/
s3-events.yml
88 lines (84 loc) · 2.66 KB
/
s3-events.yml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
AWSTemplateFormatVersion: '2010-09-09'
Description: 'cloudtrail-streamer dev template for s3 events'
Parameters:
LambdaBucket:
Description: 'S3 bucket with Lambda code'
Type: String
LambdaKey:
Description: 'S3 bucket key with Lambda code'
Type: String
Resources:
CTStreamerRole:
Type: 'AWS::IAM::Role'
Properties:
AssumeRolePolicyDocument:
Statement:
- Action:
- 'sts:AssumeRole'
Effect: Allow
Principal:
Service: lambda.amazonaws.com
Policies:
- PolicyDocument:
Statement:
- Action:
- 's3:GetObject'
Resource: "arn:aws:s3:::ctstreamer-dev-s3/*" # Hardcoded to avoid circular dependencies
Effect: 'Allow'
PolicyName: CTStreamer-GetCloudtrailLogs
- PolicyDocument:
Statement:
- Action:
- 'kinesis:*'
Resource: !Sub ${KinesisStream.Arn}
Effect: 'Allow'
PolicyName: CTStreamer-Kinesis
- PolicyDocument:
Statement:
- Action:
- 'logs:CreateLogGroup'
- 'logs:CreateLogStream'
- 'logs:PutLogEvents'
Resource: 'arn:aws:logs:*:*:*'
Effect: 'Allow'
PolicyName: CTStreamer-Logs
S3Bucket:
Type: 'AWS::S3::Bucket'
DependsOn:
- CTStreamerFunction
- PermissionForS3BucketToInvokeLambda
Properties:
BucketName: 'ctstreamer-dev-s3'
NotificationConfiguration:
LambdaConfigurations:
- Function: !Sub ${CTStreamerFunction.Arn}
Event: 's3:ObjectCreated:*'
KinesisStream:
Type: 'AWS::Kinesis::Stream'
Properties:
Name: 'ctstreamer-dev-s3'
ShardCount: 1
PermissionForS3BucketToInvokeLambda:
Type: 'AWS::Lambda::Permission'
Properties:
SourceArn: "arn:aws:s3:::ctstreamer-dev-s3" # Hardcoded to avoid circular dependencies
Action: lambda:InvokeFunction
FunctionName: !Ref CTStreamerFunction
Principal: s3.amazonaws.com
CTStreamerFunction:
Type: 'AWS::Lambda::Function'
Properties:
Description: cloudtrail-streamer Lambda function
FunctionName: ctstreamer-dev-s3
Handler: cloudtrail-streamer
Role: !Sub ${CTStreamerRole.Arn}
Runtime: go1.x
Timeout: 60
Code:
S3Key: !Ref LambdaKey
S3Bucket: !Ref LambdaBucket
Environment:
Variables:
CT_DEBUG_LOGGING: '1' # Set debug logging for dev Lambda deployment
CT_KINESIS_STREAM: !Ref KinesisStream
CT_KINESIS_REGION: !Ref AWS::Region