template.yaml

#
# Copyright 2017 Amazon.com, Inc. or its affiliates. All Rights Reserved.
#
# Licensed under the Apache License, Version 2.0 (the "License"). You may not use this file
# except in compliance with the License. A copy of the License is located at
#
#    http://aws.amazon.com/apache2.0/
#
# or in the "license" file accompanying this file. This file is distributed on an "AS IS"
# BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
# License for the specific language governing permissions and limitations under the License.
#

---

AWSTemplateFormatVersion: "2010-09-09"
Transform: "AWS::Serverless-2016-10-31"

Description: "AWS VPC Flow Log Appender services"

Parameters:
  GeolocationEnabled:
    Type: String
    Default: false
    AllowedValues:
      - true
      - false

Resources:
  #
  # -- Data Ingestion --
  #
  # Data is received from CloudWatch Logs and pushed to Kinesis Firehose.
  #
  FlowLogIngestionFunction:
    Type: "AWS::Serverless::Function"
    Properties:
      Handler: "index.handler"
      Runtime: "nodejs10.x"
      CodeUri: "ingestor/"
      Policies:
        - Version: "2012-10-17"
          Statement:
            -
              Effect: Allow
              Action:
                - "firehose:PutRecordBatch"
              Resource: !Sub "arn:aws:firehose:${AWS::Region}:${AWS::AccountId}:deliverystream/*"
      Environment:
        Variables:
          DELIVERY_STREAM_NAME: "VPCFlowLogsToElasticSearch"

  #
  # -- Decorator --
  #
  # Appends VPC Flow Logs with additional data, including instance security groups.
  #
  FlowLogDecoratorFunction:
    Type: AWS::Serverless::Function
    Properties:
      Handler: index.handler
      Runtime: nodejs10.x
      Timeout: 120
      CodeUri: decorator/
      Policies:
        - Version: "2012-10-17"
          Statement:
            - Effect: Allow
              Action:
                - "ssm:GetParameter"
              Resource: !Sub "arn:aws:ssm:${AWS::Region}:${AWS::AccountId}:parameter/ipstack-api-key"
            - Effect: Allow
              Action:
                - "ec2:Describe*"
              Resource: "*"
      Environment:
        Variables:
          GEOLOCATION_ENABLED: !Ref GeolocationEnabled
          GEOLOCATION_API_KEY_NAME: ipstack-api-key

Outputs:
 LambdaFlowLogDecorator:
   Value: !GetAtt FlowLogDecoratorFunction.Arn
   Export:
     Name: 'FlowLogDecoratorFunction'

 LambdaFlowLogIngestion:
   Value: !GetAtt FlowLogIngestionFunction.Arn
   Export:
     Name: 'FlowLogIngestionFunction'