# devops/aws-management/devops-iam-key-monitor.yml
AWSTemplateFormatVersion: "2010-09-09"
Transform: AWS::Serverless-2016-10-31

Description: >-
  Regularly scans IAM keys in various accounts looking for ones that are old
  and should be rotated. Sends a Slack message

Parameters:
  SlackMessageRelayTopicArn:
    Type: String

Resources:
  MonitorFunction:
    Type: AWS::Serverless::Function
    Properties:
      Description: >-
        Scans for stale IAM keys
      Environment:
        Variables:
          SLACK_MESSAGE_RELAY_SNS_TOPIC_ARN: !Ref SlackMessageRelayTopicArn
      Events:
        Poller:
          Properties:
            Description: Runs the IAM key scan
            Enabled: true
            Schedule: rate(1 day)
          Type: Schedule
      Handler: index.handler
      InlineCode: |
        const AWS = require('aws-sdk');

        const sns = new AWS.SNS({ apiVersion: '2010-03-31' });

        exports.handler = async (event) => {
          console.log(JSON.stringify(event));

          await sns.publish({
            TargetArn: process.env.SLACK_MESSAGE_RELAY_SNS_TOPIC_ARN,
            Message: JSON.stringify({
              channel: '#sandbox2',
              username: 'AWS CloudTrail',
              icon_emoji: ':ops-cloudtrail:',
              text: `test`,
            }),
          }).promise();
        };
      MemorySize: 128
      Policies:
        - Statement:
            - Action: sns:Publish
              Effect: Allow
              Resource: !Ref SlackMessageRelayTopicArn
          Version: "2012-10-17"
      Runtime: nodejs14.x
      Tags:
        prx:meta:tagging-version: "2021-04-07"
        prx:cloudformation:stack-name: !Ref AWS::StackName
        prx:cloudformation:stack-id: !Ref AWS::StackId
        prx:ops:environment: Production
        prx:dev:application: Security
      Timeout: 8
  MonitorFunctionLogGroup:
    Type: AWS::Logs::LogGroup
    Properties:
      LogGroupName: !Sub /aws/lambda/${MonitorFunction}
      RetentionInDays: 30
      Tags:
        - { Key: prx:meta:tagging-version, Value: "2021-04-07" }
        - { Key: prx:cloudformation:stack-name, Value: !Ref AWS::StackName }
        - { Key: prx:cloudformation:stack-id, Value: !Ref AWS::StackId }
        - { Key: prx:ops:environment, Value: Production }
        - { Key: prx:dev:application, Value: Security }

Add placeholder key monitor function
Add placeholder key monitor function
