waf_kinesis_log.yml

AWSTemplateFormatVersion: '2010-09-09'
Description: Kinesis Firehose for WAF logs

Parameters:
  AppEnvironment:
    Description: Type of app environment.
    Type: String
    Default: staging
    AllowedValues:
      - staging
      - production

Resources:
  S3Bucket:
    Type: AWS::S3::Bucket
    Properties:
      BucketName: !Sub ${AppEnvironment}-cfj-decidim-waf-log
      AccessControl: LogDeliveryWrite
      LifecycleConfiguration:
        Rules:
          - Id: !Sub ${AppEnvironment}-cfj-decidim-waf-log-life-cycle
            Status: Enabled
            Transitions:
              - StorageClass: STANDARD_IA
                TransitionInDays: 30

  WAFLogDeliveryStream:
    Type: AWS::KinesisFirehose::DeliveryStream
    Properties:
      DeliveryStreamName: !Sub "aws-waf-logs-${AppEnvironment}-cfj-decidim"
      DeliveryStreamType: DirectPut
      S3DestinationConfiguration:
        BucketARN: !Sub "${S3Bucket.Arn}"
        BufferingHints:
          SizeInMBs: 5
          IntervalInSeconds: 300
        CloudWatchLoggingOptions:
          Enabled: true
          LogGroupName: !Sub "/aws/kinesisfirehose/aws-waf-logs-${AppEnvironment}-cfj-decidim"
          LogStreamName: S3Delivery
        CompressionFormat: GZIP
        EncryptionConfiguration:
          NoEncryptionConfig: NoEncryption
        ErrorOutputPrefix: ""
        Prefix: ""
        RoleARN: !Sub "${FirehoseRole.Arn}"

  WAFLogDeliveryStreamLogGroup:
    Type: AWS::Logs::LogGroup
    Properties:
      LogGroupName: !Sub "/aws/kinesisfirehose/aws-waf-logs-${AppEnvironment}-cfj-decidim"

  WAFLogDeliveryStreamLogStream:
    Type: AWS::Logs::LogStream
    Properties:
      LogGroupName: !Ref WAFLogDeliveryStreamLogGroup
      LogStreamName: S3Delivery

  FirehoseRole:
    Type: AWS::IAM::Role
    DeletionPolicy: Retain
    Properties:
      RoleName: !Sub "${AppEnvironment}-cfj-decidim-FirehoseRole"
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Action: sts:AssumeRole
            Effect: Allow
            Principal:
              Service: firehose.amazonaws.com
      Policies:
        - PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Action:
                  - glue:GetTable
                  - glue:GetTableVersion
                  - glue:GetTableVersions
                Effect: Allow
                Resource: "*"
              - Action:
                  - s3:AbortMultipartUpload
                  - s3:GetBucketLocation
                  - s3:GetObject
                  - s3:ListBucket
                  - s3:ListBucketMultipartUploads
                  - s3:PutObject
                Effect: Allow
                Resource:
                  - !Sub "${S3Bucket.Arn}"
                  - !Sub "${S3Bucket.Arn}/*"
                  - arn:aws:s3:::%FIREHOSE_BUCKET_NAME%
                  - arn:aws:s3:::%FIREHOSE_BUCKET_NAME%/*
              - Action: kms:Decrypt
                Effect: Allow
                Resource: !Sub "arn:aws:kms:${AWS::Region}:${AWS::AccountId}:key/%SSE_KEY_ID%"
              - Action:
                  - lambda:InvokeFunction
                  - lambda:GetFunctionConfiguration
                Effect: Allow
                Resource: !Sub "arn:aws:lambda:${AWS::Region}:${AWS::AccountId}:function:%FIREHOSE_DEFAULT_FUNCTION%:%FIREHOSE_DEFAULT_VERSION%"
              - Action: logs:PutLogEvents
                Effect: Allow
                Resource: !Sub "arn:aws:logs:${AWS::Region}:${AWS::AccountId}:log-group:/aws/kinesisfirehose/${S3Bucket}:log-stream:*"
              - Action:
                  - kinesis:DescribeStream
                  - kinesis:GetShardIterator
                  - kinesis:GetRecords
                Effect: Allow
                Resource: !Sub "arn:aws:kinesis:${AWS::Region}:${AWS::AccountId}:stream/%FIREHOSE_STREAM_NAME%"
          PolicyName: firehose_delivery_role_policy