cfn-centralized-logging-cloudtrail-s3-bucket.yaml

########################################################################
# Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
# SPDX-License-Identifier: MIT-0
########################################################################
---
AWSTemplateFormatVersion: 2010-09-09
Description: CloudTrail centralized logging S3 bucket for the log archive account.

Metadata:
  AWS::CloudFormation::Interface:
    ParameterGroups:
      - Label:
          default: "CloudTrail Config"
        Parameters:
          - pTrailAccountId
          - pTrailName
          - pOrganizationId
      - Label:
          default: "S3 Bucket Details"
        Parameters:
          - pS3BucketName
      - Label:
          default: "Encryption"
        Parameters:
          - pSSEAlgorithm
          - pKMSMasterKeyID
      - Label:
          default: "Log Retention"
        Parameters:
          - pRetentionDays
          - pRetentionDaysForAccessLogs
    ParameterLabels:
      pS3BucketName:
        default: "S3 Bucket name"
      pSSEAlgorithm:
        default: "SSE algorithm"
      pKMSMasterKeyID:
        default: "KMS key Id (Optional)"
      pRetentionDays:
        default: "Retention in days"
      pRetentionDaysForAccessLogs:
        default: "Retention days for access logs"
      pOrganizationId:
        default: "AWS Organization Id"
      pTrailAccountId:
        default: "CloudTrail AWS Account Id"
      pTrailName:
        default: "CloudTrail Trail Name"

Parameters:
  pS3BucketName:
    Type: 'String'
    Description: 'Name for the S3 Bucket to hold AWS CloudTrail logging'
    Default: "cloudtrail-logs"
  pSSEAlgorithm:
    Type: 'String'
    Default: 'AES256'
    Description: S3 bucket SSE Algorithm.
    AllowedValues:
      - 'AES256'
      - 'aws:kms'
  pKMSMasterKeyID:
    Type: 'String'
    Description: 'KMS key ID required if SSE algorithm is aws:kms.'
  pRetentionDays:
    Type: String
    Description: 'Number of Days to retain the logs, after which it will be permanently deleted'
    Default: "365"
  pRetentionDaysForAccessLogs:
    Type: String
    Description: 'Number of Days to retain the access logs, after which it will be permanently deleted'
    Default: "365"
  pOrganizationId:
    Type: 'String'
    Description: Organization Id for the management account.
  pTrailAccountId:
    Type: 'String'
    Description: "The AWS account Id which the CloudTrail Organization Trail exists in."
  pTrailName:
    Type: 'String'
    Description: "The name of the Organization Trail for CloudTrail"
    Default: 'aws-cloudtrail-org'

Conditions:
  cUseKMS: !Equals
    - !Ref pSSEAlgorithm
    - 'aws:kms'

Resources:

  rS3AccessLoggingBucket:
    DeletionPolicy: Retain
    UpdateReplacePolicy: Retain
    Type: AWS::S3::Bucket
    # false positive due to if statement
    # checkov:skip=CKV_AWS_19:Ensure the S3 bucket has server-side-encryption enabled
    Metadata:
      cfn-lint:
        config:
          ignore_checks:
            - W3045
    Properties:
      BucketName: !Sub ${pS3BucketName}-access-logs-${AWS::AccountId}
      AccessControl: LogDeliveryWrite
      VersioningConfiguration:
        Status: Enabled
      LoggingConfiguration:
        DestinationBucketName: !Sub ${pS3BucketName}-access-logs-${AWS::AccountId}
      OwnershipControls:
        Rules:
          - ObjectOwnership: BucketOwnerPreferred
      PublicAccessBlockConfiguration:
        BlockPublicAcls: TRUE
        BlockPublicPolicy: TRUE
        IgnorePublicAcls: TRUE
        RestrictPublicBuckets: TRUE
      BucketEncryption:
        ServerSideEncryptionConfiguration:
          - !If
            - cUseKMS
            - ServerSideEncryptionByDefault:
                SSEAlgorithm: !Ref pSSEAlgorithm
                KMSMasterKeyID: !Ref pKMSMasterKeyID
            - ServerSideEncryptionByDefault:
                SSEAlgorithm: !Ref pSSEAlgorithm
      LifecycleConfiguration:
        Rules:
            - Id: RetentionRule
              Status: Enabled
              ExpirationInDays: !Ref pRetentionDaysForAccessLogs
              NoncurrentVersionExpirationInDays: !Ref pRetentionDaysForAccessLogs

  rS3AccessLoggingBucketPolicy:
    Type: AWS::S3::BucketPolicy
    Properties:
      Bucket: !Ref rS3AccessLoggingBucket
      PolicyDocument:
        Version: 2012-10-17
        Statement:
          - Sid: AllowSSLRequestsOnly
            Effect: Deny
            Principal: '*'
            Action: "s3:*"
            Resource:
              - !Sub "arn:${AWS::Partition}:s3:::${rS3AccessLoggingBucket}"
              - !Sub "arn:${AWS::Partition}:s3:::${rS3AccessLoggingBucket}/*"
            Condition:
              Bool:
                aws:SecureTransport: false

  rS3CloudTrailBucket:
    DeletionPolicy: Retain
    UpdateReplacePolicy: Retain
    Type: AWS::S3::Bucket
    # false positive due to if statement
    # checkov:skip=CKV_AWS_19:Ensure the S3 bucket has server-side-encryption enabled
    Metadata:
      cfn-lint:
        config:
          ignore_checks:
            - W3045
    Properties:
      BucketName: !Sub ${pS3BucketName}-${AWS::AccountId}
      VersioningConfiguration:
        Status: Enabled
      LoggingConfiguration:
        DestinationBucketName: !Ref rS3AccessLoggingBucket
      OwnershipControls:
        Rules:
          - ObjectOwnership: BucketOwnerEnforced
      PublicAccessBlockConfiguration:
        BlockPublicAcls: TRUE
        BlockPublicPolicy: TRUE
        IgnorePublicAcls: TRUE
        RestrictPublicBuckets: TRUE
      BucketEncryption:
        ServerSideEncryptionConfiguration:
          - !If
            - cUseKMS
            - ServerSideEncryptionByDefault:
                SSEAlgorithm: !Ref pSSEAlgorithm
                KMSMasterKeyID: !Ref pKMSMasterKeyID
            - ServerSideEncryptionByDefault:
                SSEAlgorithm: !Ref pSSEAlgorithm
      LifecycleConfiguration:
        Rules:
            - Id: RetentionRule
              Status: Enabled
              ExpirationInDays: !Ref pRetentionDays
              NoncurrentVersionExpirationInDays: !Ref pRetentionDays

  ## Bucket Policy details can be found at:
  ## https://docs.aws.amazon.com/awscloudtrail/latest/userguide/create-s3-bucket-policy-for-cloudtrail.html#org-trail-bucket-policy
  rS3CloudTrailBucketPolicy:
    Type: AWS::S3::BucketPolicy
    Properties:
      Bucket: !Ref rS3CloudTrailBucket
      PolicyDocument:
        Version: 2012-10-17
        Statement:
          - Sid: "AWSCloudTrailAclCheck"
            Effect: "Allow"
            Principal:
              Service:
                - cloudtrail.amazonaws.com
            Action: "s3:GetBucketAcl"
            Resource: !Sub "arn:${AWS::Partition}:s3:::${rS3CloudTrailBucket}"
            Condition:
              StringEquals:
                "aws:SourceArn": !Sub "arn:${AWS::Partition}:cloudtrail:${AWS::Region}:${pTrailAccountId}:trail/${pTrailName}"
          - Sid: "AWSCloudTrailWrite"
            Effect: "Allow"
            Principal:
              Service:
                - "cloudtrail.amazonaws.com"
            Action: "s3:PutObject"
            Resource: !Sub "arn:${AWS::Partition}:s3:::${rS3CloudTrailBucket}/AWSLogs/*"
            Condition:
              StringEquals:
                "s3:x-amz-acl": "bucket-owner-full-control"
                "aws:SourceArn": !Sub "arn:${AWS::Partition}:cloudtrail:${AWS::Region}:${pTrailAccountId}:trail/${pTrailName}"
          - Sid: AWSCloudTrailOrganizationWrite
            Effect: "Allow"
            Principal:
              Service:
                - "cloudtrail.amazonaws.com"
            Action: "s3:PutObject"
            Resource: !Sub "arn:${AWS::Partition}:s3:::${rS3CloudTrailBucket}/AWSLogs/${pOrganizationId}/*"
          - Sid: AllowSSLRequestsOnly
            Effect: Deny
            Principal: '*'
            Action: "s3:*"
            Resource:
              - !Sub "arn:${AWS::Partition}:s3:::${rS3CloudTrailBucket}"
              - !Sub "arn:${AWS::Partition}:s3:::${rS3CloudTrailBucket}/*"
            Condition:
              Bool:
                aws:SecureTransport: false

Outputs:
  BucketName:
    Description: CloudTrail centralized logging S3 Bucket name
    Value: !Ref rS3CloudTrailBucket
  LoggingBucketName:
    Description: S3 Access Logging Bucket name for CloudTrail centralized logging
    Value: !Ref rS3AccessLoggingBucket