marbot-cloudformation-drift.yml

---
# Copyright widdix GmbH
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#     http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
AWSTemplateFormatVersion: '2010-09-09'
Description: 'marbot.io: CloudFormation Drift Detection (https://github.com/marbot-io/monitoring-jump-start)'
Metadata:
  'AWS::CloudFormation::Interface':
    ParameterGroups:
    - Label:
        default: 'marbot endpoint'
      Parameters:
      - EndpointId
      - Stage
    - Label:
        default: 'Configuration'
      Parameters:
      - StackRegularExpression
Parameters:
  EndpointId:
    Description: 'Your marbot endpoint ID (to get this value: select a channel where marbot belongs to and send a message like this: "@marbot show me my endpoint id").'
    Type: String
  Stage:
    Description: 'marbot stage (never change this!).'
    Type: String
    Default: v1
    AllowedValues: [v1, dev]
  StackRegularExpression:
    Description: 'Regular expression used to filter CloudFormation stacks by name'
    Type: String
    Default: '.*'
Resources:
  ##########################################################################
  #                                                                        #
  #                                 TOPIC                                  #
  #                                                                        #
  ##########################################################################
  Topic:
    Type: 'AWS::SNS::Topic'
    Properties: {}
  TopicPolicy:
    Type: 'AWS::SNS::TopicPolicy'
    Properties:
      PolicyDocument:
        Id: Id1
        Version: '2012-10-17'
        Statement:
        - Sid: Sid1
          Effect: Allow
          Principal:
            Service: 'events.amazonaws.com' # Allow EventBridge
          Action: 'sns:Publish'
          Resource: !Ref Topic
      Topics:
      - !Ref Topic
  TopicEndpointSubscription:
    Type: 'AWS::SNS::Subscription'
    Properties:
      DeliveryPolicy:
        healthyRetryPolicy:
          minDelayTarget: 1
          maxDelayTarget: 60
          numRetries: 100
          numNoDelayRetries: 0
          backoffFunction: exponential
        throttlePolicy:
          maxReceivesPerSecond: 1
      Endpoint: !Sub 'https://api.marbot.io/${Stage}/endpoint/${EndpointId}'
      Protocol: https
      TopicArn: !Ref Topic
  MonitoringJumpStartEvent:
    DependsOn: TopicEndpointSubscription
    Type: 'AWS::Events::Rule'
    Properties:
      Description: 'Monitoring Jump Start connection. (created by marbot)'
      ScheduleExpression: 'rate(30 days)'
      State: ENABLED
      Targets:
      - Arn: !Ref Topic
        Id: marbot
        Input: !Sub |
          {
            "Type": "monitoring-jump-start-connection",
            "StackTemplate": "marbot-cloudformation-drift",
            "StackVersion": "1.6.0",
            "Partition": "${AWS::Partition}",
            "AccountId": "${AWS::AccountId}",
            "Region": "${AWS::Region}",
            "StackId": "${AWS::StackId}",
            "StackName": "${AWS::StackName}"
          }
  ##########################################################################
  #                                                                        #
  #                             STATE MACHINE                              #
  #                                                                        #
  ##########################################################################
  StateMachineRole:
    Type: 'AWS::IAM::Role'
    Properties:
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
        - Effect: Allow
          Principal:
            Service: !Sub 'states.${AWS::Region}.amazonaws.com'
          Action: 'sts:AssumeRole'
      Policies:
      - PolicyName: lambda
        PolicyDocument:
          Statement:
          - Effect: Allow
            Action: 'lambda:InvokeFunction'
            Resource:
            - !GetAtt 'FunctionFetchDriftStatus.Arn'
            - !GetAtt 'FunctionStartDriftDetection.Arn'
            - !GetAtt 'FunctionFetchDetectionStatus.Arn'
            - !GetAtt 'FunctionSendDriftNotification.Arn'
  RoleTrigger:
    Type: 'AWS::IAM::Role'
    Properties:
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
        - Effect: Allow
          Principal:
            Service: 'lambda.amazonaws.com'
          Action: 'sts:AssumeRole'
      Policies:
      - PolicyName: lambda
        PolicyDocument:
          Statement:
          - Effect: Allow
            Action: 'cloudformation:ListStacks'
            Resource: '*'
          - Effect: Allow
            Action: 'states:StartExecution'
            Resource: !Ref StateMachine
          - Effect: Allow
            Action:
            - 'logs:CreateLogStream'
            - 'logs:PutLogEvents'
            Resource: '*'
  RoleFetchDriftStatus:
    Type: 'AWS::IAM::Role'
    Properties:
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
        - Effect: Allow
          Principal:
            Service: 'lambda.amazonaws.com'
          Action: 'sts:AssumeRole'
      Policies:
      - PolicyName: lambda
        PolicyDocument:
          Statement:
          - Effect: Allow
            Action: 'cloudformation:DescribeStacks'
            Resource: '*'
          - Effect: Allow
            Action:
            - 'logs:CreateLogStream'
            - 'logs:PutLogEvents'
            Resource: '*'
  RoleStartDriftDetection:
    Type: 'AWS::IAM::Role'
    Properties:
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
        - Effect: Allow
          Principal:
            Service: 'lambda.amazonaws.com'
          Action: 'sts:AssumeRole'
      ManagedPolicyArns:
      - 'arn:aws:iam::aws:policy/ReadOnlyAccess' # needed for detecting drift
      Policies:
      - PolicyName: lambda
        PolicyDocument:
          Statement:
          - Effect: Allow
            Action:
            - 'cloudformation:DetectStackDrift'
            - 'cloudformation:DetectStackResourceDrift'
            Resource: '*'
          - Effect: Allow
            Action:
            - 'logs:CreateLogStream'
            - 'logs:PutLogEvents'
            Resource: '*'
  RoleFetchDetectionStatus:
    Type: 'AWS::IAM::Role'
    Properties:
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
        - Effect: Allow
          Principal:
            Service: 'lambda.amazonaws.com'
          Action: 'sts:AssumeRole'
      Policies:
      - PolicyName: lambda
        PolicyDocument:
          Statement:
          - Effect: Allow
            Action: 'cloudformation:DescribeStackDriftDetectionStatus'
            Resource: '*'
          - Effect: Allow
            Action:
            - 'logs:CreateLogStream'
            - 'logs:PutLogEvents'
            Resource: '*'
  RoleSendDriftNotification:
    Type: 'AWS::IAM::Role'
    Properties:
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
        - Effect: Allow
          Principal:
            Service: 'lambda.amazonaws.com'
          Action: 'sts:AssumeRole'
      Policies:
      - PolicyName: lambda
        PolicyDocument:
          Statement:
          - Effect: Allow
            Action: 'sns:Publish'
            Resource: '*'
          - Effect: Allow
            Action:
            - 'logs:CreateLogStream'
            - 'logs:PutLogEvents'
            Resource: '*'
  Permission:
    Type: 'AWS::Lambda::Permission'
    Properties:
      Action: 'lambda:InvokeFunction'
      FunctionName: !Ref FunctionTrigger
      Principal: 'events.amazonaws.com'
      SourceArn: !GetAtt 'Rule.Arn'
  Rule:
    Type: 'AWS::Events::Rule'
    Properties:
      ScheduleExpression: 'rate(24 hours)'
      State: ENABLED
      Targets:
      - Arn: !GetAtt 'FunctionTrigger.Arn'
        Id: lambda
  StateMachine:
    Type: 'AWS::StepFunctions::StateMachine'
    Properties:
      DefinitionString: !Sub |
        {
          "Comment": "Detect drift of CloudFormation stack",
          "StartAt": "FetchDriftStatus",
          "TimeoutSeconds": 600,
          "Version": "1.0",
          "States": {
            "FetchDriftStatus": {
              "Type": "Task",
              "Resource": "${FunctionFetchDriftStatus.Arn}",
              "Retry": [{
                "ErrorEquals": ["States.TaskFailed"],
                "IntervalSeconds": 5,
                "MaxAttempts": 30,
                "BackoffRate": 2
              }],
              "Next": "StartDriftDetection"
            },
            "StartDriftDetection": {
              "Type": "Task",
              "Resource": "${FunctionStartDriftDetection.Arn}",
              "Retry": [{
                "ErrorEquals": ["States.TaskFailed"],
                "IntervalSeconds": 5,
                "MaxAttempts": 30,
                "BackoffRate": 2
              }],
              "Next": "FetchDetectionStatus"
            },
            "FetchDetectionStatus": {
              "Type": "Task",
              "Resource": "${FunctionFetchDetectionStatus.Arn}",
              "Retry": [{
                "ErrorEquals": ["States.TaskFailed"],
                "IntervalSeconds": 5,
                "MaxAttempts": 30,
                "BackoffRate": 2
              }],
              "Next": "ChoiceDetectionComplete"
            },
            "ChoiceDetectionComplete": {
              "Type": "Choice",
              "Choices": [{
                "Variable": "$.detectionStatus",
                "StringEquals": "DETECTION_COMPLETE",
                "Next": "ChoiceDriftStatusChanged"
              },
              {
                "Variable": "$.detectionStatus",
                "StringEquals": "DETECTION_FAILED",
                "Next": "ChoiceDriftStatusChanged"
              },
              {
                "Variable": "$.detectionStatus",
                "StringEquals": "DETECTION_IN_PROGRESS",
                "Next": "Wait"
              }],
              "Default": "Fail"
            },
            "Wait": {
              "Type": "Wait",
              "Seconds": 10,
              "Next": "FetchDetectionStatus"
            },
            "ChoiceDriftStatusChanged": {
              "Type": "Choice",
              "Choices": [{
                "And": [
                  {
                    "Variable": "$.previousDriftStatus",
                    "StringEquals": "IN_SYNC"
                  },
                  {
                    "Variable": "$.latestDriftStatus",
                    "StringEquals": "DRIFTED"
                  }
                ],
                "Next": "SendDriftNotification"
              },
              {
                "And": [
                  {
                    "Variable": "$.previousDriftStatus",
                    "StringEquals": "UNKNOWN"
                  },
                  {
                    "Variable": "$.latestDriftStatus",
                    "StringEquals": "DRIFTED"
                  }
                ],
                "Next": "SendDriftNotification"
              },
              {
                "And": [
                  {
                    "Variable": "$.previousDriftStatus",
                    "StringEquals": "NOT_CHECKED"
                  },
                  {
                    "Variable": "$.latestDriftStatus",
                    "StringEquals": "DRIFTED"
                  }
                ],
                "Next": "SendDriftNotification"
              }],
              "Default": "Done"
            },
            "SendDriftNotification": {
              "Type": "Task",
              "Resource": "${FunctionSendDriftNotification.Arn}",
              "Retry": [{
                "ErrorEquals": ["States.TaskFailed"],
                "IntervalSeconds": 5,
                "MaxAttempts": 30,
                "BackoffRate": 2
              }],
              "Next": "Done"
            },
            "Done": {
              "Type": "Succeed"
            },
            "Fail": {
              "Type": "Fail"
            }
          }
        }
      RoleArn: !GetAtt 'StateMachineRole.Arn'
  ExecutionsFailedAlarm:
    Type: 'AWS::CloudWatch::Alarm'
    Properties:
      AlarmDescription: 'Failed state machine executions.'
      Namespace: 'AWS/States'
      MetricName: ExecutionsFailed
      Dimensions:
      - Name: StateMachineArn
        Value: !Ref StateMachine
      Statistic: Sum
      Period: 300
      EvaluationPeriods: 1
      Threshold: 0
      TreatMissingData: notBreaching
      ComparisonOperator: GreaterThanThreshold
      AlarmActions:
      - !Ref Topic
  ExecutionsTimeoutAlarm:
    Type: 'AWS::CloudWatch::Alarm'
    Properties:
      AlarmDescription: 'Failed state machine executions.'
      Namespace: 'AWS/States'
      MetricName: ExecutionsTimedOut
      Dimensions:
      - Name: StateMachineArn
        Value: !Ref StateMachine
      Statistic: Sum
      Period: 300
      EvaluationPeriods: 1
      Threshold: 0
      TreatMissingData: notBreaching
      ComparisonOperator: GreaterThanThreshold
      AlarmActions:
      - !Ref Topic
  FunctionTrigger:
    Type: 'AWS::Lambda::Function'
    Properties:
      Handler: 'index.handler'
      Runtime: 'nodejs18.x'
      MemorySize: 128
      Timeout: 30
      Role: !GetAtt 'RoleTrigger.Arn'
      Environment:
        Variables:
          STATEMACHINE_ARN: !Ref StateMachine
          STACK_REGEXP: !Ref StackRegularExpression
      Code:
        ZipFile: |
          'use strict';
          const { CloudFormationClient, ListStacksCommand } = require('@aws-sdk/client-cloudformation');
          const cloudformation = new CloudFormationClient({apiVersion: '2010-05-15'});
          const { SFNClient, StartExecutionCommand } = require('@aws-sdk/client-sfn');
          const stepfunctions = new SFNClient({apiVersion: '2016-11-23'});
          let trigger = async (nextToken) => {
            let params = {
              StackStatusFilter: ['CREATE_COMPLETE', 'UPDATE_COMPLETE', 'UPDATE_ROLLBACK_COMPLETE', 'UPDATE_ROLLBACK_FAILED']
            }
            if (nextToken) {
              params.NextToken = nextToken;
            }
            const listStacksResult = await cloudformation.send(new ListStacksCommand(params));
            const stacks = listStacksResult.StackSummaries.filter(stack => stack.StackName.match(new RegExp(process.env.STACK_REGEXP)));
            for (let stack of stacks) {
              await stepfunctions.send(new StartExecutionCommand({stateMachineArn: process.env.STATEMACHINE_ARN, input: JSON.stringify({stackName: stack.StackName})}));
            }
            if (listStacksResult.NextToken) {
              trigger(listStacksResult.NextToken);
            }
          };
          exports.handler = async (event, context) => {
            await trigger();
            return event;
          };
  LogGroupTrigger:
    Type: 'AWS::Logs::LogGroup'
    Properties:
      LogGroupName: !Sub '/aws/lambda/${FunctionTrigger}'
      RetentionInDays: 14
  FunctionFetchDriftStatus: # no monitoring needed because function is invoked by StepFunctions
    Type: 'AWS::Lambda::Function'
    Properties:
      Handler: 'index.handler'
      Runtime: 'nodejs18.x'
      MemorySize: 128
      Timeout: 30
      Role: !GetAtt 'RoleFetchDriftStatus.Arn'
      Code:
        ZipFile: |
          'use strict';
          const { CloudFormationClient, DescribeStacksCommand } = require('@aws-sdk/client-cloudformation');
          const cloudformation = new CloudFormationClient({apiVersion: '2010-05-15'});
          exports.handler = async (event, context) => {
            const result = await cloudformation.send(new DescribeStacksCommand({StackName: event.stackName}));
            const driftStatus = result.Stacks[0].DriftInformation.StackDriftStatus;
            const arn = result.Stacks[0].StackId;
            return Object.assign({}, event, {previousDriftStatus: driftStatus, stackArn: arn});
          };
  LogGroupFetchDriftStatus:
    Type: 'AWS::Logs::LogGroup'
    Properties:
      LogGroupName: !Sub '/aws/lambda/${FunctionFetchDriftStatus}'
      RetentionInDays: 14
  FunctionStartDriftDetection: # no monitoring needed because function is invoked by StepFunctions
    Type: 'AWS::Lambda::Function'
    Properties:
      Handler: 'index.handler'
      Runtime: 'nodejs18.x'
      MemorySize: 128
      Timeout: 30
      Role: !GetAtt 'RoleStartDriftDetection.Arn'
      Code:
        ZipFile: |
          'use strict';
          const { CloudFormationClient, DetectStackDriftCommand } = require('@aws-sdk/client-cloudformation');
          const cloudformation = new CloudFormationClient({apiVersion: '2010-05-15'});
          exports.handler = async (event, context) => {
            const result = await cloudformation.send(new DetectStackDriftCommand({StackName: event.stackName}));
            return Object.assign({}, event, {stackDriftDetectionId: result.StackDriftDetectionId});
          };
  LogGroupStartDriftDetection:
    Type: 'AWS::Logs::LogGroup'
    Properties:
      LogGroupName: !Sub '/aws/lambda/${FunctionStartDriftDetection}'
      RetentionInDays: 14
  FunctionFetchDetectionStatus: # no monitoring needed because function is invoked by StepFunctions
    Type: 'AWS::Lambda::Function'
    Properties:
      Handler: 'index.handler'
      Runtime: 'nodejs18.x'
      MemorySize: 128
      Timeout: 30
      Role: !GetAtt 'RoleFetchDetectionStatus.Arn'
      Code:
        ZipFile: |
          'use strict';
          const { CloudFormationClient, DescribeStackDriftDetectionStatusCommand } = require('@aws-sdk/client-cloudformation');
          const cloudformation = new CloudFormationClient({apiVersion: '2010-05-15'});
          exports.handler = async (event, context) => {
            const result = await cloudformation.send(new DescribeStackDriftDetectionStatusCommand({StackDriftDetectionId: event.stackDriftDetectionId}));
            return Object.assign({}, event, {detectionStatus: result.DetectionStatus, latestDriftStatus: result.StackDriftStatus});
          };
  LogGroupFetchDetectionStatus:
    Type: 'AWS::Logs::LogGroup'
    Properties:
      LogGroupName: !Sub '/aws/lambda/${FunctionFetchDetectionStatus}'
      RetentionInDays: 14
  FunctionSendDriftNotification: # no monitoring needed because function is invoked by StepFunctions
    Type: 'AWS::Lambda::Function'
    Properties:
      Handler: 'index.handler'
      Runtime: 'nodejs18.x'
      MemorySize: 128
      Timeout: 30
      Role: !GetAtt 'RoleSendDriftNotification.Arn'
      Environment:
        Variables:
          REGION: !Ref 'AWS::Region'
          ACCOUNT: !Ref 'AWS::AccountId'
          TOPIC_ARN: !Ref Topic
      Code:
        ZipFile: |
          'use strict';
          const querystring = require('querystring');
          const { SNSClient, PublishCommand } = require('@aws-sdk/client-sns');
          const sns = new SNSClient({apiVersion: '2010-03-31'});
          exports.handler = async (event, context) => {
            const url = `https://console.aws.amazon.com/cloudformation/home?region=${process.env.REGION}#/stacks/drifts?stackId=${querystring.escape(event.stackArn)}`;
            const msg = {
              Account: process.env.ACCOUNT,
              Region: process.env.REGION,
              Stack: event.stackName,
              Message: `CloudFormation drift detected, stage changed from ${event.previousDriftStatus} to ${event.latestDriftStatus}.`,
              'Quick Links': url
            }
            await sns.send(new PublishCommand({
              TopicArn: process.env.TOPIC_ARN,
              Message: JSON.stringify(msg),
              MessageAttributes: {
                'X-Alert-Key': {
                  DataType: 'String',
                  StringValue: event.stackArn
                }
              }
            }));
            return event;
          };
  LogGroupSendDriftNotification:
    Type: 'AWS::Logs::LogGroup'
    Properties:
      LogGroupName: !Sub '/aws/lambda/${FunctionSendDriftNotification}'
      RetentionInDays: 14
Outputs:
  StackName:
    Description: 'Stack name.'
    Value: !Sub '${AWS::StackName}'
  StackTemplate:
    Description: 'Stack template.'
    Value: 'marbot-cloudformation-drift'
  StackVersion:
    Description: 'Stack version.'
    Value: '1.6.0'