template.yaml

Transform: AWS::Serverless-2016-10-31

Metadata:
  AWS::ServerlessRepo::Application:
    Name: DingTalk-Notifier
    Description: DingTalk Notifier
    Author: Chris He
    SpdxLicenseId: Apache-2.0
    LicenseUrl: LICENSE.txt
    ReadmeUrl: README_sar.md
    Labels: ['DingTalk', 'Eventbridge']
    HomePageUrl: https://github.com/Chris-wa-He/AWS-Lambda-notifier
    SemanticVersion: 1.6.1
    SourceCodeUrl: https://github.com/Chris-wa-He/AWS-Lambda-notifier
  AWS::CloudFormation::Interface:
    ParameterGroups:
      - Label:
          default: "Notifier Parameters"
        Parameters:
          - WebhookURL
          - EnableDebug
      - Label:
          default: "Large Language Model Parameters"
        Parameters:
          - EnableLLM
          - LlmRegion
          - LlmModelId
          - AnthropicVersion
          - LlmMaxTokens
          - SystemPrompt
    ParameterLabels:
      WebhookURL:
        default: "WebhookURL (Required)"
      EnableDebug:
        default: "Enable Debug (Optional)"
      EnableLLM:
        default: "EnableLLM (Required)"
      LlmRegion:
        default: "LLM Region (Optional)"
      LlmModelId:
        default: "LLM Model Id (Optional)"
      LlmMaxTokens:
        default: "LLM Max Tokens (Optional)"
      SystemPrompt:
        default: "System Prompt (Optional)"

Parameters:
  WebhookURL:
    Type: String
    Description: "DingTalk Chat bot URL includes security token.\n Sample: https://oapi.dingtalk.com/robot/send?access_token=XXXXXXXX"
  EnableDebug:
    Type: String
    Default: "false"
    Description: "Enable debug mode.\n Sample: true"
  EnableLLM:
    Type: String
    Default: "false"
    Description: "Enable LLM to generate response message.\n Sample: true"
  LlmRegion:
    Type: String
    Default: "us-east-1"
    Description: "LLM region. \n Sample: us-east-1"
  LlmModelId:
    Type: String
    Default: "amazon.nova-lite-v1:0"
    Description: "LLM model id. The model id needs to be in the support list of the Bedrock Converse API.\n Sample: anthropic.claude-3-sonnet-20240229-v1:0"
  LlmMaxTokens:
    Type: Number
    Default: 2048
    Description: "LLM max tokens. \n Sample: 1024"
  SystemPrompt:
    Type: String
    Default: ""
    Description: "For customize System prompt."

Resources:
  DingTalkNotifierLambdaLayer:
    Type: AWS::Serverless::LayerVersion
    Properties:
      LayerName: DingTalkNotifierCommon
      Description: v.1.0.5
      ContentUri: layer/
      CompatibleRuntimes:
        - python3.6
        - python3.7
        - python3.8
        - python3.9

  DingTalkNotifierLambda:
    Type: AWS::Serverless::Function # More info about Function Resource: https://github.com/awslabs/serverless-application-model/blob/master/versions/2016-10-31.md#awsserverlessfunction
    Properties:
      CodeUri: notifier/
      Handler: app.lambda_handler
      Timeout: 180
      Layers:
        - !Ref DingTalkNotifierLambdaLayer
      Environment:
        Variables:
          SECRET_ARN:
            Ref: WebhookSecret
          ENABLE_DEBUG:
            Ref: EnableDebug
          EnableLLM:
            Ref: EnableLLM
          LLM_REGION:
            Ref: LlmRegion
          LLM_MODEL_ID:
            Ref: LlmModelId
          LLM_Max_Tokens:
            Ref: LlmMaxTokens
          System_Prompt:
            Ref: SystemPrompt
      Runtime: python3.9
      Policies:
        - AWSSecretsManagerGetSecretValuePolicy:
            SecretArn: !Ref WebhookSecret
        - Statement:
            - Sid: BedrockInvokePolicy
              Effect: Allow
              Action:
                - bedrock:InvokeModel
                - bedrock:InvokeModelWithResponseStream
              Resource: 'arn:aws:bedrock:*::foundation-model/*'
      Events:
        SNSEvent:
          Type: SNS
          Properties:
            Topic: !Ref ServerlessNotifierSNSTopic

  ServerlessNotifierSNSTopic:
    Type: AWS::SNS::Topic

  ServerlessNotifierSNSTopicPolicy:
    Type: AWS::SNS::TopicPolicy
    Properties:
      PolicyDocument:
        Id: SNSTopicPolicy
        Version: '2012-10-17'
        Statement:
          - Sid: Default_Statement
            Effect: Allow
            Principal:
              AWS: "*"
            Action:
              - sns:Publish
            Resource: !Ref ServerlessNotifierSNSTopic
            Condition:
              StringEquals:
                "AWS:SourceOwner": !Ref "AWS::AccountId"
          - Sid: Eventbridge_Statement
            Effect: Allow
            Principal:
              Service: "events.amazonaws.com"
            Action:
              - sns:Publish
            Resource: !Ref ServerlessNotifierSNSTopic
          - Sid: Costalerts_Statement
            Effect: Allow
            Principal:
              Service: "costalerts.amazonaws.com"
            Action:
              - sns:Publish
            Resource: !Ref ServerlessNotifierSNSTopic
      Topics:
        - !Ref ServerlessNotifierSNSTopic

  WebhookSecret:
    Type: AWS::SecretsManager::Secret
    Properties:
      Description: 'WebhookSecret: Store Chat bot URL'
      SecretString:
        Ref: WebhookURL

  EventRuleEC2StateChange:
    Type: AWS::Events::Rule
    Properties:
      Description: Rule for EC2 instance state change
      EventPattern:
        source:
          - aws.ec2
        detail-type:
          - EC2 Instance State-change Notification
        detail:
          state:
            - running
            - stopped
            - terminated
      Targets:
        - Arn: !Ref ServerlessNotifierSNSTopic
          Id: Send2SNS
          InputTransformer:
            InputPathsMap:
              instance-id: "$.detail.instance-id"
              region: "$.region"
              state: "$.detail.state"
              time: "$.time"
            InputTemplate:
              "\"EC2状态变化告警: \\n时间: <time> \\n区域: <region> \\n实例id: <instance-id> \\n状态: <state>\""

  EventRuleAwsHealth:
    Type: AWS::Events::Rule
    Properties:
      Description: Rule for AWS Health event
      EventPattern:
        source:
          - aws.health
        detail-type:
          - AWS Health Event
      Targets:
        - Arn: !Ref ServerlessNotifierSNSTopic
          Id: Send2SNS
          InputTransformer:
            InputPathsMap:
              resource: "$.resources[0]"
              region: "$.region"
              time: "$.time"
              type: "$.detail.eventTypeCode"
              desc: "$.detail.eventDescription[0].latestDescription"
            InputTemplate:
              "\"AWS健康事件: \\n时间: <time> \\n区域: <region> \\n受影响资源: <resource> \\n类型: <type> \\n描述: <desc>\""

  EventRuleAwsHealthAbuse:
    Type: AWS::Events::Rule
    Properties:
      Description: Rule for AWS Health Abuse event
      EventPattern:
        source:
          - aws.health
        detail-type:
          - AWS Health Abuse Event
      Targets:
        - Arn: !Ref ServerlessNotifierSNSTopic
          Id: Send2SNS
          InputTransformer:
            InputPathsMap:
              resource: "$.resources"
              region: "$.region"
              time: "$.time"
              startTime: "$.detail.startTime"
              type: "$.detail.eventTypeCode"
              desc: "$.detail.eventDescription[0].latestDescription"
            InputTemplate:
              "\"AWS异常使用事件: \\n通知生成时间: <time> \\n事件开始时间: <startTime> \\n区域: <region> \\n受影响资源: <resource> \\n类型: <type> \\n描述: <desc>\""

  EventRuleCloudWatchAlarmStateChange:
    Type: AWS::Events::Rule
    Properties:
      Description: Rule for Cloud Watch alarm state change
      EventPattern:
        detail-type:
          - CloudWatch Alarm State Change
        source:
          - aws.cloudwatch
      Targets:
        - Id: Send2SNS
          Arn: !Ref ServerlessNotifierSNSTopic
          InputTransformer:
            InputPathsMap:
              alarmName: $.detail.alarmName
              description: $.detail.configuration.description
              reason: $.detail.state.reason
              region: $.region
              resources: $.resources
              time: $.time
            InputTemplate:
              "\"Cloud Watch 状态变化告警: \\n时间: <time> \\n区域: <region> \\n资源: <resources> \\n告警名称: <alarmName> \\n描述: <description> \\n原因: <reason>\""

Outputs:
  EventBusName:
    Description: Event Bus name for integration.
    Value: 'default'
  SnsTopicArn:
    Description: SNS topic ARN for integration.
    Value: !Ref ServerlessNotifierSNSTopic