CFN_DEPLOY_AHA.yml

AWSTemplateFormatVersion: '2010-09-09'
Description: CloudFormation Template for AWS Health Aware (AHA)
Metadata:
  'AWS::CloudFormation::Interface':
    ParameterGroups:
      - Label:
          default: Customize Alerts/Notifications
        Parameters:
          - AWSOrganizationsEnabled
          - AWSHealthEventType
      - Label:
          default: Package Information
        Parameters:
          - S3Bucket
          - S3Key
      - Label:
          default: >-
            Communication Channels - Slack/Microsoft Teams/Amazon Chime And/or
            EventBridge
        Parameters:
          - SlackWebhookURL
          - MicrosoftTeamsWebhookURL
          - AmazonChimeWebhookURL
          - EventBusName
      - Label:
          default: Email Setup - For Alerting via Email
        Parameters:
          - FromEmail
          - ToEmail
          - Subject
      - Label:
          default: More Configurations - Optional
        Parameters:
          - EventSearchBack
          - Regions
          - ManagementAccountRoleArn
          - SecondaryRegion
          - AccountIDs
    ParameterLabels:
      AWSOrganizationsEnabled:
        default: AWS Organizations Enabled?
      ManagementAccountRoleArn:
        default: ARN of the AWS Organizations Management Account assume role (if using)
      AWSHealthEventType:
        default: The types of events to get alerted on
      S3Bucket:
        default: Name of S3 Bucket
      S3Key:
        default: Name of .zip file in S3 Bucket
      SlackWebhookURL:
        default: Slack Webhook URL
      MicrosoftTeamsWebhookURL:
        default: Microsoft Teams Webhook URL
      AmazonChimeWebhookURL:
        default: Amazon Chime Webhook URL
      FromEmail:
        default: Email From
      ToEmail:
        default: Email To
      Subject:
        default: Subject of Email
      HealthAPIFrequency:
        default: Hours back to search for events
      Regions:
        default: Which regions to search for events in
      SecondaryRegion:
        default: Deploy in secondary region?
      AccountIDs:
        default: Exclude any account numbers?        
Conditions:
  UsingSlack: !Not [!Equals [!Ref SlackWebhookURL, None]]
  UsingTeams: !Not [!Equals [!Ref MicrosoftTeamsWebhookURL, None]]
  UsingChime: !Not [!Equals [!Ref AmazonChimeWebhookURL, None]]
  UsingEventBridge: !Not [!Equals [!Ref EventBusName, None]]
  UsingSecrets: !Or [!Condition UsingSlack, !Condition UsingTeams, !Condition UsingChime, !Condition UsingEventBridge, !Condition UsingCrossAccountRole]
  UsingCrossAccountRole: !Not [!Equals [!Ref ManagementAccountRoleArn, None]]
  NotUsingMultiRegion: !Equals [!Ref SecondaryRegion, 'No']
  UsingMultiRegion: !Not [!Equals [!Ref SecondaryRegion, 'No']]
  TestCondition: !Equals ['true', 'false']
  UsingMultiRegionTeams: !And [!Condition UsingTeams, !Condition UsingMultiRegion]
  UsingMultiRegionSlack: !And [!Condition UsingSlack, !Condition UsingMultiRegion]
  UsingMultiRegionEventBridge: !And [!Condition UsingEventBridge, !Condition UsingMultiRegion]
  UsingMultiRegionChime: !And [!Condition UsingChime, !Condition UsingMultiRegion]
  UsingMultiRegionCrossAccountRole: !And [!Condition UsingCrossAccountRole, !Condition UsingMultiRegion]
  UsingAccountIds: !Not [!Equals [!Ref AccountIDs, None]]  
Parameters:
  AWSOrganizationsEnabled:
    Description: >-
      You can receive both PHD and SHD alerts if you're using AWS Organizations.
      If you are, make sure to enable Organizational Health View:
      (https://docs.aws.amazon.com/health/latest/ug/aggregate-events.html) to
      aggregate all PHD events in your AWS Organization. If not, you can still
      get SHD alerts.
    Default: 'No'
    AllowedValues:
      - 'Yes'
      - 'No'
    Type: String
  SecondaryRegion:
    Description: You can deploy this in a secondary region for resiliency. As a result,
      the DynamoDB table will become a Global DynamoDB table. Regions that support
      Global DynamoDB tables are listed
    Default: 'No'
    AllowedValues:
    - 'No'
    - us-east-1
    - us-east-2
    - us-west-1
    - us-west-2
    - ap-south-1
    - ap-northeast-2
    - ap-southeast-1
    - ap-southeast-2
    - ap-northeast-1
    - ca-central-1
    - eu-central-1
    - eu-west-1
    - eu-west-2
    - eu-west-3
    - sa-east-1
    Type: String    
  ManagementAccountRoleArn:
    Description: Arn of the IAM role in the top-level management account for collecting PHD Events. 'None' if deploying into the top-level management account.
    Type: String
    Default: None
  AWSHealthEventType:
    Description: >-
      Select the event type that you want AHA to report on. Refer to
      https://docs.aws.amazon.com/health/latest/APIReference/API_EventType.html for more information on EventType.
    Default: 'issue | accountNotification | scheduledChange'
    AllowedValues:
      - 'issue | accountNotification | scheduledChange'
      - 'issue'
    Type: String
  S3Bucket:
    Description: >-
      Name of your S3 Bucket where the AHA Package .zip resides. Just the name
      of the bucket (e.g. my-s3-bucket)
    Type: String
  S3Key:
    Description: >-
      Name of the .zip in your S3 Bucket. Just the name of the file (e.g.
      aha-v1.0.zip)
    Type: String
  EventBusName:
    Description: >-
      This is to ingest alerts into AWS EventBridge. Enter the event bus name if
      you wish to send the alerts to the AWS EventBridge. Note: By ingesting
      these alerts to AWS EventBridge, you can integrate with 35 SaaS vendors
      such as DataDog/NewRelic/PagerDuty. If you don't prefer to use EventBridge, leave the default (None).
    Type: String
    Default: None
  SlackWebhookURL:
    Description: >-
      Enter the Slack Webhook URL. If you don't prefer to use Slack, leave the default (None).
    Type: String
    Default: None
  MicrosoftTeamsWebhookURL:
    Description: >-
      Enter Microsoft Teams Webhook URL. If you don't prefer to use MS Teams,
      leave the default (None).   
    Type: String
    Default: None
  AmazonChimeWebhookURL:
    Description: >-
      Enter the Chime Webhook URL, If you don't prefer to use Amazon Chime,
      leave the default (None).   
    Type: String
    Default: None
  Regions:
    Description: >-
      By default, AHA reports events affecting all AWS regions. 
      If you want to report on certain regions you can enter up to 10 in a comma separated format.
      Available Regions: us-east-1,us-east-2,us-west-1,us-west-2,af-south-1,ap-east-1,ap-south-1,ap-northeast-3,
      ap-northeast-2,ap-southeast-1,ap-southeast-2,ap-northeast-1,ca-central-1,eu-central-1,eu-west-1,eu-west-2,
      eu-south-1,eu-south-3,eu-north-1,me-south-1,sa-east-1,global
    Default: all regions
    AllowedPattern: ".+"
    ConstraintDescription: No regions were entered, please read the documentation about selecting all regions or filtering on some.
    Type: String
  AccountIDs:
    Description: >-
      If you would like to EXCLUDE any accounts from alerting, upload a .csv file of comma-seperated account numbers to the same S3 bucket 
      where the AHA.zip package is located. Sample AccountIDs file name: aha_account_ids.csv. If not, leave the default of None.
    Default: None
    Type: String
    AllowedPattern: (None)|(.+(\.csv))$    
  EventSearchBack:
    Description: How far back to search for events in hours. Default is 1 hour
    Default: '1'
    Type: Number
  FromEmail:
    Description: Enter FROM Email Address
    Type: String
    Default: none@domain.com
    AllowedPattern: ^([\w+-.%]+@[\w-.]+\.[A-Za-z]+)(, ?[\w+-.%]+@[\w-.]+\.[A-Za-z]+)*$
    ConstraintDescription: 'FromEmail is not a valid, please verify entry. If not sending to email, leave as the default, none@domain.com.'
  ToEmail:
    Description: >-
      Enter email addresses separated by commas (for ex: abc@amazon.com,
      bcd@amazon.com)
    Type: String
    Default: none@domain.com
    AllowedPattern: ^([\w+-.%]+@[\w-.]+\.[A-Za-z]+)(, ?[\w+-.%]+@[\w-.]+\.[A-Za-z]+)*$
    ConstraintDescription: 'ToEmail is not a valid, please verify entry. If not sending to email, leave as the default, none@domain.com.'   
  Subject:
    Description: Enter the subject of the email address
    Type: String
    Default: AWS Health Alert
Resources:
  GlobalDDBTable:
    Type: AWS::DynamoDB::GlobalTable
    Condition: UsingMultiRegion
    Properties:
      AttributeDefinitions:
      - AttributeName: arn
        AttributeType: S
      KeySchema:
      - AttributeName: arn
        KeyType: HASH
      Replicas:
      - Region: !Ref SecondaryRegion
        ReadProvisionedThroughputSettings:
          ReadCapacityUnits: 5
      - Region: !Ref "AWS::Region"
        ReadProvisionedThroughputSettings:
          ReadCapacityUnits: 5
      StreamSpecification:
        StreamViewType: "NEW_AND_OLD_IMAGES"
      TimeToLiveSpecification:
        AttributeName: ttl
        Enabled: true
      WriteProvisionedThroughputSettings:
        WriteCapacityAutoScalingSettings:
          MaxCapacity: 10
          MinCapacity: 10
          TargetTrackingScalingPolicyConfiguration:
            DisableScaleIn: false
            ScaleInCooldown: 30
            ScaleOutCooldown: 30
            TargetValue: 10
  DynamoDBTable:
    Type: 'AWS::DynamoDB::Table'
    Condition: NotUsingMultiRegion
    Properties:
      AttributeDefinitions:
        - AttributeName: arn
          AttributeType: S
      KeySchema:
        - AttributeName: arn
          KeyType: HASH
      ProvisionedThroughput:
        ReadCapacityUnits: 5
        WriteCapacityUnits: 5
      TimeToLiveSpecification:
        AttributeName: ttl
        Enabled: TRUE        
  AHASecondaryRegionStackSet:
    Condition: UsingMultiRegion
    DependsOn: GlobalDDBTable
    Type: AWS::CloudFormation::StackSet
    Properties:
      Description: Secondary Region CloudFormation Template for AWS Health Aware (AHA)
      PermissionModel: SELF_MANAGED 
      Capabilities: [CAPABILITY_IAM]
      StackInstancesGroup:
          - Regions:
              - !Ref 'SecondaryRegion'
            DeploymentTargets:
              Accounts:
                - !Ref 'AWS::AccountId'
      StackSetName: 'aha-multi-region'
      TemplateBody: 
        !Sub |
          Resources:
              AHA2ndRegionBucket:
                Type: AWS::S3::Bucket 
              CopyAHA:
                Type: Custom::CopyAHA
                Properties:
                  DestBucket: !Ref 'AHA2ndRegionBucket'
                  ServiceToken: !GetAtt 'CopyAHAFunction.Arn'
                  SourceBucket: ${S3Bucket}
                  Object:
                    - ${S3Key}
              CopyAHARole:
                Type: AWS::IAM::Role
                Properties:
                  AssumeRolePolicyDocument:
                    Version: '2012-10-17'
                    Statement:
                      - Effect: Allow
                        Principal:
                          Service: lambda.amazonaws.com
                        Action: sts:AssumeRole
                  ManagedPolicyArns:
                    - arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole
                  Path: /
                  Policies:
                    - PolicyName: aha-lambda-copier
                      PolicyDocument:
                        Version: '2012-10-17'
                        Statement:
                          - Effect: Allow
                            Action:
                              - s3:GetObject
                            Resource:
                              - 'arn:aws:s3:::${S3Bucket}*'
                          - Effect: Allow
                            Action:
                              - s3:PutObject
                              - s3:DeleteObject
                            Resource:
                              - !Join ['', [ 'arn:aws:s3:::', !Ref AHA2ndRegionBucket, '*']]
              CopyAHAFunction:
                Type: AWS::Lambda::Function
                DependsOn: AHA2ndRegionBucket
                Properties:
                  Description: Copies AHA .zip from a source S3 bucket to a destination
                  Handler: index.handler
                  Runtime: python3.8
                  Role: !GetAtt 'CopyAHARole.Arn'
                  Timeout: 240
                  Code:
                    ZipFile: |
                      import json
                      import logging
                      import threading
                      import boto3
                      import cfnresponse
 
                      def copy_object(source_bucket, dest_bucket, object):
                          s3 = boto3.client('s3')
                          for o in object:
                              key = o
                              copy_source = {
                                  'Bucket': source_bucket,
                                  'Key': key
                              }
                              print('copy_source: %s' % copy_source)
                              print('dest_bucket = %s'%dest_bucket)
                              print('key = %s' %key)
                              s3.copy_object(CopySource=copy_source, Bucket=dest_bucket,
                                    Key=key)
 
                      def delete_object(bucket, object):
                          s3 = boto3.client('s3')
                          objects = {'Objects': [{'Key': o} for o in object]}
                          s3.delete_objects(Bucket=bucket, Delete=objects)
 
                      def timeout(event, context):
                          logging.error('Execution is about to time out, sending failure response to CloudFormation')
                          cfnresponse.send(event, context, cfnresponse.FAILED, {}, None)
 
                      def handler(event, context):
                          # make sure we send a failure to CloudFormation if the function
                          # is going to timeout
                          timer = threading.Timer((context.get_remaining_time_in_millis()
                                    / 1000.00) - 0.5, timeout, args=[event, context])
                          timer.start()
 
                          print('Received event: %s' % json.dumps(event))
                          status = cfnresponse.SUCCESS
                          try:
                              source_bucket = event['ResourceProperties']['SourceBucket']
                              dest_bucket = event['ResourceProperties']['DestBucket']
                              object = event['ResourceProperties']['Object']
                              if event['RequestType'] == 'Delete':
                                  delete_object(dest_bucket, object)
                              else:
                                  copy_object(source_bucket, dest_bucket, object)
                          except Exception as e:
                              logging.error('Exception: %s' % e, exc_info=True)
                              status = cfnresponse.FAILED
                          finally:
                              timer.cancel()
                              cfnresponse.send(event, context, status, {}, None)
              LambdaSchedule:
                Type: AWS::Events::Rule
                Properties:
                  Description: Lambda trigger Event
                  ScheduleExpression: rate(1 minute)
                  State: ENABLED
                  Targets:
                  - Arn: !GetAtt 'LambdaFunction.Arn'
                    Id: LambdaSchedule
              LambdaSchedulePermission:
                Type: AWS::Lambda::Permission
                Properties:
                  Action: lambda:InvokeFunction
                  FunctionName: !GetAtt 'LambdaFunction.Arn'
                  Principal: events.amazonaws.com
                  SourceArn: !GetAtt 'LambdaSchedule.Arn'           
              LambdaFunction:
                Type: AWS::Lambda::Function
                DependsOn: CopyAHA
                Properties:
                  Description: Lambda function that runs AHA
                  Code:
                    S3Bucket:
                      Ref: AHA2ndRegionBucket
                    S3Key: "${S3Key}"
                  Handler: handler.main
                  MemorySize: 128
                  Timeout: 600
                  Role: ${LambdaExecutionRole.Arn}
                  Runtime: python3.8
                  Environment:
                    Variables:
                      REGIONS: ${Regions}
                      FROM_EMAIL: "${FromEmail}"
                      TO_EMAIL: "${ToEmail}"
                      EMAIL_SUBJECT: "${Subject}"
                      DYNAMODB_TABLE: "${GlobalDDBTable}"
                      EVENT_SEARCH_BACK: ${EventSearchBack}
                      ORG_STATUS: ${AWSOrganizationsEnabled}
                      HEALTH_EVENT_TYPE: "${AWSHealthEventType}"
                      MANAGEMENT_ROLE_ARN: "${ManagementAccountRoleArn}"
  LambdaExecutionRole:
    Type: 'AWS::IAM::Role'
    Properties:
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - lambda.amazonaws.com
            Action:
              - 'sts:AssumeRole'
      Path: /         
      Policies:
        - PolicyName: AHA-LambdaPolicy
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Effect: Allow
                Action:
                  - logs:CreateLogGroup
                  - logs:CreateLogStream
                  - logs:PutLogEvents
                Resource: 
                  - !Sub 'arn:aws:logs:${AWS::Region}:${AWS::AccountId}:*'
                  - !If [UsingMultiRegion, !Sub 'arn:aws:logs:${SecondaryRegion}:${AWS::AccountId}:*', !Ref AWS::NoValue]
              - !If 
                - UsingSecrets
                - Effect: Allow
                  Action:
                   - 'secretsmanager:GetResourcePolicy'
                   - 'secretsmanager:DescribeSecret'
                   - 'secretsmanager:ListSecretVersionIds'
                   - 'secretsmanager:GetSecretValue'
                  Resource: 
                   - !If [UsingTeams, !Sub '${MicrosoftChannelSecret}', !Ref AWS::NoValue]
                   - !If [UsingSlack, !Sub '${SlackChannelSecret}', !Ref AWS::NoValue]
                   - !If [UsingEventBridge, !Sub '${EventBusNameSecret}', !Ref AWS::NoValue]
                   - !If [UsingChime, !Sub '${ChimeChannelSecret}', !Ref AWS::NoValue]
                   - !If [UsingCrossAccountRole, !Sub '${AssumeRoleSecret}', !Ref AWS::NoValue]      
                   - !If
                     - UsingMultiRegionTeams
                     - !Sub 
                       - 'arn:aws:secretsmanager:${SecondaryRegion}:${AWS::AccountId}:secret:${SecretNameWithSha}' 
                       - { SecretNameWithSha: !Select [1, !Split [':secret:', !Sub '${MicrosoftChannelSecret}' ]]}
                     - !Ref AWS::NoValue
                   - !If
                     - UsingMultiRegionSlack
                     - !Sub 
                       - 'arn:aws:secretsmanager:${SecondaryRegion}:${AWS::AccountId}:secret:${SecretNameWithSha}' 
                       - { SecretNameWithSha: !Select [1, !Split [':secret:', !Sub '${SlackChannelSecret}' ]]}
                     - !Ref AWS::NoValue
                   - !If
                     - UsingMultiRegionEventBridge
                     - !Sub 
                       - 'arn:aws:secretsmanager:${SecondaryRegion}:${AWS::AccountId}:secret:${SecretNameWithSha}' 
                       - { SecretNameWithSha: !Select [1, !Split [':secret:', !Sub '${EventBusNameSecret}' ]]}
                     - !Ref AWS::NoValue
                   - !If
                     - UsingMultiRegionChime
                     - !Sub 
                       - 'arn:aws:secretsmanager:${SecondaryRegion}:${AWS::AccountId}:secret:${SecretNameWithSha}' 
                       - { SecretNameWithSha: !Select [1, !Split [':secret:', !Sub '${ChimeChannelSecret}' ]]}
                     - !Ref AWS::NoValue
                   - !If
                     - UsingMultiRegionCrossAccountRole
                     - !Sub 
                       - 'arn:aws:secretsmanager:${SecondaryRegion}:${AWS::AccountId}:secret:${SecretNameWithSha}' 
                       - { SecretNameWithSha: !Select [1, !Split [':secret:', !Sub '${AssumeRoleSecret}' ]]}
                     - !Ref AWS::NoValue
                - !Ref 'AWS::NoValue'
              - Effect: Allow
                Action:
                  - health:DescribeAffectedAccountsForOrganization
                  - health:DescribeAffectedEntitiesForOrganization
                  - health:DescribeEventDetailsForOrganization
                  - health:DescribeEventsForOrganization 
                  - health:DescribeEventDetails
                  - health:DescribeEvents
                  - health:DescribeEventTypes
                  - health:DescribeAffectedEntities
                  - organizations:ListAccounts
                  - organizations:DescribeAccount                  
                Resource: "*"                               
              - Effect: Allow
                Action:
                  - dynamodb:ListTables
                Resource: 
                  - !Sub 'arn:aws:dynamodb:${AWS::Region}:${AWS::AccountId}:*'
                  - !If [UsingMultiRegion, !Sub 'arn:aws:dynamodb:${SecondaryRegion}:${AWS::AccountId}:*', !Ref AWS::NoValue]
              - Effect: Allow
                Action:
                  - ses:SendEmail
                Resource: 
                  - !Sub 'arn:aws:ses:${AWS::Region}:${AWS::AccountId}:*'
                  - !If [UsingMultiRegion, !Sub 'arn:aws:ses:${SecondaryRegion}:${AWS::AccountId}:*', !Ref AWS::NoValue]
              - Effect: Allow
                Action:
                  - dynamodb:UpdateTimeToLive
                  - dynamodb:PutItem
                  - dynamodb:DeleteItem
                  - dynamodb:GetItem
                  - dynamodb:Scan
                  - dynamodb:Query
                  - dynamodb:UpdateItem
                  - dynamodb:UpdateTable
                  - dynamodb:GetRecords
                Resource: !If [UsingMultiRegion, !GetAtt GlobalDDBTable.Arn, !GetAtt DynamoDBTable.Arn]
              - Effect: Allow
                Action:
                  - events:PutEvents
                Resource: 
                  - !Sub 'arn:aws:events:${AWS::Region}:${AWS::AccountId}:event-bus/${EventBusName}'
                  - !If [UsingMultiRegion, !Sub 'arn:aws:events:${SecondaryRegion}:${AWS::AccountId}:event-bus/${EventBusName}', !Ref AWS::NoValue]
              - !If 
                - UsingAccountIds
                - Effect: Allow
                  Action:
                    - s3:GetObject
                  Resource: !Sub 'arn:aws:s3:::${S3Bucket}/${AccountIDs}'
                - !Ref 'AWS::NoValue'                     
              - !If 
                - UsingCrossAccountRole
                - Effect: Allow
                  Action:
                    - sts:AssumeRole
                  Resource: !Ref ManagementAccountRoleArn
                - !Ref 'AWS::NoValue'                
  LambdaSchedule:
    Type: 'AWS::Events::Rule'
    Properties:
      Description: Lambda trigger Event
      ScheduleExpression: rate(1 minute)
      State: ENABLED
      Targets:
        - Arn: !GetAtt LambdaFunction.Arn
          Id: LambdaSchedule
  LambdaSchedulePermission:
    Type: 'AWS::Lambda::Permission'
    Properties:
      Action: 'lambda:InvokeFunction'
      FunctionName: !GetAtt LambdaFunction.Arn
      Principal: events.amazonaws.com
      SourceArn: !GetAtt LambdaSchedule.Arn
  MicrosoftChannelSecret:
    Type: 'AWS::SecretsManager::Secret'
    Condition: UsingTeams    
    Properties:
      Description: Microsoft Channel ID Secret
      ReplicaRegions:
        !If 
        - UsingMultiRegion
        - [{ Region: !Sub '${SecondaryRegion}' }]
        - !Ref "AWS::NoValue"
      SecretString:
        Ref: MicrosoftTeamsWebhookURL
      Tags:
        - Key: HealthCheckMicrosoft
          Value: ChannelID
  SlackChannelSecret:
    Type: 'AWS::SecretsManager::Secret'
    Condition: UsingSlack
    Properties:
      Description: Slack Channel ID Secret
      ReplicaRegions:
        !If 
        - UsingMultiRegion
        - [{ Region: !Sub '${SecondaryRegion}' }]
        - !Ref "AWS::NoValue"
      SecretString:
        Ref: SlackWebhookURL
      Tags:
        - Key: HealthCheckSlack
          Value: ChannelID
  EventBusNameSecret:
    Type: 'AWS::SecretsManager::Secret'
    Condition: UsingEventBridge       
    Properties:
      Description: EventBus Name Secret
      ReplicaRegions:
        !If 
        - UsingMultiRegion
        - [{ Region: !Sub '${SecondaryRegion}' }]
        - !Ref "AWS::NoValue"
      SecretString:
        Ref: EventBusName
      Tags:
        - Key: EventBusName
          Value: ChannelID
  ChimeChannelSecret:
    Type: 'AWS::SecretsManager::Secret'
    Condition: UsingChime    
    Properties:
      Description: Chime Channel ID Secret
      ReplicaRegions:
        !If 
        - UsingMultiRegion
        - [{ Region: !Sub '${SecondaryRegion}' }]
        - !Ref "AWS::NoValue"
      SecretString:
        Ref: AmazonChimeWebhookURL
      Tags:
        - Key: HealthCheckChime
          Value: ChannelID
  AssumeRoleSecret:
    Type: 'AWS::SecretsManager::Secret'
    Condition: UsingCrossAccountRole    
    Properties:
      Description: Management account role for AHA to assume
      ReplicaRegions:
        !If 
        - UsingMultiRegion
        - [{ Region: !Sub '${SecondaryRegion}' }]
        - !Ref "AWS::NoValue"
      SecretString:
        Ref: ManagementAccountRoleArn
      Tags:
        - Key: AssumeRoleArn
          Value: ChannelID          
  LambdaFunction:
    Type: 'AWS::Lambda::Function'
    Properties:
      Description: Lambda function that runs AHA
      Code:
        S3Bucket:
          Ref: S3Bucket
        S3Key:
          Ref: S3Key
      Handler: handler.main
      MemorySize: 128
      Timeout: 600
      Role:
        'Fn::Sub': '${LambdaExecutionRole.Arn}'
      Runtime: python3.8
      Environment:
        Variables:
          ACCOUNT_IDS:
            Ref: AccountIDs        
          REGIONS:
            Ref: Regions
          S3_BUCKET:
            Ref: S3Bucket            
          FROM_EMAIL:
            Ref: FromEmail
          TO_EMAIL:
            Ref: ToEmail
          EMAIL_SUBJECT:
            Ref: Subject
          DYNAMODB_TABLE:
            !If [UsingMultiRegion, !Ref GlobalDDBTable, !Ref DynamoDBTable]
          EVENT_SEARCH_BACK:
            Ref: EventSearchBack
          ORG_STATUS:
            Ref: AWSOrganizationsEnabled
          HEALTH_EVENT_TYPE:
            Ref: AWSHealthEventType
          MANAGEMENT_ROLE_ARN:
            Ref: ManagementAccountRoleArn
          SLACK_CHANNEL_SECRET_ARN:
            !If
            - UsingSlack
            - !Ref SlackChannelSecret
            - !Ref AWS::NoValue
          MICROSOFT_CHANNEL_SECRET_ARN:
            !If
            - UsingTeams
            - !Ref MicrosoftChannelSecret
            - !Ref AWS::NoValue
          CHIME_CHANNEL_SECRET_ARN:
            !If
            - UsingChime
            - !Ref ChimeChannelSecret
            - !Ref AWS::NoValue
          EVENT_BUS_SECRET_ARN:
            !If
            - UsingEventBridge
            - !Ref EventBusNameSecret
            - !Ref AWS::NoValue
          ASSUME_ROLE_SECRET_ARN:
            !If
            - UsingCrossAccountRole
            - !Ref AssumeRoleSecret
            - !Ref AWS::NoValue