# Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
# SPDX-License-Identifier: Apache-2.0
---
description: |
  ### Document Name - ASR-AFSBP_1.0.0_EC2.15
 
  ## What does this document do?
  This document disables auto assignment of public IP addresses.
 
  ## Input Parameters
  * Finding: (Required) Security Hub finding details JSON
  * AutomationAssumeRole: (Required) The ARN of the role that allows Automation to perform the actions on your behalf.
  * RemediationRoleName: (Optional) The name of the role that allows Automation to remediate the finding on your behalf.
 
  ## Output Parameters
  * Remediation.Output
 
  ## Documentation Links
  * [AFSBP v1.0.0 EC2.15](https://docs.aws.amazon.com/securityhub/latest/userguide/securityhub-standards-fsbp-controls.html#fsbp-ec2-15)
schemaVersion: '0.3'
assumeRole: '{{ AutomationAssumeRole }}'
parameters:
  AutomationAssumeRole:
    type: String
    description: (Required) The ARN of the role that allows Automation to perform the actions on your behalf.
    allowedPattern: '^arn:(?:aws|aws-us-gov|aws-cn):iam::\d{12}:role/[\w+=,.@-]+$'
  Finding:
    type: StringMap
    description: The input from the Orchestrator Step function for the EC2.15 finding
  RemediationRoleName:
    type: 'String'
    default: 'SO0111-DisablePublicIPAutoAssign'
    allowedPattern: '^[\w+=,.@-]+$'

outputs:
  - ParseInput.AffectedObject
  - Remediation.Output
 
mainSteps:
  -
    name: ParseInput
    action: 'aws:executeScript'
    outputs:
      - Name: FindingId
        Selector: $.Payload.finding.Id
        Type: String
      - Name: ProductArn
        Selector: $.Payload.finding.ProductArn
        Type: String
      - Name: AffectedObject
        Selector: $.Payload.object
        Type: StringMap
      - Name: SubnetARN
        Selector: $.Payload.resource_id
        Type: String
      - Name: RemediationRegion
        Selector: $.Payload.resource_region
        Type: String
      - Name: RemediationAccount
        Selector: $.Payload.account_id
        Type: String
    inputs:
      InputPayload:
        Finding: '{{Finding}}'
        parse_id_pattern: ''
        expected_control_id: 
          - 'EC2.15'
      Runtime: python3.8
      Handler: parse_event
      Script: |-
        %%SCRIPT=common/parse_input.py%%
  -
    name: Remediation
    action: 'aws:executeAutomation'
    inputs:
      DocumentName: ASR-DisablePublicIPAutoAssign
      TargetLocations:
        - Accounts: [ '{{ParseInput.RemediationAccount}}' ]
          Regions: [ '{{ParseInput.RemediationRegion}}' ]
          ExecutionRoleName: '{{ RemediationRoleName }}'
      RuntimeParameters:
        AutomationAssumeRole: 'arn:{{global:AWS_PARTITION}}:iam::{{global:ACCOUNT_ID}}:role/{{RemediationRoleName}}'
        SubnetARN: '{{ParseInput.SubnetARN}}'
  - 
    name: UpdateFinding
    action: 'aws:executeAwsApi'
    inputs:
      Service: securityhub
      Api: BatchUpdateFindings
      FindingIdentifiers:
      - Id: '{{ParseInput.FindingId}}'
        ProductArn: '{{ParseInput.ProductArn}}'
      Note:
        Text: 'Disabled public IP auto assignment for subnet.'
        UpdatedBy: 'ASR-AFSBP_1.0.0_EC2.15'
      Workflow:
        Status: RESOLVED
    description: Update finding