template.yaml

AWSTemplateFormatVersion: "2010-09-09"
Transform: AWS::Serverless-2016-10-31
Description: ECR Continuous Scan

Globals:
  Function:
    Timeout: 30
  Api:
    Cors:
      AllowMethods: "'*'"
      AllowHeaders: "'*'"
      AllowOrigin: "'*'"

Parameters:
    ConfigBucketName:
        Type: String

Resources:
  ConfigsFunc:
    Type: AWS::Serverless::Function
    Properties:
      CodeUri: bin/
      Handler: configs
      Runtime: go1.x
      Tracing: Active
      Environment:
        Variables:
          ECR_SCAN_CONFIG_BUCKET: !Sub "${ConfigBucketName}"
      Events:
        AddConfig:
          Type: Api
          Properties:
            Path: /configs
            Method: POST
        RemoveConfig:
          Type: Api
          Properties:
            Path: /configs/{id}
            Method: DELETE
        ListConfigs:
          Type: Api
          Properties:
            Path: /configs
            Method: GET
      Policies:
        - AWSLambdaExecute
        - Version: '2012-10-17'
          Statement:
            - Effect: Allow
              Action:
              - s3:*
              Resource:
              - !Sub "arn:aws:s3:::${ConfigBucketName}/*"
              - !Sub "arn:aws:s3:::${ConfigBucketName}"
  SummaryFunc:
    Type: AWS::Serverless::Function
    Properties:
      CodeUri: bin/
      Handler: summary
      Runtime: go1.x
      Tracing: Active
      Environment:
        Variables:
          ECR_SCAN_CONFIG_BUCKET: !Sub "${ConfigBucketName}"
      Events:
        CatchAll:
          Type: Api
          Properties:
            Path: /summary
            Method: GET
      Policies:
        - AWSLambdaExecute
        - Version: '2012-10-17'
          Statement:
            - Effect: Allow
              Action:
              - ecr:*
              Resource: '*'
            - Effect: Allow
              Action:
              - s3:*
              Resource:
              - !Sub "arn:aws:s3:::${ConfigBucketName}/*"
              - !Sub "arn:aws:s3:::${ConfigBucketName}"
  FindingsFunc:
    Type: AWS::Serverless::Function
    Properties:
      CodeUri: bin/
      Handler: findings
      Runtime: go1.x
      Tracing: Active
      Environment:
        Variables:
          ECR_SCAN_CONFIG_BUCKET: !Sub "${ConfigBucketName}"
      Events:
        CatchAll:
          Type: Api
          Properties:
            Path: /findings/{id}
            Method: GET
      Policies:
        - AWSLambdaExecute
        - Version: '2012-10-17'
          Statement:
            - Effect: Allow
              Action:
              - ecr:*
              Resource: '*'
            - Effect: Allow
              Action:
              - s3:*
              Resource:
              - !Sub "arn:aws:s3:::${ConfigBucketName}/*"
              - !Sub "arn:aws:s3:::${ConfigBucketName}"
  StartScanFunc:
    Type: AWS::Serverless::Function
    Properties:
      CodeUri: bin/
      Handler: start-scan
      Runtime: go1.x
      Tracing: Active
      Environment:
        Variables:
          ECR_SCAN_CONFIG_BUCKET: !Sub "${ConfigBucketName}"
      Events:
        Timer:
          Type: Schedule
          Properties:
            Schedule: rate(24 hours)
      Policies:
        - AWSLambdaExecute
        - Version: '2012-10-17'
          Statement:
            - Effect: Allow
              Action:
              - ecr:*
              Resource: '*'
            - Effect: Allow
              Action:
              - s3:*
              Resource:
              - !Sub "arn:aws:s3:::${ConfigBucketName}/*"
              - !Sub "arn:aws:s3:::${ConfigBucketName}"
  

Outputs:
  ECRScanAPIEndpoint:
    Description: "The ECR Continuous Scan HTTP API Gateway endpoint URL"
    Value: !Sub "https://${ServerlessRestApi}.execute-api.${AWS::Region}.amazonaws.com/Prod"