CFN_DEPLOY_AHA.yml

AWSTemplateFormatVersion: '2010-09-09'
Description: CloudFormation Template for AWS Health Aware (AHA)
Metadata:
  'AWS::CloudFormation::Interface':
    ParameterGroups:
      - Label:
          default: Customize Alerts/Notifications
        Parameters:
          - AWSOrganizationsEnabled
          - AWSHealthEventType
      - Label:
          default: Package Information
        Parameters:
          - S3Bucket
          - S3Key
      - Label:
          default: >-
            Communication Channels - Slack/Microsoft Teams/Amazon Chime And/or
            EventBridge
        Parameters:
          - SlackWebhookURL
          - MicrosoftTeamsWebhookURL
          - AmazonChimeWebhookURL
          - EventBusName
          - JiraInstanceSecretParam
      - Label:
          default: Email Setup - For Alerting via Email
        Parameters:
          - FromEmail
          - ToEmail
          - Subject
      - Label:
          default: More Configurations - Optional
        Parameters:
          - EventSearchBack
          - Regions
          - ManagementAccountRoleArn
          - SecondaryRegion
          - AccountIDs
    ParameterLabels:
      AWSOrganizationsEnabled:
        default: AWS Organizations Enabled?
      ManagementAccountRoleArn:
        default: ARN of the AWS Organizations Management Account assume role (if using)
      AWSHealthEventType:
        default: The types of events to get alerted on
      S3Bucket:
        default: Name of S3 Bucket
      S3Key:
        default: Name of .zip file in S3 Bucket
      SlackWebhookURL:
        default: Slack Webhook URL
      MicrosoftTeamsWebhookURL:
        default: Microsoft Teams Webhook URL
      AmazonChimeWebhookURL:
        default: Amazon Chime Webhook URL
      JiraInstanceSecretParam:
        default: Jira Instance URL
      FromEmail:
        default: Email From
      ToEmail:
        default: Email To
      Subject:
        default: Subject of Email
      HealthAPIFrequency:
        default: Hours back to search for events
      Regions:
        default: Which regions to search for events in
      SecondaryRegion:
        default: Deploy in secondary region?
      AccountIDs:
        default: Exclude any account numbers?
Conditions:
  UsingSlack: !Not [!Equals [!Ref SlackWebhookURL, None]]
  UsingTeams: !Not [!Equals [!Ref MicrosoftTeamsWebhookURL, None]]
  UsingChime: !Not [!Equals [!Ref AmazonChimeWebhookURL, None]]
  UsingJira: !Not [!Equals [!Ref JiraInstanceSecretParam, None]]
  UsingEventBridge: !Not [!Equals [!Ref EventBusName, None]]
  UsingSecrets: !Or [!Condition UsingSlack, !Condition UsingTeams, !Condition UsingChime, !Condition UsingEventBridge, !Condition UsingCrossAccountRole]
  UsingCrossAccountRole: !Not [!Equals [!Ref ManagementAccountRoleArn, None]]
  NotUsingMultiRegion: !Equals [!Ref SecondaryRegion, 'No']
  UsingMultiRegion: !Not [!Equals [!Ref SecondaryRegion, 'No']]
  TestCondition: !Equals ['true', 'false']
  UsingMultiRegionTeams: !And [!Condition UsingTeams, !Condition UsingMultiRegion]
  UsingMultiRegionSlack: !And [!Condition UsingSlack, !Condition UsingMultiRegion]
  UsingMultiRegionEventBridge: !And [!Condition UsingEventBridge, !Condition UsingMultiRegion]
  UsingMultiRegionChime: !And [!Condition UsingChime, !Condition UsingMultiRegion]
  UsingMultiRegionJira: !And [!Condition UsingJira, !Condition UsingMultiRegion]
  UsingMultiRegionCrossAccountRole: !And [!Condition UsingCrossAccountRole, !Condition UsingMultiRegion]
  UsingAccountIds: !Not [!Equals [!Ref AccountIDs, None]]
Parameters:
  AWSOrganizationsEnabled:
    Description: >-
      You can receive both PHD and SHD alerts if you're using AWS Organizations.
      If you are, make sure to enable Organizational Health View:
      (https://docs.aws.amazon.com/health/latest/ug/aggregate-events.html) to
      aggregate all PHD events in your AWS Organization. If not, you can still
      get SHD alerts.
    Default: 'No'
    AllowedValues:
      - 'Yes'
      - 'No'
    Type: String
  SecondaryRegion:
    Description: You can deploy this in a secondary region for resiliency. As a result,
      the DynamoDB table will become a Global DynamoDB table. Regions that support
      Global DynamoDB tables are listed
    Default: 'No'
    AllowedValues:
    - 'No'
    - us-east-1
    - us-east-2
    - us-west-1
    - us-west-2
    - ap-south-1
    - ap-northeast-2
    - ap-southeast-1
    - ap-southeast-2
    - ap-northeast-1
    - ca-central-1
    - eu-central-1
    - eu-west-1
    - eu-west-2
    - eu-west-3
    - sa-east-1
    Type: String
  ManagementAccountRoleArn:
    Description: Arn of the IAM role in the top-level management account for collecting PHD Events. 'None' if deploying into the top-level management account.
    Type: String
    Default: None
  AWSHealthEventType:
    Description: >-
      Select the event type that you want AHA to report on. Refer to
      https://docs.aws.amazon.com/health/latest/APIReference/API_EventType.html for more information on EventType.
    Default: 'issue | accountNotification | scheduledChange'
    AllowedValues:
      - 'issue | accountNotification | scheduledChange'
      - 'issue'
    Type: String
  S3Bucket:
    Description: >-
      Name of your S3 Bucket where the AHA Package .zip resides. Just the name
      of the bucket (e.g. my-s3-bucket)
    Type: String
  S3Key:
    Description: >-
      Name of the .zip in your S3 Bucket. Just the name of the file (e.g.
      aha-v1.0.zip)
    Type: String
  EventBusName:
    Description: >-
      This is to ingest alerts into AWS EventBridge. Enter the event bus name if
      you wish to send the alerts to the AWS EventBridge. Note: By ingesting
      these alerts to AWS EventBridge, you can integrate with 35 SaaS vendors
      such as DataDog/NewRelic/PagerDuty. If you don't prefer to use EventBridge, leave the default (None).
    Type: String
    Default: None
  SlackWebhookURL:
    Description: >-
      Enter the Slack Webhook URL. If you don't prefer to use Slack, leave the default (None).
    Type: String
    Default: None
  MicrosoftTeamsWebhookURL:
    Description: >-
      Enter Microsoft Teams Webhook URL. If you don't prefer to use MS Teams,
      leave the default (None).
    Type: String
    Default: None
  AmazonChimeWebhookURL:
    Description: >-
      Enter the Chime Webhook URL, If you don't prefer to use Amazon Chime,
      leave the default (None).
    Type: String
    Default: None
  JiraInstanceSecretParam:
    Description: >-
      Enter the Jira Instance URL. Once the secret is created, you must manually enter the auth data into the secret.
      If you don't prefer to use Jira, leave the default (None).
    Type: String
    Default: None
  Regions:
    Description: >-
      By default, AHA reports events affecting all AWS regions.
      If you want to report on certain regions you can enter up to 10 in a comma separated format.
      Available Regions: us-east-1,us-east-2,us-west-1,us-west-2,af-south-1,ap-east-1,ap-south-1,ap-northeast-3,
      ap-northeast-2,ap-southeast-1,ap-southeast-2,ap-northeast-1,ca-central-1,eu-central-1,eu-west-1,eu-west-2,
      eu-south-1,eu-south-3,eu-north-1,me-south-1,sa-east-1,global
    Default: all regions
    AllowedPattern: ".+"
    ConstraintDescription: No regions were entered, please read the documentation about selecting all regions or filtering on some.
    Type: String
  AccountIDs:
    Description: >-
      If you would like to EXCLUDE any accounts from alerting, upload a .csv file of comma-seperated account numbers to the same S3 bucket
      where the AHA.zip package is located. Sample AccountIDs file name: aha_account_ids.csv. If not, leave the default of None.
    Default: None
    Type: String
    AllowedPattern: (None)|(.+(\.csv))$
  EventSearchBack:
    Description: How far back to search for events in hours. Default is 1 hour
    Default: '1'
    Type: Number
  FromEmail:
    Description: Enter FROM Email Address
    Type: String
    Default: none@domain.com
    AllowedPattern: ^([\w+-.%]+@[\w-.]+\.[A-Za-z]+)(, ?[\w+-.%]+@[\w-.]+\.[A-Za-z]+)*$
    ConstraintDescription: 'FromEmail is not a valid, please verify entry. If not sending to email, leave as the default, none@domain.com.'
  ToEmail:
    Description: >-
      Enter email addresses separated by commas (for ex: abc@amazon.com,
      bcd@amazon.com)
    Type: String
    Default: none@domain.com
    AllowedPattern: ^([\w+-.%]+@[\w-.]+\.[A-Za-z]+)(, ?[\w+-.%]+@[\w-.]+\.[A-Za-z]+)*$
    ConstraintDescription: 'ToEmail is not a valid, please verify entry. If not sending to email, leave as the default, none@domain.com.'
  Subject:
    Description: Enter the subject of the email address
    Type: String
    Default: AWS Health Alert
Resources:
  GlobalDDBTable:
    Type: AWS::DynamoDB::GlobalTable
    Condition: UsingMultiRegion
    Properties:
      AttributeDefinitions:
      - AttributeName: arn
        AttributeType: S
      KeySchema:
      - AttributeName: arn
        KeyType: HASH
      Replicas:
      - Region: !Ref SecondaryRegion
        ReadProvisionedThroughputSettings:
          ReadCapacityUnits: 5
      - Region: !Ref "AWS::Region"
        ReadProvisionedThroughputSettings:
          ReadCapacityUnits: 5
      StreamSpecification:
        StreamViewType: "NEW_AND_OLD_IMAGES"
      TimeToLiveSpecification:
        AttributeName: ttl
        Enabled: true
      WriteProvisionedThroughputSettings:
        WriteCapacityAutoScalingSettings:
          MaxCapacity: 10
          MinCapacity: 10
          TargetTrackingScalingPolicyConfiguration:
            DisableScaleIn: false
            ScaleInCooldown: 30
            ScaleOutCooldown: 30
            TargetValue: 10
  DynamoDBTable:
    Type: 'AWS::DynamoDB::Table'
    Condition: NotUsingMultiRegion
    Properties:
      AttributeDefinitions:
        - AttributeName: arn
          AttributeType: S
      KeySchema:
        - AttributeName: arn
          KeyType: HASH
      ProvisionedThroughput:
        ReadCapacityUnits: 5
        WriteCapacityUnits: 5
      TimeToLiveSpecification:
        AttributeName: ttl
        Enabled: TRUE
  AHASecondaryRegionStackSet:
    Condition: UsingMultiRegion
    DependsOn: GlobalDDBTable
    Type: AWS::CloudFormation::StackSet
    Properties:
      Description: Secondary Region CloudFormation Template for AWS Health Aware (AHA)
      PermissionModel: SELF_MANAGED
      Capabilities: [CAPABILITY_IAM]
      StackInstancesGroup:
          - Regions:
              - !Ref 'SecondaryRegion'
            DeploymentTargets:
              Accounts:
                - !Ref 'AWS::AccountId'
      StackSetName: 'aha-multi-region'
      TemplateBody:
        !Sub |
          Resources:
              AHA2ndRegionBucket:
                Type: AWS::S3::Bucket
              CopyAHA:
                Type: Custom::CopyAHA
                Properties:
                  DestBucket: !Ref 'AHA2ndRegionBucket'
                  ServiceToken: !GetAtt 'CopyAHAFunction.Arn'
                  SourceBucket: ${S3Bucket}
                  Object:
                    - ${S3Key}
              CopyAHARole:
                Type: AWS::IAM::Role
                Properties:
                  AssumeRolePolicyDocument:
                    Version: '2012-10-17'
                    Statement:
                      - Effect: Allow
                        Principal:
                          Service: lambda.amazonaws.com
                        Action: sts:AssumeRole
                  ManagedPolicyArns:
                    - arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole
                  Path: /
                  Policies:
                    - PolicyName: aha-lambda-copier
                      PolicyDocument:
                        Version: '2012-10-17'
                        Statement:
                          - Effect: Allow
                            Action:
                              - s3:GetObject
                            Resource:
                              - 'arn:aws:s3:::${S3Bucket}*'
                          - Effect: Allow
                            Action:
                              - s3:PutObject
                              - s3:DeleteObject
                            Resource:
                              - !Join ['', [ 'arn:aws:s3:::', !Ref AHA2ndRegionBucket, '*']]
              CopyAHAFunction:
                Type: AWS::Lambda::Function
                DependsOn: AHA2ndRegionBucket
                Properties:
                  Description: Copies AHA .zip from a source S3 bucket to a destination
                  Handler: index.handler
                  Runtime: python3.11
                  Role: !GetAtt 'CopyAHARole.Arn'
                  Timeout: 240
                  Code:
                    ZipFile: |
                      import json
                      import logging
                      import threading
                      import boto3
                      import cfnresponse

                      def copy_object(source_bucket, dest_bucket, object):
                          s3 = boto3.client('s3')
                          for o in object:
                              key = o
                              copy_source = {
                                  'Bucket': source_bucket,
                                  'Key': key
                              }
                              print('copy_source: %s' % copy_source)
                              print('dest_bucket = %s'%dest_bucket)
                              print('key = %s' %key)
                              s3.copy_object(CopySource=copy_source, Bucket=dest_bucket,
                                    Key=key)

                      def delete_object(bucket, object):
                          s3 = boto3.client('s3')
                          objects = {'Objects': [{'Key': o} for o in object]}
                          s3.delete_objects(Bucket=bucket, Delete=objects)

                      def timeout(event, context):
                          logging.error('Execution is about to time out, sending failure response to CloudFormation')
                          cfnresponse.send(event, context, cfnresponse.FAILED, {}, None)

                      def handler(event, context):
                          # make sure we send a failure to CloudFormation if the function
                          # is going to timeout
                          timer = threading.Timer((context.get_remaining_time_in_millis()
                                    / 1000.00) - 0.5, timeout, args=[event, context])
                          timer.start()

                          print('Received event: %s' % json.dumps(event))
                          status = cfnresponse.SUCCESS
                          try:
                              source_bucket = event['ResourceProperties']['SourceBucket']
                              dest_bucket = event['ResourceProperties']['DestBucket']
                              object = event['ResourceProperties']['Object']
                              if event['RequestType'] == 'Delete':
                                  delete_object(dest_bucket, object)
                              else:
                                  copy_object(source_bucket, dest_bucket, object)
                          except Exception as e:
                              logging.error('Exception: %s' % e, exc_info=True)
                              status = cfnresponse.FAILED
                          finally:
                              timer.cancel()
                              cfnresponse.send(event, context, status, {}, None)
              LambdaSchedule:
                Type: AWS::Events::Rule
                Properties:
                  Description: Lambda trigger Event
                  ScheduleExpression: rate(1 minute)
                  State: ENABLED
                  Targets:
                  - Arn: !GetAtt 'LambdaFunction.Arn'
                    Id: LambdaSchedule
              LambdaSchedulePermission:
                Type: AWS::Lambda::Permission
                Properties:
                  Action: lambda:InvokeFunction
                  FunctionName: !GetAtt 'LambdaFunction.Arn'
                  Principal: events.amazonaws.com
                  SourceArn: !GetAtt 'LambdaSchedule.Arn'
              LambdaFunction:
                Type: AWS::Lambda::Function
                DependsOn: CopyAHA
                Properties:
                  Description: Lambda function that runs AHA
                  Code:
                    S3Bucket:
                      Ref: AHA2ndRegionBucket
                    S3Key: "${S3Key}"
                  Handler: handler.main
                  MemorySize: 128
                  Timeout: 600
                  Role: ${LambdaExecutionRole.Arn}
                  Runtime: python3.11
                  Environment:
                    Variables:
                      REGIONS: ${Regions}
                      FROM_EMAIL: "${FromEmail}"
                      TO_EMAIL: "${ToEmail}"
                      EMAIL_SUBJECT: "${Subject}"
                      DYNAMODB_TABLE: "${GlobalDDBTable}"
                      EVENT_SEARCH_BACK: ${EventSearchBack}
                      ORG_STATUS: ${AWSOrganizationsEnabled}
                      HEALTH_EVENT_TYPE: "${AWSHealthEventType}"
                      MANAGEMENT_ROLE_ARN: "${ManagementAccountRoleArn}"
  LambdaExecutionRole:
    Type: 'AWS::IAM::Role'
    Properties:
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - lambda.amazonaws.com
            Action:
              - 'sts:AssumeRole'
      Path: /
      Policies:
        - PolicyName: AHA-LambdaPolicy
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Effect: Allow
                Action:
                  - logs:CreateLogGroup
                  - logs:CreateLogStream
                  - logs:PutLogEvents
                Resource:
                  - !Sub 'arn:aws:logs:${AWS::Region}:${AWS::AccountId}:*'
                  - !If [UsingMultiRegion, !Sub 'arn:aws:logs:${SecondaryRegion}:${AWS::AccountId}:*', !Ref AWS::NoValue]
              - !If
                - UsingSecrets
                - Effect: Allow
                  Action:
                   - 'secretsmanager:GetResourcePolicy'
                   - 'secretsmanager:DescribeSecret'
                   - 'secretsmanager:ListSecretVersionIds'
                   - 'secretsmanager:GetSecretValue'
                  Resource:
                   - !If [UsingTeams, !Sub '${MicrosoftChannelSecret}', !Ref AWS::NoValue]
                   - !If [UsingSlack, !Sub '${SlackChannelSecret}', !Ref AWS::NoValue]
                   - !If [UsingEventBridge, !Sub '${EventBusNameSecret}', !Ref AWS::NoValue]
                   - !If [UsingChime, !Sub '${ChimeChannelSecret}', !Ref AWS::NoValue]
                   - !If [UsingJira, !Sub '${JiraInstanceSecret}', !Ref AWS::NoValue]
                   - !If [UsingCrossAccountRole, !Sub '${AssumeRoleSecret}', !Ref AWS::NoValue]
                   - !If
                     - UsingMultiRegionTeams
                     - !Sub
                       - 'arn:aws:secretsmanager:${SecondaryRegion}:${AWS::AccountId}:secret:${SecretNameWithSha}'
                       - { SecretNameWithSha: !Select [1, !Split [':secret:', !Sub '${MicrosoftChannelSecret}' ]]}
                     - !Ref AWS::NoValue
                   - !If
                     - UsingMultiRegionSlack
                     - !Sub
                       - 'arn:aws:secretsmanager:${SecondaryRegion}:${AWS::AccountId}:secret:${SecretNameWithSha}'
                       - { SecretNameWithSha: !Select [1, !Split [':secret:', !Sub '${SlackChannelSecret}' ]]}
                     - !Ref AWS::NoValue
                   - !If
                     - UsingMultiRegionEventBridge
                     - !Sub
                       - 'arn:aws:secretsmanager:${SecondaryRegion}:${AWS::AccountId}:secret:${SecretNameWithSha}'
                       - { SecretNameWithSha: !Select [1, !Split [':secret:', !Sub '${EventBusNameSecret}' ]]}
                     - !Ref AWS::NoValue
                   - !If
                     - UsingMultiRegionChime
                     - !Sub
                       - 'arn:aws:secretsmanager:${SecondaryRegion}:${AWS::AccountId}:secret:${SecretNameWithSha}'
                       - { SecretNameWithSha: !Select [1, !Split [':secret:', !Sub '${ChimeChannelSecret}' ]]}
                     - !Ref AWS::NoValue
                   - !If
                     - UsingMultiRegionJira
                     - !Sub
                       - 'arn:aws:secretsmanager:${SecondaryRegion}:${AWS::AccountId}:secret:${SecretNameWithSha}'
                       - { SecretNameWithSha: !Select [1, !Split [':secret:', !Sub '${JiraInstanceSecret}' ]]}
                     - !Ref AWS::NoValue
                   - !If
                     - UsingMultiRegionCrossAccountRole
                     - !Sub
                       - 'arn:aws:secretsmanager:${SecondaryRegion}:${AWS::AccountId}:secret:${SecretNameWithSha}'
                       - { SecretNameWithSha: !Select [1, !Split [':secret:', !Sub '${AssumeRoleSecret}' ]]}
                     - !Ref AWS::NoValue
                - !Ref 'AWS::NoValue'
              - Effect: Allow
                Action:
                  - health:DescribeAffectedAccountsForOrganization
                  - health:DescribeAffectedEntitiesForOrganization
                  - health:DescribeEventDetailsForOrganization
                  - health:DescribeEventsForOrganization
                  - health:DescribeEventDetails
                  - health:DescribeEvents
                  - health:DescribeEventTypes
                  - health:DescribeAffectedEntities
                  - organizations:ListAccounts
                  - organizations:DescribeAccount
                Resource: "*"
              - Effect: Allow
                Action:
                  - dynamodb:ListTables
                Resource:
                  - !Sub 'arn:aws:dynamodb:${AWS::Region}:${AWS::AccountId}:*'
                  - !If [UsingMultiRegion, !Sub 'arn:aws:dynamodb:${SecondaryRegion}:${AWS::AccountId}:*', !Ref AWS::NoValue]
              - Effect: Allow
                Action:
                  - ses:SendEmail
                Resource:
                  - !Sub 'arn:aws:ses:${AWS::Region}:${AWS::AccountId}:*'
                  - !If [UsingMultiRegion, !Sub 'arn:aws:ses:${SecondaryRegion}:${AWS::AccountId}:*', !Ref AWS::NoValue]
              - Effect: Allow
                Action:
                  - dynamodb:UpdateTimeToLive
                  - dynamodb:PutItem
                  - dynamodb:DeleteItem
                  - dynamodb:GetItem
                  - dynamodb:Scan
                  - dynamodb:Query
                  - dynamodb:UpdateItem
                  - dynamodb:UpdateTable
                  - dynamodb:GetRecords
                Resource: !If [UsingMultiRegion, !GetAtt GlobalDDBTable.Arn, !GetAtt DynamoDBTable.Arn]
              - Effect: Allow
                Action:
                  - events:PutEvents
                Resource:
                  - !Sub 'arn:aws:events:${AWS::Region}:${AWS::AccountId}:event-bus/${EventBusName}'
                  - !If [UsingMultiRegion, !Sub 'arn:aws:events:${SecondaryRegion}:${AWS::AccountId}:event-bus/${EventBusName}', !Ref AWS::NoValue]
              - !If
                - UsingAccountIds
                - Effect: Allow
                  Action:
                    - s3:GetObject
                  Resource: !Sub 'arn:aws:s3:::${S3Bucket}/${AccountIDs}'
                - !Ref 'AWS::NoValue'
              - !If
                - UsingCrossAccountRole
                - Effect: Allow
                  Action:
                    - sts:AssumeRole
                  Resource: !Ref ManagementAccountRoleArn
                - !Ref 'AWS::NoValue'
  LambdaSchedule:
    Type: 'AWS::Events::Rule'
    Properties:
      Description: Lambda trigger Event
      ScheduleExpression: rate(10 minutes)
      State: ENABLED
      Targets:
        - Arn: !GetAtt LambdaFunction.Arn
          Id: LambdaSchedule
  LambdaSchedulePermission:
    Type: 'AWS::Lambda::Permission'
    Properties:
      Action: 'lambda:InvokeFunction'
      FunctionName: !GetAtt LambdaFunction.Arn
      Principal: events.amazonaws.com
      SourceArn: !GetAtt LambdaSchedule.Arn
  MicrosoftChannelSecret:
    Type: 'AWS::SecretsManager::Secret'
    Condition: UsingTeams
    Properties:
      Name: MicrosoftChannelID
      Description: Microsoft Channel ID Secret
      ReplicaRegions:
        !If
        - UsingMultiRegion
        - [{ Region: !Sub '${SecondaryRegion}' }]
        - !Ref "AWS::NoValue"
      SecretString:
        Ref: MicrosoftTeamsWebhookURL
      Tags:
        - Key: HealthCheckMicrosoft
          Value: ChannelID
  SlackChannelSecret:
    Type: 'AWS::SecretsManager::Secret'
    Condition: UsingSlack
    Properties:
      Name: SlackChannelID
      Description: Slack Channel ID Secret
      ReplicaRegions:
        !If
        - UsingMultiRegion
        - [{ Region: !Sub '${SecondaryRegion}' }]
        - !Ref "AWS::NoValue"
      SecretString:
        Ref: SlackWebhookURL
      Tags:
        - Key: HealthCheckSlack
          Value: ChannelID
  EventBusNameSecret:
    Type: 'AWS::SecretsManager::Secret'
    Condition: UsingEventBridge
    Properties:
      Name: EventBusName
      Description: EventBus Name Secret
      ReplicaRegions:
        !If
        - UsingMultiRegion
        - [{ Region: !Sub '${SecondaryRegion}' }]
        - !Ref "AWS::NoValue"
      SecretString:
        Ref: EventBusName
      Tags:
        - Key: EventBusName
          Value: ChannelID
  ChimeChannelSecret:
    Type: 'AWS::SecretsManager::Secret'
    Condition: UsingChime
    Properties:
      Name: ChimeChannelID
      Description: Chime Channel ID Secret
      ReplicaRegions:
        !If
        - UsingMultiRegion
        - [{ Region: !Sub '${SecondaryRegion}' }]
        - !Ref "AWS::NoValue"
      SecretString:
        Ref: AmazonChimeWebhookURL
      Tags:
        - Key: HealthCheckChime
          Value: ChannelID
  JiraInstanceSecret:
    Type: 'AWS::SecretsManager::Secret'
    Condition: UsingJira
    Properties:
      Name: JiraInstanceSecret
      Description: Jira Instance and Auth info
      ReplicaRegions:
        !If
        - UsingMultiRegion
        - [{ Region: !Sub '${SecondaryRegion}' }]
        - !Ref "AWS::NoValue"
      SecretString: !Ref JiraInstanceSecretParam
      Tags:
        - Key: HealthCheckJira
          Value: ChannelID

  AssumeRoleSecret:
    Type: 'AWS::SecretsManager::Secret'
    Condition: UsingCrossAccountRole
    Properties:
      Name: AssumeRoleArn
      Description: Management account role for AHA to assume
      ReplicaRegions:
        !If
        - UsingMultiRegion
        - [{ Region: !Sub '${SecondaryRegion}' }]
        - !Ref "AWS::NoValue"
      SecretString:
        Ref: ManagementAccountRoleArn
      Tags:
        - Key: AssumeRoleArn
          Value: ChannelID
  LambdaFunction:
    Type: 'AWS::Lambda::Function'
    Properties:
      Description: Lambda function that runs AHA
      Code:
        S3Bucket:
          Ref: S3Bucket
        S3Key:
          Ref: S3Key
      Handler: handler.main
      MemorySize: 128
      Timeout: 600
      Role:
        'Fn::Sub': '${LambdaExecutionRole.Arn}'
      Runtime: python3.11
      Environment:
        Variables:
          ACCOUNT_IDS:
            Ref: AccountIDs
          REGIONS:
            Ref: Regions
          S3_BUCKET:
            Ref: S3Bucket
          FROM_EMAIL:
            Ref: FromEmail
          TO_EMAIL:
            Ref: ToEmail
          EMAIL_SUBJECT:
            Ref: Subject
          DYNAMODB_TABLE:
            !If [UsingMultiRegion, !Ref GlobalDDBTable, !Ref DynamoDBTable]
          EVENT_SEARCH_BACK:
            Ref: EventSearchBack
          ORG_STATUS:
            Ref: AWSOrganizationsEnabled
          HEALTH_EVENT_TYPE:
            Ref: AWSHealthEventType
          MANAGEMENT_ROLE_ARN:
            Ref: ManagementAccountRoleArn