CloudWatchAutoAlarms-SNS.yaml

Description: SNS Topic for the notification configuration of alarms created by the amazon-cloudwatch-auto-alarms Lambda function
AWSTemplateFormatVersion: '2010-09-09'
Parameters:
  TargetOrganizationId:
    Description: Provide CloudWatch publish rights from all accounts in the organization. Leave blank for single account, single region implementation.
    Type: String
    Default: ""

Conditions:
  OrgEnabledAccess: !Not [!Equals ["", !Ref TargetOrganizationId]]

Resources:
  CloudWatchAutoAlarmsSNSTopic:
    Type: AWS::SNS::Topic
    Properties:
      DisplayName: CloudWatchAutoAlarms SNS Notification Topic
      TopicName: CloudWatchAutoAlarmsSNSTopic

  CloudWatchAutoAlarmsSNSTopicPolicy:
    Type: AWS::SNS::TopicPolicy
    Properties:
      Topics:
        - !Ref CloudWatchAutoAlarmsSNSTopic
      PolicyDocument:
        Version: '2012-10-17'
        Id: SSEAndSSLPolicy
        Statement:
          # If OrgEnabledAccess is false, restrict to the same account
          - !If
            - OrgEnabledAccess
            - !Ref "AWS::NoValue"
            -
              Sid: Allow_Publish_Same_Account
              Effect: Allow
              Principal:
                Service:
                  - cloudwatch.amazonaws.com
              Action: sns:Publish
              Resource:
                - !Ref CloudWatchAutoAlarmsSNSTopic
              Condition:
                StringEquals:
                  aws:SourceAccount: !Ref AWS::AccountId

          # If OrgEnabledAccess is true, allow organization-level access
          - !If
            - OrgEnabledAccess
            -
              Sid: AllowOrgToPublishToSNSTopic
              Effect: Allow
              Principal:
                Service:
                  - cloudwatch.amazonaws.com
              Action: sns:Publish
              Resource:
                - !Ref CloudWatchAutoAlarmsSNSTopic
              Condition:
                StringLike:
                  aws:PrincipalOrgPaths:
                    - !Sub "${TargetOrganizationId}/*"
            - !Ref "AWS::NoValue"

Outputs:
  CloudWatchAutoAlarmsSNSTopicArn:
    Value: !Ref CloudWatchAutoAlarmsSNSTopic
    Description: "SNS topic for notifications for alarms created by the CloudWatchAutoAlarms Lambda function"
    Export:
      Name: amazon-cloudwatch-auto-alarms-sns-topic-arn