Add org sink rules template and deploy action

PRX · Apr 22, 2024 · 2df574f · 2df574f
1 parent dc1976c
commit 2df574f
Show file tree

Hide file tree

Showing 2 changed files with 99 additions and 0 deletions.
diff --git a/.github/workflows/deploy-eventrules-org-sink.yml b/.github/workflows/deploy-eventrules-org-sink.yml
@@ -0,0 +1,39 @@
+name: Deploy org sink rules
+
+on:
+  push:
+    branches:
+      - main
+    paths:
+      - event-rules/org-sink-rules/template.yml
+
+concurrency:
+  group: ${{ github.workflow }}
+
+permissions:
+  id-token: write
+  contents: read
+
+jobs:
+  deploy:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Configure AWS Credentials
+        uses: aws-actions/configure-aws-credentials@v4
+        with:
+          aws-region: us-east-2
+          role-to-assume: arn:aws:iam::048723829744:role/PRX-GHA-AccessRole
+          role-session-name: gha-deploy-org-sink-rules
+
+      - name: Deploy to management account
+        working-directory: event-rules/org-sink-rules
+        run: |
+          aws cloudformation deploy \
+            --region us-east-2 \
+            --stack-name org-sink-event-rules \
+            --template-file template.yml \
+            --capabilities CAPABILITY_NAMED_IAM \
+            --no-fail-on-empty-changeset \
+            --role-arn arn:aws:iam::048723829744:role/PRX-GHA-ServiceRoleForCloudFormation
diff --git a/event-rules/org-sink-rules/template.yml b/event-rules/org-sink-rules/template.yml
@@ -0,0 +1,60 @@
+AWSTemplateFormatVersion: "2010-09-09"
+
+Resources:
+  CloudWatchAlarmStateChangeRule:
+    Type: AWS::Events::Rule
+    Properties:
+      EventPattern:
+        detail-type:
+          - CloudWatch Alarm State Change
+        source:
+          - aws.cloudwatch
+      State: ENABLED
+      Targets:
+        - Arn: arn:aws:events:us-east-2:578003269847:event-bus/CloudWatch-org-sink
+          Id: org-sink-alarm-state-change
+          RoleArn: !Sub arn:${AWS::Partition}:iam::${AWS::AccountId}:role/PRX-CloudWatchOrgSinkRole
+
+  CloudFormationStateChangeRule:
+    Type: AWS::Events::Rule
+    Properties:
+      EventPattern:
+        detail-type:
+          - CloudFormation Resource Status Change
+          - CloudFormation Stack Status Change
+        source:
+          - aws.cloudformation
+      State: ENABLED
+      Targets:
+        - Arn: arn:aws:events:us-east-2:578003269847:event-bus/CloudFormation-org-sink
+          Id: org-sink-cfn-state-change
+          RoleArn: !Sub arn:${AWS::Partition}:iam::${AWS::AccountId}:role/PRX-CloudFormationOrgSinkRole
+
+  CloudTrailRootActivityRule:
+    Type: AWS::Events::Rule
+    Properties:
+      EventPattern:
+        detail:
+          userIdentity:
+            type:
+              - Root
+        detail-type:
+          - AWS API Call via CloudTrail
+          - AWS Console Sign In via CloudTrail
+      State: ENABLED
+      Targets:
+        - Arn: arn:aws:events:us-east-2:578003269847:event-bus/CloudTrail-org-sink
+          Id: org-sink-trail-root-activity
+          RoleArn: !Sub arn:${AWS::Partition}:iam::${AWS::AccountId}:role/PRX-CloudTrailOrgSinkRole
+
+  SlackMessageRule:
+    Type: AWS::Events::Rule
+    Properties:
+      EventPattern:
+        detail-type:
+          - Slack Message Relay Message Payload
+      State: ENABLED
+      Targets:
+        - Arn: arn:aws:events:us-east-2:578003269847:event-bus/SlackMessageRelay-org-sink
+          Id: org-sink-slack-message-payload
+          RoleArn: !Sub arn:${AWS::Partition}:iam::${AWS::AccountId}:role/PRX-SlackOrgSinkRole