governance.yaml

---
AWSTemplateFormatVersion: 2010-09-09
Description: 'Set up Vertice governance infrastructure (IAM role, S3 bucket, CUR/COR report).'

Parameters:
  AccountType:
    Description: 'Your AWS account type (member for workloads, billing for billing, combined for both).'
    Type: String
    AllowedValues: ['billing', 'combined', 'member']
  BillingReportCreate:
    Description: 'Enable Cost and Usage Reports (CUR) and export results to defined S3 bucket.'
    Default: 'false'
    Type: String
    AllowedValues: ['true', 'false']
  BillingReportName:
    Description: 'Name for created Cost and Usage Report.'
    Type: String
    Default: 'vertice-cur-report'
  BillingReportS3Prefix:
    Description: 'S3 bucket object name prefix for generated CUR.'
    Type: String
    Default: 'cur'
  BillingReportSplitCostAllocationData:
    Description: 'Include SPLIT_COST_ALLOCATION_DATA in the CUR output schema.'
    Default: 'false'
    Type: String
    AllowedValues: ['true', 'false']
  BillingBucketCreate:
    Description: 'Create S3 bucket (see BillingBucketName); set to false for pre-created buckets.'
    Default: 'false'
    Type: String
    AllowedValues: ['true', 'false']
  BillingBucketName:
    Description: 'Name of S3 bucket in which to store Cost and Usage Reports data.'
    Type: String
    MinLength: '3'
    MaxLength: '63'
  BillingBucketDeletionPolicy:
    Description: 'Behavior regarding S3 bucket if the stack is created/tries to replace it.'
    Default: 'Retain'
    Type: String
    AllowedValues: ['Delete', 'Retain', 'RetainExceptOnCreate']
  DataExportCreate:
    Description: 'Enable AWS Data Exports (COR format) and export results to defined S3 bucket.'
    Default: 'false'
    Type: String
    AllowedValues: ['true', 'false']
  DataExportName:
    Description: 'Name for created AWS Data Export.'
    Type: String
    Default: 'vertice-cor-report'
  DataExportS3Prefix:
    Description: 'S3 bucket object name prefix for AWS Data Export output.'
    Type: String
    Default: 'cor'
  VerticeIAMRoleCreate:
    Description: "Create IAM role allowing Vertice to access your account's billing data."
    Default: 'true'
    Type: String
    AllowedValues: ['true', 'false']
  VerticeIAMRoleAccountIDs:
    Type: CommaDelimitedList
    Description: 'List of Vertice AWS account IDs that will be used to assume the role in your account.'
    Default: '642184526628,762729743961'
  VerticeIAMRoleName:
    Type: String
    Description: 'Name of the Vertice IAM role to be created in your account.'
    Default: 'VerticeGovernanceRole'
  VerticeSTSExternalID:
    Type: String
    Description: 'Unique identifier for the Vertice platform to assume the IAM role in your account'
    MinLength: '36'
    MaxLength: '36'
  Ec2RiPolicyCreate:
    Description: 'Create IAM policy allowing Vertice to purchase EC2 Reserved Instances.'
    Default: 'true'
    Type: String
    AllowedValues: ['true', 'false']
  ElastiCacheRiPolicyCreate:
    Description: 'Create IAM policy allowing Vertice to purchase elasticache Reserved Instances.'
    Default: 'true'
    Type: String
    AllowedValues: ['true', 'false']
  EsRiPolicyCreate:
    Description: 'Create IAM policy allowing Vertice to purchase ES Reserved Instances.'
    Default: 'true'
    Type: String
    AllowedValues: ['true', 'false']
  RdsRiPolicyCreate:
    Description: 'Create IAM policy allowing Vertice to purchase RDS Reserved Instances.'
    Default: 'true'
    Type: String
    AllowedValues: ['true', 'false']
  RedshiftRiPolicyCreate:
    Description: 'Create IAM policy allowing Vertice to purchase Redshift Reserved Instances.'
    Default: 'true'
    Type: String
    AllowedValues: ['true', 'false']
  SavingPlansPolicyCreate:
    Description: 'Create IAM policy allowing Vertice to purchase Saving Plans.'
    Default: 'true'
    Type: String
    AllowedValues: ['true', 'false']

Conditions:
  BillingAccess: !Or
    - !Equals [!Ref AccountType, 'billing']
    - !Equals [!Ref AccountType, 'combined']
  BillingSplitCost: !Equals [!Ref BillingReportSplitCostAllocationData, 'true']
  CoreAccess: !Or
    - !Equals [!Ref AccountType, 'member']
    - !Equals [!Ref AccountType, 'combined']

  CreateBucket: !And
    - !Equals [!Ref BillingBucketCreate, 'true']
    - !Condition BillingAccess
  CreateReport: !And
    - !Equals [!Ref BillingReportCreate, 'true']
    - !Condition BillingAccess
  CreateDataExport: !And
    - !Equals [!Ref DataExportCreate, 'true']
    - !Condition BillingAccess

  CreateRole: !Equals [!Ref VerticeIAMRoleCreate, 'true']
  CreateBillingPolicy: !And
    - !Condition BillingAccess
    - !Condition CreateRole
  CreateCorePolicy: !And
    - !Condition CoreAccess
    - !Condition CreateRole

  CreateEsPolicy: !Equals [!Ref EsRiPolicyCreate, 'true']
  CreateEc2Policy: !Equals [!Ref Ec2RiPolicyCreate, 'true']
  CreateRdsPolicy: !Equals [!Ref RdsRiPolicyCreate, 'true']
  CreateRedshiftPolicy: !Equals [!Ref RedshiftRiPolicyCreate, 'true']
  CreateElastiCachePolicy: !Equals [!Ref ElastiCacheRiPolicyCreate, 'true']
  CreateSavingPlansPolicy: !Equals [!Ref SavingPlansPolicyCreate, 'true']

Resources:
  VerticeGovernanceS3Bucket:
    Type: 'AWS::S3::Bucket'
    Condition: CreateBucket
    Properties:
      BucketName: !Ref BillingBucketName
    DeletionPolicy: !Ref BillingBucketDeletionPolicy
    UpdateReplacePolicy: !Ref BillingBucketDeletionPolicy
  VerticeGovernanceS3BucketPolicy:
    Type: 'AWS::S3::BucketPolicy'
    Condition: CreateBucket
    Properties:
      Bucket: !Ref VerticeGovernanceS3Bucket
      PolicyDocument:
        Id: VerticeGovernanceS3BucketPolicy
        Version: 2012-10-17
        Statement:
          - Sid: AllowSecureRequestsOnly
            Effect: 'Deny'
            Principal: '*'
            Action: ['s3:*']
            Condition:
              Bool:
                'aws:SecureTransport': false
            Resource:
              - !Sub 'arn:aws:s3:::${BillingBucketName}'
              - !Sub 'arn:aws:s3:::${BillingBucketName}/*'
          - Sid: EnableAWSDataExportsToWriteToS3AndCheckPolicy
            Effect: 'Allow'
            Action:
              - 's3:GetBucketAcl'
              - 's3:GetBucketPolicy'
              - 's3:PutObject'
            Principal:
              Service:
                - 'bcm-data-exports.amazonaws.com'
                - 'billingreports.amazonaws.com'
            Resource:
              - !Sub 'arn:aws:s3:::${BillingBucketName}'
              - !Sub 'arn:aws:s3:::${BillingBucketName}/*'
            Condition:
              StringLike:
                'aws:SourceArn':
                  - !Sub 'arn:aws:cur:us-east-1:${AWS::AccountId}:definition/*'
                  - !Sub 'arn:aws:bcm-data-exports:us-east-1:${AWS::AccountId}:export/*'
                'aws:SourceAccount': !Sub ${AWS::AccountId}

  VerticeGovernanceBillingReport:
    Type: 'AWS::CUR::ReportDefinition'
    Condition: CreateReport
    Properties:
      ReportName: !Ref BillingReportName
      AdditionalArtifacts: ['ATHENA']
      AdditionalSchemaElements:
        - 'RESOURCES'
        - !If [
            BillingSplitCost,
            'SPLIT_COST_ALLOCATION_DATA',
            !Ref AWS::NoValue,
          ]
      Compression: 'Parquet'
      Format: 'Parquet'
      RefreshClosedReports: true
      ReportVersioning: 'OVERWRITE_REPORT'
      S3Bucket:
        !If [
          CreateBucket,
          !Ref VerticeGovernanceS3Bucket,
          !Ref BillingBucketName,
        ]
      S3Prefix: !Ref BillingReportS3Prefix
      S3Region: !Ref AWS::Region
      TimeUnit: 'HOURLY'

  VerticeGovernanceDataExport:
    Type: 'AWS::BCMDataExports::Export'
    Condition: CreateDataExport
    Metadata:
      # https://github.com/aws/serverless-application-model/issues/259#issuecomment-523953576
      DependsOn:
        [
          !If [
            CreateBucket,
            !Ref VerticeGovernanceS3BucketPolicy,
            !Ref AWS::NoValue,
          ],
        ]
    Properties:
      Export:
        DataQuery:
          QueryStatement:
            SELECT account_id, action_type, currency_code, current_resource_details,
            current_resource_summary, current_resource_type, estimated_monthly_cost_after_discount,
            estimated_monthly_cost_before_discount, estimated_monthly_savings_after_discount,
            estimated_monthly_savings_before_discount, estimated_savings_percentage_after_discount,
            estimated_savings_percentage_before_discount, implementation_effort, last_refresh_timestamp,
            recommendation_id, recommendation_lookback_period_in_days, recommendation_source,
            recommended_resource_details, recommended_resource_summary, recommended_resource_type,
            region, resource_arn, restart_needed, rollback_possible, tags FROM COST_OPTIMIZATION_RECOMMENDATIONS
          TableConfigurations:
            COST_OPTIMIZATION_RECOMMENDATIONS:
              FILTER: '{}'
              INCLUDE_ALL_RECOMMENDATIONS: 'TRUE'
        DestinationConfigurations:
          S3Destination:
            S3Bucket:
              !If [
                CreateBucket,
                !Ref VerticeGovernanceS3Bucket,
                !Ref BillingBucketName,
              ]
            S3OutputConfigurations:
              Compression: 'PARQUET'
              Format: 'PARQUET'
              OutputType: 'CUSTOM'
              Overwrite: 'OVERWRITE_REPORT'
            S3Prefix: !Ref DataExportS3Prefix
            S3Region: !Ref AWS::Region
        Name: !Ref DataExportName
        RefreshCadence:
          Frequency: 'SYNCHRONOUS'

  VerticeGovernanceIAMRole:
    Type: 'AWS::IAM::Role'
    Condition: CreateRole
    Properties:
      Description: 'Role assumed by Vertice to monitor your spending'
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: 'Allow'
            Principal:
              AWS: !Ref VerticeIAMRoleAccountIDs
            Action: 'sts:AssumeRole'
            Condition:
              StringLike:
                'sts:ExternalId': !Ref VerticeSTSExternalID
      Path: /vertice/
      RoleName: !Ref VerticeIAMRoleName
      MaxSessionDuration: 43200

  VerticeGovernanceCheckRolePolicy:
    Type: 'AWS::IAM::ManagedPolicy'
    Condition: CreateRole
    Properties:
      Description: 'Policy allowing Vertice to simulate its IAM role in your account'
      PolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: 'Allow'
            Action:
              - 'iam:SimulatePrincipalPolicy'
            Resource: !GetAtt VerticeGovernanceIAMRole.Arn
      Roles:
        - !Ref VerticeGovernanceIAMRole

  VerticeGovernanceBillingPolicy:
    Type: 'AWS::IAM::ManagedPolicy'
    Condition: CreateBillingPolicy
    Properties:
      Description: "Policy allowing Vertice to monitor your account's billing"
      PolicyDocument:
        Version: 2012-10-17
        Statement:
          - Sid: 'VerticeBillingAccess'
            Effect: 'Allow'
            Action:
              - 'bcm-data-exports:GetExport'
              - 'bcm-data-exports:GetExecution'
              - 'bcm-data-exports:ListExports'
              - 'bcm-data-exports:ListExecutions'
              - 'budgets:Describe*'
              - 'budgets:View*'
              - 'ce:Describe*'
              - 'ce:Get*'
              - 'ce:List*'
              - 'cur:Describe*'
              - 'ec2:DescribeAvailabilityZones'
              - 'ec2:DescribeInstanceTypeOfferings'
              - 'ec2:DescribeInstanceTypes'
              - 'ec2:DescribeInstances'
              - 'ec2:DescribeReservedInstances'
              - 'ec2:DescribeReservedInstancesOfferings'
              - 'elasticache:DescribeReservedCacheNodes'
              - 'elasticache:DescribeReservedCacheNodesOfferings'
              - 'es:DescribeReservedInstanceOfferings'
              - 'es:DescribeReservedInstances'
              - 'organizations:Describe*'
              - 'organizations:List*'
              - 'rds:DescribeDBInstances'
              - 'rds:DescribeReservedDBInstances'
              - 'rds:DescribeReservedDBInstancesOfferings'
              - 'redshift:DescribeReservedNodeOfferings'
              - 'redshift:DescribeReservedNodes'
              - 'savingsplans:Describe*'
              - 'savingsplans:List*'
            Resource: '*'
          - Sid: 'VerticeBillingBucketAccess'
            Effect: 'Allow'
            Action:
              - 's3:GetBucketLocation'
              - 's3:ListBucket'
              - 's3:GetObject'
            Resource:
              - !Sub 'arn:aws:s3:::${BillingBucketName}'
              - !Sub 'arn:aws:s3:::${BillingBucketName}/*'
      Roles:
        - !Ref VerticeGovernanceIAMRole

  VerticeGovernanceEc2RiPolicy:
    Type: 'AWS::IAM::ManagedPolicy'
    Condition: CreateEc2Policy
    Properties:
      Description: 'Policy allowing Vertice to purchase EC2 Reserved Instances'
      PolicyDocument:
        Version: 2012-10-17
        Statement:
          - Sid: 'VerticeEc2RiAccess'
            Effect: 'Allow'
            Action:
              - 'ec2:DescribeAvailabilityZones'
              - 'ec2:DescribeInstanceTypeOfferings'
              - 'ec2:DescribeInstanceTypes'
              - 'ec2:DescribeInstances'
              - 'ec2:DescribeReservedInstances'
              - 'ec2:DescribeReservedInstancesOfferings'
              - 'ec2:PurchaseReservedInstancesOffering'
              - 'ec2:ModifyReservedInstances'
              - 'ec2:DeleteQueuedReservedInstances'
            Resource: '*'
      Roles:
        - !Ref VerticeGovernanceIAMRole

  VerticeGovernanceElastiCacheRiPolicy:
    Type: 'AWS::IAM::ManagedPolicy'
    Condition: CreateElastiCachePolicy
    Properties:
      Description: 'Policy allowing Vertice to purchase ElastiCache Reserved Instances'
      PolicyDocument:
        Version: 2012-10-17
        Statement:
          - Sid: 'VerticeElastiCacheRiAccess'
            Effect: 'Allow'
            Action:
              - 'elasticache:DescribeReservedCacheNodes'
              - 'elasticache:DescribeReservedCacheNodesOfferings'
              - 'elasticache:PurchaseReservedCacheNodesOffering'
            Resource: '*'
      Roles:
        - !Ref VerticeGovernanceIAMRole

  VerticeGovernanceEsRiPolicy:
    Type: 'AWS::IAM::ManagedPolicy'
    Condition: CreateEsPolicy
    Properties:
      Description: 'Policy allowing Vertice to purchase ES Reserved Instances'
      PolicyDocument:
        Version: 2012-10-17
        Statement:
          - Sid: 'VerticeEsRiAccess'
            Effect: 'Allow'
            Action:
              - 'es:DescribeReservedInstanceOfferings'
              - 'es:DescribeReservedInstances'
              - 'es:PurchaseReservedInstanceOffering'
            Resource: '*'
      Roles:
        - !Ref VerticeGovernanceIAMRole

  VerticeGovernanceRdsRiPolicy:
    Type: 'AWS::IAM::ManagedPolicy'
    Condition: CreateRdsPolicy
    Properties:
      Description: 'Policy allowing Vertice to purchase RDS Reserved Instances'
      PolicyDocument:
        Version: 2012-10-17
        Statement:
          - Sid: 'VerticeRdsRiAccess'
            Effect: 'Allow'
            Action:
              - 'rds:DescribeDBInstances'
              - 'rds:DescribeReservedDBInstances'
              - 'rds:DescribeReservedDBInstancesOfferings'
              - 'rds:PurchaseReservedDBInstancesOffering'
            Resource: '*'
      Roles:
        - !Ref VerticeGovernanceIAMRole

  VerticeGovernanceRedshiftRiPolicy:
    Type: 'AWS::IAM::ManagedPolicy'
    Condition: CreateRedshiftPolicy
    Properties:
      Description: 'Policy allowing Vertice to purchase Redshift Reserved Instances'
      PolicyDocument:
        Version: 2012-10-17
        Statement:
          - Sid: 'VerticeRedshiftRiAccess'
            Effect: 'Allow'
            Action:
              - 'redshift:DescribeReservedNodeOfferings'
              - 'redshift:DescribeReservedNodes'
              - 'redshift:PurchaseReservedNodeOffering'
            Resource: '*'
      Roles:
        - !Ref VerticeGovernanceIAMRole

  VerticeGovernanceSavingPlansPolicy:
    Type: 'AWS::IAM::ManagedPolicy'
    Condition: CreateSavingPlansPolicy
    Properties:
      Description: 'Policy allowing Vertice to purchase Saving Plans'
      PolicyDocument:
        Version: 2012-10-17
        Statement:
          - Sid: 'VerticeSavingPlansAccess'
            Effect: 'Allow'
            Action:
              - 'savingsplans:Describe*'
              - 'savingsplans:List*'
              - 'savingsplans:CreateSavingsPlan'
              - 'savingsplans:DeleteQueuedSavingsPlan'
            Resource: '*'
      Roles:
        - !Ref VerticeGovernanceIAMRole

  VerticeGovernanceCorePolicy:
    Type: 'AWS::IAM::ManagedPolicy'
    Condition: CreateCorePolicy
    Properties:
      Description: "Policy allowing Vertice to monitor your account's workloads for cost optimization purposes"
      PolicyDocument:
        Version: 2012-10-17
        Statement:
          - Sid: 'VerticeCostOptimizationAccess'
            Effect: 'Allow'
            Action:
              - 'backup:List*'
              - 'backup:Describe*'
              - 'backup:Get*'
              - 'cloudwatch:Describe*'
              - 'cloudwatch:GetMetricStatistics'
              - 'cloudwatch:GetMetricData'
              - 'cloudwatch:List*'
              - 'ec2:Describe*'
              - 'ec2:GetCapacityReservationUsage'
              - 'ec2:GetEbsEncryptionByDefault'
              - 'ec2:List*'
              - 'ec2:SearchTransitGatewayRoutes'
              - 'ecr:BatchCheck*'
              - 'ecr:BatchGet*'
              - 'ecr:Describe*'
              - 'ecr:List*'
              - 'ecs:Describe*'
              - 'ecs:List*'
              - 'elasticache:Describe*'
              - 'elasticache:List*'
              - 'elasticfilesystem:Describe*'
              - 'elasticfilesystem:List*'
              - 'es:Describe*'
              - 'es:List*'
              - 'fsx:Describe*'
              - 'logs:Describe*'
              - 'logs:List*'
              - 'organizations:Describe*'
              - 'organizations:List*'
              - 'rds:Describe*'
              - 'rds:List*'
              - 'redshift:Describe*'
              - 'redshift:View*'
              - 's3:GetBucketLocation'
              - 's3:GetBucketTagging'
              - 's3:List*'
              - 's3:GetLifecycleConfiguration'
              - 'savingsplans:Describe*'
              - 'savingsplans:List*'
              - 'tag:Get*'
            Resource: '*'
      Roles:
        - !Ref VerticeGovernanceIAMRole

Outputs:
  VerticeGovernanceRoleArn:
    Value:
      !If [CreateRole, !GetAtt VerticeGovernanceIAMRole.Arn, !Ref AWS::NoValue]
  FullS3Path:
    Value:
      !Join [
        '/',
        [
          's3:/',
          !Ref BillingBucketName,
          !Ref BillingReportName,
          !Ref BillingReportS3Prefix,
        ],
      ]
  VerticeIAMRoleAccountIDs:
    Value: !Join [',', !Ref VerticeIAMRoleAccountIDs]