AWSLimits.cfn

{
	"Parameters": {
		"TopicEmail": {
			"Default": "your.address@here.com",
			"Description": "E-Mail address to subscribe to alerts",
			"Type": "String"
		},
		"S3Bucket": {
			"Default": "your-bucket-here",
			"Description": "Bucket in your account where Lambda function (limits.zip) is stored",
			"Type": "String"
		},
		"S3Key": {
			"Default": "limits.zip",
			"Description": "S3 Key of Lambda Function Zip File (/path/to/limits.zip)",
			"Type": "String"
		},
		"AccountList": {
			"Default": "\"000000000000\",\"999999999999\"",
			"Description": "Quote Encapsulated, Comma Delimited List of Account Numbers to Scan for Limits",
			"Type": "String"
		},
		"RegionList": {
			"Default": "\"us-east-1\",\"us-west-2\"",
			"Description": "Quote Encapsulated, Comma Delimited List of Regions to Scan for Limits",
			"Type": "String"
		},
		"SNSTopicName": {
			"Default": "LimitCheckSNS",
			"Description": "Name of the SNS Topic for E-Mail Alerts",
			"Type": "String"
		},
		"CheckRoleName": {
			"Default": "LimitCheckRole",
			"Description": "Name of IAM Role created to check limits",
			"Type": "String"
		}
	},
	"Resources": {
		"SNSTopic": {
			"Type": "AWS::SNS::Topic",
			"Properties": {
				"DisplayName": "AWS Limits SNS",
				"Subscription": [{
					"Endpoint": {
						"Ref": "TopicEmail"
					},
					"Protocol": "email"
				}],
				"TopicName": {"Ref": "SNSTopicName"}
			},
			"Metadata" : {
				"Comment": "Create an SNS Topic to Publish Alerts to, subscribe e-mail parameter"
			}
		},
		"MasterLambda": {
			"Type": "AWS::Lambda::Function",
			"Properties": {
				"Code": {
					"S3Bucket": {"Ref": "S3Bucket"},
					"S3Key": {"Ref": "S3Key"}
				},
				"Handler": "limitMaster.lambda_handler",
				"Role": {"Fn::GetAtt" : [ "LRole", "Arn" ]},
				"Runtime": "python2.7",
				"Timeout": "300"
			},
			"DependsOn": "LRole",
			"Metadata" : {
				"Comment": "Lambda Function which take a list of accounts and invoke a Lambda function for each accounts limit analysis"
			}
		},
		"ChildLambda": {
			"Type": "AWS::Lambda::Function",
			"Properties": {
				"Code": {
					"S3Bucket": {"Ref": "S3Bucket"},
					"S3Key": {"Ref": "S3Key"}
				},
				"Handler": "limitCheck.lambda_handler",
				"Role": {"Fn::GetAtt" : [ "LRole", "Arn" ]},
				"Runtime": "python2.7",
				"Timeout": "300"
			},
			"DependsOn": "LRole",
			"Metadata" : {
				"Comment": "Lambda Function which take an account and list of regions and scan for approaching limits and send an alert to the SNS topic"
			}
		},
		"ConfigLambda": {
			"Type": "AWS::Lambda::Function",
			"Properties": {
				"Code": {
					"S3Bucket": {"Ref": "S3Bucket"},
					"S3Key": {"Ref": "S3Key"}
				},
				"Handler": "configuration.lambda_handler",
				"Role": {"Fn::GetAtt" : [ "LRole", "Arn" ]},
				"Runtime": "python2.7",
				"Timeout": "300"
			},
			"DependsOn": "LRole",
			"Metadata" : {
				"Comment": "Lambda Function which will take create the role to be assumed by the Child Lambda and be called cross-account"
			}
		},
		"CheckRole": {
			"Type": "Custom::CheckRole",
			"Properties":{
				"ServiceToken": {"Fn::GetAtt" : ["ConfigLambda", "Arn"]},
				"Region": { "Ref": "AWS::Region" },
				"CheckRoleName": {"Ref" : "CheckRoleName"},
				"AccountNumber": {"Ref" : "AWS::AccountId"}
			},
			"Metadata" : {
				"Comment": "Invoke the Configuration Lambda Function with the specified parameters for creating the role to assume"
			}
		},
		"LRole": {
			"Type": "AWS::IAM::Role",
			"Properties": {
				"AssumeRolePolicyDocument": {
					"Version": "2012-10-17",
					"Statement": [{
						"Effect": "Allow",
						"Principal": {
							"Service": "lambda.amazonaws.com"
						},
						"Action": "sts:AssumeRole"
					}]
				},
				"Path": "/",
				"Policies": [{
					"PolicyName": "Limits-AssumeRole",
					"PolicyDocument": {
						"Version": "2012-10-17",
						"Statement": [{
							"Effect": "Allow",
							"Action": ["sts:AssumeRole","lambda:Invoke*","SNS:Publish","logs:CreateLogGroup","logs:CreateLogStream","logs:PutLogEvents", "events:*", "iam:CreateRole", "iam:AttachRolePolicy", "iam:PutRolePolicy", "lambda:AddPermission", "iam:DeleteRole", "iam:DetachRolePolicy", "iam:DeleteRolePolicy"],
							"Resource": ["*"]
						}]
					}
				}]
			},	
			"Metadata" : {
				"Comment": "Invocation role for the Lambda functions to use"
			}
		},
		"Rule":	{
  			"Type" : "AWS::Events::Rule",
  			"Properties" : {
    			"ScheduleExpression" : "cron(* 0 * * ? *)",
    			"State" : "ENABLED",
    			"Targets" : [{
    				"Arn": { "Fn::GetAtt" : ["MasterLambda", "Arn"] },
    				"Id": "LimitsRule",
    				"Input": {
    					"Fn::Join":
    					["",
    						[
    							"{\"CheckRoleName\":\"",
    							{"Ref" : "CheckRoleName"},
    							"\",\"Region\":\"",
    							{ "Ref": "AWS::Region" },
    							"\",\"AccountList\":[",
    							{"Ref": "AccountList"},
    							"],\"RegionList\":[",
    							{"Ref": "RegionList"},
    							"],\"ChildLambda\":\"",
    							{"Ref" : "ChildLambda"},
    							"\",\"SNSArn\":\"",
    							{"Ref" : "SNSTopic"},
    							"\"}"
    						]
    					]
    				}
    			}]
  			},
  			"DependsOn": "CheckRole"
		},
		"LambdaInvokePermission": {
  			"Type": "AWS::Lambda::Permission",
  			"Properties": {
    			"FunctionName" : { "Fn::GetAtt" : ["MasterLambda", "Arn"] },
    			"Action": "lambda:InvokeFunction",
    			"Principal": "events.amazonaws.com",
    			"SourceArn": { "Fn::GetAtt" : ["Rule", "Arn"] }
  			}
		}		
	},
	"Outputs": {
  		"CreateRole" : {
  			"Description" : "Run this in each sub-account you wish to monitor to create a role for the primary account to assume",
  			"Value" : {
  				"Fn::Join": 
  				["", 
  					[
  						"aws iam create-role --role-name ",
  						{"Ref" : "CheckRoleName"},
  						" --assume-role-policy-document '{\"Version\": \"2012-10-17\",\"Statement\": [{\"Effect\": \"Allow\",\"Principal\": {\"AWS\": \"",
  						{"Ref" : "AWS::AccountId"},
  						"\"},\"Action\": \"sts:AssumeRole\"}]}'"
  					]
  				]
  			}
  		},
  		"AttachPolicy1" : {
  			"Description" : "Add Read Only Access",
  			"Value" : {
  				"Fn::Join": 
  				["", 
  					[
  						"aws iam attach-role-policy --policy-arn arn:aws:iam::aws:policy/ReadOnlyAccess --role-name ",
  						{"Ref" : "CheckRoleName"}
  					]
  				]
  			}
  		},
  		"AttachPolicy2" : {
  			"Description" : "Add Support API for TrustedAdvisor access",
  			"Value" : {
  				"Fn::Join": 
  				["", 
  					[
  						"aws iam attach-role-policy --policy-arn arn:aws:iam::aws:policy/AWSSupportAccess --role-name ",
  						{"Ref" : "CheckRoleName"}
  					]
  				]
  			}
  		},
  		"AttachPolicy3" : {
  			"Description" : "Add Support API for TrustedAdvisor access",
  			"Value" : {
  				"Fn::Join": 
  				["", 
  					[
  						"aws iam put-role-policy --role-name ",
  						{"Ref" : "CheckRoleName"}, 
  						" --policy-name CloudFormationDescribe --policy-document '{\"Version\": \"2012-10-17\",\"Statement\": [{\"Sid\": \"Stmt1455149881000\",\"Effect\": \"Allow\",\"Action\": [\"cloudformation:DescribeAccountLimits\"],\"Resource\": [\"*\"]}]}'"		
  					]
  				]
  			}
  		}
  	}
}