cloudtrail-config-guardduty-securityhub-new.yaml

AWSTemplateFormatVersion: 2010-09-09
Description: >-
  AWS CloudFormation  Template for enabling CloudTrail, Config and GuardDuty. 
  **WARNING** You will be billed for the AWS resources created if you create a 
  stack from this template.

  Copyright 2019-2021 Amazon.com, Inc. or its affiliates. All Rights Reserved.
  
  Licensed under the Apache License, Version 2.0 (the "License").
  You may not use this file except in compliance with the License.
  A copy of the License is located at
  
      https://www.apache.org/licenses/LICENSE-2.0
  
  or in the "license" file accompanying this file. This file is distributed 
  on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either 
  express or implied. See the License for the specific language governing 
  permissions and limitations under the License.

Parameters:
  #General
  ParentKmsKeyStack:
    Description: 'Optional Stack name of parent KMS key stack based on kms-key.yaml template.'
    Type: String
    Default: ''
  ParentAlertStack:
    Description: 'Optional but recommended stack name of parent alert stack based on https://github.com/kkpkishan/AWS-SNS/blob/master/alert.yaml template.'
    Type: String
    Default: ''
  Config:
    Type: String
    Description: 'Configure AWS Config. If you have previously enabled Config select No.'
    Default: 'Yes'
    AllowedValues:
      - 'No'
      - 'Yes'
  GuardDuty:
    Type: String
    Description: 'Configure Amazon GuardDuty. If you have previously enabled GuardDuty select No.'
    Default: 'Yes'
    AllowedValues:
      - 'No'
      - 'Yes'
  SecurityHub:
    Type: String
    Description: 'Configure AWS Security Hub. AWS Config must be enabled in this stack for Security Hub to work.'
    Default: 'Yes'
    AllowedValues:
      - 'No'
      - 'Yes'
  S3BucketPolicyExplicitDeny:
    Type: String
    Description: 'Optional: Explicitly deny destructive actions to buckets created in this stack. Note: you will need to login as root to remove the bucket policy'
    Default: 'No'
    AllowedValues:
      - 'No'
      - 'Yes'
  S3AccessLogsBucketName:
    Type: String
    Description: 'Optional: The name of an existing S3 bucket for storing S3 Access Logs. Leave blank for no S3 access logs.'
    Default: ''
  #CloudTrail
  CloudTrailBucketName:
    Type: String
    Description: The name of the new S3 bucket to create for CloudTrail to send logs to. Can contain only lower-case characters, numbers, periods, and dashes.Each label in the bucket name must start with a lowercase letter or number.
    MinLength: '3'
    MaxLength: '63'
    AllowedPattern: '([a-zA-Z0-9]){1}([a-zA-Z0-9-])*'
  CloudTrailCWLogsRetentionTime:
    Type: Number
    Description: 'Number of days to retain logs in CloudWatch Logs. 0=Forever. Default 1 year, note logs are stored in S3 default 10 years'
    Default: '365'
  CloudTrailS3RetentionTime:
    Type: Number
    Description: Number of days to retain logs in the S3 Bucket before they are automatically deleted. Default is ~ 10 years
    Default: '3650'
  CloudTrailEncryptS3Logs:
    Type: String
    Description: 'OPTIONAL: Use KMS to enrypt logs stored in S3. A new key will be created'
    Default: 'No'
    AllowedValues:
      - 'No'
      - 'Yes'
  CloudTrailLogS3DataEvents:
    Type: String
    Description: 'OPTIONAL: These events provide insight into the resource operations performed on or within S3'
    Default: 'No'
    AllowedValues:
      - 'No'
      - 'Yes'
  #Config
  ConfigBucketName:
    Type: String
    Description: >-
      The name of the S3 bucket Config Service will store configuration
      snapshots in. Each label in the bucket name must start with a lowercase letter or number.
  ConfigSnapshotFrequency:
    Type: String
    Description: AWS Config configuration snapshot frequency
    Default: One_Hour
    AllowedValues:
      - One_Hour
      - Three_Hours
      - Six_Hours
      - Twelve_Hours
      - TwentyFour_Hours
  ConfigS3RetentionTime:
    Type: Number
    Description: Number of days to retain logs in the S3 Bucket before they are automatically deleted. Default is ~ 10 years
    Default: '3650'
  #GuardDuty
  GuardDutyEmailAddress:
    Type: String
    Default: 'someone@example.com'
    Description: Enter the email address that will receive the alerts
  WorkloadRegion:
    Description: AWS region for the workload region
    Type: String
    Default: ap-south-1
    AllowedValues:
      - ap-east-1
      - ap-northeast-1
      - ap-northeast-2
      - ap-northeast-3
      - ap-south-1
      - ap-southeast-1
      - ap-southeast-2
      - ca-central-1
      - cn-north-1
      - cn-northwest-1
      - eu-central-1
      - eu-north-1
      - eu-south-1
      - eu-west-1
      - eu-west-2
      - eu-west-3
      - me-south-1
      - sa-east-1
      - us-east-1
      - us-east-2
      - us-west-1
      - us-west-2
Conditions:
  ConfigEnabled: !Equals
    - !Ref Config
    - 'Yes'
  GuardDutyEnabled: !Equals
    - !Ref GuardDuty
    - 'Yes'
  SecurityHubEnabled: !Equals
    - !Ref SecurityHub
    - 'Yes'
  S3BucketExplicitDenyEnabled: !Equals 
    - !Ref S3BucketPolicyExplicitDeny
    - 'Yes'
  CloudTrailEncryptS3LogsEnabled: !Equals
    - !Ref CloudTrailEncryptS3Logs
    - 'Yes'
  BucketLoggingEnabled: !Not 
    - !Equals 
      - !Ref S3AccessLogsBucketName
      - ''
  CloudTrailLogS3DataEventsEnabled: !Equals
    - !Ref CloudTrailLogS3DataEvents
    - 'Yes'
  HasAlertTopic: !Not [!Equals [!Ref ParentAlertStack, '']]
  HasKmsKey: !Not [!Equals [!Ref ParentKmsKeyStack, '']]

Metadata:
  'AWS::CloudFormation::Interface':
    ParameterGroups:
      - Label:
          default: 'Parent Parameters'
        Parameters:
          - ParentAlertStack
      - Label:
          default: General
        Parameters:
          - CloudTrail
          - Config
          - GuardDuty
          - SecurityHub
          - S3BucketPolicyExplicitDeny
          - S3AccessLogsBucketName
      - Label:
          default: CloudTrail
        Parameters:  
          - CloudTrailBucketName
          - CloudTrailCWLogsRetentionTime
          - CloudTrailS3RetentionTime
          - CloudTrailEncryptS3Logs
          - CloudTrailLogS3DataEvents
      - Label:
          default: Config
        Parameters:    
          - ConfigBucketName
          - ConfigSnapshotFrequency
          - ConfigS3RetentionTime
      - Label:
          default: GuardDuty
        Parameters:    
          - GuardDutyEmailAddress

Resources:
  #CloudTrail
  CloudTrailKMSKey:
    Type: 'AWS::KMS::Key'
    DeletionPolicy: Delete
    Condition: CloudTrailEncryptS3LogsEnabled
    Properties:
      Description: KMS Key for Cloudtrail to use to encrypt logs stored in S3
      KeyPolicy:
        Version: 2012-10-17
        Id: Key policy created by CloudTrail
        Statement:
          - Sid: Enable IAM User Permissions
            Effect: Allow
            Principal:
              AWS:
                - !Join 
                  - ''
                  - - 'arn:aws:iam::'
                    - !Ref 'AWS::AccountId'
                    - ':root'
            Action: 'kms:*'
            Resource: '*'
          - Sid: Allow CloudTrail to encrypt logs
            Effect: Allow
            Principal:
              Service:
                - cloudtrail.amazonaws.com
            Action: 'kms:GenerateDataKey*'
            Resource: '*'
            Condition:
              StringLike:
                'kms:EncryptionContext:aws:cloudtrail:arn': !Join 
                  - ''
                  - - 'arn:aws:cloudtrail:*:'
                    - !Ref 'AWS::AccountId'
                    - ':trail/*'
          - Sid: Allow CloudTrail to describe key
            Effect: Allow
            Principal:
              Service:
                - cloudtrail.amazonaws.com
            Action: 'kms:DescribeKey'
            Resource: '*'
          - Sid: Allow principals in the account to decrypt log files
            Effect: Allow
            Principal:
              AWS: '*'
            Action:
              - 'kms:Decrypt'
              - 'kms:ReEncryptFrom'
            Resource: '*'
            Condition:
              StringEquals:
                'kms:CallerAccount': !Ref 'AWS::AccountId'
              StringLike:
                'kms:EncryptionContext:aws:cloudtrail:arn': !Join 
                  - ''
                  - - 'arn:aws:cloudtrail:*:'
                    - !Ref 'AWS::AccountId'
                    - ':trail/*'
          - Sid: Allow alias creation during setup
            Effect: Allow
            Principal:
              AWS: '*'
            Action: 'kms:CreateAlias'
            Resource: '*'
            Condition:
              StringEquals:
                'kms:ViaService': !Join 
                  - ''
                  - - ec2.
                    - !Ref 'AWS::Region'
                    - .amazonaws.com
                'kms:CallerAccount': !Ref 'AWS::AccountId'
          - Sid: Enable cross account log decryption
            Effect: Allow
            Principal:
              AWS: '*'
            Action:
              - 'kms:Decrypt'
              - 'kms:ReEncryptFrom'
            Resource: '*'
            Condition:
              StringEquals:
                'kms:CallerAccount': !Ref 'AWS::AccountId'
              StringLike:
                'kms:EncryptionContext:aws:cloudtrail:arn': !Join 
                  - ''
                  - - 'arn:aws:cloudtrail:*:'
                    - !Ref 'AWS::AccountId'
                    - ':trail/*'
  CloudTrailDestinationBucket:
    Type: 'AWS::S3::Bucket'
    #https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-s3-bucket.html
    Properties:
      BucketName: !Ref CloudTrailBucketName
      LoggingConfiguration: !If 
        - BucketLoggingEnabled
        - DestinationBucketName: !Ref S3AccessLogsBucketName
          LogFilePrefix: !Join 
            - ''
            - - !Ref CloudTrailBucketName
              - /
        - !Ref 'AWS::NoValue'
      VersioningConfiguration:
        Status: Enabled
      LifecycleConfiguration:
        Rules:
          - Id: Delete
            Status: Enabled
            ExpirationInDays: !Ref CloudTrailS3RetentionTime
    DeletionPolicy: Delete
  CloudTrailBucketPolicy:
    Type: 'AWS::S3::BucketPolicy'
    #https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-s3-policy.html
    DependsOn:
      - CloudTrailDestinationBucket
    Properties:
      Bucket: !Ref CloudTrailDestinationBucket
      PolicyDocument:
        Id: CloudTrailService
        Statement:
          - !If 
            - S3BucketExplicitDenyEnabled
            - Action:
                - 's3:DeleteBucket'
                - 's3:DeleteBucketPolicy'
                - 's3:DeleteBucketWebsite'
                - 's3:DeleteObject'
                - 's3:DeleteObjectVersion'
                - 's3:PutAccelerateConfiguration'
                - 's3:PutBucketAcl'
                - 's3:PutBucketCORS'
                - 's3:PutBucketLogging'
                - 's3:PutBucketPolicy'
                - 's3:PutBucketRequestPayment'
                - 's3:PutBucketVersioning'
                - 's3:PutBucketWebsite'
                - 's3:PutLifecycleConfiguration'
                - 's3:PutReplicationConfiguration'
                - 's3:ReplicateDelete'
                - 's3:ReplicateObject'
                - 's3:RestoreObject'
              Effect: Deny
              Principal: '*'
              Resource:
                - !Join 
                  - ''
                  - - 'arn:aws:s3:::'
                    - !Ref CloudTrailDestinationBucket
                    - /*
                - !Join 
                  - ''
                  - - 'arn:aws:s3:::'
                    - !Ref CloudTrailDestinationBucket
              Sid: DenyDestructiveActions
            - !Ref 'AWS::NoValue'
          - Action:
              - 's3:GetBucketAcl'
            Principal:
              Service: cloudtrail.amazonaws.com
            Effect: Allow
            Resource:
              - !Join 
                - ''
                - - 'arn:aws:s3:::'
                  - !Ref CloudTrailDestinationBucket
            Sid: AllowCloudTrailServiceGetAcl
          - Action:
              - 's3:PutObject'
            Principal:
              Service: cloudtrail.amazonaws.com
            Effect: Allow
            Condition:
              StringEquals:
                's3:x-amz-acl': bucket-owner-full-control
            Resource:
              - !Join 
                - ''
                - - 'arn:aws:s3:::'
                  - !Ref CloudTrailDestinationBucket
                  - /*
            Sid: AllowCloudTrailServicePut
          - Action:
             - 's3:PutObject'
            Principal: 
              AWS: 
                - '981588356137'
                - '129689185312'
            Effect: Allow
            Resource:
             - !Join
               - ''
               - - 'arn:aws:s3:::'
                 - !Ref CloudTrailDestinationBucket
                 - /*
            Sid: AllowManagedAccountsCloudtrail
        Version: 2012-10-17
  CloudTrailDestinationTrail:
    Type: 'AWS::CloudTrail::Trail'
    #https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-cloudtrail-trail.html
    DependsOn:
      - CloudTrailBucketPolicy
      - CloudTrailCWLogsGroup
      - CloudTrailCloudWatchLogsRole
    Properties:
      TrailName: default
      S3BucketName: !Ref CloudTrailDestinationBucket
      #S3KeyPrefix:
      CloudWatchLogsLogGroupArn: !Sub '${CloudTrailCWLogsGroup.Arn}'
      CloudWatchLogsRoleArn: !Sub '${CloudTrailCloudWatchLogsRole.Arn}'
      #CloudWatchLogsRoleArn: !Sub 'arn:aws:iam::${AWS::AccountId}:role/aws-service-role/cloudtrail.amazonaws.com/AWSServiceRoleForCloudTrail'
      EnableLogFileValidation: true
      EventSelectors: #https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudtrail-trail-eventselector.html
        - IncludeManagementEvents: true
        - ReadWriteType: All
        - !If 
          - CloudTrailLogS3DataEventsEnabled
          - DataResources:
            - Type: AWS::S3::Object
              Values:
                - "arn:aws:s3:::"
          - !Ref 'AWS::NoValue'
      IncludeGlobalServiceEvents: true
      IsMultiRegionTrail: true
      IsLogging: true
      KMSKeyId: !If 
        - CloudTrailEncryptS3LogsEnabled
        - !Ref CloudTrailKMSKey
        - !Ref 'AWS::NoValue'
  CloudTrailCWLogsGroup:
    Type: 'AWS::Logs::LogGroup'
    Properties:
      RetentionInDays: !Ref CloudTrailCWLogsRetentionTime
  CloudTrailCloudWatchLogsRole:
    Type: 'AWS::IAM::Role'
    DependsOn:
      - CloudTrailCWLogsGroup
    Properties:
      AssumeRolePolicyDocument:
        Statement:
          - Action:
              - 'sts:AssumeRole'
            Effect: Allow
            Principal:
              Service: cloudtrail.amazonaws.com
        Version: 2012-10-17
      Policies:
        - PolicyDocument:
            Statement:
              - Action:
                  - 'logs:CreateLogStream'
                Effect: Allow
                Resource: !Sub '${CloudTrailCWLogsGroup.Arn}'
              - Action:
                  - 'logs:PutLogEvents'
                Effect: Allow
                Resource: !Sub '${CloudTrailCWLogsGroup.Arn}'
            Version: 2012-10-17
          PolicyName: CloudtrailInteractionPolicy
  UnauthorizedOperationMetricFilter: # CIS 3.1
    Condition: HasAlertTopic
    Type: 'AWS::Logs::MetricFilter'
    Properties:
      FilterPattern: '{($.errorCode = "*UnauthorizedOperation") || ($.errorCode = "AccessDenied*")}'
      LogGroupName: !Ref CloudTrailCWLogsGroup
      MetricTransformations:
      - MetricValue: '1'
        MetricNamespace: !Ref 'AWS::StackName'
        MetricName: 'UnauthorizedOperationCount'
  UnauthorizedOperationAlarm:
    Condition: HasAlertTopic
    Type: 'AWS::CloudWatch::Alarm'
    Properties:
      AlarmDescription: 'CloudTrail: unauthorized API calls detected'
      Namespace: !Ref 'AWS::StackName'
      MetricName: UnauthorizedOperationCount
      Statistic: Sum
      Period: 300
      EvaluationPeriods: 1
      ComparisonOperator: GreaterThanThreshold
      Threshold: 0
      AlarmActions:
      - {'Fn::ImportValue': !Sub '${ParentAlertStack}-TopicARN'}
      TreatMissingData: notBreaching
  NonMfaConsoleLoginMetricFilter: # CIS 3.2
    Condition: HasAlertTopic
    Type: 'AWS::Logs::MetricFilter'
    Properties:
      FilterPattern: '{($.eventName = "ConsoleLogin") && ($.additionalEventData.MFAUsed != "Yes") && ($.userIdentity.type != "AssumedRole")}'
      LogGroupName: !Ref CloudTrailCWLogsGroup
      MetricTransformations:
      - MetricValue: '1'
        MetricNamespace: !Ref 'AWS::StackName'
        MetricName: 'NonMfaConsoleLoginCount'
  NonMfaConsoleLoginAlarm:
    Condition: HasAlertTopic
    Type: 'AWS::CloudWatch::Alarm'
    Properties:
      AlarmDescription: 'CloudTrail: Management Console sign-in without MFA detected'
      Namespace: !Ref 'AWS::StackName'
      MetricName: NonMfaConsoleLoginCount
      Statistic: Sum
      Period: 300
      EvaluationPeriods: 1
      ComparisonOperator: GreaterThanThreshold
      Threshold: 0
      AlarmActions:
      - {'Fn::ImportValue': !Sub '${ParentAlertStack}-TopicARN'}
      TreatMissingData: notBreaching
  MetricFilterCloudTrailChange:
    Condition: HasAlertTopic
    Type: 'AWS::Logs::MetricFilter'
    Properties:
      FilterPattern: >-
        {($.eventSource = cloudtrail.amazonaws.com) && (($.eventName !=
        Describe*) && ($.eventName != Get*) && ($.eventName != Lookup*) &&
        ($.eventName != List*))}
      LogGroupName: !Ref CloudTrailCWLogsGroup
      MetricTransformations:
        - MetricName: CloudTrailChangeCount
          MetricNamespace: !Ref 'AWS::StackName'
          MetricValue: '1'

  MetricFilterIAMCreateAccessKey:
    Condition: HasAlertTopic
    Type: 'AWS::Logs::MetricFilter'
    Properties:
      FilterPattern: '{($.eventName=CreateAccessKey)}'
      LogGroupName: !Ref CloudTrailCWLogsGroup
      MetricTransformations:
        - MetricName: NewAccessKeyCreated
          MetricNamespace: !Ref 'AWS::StackName'
          MetricValue: '1'

  CloudWatchAlarmCloudTrailChange:
    Condition: HasAlertTopic
    Type: 'AWS::CloudWatch::Alarm'
    Properties:
      ComparisonOperator: GreaterThanOrEqualToThreshold
      EvaluationPeriods: 1
      ActionsEnabled: true
      AlarmActions:
      - {'Fn::ImportValue': !Sub '${ParentAlertStack}-TopicARN'}
      AlarmDescription: >-
        Warning: Changes to CloudTrail log configuration detected in this
        account.
      AlarmName: cloudtrail-change-alarm
      MetricName: CloudTrailChangeCount
      Namespace: CloudTrailMetrics
      Period: 300
      Statistic: Sum
      Threshold: 1
  CloudWatchAlarmIAMCreateAccessKey:
    Condition: HasAlertTopic
    Type: 'AWS::CloudWatch::Alarm'
    Properties:
      ComparisonOperator: GreaterThanOrEqualToThreshold
      EvaluationPeriods: 1
      ActionsEnabled: true
      AlarmActions:
      - {'Fn::ImportValue': !Sub '${ParentAlertStack}-TopicARN'}
      AlarmDescription: >-
        Warning: New IAM access key was created. Please be sure this action was
        neccessary.
      AlarmName: iam-create-access-key-alarm
      MetricName: NewAccessKeyCreated
      Namespace: CloudTrailMetrics
      Period: 300
      Statistic: Sum
      Threshold: 1
  RootUserActivityMetricFilter: # CIS 1.1 & 3.3
    Condition: HasAlertTopic
    Type: 'AWS::Logs::MetricFilter'
    Properties:
      FilterPattern: '{$.userIdentity.type = "Root" && $.userIdentity.invokedBy NOT EXISTS && $.eventType != "AwsServiceEvent"}'
      LogGroupName: !Ref CloudTrailCWLogsGroup
      MetricTransformations:
      - MetricValue: '1'
        MetricNamespace: !Ref 'AWS::StackName'
        MetricName: 'RootUserActivityCount'
  RootUserActivityAlarm:
    Condition: HasAlertTopic
    Type: 'AWS::CloudWatch::Alarm'
    Properties:
      AlarmDescription: 'CloudTrail: usage of root account/user detected'
      Namespace: !Ref 'AWS::StackName'
      MetricName: RootUserActivityCount
      Statistic: Sum
      Period: 300
      EvaluationPeriods: 1
      ComparisonOperator: GreaterThanThreshold
      Threshold: 0
      AlarmActions:
      - {'Fn::ImportValue': !Sub '${ParentAlertStack}-TopicARN'}
      TreatMissingData: notBreaching
  UnauthorizedOperationRegionMetricFilter: 
    Condition: HasAlertTopic
    Type: 'AWS::Logs::MetricFilter'
    Properties:
      FilterPattern: !Sub "{ ($.eventType = \"AwsApiCall\") && ($.awsRegion != \"${WorkloadRegion}\") }"
      LogGroupName: !Ref CloudTrailCWLogsGroup
      MetricTransformations:
      - MetricValue: '1'
        MetricNamespace: !Ref 'AWS::StackName'
        MetricName: 'UnauthorizedOperationRegionCount'
  UnauthorizedOperationRegionAlarm:
    Condition: HasAlertTopic
    Type: 'AWS::CloudWatch::Alarm'
    Properties:
      AlarmDescription: 'CloudTrail:  Unauthorized Operation detected in non-workload Region'
      Namespace: !Ref 'AWS::StackName'
      MetricName: UnauthorizedOperationRegionCount
      Statistic: Sum
      Period: 300
      EvaluationPeriods: 1
      ComparisonOperator: GreaterThanThreshold
      Threshold: 0
      AlarmActions:
      - {'Fn::ImportValue': !Sub '${ParentAlertStack}-TopicARN'}
      TreatMissingData: notBreaching
  IamPolicyChangeMetricFilter: # CIS 3.4
    Condition: HasAlertTopic
    Type: 'AWS::Logs::MetricFilter'
    Properties:
      FilterPattern: '{($.eventName=DeleteGroupPolicy) || ($.eventName=DeleteRolePolicy) || ($.eventName=DeleteUserPolicy) || ($.eventName=PutGroupPolicy) || ($.eventName=PutRolePolicy) || ($.eventName=PutUserPolicy) || ($.eventName=CreatePolicy) || ($.eventName=DeletePolicy) || ($.eventName=CreatePolicyVersion) || ($.eventName=DeletePolicyVersion) || ($.eventName=AttachRolePolicy) || ($.eventName=DetachRolePolicy) || ($.eventName=AttachUserPolicy) || ($.eventName=DetachUserPolicy) || ($.eventName=AttachGroupPolicy) || ($.eventName=DetachGroupPolicy)}'
      LogGroupName: !Ref CloudTrailCWLogsGroup
      MetricTransformations:
      - MetricValue: '1'
        MetricNamespace: !Ref 'AWS::StackName'
        MetricName: 'IamPolicyChangeCount'
  IamPolicyChangeAlarm:
    Condition: HasAlertTopic
    Type: 'AWS::CloudWatch::Alarm'
    Properties:
      AlarmDescription: 'CloudTrail: IAM policy changes detected'
      Namespace: !Ref 'AWS::StackName'
      MetricName: IamPolicyChangeCount
      Statistic: Sum
      Period: 300
      EvaluationPeriods: 1
      ComparisonOperator: GreaterThanThreshold
      Threshold: 0
      AlarmActions:
      - {'Fn::ImportValue': !Sub '${ParentAlertStack}-TopicARN'}
      TreatMissingData: notBreaching
  CloudTrailConfigChangeMetricFilter: # CIS 3.5
    Condition: HasAlertTopic
    Type: 'AWS::Logs::MetricFilter'
    Properties:
      FilterPattern: '{($.eventName = CreateTrail) || ($.eventName = UpdateTrail) || ($.eventName = DeleteTrail) || ($.eventName = StartLogging) || ($.eventName = StopLogging)}'
      LogGroupName: !Ref CloudTrailCWLogsGroup
      MetricTransformations:
      - MetricValue: '1'
        MetricNamespace: !Ref 'AWS::StackName'
        MetricName: 'CloudTrailConfigChangeCount'
  CloudTrailConfigChangeAlarm:
    Condition: HasAlertTopic
    Type: 'AWS::CloudWatch::Alarm'
    Properties:
      AlarmDescription: 'CloudTrail: CloudTrail configuration changes detected'
      Namespace: !Ref 'AWS::StackName'
      MetricName: CloudTrailConfigChangeCount
      Statistic: Sum
      Period: 300
      EvaluationPeriods: 1
      ComparisonOperator: GreaterThanThreshold
      Threshold: 0
      AlarmActions:
      - {'Fn::ImportValue': !Sub '${ParentAlertStack}-TopicARN'}
      TreatMissingData: notBreaching
  ManagementConsoleAuthFailureMetricFilter: # CIS 3.6
    Condition: HasAlertTopic
    Type: 'AWS::Logs::MetricFilter'
    Properties:
      FilterPattern: '{($.eventName = ConsoleLogin) && ($.errorMessage = "Failed authentication")}'
      LogGroupName: !Ref CloudTrailCWLogsGroup
      MetricTransformations:
      - MetricValue: '1'
        MetricNamespace: !Ref 'AWS::StackName'
        MetricName: 'ManagementConsoleAuthFailureCount'
  ManagementConsoleAuthFailureAlarm:
    Condition: HasAlertTopic
    Type: 'AWS::CloudWatch::Alarm'
    Properties:
      AlarmDescription: 'CloudTrail: Management Console authentication failures detected'
      Namespace: !Ref 'AWS::StackName'
      MetricName: ManagementConsoleAuthFailureCount
      Statistic: Sum
      Period: 300
      EvaluationPeriods: 1
      ComparisonOperator: GreaterThanThreshold
      Threshold: 0
      AlarmActions:
      - {'Fn::ImportValue': !Sub '${ParentAlertStack}-TopicARN'}
      TreatMissingData: notBreaching
  DeletingKmsCmkMetricFilter: # CIS 3.7
    Condition: HasAlertTopic
    Type: 'AWS::Logs::MetricFilter'
    Properties:
      FilterPattern: '{($.eventSource = kms.amazonaws.com) && (($.eventName=DisableKey) || ($.eventName=ScheduleKeyDeletion))}'
      LogGroupName: !Ref CloudTrailCWLogsGroup
      MetricTransformations:
      - MetricValue: '1'
        MetricNamespace: !Ref 'AWS::StackName'
        MetricName: 'DeletingKmsCmkCount'
  DeletingKmsCmkAlarm:
    Condition: HasAlertTopic
    Type: 'AWS::CloudWatch::Alarm'
    Properties:
      AlarmDescription: 'CloudTrail: disabling or scheduled deletion of customer created CMKs detected'
      Namespace: !Ref 'AWS::StackName'
      MetricName: DeletingKmsCmkCount
      Statistic: Sum
      Period: 300
      EvaluationPeriods: 1
      ComparisonOperator: GreaterThanThreshold
      Threshold: 0
      AlarmActions:
      - {'Fn::ImportValue': !Sub '${ParentAlertStack}-TopicARN'}
      TreatMissingData: notBreaching
  S3BucketPolicyChangeMetricFilter: # CIS 3.8
    Condition: HasAlertTopic
    Type: 'AWS::Logs::MetricFilter'
    Properties:
      FilterPattern: '{($.eventSource = s3.amazonaws.com) && (($.eventName = PutBucketAcl) || ($.eventName = PutBucketPolicy) || ($.eventName = PutBucketCors) || ($.eventName = PutBucketLifecycle) || ($.eventName = PutBucketReplication) || ($.eventName = DeleteBucketPolicy) || ($.eventName = DeleteBucketCors) || ($.eventName = DeleteBucketLifecycle) || ($.eventName = DeleteBucketReplication))}'
      LogGroupName: !Ref CloudTrailCWLogsGroup
      MetricTransformations:
      - MetricValue: '1'
        MetricNamespace: !Ref 'AWS::StackName'
        MetricName: 'S3BucketPolicyChangeCount'
  S3BucketPolicyChangeAlarm:
    Condition: HasAlertTopic
    Type: 'AWS::CloudWatch::Alarm'
    Properties:
      AlarmDescription: 'CloudTrail:  S3 bucket policy changes detected'
      Namespace: !Ref 'AWS::StackName'
      MetricName: S3BucketPolicyChangeCount
      Statistic: Sum
      Period: 300
      EvaluationPeriods: 1
      ComparisonOperator: GreaterThanThreshold
      Threshold: 0
      AlarmActions:
      - {'Fn::ImportValue': !Sub '${ParentAlertStack}-TopicARN'}
      TreatMissingData: notBreaching
  ConfigChangeMetricFilter: # CIS 3.9
    Condition: HasAlertTopic
    Type: 'AWS::Logs::MetricFilter'
    Properties:
      FilterPattern: '{($.eventSource = config.amazonaws.com) && (($.eventName = StopConfigurationRecorder) || ($.eventName = DeleteDeliveryChannel) || ($.eventName = PutDeliveryChannel) || ($.eventName = PutConfigurationRecorder))}'
      LogGroupName: !Ref CloudTrailCWLogsGroup
      MetricTransformations:
      - MetricValue: '1'
        MetricNamespace: !Ref 'AWS::StackName'
        MetricName: 'ConfigChangeCount'
  ConfigChangeAlarm:
    Condition: HasAlertTopic
    Type: 'AWS::CloudWatch::Alarm'
    Properties:
      AlarmDescription: 'CloudTrail: AWS Config configuration changes detected'
      Namespace: !Ref 'AWS::StackName'
      MetricName: ConfigChangeCount
      Statistic: Sum
      Period: 300
      EvaluationPeriods: 1
      ComparisonOperator: GreaterThanThreshold
      Threshold: 0
      AlarmActions:
      - {'Fn::ImportValue': !Sub '${ParentAlertStack}-TopicARN'}
      TreatMissingData: notBreaching
  SecurityGroupChangeMetricFilter: # CIS 3.10
    Condition: HasAlertTopic
    Type: 'AWS::Logs::MetricFilter'
    Properties:
      FilterPattern: '{($.eventName = AuthorizeSecurityGroupIngress) || ($.eventName = AuthorizeSecurityGroupEgress) || ($.eventName = RevokeSecurityGroupIngress) || ($.eventName = RevokeSecurityGroupEgress) || ($.eventName = CreateSecurityGroup) || ($.eventName = DeleteSecurityGroup)}'
      LogGroupName: !Ref CloudTrailCWLogsGroup
      MetricTransformations:
      - MetricValue: '1'
        MetricNamespace: !Ref 'AWS::StackName'
        MetricName: 'SecurityGroupChangeCount'
  SecurityGroupChangeAlarm:
    Condition: HasAlertTopic
    Type: 'AWS::CloudWatch::Alarm'
    Properties:
      AlarmDescription: 'CloudTrail: security group changes detected'
      Namespace: !Ref 'AWS::StackName'
      MetricName: SecurityGroupChangeCount
      Statistic: Sum
      Period: 300
      EvaluationPeriods: 1
      ComparisonOperator: GreaterThanThreshold
      Threshold: 0
      AlarmActions:
      - {'Fn::ImportValue': !Sub '${ParentAlertStack}-TopicARN'}
      TreatMissingData: notBreaching
  NaclChangeMetricFilter: # CIS 3.11
    Condition: HasAlertTopic
    Type: 'AWS::Logs::MetricFilter'
    Properties:
      FilterPattern: '{($.eventName = CreateNetworkAcl) || ($.eventName = CreateNetworkAclEntry) || ($.eventName = DeleteNetworkAcl) || ($.eventName = DeleteNetworkAclEntry) || ($.eventName = ReplaceNetworkAclEntry) || ($.eventName = ReplaceNetworkAclAssociation)}'
      LogGroupName: !Ref CloudTrailCWLogsGroup
      MetricTransformations:
      - MetricValue: '1'
        MetricNamespace: !Ref 'AWS::StackName'
        MetricName: 'NaclChangeCount'
  NaclChangeAlarm:
    Condition: HasAlertTopic
    Type: 'AWS::CloudWatch::Alarm'
    Properties:
      AlarmDescription: 'CloudTrail: changes to Network Access Control List (NACL) detected'
      Namespace: !Ref 'AWS::StackName'
      MetricName: NaclChangeCount
      Statistic: Sum
      Period: 300
      EvaluationPeriods: 1
      ComparisonOperator: GreaterThanThreshold
      Threshold: 0
      AlarmActions:
      - {'Fn::ImportValue': !Sub '${ParentAlertStack}-TopicARN'}
      TreatMissingData: notBreaching
  NetworkGatewayChangeMetricFilter: # CIS 3.12
    Condition: HasAlertTopic
    Type: 'AWS::Logs::MetricFilter'
    Properties:
      FilterPattern: '{($.eventName = CreateCustomerGateway) || ($.eventName = DeleteCustomerGateway) || ($.eventName = AttachInternetGateway) || ($.eventName = CreateInternetGateway) || ($.eventName = DeleteInternetGateway) || ($.eventName = DetachInternetGateway)}'
      LogGroupName: !Ref CloudTrailCWLogsGroup
      MetricTransformations:
      - MetricValue: '1'
        MetricNamespace: !Ref 'AWS::StackName'
        MetricName: 'NetworkGatewayChangeChangeCount'
  NetworkGatewayChangeAlarm:
    Condition: HasAlertTopic
    Type: 'AWS::CloudWatch::Alarm'
    Properties:
      AlarmDescription: 'CloudTrail: changes to network gateways detected'
      Namespace: !Ref 'AWS::StackName'
      MetricName: NetworkGatewayChangeChangeCount
      Statistic: Sum
      Period: 300
      EvaluationPeriods: 1
      ComparisonOperator: GreaterThanThreshold
      Threshold: 0
      AlarmActions:
      - {'Fn::ImportValue': !Sub '${ParentAlertStack}-TopicARN'}
      TreatMissingData: notBreaching
  RouteTableChangeMetricFilter: # CIS 3.13
    Condition: HasAlertTopic
    Type: 'AWS::Logs::MetricFilter'
    Properties:
      FilterPattern: '{($.eventName = CreateRoute) || ($.eventName = CreateRouteTable) || ($.eventName = ReplaceRoute) || ($.eventName = ReplaceRouteTableAssociation) || ($.eventName = DeleteRouteTable) || ($.eventName = DeleteRoute) || ($.eventName = DisassociateRouteTable)}'
      LogGroupName: !Ref CloudTrailCWLogsGroup
      MetricTransformations:
      - MetricValue: '1'
        MetricNamespace: !Ref 'AWS::StackName'
        MetricName: 'RouteTableChangeCount'
  RouteTableChangeAlarm:
    Condition: HasAlertTopic
    Type: 'AWS::CloudWatch::Alarm'
    Properties:
      AlarmDescription: 'CloudTrail: changes to route tables detected'
      Namespace: !Ref 'AWS::StackName'
      MetricName: RouteTableChangeCount
      Statistic: Sum
      Period: 300
      EvaluationPeriods: 1
      ComparisonOperator: GreaterThanThreshold
      Threshold: 0
      AlarmActions:
      - {'Fn::ImportValue': !Sub '${ParentAlertStack}-TopicARN'}
      TreatMissingData: notBreaching
  VpcChangeMetricFilter: # CIS 3.14
    Condition: HasAlertTopic
    Type: 'AWS::Logs::MetricFilter'
    Properties:
      FilterPattern: '{($.eventName = CreateVpc) || ($.eventName = DeleteVpc) || ($.eventName = ModifyVpcAttribute) || ($.eventName = AcceptVpcPeeringConnection) || ($.eventName = CreateVpcPeeringConnection) || ($.eventName = DeleteVpcPeeringConnection) || ($.eventName = RejectVpcPeeringConnection) || ($.eventName = AttachClassicLinkVpc) || ($.eventName = DetachClassicLinkVpc) || ($.eventName = DisableVpcClassicLink) || ($.eventName = EnableVpcClassicLink)}'
      LogGroupName: !Ref CloudTrailCWLogsGroup
      MetricTransformations:
      - MetricValue: '1'
        MetricNamespace: !Ref 'AWS::StackName'
        MetricName: 'VpcChangeCount'
  VpcTableChangeAlarm:
    Condition: HasAlertTopic
    Type: 'AWS::CloudWatch::Alarm'
    Properties:
      AlarmDescription: 'CloudTrail: changes to VPCs detected'
      Namespace: !Ref 'AWS::StackName'
      MetricName: VpcChangeCount
      Statistic: Sum
      Period: 300
      EvaluationPeriods: 1
      ComparisonOperator: GreaterThanThreshold
      Threshold: 0
      AlarmActions:
      - {'Fn::ImportValue': !Sub '${ParentAlertStack}-TopicARN'}
      TreatMissingData: notBreaching
  #Config
  ConfigRole:
    Type: 'AWS::IAM::Role'
    Condition: ConfigEnabled
    Properties:
      AssumeRolePolicyDocument:
        Statement:
          - Action:
              - 'sts:AssumeRole'
            Effect: Allow
            Principal:
              Service: config.amazonaws.com
        Version: 2012-10-17
      ManagedPolicyArns:
        - 'arn:aws:iam::aws:policy/service-role/AWS_ConfigRole'
      Path: /service-role/
      Policies:
        - PolicyDocument:
            Statement:
              - Effect: Allow
                Action:
                  - 's3:PutObject'
                Resource: !Sub 'arn:aws:s3:::${ConfigBucket}/*'
              - Effect: Allow
                Action:
                  - 's3:GetBucketAcl'
                Resource: !Sub 'arn:aws:s3:::${ConfigBucket}'
            Version: 2012-10-17
          PolicyName: ConfigServiceS3
  ConfigDeliveryChannel:
    Type: 'AWS::Config::DeliveryChannel'
    #https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-config-deliverychannel.html
    Condition: ConfigEnabled
    Properties:
      Name: default
      ConfigSnapshotDeliveryProperties:
        DeliveryFrequency: !Ref ConfigSnapshotFrequency
      S3BucketName: !Ref ConfigBucket
  ConfigRecorder:
    Type: 'AWS::Config::ConfigurationRecorder'
    #https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-config-configurationrecorder.html
    Condition: ConfigEnabled
    Properties:
      Name: default
      RecordingGroup:
        AllSupported: 'true'
        IncludeGlobalResourceTypes: 'true'
      RoleARN: !Sub '${ConfigRole.Arn}'
  ConfigBucket:
    Type: 'AWS::S3::Bucket'
    #https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-s3-bucket.html
    Condition: ConfigEnabled
    Properties:
      BucketName: !Ref ConfigBucketName
      LoggingConfiguration: !If 
        - BucketLoggingEnabled
        - DestinationBucketName: !Ref S3AccessLogsBucketName
          LogFilePrefix: !Join 
            - ''
            - - !Ref ConfigBucketName
              - /
        - !Ref 'AWS::NoValue'
      VersioningConfiguration:
        Status: Enabled
      LifecycleConfiguration:
        Rules:
          - Id: Delete
            Status: Enabled
            ExpirationInDays: !Ref ConfigS3RetentionTime
    DeletionPolicy: Delete
  ConfigBucketPolicy:
    Type: 'AWS::S3::BucketPolicy'
    #https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-s3-policy.html
    Condition: ConfigEnabled
    DependsOn:
      - ConfigBucket
    Properties:
      Bucket: !Ref ConfigBucket
      PolicyDocument:
        Id: ConfigService
        Statement:
          - !If 
            - S3BucketExplicitDenyEnabled
            - Action:
                - 's3:DeleteBucket'
                - 's3:DeleteBucketPolicy'
                - 's3:DeleteBucketWebsite'
                - 's3:DeleteObject'
                - 's3:DeleteObjectVersion'
                - 's3:PutAccelerateConfiguration'
                - 's3:PutBucketAcl'
                - 's3:PutBucketCORS'
                - 's3:PutBucketLogging'
                - 's3:PutBucketPolicy'
                - 's3:PutBucketRequestPayment'
                - 's3:PutBucketVersioning'
                - 's3:PutBucketWebsite'
                - 's3:PutLifecycleConfiguration'
                - 's3:PutReplicationConfiguration'
                - 's3:ReplicateDelete'
                - 's3:ReplicateObject'
                - 's3:RestoreObject'
              Effect: Deny
              Principal: '*'
              Resource:
                - !Join 
                  - ''
                  - - 'arn:aws:s3:::'
                    - !Ref ConfigBucket
                    - /*
                - !Join 
                  - ''
                  - - 'arn:aws:s3:::'
                    - !Ref ConfigBucket
              Sid: DenyDestructiveActions
            - !Ref 'AWS::NoValue'
          - Action: 's3:GetBucketAcl'
            Effect: Allow
            Principal:
              Service: cloudtrail.amazonaws.com
            Resource: !Join 
              - ''
              - - 'arn:aws:s3:::'
                - !Ref ConfigBucket
            Sid: ConfigServiceACLCheck
          - Action: 's3:PutObject'
            Condition:
              StringEquals:
                's3:x-amz-acl': bucket-owner-full-control
            Effect: Allow
            Principal:
              Service: cloudtrail.amazonaws.com
            Resource:
              - !Join 
                - ''
                - - 'arn:aws:s3:::'
                  - !Ref ConfigBucket
                  - /*
            Sid: ConfigServiceWrite
        Version: 2012-10-17
  #GuardDuty
  GuardDutyDetector:
    Type: 'AWS::GuardDuty::Detector'
    #https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-guardduty-detector.html
    Condition: GuardDutyEnabled
    Properties:
      Enable: true
      FindingPublishingFrequency: FIFTEEN_MINUTES
  GuardDutySNSTopic:
    Type: 'AWS::SNS::Topic'
    #https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-sns-topic.html
    Condition: GuardDutyEnabled
    Properties:
      TopicName: GuardDuty-Email
      KmsMasterKeyId: !If [HasKmsKey, {'Fn::ImportValue': !Sub '${ParentKmsKeyStack}-KeyId'}, !Ref 'AWS::NoValue']
  GuardDutyCWEvent:
    Type: 'AWS::Events::Rule'
    #https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-events-rule-target.html
    Condition: GuardDutyEnabled
    Properties:
      Description: GuardDuty Email Event
      EventPattern:
        source:
          - aws.guardduty
        detail-type:
          - GuardDuty Finding
      State: ENABLED
      Targets:
        - Arn: !Ref GuardDutySNSTopic
          Id: GuardDuty-Email
  GuardDutySNSSubscription:
    Type: 'AWS::SNS::Subscription'
    #https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-sns-subscription.html
    Condition: GuardDutyEnabled
    Properties:
      Endpoint: !Ref GuardDutyEmailAddress
      Protocol: email
      TopicArn: !Ref GuardDutySNSTopic
  #SecurityHub
  SecurityHubSingleAcc:
    Type: 'AWS::SecurityHub::Hub'
    Condition: SecurityHubEnabled
    DependsOn: ConfigRecorder
Outputs:
  CloudTrailBucketName:
    Description: S3 bucket for CloudTrail logs
    Value: !Ref CloudTrailDestinationBucket
    Export:
      Name: !Sub '${AWS::StackName}-CloudTrailBucketName'