main.yml

---
AWSTemplateFormatVersion: "2010-09-09"
Description: This CloudFormation stack deploys an AWS Lambda Function which retrieves the Outputs of this stack and nested stacks within this stack and POST them as a HTTP Request to any API Endpoint.

Parameters:
  DomainName:
    Description: The registered domain name of your business.
    Type: String

  GitHubBranch:
    Description: "GitHub Branch. Example: main, dev."
    Type: String
    Default: main

  S3Key:
    Description: S3 Bucket Name.
    Default: "lambda-aws-python-post-stack-outputs.zip"
    Type: String

Resources:
  PostCFNOutputToAPIEndpointLambdaRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Principal:
              Service: lambda.amazonaws.com
            Action: sts:AssumeRole
      Path: /
      Policies:
        - PolicyName: AllowLogging
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Effect: Allow
                Action:
                  - logs:CreateLogGroup
                  - logs:CreateLogStream
                  - logs:PutLogEvents
                Resource: !Sub "arn:${AWS::Partition}:logs:${AWS::Region}:${AWS::AccountId}:*"
              - Effect: Allow
                Action:
                  - cloudformation:DescribeStackResources
                  - cloudformation:DescribeStacks
                Resource: !Sub "arn:${AWS::Partition}:cloudformation:${AWS::Region}:${AWS::AccountId}:stack/*/*"
        - PolicyName: AWSOrganizationsReadOnly
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Effect: Allow
                Action:
                  - organizations:DescribeAccount
                Resource: "*"
        - PolicyName: AWSAccountReadOnly
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Effect: Allow
                Action:
                  - account:GetAlternateContact
                Resource: !Sub "arn:${AWS::Partition}:account::${AWS::AccountId}:account"
        - PolicyName: AWSCostExplorerReadOnly
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Effect: Allow
                Action:
                  - ce:GetCostAndUsage
                Resource: !Sub "arn:${AWS::Partition}:ce:${AWS::Region}:${AWS::AccountId}:/GetCostAndUsage"

  PostCFNOutputToAPIEndpointLambda:
    Type: AWS::Lambda::Function
    Properties:
      Runtime: python3.10
      MemorySize: 128
      Timeout: 600
      Role: !GetAtt PostCFNOutputToAPIEndpointLambdaRole.Arn
      Handler: handler.lambda_handler
      Code:
        S3Bucket: !FindInMap [RegionMap, !Ref "AWS::Region", S3BucketName]
        S3Key: !Sub "wafr-ftr-onboarding/${GitHubBranch}/${S3Key}"
      Environment:
        Variables:
          STACK_ID: !Ref AWS::StackId
          REGION: !Ref AWS::Region
          AWS_ACCOUNT_ID: !Ref AWS::AccountId
          ENDPOINT_TYPE: API
          ENDPOINT_URL: https://oekdkilbf2.execute-api.us-east-1.amazonaws.com/send
          LOGLEVEL: DEBUG
          BOTOCORE_LOGLEVEL: DEBUG
          ENDUSER_DOMAIN_NAME: !Ref DomainName

  CustomResource:
    Type: AWS::CloudFormation::CustomResource
    Properties:
      ServiceToken: !GetAtt PostCFNOutputToAPIEndpointLambda.Arn
      RoleName: !Ref PostCFNOutputToAPIEndpointLambdaRole

Outputs:
  SampleOutput:
    Description: This is a sample output for the AWS Lambda function to share with the API Endpoint
    Value: "ThisIsASampleOutput"

Mappings:
  RegionMap:
    us-east-1:
      S3BucketName: us-east-1.wafr.ibexlabs.com
    us-east-2:
      S3BucketName: us-east-2.wafr.ibexlabs.com
    us-west-1:
      S3BucketName: us-west-1.wafr.ibexlabs.com
    us-west-2:
      S3BucketName: wafr.ibexlabs.com
    ca-central-1:
      S3BucketName: ca-central-1.wafr.ibexlabs.com

Metadata:
  AWS::CloudFormation::Interface:
    ParameterGroups:
      - Label:
          default: Requestor Information
        Parameters:
          - DomainName

      - Label:
          default: Lambda Code Zip file configuration.
        Parameters:
          - GitHubBranch
          - S3Key

    ParameterLabels:
      DomainName:
        default: "Please provide the registered domain name for your business."

      GitHubBranch:
        default: "Please provide the GitHub branch to use. Recommended to leave this as `main`."

      S3Key:
        default: "Please provide the file name of the Lambda code zip file."