AWSTemplateFormatVersion: "2010-09-09"
Description: SIEM SQS Integration: IAM User, Policy SQS queue and subscription to consume CloudTrail notifications. Deploy in the ControlTower Audit account. James Bromberger, Modis.
Parameters:
  CloudTrailBucketName:
    Type: String
    Default: aws-controltower-logs-${YourLogArchiveAcctNumber}-ap-southeast-2
  ConfigTopicName:
    Type: String
    Default: aws-controltower-AllConfigNotifications
  SQSQueueName:
    Type: String
    Default: McAfeeSIEMDelivery
  SIEMIAMUserName:
    Type: String
    Default: McAfeeSIEM
  CustomerIPRange:
    Type: String
    Default: 200.0.0.0/24
  OrganizationId:
    Type: String
    Default: o-${YourOrganizationId}
Resources:
  SIEMSQS:
    Type: AWS::SQS::Queue
    Properties: 
      QueueName: !Ref SQSQueueName
      ReceiveMessageWaitTimeSeconds: 20
  SIEMSQSPolicy:
    Type: AWS::SQS::QueuePolicy
    DependsOn: SIEMSQS
    Properties: 
      Queues: 
        - !Ref SIEMSQS
      PolicyDocument: 
        Statement: 
          - 
            Action: 
              - "SQS:SendMessage" 
            Effect: "Allow"
            Resource:
              Fn::GetAtt:
                - "SIEMSQS"
                - "Arn"
            Principal:
              Service:
                - sns.amazonaws.com
            Condition:
              ArnEquals:
                'aws:SourceArn':
                  !Sub 'arn:aws:sns:${AWS::Region}:${AWS::AccountId}:${ConfigTopicName}'
  SNSSubscription:
    Type: 'AWS::SNS::Subscription'
    DependsOn: SIEMSQSPolicy
    Properties:
      TopicArn:
        !Sub 'arn:aws:sns:${AWS::Region}:${AWS::AccountId}:${ConfigTopicName}'
      Endpoint:
        Fn::GetAtt:
          - "SIEMSQS"
          - "Arn"
      Protocol: sqs
  SIEMIAMUser:
    Type: AWS::IAM::User
    Properties: 
      Policies: 
        - PolicyName: SQSAccess
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
            - Effect: Allow
              Sid: RecvDelFromSIEMDeliveryQueue
              Action:
              - sqs:ReceiveMessage
              - sqs:DeleteMessage
              - sqs:GetQueueUrl
              - sqs:ListDeadLetterSourceQueues
              - sqs:ReceiveMessage
              - sqs:GetQueueAttributes
              - sqs:ListQueueTags
              - sqs:SetQueueAttributes
              Resource:
                Fn::GetAtt:
                - "SIEMSQS"
                - "Arn"
              Condition:
                IpAddress:
                  aws:SourceIp:
                  - !Ref CustomerIPRange
        - PolicyName: S3CloudTrailBucket
          PolicyDocument: 
            Version: '2012-10-17'
            Statement:
            - Effect: Allow
              Sid: ListS3CloudTrailLogs
              Action: 
              - s3:ListBucket
              Resource: arn:aws:s3:::${CloudTrailBucketName}
              Condition:
                IpAddress:
                  aws:SourceIp:
                  - !Ref CustomerIPRange
        - PolicyName: S3CloudTrailObject
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
            - Effect: Allow
              Sid: ReadFromS3CloudTrailLogs
              Action: 
              - s3:GetObject
              Resource: arn:aws:s3:::${CloudTrailBucketName}:/${OrganizationId}/*
              Condition:
                IpAddress:
                  aws:SourceIp:
                  - !Ref CustomerIPRange
      UserName: !Ref SIEMIAMUserName