workloadsecurity-events-aws-sns-cloudwatchlogs-cloudformation.json

{
    "AWSTemplateFormatVersion": "2010-09-09",
    "Transform": "AWS::Serverless-2016-10-31",
    "Description": "CloudFormation template for Trend Micro Cloud One Workload Security Events - Amazon SNS Integration with Amazon CloudWatch Logs. For cost and billing purposes, all resources are tagged with Project=TrendMicro tags. Use AWS Resource Groups' tag filter to identify created resources.",
    "Metadata": {
        "AWS::CloudFormation::Interface": {
            "ParameterGroups": [
                {
                    "Label": {
                        "default": "[ Required section ]"
                    },
                    "Parameters": [
                        "C1WSApiSecretKey",
                        "C1WSCloudWatchLogRetentionPeriod"
                    ]
                },
                {
                    "Label": {
                        "default": "[ Optional: resource prefixes ] Warning: These fields need to be filled only when previous deployment of the following resources exist."
                    },
                    "Parameters": [
                        "C1WSSnsTopicArn",
                        "C1WSAPIUsername"
                    ]
                }
            ],
            "ParameterLabels": {
                "C1WSApiSecretKey": {
                    "default": "C1WSApiSecretKey"
                },
                "C1WSSnsTopicArn": {
                    "default": "C1WSSnsTopicArn"
                },
                "C1WSCloudWatchLogRetentionPeriod": {
                    "default": "C1WSCloudWatchLogRetentionPeriod"
                },
                "C1WSAPIUsername": {
                    "default": "C1WSAPIUsername"
                }
            }
        }
    },
    "Parameters": {
        "C1WSApiSecretKey": {
            "Type": "String",
            "Description": "Cloud One Workload Security API Secret Key. To create an API key, refer https://cloudone.trendmicro.com/docs/workload-security/api-send-request/#create-an-api-key",
            "ConstraintDescription": "must be a valid Cloud One Workload Security API Secret."
        },
        "C1WSAPIUsername": {
            "Type": "String",
            "Description": "Cloud One Workload Security API Username. Enter the username of the IAM User created for Workload Security. Default: CloudOneWorkloadSecurityAPIUser",
            "ConstraintDescription": "must be a valid IAM User."  
        },
        "C1WSCloudWatchLogRetentionPeriod":{
            "Type": "Number",
            "Description": "Choose a number of days to retain Workload Security Events in CloudWatch Logs. Choose 9999 to Never Expire",
            "AllowedValues": [1, 3, 5, 7, 14, 30, 60, 90, 120, 150, 180, 365, 400, 545, 731, 1827, 3653, 9999]
        },
        "C1WSSnsTopicArn": {
            "Type": "String",
            "Description": "OPTIONAL. Cloud One Workload Security SNS Topic ARN. Must be a valid SNS Topic ARN configured with Cloud One Workload Security - SNS integration prior to running this template.",
            "ConstraintDescription": "must be a valid SNS Topic ARN configured with Cloud One Workload Security - SNS integration prior to running this template."
        }
    },
    "Conditions": {
        "CreateC1WSSnsTopicArn": {
            "Fn::Equals" : [
                {
                    "Ref" : "C1WSSnsTopicArn"
                },
                ""
            ]
        },
        "ProvidedC1WSSnsTopicArn": {
            "Fn::Not" : [
                {
                    "Fn::Equals" : [
                        {
                            "Ref" : "C1WSSnsTopicArn"
                        },
                        ""
                    ]
                }
            ]
        },
        "IsC1WSApiSecretPresent": {
            "Fn::Equals" : [
                {
                    "Ref" : "C1WSApiSecretKey"
                },
                ""
            ]
        },
        "IsCWLogsRetentionSetToNeverExpire": {
            "Fn::Equals" : [
                {
                    "Ref" : "C1WSCloudWatchLogRetentionPeriod"
                },
                9999
            ]
        }
    },
    "Resources": {
        "C1WSSnsTopic": {
            "Type": "AWS::SNS::Topic",
            "Condition": "CreateC1WSSnsTopicArn",
            "Properties": {
                "DisplayName": "CloudOneWorkloadSecuritySnsCWLogsTopic",
                "TopicName": "CloudOneWorkloadSecuritySnsCWLogsTopic",
                "KmsMasterKeyId": {
                    "Fn::Join" : [ 
                        "", [ 
                            "arn:aws:kms:",
                            { "Ref" : "AWS::Region" },
                            ":",
                            { "Ref" : "AWS::AccountId" },
                            ":alias/aws/sns"
                        ] 
                    ]
                },
                "Tags": [
                    {
                        "Key": "Owner",
                        "Value": "TrendMicro"
                    },
                    {
                        "Key": "Product",
                        "Value": "CloudOneWorkloadSecurity"
                    },
                    {
                        "Key": "Name",
                        "Value": "CloudOneWorkloadSecuritySnsCWLogsTopic"
                    }
                ]
            }
        },
        "C1WSAPIUserSnsPolicy": {
            "Type": "AWS::IAM::Policy",
            "Condition": "CreateC1WSSnsTopicArn",
            "Properties": {
                "PolicyName": "CloudOneWorkloadSecurityEvent-Sns-Policy",
                "PolicyDocument": {
                    "Version": "2012-10-17",
                    "Statement": [
                        {
                            "Action": [
                                "sns:Publish"
                            ],
                            "Effect": "Allow",
                            "Resource": {
                                "Ref": "C1WSSnsTopic"
                            }
                        },
                        {
                            "Action": [
                                "kms:Decrypt",
                                "kms:DescribeKey",
                                "kms:Encrypt",
                                "kms:GenerateDataKey*",
                                "kms:ReEncrypt*"
                            ],
                            "Effect": "Allow",
                            "Resource": {
                                "Fn::Join" : [ 
                                    "", [ 
                                        "arn:aws:kms:",
                                        { "Ref" : "AWS::Region" },
                                        ":",
                                        { "Ref" : "AWS::AccountId" },
                                        ":alias/aws/sns"
                                    ] 
                                ]
                            }
                        }
                    ]
                },
                "Users": [
                    {
                        "Ref": "C1WSAPIUser"
                    }
                ]
            }
        },
        "C1WSEventsCWLogsGroup": {
            "Type" : "AWS::Logs::LogGroup",
            "Properties" : {
                "LogGroupName" : "CloudOneWorkloadSecurityEventsLogGroup",
                "RetentionInDays" : { "Fn::If": [ "IsCWLogsRetentionSetToNeverExpire", { "Ref": "AWS::NoValue" }, { "Ref": "C1WSCloudWatchLogRetentionPeriod" }]}
            }
        },
        "C1WSLambdaRole": {
            "Type": "AWS::IAM::Role",
            "Properties": {
                "AssumeRolePolicyDocument": {
                    "Version": "2012-10-17",
                    "Statement": [
                        {
                            "Effect": "Allow",
                            "Principal": {
                                "Service": [
                                    "lambda.amazonaws.com"
                                ]
                            },
                            "Action": [
                                "sts:AssumeRole"
                            ]
                        }
                    ]
                },
                "ManagedPolicyArns": [
                    "arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"
                ],
                "Description": "Workload Security Lambda IAM Role",
                "Path": "/",
                "RoleName": "CloudOneWorkloadSecurityLambdaRole",
                "Tags": [
                    {
                        "Key": "Owner",
                        "Value": "TrendMicro"
                    },
                    {
                        "Key": "Product",
                        "Value": "CloudOneWorkloadSecurity"
                    },
                    {
                        "Key": "Name",
                        "Value": "CloudOneWorkloadSecurityLambdaRole"
                    }
                ]
            }
        },
        "C1WSCWLogsLambdaPolicy": {
            "Type": "AWS::IAM::Policy",
            "Properties": {
                "PolicyName": "CloudOneWorkloadSecurityEvent-CWLogs-Policy",
                "PolicyDocument": {
                    "Version": "2012-10-17",
                    "Statement": [
                        {
                            "Effect": "Allow",
                            "Action": [
                                "logs:CreateLogGroup",
                                "logs:CreateLogStream",
                                "logs:PutLogEvents"
                            ],
                            "Resource": [
                                {
                                    "Fn::GetAtt": [
                                        "C1WSEventsCWLogsGroup",
                                        "Arn"
                                    ]
                                }
                            ]
                        }
                    ]
                },
                "Roles": [
                    {
                        "Ref": "C1WSLambdaRole"
                    }
                ]
            }
        },
        "C1WSAPIUser": {
            "Type": "AWS::IAM::User",
            "Condition": "IsC1WSApiSecretPresent",
            "Properties": {
                "Path": "/",
                "Tags": [
                    {
                        "Key": "Owner",
                        "Value": "TrendMicro"
                    },
                    {
                        "Key": "Product",
                        "Value": "CloudOneWorkloadSecurity"
                    },
                    {
                        "Key": "Name",
                        "Value": "CloudOneWorkloadSecurityAPIUser"
                    }
                ],
                "UserName": "CloudOneWorkloadSecurityAPIUser"
            }
        },
        "C1WSAPIUserIAMAccessKey": {
            "Type": "AWS::IAM::AccessKey",
            "Condition": "IsC1WSApiSecretPresent",
            "Properties": {
                "Status": "Active",
                "UserName": {
                    "Ref": "C1WSAPIUser"
                }
            }
        },
        "C1WSLambdaSnsCWLogsWriter": {
            "Type": "AWS::Serverless::Function",
            "Properties": {
                "Description": "Trend Micro Cloud One Workload Security lambda function to read Workload Security SIEM Events from the designated SNS topic and write to the designated CloudWatch Logs Group. Refer tags for the SNS Topic and CloudWatch Logs Group information.",
                "FunctionName": "CloudOneWorkloadSecurityLambdaSnsCWLogsWriter",
                "Handler": "index.lambda_handler",
                "Timeout": 15,
                "Role": {
                    "Fn::GetAtt": [
                        "C1WSLambdaRole",
                        "Arn"
                    ]
                },
                "Runtime": "python3.8",
                "InlineCode": "import os\nimport boto3\nimport string\nimport random\nimport time\n\ncwlogs = boto3.client('logs')\ndef createLogGroup(logGroupName):\n\tcreateLogGroupResponse = cwlogs.create_log_group(\n\t\tlogGroupName=logGroupName,\n\t\ttags={\n\t\t\t\"Owner\": \"TrendMicro\",\n\t\t\t\"Product\": \"CloudOneWorkloadSecurity\",\n\t\t\t\"Name\": logGroupName\n\t\t}\n\t)\n\ndef ifLogGroupExists(logGroupName):\n\tlistLogGroupsResponse = cwlogs.describe_log_groups()\n\tfor logGroup in listLogGroupsResponse[\"logGroups\"]:\n\t\tif logGroupName in logGroup[\"logGroupName\"]:\n\t\t\treturn True\n\treturn False\n\ndef createLogStream(logGroupName, logStreamName):\n\tcreateLogStreamResponse = cwlogs.create_log_stream(\n\t\tlogGroupName=logGroupName,\n\t\tlogStreamName=logStreamName\n\t)\n\tif createLogStreamResponse[\"ResponseMetadata\"][\"HTTPStatusCode\"] == 200:\n\t\treturn logStreamName\n\treturn \"\"\n\ndef putLogEvents(logGroupName, logStreamName, logEvents):\n\n\tputLogEventsResponse = cwlogs.put_log_events(\n\t\tlogGroupName=logGroupName,\n\t\tlogStreamName=logStreamName,\n\t\tlogEvents=logEvents\n\t)\n\tif \"rejectedLogEventsInfo\" not in putLogEventsResponse:\n\t\treturn True\n\treturn False\n\ndef lambda_handler(event, context):\n\n\tlogGroupName = str(os.environ.get(\"CloudWatchLogGroupName\"))\n\tlogStreamNamePrefix = str(os.environ.get(\"CloudWatchLogStreamNamePrefix\"))\n\n\tnonce = ''.join(random.choices(string.ascii_letters + string.digits, k=8)).upper()\n\n\tlogEvents = []\n\n\tepoch_time = int(round(time.time() * 1000))\n\n\ttempDict = {}\n\ttempDict.update({\"timestamp\": epoch_time, \"message\": event[\"Records\"][0][\"Sns\"][\"Message\"]})\n\n\tlogEvents.append(tempDict)\n\n\tif len(logEvents) > 0:\n\t\tif ifLogGroupExists(logGroupName):\n\t\t\tlogStreamName = createLogStream(logGroupName, logStreamNamePrefix + \"-\" + nonce)\n\t\t\tresult = putLogEvents(logGroupName, logStreamName, logEvents)\n\t\telse:\n\t\t\tcreateLogGroup(logGroupName)\n\t\t\tlogStreamName = createLogStream(logGroupName, logStreamNamePrefix + \"-\" + nonce)\n\t\t\tresult = putLogEvents(logGroupName, logStreamName, logEvents)\n",
                "Environment": {
                    "Variables": {
                        "CloudWatchLogGroupName": "CloudOneWorkloadSecurityEventsLogGroup",
                        "CloudWatchLogStreamNamePrefix": "CloudOneWorkloadSecurityEventsLogStream"
                    }
                },
                "Events": {
                    "SnsTriggerEvent": {
                        "Type": "SNS",
                        "Properties": {
                            "Topic": {
                                "Ref": "C1WSSnsTopic"
                            }
                        }
                    }
                },
                "Tags": {
                    "Owner": "TrendMicro",
                    "Product": "CloudOneWorkloadSecurity",
                    "Name": "CloudOneWorkloadSecurityLambdaSnsCWLogsWriter",
                    "SnsTopicArn": {
                        "Ref": "C1WSSnsTopic"
                    },
                    "CloudWatchLogGroup": {
                        "Fn::GetAtt": [
                            "C1WSEventsCWLogsGroup",
                            "Arn"
                        ]
                    }
                }
            }
        },
        "C1WSConfigureSIEMLambdaFunction": {
            "Type": "AWS::Lambda::Function",
            "Properties": {
                "Description": "Trend Micro Cloud One Workload Security lambda function to configure Workload Security SNS Event Forwarding using REST APIs",
                "Handler": "index.lambda_handler",
                "Timeout": 15,
                "Role": {
                    "Fn::GetAtt": [
                        "C1WSLambdaRole",
                        "Arn"
                    ]
                },
                "Runtime": "python3.8",
                "Code": {
                    "ZipFile": "import cfnresponse\nimport urllib3\nimport json\n\ndef callCloudOneWorkloadSecurityApi(c1wsSecret, configKey, configValue):\n\tbaseUrl = 'https:\/\/app.deepsecurity.trendmicro.com\/api\/systemsettings\/'\n\turl = baseUrl + configKey\n\thttpBody = json.dumps({ \"value\": configValue })\n\thttp = urllib3.PoolManager()\n\theader = { 'Content-Type': 'application/json', 'Content-Length': str(len(httpBody)), 'Host': 'app.deepsecurity.trendmicro.com', 'api-version': 'v1', 'api-secret-key': c1wsSecret }\n\tx = http.request('POST', url, headers=header, body=httpBody)\n\treturn str(x.data)\n\ndef lambda_handler(event, context):\n\tprint(f\"Data in event: {event}\")\n\tresponse_data = \"\"\n\tresponseObj = {}\n\tif event[\"RequestType\"] == \"Create\" or event[\"RequestType\"] == \"Update\":\n\t\taws_sns_topic = str(event[\"ResourceProperties\"][\"C1WSSnsTopicArn\"])\n\t\tc1wsAwsIamUserAccesskey = str(event[\"ResourceProperties\"][\"C1WSAPIUserAccessKey\"])\n\t\tc1wsAwsIamUserSecretkey = str(event[\"ResourceProperties\"][\"C1WSAPIUserAccessSecret\"])\n\t\tc1wsApiSecretKey = str(event[\"ResourceProperties\"][\"C1WSApiSecretKey\"])\n\t\tc1wsSnsEventForwardingConfigJson = '{ \"platformSettingEventForwardingSnsAdvancedConfigEnabled\": \"false\", \"platformSettingEventForwardingSnsEnabled\": \"true\", \"platformSettingEventForwardingSnsConfigJson\": { \"Version\": \"2014-09-24\", \"Statement\": [ { \"Topic\": \"\", \"Condition\": { \"StringEquals\": { \"EventType\": [ \"SystemEvent\", \"AntiMalwareEvent\", \"WebReputationEvent\", \"AppControlEvent\", \"IntegrityEvent\", \"LogInspectionEvent\", \"PacketLog\", \"PayloadLog\" ] } } } ] }, \"platformSettingEventForwardingSnsSecretKey\": \"\", \"platformSettingEventForwardingSnsAccessKey\": \"\" }'\n\t\tc1wsSnsEventForwardingConfigDict = json.loads(c1wsSnsEventForwardingConfigJson)\n\t\tc1wsSnsEventForwardingConfigDict[\"platformSettingEventForwardingSnsConfigJson\"][\"Statement\"][0][\"Topic\"] = aws_sns_topic\n\t\tc1wsSnsEventForwardingConfigDict[\"platformSettingEventForwardingSnsSecretKey\"] = c1wsAwsIamUserSecretkey\n\t\tc1wsSnsEventForwardingConfigDict[\"platformSettingEventForwardingSnsAccessKey\"] = c1wsAwsIamUserAccesskey\n\n\t\tfor item in c1wsSnsEventForwardingConfigDict:\n\t\t\tresponse = \"\"\n\t\t\tresponse = callCloudOneWorkloadSecurityApi(c1wsApiSecretKey, str(item), str(c1wsSnsEventForwardingConfigDict[item]))\n\t\t\tresponse_data += response\n\t\t\tresponseObj = { \"Output\": response_data }\n\n\tcfnresponse.send(event, context, cfnresponse.SUCCESS, responseObj)"
                },
                "Tags": [
                    {
                        "Key": "Owner",
                        "Value": "TrendMicro"
                    },
                    {
                        "Key": "Product",
                        "Value": "CloudOneWorkloadSecurity"
                    },
                    {
                        "Key": "Name",
                        "Value": "CloudOneWorkloadSecurityLambdaConfigureSnsEventForwarding"
                    }
                ]
            }
        },
        "CloudOneWorkloadSecurityConfigResource": {
            "Type": "Custom::CloudOneWorkloadSecurityConfigResource",
            "Properties": {
                "ServiceToken": {
                    "Fn::GetAtt": [
                        "C1WSConfigureSIEMLambdaFunction",
                        "Arn"
                    ]
                },
                "C1WSSnsTopicArn": {
                    "Ref": "C1WSSnsTopic"
                },
                "C1WSAPIUserAccessSecret": {
                    "Fn::GetAtt": [
                        "C1WSAPIUserIAMAccessKey",
                        "SecretAccessKey"
                    ]
                },
                "C1WSAPIUserAccessKey": {
                    "Ref": "C1WSAPIUserIAMAccessKey"
                },
                "C1WSApiSecretKey": {
                    "Ref": "C1WSApiSecretKey"
                }
            }
        }
    },
    "Outputs": {
        "ProvidedC1WSSnsTopicArn": {
            "Description": "Provided SNS Topic ARN for Trend Micro Cloud One Workload Security",
            "Condition": "ProvidedC1WSSnsTopicArn",
            "Value": {
                "Ref": "C1WSSnsTopicArn"
            }
        },
        "C1WSSnsTopicArn": {
            "Description": "SNS Topic ARN for Trend Micro Cloud One Workload Security",
            "Condition": "CreateC1WSSnsTopicArn",
            "Value": {
                "Ref": "C1WSSnsTopic"
            }
        },
        "C1WSEventsCWLogsGroupArn": {
            "Value": {
                "Fn::GetAtt": [
                    "C1WSEventsCWLogsGroup",
                    "Arn"
                ]
            },
            "Description": "Bucket Name of the newly created S3 Bucket for Trend Micro Cloud One Workload Security"
        },
        "C1WSLambdaSnsCWLogsWriter": {
            "Description": "Lambda Function ARN for Trend Micro Cloud One Workload Security",
            "Value": {
                "Fn::GetAtt": [
                    "C1WSLambdaSnsCWLogsWriter",
                    "Arn"
                ]
            }
        },
        "C1WSConfigureSIEMLambdaFunction": {
            "Description": "One-time configuration Lambda Function ARN for Trend Micro Cloud One Workload Security",
            "Value": {
                "Fn::GetAtt": [
                    "C1WSConfigureSIEMLambdaFunction",
                    "Arn"
                ]
            }
        }
    }
}