autotag_event-template.json

{
  "AWSTemplateFormatVersion" : "2010-09-09",
  "Description" : "Auto Tag (Open Source by GorillaStack)",
  "Parameters" : {

    "CodeS3Bucket" : {
      "Description" : "The name of the code bucket in S3",
      "Type" : "String",
      "Default" : "gorillastack-autotag-releases-ap-northeast-1"
    },

    "CodeS3Path" : {
      "Description" : "The path of the code zip file in the code bucket in S3",
      "Type" : "String",
      "Default" : "autotag-0.5.3.zip"
    },
    "AutoTagDebugLogging": {
      "Description": "Enable/Disable Debug Logging for the Lambda Function for all processed CloudTrail events.",
      "Type": "String",
      "AllowedValues": [
        "Enabled",
        "Disabled"
      ],
      "Default": "Disabled"
    },
    "AutoTagDebugLoggingOnFailure": {
      "Description": "Enable/Disable Debug Logging when the Lambda Function has a failure.",
      "Type": "String",
      "AllowedValues": [
        "Enabled",
        "Disabled"
      ],
      "Default": "Enabled"
    },
    "AutoTagTagsCreateTime": {
      "Description": "Enable/Disable the \"CreateTime\" tagging for all resources.",
      "Type": "String",
      "AllowedValues": [
        "Enabled",
        "Disabled"
      ],
      "Default": "Enabled"
    },
    "AutoTagTagsInvokedBy": {
      "Description": "Enable/Disable the \"InvokedBy\" tagging for all resources.",
      "Type": "String",
      "AllowedValues": [
        "Enabled",
        "Disabled"
      ],
      "Default": "Enabled"
    }
  },

  "Resources": {

    "AutoTagLambdaFunction" : {
      "Type" : "AWS::Lambda::Function",
      "Properties" : {
        "Code" : {
          "S3Bucket": { "Ref" : "CodeS3Bucket" },
          "S3Key": { "Ref" : "CodeS3Path" }
        },
        "Description" : "Auto Tag (Open Source by GorillaStack)",
        "FunctionName" : {
          "Fn::Sub": "${AWS::StackName}"
        },
        "Handler" : "autotag_event.handler",
        "Role" : { "Fn::GetAtt" : [ "AutoTagExecutionRole", "Arn" ] },
        "Runtime" : "nodejs18.x",
        "Timeout" : 120,
        "Environment": {
          "Variables": {
            "DEBUG_LOGGING_ON_FAILURE": {
              "Ref": "AutoTagDebugLoggingOnFailure"
            },
            "DEBUG_LOGGING": {
              "Ref": "AutoTagDebugLogging"
            },
            "CREATE_TIME": {
              "Ref": "AutoTagTagsCreateTime"
            },
            "INVOKED_BY": {
              "Ref": "AutoTagTagsInvokedBy"
            },
            "ROLE_NAME": {
              "Ref": "AutoTagMasterRole"
            }
          }
        }
      }
    },

    "AutoTagExecutionRole" : {
      "Type": "AWS::IAM::Role",
      "Properties": {
        "AssumeRolePolicyDocument": {
          "Statement": [
            {
              "Effect": "Allow",
              "Principal": {
                "Service": [ "lambda.amazonaws.com" ]
              },
              "Action": [ "sts:AssumeRole" ]
            }
          ]
        },
        "Path": "/gorillastack/autotag/execution/"
      }
    },

    "AutoTagExecutionPolicy" : {
      "Type": "AWS::IAM::Policy",
      "Properties": {
        "PolicyName": "AutoTagExecutionPolicy",
        "Roles": [ { "Ref": "AutoTagExecutionRole" } ],
        "PolicyDocument": {
          "Version": "2012-10-17",
          "Statement": [
            {
              "Effect": "Allow",
              "Action": [
                "logs:CreateLogGroup",
                "logs:CreateLogStream",
                "logs:PutLogEvents"
              ],
              "Resource": "arn:aws:logs:*:*:*"
            },
            {
              "Effect": "Allow",
              "Action": [
                "sts:*"
              ],
              "Resource": [
                { "Fn::GetAtt" : [ "AutoTagMasterRole", "Arn" ] }
              ]
            }
          ]
        }
      }
    },

    "AutoTagMasterRole" : {
      "Type": "AWS::IAM::Role",
      "Properties": {
        "AssumeRolePolicyDocument": {
          "Statement": [
            {
              "Effect": "Allow",
              "Principal": {
                "AWS" : { "Fn::GetAtt" : [ "AutoTagExecutionRole", "Arn" ] }
              },
              "Action": [
                "sts:AssumeRole"
              ]
            }
          ]
        },
        "Path": "/gorillastack/autotag/master/"
      }
    },

    "AutoTagMasterPolicy" : {
      "Type": "AWS::IAM::Policy",
      "Properties": {
        "PolicyName": "AutoTagMasterPolicy",
        "Roles": [ { "Ref": "AutoTagMasterRole" } ],
        "PolicyDocument": {
          "Version": "2012-10-17",
          "Statement": [
            {
              "Effect": "Allow",
              "Action": [
                "autoscaling:CreateOrUpdateTags",
                "autoscaling:DescribeAutoScalingGroups",
                "autoscaling:DescribeAutoScalingInstances",
                "autoscaling:DescribeTags",
                "cloudwatch:TagResource",
                "datapipeline:AddTags",
                "dynamodb:ListTagsOfResource",
                "dynamodb:TagResource",
                "ec2:CreateTags",
                "ec2:DescribeInstances",
                "ec2:DescribeSnapshots",
                "events:TagResource",
                "elasticloadbalancing:AddTags",
                "elasticmapreduce:AddTags",
                "iam:TagRole",
                "iam:TagUser",
                "lambda:TagResource",
                "logs:TagLogGroup",
                "rds:AddTagsToResource",
                "opsworks:DescribeInstances",
                "opsworks:DescribeStacks",
                "opsworks:ListTags",
                "opsworks:TagResource",
                "s3:GetBucketTagging",
                "s3:PutBucketTagging"
              ],
              "Resource": [ "*" ]
            }
          ]
        }
      }
    },

    "TriggerLambdaPermission": {
      "Type" : "AWS::Lambda::Permission",
      "DependsOn" : "AutoTagLambdaFunction",
      "Properties" : {
        "Action" : "lambda:InvokeFunction",
        "FunctionName" : { "Fn::GetAtt" : [ "AutoTagLambdaFunction", "Arn" ] },
        "Principal" : "events.amazonaws.com",
        "SourceArn": { "Fn::GetAtt" : [ "EC2EventRule", "Arn" ] }
      }
    },

    "EC2EventRule" : {
      "Type" : "AWS::Events::Rule",
      "Properties" : {
        "Description" : "Auto-tag resources with Lambda from CloudTrail events",
        "EventPattern" : {
          "detail-type" : [
            "AWS API Call via CloudTrail"
          ],
          "detail" : {
            "eventSource" : [
              "autoscaling.amazonaws.com",
              "datapipeline.amazonaws.com",
              "dynamodb.amazonaws.com",
              "ec2.amazonaws.com",
              "events.amazonaws.com",
              "elasticloadbalancing.amazonaws.com",
              "elasticmapreduce.amazonaws.com",
              "iam.amazonaws.com",
              "lambda.amazonaws.com",
              "logs.amazonaws.com",
              "monitoring.amazonaws.com",
              "opsworks.amazonaws.com",
              "rds.amazonaws.com",
              "s3.amazonaws.com"
            ],
            "eventName" : [
              "AllocateAddress",
              "CloneStack",
              "CopyImage",
              "CopySnapshot",
              "CreateAutoScalingGroup",
              "CreateBucket",
              "CreateCustomerGateway",
              "CreateDBInstance",
              "CreateDhcpOptions",
              "CreateFunction20150331",
              "CreateFunction20141111",
              "CreateImage",
              "CreateInternetGateway",
              "CreateLoadBalancer",
              "CreateLogGroup",
              "CreateNatGateway",
              "CreateNetworkAcl",
              "CreateNetworkInterface",
              "CreatePipeline",
              "CreateRole",
              "CreateRouteTable",
              "CreateSecurityGroup",
              "CreateSnapshot",
              "CreateStack",
              "CreateSubnet",
              "CreateTable",
              "CreateUser",
              "CreateVolume",
              "CreateVpc",
              "CreateVpnConnection",
              "CreateVpnGateway",
              "CreateVpcPeeringConnection",
              "ImportSnapshot",
              "PutMetricAlarm",
              "PutRule",
              "RegisterImage",
              "RunInstances",
              "RunJobFlow"
            ]
          }
        },
        "Name" : "AutoTag-CloudTrail-Events",
        "State" : "ENABLED",
        "Targets" : [
          {
            "Arn" : { "Fn::GetAtt" : [ "AutoTagLambdaFunction", "Arn" ] },
            "Id"  : "Main"
          }
        ]
      }
    }
  }
}