template.yaml

AWSTemplateFormatVersion: "2010-09-09"
Transform: AWS::Serverless-2016-10-31

Description: >
  aws-access-key-expiry

  Sample SAM Template for aws-access-key-expiry

Metadata:
  AWS::ServerlessRepo::Application:
    Name: aws-access-key-expiry
    Description: TODO
    Author: Christian Schneider
    SpdxLicenseId: Apache-2.0
    LicenseUrl: LICENSE
    ReadmeUrl: README.md
    HomePageUrl: https://github.com/cdschneider/aws-access-key-expiry
    SourceCodeUrl: https://github.com/cdschneider/aws-access-key-expiry

Parameters:
  LambdaFunctionArch:
    Type: String
    Default: x86_64
    AllowedValues:
      - x86_64
      - arm64
    Description: The architecture used for the Lambda functions in this stack

Resources:
  ExpireAccessKeysStateMachine:
    Type: AWS::Serverless::StateMachine
    Properties:
      DefinitionUri: statemachine/workflow.asl.json
      DefinitionSubstitutions:
        AccessKeyActionsFunctionArn: !GetAtt AccessKeyActionsFunction.Arn
        AccessKeyRotationFunctionArn: !GetAtt AccessKeyRotationFunction.Arn
        AccessKeyDynamoDbTableName: !Ref AccessKeyTable
      Type: EXPRESS
      Tracing:
        Enabled: True
      Logging:
        Destinations:
          - CloudWatchLogsLogGroup:
              LogGroupArn: !GetAtt ExpireAccessKeysStateMachineLogGroup.Arn
        IncludeExecutionData: True
        Level: ALL
      Events:
        RecurringSchedule:
          Type: Schedule
          Properties:
            Schedule: "rate(5 minutes)"
            Enabled: True
      Policies:
        - IAMReadOnlyAccess
        - AWSXrayWriteOnlyAccess
        - !Ref IAMUpdateAccessKeysPolicy
        - !Ref StepFunctionsLoggingPolicy
        - LambdaInvokePolicy:
            FunctionName: !Ref AccessKeyActionsFunction
        - LambdaInvokePolicy:
            FunctionName: !Ref AccessKeyRotationFunction
        - DynamoDBWritePolicy:
            TableName: !Ref AccessKeyTable

  ExpireAccessKeysStateMachineLogGroup:
    Type: AWS::Logs::LogGroup
    UpdateReplacePolicy: Delete
    DeletionPolicy: Delete

  AccessKeyActionsFunction:
    Type: AWS::Serverless::Function
    Properties:
      PackageType: Image
      Architectures:
        - Ref: LambdaFunctionArch
      Policies:
        - DynamoDBReadPolicy:
            TableName: !Ref AccessKeyTable
        - AWSXrayWriteOnlyAccess
        - !Ref IAMReadAccessKeysPolicy
      Tracing: Active
      Timeout: 10
      Environment:
        Variables:
          DynamoDB__TableName: !Ref AccessKeyTable
    Metadata:
      Dockerfile: Dockerfile
      DockerContext: ./src/AccessKeyActions/
  
  AccessKeyRotationFunction:
    Type: AWS::Serverless::Function
    Properties:
      PackageType: Image
      Architectures:
        - Ref: LambdaFunctionArch
      Policies:
        - IAMFullAccess
        - SecretsManagerReadWrite
        - AWSXrayWriteOnlyAccess
      Tracing: Active
    Metadata: 
      Dockerfile: Dockerfile
      DockerContext: ./src/AccessKeyRotation/
  
  StepFunctionsLoggingPolicy:
    Type: AWS::IAM::ManagedPolicy
    Properties:
      PolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Action:
              - 'logs:CreateLogDelivery'
              - 'logs:GetLogDelivery'
              - 'logs:UpdateLogDelivery'
              - 'logs:DeleteLogDelivery'
              - 'logs:ListLogDeliveries'
              - 'logs:PutResourcePolicy'
              - 'logs:DescribeResourcePolicies'
              - 'logs:DescribeLogGroups'
            Resource: '*'

  IAMReadAccessKeysPolicy:
    Type: AWS::IAM::ManagedPolicy
    Properties:
      PolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Action:
              - 'iam:GetAccessKeyLastUsed'
              - 'iam:ListAccessKeys'
            Resource: '*'

  IAMUpdateAccessKeysPolicy:
    Type: AWS::IAM::ManagedPolicy
    Properties:
      PolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Action:
              - 'iam:UpdateAccessKey'
              - 'iam:DeleteAccessKey'
            Resource: '*'

  AccessKeyTable:
    Type: AWS::Serverless::SimpleTable
    UpdateReplacePolicy: Delete
    DeletionPolicy: Delete
    Properties:
      PrimaryKey:
        Name: Id
        Type: String