AWSTemplateFormatVersion: "2010-09-09"
Description: >
 Sample CloudFormation template creates archive rules for findings created for resources shared outside of your zone of trust for specified analyzer. 
  
# When you are creating the analyzer for the Org level, make sure your service is enabled at the org level by running this command on CLI from the org root account `aws organizations enable-aws-service-access --service-principal access-analyzer.amazonaws.com`

Metadata: 
  AWS::CloudFormation::Interface: 
    ParameterGroups: 
      - 
        Label: 
          default: "Define Configuration"
        Parameters: 
          - AccessAnalyzerName
          - ZoneOfTrust
          - KnownPublicS3Buckets
          - TrustedAccounts
          - SAMLProvider
      
Parameters:

  AccessAnalyzerName:
    Description: Provide name of the analyzer you would like to create archive rules for.
    Type: String

  ZoneOfTrust:
    Description: Select the zone of trust of AccessAnalyzer
    AllowedValues:
      - ACCOUNT
      - ORGANIZATION
    Type: String

  
  KnownPublicS3Buckets:
    Description: List of comma-separated known S3 bucket arns, that should allow public access Example - arn:aws:s3:::DOC-EXAMPLE-BUCKET,arn:aws:s3:::DOC-EXAMPLE-BUCKET2
    Type: CommaDelimitedList
    
    
  TrustedAccounts:
    Description: List of comma-separated account IDs, that do not belong to your organization but you trust them to have access to resources in your organization. [Example - Your auditor’s AWS account]
    Type: List<Number>
    

  TrustedFederationPrincipals:
    Description: List of comma-separated trusted federated principals that are able to assume roles in your accounts. [Example - arn:aws:iam::012345678901:saml-provider/Okta, arn:aws:iam::1111222233334444:saml-provider/Okta]
    Type: CommaDelimitedList
    
   
Resources:
  AccessAnalyzer:
    Type: AWS::AccessAnalyzer::Analyzer
    Properties:
      AnalyzerName: !Sub '${AccessAnalyzerName}-${AWS::Region}'
      Type: !Ref ZoneOfTrust
      ArchiveRules:
        - # Archive findings for known public S3 buckets
          RuleName: ArchivePublicS3BucketsAccess
          Filter:
            - Property: 'resource'
              Eq: !Ref KnownPublicS3Buckets
        - # Archive findings for a trusted AWS account
          RuleName: AccountAccessNecessaryForBusinessProcesses
          Filter:
            - Property: 'principal.AWS'
              Eq: !Ref TrustedAccounts
            - Property: 'isPublic'
              Eq: 
                - 'false'
        - # Archive findings from saml federation [The filter for OktaFederatedUsers rule depends on the name given to the SAML Identity Provider in your Federation setup. For example, if your SAML identity provider name is myIdp, then the principal.Federated property in the CloudFormation template rule should have a contains value of ‘:saml-provider/myIdp’]
          RuleName: SAMLFederatedUsers
          Filter:
            - Property: 'principal.Federated'
              Eq: !Ref TrustedFederationPrincipals