#  (c) 2020 Amazon Web Services, Inc. or its affiliates. All Rights Reserved. This AWS Content is provided subject to the terms of the AWS
#   Customer Agreement available at https://aws.amazon.com/agreement or other writtenagreement between Customer
#   and Amazon Web Services, Inc.

---

AWSTemplateFormatVersion: 2010-09-09
Description: Cloudformation Template to Create the IAM Role to be assumed by Lambda Function for unhealthy target monitoring. This template also creates the SNS Topic to be used for sending notificiation to the desired email ID.

Metadata:
  AWS::CloudFormation::Interface:
    ParameterGroups:
    - Label:
        default: Lambda IAM Role
      Parameters:
      - pIAMRoleForLambdaUnhealthyTargetMonitoring
      - pSNSTopicName
      - pEmailAddress
      - pS3BucketForUploads
      - pCWApplicationLogsEnabled
      - pCWLogGroupForAppLogs
    ParameterLabels:
      pIAMRoleForLambdaUnhealthyTargetMonitoring:
        default: Name of the IAM Role For UnhealthyTargetMonitoring Lambda Function
      pSNSTopicName:
        default: Name of the SNS Topic used for Notifications sent from Lambda Function
      pEmailAddress:
        default: Email Address for SNS Subscription
      pS3BucketForUploads:
        default: Name of the S3 bucket to store the Notifications
      pCWApplicationLogsEnabled:
        default: Are Application Logs for EC2 servers stored in CloudWatch Log Group
      pCWLogGroupForAppLogs:
        default: Cloudwatch Log Group Name where EC2 servers logs are stored

Parameters:
  pCWApplicationLogsEnabled:
    Type: String
    Default: 'FALSE'
    Description: >-
      Select True/False according to whether the EC2 Servers registered with the ALB, are sending Application logs to Cloudwatch log group.
    AllowedValues:
      - 'TRUE'
      - 'FALSE'
  pCWLogGroupForAppLogs:
    Type: String
    Default: 'NONE'
    Description: >-
      Enter the Name of the CloudWatch Log Group if you are storing applications logs of ALB Targets and have selected TRUE. 
      If you have selected FALSE, leave the value as 'NONE'
  pIAMRoleForLambdaUnhealthyTargetMonitoring:
    Default: 'IAMRole_Lambda_ELBUnhealthyTargetMonitoring'
    Type: String
    Description: >-
      Name of the IAM Role to be assumed by Lambda Function to be used for monitoring unhealthy targets
  pSNSTopicName:
    Default: 'ELB_UnhealthyTargetMonitoring_SNS_Topic'
    Type: String
    Description: >-
      Name of the SNS topic. This SNS topic is used to send out alerts to the subscribed email from the Lambda for UnhealthyTargetMonitoring
  pEmailAddress:
    Type: String
    Description: >-
      Email ID to be subsribed to the SNS Topic as an endpoint for notifications
  pS3BucketForUploads:
    Default: ''
    Type: String
    Description: >-
      Name of the S3 bucket where the Lambda for UnhealthyTargetMonitoring will be storing notifications as a backup

Conditions:
  CreateCWAlarmPolicy: !Equals 
    - !Ref pCWApplicationLogsEnabled
    - "TRUE"

Resources:
  rSNSTopicForNotifications:
    Type: AWS::SNS::Topic
    Properties: 
      Subscription: 
        - Endpoint: !Ref pEmailAddress
          Protocol: email
      TopicName: !Ref pSNSTopicName
  rIAMRoleForLambdaUnhealthyTargetMonitoring: ######### Role for Lambda Function UnhealthyTargetMonitoring
    Type: AWS::IAM::Role
    Properties:
      RoleName: !Ref pIAMRoleForLambdaUnhealthyTargetMonitoring
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
        - Effect: Allow
          Principal:
            Service:
            - lambda.amazonaws.com
          Action: sts:AssumeRole
      Description: IAM role for UnhealthyTarget Monitoring Lambda Function
      Policies:
        - PolicyName: IAMPolicyForUnhealthyTargetMornitoringLambda
          PolicyDocument:
            Version: 2012-10-17
            Statement:
            - Effect: Allow
              Action:
                - logs:CreateLogGroup
                - logs:CreateLogStream
                - logs:PutLogEvents
              Resource: !Sub arn:${AWS::Partition}:logs:${AWS::Region}:${AWS::AccountId}:log-group:/aws/lambda/ELB_UnhealthyTargetMonitoring*
            - Effect: Allow
              Action:
                - sns:Publish
              Resource: !Ref rSNSTopicForNotifications
            - Effect: Allow
              Action:
                - elasticloadbalancing:Describe*
                - ec2:Describe*
              Resource: "*"
            - Effect: Allow
              Action:
                - s3:PutObject
              Resource: !Sub arn:${AWS::Partition}:s3:::${pS3BucketForUploads}/*
  rRolePolicyForCWLogEvents: 
    Type: "AWS::IAM::Policy"
    Condition: CreateCWAlarmPolicy
    Properties: 
      PolicyName: "CloudWatchLogEventsPolicyForApplicationLogs"
      PolicyDocument: 
        Version: "2012-10-17"
        Statement: 
          - Effect: "Allow"
            Action:
              - logs:GetLogEvents
            Resource: !Sub arn:${AWS::Partition}:logs:${AWS::Region}:${AWS::AccountId}:log-group:${pCWLogGroupForAppLogs}:log-stream:*
      Roles: 
        - !Ref rIAMRoleForLambdaUnhealthyTargetMonitoring

Outputs:
  oIAMRoleARNForLambdaUnhealthyTargetMonitoring:
    Description: Arn of IAM role to be assumed by SSM Automation
    Value: !GetAtt rIAMRoleForLambdaUnhealthyTargetMonitoring.Arn
    Export:
      Name: IAMRole-Lambda-ELBUnhealthyTargetMonitoring
  oSNSTopicARN:
    Description: Arn of SNS Topic Subscribed to the provided email
    Value: !Ref rSNSTopicForNotifications
    Export:
      Name: SNSTopic-Notification-ELBUnhealthyTargetMonitoring


