control-tower-customization.yml

AWSTemplateFormatVersion: 2010-09-09
Description: Control Tower customization that adds in New Relic integration to your aws accounts enrolled using AWS Control Tower.
Resources:
  NewRelicControlTowerEvents:
    Type: AWS::Events::Rule
    Properties:
      Description: Capture Control Tower LifeCycle Events and Trigger an Action
      EventPattern:
        detail:
          eventName:
          - CreateManagedAccount
          - UpdateManagedAccount
          eventSource:
          - controltower.amazonaws.com
        detail-type:
        - AWS Service Event via CloudTrail
        source:
        - aws.controltower
      Name: NewRelicControlTowerEvents
      State: ENABLED
      Targets:
      - Arn: !GetAtt "NewRelicControlTowerCustomizations.Arn"
        Id: IDNewRelicControlTowerEvents

  NewRelicControlTowerCustomizationsRole:
    Type: AWS::IAM::Role
    Metadata:
      cfn_nag:
        rules_to_suppress:
          - id: W28
            reason: "New Relic needs to name IAM roles to help uniquely identify them."
    Properties:
      RoleName: NewRelicControlTowerCustomizationsRole
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              Service: lambda.amazonaws.com
            Action: sts:AssumeRole
            Condition: {}
      Path: /
      Policies:
        - PolicyName: Cloudformation-Ops
          PolicyDocument:
            Version: 2012-10-17
            Statement:
              - Effect: Allow
                Action:
                  - 'cloudformation:CreateStackInstances'
                Resource: !Join [':',['arn:aws:cloudformation', !Ref 'AWS::Region', !Ref 'AWS::AccountId', 'stackset/*:*']]
        - PolicyName: Pass-Role
          PolicyDocument:
            Version: 2012-10-17
            Statement:
              Effect: Allow
              Action:
                - iam:PassRole
              Resource: !Join [':', ['arn:aws:iam:', !Ref "AWS::AccountId", 'role/service-role/AWSControlTowerExecution']]        
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole

  NewRelicControlTowerCustomizations:
    Type: AWS::Lambda::Function
    Properties:
      Code:
        ZipFile: |
          import json
          import boto3
          import logging
          LOGGER = logging.getLogger()
          LOGGER.setLevel(logging.INFO)
          stackset_list = ['NewRelic-Integration']
          result = {"ResponseMetadata":{"HTTPStatusCode":"400"}}
          def lambda_handler(event, context):
              # TODO implement
              masterAcct = event['account']
              eventDetails = event['detail']
              regionName = eventDetails['awsRegion']
              eventName = eventDetails['eventName']
              srvEventDetails = eventDetails['serviceEventDetails']
              if eventName == 'CreateManagedAccount':
                  newAccInfo = srvEventDetails['createManagedAccountStatus']
                  cmdStatus = newAccInfo['state']
                  if cmdStatus == 'SUCCEEDED':
                      '''Sucessful event recieved'''
                      ouInfo = newAccInfo['organizationalUnit']
                      ouName = ouInfo['organizationalUnitName']
                      odId = ouInfo['organizationalUnitId']
                      accId = newAccInfo['account']['accountId']
                      accName = newAccInfo['account']['accountName']
                      CFT = boto3.client('cloudformation')
                      for item in stackset_list:
                          try:
                              result = CFT.create_stack_instances(StackSetName=item, Accounts=[accId], Regions=[regionName])
                              LOGGER.info('Processed {} Sucessfully'.format(item))
                          except Exception as e:
                              LOGGER.error('Unable to launch in:{}, REASON: {}'.format(item, e))
                  else:
                      '''Unsucessful event recieved'''
                      LOGGER.info('Unsucessful Event Recieved. SKIPPING :{}'.format(event))
                      return(False)
              else:
                  LOGGER.info('Control Tower Event Captured :{}'.format(event))
      Handler: index.lambda_handler
      MemorySize: 128
      Role: !GetAtt "NewRelicControlTowerCustomizationsRole.Arn"
      Runtime: python3.7
      Timeout: 60

  NewRelicControlTowerCustomizationsPermission:
    Type: AWS::Lambda::Permission
    Properties:
      Action: lambda:InvokeFunction
      FunctionName: !GetAtt "NewRelicControlTowerCustomizations.Arn"
      Principal: events.amazonaws.com
      SourceArn: !GetAtt "NewRelicControlTowerEvents.Arn"