template.yml

---
AWSTemplateFormatVersion: "2010-09-09"
Transform: "AWS::Serverless-2016-10-31"
Description: AWS SAM project an API for Control Tower

Parameters:
  Regions:
    Type: CommaDelimitedList
    Description: Regions to enable for Security Hub and GuardDuty
    Default: "us-east-1"

Globals:
  Function:
    Runtime: python3.8
    CodeUri: src/
    MemorySize: 128 # megabytes
    Timeout: 20 # seconds
    Tracing: Active
    Environment:
      Variables:
        POWERTOOLS_METRICS_NAMESPACE: ControlTowerAPI
        LOG_LEVEL: DEBUG

Resources:
  ApiKeySecret:
    Type: "AWS::SecretsManager::Secret"
    Properties:
      Description: "Control Tower API Key Secret"
      GenerateSecretString:
        SecretStringTemplate: "{}"
        GenerateStringKey: token
        PasswordLength: 32
        ExcludeCharacters: '"@/\'
        ExcludePunctuation: true

  # see https://docs.aws.amazon.com/controltower/latest/userguide/account-factory.html#automated-provisioning
  ControlTowerAccountFactoryPolicy:
    Type: "AWS::IAM::Policy"
    Properties:
      PolicyName: ControlTowerAccountFactoryPolicy
      PolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Sid: AWSControlTowerAccountFactoryAccess
            Effect: Allow
            Action:
              - "sso:GetProfile"
              - "sso:CreateProfile"
              - "sso:UpdateProfile"
              - "sso:AssociateProfile"
              - "sso:CreateApplicationInstance"
              - "sso:GetSSOStatus"
              - "sso:GetTrust"
              - "sso:CreateTrust"
              - "sso:UpdateTrust"
              - "sso:GetPeregrineStatus"
              - "sso:GetApplicationInstance"
              - "sso:ListDirectoryAssociations"
              - "sso:ListPermissionSets"
              - "sso:GetPermissionSet"
              - "sso:ProvisionApplicationInstanceForAWSAccount"
              - "sso:ProvisionApplicationProfileForAWSAccountInstance"
              - "sso:ProvisionSAMLProvider"
              - "sso:ListProfileAssociations"
              - "sso-directory:ListMembersInGroup"
              - "sso-directory:AddMemberToGroup"
              - "sso-directory:SearchGroups"
              - "sso-directory:SearchGroupsWithGroupName"
              - "sso-directory:SearchUsers"
              - "sso-directory:CreateUser"
              - "sso-directory:DescribeGroups"
              - "sso-directory:DescribeDirectory"
              - "sso-directory:GetUserPoolInfo"
              - "controltower:CreateManagedAccount"
              - "controltower:DescribeManagedAccount"
              - "controltower:DeregisterManagedAccount"
              - "s3:GetObject"
              - "organizations:describeOrganization"
              - "sso:DescribeRegisteredRegions"
            Resource: "*"
      Roles:
        - !Ref QueueProcessorFunctionRole

  AccountCreateFunction:
    Type: "AWS::Serverless::Function"
    Properties:
      Description: Create Account Lambda handler
      Environment:
        Variables:
          POWERTOOLS_SERVICE_NAME: apigw_account_create
          ACCOUNT_QUEUE_URL: !Ref AccountQueue
          SECRET_ID: !Ref ApiKeySecret
          ACCOUNT_TABLE: !Ref AccountTable
      Events:
        HttpApiEvent:
          Type: HttpApi
          Properties:
            Path: /v1/accounts
            Method: POST
      Handler: apigw_account_create.lambda_handler
      Layers:
        - !Ref DependencyLayer
      Policies:
        - AWSSecretsManagerGetSecretValuePolicy:
            SecretArn: !Ref ApiKeySecret
        - SQSSendMessagePolicy:
            QueueName: !Ref AccountQueue
        - Version: "2012-10-17"
          Statement:
            - Effect: Allow
              Action:
                - "dynamodb:DescribeTable"
                - "dynamodb:PutItem"
              Resource: !GetAtt AccountTable.Arn

  AccountTable:
    Type: "AWS::DynamoDB::Table"
    UpdateReplacePolicy: Delete
    DeletionPolicy: Delete
    Properties:
      AttributeDefinitions:
        - AttributeName: account_name
          AttributeType: S
        - AttributeName: status
          AttributeType: S
      BillingMode: PAY_PER_REQUEST
      GlobalSecondaryIndexes:
        - IndexName: AccountStatus
          KeySchema:
            - AttributeName: status
              KeyType: HASH
            - AttributeName: account_name
              KeyType: RANGE
          Projection:
            ProjectionType: KEYS_ONLY
      KeySchema:
        - AttributeName: account_name
          KeyType: HASH
      PointInTimeRecoverySpecification:
        PointInTimeRecoveryEnabled: true
      SSESpecification:
        SSEEnabled: true

  AccountQueue:
    Type: "AWS::SQS::Queue"
    Properties:
      ContentBasedDeduplication: true
      DelaySeconds: 0
      FifoQueue: true
      KmsDataKeyReusePeriodSeconds: 300 # 5 minutes (default)
      KmsMasterKeyId: alias/aws/sqs
      MaximumMessageSize: 262144 # 256 KiB (default)
      MessageRetentionPeriod: 1209600 # 14 days
      ReceiveMessageWaitTimeSeconds: 20 # long-polling
      VisibilityTimeout: 120 # 2 minutes

  AccountQueuePolicy:
    Type: "AWS::SQS::QueuePolicy"
    Properties:
      PolicyDocument:
        Statement:
          - Effect: Allow
            Principal:
              AWS: !GetAtt AccountCreateFunctionRole.Arn
            Action: "sqs:SendMessage"
            Resource: !GetAtt AccountQueue.Arn
          - Effect: Allow
            Principal:
              AWS: !GetAtt QueueProcessorFunctionRole.Arn
            Action:
              - "sqs:DeleteMessage"
              - "sqs:GetQueueAttributes"
              - "sqs:ReceiveMessage"
            Resource: !GetAtt AccountQueue.Arn
      Queues:
        - !Ref AccountQueue

  QueueProcessorRolePolicy:
    Type: "AWS::IAM::Policy"
    Properties:
      PolicyName: QueueProcessorRolePolicy
      PolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Action: "iam:GetRole"
            Resource: !GetAtt QueueProcessorFunctionRole.Arn
      Roles:
        - !Ref QueueProcessorFunctionRole

  QueueProcessorFunction:
    Type: "AWS::Serverless::Function"
    Properties:
      Description: Queue Processor Lambda handler
      Environment:
        Variables:
          POWERTOOLS_SERVICE_NAME: sqs_processor
          LAMBDA_ROLE_ARN: !GetAtt QueueProcessorFunctionRole.Arn
          ACCOUNT_TABLE: !Ref AccountTable
      Events:
        SQSEvent:
          Type: SQS
          Properties:
            BatchSize: 1
            Enabled: true
            Queue: !GetAtt AccountQueue.Arn
      Handler: sqs_processor.lambda_handler
      Layers:
        - !Ref DependencyLayer
      Policies:
        - Version: "2012-10-17"
          Statement:
            - Effect: Allow
              Action:
                - "servicecatalog:ListPortfolios"
                - "servicecatalog:SearchProducts"
              Resource: "*"
            - Effect: Allow
              Action: "servicecatalog:DescribeRecord"
              Resource: "*"
              Condition:
                StringEquals:
                  "servicecatalog:accountLevel": "self"
            - Effect: Allow
              Action:
                - "servicecatalog:DescribeProduct"
                - "servicecatalog:ProvisionProduct"
              Resource: !Sub "arn:${AWS::Partition}:catalog:${AWS::Region}:${AWS::AccountId}:product/*"
            - Effect: Allow
              Action: "servicecatalog:AssociatePrincipalWithPortfolio"
              Resource: !Sub "arn:${AWS::Partition}:catalog:${AWS::Region}:${AWS::AccountId}:portfolio/*"
            - Effect: Allow
              Action:
                - "dynamodb:DescribeTable"
                - "dynamodb:GetItem"
                - "dynamodb:Query"
                - "dynamodb:UpdateItem"
              Resource:
                - !GetAtt AccountTable.Arn
                - !Sub "${AccountTable.Arn}/index/*"
      Timeout: 10 # seconds

  AccountStatusFunction:
    Type: "AWS::Serverless::Function"
    Properties:
      Description: Account Status Lambda handler
      Environment:
        Variables:
          POWERTOOLS_SERVICE_NAME: apigw_account_status
          SECRET_ID: !Ref ApiKeySecret
      Events:
        HttpApiEvent:
          Type: HttpApi
          Properties:
            Path: "/v1/accounts/{accountName}"
            Method: GET
      Handler: apigw_account_status.lambda_handler
      Layers:
        - !Ref DependencyLayer
      Policies:
        - Version: "2012-10-17"
          Statement:
            - Effect: Allow
              Action:
                - "dynamodb:DescribeTable"
                - "dynamodb:GetItem"
              Resource: !GetAtt AccountTable.Arn

  AccountDeleteFunction:
    Type: "AWS::Serverless::Function"
    Properties:
      Description: Account Delete Lambda handler
      Environment:
        Variables:
          POWERTOOLS_SERVICE_NAME: apigw_account_delete
          SECRET_ID: !Ref ApiKeySecret
      Events:
        HttpApiEvent:
          Type: HttpApi
          Properties:
            Path: "/v1/accounts/{accountName}"
            Method: DELETE
      Handler: apigw_account_delete.lambda_handler
      Layers:
        - !Ref DependencyLayer
      Policies:
        - Version: "2012-10-17"
          Statement:
            - Effect: Allow
              Action:
                - "dynamodb:DescribeTable"
                - "dynamodb:GetItem"
                - "dynamodb:DeleteItem"
              Resource: !GetAtt AccountTable.Arn

  InvokeCallbackFunction:
    Type: "AWS::Serverless::Function"
    Properties:
      Description: Invoke Callback Lambda handler
      Environment:
        Variables:
          POWERTOOLS_SERVICE_NAME: eb_invoke_callback
          ACCOUNT_TABLE: !Ref AccountTable
      Events:
        EventBridgeEvent:
          Type: EventBridgeRule
          Properties:
            InputPath: "$.detail.serviceEventDetails.createManagedAccountStatus"
            Pattern:
              source:
                - "aws.controltower"
              "detail-type":
                - "AWS Service Event via CloudTrail"
              detail:
                eventName:
                  - CreateManagedAccount
      Layers:
        - !Ref DependencyLayer
      Handler: eb_invoke_callback.lambda_handler
      Policies:
        - Version: "2012-10-17"
          Statement:
            - Effect: Allow
              Action:
                - "dynamodb:DescribeTable"
                - "dynamodb:GetItem"
                - "dynamodb:UpdateItem"
              Resource: !GetAtt AccountTable.Arn

  S3PublicBlockFunction:
    Type: "AWS::Serverless::Function"
    Properties:
      CodeUri: functions/s3_public_block
      Description: S3 Public Block Lambda handler
      Environment:
        Variables:
          POWERTOOLS_SERVICE_NAME: s3_public_block
      Layers:
        - !Ref DependencyLayer
      Handler: lambda_handler.handler

  DeleteDefaultVpcFunction:
    Type: "AWS::Serverless::Function"
    Properties:
      CodeUri: functions/delete_default_vpc
      Description: Delete Default VPC Lambda handler
      Environment:
        Variables:
          POWERTOOLS_SERVICE_NAME: delete_default_vpc
      Layers:
        - !Ref DependencyLayer
      Handler: lambda_handler.handler
      MemorySize: 1024 # megabytes
      Policies:
        - Version: "2012-10-17"
          Statement:
            - Effect: Allow
              Action: "ec2:DescribeRegions"
              Resource: "*"
      Timeout: 300 # 5 minutes

  Route53QueryLogsFunction:
    Type: "AWS::Serverless::Function"
    Properties:
      CodeUri: functions/route53_query_logs
      Description: Route53 Query Logs Lambda handler
      Environment:
        Variables:
          POWERTOOLS_SERVICE_NAME: route53_query_logs
      Layers:
        - !Ref DependencyLayer
      Handler: lambda_handler.handler

  EnableSecurityHubFunction:
    Type: "AWS::Serverless::Function"
    Properties:
      CodeUri: functions/enable_security_hub
      Description: Enable Security Hub Lambda handler
      Environment:
        Variables:
          POWERTOOLS_SERVICE_NAME: enable_security_hub
          REGIONS: !Join [",", !Ref Regions]
      Layers:
        - !Ref DependencyLayer
      Handler: lambda_handler.handler
      MemorySize: 1024 # megabytes
      Policies:
        - Version: "2012-10-17"
          Statement:
            - Effect: Allow
              Action:
                - "ec2:DescribeRegions"
                - "organizations:DescribeAccount"
                - "organizations:ListAccounts"
              Resource: "*"
      Timeout: 300 # 5 minutes

  ControlTowerAssumePolicy:
    Type: "AWS::IAM::Policy"
    Properties:
      PolicyName: ControlTowerAssumePolicy
      PolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Action: "sts:AssumeRole"
            Resource: !Sub "arn:${AWS::Partition}:iam::*:role/AWSControlTowerExecution"
      Roles:
        - !Ref S3PublicBlockFunctionRole
        - !Ref DeleteDefaultVpcFunctionRole
        - !Ref Route53QueryLogsFunctionRole
        - !Ref EnableSecurityHubFunctionRole

  DependencyLayer:
    Type: "AWS::Serverless::LayerVersion"
    Properties:
      CompatibleRuntimes:
        - python3.8
      ContentUri: dependencies
      LicenseInfo: MIT
      RetentionPolicy: Delete
    Metadata:
      BuildMethod: python3.8

  StateMachine:
    Type: "AWS::Serverless::StateMachine"
    Properties:
      Definition:
        StartAt: ProvisionAccount
        States:
          ProvisionAccount:
            Type: Parallel
            End: true
            Branches:
              - StartAt: S3PublicBlock
                States:
                  S3PublicBlock:
                    Type: Task
                    Resource: !GetAtt S3PublicBlockFunction.Arn
                    Retry:
                      - ErrorEquals:
                          - ThrottlingException
                          - "Lambda.ServiceException"
                          - "Lambda.AWSLambdaException"
                          - "Lambda.SdkClientException"
                        IntervalSeconds: 2
                        MaxAttempts: 6
                        BackoffRate: 2
                    TimeoutSeconds: 20
                    End: true
              - StartAt: DeleteDefaultVpc
                States:
                  DeleteDefaultVpc:
                    Type: Task
                    Resource: !GetAtt DeleteDefaultVpcFunction.Arn
                    Retry:
                      - ErrorEquals:
                          - ThrottlingException
                          - "Lambda.ServiceException"
                          - "Lambda.AWSLambdaException"
                          - "Lambda.SdkClientException"
                        IntervalSeconds: 2
                        MaxAttempts: 6
                        BackoffRate: 2
                    TimeoutSeconds: 300 # 5 minutes
                    End: true
              - StartAt: Route53QueryLogs
                States:
                  Route53QueryLogs:
                    Type: Task
                    Resource: !GetAtt Route53QueryLogsFunction.Arn
                    Retry:
                      - ErrorEquals:
                          - ThrottlingException
                          - "Lambda.ServiceException"
                          - "Lambda.AWSLambdaException"
                          - "Lambda.SdkClientException"
                        IntervalSeconds: 2
                        MaxAttempts: 6
                        BackoffRate: 2
                    TimeoutSeconds: 300 # 5 minutes
                    End: true
              - StartAt: EnableSecurityHub
                States:
                  EnableSecurityHub:
                    Type: Task
                    Resource: !GetAtt EnableSecurityHubFunction.Arn
                    Retry:
                      - ErrorEquals:
                          - ThrottlingException
                          - "Lambda.ServiceException"
                          - "Lambda.AWSLambdaException"
                          - "Lambda.SdkClientException"
                        IntervalSeconds: 2
                        MaxAttempts: 6
                        BackoffRate: 2
                    TimeoutSeconds: 300 # 5 minutes
                    End: true
      Events:
        EventBridgeEvent:
          Type: EventBridgeRule
          Properties:
            InputPath: "$.detail.serviceEventDetails.createManagedAccountStatus"
            Pattern:
              source:
                - "aws.controltower"
              "detail-type":
                - "AWS Service Event via CloudTrail"
              detail:
                eventName:
                  - CreateManagedAccount
                serviceEventDetails:
                  createManagedAccountStatus:
                    state:
                      - SUCCEEDED
      Policies:
        - Version: "2012-10-17"
          Statement:
            - Effect: Allow
              Action: "lambda:InvokeFunction"
              Resource:
                - !GetAtt DeleteDefaultVpcFunction.Arn
                - !GetAtt S3PublicBlockFunction.Arn
                - !GetAtt Route53QueryLogsFunction.Arn
                - !GetAtt EnableSecurityHubFunction.Arn
      #Tracing:
      #  Enabled: true
      Type: STANDARD

Outputs:
  ApiUrl:
    Description: API endpoint URL
    Value: !Sub "https://${ServerlessHttpApi}.execute-api.${AWS::Region}.amazonaws.com"