########################################################################
# Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
# SPDX-License-Identifier: MIT-0
########################################################################
AWSTemplateFormatVersion: 2010-09-09
Description:
  This template creates a custom resource to configure Macie within the delegated administrator account and each member account. - 'macie_org'
  solution in the repo, https://github.com/aws-samples/aws-security-reference-architecture-examples (sra-1ssgnse5m)

Metadata:
  SRA:
    Version: 1.2
    Order: 5
  AWS::CloudFormation::Interface:
    ParameterGroups:
      - Label:
          default: General Properties
        Parameters:
          - pSRASolutionName
          - pSRAAlarmEmail

      - Label:
          default: Lambda Function Properties
        Parameters:
          - pMacieOrgLambdaRoleName
          - pMacieOrgLambdaFunctionName
          - pOrganizationId

      - Label:
          default: Custom Resource Properties
        Parameters:
          - pDisableMacie
          - pMacieOrgConfigurationRoleName
          - pControlTowerRegionsOnly
          - pDelegatedAdminAccountId
          - pDisableMacieRoleName
          - pEnabledRegions
          - pFindingPublishingFrequency
          - pKMSKeyArn
          - pPublishingDestinationBucketName

      - Label:
          default: General Lambda Function Properties
        Parameters:
          - pCreateLambdaLogGroup
          - pLambdaLogGroupRetention
          - pLambdaLogGroupKmsKey
          - pLambdaLogLevel

    ParameterLabels:
      pControlTowerRegionsOnly:
        default: Control Tower Regions Only
      pCreateLambdaLogGroup:
        default: Create Lambda Log Group
      pDelegatedAdminAccountId:
        default: Delegated Admin Account ID
      pDisableMacie:
        default: Disable Macie in All Accounts
      pDisableMacieRoleName:
        default: Disable Macie Role Name
      pEnabledRegions:
        default: Enabled Regions
      pFindingPublishingFrequency:
        default: Finding Publishing Frequency
      pKMSKeyArn:
        default: KMS Key ARN
      pLambdaLogGroupKmsKey:
        default: (Optional) Lambda Logs KMS Key
      pLambdaLogGroupRetention:
        default: Lambda Log Group Retention
      pLambdaLogLevel:
        default: Lambda Log Level
      pMacieOrgConfigurationRoleName:
        default: Configuration Role Name
      pMacieOrgLambdaFunctionName:
        default: Lambda Function Name
      pMacieOrgLambdaRoleName:
        default: Lambda Execution Role Name
      pOrganizationId:
        default: Organization ID
      pPublishingDestinationBucketName:
        default: Macie classification export S3 Bucket Name
      pSRAAlarmEmail:
        default: (Optional) SRA Alarm Email
      pSRASolutionName:
        default: SRA Solution Name
      pSRAStagingS3BucketName:
        default: SRA Staging S3 Bucket Name

Parameters:
  pControlTowerRegionsOnly:
    Type: String
    Description: Only enable in the Control Tower governed regions
    Default: 'true'
    AllowedValues: ['true', 'false']
  pCreateLambdaLogGroup:
    AllowedValues: ['true', 'false']
    Default: 'false'
    Description:
      Indicates whether a CloudWatch Log Group should be explicitly created for the Lambda function, to allow for setting a Log Retention and/or KMS
      Key for encryption.
    Type: String
  pDelegatedAdminAccountId:
    AllowedPattern: '^\d{12}$'
    ConstraintDescription: Must be 12 digits
    Description: Delegated administrator account ID
    Type: String
  pDisableMacie:
    AllowedValues: ['true', 'false']
    Default: 'false'
    Description: Update to 'true' to disable Macie in all accounts and regions before deleting the stack.
    Type: String
  pDisableMacieRoleName:
    AllowedPattern: '^[\w+=,.@-]{1,64}$'
    ConstraintDescription: Max 64 alphanumeric characters. Also special characters supported [+, =, ., @, -]
    Default: sra-macie-org-disable
    Description: Role to assume in each account to disable Macie
    Type: String
  pEnabledRegions:
    AllowedPattern: '^$|^([a-z0-9-]{1,64})$|^(([a-z0-9-]{1,64},)*[a-z0-9-]{1,64})$'
    ConstraintDescription:
      Only lowercase letters, numbers, and hyphens ('-') allowed. (e.g. us-east-1) Additional AWS regions can be provided, separated by commas. (e.g.
      us-east-1,ap-southeast-2)
    Description: Enabled regions (AWS regions, separated by commas). Leave blank to enable all regions.
    Type: String
  pFindingPublishingFrequency:
    AllowedValues: [FIFTEEN_MINUTES, ONE_HOUR, SIX_HOURS]
    Default: FIFTEEN_MINUTES
    Description: Specifies how often to publish updates to policy findings for the account.
    Type: String
  pKMSKeyArn:
    AllowedPattern: '^arn:(aws[a-zA-Z-]*)?:kms:[a-z0-9-]+:\d{12}:key\/[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$'
    ConstraintDescription: 'Key ARN example:  arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab'
    Description: Logging S3 bucket KMS Key ARN
    Type: String
  pLambdaLogGroupKmsKey:
    AllowedPattern: '^$|^arn:(aws[a-zA-Z-]*){1}:kms:[a-z0-9-]+:\d{12}:key\/[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$'
    ConstraintDescription: 'Key ARN example:  arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab'
    Description:
      (Optional) KMS Key ARN to use for encrypting the Lambda logs data. If empty, encryption is enabled with CloudWatch Logs managing the server-side
      encryption keys.
    Type: String
  pLambdaLogGroupRetention:
    AllowedValues: [1, 3, 5, 7, 14, 30, 60, 90, 120, 150, 180, 365, 400, 545, 731, 1827, 3653]
    Default: 14
    Description: Specifies the number of days you want to retain log events
    Type: String
  pLambdaLogLevel:
    AllowedValues: [INFO, ERROR, DEBUG]
    Default: INFO
    Description: Lambda Function Logging Level
    Type: String
  pMacieOrgConfigurationRoleName:
    AllowedPattern: '^[\w+=,.@-]{1,64}$'
    ConstraintDescription: Max 64 alphanumeric characters. Also special characters supported [+, =, ., @, -]
    Default: sra-macie-org-configuration
    Description: Macie Configuration role to assume in the delegated administrator account
    Type: String
  pMacieOrgLambdaFunctionName:
    AllowedPattern: '^[\w-]{0,64}$'
    ConstraintDescription: Max 64 alphanumeric characters. Also special characters supported [_, -]
    Default: sra-macie-org
    Description: Lambda function name
    Type: String
  pMacieOrgLambdaRoleName:
    AllowedPattern: '^[\w+=,.@-]{1,64}$'
    ConstraintDescription: Max 64 alphanumeric characters. Also special characters supported [+, =, ., @, -]
    Default: sra-macie-org-lambda
    Description: Macie configuration Lambda role name
    Type: String
  pOrganizationId:
    AllowedPattern: '^o-[a-z0-9]{10,32}$'
    ConstraintDescription: The Organization ID must be a 12 character string starting with o- and followed by 10 lower case alphanumeric characters
    Description: AWS Organizations ID
    Type: String
  pPublishingDestinationBucketName:
    AllowedPattern: '^$|^[0-9a-zA-Z]+([0-9a-zA-Z-]*[0-9a-zA-Z])*$'
    ConstraintDescription:
      S3 bucket name can include numbers, lowercase letters, uppercase letters, and hyphens (-). It cannot start or end with a hyphen (-).
    Description: Macie classification export S3 bucket name
    Type: String
  pSRAAlarmEmail:
    AllowedPattern: '^$|^([a-zA-Z0-9_.+-]+@[a-zA-Z0-9-]+\.[a-zA-Z0-9-.]+)$'
    ConstraintDescription: Must be a valid email address.
    Description: (Optional) Email address for receiving DLQ alarms
    Type: String
  pSRASolutionName:
    AllowedValues: [sra-macie-org]
    Default: sra-macie-org
    Description: The SRA solution name. The default value is the folder name of the solution
    Type: String
  pSRAStagingS3BucketName:
    AllowedPattern: '^(?=^.{3,63}$)(?!.*[.-]{2})(?!.*[--]{2})(?!^(?:(25[0-5]|2[0-4][0-9]|1[0-9]{2}|[1-9]?[0-9])(\.(?!$)|$)){4}$)(^(([a-z0-9]|[a-z0-9][a-z0-9\-]*[a-z0-9])\.)*([a-z0-9]|[a-z0-9][a-z0-9\-]*[a-z0-9])$)'
    ConstraintDescription:
      SRA Staging S3 bucket name can include numbers, lowercase letters, uppercase letters, and hyphens (-). It cannot start or end with a hyphen (-).
    Description:
      SRA Staging S3 bucket name for the artifacts relevant to solution. (e.g., lambda zips, CloudFormation templates) S3 bucket name can include
      numbers, lowercase letters, uppercase letters, and hyphens (-). It cannot start or end with a hyphen (-).
    Type: String

Conditions:
  cUseKmsKey: !Not [!Equals [!Ref pLambdaLogGroupKmsKey, '']]
  cCreateLambdaLogGroup: !Equals [!Ref pCreateLambdaLogGroup, 'true']
  cCreateDLQAlarm: !Not [!Equals [!Ref pSRAAlarmEmail, '']]
  cUseGraviton: !Or
    - !Equals [!Ref 'AWS::Region', ap-northeast-1]
    - !Equals [!Ref 'AWS::Region', ap-south-1]
    - !Equals [!Ref 'AWS::Region', ap-southeast-1]
    - !Equals [!Ref 'AWS::Region', ap-southeast-2]
    - !Equals [!Ref 'AWS::Region', eu-central-1]
    - !Equals [!Ref 'AWS::Region', eu-west-1]
    - !Equals [!Ref 'AWS::Region', eu-west-2]
    - !Equals [!Ref 'AWS::Region', us-east-1]
    - !Equals [!Ref 'AWS::Region', us-east-2]
    - !Equals [!Ref 'AWS::Region', us-west-2]

Resources:
  rMacieOrgLambdaLogGroup:
    Type: AWS::Logs::LogGroup
    Condition: cCreateLambdaLogGroup
    DeletionPolicy: Retain
    UpdateReplacePolicy: Retain
    Properties:
      LogGroupName: !Sub /aws/lambda/${pMacieOrgLambdaFunctionName}
      KmsKeyId: !If
        - cUseKmsKey
        - !Ref pLambdaLogGroupKmsKey
        - !Ref AWS::NoValue
      RetentionInDays: !Ref pLambdaLogGroupRetention

  rMacieOrgLambdaRole:
    Type: AWS::IAM::Role
    Metadata:
      cfn_nag:
        rules_to_suppress:
          - id: W11
            reason: 'Allow * in resource for read only actions'
          - id: W28
            reason: The role name is defined
    Properties:
      RoleName: !Ref pMacieOrgLambdaRoleName
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Action: sts:AssumeRole
            Principal:
              Service:
                - lambda.amazonaws.com
      Path: '/'
      Policies:
        - PolicyName: sra-macie-org-policy-logs
          PolicyDocument:
            Version: 2012-10-17
            Statement:
              - Sid: CreateLogStreamAndEvents
                Effect: Allow
                Action:
                  - logs:CreateLogGroup
                  - logs:CreateLogStream
                  - logs:PutLogEvents
                Resource: !Sub arn:${AWS::Partition}:logs:${AWS::Region}:${AWS::AccountId}:log-group:/aws/lambda/${pMacieOrgLambdaFunctionName}:log-stream:*

        - PolicyName: sra-macie-org-policy-organizations
          PolicyDocument:
            Version: 2012-10-17
            Statement:
              - Sid: OrganizationsReadAccess
                Effect: Allow
                Action:
                  - organizations:DescribeOrganization
                  - organizations:ListAWSServiceAccessForOrganization
                  - organizations:ListAccounts
                  - organizations:ListDelegatedAdministrators
                Resource: '*'

              - Sid: AWSServiceAccess
                Effect: Allow
                Action:
                  - organizations:DisableAWSServiceAccess
                  - organizations:EnableAWSServiceAccess
                Condition:
                  StringLikeIfExists:
                    organizations:ServicePrincipal: macie.amazonaws.com
                Resource: '*'

              - Sid: RegisterDeregisterDelegatedAdministrator
                Effect: Allow
                Action:
                  - organizations:DeregisterDelegatedAdministrator
                  - organizations:RegisterDelegatedAdministrator
                Condition:
                  StringLikeIfExists:
                    organizations:ServicePrincipal: macie.amazonaws.com
                Resource: !Sub arn:${AWS::Partition}:organizations::*:account/o-*/*

        - PolicyName: sra-macie-org-policy-macie
          PolicyDocument:
            Version: 2012-10-17
            Statement:
              - Sid: MacieNoResource
                Effect: Allow
                Action:
                  - macie2:DisableOrganizationAdminAccount
                  - macie2:EnableMacie
                  - macie2:EnableOrganizationAdminAccount
                  - macie2:ListOrganizationAdminAccounts
                Resource: '*'

        - PolicyName: sra-macie-org-policy-iam
          PolicyDocument:
            Version: 2012-10-17
            Statement:
              - Sid: AssumeRole
                Effect: Allow
                Action: sts:AssumeRole
                Condition:
                  StringEquals:
                    aws:PrincipalOrgId: !Ref pOrganizationId
                Resource:
                  - !Sub arn:${AWS::Partition}:iam::${pDelegatedAdminAccountId}:role/${pMacieOrgConfigurationRoleName}
                  - !Sub arn:${AWS::Partition}:iam::*:role/${pDisableMacieRoleName}

              - Sid: AllowReadIamActions
                Effect: Allow
                Action: iam:GetRole
                Resource: !Sub arn:${AWS::Partition}:iam::${AWS::AccountId}:role/*

              - Sid: AllowCreateServiceLinkedRole
                Effect: Allow
                Action: iam:CreateServiceLinkedRole
                Condition:
                  StringLike:
                    iam:AWSServiceName: macie.amazonaws.com
                Resource: !Sub arn:${AWS::Partition}:iam::${AWS::AccountId}:role/aws-service-role/macie.amazonaws.com/AWSServiceRoleForAmazonMacie

              - Sid: AllowPolicyActions
                Effect: Allow
                Action: iam:PutRolePolicy
                Resource: !Sub arn:${AWS::Partition}:iam::${AWS::AccountId}:role/aws-service-role/macie.amazonaws.com/AWSServiceRoleForAmazonMacie

        - PolicyName: macie-org-policy-cloudformation
          PolicyDocument:
            Version: 2012-10-17
            Statement:
              - Effect: Allow
                Action: cloudformation:ListStackInstances
                Resource: !Sub arn:${AWS::Partition}:cloudformation:${AWS::Region}:${AWS::AccountId}:stackset/AWSControlTowerBP-*

        - PolicyName: sra-macie-org-policy-sns
          PolicyDocument:
            Version: 2012-10-17
            Statement:
              - Sid: SNSPublish
                Effect: Allow
                Action: sns:Publish
                Resource: !Ref rMacieOrgTopic

        - PolicyName: sra-macie-org-policy-sqs
          PolicyDocument:
            Version: 2012-10-17
            Statement:
              - Sid: SQSSendMessage
                Effect: Allow
                Action: sqs:SendMessage
                Resource: !GetAtt rMacieOrgDLQ.Arn
      Tags:
        - Key: sra-solution
          Value: !Ref pSRASolutionName

  rMacieOrgLambdaFunction:
    Type: AWS::Lambda::Function
    Metadata:
      cfn_nag:
        rules_to_suppress:
          - id: W58
            reason: CloudWatch access provided by the attached IAM role
          - id: W89
            reason: Lambda is not deployed within a VPC
          - id: W92
            reason: Lambda does not need reserved concurrent executions.
      checkov:
        skip:
          - id: CKV_AWS_115
            comment: Lambda does not need reserved concurrent executions.
          - id: CKV_AWS_117
            comment: Lambda does not need to communicate with VPC resources.
          - id: CKV_AWS_173
            comment: Environment variables are not sensitive.
    Properties:
      FunctionName: !Ref pMacieOrgLambdaFunctionName
      Description: Configure Macie for the Organization
      Role: !GetAtt rMacieOrgLambdaRole.Arn
      Architectures: !If
        - cUseGraviton
        - [arm64]
        - !Ref AWS::NoValue
      Handler: app.lambda_handler
      MemorySize: 512
      Runtime: python3.9
      Timeout: 900
      Code:
        S3Bucket: !Ref pSRAStagingS3BucketName
        S3Key: !Sub ${pSRASolutionName}/lambda_code/${pSRASolutionName}.zip
      DeadLetterConfig:
        TargetArn: !GetAtt rMacieOrgDLQ.Arn
      Environment:
        Variables:
          LOG_LEVEL: !Ref pLambdaLogLevel
      Tags:
        - Key: sra-solution
          Value: !Ref pSRASolutionName

  rMacieOrgLambdaCustomResource:
    Type: Custom::LambdaCustomResource
    Version: '1.0'
    Properties:
      ServiceToken: !GetAtt rMacieOrgLambdaFunction.Arn
      CONFIGURATION_ROLE_NAME: !Ref pMacieOrgConfigurationRoleName
      CONTROL_TOWER_REGIONS_ONLY: !Ref pControlTowerRegionsOnly
      DELEGATED_ADMIN_ACCOUNT_ID: !Ref pDelegatedAdminAccountId
      DISABLE_MACIE: !Ref pDisableMacie
      DISABLE_MACIE_ROLE_NAME: !Ref pDisableMacieRoleName
      ENABLED_REGIONS: !Ref pEnabledRegions
      FINDING_PUBLISHING_FREQUENCY: !Ref pFindingPublishingFrequency
      KMS_KEY_ARN: !Ref pKMSKeyArn
      MANAGEMENT_ACCOUNT_ID: !Ref AWS::AccountId
      PUBLISHING_DESTINATION_BUCKET_NAME: !Ref pPublishingDestinationBucketName
      SNS_TOPIC_ARN: !Ref rMacieOrgTopic

  rMacieOrgTopic:
    Type: AWS::SNS::Topic
    Properties:
      DisplayName: !Sub ${pSRASolutionName}-configuration
      KmsMasterKeyId: !Sub arn:${AWS::Partition}:kms:${AWS::Region}:${AWS::AccountId}:alias/aws/sns
      Tags:
        - Key: sra-solution
          Value: !Ref pSRASolutionName

  rMacieOrgTopicLambdaPermission:
    Type: AWS::Lambda::Permission
    Properties:
      Action: lambda:InvokeFunction
      FunctionName: !GetAtt rMacieOrgLambdaFunction.Arn
      Principal: sns.amazonaws.com
      SourceArn: !Ref rMacieOrgTopic

  rMacieOrgTopicSubscription:
    Type: AWS::SNS::Subscription
    Properties:
      Endpoint: !GetAtt rMacieOrgLambdaFunction.Arn
      Protocol: lambda
      TopicArn: !Ref rMacieOrgTopic

  rMacieOrgDLQ:
    Type: AWS::SQS::Queue
    Properties:
      KmsMasterKeyId: alias/aws/sqs
      QueueName: !Sub ${pSRASolutionName}-dlq
      Tags:
        - Key: sra-solution
          Value: !Ref pSRASolutionName

  rMacieOrgDLQPolicy:
    Type: AWS::SQS::QueuePolicy
    Properties:
      Queues:
        - !Ref rMacieOrgDLQ
      PolicyDocument:
        Statement:
          - Action: SQS:SendMessage
            Condition:
              ArnEquals:
                aws:SourceArn:
                  - !GetAtt rMacieOrgLambdaFunction.Arn
            Effect: Allow
            Principal:
              Service: events.amazonaws.com
            Resource:
              - !GetAtt rMacieOrgDLQ.Arn

  rMacieOrgDLQAlarmTopic:
    Condition: cCreateDLQAlarm
    Type: AWS::SNS::Topic
    Properties:
      DisplayName: !Sub ${pSRASolutionName}-dlq-alarm
      KmsMasterKeyId: !Sub arn:${AWS::Partition}:kms:${AWS::Region}:${AWS::AccountId}:alias/aws/sns
      TopicName: !Sub ${pSRASolutionName}-dlq-alarm
      Subscription:
        - Endpoint: !Ref pSRAAlarmEmail
          Protocol: email
      Tags:
        - Key: sra-solution
          Value: !Ref pSRASolutionName

  rMacieOrgDLQAlarm:
    Condition: cCreateDLQAlarm
    Type: AWS::CloudWatch::Alarm
    Properties:
      AlarmDescription: SRA DLQ alarm if the queue depth is 1
      Namespace: AWS/SQS
      MetricName: ApproximateNumberOfMessagesVisible
      Dimensions:
        - Name: QueueName
          Value: !GetAtt rMacieOrgDLQ.QueueName
      Statistic: Sum
      Period: 300
      EvaluationPeriods: 1
      Threshold: 1
      ComparisonOperator: GreaterThanThreshold
      AlarmActions:
        - !Ref rMacieOrgDLQAlarmTopic
      InsufficientDataActions:
        - !Ref rMacieOrgDLQAlarmTopic

Outputs:
  oMacieOrgLambdaFunctionArn:
    Description: SRA Macie Lambda Function ARN
    Value: !GetAtt rMacieOrgLambdaFunction.Arn
  oMacieOrgLambdaLogGroupArn:
    Condition: cCreateLambdaLogGroup
    Description: SRA Macie Lambda Log Group ARN
    Value: !GetAtt rMacieOrgLambdaLogGroup.Arn
  oMacieOrgLambdaRoleArn:
    Description: SRA Macie Lambda Role ARN
    Value: !GetAtt rMacieOrgLambdaRole.Arn