Skip to content
Open
Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
24 commits
Select commit Hold shift + click to select a range
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions .gitignore
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
*.DS_Store
14 changes: 0 additions & 14 deletions LICENSE

This file was deleted.

77 changes: 0 additions & 77 deletions README.md

This file was deleted.

14 changes: 0 additions & 14 deletions bin/deploy.sh

This file was deleted.

Binary file removed images/architecture
Binary file not shown.
Binary file removed images/architecture.jpeg
Binary file not shown.
1 change: 0 additions & 1 deletion images/architecture.xml

This file was deleted.

Binary file removed images/sync-sc-pipeline.jpeg
Binary file not shown.
122 changes: 63 additions & 59 deletions lambda-cloudformation.yaml
Original file line number Diff line number Diff line change
@@ -1,66 +1,70 @@
# Copyright 2017 Amazon.com, Inc. or its affiliates. All Rights Reserved.
# SPDX-License-Identifier: MIT-0

AWSTemplateFormatVersion: '2010-09-09'
Description: service-catalog-sync-lambda
AWSTemplateFormatVersion: '2010-09-09'
Description: custom organization-config-rules
Resources:
LAMBDA:
rVPCFlowLogS3EnforcementLambda2:
Type: AWS::Lambda::Function
DependsOn:
- rVPCFlowLogS3EnforcementLambdaRole2
Properties:
FunctionName: service-catalog-sync-lambda
Handler: sync-catalog.handler
FunctionName: VPCFlowLogS3EnforcementLambda2
Handler: VPCFlowLogS3EnforcementLambda.lambda_handler
Runtime: python2.7
Description: Function to sync service catalog with a configuration file
Code: ./
Description: Ensure that VPC FlowLogs to centralized S3 bucket.
Code: ./rules/VPC_FLOW_LOGS_TO_S3_CUSTOM/VPCFlowLogS3EnforcementLambda.py
MemorySize: 128
Timeout: 300
Role: !GetAtt LAMBDAROLE.Arn
LAMBDAROLE:
Type: AWS::IAM::Role
Properties:
RoleName: !Sub service-catalog-sync-lambda-role-${AWS::Region}
AssumeRolePolicyDocument:
Version: 2012-10-17
Statement:
-
Effect: Allow
Principal:
Service:
- lambda.amazonaws.com
Action:
- sts:AssumeRole
Path: /
LAMBDAPOLICY:
Type: AWS::IAM::Policy
Timeout: 180
Role: !GetAtt rVPCFlowLogS3EnforcementLambdaRole2.Arn
rVPCFlowLogS3EnforcementLambdaRole2:
Type: 'AWS::IAM::Role'
Properties:
PolicyName: !Sub service-catalog-sync-lambda-policy-${AWS::Region}
PolicyDocument:
Version: 2012-10-17
RoleName: VPCFlowLogS3EnforcementLambdaRole2
AssumeRolePolicyDocument:
Version: '2012-10-17'
Statement:
-
Effect: Allow
Action:
- servicecatalog:*
- s3:*
- codepipeline:PutJobFailureResult
- codepipeline:PutJobSuccessResult
- cloudformation:ValidateTemplate
- iam:GetRole
Resource:
- "*"
-
Effect: Allow
Action:
- logs:CreateLogGroup
- logs:CreateLogStream
- logs:PutLogEvents
Resource: arn:aws:logs:*:*:*
Roles:
-
!Ref LAMBDAROLE
Outputs:
LambdaArn:
Description: ARN of the Lambda Function, which syncs up configuration files with yaml file
Value: !GetAtt LAMBDA.Arn
Export:
Name: service-catalog-sync-lambda
Effect: Allow
Principal:
Service:
- lambda.amazonaws.com
Action: 'sts:AssumeRole'
Policies:
- PolicyName: VPCFlowLogS3EnforcementLambdaPolicy2
PolicyDocument:
Version: '2012-10-17'
Statement:
- Effect: Allow
Action:
- 'logs:CreateLogGroup'
- 'logs:CreateLogStream'
- 'logs:PutLogEvents'
- 'logs:DescribeLogStreams'
- 'logs:DescribeLogGroups'
- 'logs:CreateLogDelivery'
- 'logs:DeleteLogDelivery'
- 'ec2:CreateFlowLogs'
- 'ec2:DescribeFlowLogs'
- 'config:PutEvaluations'
- 'config:StartConfigRulesEvaluation'
Resource:
- '*'
- PolicyName: OrgConfigRuleAssumeEvalsRole2Policy2
PolicyDocument:
Version: "2012-10-17"
Statement:
- Effect: Allow
Action: "sts:AssumeRole"
Resource: "arn:aws:iam::*:role/OrgConfigRuleEvalsRole2"
- PolicyName: VPCFlowLogS3EnforcementAssumeLambdaRole2Policy
PolicyDocument:
Version: "2012-10-17"
Statement:
- Effect: Allow
Action: "sts:AssumeRole"
Resource: "arn:aws:iam::*:role/VPCFlowLogS3EnforcementLambdaRole2"
rConfigPermissionToCallLambda:
Type: "AWS::Lambda::Permission"
DependsOn:
- rVPCFlowLogS3EnforcementLambda2
Properties:
FunctionName: !GetAtt rVPCFlowLogS3EnforcementLambda2.Arn
Action: "lambda:InvokeFunction"
Principal: "config.amazonaws.com"
Loading