hec_auto_conf_website_template.json

{
    "AWSTemplateFormatVersion": "2010-09-09",
    "Parameters": {
      "SplunkHttpEventCollectorURL": {
        "Description": "The HEC endpoint server and port (default 8088) of the the Splunk environment which will receive AWS data. This endpoint requires a valid, CA-signed certificate (format - https://server:port)",
        "Type": "String"
      },
      "SplunkHttpEventCollectorManagementURL": {
      "Description": "The HEC endpoint server and Splunk management port (default 8089) of the the Splunk environment which will receive AWS data. This endpoint does NOT require a valid, CA-signed certificate (format - https://server:port)",
      "Type": "String"
    },
      "SplunkUsername": {
        "Description": "The Splunk user that will be used by the template to configure HEC for Trumpet. This user should have permission to list and create HEC tokens.",
        "Type": "String"
      },
      "SplunkPassword": {
        "Description": "The Splunk password for the provided user. Password will be stored temporarily in AWS secrets manager and removed after HEC is configured.",
        "Type": "String",
        "NoEcho": true
      },
      "SecretManagerSecretName": {
        "Description": "The (unique) name of the secret password used to temporarily store the Splunk password.",
        "Type": "String"
      }
    },
    "Metadata" : {
      "AWS::CloudFormation::Interface" : {
        "ParameterGroups" : [
          {
            "Label" : { "default" : "Splunk credentials" },
            "Parameters" : [ "SplunkUsername", "SplunkPassword" ]
          },
          {
            "Label" : { "default":"Splunk HEC endpoint details" },
            "Parameters" : [ "SplunkHttpEventCollectorURL", "SplunkHttpEventCollectorManagementURL" ]
          },
          {
            "Label" : { "default": "AWS Secrets Manager configuration" },
            "Parameters" : [ "SecretManagerSecretName" ]
          }
        ],
        "ParameterLabels" : {
          "SecretManagerSecretName" : { "default" : "Secret name" },
          "SplunkHttpEventCollectorURL" : { "default" : "Splunk HTTP Event Collector URL" },
          "SplunkHttpEventCollectorManagementURL" : { "default" : "Splunk HTTP Event Collector Management URL" },
          "SplunkUsername" : { "default" : "Splunk username" },
          "SplunkPassword" : { "default" : "Splunk password" }
        }
      }
    },
    "Mappings": {
      "BucketMap": {
        "us-east-1": { "BucketName": "trumpet-splunk-prod-us-east-1" },
        "us-east-2": { "BucketName": "trumpet-splunk-prod-us-east-2" },
        "us-west-1": { "BucketName": "trumpet-splunk-prod-us-west-1" },
        "us-west-2": { "BucketName": "trumpet-splunk-prod-us-west-2" },
        "ca-central-1": { "BucketName": "trumpet-splunk-prod-ca-central-1" },
        "eu-central-1" : { "BucketName": "trumpet-splunk-prod-eu-central-1" },
        "eu-west-1": { "BucketName": "trumpet-splunk-prod-eu-west-1" },
        "eu-west-2": { "BucketName": "trumpet-splunk-prod-eu-west-2" },
        "eu-west-3": { "BucketName": "trumpet-splunk-prod-eu-west-3" },
        "ap-northeast-1": { "BucketName": "trumpet-splunk-prod-ap-northeast-1" },
        "ap-northeast-2": { "BucketName": "trumpet-splunk-prod-ap-northeast-2" },
        "ap-southeast-1": { "BucketName": "trumpet-splunk-prod-ap-southeast-1" },
        "ap-southeast-2": { "BucketName": "trumpet-splunk-prod-ap-southeast-2" },
        "ap-south-1": { "BucketName": "trumpet-splunk-prod-ap-south-1" },
        "sa-east-1": { "BucketName": "trumpet-splunk-prod-sa-east-1" }
      }
    },
    "Resources": {
      "LambdaSecretSetup": {
        "Type": "AWS::Lambda::Function",
        "Properties": {
          "Code": {
            "S3Bucket": { "Fn::FindInMap" : [ "BucketMap", { "Ref" : "AWS::Region" }, "BucketName"]},
            "S3Key": "secret_configuration.zip"
          },
          "Handler": "index.handler",
          "Role": {
            "Fn::GetAtt": [
              "LambdaSecretSetupExecutionRole",
              "Arn"
            ]
          },
          "Runtime": "python2.7",
          "Timeout": "30"
        }
      },
      "LambdaSecretSetupExecutionRole": {
        "Type": "AWS::IAM::Role",
        "Properties": {
          "AssumeRolePolicyDocument": {
            "Version": "2012-10-17",
            "Statement": [
              {
                "Effect": "Allow",
                "Principal": {
                  "Service": [
                    "lambda.amazonaws.com"
                  ]
                },
                "Action": [
                  "sts:AssumeRole"
                ]
              }
            ]
          },
          "Path": "/",
          "Policies": [
            {
              "PolicyName": "root",
              "PolicyDocument": {
                "Version": "2012-10-17",
                "Statement": [
                  {
                    "Effect": "Allow",
                    "Action": [
                      "logs:CreateLogGroup",
                      "logs:CreateLogStream",
                      "logs:PutLogEvents"
                    ],
                    "Resource": "arn:aws:logs:*:*:*"
                  },
                  {
                    "Effect": "Allow",
                    "Action": [
                      "secretsmanager:CreateSecret"
                    ],
                    "Resource": "*"
                  }
                ]
              }
            }
          ]
        }
      },
      "CustomResourceSecretSetup": {
        "Type": "Custom::CustomResource",
        "Properties": {
          "ServiceToken": {
            "Fn::GetAtt": [
              "LambdaSecretSetup",
              "Arn"
            ]
          },
          "SplunkPassword": { "Ref" : "SplunkPassword" },
          "SecretManagerSecretName": { "Ref" : "SecretManagerSecretName" }
        }
      },
      "LambdaHecAutomation": {
        "Type": "AWS::Lambda::Function",
        "Properties": {
          "Code": {
            "S3Bucket": { "Fn::FindInMap" : [ "BucketMap", { "Ref" : "AWS::Region" }, "BucketName"]},
            "S3Key": "hec_auto.zip"
          },
          "Handler": "index.handler",
          "Role": {
            "Fn::GetAtt": [
              "LambdaHecAutomationExecutionRole",
              "Arn"
            ]
          },
          "Runtime": "python2.7",
          "Timeout": "30"
        }
      },
      "LambdaHecAutomationExecutionRole": {
        "Type": "AWS::IAM::Role",
        "Properties": {
          "AssumeRolePolicyDocument": {
            "Version": "2012-10-17",
            "Statement": [
              {
                "Effect": "Allow",
                "Principal": {
                  "Service": [
                    "lambda.amazonaws.com"
                  ]
                },
                "Action": [
                  "sts:AssumeRole"
                ]
              }
            ]
          },
          "Path": "/",
          "Policies": [
            {
              "PolicyName": "root",
              "PolicyDocument": {
                "Version": "2012-10-17",
                "Statement": [
                  {
                    "Effect": "Allow",
                    "Action": [
                      "logs:CreateLogGroup",
                      "logs:CreateLogStream",
                      "logs:PutLogEvents"
                    ],
                    "Resource": "arn:aws:logs:*:*:*"
                  },
                  {
                    "Effect": "Allow",
                    "Action": [
                      "secretsmanager:GetSecretValue"
                    ],
                    "Resource": "*"
                  }
                ]
              }
            }
          ]
        }
      },
      "CustomResourceHecAutomation": {
        "Type": "Custom::CustomResource",
        "DependsOn": ["CustomResourceSecretSetup"],
        "Properties": {
          "ServiceToken": {
            "Fn::GetAtt": [
              "LambdaHecAutomation",
              "Arn"
            ]
          },
          "SplunkUser": { "Ref" : "SplunkUsername" },
          "SplunkHttpEventCollectorURL": { "Ref" : "SplunkHttpEventCollectorURL" },
          "SplunkHttpEventCollectorManagementURL": { "Ref" : "SplunkHttpEventCollectorManagementURL" },
          "AWSRegion": { "Ref" : "AWS::Region" },
          "SecretManagerSecretName": { "Ref" : "SecretManagerSecretName" }
        }
      },
      "LambdaWebsiteSetup": {
        "Type": "AWS::Lambda::Function",
        "Properties": {
          "Code": {
            "S3Bucket": { "Fn::FindInMap" : [ "BucketMap", { "Ref" : "AWS::Region" }, "BucketName"]},
            "S3Key": "index.zip"
          },
          "Handler": "index.handler",
          "Role": { "Fn::GetAtt" : ["LambdaWebsiteSetupExecutionRole", "Arn"] },
          "Runtime": "python2.7",
          "Timeout": "30",
          "Environment": {
            "Variables" : {
              "AutoHEC": "true",
              "CloudTrailHECToken": {
                "Fn::GetAtt": [
                  "CustomResourceHecAutomation",
                  "CloudTrailHECToken"
                ]
              },
              "CloudWatchHECToken": {
                "Fn::GetAtt": [
                  "CustomResourceHecAutomation",
                  "CloudWatchHECToken"
                ]
              },
              "ConfigNotificationHECToken": {
                "Fn::GetAtt": [
                  "CustomResourceHecAutomation",
                  "ConfigNotificationHECToken"
                ]
              },
              "ConfigSnapshotHECToken": {
                "Fn::GetAtt": [
                  "CustomResourceHecAutomation",
                  "ConfigSnapshotHECToken"
                ]
              },
              "GuardDutyHECToken": {
                "Fn::GetAtt": [
                  "CustomResourceHecAutomation",
                  "GuardDutyHECToken"
                ]
              },
              "SplunkHttpEventCollectorURL": {
                "Ref": "SplunkHttpEventCollectorURL"
              }
            }
          }
        }
      },
      "LambdaWebsiteSetupExecutionRole": {
        "Type": "AWS::IAM::Role",
        "Properties": {
          "AssumeRolePolicyDocument": {
            "Version": "2012-10-17",
            "Statement": [{
              "Effect": "Allow",
              "Principal": {"Service": ["lambda.amazonaws.com"]},
              "Action": ["sts:AssumeRole"]
            }]
          },
          "Path": "/",
          "Policies": [{
            "PolicyName": "root",
            "PolicyDocument": {
              "Version": "2012-10-17",
              "Statement": [
                {
                  "Effect": "Allow",
                  "Action": [
                    "logs:CreateLogGroup",
                    "logs:CreateLogStream",
                    "logs:PutLogEvents"
                  ],
                  "Resource": "arn:aws:logs:*:*:*"
                },
                {
                  "Effect": "Allow",
                  "Action": [
                    "s3:PutObject",
                    "s3:DeleteObject",
                    "s3:DeleteBucket"
                  ],
                  "Resource": "*"
                }
              ]
            }
          }]
        }
      },
      "CustomResourceWebsiteSetup": {
            "Type": "Custom::CustomResource",
            "Properties": {
                "ServiceToken": { "Fn::GetAtt" : ["LambdaWebsiteSetup", "Arn"] },
                "S3Bucket": { "Ref": "S3Bucket" }
            }
        },
        "S3Bucket": {
            "Type": "AWS::S3::Bucket",
            "Properties": {
                "AccessControl": "PublicRead",
                "WebsiteConfiguration": {
                    "IndexDocument": "index.html",
                    "ErrorDocument": "error.html"
                }
            },
            "DeletionPolicy": "Retain"
        },
        "BucketPolicy": {
            "Type": "AWS::S3::BucketPolicy",
            "Properties": {
                "PolicyDocument": {
                    "Id": "MyPolicy",
                    "Version": "2012-10-17",
                    "Statement": [
                        {
                            "Effect": "Allow",
                            "Principal": "*",
                            "Action": "s3:GetObject",
                            "Resource": {
                                "Fn::Join": [
                                    "",
                                    [
                                        "arn:aws:s3:::",
                                        {
                                            "Ref": "S3Bucket"
                                        },
                                        "/*"
                                    ]
                                ]
                            }
                        }
                    ]
                },
                "Bucket": {
                    "Ref": "S3Bucket"
                }
            }
        }
    },
    "Outputs": {
        "WebsiteURL": {
            "Value": {
                "Fn::GetAtt": [
                    "S3Bucket",
                    "WebsiteURL"
                ]
            },
            "Description": "URL for website hosted on S3"
        }
    }
}