template.yaml

# Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
# SPDX-License-Identifier: MIT-0
AWSTemplateFormatVersion: '2010-09-09'
Transform: AWS::Serverless-2016-10-31
Description: >
  Deploys an IAM password policy via CloudFormation StackSets
Parameters:
  ResourceNamePrefix:
    Type: String 
    Description: String prefix for resource names
    Default: cfn-custom-resource-deployer
  OrganizationID:
    Type: String 
    Description: The AWS organization ID. This parameter will be used to allow other accounts in the organization to communicate with the central account. 
  Environment:
    Type: String
    Default: dev
  TargetOU:
    Type: String
    Description: The AWS Organizations OU to which the stack set template will be deployed
Resources:  
  PasswordPolicyProviderFunction:
    Type: AWS::Serverless::Function 
    Properties:
      FunctionName: !Sub ${ResourceNamePrefix}-function-${Environment}
      Timeout: 20
      CodeUri: functions/password_policy/
      Handler: app.lambda_handler
      Runtime: python3.8
      Role: !GetAtt  CustomResourceExecutionRole.Arn
      Environment:
        Variables:
          AWS_PARTITION: !Sub ${AWS::Partition}
          AWS_ACCOUNT: !Sub ${AWS::AccountId}
          TARGET_ROLE: !Sub ${ResourceNamePrefix}-role-${Environment}
  SNSTopicEncryptionKey:
    Type: AWS::KMS::Key
    Properties:
      Description: SNS topic encryption key
      EnableKeyRotation: true
      PendingWindowInDays: 20
      KeyPolicy:
        Version: '2012-10-17'
        Id: Main
        Statement:
          - Sid: Enable IAM User Permissions
            Effect: Allow
            Principal:
              AWS: !Sub arn:${AWS::Partition}:iam::${AWS::AccountId}:root
            Action: kms:*
            Resource: "*"
          - Sid: Allow an external account to use this CMK
            Effect: Allow
            Principal:
              AWS: "*"
            Action:
              - kms:Encrypt
              - kms:Decrypt
              - kms:ReEncrypt*
              - kms:GenerateDataKey*
              - kms:DescribeKey
            Resource: "*"
            Condition:
              StringEquals:
                aws:PrincipalOrgID: !Ref OrganizationID
  SNSTopicEncryptionKeyAlias:
    Type: AWS::KMS::Alias
    Properties:
      AliasName: alias/SNSTopicEncryption
      TargetKeyId: !Ref SNSTopicEncryptionKey    
  PasswordPolicyTopic:
    Type: AWS::SNS::Topic
    Properties: 
      DisplayName: !Sub ${ResourceNamePrefix}-topic-${Environment}
      TopicName: !Sub ${ResourceNamePrefix}-topic-${Environment}
      KmsMasterKeyId: !Ref SNSTopicEncryptionKeyAlias
  PasswordPolicyTopicPolicy:
    Type: AWS::SNS::TopicPolicy
    Properties: 
      PolicyDocument:
        Version: 2008-10-17
        Id: CrossAccountPublishAccess
        Statement:
          - Sid: allow-publish-from-organization-accounts
            Effect: Allow
            Principal:
              AWS: "*"
            Action:
              - sns:Publish
            Resource:
              - !Ref PasswordPolicyTopic
            Condition:
              StringEquals:
                aws:PrincipalOrgID: !Ref OrganizationID
      Topics: 
        - !Ref PasswordPolicyTopic
  PasswordPolicyLambdaSubscription:
    Type: AWS::SNS::Subscription
    Properties:
      Endpoint: !GetAtt PasswordPolicyProviderFunction.Arn
      Protocol: lambda
      TopicArn: !Ref PasswordPolicyTopic
  PasswordPolicyLambdaPermission:
    Type: AWS::Lambda::Permission
    Properties:
      FunctionName: !Ref PasswordPolicyProviderFunction
      Action: lambda:InvokeFunction
      Principal: sns.amazonaws.com
      SourceArn: !Ref PasswordPolicyTopic
  CustomResourceExecutionRole:
    Type: "AWS::IAM::Role"
    Properties:
      RoleName: !Sub ${ResourceNamePrefix}-role-${Environment}
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Principal:
              Service: 'lambda.amazonaws.com'
            Action: sts:AssumeRole
      Path: /
      Policies:
        - PolicyName: IAMPermissions
          PolicyDocument:
            Version: 2012-10-17
            Statement:
              - Effect: Allow
                Action:
                  - sts:AssumeRole
                Resource:
                  - !Sub 'arn:${AWS::Partition}:iam::*:role/${ResourceNamePrefix}-role-${Environment}'
              - Effect: Allow
                Action:
                  - 'logs:CreateLogGroup'
                  - 'logs:CreateLogStream'
                  - 'logs:PutLogEvents'
                Resource: "*"
  CFCustomResourceStackSet:
    Type: AWS::CloudFormation::StackSet
    DependsOn:
      - PasswordPolicyProviderFunction
      - PasswordPolicyTopic
      - PasswordPolicyTopicPolicy
      - PasswordPolicyLambdaPermission
      - PasswordPolicyLambdaSubscription
      - SNSTopicEncryptionKey
      - SNSTopicEncryptionKeyAlias
    Properties: 
      AutoDeployment: 
        Enabled: true
        RetainStacksOnAccountRemoval: false
      Capabilities: 
        - CAPABILITY_NAMED_IAM
      Description: Custom resource deployer
      StackInstancesGroup:
        - DeploymentTargets: 
            OrganizationalUnitIds: 
              - !Ref TargetOU
          Regions: 
            - !Sub ${AWS::Region}
      Parameters: 
        - ParameterKey: ResourceNamePrefix
          ParameterValue: !Ref ResourceNamePrefix
        - ParameterKey: TrustedRoleForCustomResources
          ParameterValue: !GetAtt CustomResourceExecutionRole.Arn 
        - ParameterKey: PasswordPolicyTopicArn
          ParameterValue: !Ref PasswordPolicyTopic
        - ParameterKey: Environment
          ParameterValue: !Ref Environment

      Tags:
        - Key: Environment
          Value: !Ref Environment

      PermissionModel: SERVICE_MANAGED
      StackSetName: !Sub ${ResourceNamePrefix}-${Environment}
      TemplateBody: |
        AWSTemplateFormatVersion: '2010-09-09'
        Parameters:
          ResourceNamePrefix:
            Type: String 
            Description: String prefix for resource names
          TrustedRoleForCustomResources:
            Type: String
            Description: The ARN of the trusted IAM role 
          PasswordPolicyTopicArn:
            Type: String 
            Description: The ARN of the SNS topic for the custom password policy
          Environment:
            Type: String  
        Resources:
          CFCustomResourceProviderRoleSpoke:
            Type: "AWS::IAM::Role"
            Properties:
              RoleName: !Sub ${ResourceNamePrefix}-role-${Environment}
              AssumeRolePolicyDocument:
                Version: 2012-10-17
                Statement:
                  - Effect: Allow
                    Principal:
                      AWS: !Ref TrustedRoleForCustomResources
                    Action: sts:AssumeRole
              Path: /
              Policies:
                - PolicyName: IAMPermissions
                  PolicyDocument:
                    Version: 2012-10-17
                    Statement:
                      - # PasswordPolicyPermissions 
                        Effect: Allow
                        Action:
                          - iam:DeleteAccountPasswordPolicy
                          - iam:UpdateAccountPasswordPolicy
                        Resource: '*'
          PasswordPolicy:
            Type: Custom::PasswordPolicy
            DependsOn:
              - CFCustomResourceProviderRoleSpoke
            Properties:
              MinimumPasswordLength: 10
              RequireSymbols: true
              RequireNumbers: false
              RequireUppercaseCharacters: true
              RequireLowercaseCharacters: true
              AllowUsersToChangePassword: true
              MaxPasswordAge: 10
              PasswordReusePrevention: 1
              HardExpiry: true
              ServiceToken: !Ref PasswordPolicyTopicArn
Outputs:
  ResourceNamePrefix:
    Description: Input value for stack set parameter ResourceNamePrefix
    Value: !Ref ResourceNamePrefix
  TrustedRoleForCustomResources:
    Description: Input value for stack set parameter TrustedRoleForCustomResources
    Value: !GetAtt CustomResourceExecutionRole.Arn
  PasswordPolicyTopicArn:
    Description: Input value for stack set parameter PasswordPolicyTopicArn
    Value: !Ref PasswordPolicyTopic