template.yml

AWSTemplateFormatVersion: "2010-09-09"

Description: Account Controller Solution

Parameters:

    ControlTowerMode:
        Description: Provision accounts with Control Tower instead of directly with Organizations (requires Control Tower to be set up)
        Type: String
        Default: "false"
        AllowedValues:
          - "true"
          - "false"

    AccountCreationFunctionality:
        Description: Manage SSO and other features required for account creation functionality
        Type: String
        Default: "true"
        AllowedValues:
          - "true"
          - "false"

    AccountDeletionFunctionality:
        Description: Manage Connect and other features required for account deletion functionality
        Type: String
        Default: "true"
        AllowedValues:
          - "true"
          - "false"

    AutoUnsubMarketing:
        Description: Automatically unsubscribe newly created accounts from all marketing material
        Type: String
        Default: "true"
        AllowedValues:
          - "true"
          - "false"

    MasterEmail:
        Description: The email address which will receive all root account correspondence (this should NOT be an address of your master domain/subdomain)
        Type: String
        AllowedPattern: "^[a-zA-Z0-9._+-]+@[a-zA-Z0-9.-]+\\.[a-zA-Z]+$"

    MaximumAccountSpend:
        Description: The maximum configurable monthly spend, in USD, of created accounts before they are automatically deleted - or set to "0" to disable spend tracking
        Type: String
        Default: "100"
        AllowedPattern: "^[0-9]+(?:\\.[0-9]{2})?$"

    EmailSubjectCustomization:
        Description: The format of the forwarded emails
        Type: String
        Default: "{subject} | From: {from} | Acct ID: {accountid} | Acct Email: {accountemail}"

    RootEmailsToUser:
        Description: If true, root e-mails will be sent to the user who created the account, otherwise they will be sent to the master e-mail address
        Type: String
        Default: "true"
        AllowedValues:
          - "true"
          - "false"

    DenySubscriptionCalls:
        Description: Denies the capability to make subscription-based calls in new accounts, like reserved instances, via an SCP
        Type: String
        Default: "true"
        AllowedValues:
          - "true"
          - "false"

    DomainName:
        Description: The domain name (or subdomain) which is used for all account root email addresses
        Type: String

    2CaptchaApiKey:
        Description: The API Key for 2captcha.com
        Type: String
        Default: ''
        NoEcho: true

    S3Bucket:
        Description: The name of the bucket that contains the Lambda source (leave blank to use latest)
        Type: String
        Default: ''
    
    S3Key:
        Description: The key of the ZIP package within the bucket (leave blank to use latest)
        Type: String
        Default: ''

    AutomationUsername:
        Description: The username of an IAM user created to perform automated actions
        Type: String
        Default: AccountControllerAutomationUser
    
    LogLevel:
        Description: The log level of the Lambda function
        Type: String
        Default: "INFO"
        AllowedValues:
          - "DEBUG"
          - "INFO"
          - "WARN"
          - "ERROR"
    
    CCName:
        Description: The full name of the credit card owner
        Type: String
    
    CCNumber:
        Description: The number of the credit card
        Type: String
        NoEcho: true
    
    CCMonth:
        Description: The month of the credit card as a number (January = 1, December = 12)
        Type: String
        AllowedValues:
          - "1"
          - "2"
          - "3"
          - "4"
          - "5"
          - "6"
          - "7"
          - "8"
          - "9"
          - "10"
          - "11"
          - "12"
    
    CCYear:
        Description: The full year of the credit card (e.g. 2020)
        Type: String
        AllowedValues:
          - "2020"
          - "2021"
          - "2022"
          - "2023"
          - "2024"
          - "2025"
          - "2026"
          - "2027"
          - "2028"
          - "2029"
          - "2030"
          - "2031"
          - "2032"
          - "2033"
          - "2034"
          - "2035"
          - "2036"
          - "2037"
          - "2038"
          - "2039"
    
    HostedZoneId:
        Description: The ID of the hosted zone of the previous domain name (leave blank for this to be created for you)
        Type: String
        Default: ''

    SSOManagerAppName:
        Description: The name of the SSO application used to manage accounts
        Type: String
        Default: Account Manager

Metadata: 

    AWS::CloudFormation::Interface: 
        ParameterGroups: 
          - Label: 
                default: "Global Features"
            Parameters: 
              - AccountCreationFunctionality
              - AccountDeletionFunctionality
              - ControlTowerMode
          - Label: 
                default: "Email Configuration"
            Parameters: 
              - MasterEmail
              - DomainName
              - HostedZoneId
              - EmailSubjectCustomization
              - RootEmailsToUser
              - AutoUnsubMarketing
          - Label: 
                default: "Billing Credit Card"
            Parameters: 
              - CCName
              - CCNumber
              - CCMonth
              - CCYear
          - Label: 
                default: "SSO Settings"
            Parameters: 
              - SSOManagerAppName
          - Label: 
                default: "Other Settings"
            Parameters: 
              - 2CaptchaApiKey
              - AutomationUsername
              - MaximumAccountSpend
              - DenySubscriptionCalls
          - Label: 
                default: "Lambda Function"
            Parameters: 
              - LogLevel
              - S3Bucket
              - S3Key
        ParameterLabels: 
            MasterEmail: 
                default: "Master Email Address"
            DomainName: 
                default: "Master Domain Name"
            HostedZoneId: 
                default: "Hosted Zone ID"
            CCName: 
                default: "Credit Card Name"
            CCNumber: 
                default: "Credit Card Number"
            CCMonth: 
                default: "Credit Card Expiry Month"
            CCYear: 
                default: "Credit Card Expiry Year"
            2CaptchaApiKey: 
                default: "2Captcha API Key"
            S3Bucket: 
                default: "S3 Bucket"
            S3Key: 
                default: "S3 Key"
            LogLevel: 
                default: "Log Level"
            EmailSubjectCustomization: 
                default: "E-mail Subject Customization"
            AccountCreationFunctionality: 
                default: "Enable Account Creation Functionality"
            AccountDeletionFunctionality: 
                default: "Enable Account Deletion Functionality"
            SSOManagerAppName: 
                default: "SSO Account Manager Application Name"
            AutomationUsername: 
                default: "Automation IAM User Username"
            RootEmailsToUser:
                default: "Send Root E-mails to User"
            MaximumAccountSpend:
                default: "Maximum Monthly Spend Per Account"
            DenySubscriptionCalls:
                default: "Deny Subscription Calls"
            AutoUnsubMarketing:
                default: "Unsubscribe Marketing E-mails"
            ControlTowerMode:
                default: "Control Tower Mode"

Conditions:

    S3Defined: !Not [ !Equals [ '', !Ref S3Bucket ] ]
    HostedZoneNotDefined: !Equals [ '', !Ref HostedZoneId ]
    AccountCreationEnabled: !Equals [ 'true', !Ref AccountCreationFunctionality ]
    AccountDeletionEnabled: !Equals [ 'true', !Ref AccountDeletionFunctionality ]
    ControlTowerModeEnabled: !Equals [ 'true', !Ref ControlTowerMode ]

Mappings:
    RegionMap:
        us-east-1:
            bucketname: ianmckay-us-east-1
        us-east-2:
            bucketname: ianmckay-us-east-2
        us-west-1:
            bucketname: ianmckay-us-west-1
        us-west-2:
            bucketname: ianmckay-us-west-2
        ap-south-1:
            bucketname: ianmckay-ap-south-1
        ap-northeast-2:
            bucketname: ianmckay-ap-northeast-2
        ap-southeast-1:
            bucketname: ianmckay-ap-southeast-1
        ap-southeast-2:
            bucketname: ianmckay-ap-southeast-2
        ap-northeast-1:
            bucketname: ianmckay-ap-northeast-1
        ca-central-1:
            bucketname: ianmckay-ca-central-1
        eu-central-1:
            bucketname: ianmckay-eu-central-1
        eu-west-1:
            bucketname: ianmckay-eu-west-1
        eu-west-2:
            bucketname: ianmckay-eu-west-2
        eu-west-3:
            bucketname: ianmckay-eu-west-3
        eu-north-1:
            bucketname: ianmckay-eu-north-1
        sa-east-1:
            bucketname: ianmckay-sa-east-1

Resources:

    DebugBucket:
        Type: AWS::S3::Bucket
        Properties:
            LifecycleConfiguration:
                Rules:
                  - NoncurrentVersionExpirationInDays: 14
                    ExpirationInDays: 14
                    Status: Enabled
            BucketEncryption:
                ServerSideEncryptionConfiguration:
                  - ServerSideEncryptionByDefault:
                        SSEAlgorithm: AES256
            PublicAccessBlockConfiguration:
                BlockPublicAcls: true
                BlockPublicPolicy: true
                IgnorePublicAcls: true
                RestrictPublicBuckets: true

    HostedZone:
        Condition: HostedZoneNotDefined
        Type: AWS::Route53::HostedZone
        Properties:
            Name: !Ref DomainName

    MXRecord:
        Type: AWS::Route53::RecordSet
        Properties:
            HostedZoneId: !If
              - HostedZoneNotDefined
              - !Ref HostedZone
              - !Ref HostedZoneId
            Name: !Sub '${DomainName}.'
            Type: MX
            TTL: '900'
            ResourceRecords:
              - !Sub '10 inbound-smtp.${AWS::Region}.amazonaws.com'
    
    OrgAccountTaggedRule:
        Type: AWS::Events::Rule
        Properties:
            Description: Detect and begin processing accounts when tagged
            EventPattern: |
              {
                "source": [
                  "aws.organizations"
                ],
                "detail-type": [
                  "AWS API Call via CloudTrail"
                ],
                "detail": {
                  "eventSource": [
                    "organizations.amazonaws.com"
                  ],
                  "eventName": [
                    "TagResource"
                  ]
                }
              }
            State: ENABLED
            Targets:
              - Arn: !GetAtt LambdaFunction.Arn
                Id: Action

    LambdaAccountDeletionEventRulePermission:
        Condition: AccountDeletionEnabled
        Type: AWS::Lambda::Permission
        Properties:
            FunctionName: !Ref LambdaFunction
            Action: lambda:InvokeFunction
            Principal: events.amazonaws.com
            SourceArn: !GetAtt OrgAccountTaggedRule.Arn

    LambdaConnectPermission:
        Condition: AccountDeletionEnabled
        Type: AWS::Lambda::Permission
        Properties:
            FunctionName: !Ref LambdaFunction
            Action: lambda:InvokeFunction
            Principal: connect.amazonaws.com
            SourceAccount: !Ref AWS::AccountId

    LambdaAPIGatewayPermission:
        Condition: AccountCreationEnabled
        Type: AWS::Lambda::Permission
        Properties:
            FunctionName: !Ref LambdaFunction
            Action: lambda:InvokeFunction
            Principal: apigateway.amazonaws.com
            SourceArn: !Sub "arn:aws:execute-api:${AWS::Region}:${AWS::AccountId}:${SAMLHttpApi}/*/*/*"

    LambdaDeleteAccountEventsPermission:
        Condition: AccountDeletionEnabled
        Type: AWS::Lambda::Permission
        Properties:
            FunctionName: !Ref LambdaFunction
            Action: lambda:InvokeFunction
            Principal: events.amazonaws.com
            SourceArn: !Sub "arn:aws:events:${AWS::Region}:${AWS::AccountId}:rule/ScheduledAccountDeletion-*"

    LambdaDeleteAccountSNSPermission:
        Condition: AccountDeletionEnabled
        Type: AWS::Lambda::Permission
        Properties:
            FunctionName: !Ref LambdaFunction
            Action: lambda:InvokeFunction
            Principal: sns.amazonaws.com
            SourceArn: !Ref AccountDeletionSNSTopic

    LambdaLogGroup:
        Type: AWS::Logs::LogGroup
        Properties:
            LogGroupName: /aws/lambda/AccountAutomator
            RetentionInDays: 14

    LambdaFunction:
        DependsOn:
          - AutomationUser
          - LambdaLogGroup
        Type: AWS::Lambda::Function
        Properties:
            FunctionName: AccountAutomator
            Code:
                S3Bucket: !If
                    - S3Defined
                    - !Ref S3Bucket
                    - Fn::FindInMap:
                        - RegionMap
                        - !Ref 'AWS::Region'
                        - bucketname
                S3Key: !If
                    - S3Defined
                    - !Ref S3Key
                    - 'accountcontroller/app.zip'
            Handler: index.handler
            Role: !GetAtt LambdaExecutionRole.Arn
            Environment:
                Variables:
                    DEBUG_BUCKET: !Ref DebugBucket
                    CAPTCHA_KEY: !Ref 2CaptchaApiKey
                    ACCOUNTID: !Ref AWS::AccountId
                    MASTER_EMAIL: !Ref MasterEmail
                    LOG_LEVEL: !Ref LogLevel
                    EMAIL_SUBJECT: !Ref EmailSubjectCustomization
                    SECRET_ARN: !Ref AutomationCredentials
                    CONNECT_SSM_PARAMETER: !Ref ConnectProperties
                    SSO_SSM_PARAMETER: !Ref SSOProperties
                    DOMAIN_NAME: !Ref DomainName
                    CREATION_FUNCTIONALITY_ENABLED: !Ref AccountCreationFunctionality
                    DELETION_FUNCTIONALITY_ENABLED: !Ref AccountDeletionFunctionality
                    ACCOUNT_DELETION_TOPIC: !If
                      - AccountDeletionEnabled
                      - !Ref AccountDeletionSNSTopic
                      - !Ref AWS::NoValue
                    ROOT_EMAILS_TO_USER: !Ref RootEmailsToUser
                    MAXIMUM_ACCOUNT_SPEND: !Ref MaximumAccountSpend
                    DENY_SUBSCRIPTION_CALLS: !Ref DenySubscriptionCalls
                    AUTO_UNSUB_MARKETING: !Ref AutoUnsubMarketing
                    CONTROL_TOWER_MODE: !Ref ControlTowerMode
                    ROLE: !GetAtt LambdaExecutionRole.Arn
            Runtime: nodejs12.x
            MemorySize: 1024
            Timeout: 900
    
    LambdaExecutionRole:
        Type: AWS::IAM::Role
        Properties:
            AssumeRolePolicyDocument:
                Version: '2012-10-17'
                Statement:
                  - Effect: Allow
                    Principal:
                        Service:
                          - lambda.amazonaws.com
                    Action:
                      - sts:AssumeRole
            Path: /
            Policies:
              - PolicyName: root
                PolicyDocument:
                    Version: '2012-10-17'
                    Statement:
                      - Effect: Allow
                        Action:
                          - logs:CreateLogGroup
                          - logs:CreateLogStream
                          - logs:PutLogEvents
                        Resource: arn:aws:logs:*:*:*
                      - Effect: Allow
                        Action:
                          - s3:GetObject
                        Resource:
                          - !Sub arn:aws:s3:::accountcontroller-email-processing-${AWS::Region}-${AWS::AccountId}/*
                      - Effect: Allow
                        Action:
                          - s3:PutObject
                        Resource:
                          - !Sub arn:aws:s3:::${DebugBucket}/*
                      - Effect: Allow
                        Action:
                          - organizations:DescribeAccount
                        Resource:
                          - !Sub arn:aws:organizations::${AWS::AccountId}:account/*
                      - Effect: Allow
                        Action:
                          - sts:AssumeRole
                        Resource:
                          - arn:aws:iam::*:role/OrganizationAccountAccessRole
                          - arn:aws:iam::*:role/AWSControlTowerExecution
                      - Effect: Allow
                        Action:
                          - organizations:ListAccounts
                          - organizations:ListTagsForResource
                          - organizations:TagResource
                          - organizations:CreateAccount
                          - organizations:DescribeCreateAccountStatus
                          - organizations:DescribeOrganization
                          - organizations:ListPolicies
                          - organizations:CreatePolicy
                          - organizations:UpdatePolicy
                          - organizations:AttachPolicy
                          - organizations:RemoveAccountFromOrganization
                          - ses:SendRawEmail
                          - ses:SetActiveReceiptRuleSet
                          - ses:DeleteReceiptRuleSet
                          - events:PutTargets
                          - events:PutRule
                          - events:ListTargetsByRule
                          - events:RemoveTargets
                          - events:DeleteRule
                          - servicecatalog:ProvisionProduct
                          - servicecatalog:ListProvisioningArtifacts
                          - servicecatalog:ListLaunchPaths
                          - servicecatalog:AssociatePrincipalWithPortfolio
                          - servicecatalog:ListPortfoliosForProduct
                          - servicecatalog:SearchProductsAsAdmin
                          - servicecatalog:TerminateProduct
                          - servicecatalog:DescribeRecord
                          - iam:GetRole
                          - !If [ ControlTowerModeEnabled, "*", !Ref 'AWS::NoValue' ] # Not my fault: https://docs.aws.amazon.com/controltower/latest/userguide/setting-up.html#setting-up-iam
                        Resource:
                          - '*'
                      - Effect: Allow
                        Action:
                          - secretsmanager:GetSecretValue
                        Resource:
                          - !Ref AutomationCredentials
                      - Effect: Allow
                        Action:
                          - ssm:GetParameter
                          - ssm:PutParameter
                        Resource:
                          - !Sub "arn:aws:ssm:${AWS::Region}:${AWS::AccountId}:parameter/${ConnectProperties}"
                          - !Sub "arn:aws:ssm:${AWS::Region}:${AWS::AccountId}:parameter/${SSOProperties}"

    EmailBucket:
        DependsOn:
          - BucketPermission
        Type: AWS::S3::Bucket
        Properties:
            BucketName: !Sub "accountcontroller-email-processing-${AWS::Region}-${AWS::AccountId}" # Required, see https://aws.amazon.com/premiumsupport/knowledge-center/unable-validate-destination-s3/
            LifecycleConfiguration:
                Rules:
                  - NoncurrentVersionExpirationInDays: 14
                    ExpirationInDays: 14
                    Status: Enabled
            NotificationConfiguration:
                LambdaConfigurations:
                  - Event: "s3:ObjectCreated:*"
                    Function: !GetAtt LambdaFunction.Arn
            BucketEncryption:
                ServerSideEncryptionConfiguration:
                  - ServerSideEncryptionByDefault:
                        SSEAlgorithm: AES256
            PublicAccessBlockConfiguration:
                BlockPublicAcls: true
                BlockPublicPolicy: true
                IgnorePublicAcls: true
                RestrictPublicBuckets: true
    
    BucketPermission:
        Type: AWS::Lambda::Permission
        Properties:
            Action: lambda:InvokeFunction
            FunctionName: !Ref LambdaFunction
            Principal: s3.amazonaws.com
            SourceAccount: !Ref AWS::AccountId
            SourceArn: !Sub arn:aws:s3:::accountcontroller-email-processing-${AWS::Region}-${AWS::AccountId}
    
    ReceiptRuleSet:
        DeletionPolicy: Retain # Custom Resource is responsible for deletion
        Type: AWS::SES::ReceiptRuleSet
        Properties:
            RuleSetName: account-controller

    ReceiptRule:
        DependsOn:
          - ReceivedEmailBucketPolicy
        Type: AWS::SES::ReceiptRule
        Properties:
            RuleSetName: !Ref ReceiptRuleSet
            Rule:
                Name: default
                Enabled: true
                Actions:
                  - S3Action:
                        BucketName: !Ref EmailBucket
    
    ReceivedEmailBucketPolicy:
        Type: AWS::S3::BucketPolicy
        Properties:
            Bucket: !Ref EmailBucket
            PolicyDocument:
                Statement:
                  - Effect: Allow
                    Principal:
                        Service: lambda.amazonaws.com
                    Action:
                      - s3:GetObject
                    Resource:
                      - !Sub "${EmailBucket.Arn}/*"
                    Condition:
                        StringEquals:
                            "aws:Referer":
                              - !Ref "AWS::AccountId"
                  - Effect: Allow
                    Principal:
                        Service: ses.amazonaws.com
                    Action:
                      - s3:PutObject
                    Resource:
                      - !Sub "${EmailBucket.Arn}/*"
                    Condition:
                        StringEquals:
                            "aws:Referer":
                              - !Ref "AWS::AccountId"

    AutomationUser:
        DependsOn:
          - AutomationCredentials
        Type: AWS::IAM::User
        Properties:
            UserName: !Sub "{{resolve:secretsmanager:${AutomationCredentials}:SecretString:username}}"
            LoginProfile:
                Password: !Sub "{{resolve:secretsmanager:${AutomationCredentials}:SecretString:password}}"
            Policies:
              - PolicyName: root
                PolicyDocument:
                    Version: '2012-10-17'
                    Statement:
                      - Effect: Allow
                        Action:
                          - '*' # TODO: Fix. I'm sorry, I have no idea what magic the console is doing.
                        Resource: '*'
    
    AutomationCredentials:
        Type: AWS::SecretsManager::Secret
        Properties:
            Name: account-controller-automation-secret
            Description: Contains secret data for account automation
            GenerateSecretString:
                SecretStringTemplate: !Sub |
                    {
                        "username": "${AutomationUsername}",
                        "ccmonth": "${CCMonth}",
                        "ccyear": "${CCYear}",
                        "ccname": "${CCName}",
                        "ccnumber": "${CCNumber}"
                    }
                GenerateStringKey: "password"
                PasswordLength: 30
                ExcludeCharacters: '"@/\'
    
    ConnectSetup:
        Condition: AccountDeletionEnabled
        DependsOn:
          - LambdaLogGroup
          - ReceiptRuleSet
          - ConnectProperties
        Type: Custom::ConnectSetup
        Properties: 
            ServiceToken: !GetAtt LambdaFunction.Arn

    ConnectProperties:
        Type: AWS::SSM::Parameter
        Properties:
            Type: String
            Value: '{}'
            Description: Account Controller properties for Amazon Connect
    
    SSOSetup:
        Condition: AccountCreationEnabled
        DependsOn:
          - LambdaLogGroup
          - SSOProperties
        Type: Custom::SSOSetup
        Properties: 
            ServiceToken: !GetAtt LambdaFunction.Arn
            SSOManagerAppName: !Ref SSOManagerAppName
            APIGatewayEndpoint: !Sub "https://${SAMLHttpApi}.execute-api.${AWS::Region}.amazonaws.com"

    SSOProperties:
        Type: AWS::SSM::Parameter
        Properties:
            Type: String
            Value: '{}'
            Description: Account Controller properties for AWS SSO

    SAMLHttpApi:
        Condition: AccountCreationEnabled
        Type: AWS::ApiGatewayV2::Api
        Properties:
            Name: !Ref AWS::StackName
            ProtocolType: HTTP
            RouteSelectionExpression: "$request.method $request.path"
            Version: "1.0"
            CorsConfiguration:
                AllowMethods:
                  - GET
                  - POST
                  - PUT
                  - DELETE
                AllowOrigins:
                  - "*"

    SAMLHttpApiStage:
        Condition: AccountCreationEnabled
        Type: AWS::ApiGatewayV2::Stage
        Properties:
            ApiId: !Ref SAMLHttpApi
            AutoDeploy: true
            StageName: "$default"

    SAMLHttpApiGetRoute:
        Condition: AccountCreationEnabled
        Type: AWS::ApiGatewayV2::Route
        Properties:
            ApiId: !Ref SAMLHttpApi
            AuthorizationType: NONE
            RouteKey: "GET /"
            Target: !Sub "integrations/${SAMLHttpApiIntegration}"

    SAMLHttpApiPostRoute:
        Condition: AccountCreationEnabled
        Type: AWS::ApiGatewayV2::Route
        Properties:
            ApiId: !Ref SAMLHttpApi
            AuthorizationType: NONE
            RouteKey: "POST /"
            Target: !Sub "integrations/${SAMLHttpApiIntegration}"

    SAMLHttpApiPostAccountsRoute:
        Condition: AccountCreationEnabled
        Type: AWS::ApiGatewayV2::Route
        Properties:
            ApiId: !Ref SAMLHttpApi
            AuthorizationType: NONE
            RouteKey: "POST /accounts"
            Target: !Sub "integrations/${SAMLHttpApiIntegration}"

    SAMLHttpApiPostDeleteaccountRoute:
        Condition: AccountCreationEnabled
        Type: AWS::ApiGatewayV2::Route
        Properties:
            ApiId: !Ref SAMLHttpApi
            AuthorizationType: NONE
            RouteKey: "POST /deleteaccount"
            Target: !Sub "integrations/${SAMLHttpApiIntegration}"

    SAMLHttpApiPostCreateaccountRoute:
        Condition: AccountCreationEnabled
        Type: AWS::ApiGatewayV2::Route
        Properties:
            ApiId: !Ref SAMLHttpApi
            AuthorizationType: NONE
            RouteKey: "POST /createaccount"
            Target: !Sub "integrations/${SAMLHttpApiIntegration}"

    SAMLHttpApiIntegration:
        Condition: AccountCreationEnabled
        Type: AWS::ApiGatewayV2::Integration
        Properties:
            ApiId: !Ref SAMLHttpApi
            ConnectionType: INTERNET
            IntegrationMethod: POST
            IntegrationType: AWS_PROXY
            IntegrationUri: !GetAtt LambdaFunction.Arn
            PayloadFormatVersion: "2.0"

    AccountDeletionSNSTopic:
        Condition: AccountDeletionEnabled
        Type: AWS::SNS::Topic

    AccountDeletionSNSTopicLambdaSubscription:
        Condition: AccountDeletionEnabled
        Type: AWS::SNS::Subscription
        Properties:
            Protocol: lambda
            TopicArn: !Ref AccountDeletionSNSTopic
            Endpoint: !GetAtt LambdaFunction.Arn
          
    AccountDeletionSNSTopicPolicy:
        Condition: AccountDeletionEnabled
        Type: AWS::SNS::TopicPolicy
        Properties:
            PolicyDocument:
                Version: '2012-10-17'
                Statement:
                  - Effect: Allow
                    Principal:
                        AWS: "*"
                    Action:
                      - sns:Publish
                    Resource: !Ref AccountDeletionSNSTopic
                    Condition:
                        ArnLike:
                            aws:SourceArn: arn:aws:cloudwatch:us-east-1:*:alarm:AccountManagerDeletionBudgetMonitor
            Topics:
              - !Ref AccountDeletionSNSTopic