cfn_budget_lambda_blog_post.json

{
  "AWSTemplateFormatVersion" : "2010-09-09",

  "Description" : "AWS CloudFormation Template that spins up the solution stack pertaining to blog1 in the Serverless Cost Controls series. This creates IAM users, groups, roles, lambda functions, sns topics and budgets. Note that you will need to specify the CAPABILITY_IAM flag when you create the stack to allow this template to execute. You can do this through the AWS management console by clicking on the check box acknowledging that you understand this template creates IAM resources or by specifying the CAPABILITY_IAM flag to the cfn-create-stack command line tool or CreateStack API call. ",
  "Resources" : {

    "testUserForProjectBeta" : {
      "Type" : "AWS::IAM::User",
      "Properties" :{
        "LoginProfile": {"Password": "costContr01s"}
      }
    },

    "projectBeta" : {
      "Type" : "AWS::IAM::Group",
      "Properties" : {
        "ManagedPolicyArns": ["arn:aws:iam::aws:policy/AmazonEC2FullAccess"],
        "Policies": [{
          "PolicyName": "root",
          "PolicyDocument": {
          "Version": "2012-10-17",
          "Statement": [
            {
              "Effect": "Allow",
              "Action": [
                "cloudformation:DescribeStacks",
                "cloudformation:DescribeStackEvents",
                "cloudformation:DescribeStackResource",
                "cloudformation:DescribeStackResources",
                "cloudformation:GetTemplate",
                "cloudformation:GetTemplateSummary",
                "cloudformation:CreateStack",
                "cloudformation:UpdateStack",
                "cloudformation:List*",
                "cloudformation:DeleteStack"
              ],
              "Resource": "*",
              "Condition" : { "ForAllValues:StringEquals" : {
                                "cloudformation:TemplateUrl" : ["https://s3-us-west-2.amazonaws.com/serverless-automated-cost-controls/cfn_create_ec2_instances.json"]
                              }
                            }
            }
          ]
        }
        }]
      }
    },

    "budgetNotificationTopic" : {
      "Type" : "AWS::SNS::Topic"
    },

    "budgetNotificationTopicPolicy": {
      "Type" : "AWS::SNS::TopicPolicy",
      "Properties" :
      {
        "PolicyDocument": {
          "Id" : "MyTopicPolicy",
          "Version" : "2012-10-17",
          "Statement" : [{
            "Sid": "AWSBudgets-notification-1",
            "Effect": "Allow",
            "Principal": {
              "Service": "budgets.amazonaws.com"
            },
            "Action": "SNS:Publish",
            "Resource": {"Ref":"budgetNotificationTopic"}
          }]
        },
        "Topics" : [
          {"Ref":"budgetNotificationTopic"}
        ]
      }
    },
    "MasterLambdaSubscription" : {
      "Type" : "AWS::SNS::Subscription",
      "Properties" : {
        "Endpoint" :{ "Fn::GetAtt" : ["budgetMasterLambda", "Arn"] },
        "Protocol" : "lambda",
        "TopicArn" : {"Fn::Join": ["",[
           "arn:aws:sns:",{"Ref" : "AWS::Region"},":",
           {"Ref" : "AWS::AccountId"},
           ":",
           {"Fn::GetAtt":["budgetNotificationTopic", "TopicName"]}
           ]]
        }
      },
      "DependsOn" : ["budgetNotificationTopic", "budgetMasterLambda"]
    },

    "budgetMasterLambda": {
      "Type": "AWS::Lambda::Function",
      "Properties": {
        "Environment": {
          "Variables":{
            "GroupName" : { "Ref" : "projectBeta" },
            "DetachPolicyArn" : "arn:aws:iam::aws:policy/AmazonEC2FullAccess",
            "AttachPolicyArn" : "arn:aws:iam::aws:policy/AmazonEC2ReadOnlyAccess",
            "StateMachineArn": { "Ref": "budgetActionSM"}
          }},
        "Handler": "lambda_function.lambda_handler",
        "Role": { "Fn::GetAtt" : ["LambdaSnsRole", "Arn"] },
        "Code": {
          "S3Bucket": {"Fn::Join":["",["serverless-automated-cost-controls-",{"Ref" : "AWS::Region"}]]},
          "S3Key": "budgetMaster.zip"
        },
        "Runtime": "python2.7",
        "Timeout": "25"
      }
    },

    "budgetMasterLambdaInvokePermission": {
        "Type": "AWS::Lambda::Permission",
        "Properties": {
          "Action": "lambda:InvokeFunction",
          "Principal": "sns.amazonaws.com",
          "SourceArn": { "Ref": "budgetNotificationTopic" },
          "FunctionName": {
            "Fn::GetAtt": [ "budgetMasterLambda", "Arn" ]
          }
        }
      },

    "actionLambda": {
      "Type": "AWS::Lambda::Function",
      "Properties": {
        "Handler": "lambda_function.lambda_handler",
        "Role": { "Fn::GetAtt" : ["LambdaIamRole", "Arn"] },
        "Code": {
          "S3Bucket": {"Fn::Join":["",["serverless-automated-cost-controls-",{"Ref" : "AWS::Region"}]]},
          "S3Key": "removeCreateInstancePermissions.zip"
        },
        "Runtime": "python2.7",
        "Timeout": "25"
      }
    },

    "createBudgetLambda": {
      "Type": "AWS::Lambda::Function",
      "Properties": {
        "Environment": { "Variables" : {"AccountId":{ "Ref" : "AWS::AccountId" },
        "BudgetNotificationArn": {"Fn::Join": ["",["arn:aws:sns:",{"Ref" : "AWS::Region"},":",{"Ref" : "AWS::AccountId"},":",
          {"Fn::GetAtt" : ["budgetNotificationTopic", "TopicName"]}]]}} },
        "Handler": "createBudgetLambda.lambda_handler",
        "Role": { "Fn::GetAtt" : ["LambdaBudgetRole", "Arn"] },
        "Code": {
          "S3Bucket": {"Fn::Join":["",["serverless-automated-cost-controls-",{"Ref" : "AWS::Region"}]]},
          "S3Key": "createBudgetLambda.zip"
        },
        "Runtime": "python2.7",
        "Timeout": "25"
      },
      "DependsOn" : "budgetNotificationTopic"
    },

    "LambdaBudgetRole": {
      "Type": "AWS::IAM::Role",
      "Properties": {
        "AssumeRolePolicyDocument": {
          "Version": "2012-10-17",
          "Statement": [{ "Effect": "Allow", "Principal": {"Service": ["lambda.amazonaws.com"]}, "Action": ["sts:AssumeRole"] }]
        },
        "Path": "/",
        "Policies": [{
          "PolicyName": "root",
          "PolicyDocument": {
            "Version": "2012-10-17",
            "Statement": [
                          {
                            "Effect": "Allow",
                            "Action": [
                              "logs:CreateLogGroup",
                              "logs:CreateLogStream",
                              "logs:PutLogEvents"
                            ],
                            "Resource": "*"
                          },
                          {
                                      "Sid": "Stmt1435216493000",
                                      "Effect": "Allow",
                                      "Action": [
                                          "aws-portal:ViewBilling",
                                          "aws-portal:ModifyBilling",
                                          "budgets:ViewBudget",
                                          "budgets:ModifyBudget"
                                      ],
                                      "Resource": [
                                          "*"
                                      ]
                          },
                          {
                                      "Sid": "Stmt1435216514000",
                                      "Effect": "Allow",
                                      "Action": [
                                          "cloudwatch:*"
                                      ],
                                      "Resource": [
                                          "*"
                                      ]
                          },
                          {
                                      "Sid": "Stmt1435216552000",
                                      "Effect": "Allow",
                                      "Action": [
                                          "sns:*"
                                      ],
                                      "Resource": [
                                          {"Fn::Join" : ["",["arn:aws:sns:",{"Ref" : "AWS::Region"}]]}
                                      ]
                          }
            ]
          }
        }]
      }
    },

    "LambdaSnsRole": {
      "Type": "AWS::IAM::Role",
      "Properties": {
        "AssumeRolePolicyDocument": {
          "Version": "2012-10-17",
          "Statement": [{ "Effect": "Allow", "Principal": {"Service": ["lambda.amazonaws.com"]}, "Action": ["sts:AssumeRole"] }]
        },
        "Path": "/",
        "Policies": [{
          "PolicyName": "root",
          "PolicyDocument": {
            "Version": "2012-10-17",
            "Statement": [
                          {
                            "Effect": "Allow",
                            "Action": [
                              "logs:CreateLogGroup",
                              "logs:CreateLogStream",
                              "logs:PutLogEvents"
                            ],
                            "Resource": "*"
                          }
            ]
          }
        }],
        "ManagedPolicyArns":[
            "arn:aws:iam::aws:policy/AWSStepFunctionsFullAccess"
        ]
      }
    },

    "LambdaIamRole": {
      "Type": "AWS::IAM::Role",
      "Properties": {
        "AssumeRolePolicyDocument": {
          "Version": "2012-10-17",
          "Statement": [{ "Effect": "Allow", "Principal": {"Service": ["lambda.amazonaws.com"]}, "Action": ["sts:AssumeRole"] }]
        },
        "Path": "/",
        "Policies": [{
          "PolicyName": "root",
          "PolicyDocument": {
            "Version": "2012-10-17",
            "Statement": [
                          {
                            "Effect": "Allow",
                            "Action": [
                              "logs:CreateLogGroup",
                              "logs:CreateLogStream",
                              "logs:PutLogEvents"
                            ],
                            "Resource": "*"
                          },
                          {
                            "Action": [
                              "iam:*"
                            ],
                            "Effect": "Allow",
                            "Resource": "*"
                          }
            ]
          }
        }]
      }
    },

    "Users" : {
      "Type" : "AWS::IAM::UserToGroupAddition",
      "Properties" : {
        "GroupName": { "Ref" : "projectBeta" },
        "Users" : [ { "Ref" : "testUserForProjectBeta" } ]
      }
    },


    "CreateBudget": {
      "Type": "Custom::CreateBudget",
      "Properties": {
        "ServiceToken": { "Fn::GetAtt" : ["createBudgetLambda", "Arn"] }
      },
      "DependsOn" : "createBudgetLambda"
    },

    "BudgetActionStepFNRole" : {
      "Type": "AWS::IAM::Role",
      "Properties": {
        "Path": "/service-role/",
        "AssumeRolePolicyDocument": {
          "Version": "2012-10-17",
          "Statement": [{ 
            "Effect": "Allow", 
            "Principal": {"Service": [
              {"Fn::Join":[
                "",
                ["states.",{"Ref" : "AWS::Region"},".amazonaws.com"]]}
            ]}, 
            "Action": ["sts:AssumeRole"] 
          }]
        },
        "Policies" : [{
        "PolicyName": "allowLambdaInvoke",
          "PolicyDocument": {
            "Version": "2012-10-17",
            "Statement": [{
              "Effect": "Allow",
              "Action": [
                  "lambda:InvokeFunction"
              ],
              "Resource": "*"
            }]
          }  
      },
      {
        "PolicyName":"allowStepFuns",
          "PolicyDocument" :{
            "Version": "2012-10-17",
            "Statement":[{
              "Effect": "Allow",
              "Action": [
                  "states:*"
              ],
              "Resource": [
                  "*"
              ]
            }
            ]
          }
      }]
      }
      
    },

    "budgetActionSM" : {
      "Type": "AWS::StepFunctions::StateMachine",
      "Properties": {
          "DefinitionString": {                   
              "Fn::Join": [
                          "",
                          [
                              "{\"Comment\": \"Removes Permissions to create more resources\", \"StartAt\": \"RemovePermissions\", \"States\": {\"RemovePermissions\": {\"Type\": \"Task\",\"Resource\":\"",
                              { "Fn::GetAtt" : ["actionLambda", "Arn"] },
                              "\",\"End\": true}}}"
                          ]
              ]
          },
          "RoleArn": {"Fn::GetAtt" : ["BudgetActionStepFNRole", "Arn"] }
      }
    }
  },


  "Outputs" : {
    "SignInURL" : {
      "Value": {"Fn::Join": ["",["https://",{"Ref" : "AWS::AccountId"},".signin.aws.amazon.com/console/"]]},
      "Description" : "AWS Sign-in URL"
    },
    "UserName" : {
      "Value": { "Ref": "testUserForProjectBeta" },
      "Description" : "Username to login to the AWS Console for the next part."
    },
    "Password" : {
      "Value": "costContr01s",
      "Description" : "Password to login to the AWS Console for the next part."
    },
    "TemplateURL": {
      "Value": "https://s3-us-west-2.amazonaws.com/serverless-automated-cost-controls/cfn_create_ec2_instances.json",
      "Description" : "Cloudformation Template URL - to create the test Ec2 cluster"
    }
  }
}