AWSTemplateFormatVersion: "2010-09-09"
Description: >
  Vrymdor Business Security: send security relevant CloudTrail management events to Vrymdor through an
  EventBridge API destination. Push only; Vrymdor receives no access to this account.

Parameters:
  AwarenessToken:
    Type: String
    NoEcho: true
    AllowedPattern: "^vrym_live_[0-9a-f]{48}$"
    ConstraintDescription: The token from your Vrymdor approval email (vrym_live_ and 48 hex characters).
    Description: Your Vrymdor AWARENESS_TOKEN. EventBridge keeps it in AWS Secrets Manager in this account.
  VrymdorEndpoint:
    Type: String
    Default: https://api.vrymdor.com/v1/ingest/aws
    AllowedPattern: "^https://.+"
    Description: The Vrymdor ingestion endpoint.

Resources:
  VrymdorConnection:
    Type: AWS::Events::Connection
    Properties:
      Description: Vrymdor ingestion (API key header X-Awareness-Token)
      AuthorizationType: API_KEY
      AuthParameters:
        ApiKeyAuthParameters:
          ApiKeyName: X-Awareness-Token
          ApiKeyValue: !Ref AwarenessToken

  VrymdorDestination:
    Type: AWS::Events::ApiDestination
    Properties:
      Description: Vrymdor Business Security
      ConnectionArn: !GetAtt VrymdorConnection.Arn
      InvocationEndpoint: !Ref VrymdorEndpoint
      HttpMethod: POST
      InvocationRateLimitPerSecond: 10

  VrymdorInvokeRole:
    Type: AWS::IAM::Role
    Properties:
      Description: Lets EventBridge call the Vrymdor API destination and nothing else.
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Principal: { Service: events.amazonaws.com }
            Action: sts:AssumeRole
            Condition:
              StringEquals: { "aws:SourceAccount": !Ref AWS::AccountId }
      Policies:
        - PolicyName: invoke-vrymdor-destination
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Effect: Allow
                Action: events:InvokeApiDestination
                Resource: !GetAtt VrymdorDestination.Arn

  VrymdorSecurityEvents:
    Type: AWS::Events::Rule
    Properties:
      Description: Security relevant CloudTrail management events for Vrymdor
      State: ENABLED
      EventPattern:
        detail-type:
          - AWS API Call via CloudTrail
          - AWS Console Sign In via CloudTrail
        detail:
          eventName:
            - ConsoleLogin
            - StopLogging
            - DeleteTrail
            - UpdateTrail
            - PutBucketPolicy
            - PutBucketAcl
            - DeleteBucketPolicy
            - PutBucketPublicAccessBlock
            - DeleteBucketPublicAccessBlock
            - CreateAccessKey
            - CreateUser
            - DeleteUser
            - CreateLoginProfile
            - AttachUserPolicy
            - AttachRolePolicy
            - DetachUserPolicy
            - DetachRolePolicy
            - PutUserPolicy
            - PutRolePolicy
            - CreateRole
            - DeleteRole
            - UpdateAssumeRolePolicy
            - DeactivateMFADevice
            - AuthorizeSecurityGroupIngress
            - RevokeSecurityGroupIngress
            - CreateSecurityGroup
            - DeleteSecurityGroup
            - CreateKeyPair
            - DisableKey
            - ScheduleKeyDeletion
            - DeleteDetector
            - DisableSecurityHub
            - DeleteFlowLogs
            - ModifyDBInstance
      Targets:
        - Id: vrymdor
          Arn: !GetAtt VrymdorDestination.Arn
          RoleArn: !GetAtt VrymdorInvokeRole.Arn
          RetryPolicy:
            MaximumEventAgeInSeconds: 86400
            MaximumRetryAttempts: 185

Outputs:
  ApiDestinationArn:
    Value: !GetAtt VrymdorDestination.Arn
  RuleName:
    Value: !Ref VrymdorSecurityEvents