########################################################################
# Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
# SPDX-License-Identifier: MIT-0
########################################################################
AWSTemplateFormatVersion: 2010-09-09
Description:
  This template deploys a Lambda function that enables the EC2 default ebs encryption in each account and region. - 'ec2_default_ebs_encryption'
  solution in the repo, https://github.com/aws-samples/aws-security-reference-architecture-examples (sra-1ssgnse40)

Metadata:
  SRA:
    Version: 1.3
    Order: 3
  AWS::CloudFormation::Interface:
    ParameterGroups:
      - Label:
          default: General Properties
        Parameters:
          - pSRASolutionName
          - pSRAStagingS3BucketName
          - pSRAAlarmEmail

      - Label:
          default: Lambda Function Properties
        Parameters:
          - pEC2DefaultEBSEncryptionLambdaFunctionName
          - pEC2DefaultEBSEncryptionLambdaRoleName
          - pOrganizationId

      - Label:
          default: Custom Resource Properties
        Parameters:
          - pControlTowerRegionsOnly
          - pEnabledRegions
          - pEC2DefaultEBSEncryptionRoleName
          - pExcludeEC2DefaultEBSEncryptionTags

      - Label:
          default: General Lambda Function Properties
        Parameters:
          - pCreateLambdaLogGroup
          - pLambdaLogGroupRetention
          - pLambdaLogGroupKmsKey
          - pLambdaLogLevel

      - Label:
          default: EventBridge Rule Properties
        Parameters:
          - pComplianceFrequency
          - pControlTowerLifeCycleRuleName
          - pEventRuleRoleName

    ParameterLabels:
      pComplianceFrequency:
        default: Frequency to Check for Organizational Compliance
      pControlTowerLifeCycleRuleName:
        default: Control Tower Lifecycle Rule Name
      pCreateLambdaLogGroup:
        default: Create Lambda Log Group
      pEC2DefaultEBSEncryptionLambdaFunctionName:
        default: Lambda Function Name
      pEC2DefaultEBSEncryptionLambdaRoleName:
        default: Lambda Role Name
      pEC2DefaultEBSEncryptionRoleName:
        default: EC2 Enable Default Encryption Role Name
      pEnabledRegions:
        default: Enabled Regions
      pEventRuleRoleName:
        default: Event Rule Role Name
      pExcludeEC2DefaultEBSEncryptionTags:
        default: (Optional) Exclude EC2 Default EBS Encryption Tags
      pLambdaLogGroupKmsKey:
        default: (Optional) Lambda Logs KMS Key
      pLambdaLogGroupRetention:
        default: Lambda Log Group Retention
      pLambdaLogLevel:
        default: Lambda Log Level
      pManagementAccountId:
        default: Management Account ID
      pOrganizationId:
        default: Organization ID
      pSRAAlarmEmail:
        default: (Optional) SRA Alarm Email
      pSRASolutionName:
        default: SRA Solution Name
      pSRAStagingS3BucketName:
        default: SRA Staging S3 Bucket Name

Parameters:
  pComplianceFrequency:
    ConstraintDescription: Compliance Frequency must be a number between 1 and 30, inclusive.
    Default: 7
    Description: Frequency (in days between 1 and 30, default is 7) to check organizational compliance
    MinValue: 1
    MaxValue: 30
    Type: Number
  pControlTowerLifeCycleRuleName:
    AllowedPattern: '^[\w.-]{1,64}$'
    ConstraintDescription: Max 64 alphanumeric and underscore characters. Also special characters supported [., -]
    Default: sra-ec2-default-ebs-encryption-trigger
    Description: The name of the AWS Control Tower Life Cycle Rule.
    Type: String
  pControlTowerRegionsOnly:
    Type: String
    Description: Only enable in the Control Tower governed regions
    Default: true
    AllowedValues: [true, false]
  pCreateLambdaLogGroup:
    AllowedValues: [true, false]
    Default: false
    Description:
      Indicates whether a CloudWatch Log Group should be explicitly created for the Lambda function, to allow for setting a Log Retention and/or KMS
      Key for encryption.
    Type: String
  pEC2DefaultEBSEncryptionLambdaFunctionName:
    AllowedPattern: '^[\w-]{0,64}$'
    ConstraintDescription: Max 64 alphanumeric characters. Also special characters supported [_, -]
    Default: sra-ec2-default-ebs-encryption
    Type: String
  pEC2DefaultEBSEncryptionLambdaRoleName:
    AllowedPattern: '^[\w+=,.@-]{1,64}$'
    ConstraintDescription: Max 64 alphanumeric characters. Also special characters supported [+, =, ., @, -]
    Default: sra-ec2-default-ebs-encryption-lambda
    Description: EC2 Default EBS Encryption Lambda Role Name
    Type: String
  pEC2DefaultEBSEncryptionRoleName:
    AllowedPattern: '^[\w+=,.@-]{1,64}$'
    ConstraintDescription: Max 64 alphanumeric characters. Also special characters supported [+, =, ., @, -]
    Default: sra-ec2-default-ebs-encryption
    Description: EC2 Default EBS Encryption Role Name
    Type: String
  pEnabledRegions:
    AllowedPattern: '^$|^([a-z0-9-]{1,64})$|^(([a-z0-9-]{1,64},)*[a-z0-9-]{1,64})$'
    ConstraintDescription:
      Only lowercase letters, numbers, and hyphens ('-') allowed. (e.g. us-east-1) Additional AWS regions can be provided, separated by commas. (e.g.
      us-east-1,ap-southeast-2)
    Default: ''
    Description:
      (Optional) If Control Tower Regions Only = false, list the regions to enable (AWS regions, separated by commas). Leave blank to enable all
      regions. Regions must be enabled in all accounts within the AWS Organization.
    Type: String
  pEventRuleRoleName:
    AllowedPattern: '^[\w+=,.@-]{1,64}$'
    ConstraintDescription: Max 64 alphanumeric characters. Also special characters supported [+, =, ., @, -].
    Default: sra-ec2-default-ebs-encryption-global-events
    Description: Event rule role name for putting events on the home region event bus
    Type: String
  pExcludeEC2DefaultEBSEncryptionTags:
    AllowedPattern: '^$|.*'
    Description:
      '(Optional) Resource Tags that denote an Account should be excluded from this solution in JSON format: [{"Key": "string", "Value": "string"},
      ... ]. For example, [{"Key": "exclude-ec2-default-ebs-encryption", "Value": "true"}].'
    Type: String
  pLambdaLogGroupKmsKey:
    AllowedPattern: '^$|^arn:(aws[a-zA-Z-]*){1}:kms:[a-z0-9-]+:\d{12}:key\/[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$'
    ConstraintDescription: 'Key ARN example:  arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab'
    Default: ''
    Description:
      (Optional) KMS Key ARN to use for encrypting the Lambda logs data. If empty, encryption is enabled with CloudWatch Logs managing the server-side
      encryption keys.
    Type: String
  pLambdaLogGroupRetention:
    AllowedValues: [1, 3, 5, 7, 14, 30, 60, 90, 120, 150, 180, 365, 400, 545, 731, 1827, 3653]
    Default: 14
    Description: Specifies the number of days you want to retain log events
    Type: String
  pLambdaLogLevel:
    AllowedValues: [DEBUG, INFO, ERROR]
    Default: INFO
    Description: Lambda Function Logging Level
    Type: String
  pManagementAccountId:
    AllowedPattern: '^\d{12}$'
    ConstraintDescription:
      Must be alphanumeric or special characters [., _, -]. In addition, the slash character ( / ) used to delineate hierarchies in parameter names.
    Description: AWS Account ID of the Control Tower Management account.
    Type: String
  pOrganizationId:
    AllowedPattern: '^o-[a-z0-9]{10,32}$'
    ConstraintDescription: Must start with 'o-' followed by from 10 to 32 lowercase letters or digits. (e.g. o-abc1234567)
    Description: AWS Organizations ID
    Type: String
  pSRAAlarmEmail:
    AllowedPattern: '^$|^([a-zA-Z0-9_.+-]+@[a-zA-Z0-9-]+\.[a-zA-Z0-9-.]+)$'
    ConstraintDescription: Email Validation as per RFC2822 standards.
    Default: ''
    Description:
      (Optional) Email address for receiving DLQ alarms. If empty, CloudWatch Alarm will not be created to notify when the DLQ has a queue depth of 1.
    Type: String
  pSRASolutionName:
    AllowedValues: [sra-ec2-default-ebs-encryption]
    Default: sra-ec2-default-ebs-encryption
    Description: The SRA solution name. The default value is the folder name of the solution
    Type: String
  pSRAStagingS3BucketName:
    AllowedPattern: '^(?=^.{3,63}$)(?!.*[.-]{2})(?!.*[--]{2})(?!^(?:(25[0-5]|2[0-4][0-9]|1[0-9]{2}|[1-9]?[0-9])(\.(?!$)|$)){4}$)(^(([a-z0-9]|[a-z0-9][a-z0-9\-]*[a-z0-9])\.)*([a-z0-9]|[a-z0-9][a-z0-9\-]*[a-z0-9])$)'
    ConstraintDescription:
      SRA Staging S3 bucket name can include numbers, lowercase letters, uppercase letters, and hyphens (-). It cannot start or end with a hyphen (-).
    Description:
      SRA Staging S3 bucket name for the artifacts relevant to solution. (e.g., lambda zips, CloudFormation templates) S3 bucket name can include
      numbers, lowercase letters, uppercase letters, and hyphens (-). It cannot start or end with a hyphen (-).
    Type: String

Conditions:
  cComplianceFrequencySingleDay: !Equals [!Ref pComplianceFrequency, 1]
  cCreateDLQAlarm: !Not [!Equals [!Ref pSRAAlarmEmail, '']]
  cCreateLambdaLogGroup: !Equals [!Ref pCreateLambdaLogGroup, 'true']
  cNotGlobalRegionUsEast1: !Not [!Equals [!Ref 'AWS::Region', us-east-1]]
  cUseGraviton: !Or
    - !Equals [!Ref 'AWS::Region', ap-northeast-1]
    - !Equals [!Ref 'AWS::Region', ap-south-1]
    - !Equals [!Ref 'AWS::Region', ap-southeast-1]
    - !Equals [!Ref 'AWS::Region', ap-southeast-2]
    - !Equals [!Ref 'AWS::Region', eu-central-1]
    - !Equals [!Ref 'AWS::Region', eu-west-1]
    - !Equals [!Ref 'AWS::Region', eu-west-2]
    - !Equals [!Ref 'AWS::Region', us-east-1]
    - !Equals [!Ref 'AWS::Region', us-east-2]
    - !Equals [!Ref 'AWS::Region', us-west-2]
  cUseKmsKey: !Not [!Equals [!Ref pLambdaLogGroupKmsKey, '']]

Resources:
  rEC2DefaultEBSEncryptionDLQ:
    Type: AWS::SQS::Queue
    Properties:
      KmsMasterKeyId: alias/aws/sqs
      QueueName: !Sub ${pSRASolutionName}-dlq
      Tags:
        - Key: sra-solution
          Value: !Ref pSRASolutionName

  rEC2DefaultEBSEncryptionDLQAlarm:
    Type: AWS::CloudWatch::Alarm
    Condition: cCreateDLQAlarm
    Properties:
      AlarmDescription: SRA DLQ alarm if the queue depth is 1
      Namespace: AWS/SQS
      MetricName: ApproximateNumberOfMessagesVisible
      Dimensions:
        - Name: QueueName
          Value: !GetAtt rEC2DefaultEBSEncryptionDLQ.QueueName
      Statistic: Sum
      Period: 300
      EvaluationPeriods: 1
      Threshold: 1
      ComparisonOperator: GreaterThanThreshold
      AlarmActions:
        - !Ref rEC2DefaultEBSEncryptionDLQAlarmTopic
      InsufficientDataActions:
        - !Ref rEC2DefaultEBSEncryptionDLQAlarmTopic

  rEC2DefaultEBSEncryptionDLQAlarmTopic:
    Type: AWS::SNS::Topic
    Condition: cCreateDLQAlarm
    Properties:
      DisplayName: !Sub ${pSRASolutionName}-dlq-alarm
      KmsMasterKeyId: !Sub arn:${AWS::Partition}:kms:${AWS::Region}:${AWS::AccountId}:alias/aws/sns
      TopicName: !Sub ${pSRASolutionName}-dlq-alarm
      Subscription:
        - Endpoint: !Ref pSRAAlarmEmail
          Protocol: email
      Tags:
        - Key: sra-solution
          Value: !Ref pSRASolutionName

  rEC2DefaultEBSEncryptionDLQPolicy:
    Type: AWS::SQS::QueuePolicy
    Properties:
      Queues:
        - !Ref rEC2DefaultEBSEncryptionDLQ
      PolicyDocument:
        Statement:
          - Effect: Allow
            Action: SQS:SendMessage
            Condition:
              ArnEquals:
                aws:SourceArn:
                  - !GetAtt rEC2DefaultEBSEncryptionLambdaFunction.Arn
            Resource:
              - !GetAtt rEC2DefaultEBSEncryptionDLQ.Arn
            Principal:
              Service: events.amazonaws.com

  rEC2DefaultEBSEncryptionLambdaLogGroup:
    Type: AWS::Logs::LogGroup
    Condition: cCreateLambdaLogGroup
    DeletionPolicy: Retain
    UpdateReplacePolicy: Retain
    Properties:
      KmsKeyId: !If
        - cUseKmsKey
        - !Ref pLambdaLogGroupKmsKey
        - !Ref AWS::NoValue
      LogGroupName: !Sub '/aws/lambda/${pEC2DefaultEBSEncryptionLambdaFunctionName}'
      RetentionInDays: !Ref pLambdaLogGroupRetention

  rEC2DefaultEBSEncryptionLambdaRole:
    Type: AWS::IAM::Role
    Metadata:
      cfn_nag:
        rules_to_suppress:
          - id: W11
            reason: service actions require a wildcard in the resource
          - id: W28
            reason: Using a defined role name
    Properties:
      RoleName: !Ref pEC2DefaultEBSEncryptionLambdaRoleName
      Description: !Sub SRA IAM role for ${pEC2DefaultEBSEncryptionLambdaRoleName} Lambda function
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - lambda.amazonaws.com
            Action:
              - sts:AssumeRole
      Path: '/'
      Policies:
        - PolicyName: sra-ec2-default-ebs-encryption-policy-cloudformation
          PolicyDocument:
            Version: 2012-10-17
            Statement:
              - Sid: CloudFormation
                Effect: Allow
                Action: cloudformation:ListStackInstances
                Resource: !Sub arn:${AWS::Partition}:cloudformation:${AWS::Region}:${AWS::AccountId}:stackset/AWSControlTowerBP-*

        - PolicyName: sra-ec2-default-ebs-encryption-policy-iam
          PolicyDocument:
            Version: 2012-10-17
            Statement:
              - Sid: AssumeRole
                Effect: Allow
                Action: sts:AssumeRole
                Resource: !Sub arn:${AWS::Partition}:iam::*:role/${pEC2DefaultEBSEncryptionRoleName}
                Condition:
                  StringEquals:
                    aws:PrincipalOrgId: !Ref pOrganizationId

        - PolicyName: sra-ec2-default-ebs-encryption-policy-logs
          PolicyDocument:
            Version: 2012-10-17
            Statement:
              - Sid: CreateLogStreamAndEvents
                Effect: Allow
                Action:
                  - logs:CreateLogGroup
                  - logs:CreateLogStream
                  - logs:PutLogEvents
                Resource: !Sub arn:${AWS::Partition}:logs:${AWS::Region}:${AWS::AccountId}:log-group:/aws/lambda/${pEC2DefaultEBSEncryptionLambdaFunctionName}:log-stream:*

        - PolicyName: sra-ec2-default-ebs-encryption-policy-organizations
          PolicyDocument:
            Version: 2012-10-17
            Statement:
              - Sid: OrganizationsReadAccess
                Effect: Allow
                Action:
                  - organizations:DescribeAccount
                  - organizations:ListAccounts
                Resource: '*'

              - Sid: ListTagsForAccounts
                Effect: Allow
                Action: organizations:ListTagsForResource
                Resource: !Sub arn:${AWS::Partition}:organizations::${pManagementAccountId}:account/${pOrganizationId}/*

        - PolicyName: sra-ec2-default-ebs-encryption-policy-sns
          PolicyDocument:
            Version: 2012-10-17
            Statement:
              - Sid: SNSPublish
                Effect: Allow
                Action:
                  - sns:Publish
                  - sns:PublishBatch
                Resource: !Ref rEC2DefaultEBSEncryptionTopic

        - PolicyName: sra-ec2-default-ebs-encryption-policy-sqs
          PolicyDocument:
            Version: 2012-10-17
            Statement:
              - Sid: SQSSendMessage
                Effect: Allow
                Action: sqs:SendMessage
                Resource: !GetAtt rEC2DefaultEBSEncryptionDLQ.Arn

      Tags:
        - Key: sra-solution
          Value: !Ref pSRASolutionName

  rEC2DefaultEBSEncryptionLambdaFunction:
    Type: AWS::Lambda::Function
    Metadata:
      cfn_nag:
        rules_to_suppress:
          - id: W58
            reason: Role provides access to CloudWatch.
          - id: W89
            reason: Lambda function does not access resources inside a VPC.
          - id: W92
            reason: Lambda does not need reserved concurrent executions.
      checkov:
        skip:
          - id: CKV_AWS_115
            comment: Lambda does not need reserved concurrent executions.
          - id: CKV_AWS_117
            comment: Lambda does not need to communicate with VPC resources.
          - id: CKV_AWS_173
            comment: Environment variables are not sensitive.
    Properties:
      FunctionName: !Ref pEC2DefaultEBSEncryptionLambdaFunctionName
      Description: SRA Set the EC2 Default EBS encryption account setting
      Architectures: !If
        - cUseGraviton
        - [arm64]
        - !Ref AWS::NoValue
      Handler: app.lambda_handler
      Role: !GetAtt rEC2DefaultEBSEncryptionLambdaRole.Arn
      Runtime: python3.9
      Timeout: 900
      Code:
        S3Bucket: !Ref pSRAStagingS3BucketName
        S3Key: !Sub ${pSRASolutionName}/lambda_code/${pSRASolutionName}.zip
      DeadLetterConfig:
        TargetArn: !GetAtt rEC2DefaultEBSEncryptionDLQ.Arn
      Environment:
        Variables:
          LOG_LEVEL: !Ref pLambdaLogLevel
          CONFIGURATION_ROLE_NAME: !Ref pEC2DefaultEBSEncryptionRoleName
          CONTROL_TOWER_REGIONS_ONLY: !Ref pControlTowerRegionsOnly
          ENABLED_REGIONS: !Ref pEnabledRegions
          EXCLUDE_ACCOUNT_TAGS: !Ref pExcludeEC2DefaultEBSEncryptionTags
          ROLE_SESSION_NAME: sra-ec2-default-ebs-encryption
          SNS_TOPIC_ARN: !Ref rEC2DefaultEBSEncryptionTopic
      Tags:
        - Key: sra-solution
          Value: !Ref pSRASolutionName

  rEC2DefaultEBSEncryptionLambdaCustomResource:
    Type: Custom::LambdaCustomResource
    Version: '1.0'
    Properties:
      ServiceToken: !GetAtt rEC2DefaultEBSEncryptionLambdaFunction.Arn
      CONFIGURATION_ROLE_NAME: !Ref pEC2DefaultEBSEncryptionRoleName
      CONTROL_TOWER_REGIONS_ONLY: !Ref pControlTowerRegionsOnly
      ENABLED_REGIONS: !Ref pEnabledRegions
      EXCLUDE_ACCOUNT_TAGS: !Ref pExcludeEC2DefaultEBSEncryptionTags
      ROLE_SESSION_NAME: sra-ec2-default-ebs-encryption
      SNS_TOPIC_ARN: !Ref rEC2DefaultEBSEncryptionTopic

  rEC2DefaultEBSEncryptionTopic:
    Type: AWS::SNS::Topic
    Properties:
      DisplayName: !Sub ${pSRASolutionName}-configuration
      KmsMasterKeyId: !Sub arn:${AWS::Partition}:kms:${AWS::Region}:${AWS::AccountId}:alias/aws/sns
      Tags:
        - Key: sra-solution
          Value: !Ref pSRASolutionName

  rEC2DefaultEBSEncryptionTopicLambdaPermission:
    Type: AWS::Lambda::Permission
    Properties:
      Action: lambda:InvokeFunction
      FunctionName: !GetAtt rEC2DefaultEBSEncryptionLambdaFunction.Arn
      Principal: sns.amazonaws.com
      SourceArn: !Ref rEC2DefaultEBSEncryptionTopic

  rEC2DefaultEBSEncryptionTopicSubscription:
    Type: AWS::SNS::Subscription
    Properties:
      Endpoint: !GetAtt rEC2DefaultEBSEncryptionLambdaFunction.Arn
      Protocol: lambda
      TopicArn: !Ref rEC2DefaultEBSEncryptionTopic

  rOrganizationsRule:
    Type: AWS::Events::Rule
    Properties:
      Name: !Sub ${pControlTowerLifeCycleRuleName}-org-update
      Description: SRA EC2 Default EBS Encryption Trigger on Organizations update
      EventPattern:
        source:
          - aws.organizations
        detail-type:
          - AWS API Call via CloudTrail
        detail:
          eventSource:
            - organizations.amazonaws.com
          eventName:
            - AcceptHandshake
            - CreateAccountResult
            - TagResource
      State: ENABLED
      Targets:
        - Arn: !GetAtt rEC2DefaultEBSEncryptionLambdaFunction.Arn
          Id: !Ref pEC2DefaultEBSEncryptionLambdaFunctionName

  rControlTowerLifeCycleRule:
    Type: AWS::Events::Rule
    Properties:
      Name: !Ref pControlTowerLifeCycleRuleName
      Description: SRA EC2 Default EBS Encryption Control Tower Life Cycle Trigger (triggers on new Control Tower vended accounts)
      EventPattern:
        source:
          - aws.controltower
        detail-type:
          - AWS Service Event via CloudTrail
        detail:
          eventName:
            - CreateManagedAccount
            - UpdateManagedAccount
      State: ENABLED
      Targets:
        - Arn: !GetAtt rEC2DefaultEBSEncryptionLambdaFunction.Arn
          Id: !Ref pEC2DefaultEBSEncryptionLambdaFunctionName

  rPermissionForControlTowerRuleToInvokeLambda:
    Type: AWS::Lambda::Permission
    Properties:
      FunctionName: !GetAtt rEC2DefaultEBSEncryptionLambdaFunction.Arn
      Action: lambda:InvokeFunction
      Principal: events.amazonaws.com
      SourceArn: !GetAtt rControlTowerLifeCycleRule.Arn

  rPermissionForOrganizationsRuleToInvokeLambda:
    Type: AWS::Lambda::Permission
    Properties:
      FunctionName: !GetAtt rEC2DefaultEBSEncryptionLambdaFunction.Arn
      Action: lambda:InvokeFunction
      Principal: events.amazonaws.com
      SourceArn: !GetAtt rOrganizationsRule.Arn

  rPermissionForScheduledComplianceRuleToInvokeLambda:
    Type: AWS::Lambda::Permission
    Properties:
      FunctionName: !GetAtt rEC2DefaultEBSEncryptionLambdaFunction.Arn
      Action: lambda:InvokeFunction
      Principal: events.amazonaws.com
      SourceArn: !GetAtt rScheduledComplianceRule.Arn

  rScheduledComplianceRule:
    Type: AWS::Events::Rule
    Properties:
      Name: !Sub ${pControlTowerLifeCycleRuleName}-org-compliance
      Description: SRA EC2 Default EBS Encryption Trigger for scheduled organization compliance
      ScheduleExpression: !If
        - cComplianceFrequencySingleDay
        - !Sub rate(${pComplianceFrequency} day)
        - !Sub rate(${pComplianceFrequency} days)
      State: ENABLED
      Targets:
        - Arn: !GetAtt rEC2DefaultEBSEncryptionLambdaFunction.Arn
          Id: !Ref pEC2DefaultEBSEncryptionLambdaFunctionName

  rCrossRegionEventRuleRole:
    Type: AWS::IAM::Role
    Condition: cNotGlobalRegionUsEast1
    Metadata:
      cfn_nag:
        rules_to_suppress:
          - id: W28
            reason: Specific role name provided
    Properties:
      RoleName: !Ref pEventRuleRoleName
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Action: sts:AssumeRole
            Principal:
              Service:
                - events.amazonaws.com
      Policies:
        - PolicyName: sra-ec2-default-ebs-encryption-policy-events
          PolicyDocument:
            Version: 2012-10-17
            Statement:
              - Effect: Allow
                Action: events:PutEvents
                Resource: !Sub arn:${AWS::Partition}:events:${AWS::Region}:${AWS::AccountId}:event-bus/default

Outputs:
  oControlTowerLifeCycleRule:
    Description: SRA Control Tower Life Cycle Rule ARN
    Value: !GetAtt rControlTowerLifeCycleRule.Arn
  oEC2DefaultEBSEncryptionLambdaFunctionArn:
    Description: SRA EC2 Default EBS Encryption Lambda Function ARN
    Value: !GetAtt rEC2DefaultEBSEncryptionLambdaFunction.Arn
  oEC2DefaultEBSEncryptionLambdaLogGroupArn:
    Condition: cCreateLambdaLogGroup
    Description: SRA EC2 Default EBS Encryption Lambda Log Group ARN
    Value: !GetAtt rEC2DefaultEBSEncryptionLambdaLogGroup.Arn
  oEC2DefaultEBSEncryptionLambdaRoleArn:
    Description: SRA EC2 Default EBS Encryption Lambda Role ARN
    Value: !GetAtt rEC2DefaultEBSEncryptionLambdaRole.Arn