Resources:
  s3kmskeyA0E45BCB:
    Type: AWS::KMS::Key
    Properties:
      KeyPolicy:
        Statement:
          - Action: kms:*
            Effect: Allow
            Principal:
              AWS:
                Fn::Join:
                  - ""
                  - - "arn:"
                    - Ref: AWS::Partition
                    - ":iam::"
                    - Ref: AWS::AccountId
                    - :root
            Resource: "*"
        Version: "2012-10-17"
      Description: KMS key for security hub findings in S3 bucket.
      EnableKeyRotation: false
      PendingWindowInDays: 7
    UpdateReplacePolicy: Delete
    DeletionPolicy: Delete
  s3kmskeyAlias2C7CE359:
    Type: AWS::KMS::Alias
    Properties:
      AliasName: alias/sechub_export_key
      TargetKeyId:
        Fn::GetAtt:
          - s3kmskeyA0E45BCB
          - Arn
  securityhubexportbucket0BDF3430:
    Type: AWS::S3::Bucket
    Properties:
      BucketEncryption:
        ServerSideEncryptionConfiguration:
          - BucketKeyEnabled: true
            ServerSideEncryptionByDefault:
              KMSMasterKeyID:
                Fn::GetAtt:
                  - s3kmskeyA0E45BCB
                  - Arn
              SSEAlgorithm: aws:kms
      LifecycleConfiguration:
        Rules:
          - ExpirationInDays: 365
            Status: Enabled
            Transitions:
              - StorageClass: GLACIER
                TransitionInDays: 31
      OwnershipControls:
        Rules:
          - ObjectOwnership: BucketOwnerEnforced
      PublicAccessBlockConfiguration:
        BlockPublicAcls: true
        BlockPublicPolicy: true
        IgnorePublicAcls: true
        RestrictPublicBuckets: true
      VersioningConfiguration:
        Status: Enabled
    UpdateReplacePolicy: Retain
    DeletionPolicy: Retain
  securityhubexportbucketPolicy5AE68C6C:
    Type: AWS::S3::BucketPolicy
    Properties:
      Bucket:
        Ref: securityhubexportbucket0BDF3430
      PolicyDocument:
        Statement:
          - Action: s3:*
            Condition:
              Bool:
                aws:SecureTransport: "false"
            Effect: Deny
            Principal:
              AWS: "*"
            Resource:
              - Fn::GetAtt:
                  - securityhubexportbucket0BDF3430
                  - Arn
              - Fn::Join:
                  - ""
                  - - Fn::GetAtt:
                        - securityhubexportbucket0BDF3430
                        - Arn
                    - /*
          - Action:
              - s3:GetObject*
              - s3:ListBucket
              - s3:PutObject*
            Effect: Allow
            Principal:
              AWS:
                Fn::GetAtt:
                  - getsechubfindingsrole8CEDAFEB
                  - Arn
            Resource:
              - Fn::GetAtt:
                  - securityhubexportbucket0BDF3430
                  - Arn
              - Fn::Join:
                  - ""
                  - - Fn::GetAtt:
                        - securityhubexportbucket0BDF3430
                        - Arn
                    - /*
        Version: "2012-10-17"
  getsechubfindingsrole8CEDAFEB:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Statement:
          - Action: sts:AssumeRole
            Effect: Allow
            Principal:
              Service: lambda.amazonaws.com
        Version: "2012-10-17"
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole
      RoleName: SHFindingReadAutomationRole
  sechubcountparameterD48E37A7:
    Type: AWS::SSM::Parameter
    Properties:
      Type: String
      Value: "0"
      Description: The Count for Security Hub findings.
      Name: /sechubexport/count
  getsechubfindingsfunctionF35AD803:
    Type: AWS::Lambda::Function
    Properties:
      Code:
        S3Bucket:
          Ref: LambdaCodeSourceS3Bucket
        S3Key:
          Ref: LambdaCodeSourceS3Key
      Role:
        Fn::GetAtt:
          - getsechubfindingsrole8CEDAFEB
          - Arn
      Description: Get all AWS Security Hub findings.
      Environment:
        Variables:
          REGION:
            Ref: AWS::Region
          S3_BUCKET:
            Ref: securityhubexportbucket0BDF3430
          KMS_KEY_ID:
            Fn::GetAtt:
              - s3kmskeyA0E45BCB
              - Arn
          SSM_PARAMETER_COUNT:
            Ref: sechubcountparameterD48E37A7
      Handler: get_sh_finding.lambda_handler
      MemorySize: 1024
      ReservedConcurrentExecutions: 100
      Runtime: python3.8
      Timeout: 900
    DependsOn:
      - getsechubfindingsrole8CEDAFEB
  lambdaGetSHFindingManagedPolicy28F5776D:
    Type: AWS::IAM::ManagedPolicy
    Properties:
      PolicyDocument:
        Statement:
          - Action: securityhub:Get*
            Effect: Allow
            Resource: "*"
            Sid: GetSHFinding
          - Action:
              - kms:Describe*
              - kms:Decrypt
              - kms:GenerateDataKey
            Effect: Allow
            Resource:
              Fn::GetAtt:
                - s3kmskeyA0E45BCB
                - Arn
            Sid: KMSDecrypt
          - Action:
              - ssm:GetParameter
              - ssm:PutParameter
            Effect: Allow
            Resource:
              Fn::Join:
                - ""
                - - "arn:"
                  - Ref: AWS::Partition
                  - ":ssm:"
                  - Ref: AWS::Region
                  - ":"
                  - Ref: AWS::AccountId
                  - :parameter
                  - Ref: sechubcountparameterD48E37A7
            Sid: SSMAllow
          - Action:
              - ec2:CreateNetworkInterface
              - ec2:DescribeNetworkInterfaces
              - ec2:DeleteNetworkInterface
            Effect: Allow
            Resource: "*"
            Sid: EC2Allow
        Version: "2012-10-17"
      Description: Get Security Hub Findings
      ManagedPolicyName: lambdaGetSHFindingManagedPolicy
      Path: /
      Roles:
        - Ref: getsechubfindingsrole8CEDAFEB
  sechubstatemachineRoleCC488DBF:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Statement:
          - Action: sts:AssumeRole
            Effect: Allow
            Principal:
              Service:
                Fn::Join:
                  - ""
                  - - states.
                    - Ref: AWS::Region
                    - .amazonaws.com
        Version: "2012-10-17"
  sechubstatemachineRoleDefaultPolicy091AA471:
    Type: AWS::IAM::Policy
    Properties:
      PolicyDocument:
        Statement:
          - Action: lambda:InvokeFunction
            Effect: Allow
            Resource:
              - Fn::GetAtt:
                  - getsechubfindingsfunctionF35AD803
                  - Arn
              - Fn::Join:
                  - ""
                  - - Fn::GetAtt:
                        - getsechubfindingsfunctionF35AD803
                        - Arn
                    - :*
          - Action: ssm:PutParameter
            Effect: Allow
            Resource:
              Fn::Join:
                - ""
                - - "arn:"
                  - Ref: AWS::Partition
                  - ":ssm:"
                  - Ref: AWS::Region
                  - ":"
                  - Ref: AWS::AccountId
                  - :parameter
                  - Ref: sechubcountparameterD48E37A7
        Version: "2012-10-17"
      PolicyName: sechubstatemachineRoleDefaultPolicy091AA471
      Roles:
        - Ref: sechubstatemachineRoleCC488DBF
  sechubstatemachine4A890B2A:
    Type: AWS::StepFunctions::StateMachine
    Properties:
      RoleArn:
        Fn::GetAtt:
          - sechubstatemachineRoleCC488DBF
          - Arn
      DefinitionString:
        Fn::Join:
          - ""
          - - '{"StartAt":"GetSecurityHubFindings","States":{"GetSecurityHubFindings":{"Next":"Check for NextToken in Security Hub Findings response.","Retry":[{"ErrorEquals":["Lambda.ServiceException","Lambda.AWSLambdaException","Lambda.SdkClientException"],"IntervalSeconds":2,"MaxAttempts":6,"BackoffRate":2},{"ErrorEquals":["States.ALL"],"IntervalSeconds":10,"MaxAttempts":5,"BackoffRate":2}],"Type":"Task","InputPath":"$","OutputPath":"$","Resource":"arn:'
            - Ref: AWS::Partition
            - :states:::lambda:invoke","Parameters":{"FunctionName":"
            - Fn::GetAtt:
                - getsechubfindingsfunctionF35AD803
                - Arn
            - '","Payload.$":"$"}},"Check for NextToken in Security Hub Findings response.":{"Type":"Choice","Choices":[{"Variable":"$.Payload.NextToken","IsNull":false,"Next":"GetSecurityHubFindings"}],"Default":"Security Hub Export Succeded"},"Security Hub Export Succeded":{"Type":"Succeed"}}}'
      StateMachineName: sec_hub_finding_export
    DependsOn:
      - sechubstatemachineRoleDefaultPolicy091AA471
      - sechubstatemachineRoleCC488DBF
  sechubstatustopicE541A4CB:
    Type: AWS::SNS::Topic
    Properties:
      DisplayName: SNS Topic for Security Hub Export Status.
      TopicName: Security_Hub_Export_Status
  sechubstatustopicPolicyAC5E8270:
    Type: AWS::SNS::TopicPolicy
    Properties:
      PolicyDocument:
        Statement:
          - Action: sns:Publish
            Effect: Allow
            Principal:
              Service: events.amazonaws.com
            Resource:
              Ref: sechubstatustopicE541A4CB
            Sid: "0"
        Version: "2012-10-17"
      Topics:
        - Ref: sechubstatustopicE541A4CB
  stepfunctionstatuschangeABD45BE3:
    Type: AWS::Events::Rule
    Properties:
      Description: Alerts when state machine status changes for Security Hub export.
      EventPattern:
        source:
          - aws.states
        detail-type:
          - Step Functions Execution Status Change
        detail:
          status:
            - SUCCEEDED
            - FAILED
            - TIMED_OUT
            - ABORTED
          executionArn:
            - Ref: sechubstatemachine4A890B2A
      Name: Alert_Sec_Hub_Export_Status_Change
      State: ENABLED
      Targets:
        - Arn:
            Ref: sechubstatustopicE541A4CB
          Id: Target0
Parameters:
  LambdaCodeSourceS3Bucket:
    Type: String
    Description: S3 bucket name where lambda code zip files are stored.
    Default: awsiammedia
  LambdaCodeSourceS3Key:
    Type: String
    Description:  S3 key for lambda source code for the lambda Security Hub export function.
    Default: public/sample/1391-security-hub-continuous-export/get_sh_finding.zip