cloudformation-test.json

{
  "AWSTemplateFormatVersion" : "2010-09-09",
  "Description" : "CloudWatch to Humio Integration for sending CloudWatch Logs and Metrics to Humio.",
  "Parameters" : {
    "HumioProtocol" : {
      "Type" : "String",
      "Description" : "The transport protocol used for delivering log/metric events to Humio. HTTPS is default and recommended.",
      "Default" : "https"
    },
    "HumioHost" : {
      "Type" : "String",
      "Description" : "The host to ship Humio log/metric events to.",
      "Default" : "cloud.humio.com"
    },
    "HumioIngestToken" : {
      "Type" : "String",
      "Description" : "The value of the ingest token for the repository from your Humio account to ship log/metric events to.",
      "Default" : "",
      "NoEcho" : true
    },
    "HumioLambdaLogRetention" : {
      "Type" : "Number",
      "Description" : "Number of days to retain CloudWatch logs from the Humio Lambda functions.",
      "Default": 1
    },
    "EnableCloudWatchLogsAutoSubscription" : {
      "Type" : "String",
      "AllowedValues" : [
        "true",
        "false"
      ],
      "Description" : "Make the log ingester automatically subscribe to new log groups specified with the logs subscription prefix parameter. Set to 'true' to enable.",
      "Default" : "true"
    },
    "HumioCloudWatchLogsSubscriptionPrefix" : {
      "Type" : "String",
      "Description" : "Humio will only subscribe to log groups with the prefix specified.",
      "Default" : ""
    },
    "EnableCloudWatchLogsBackfillerAutoRun" : {
      "Type" : "String",
      "AllowedValues" : [
        "true",
        "false"
      ],
      "Description" : "Make the backfiller run automatically when created. Set to 'true' to enable.",
      "Default" : "true"
    },
    "EnableVPCForIngesterLambdas" : {
      "Type" : "String",
      "AllowedValues" : [
        "true",
        "false"
      ],
      "Description" : "Use a VPC for the lambda ingester functions. Set to 'true' to enable.",
      "Default" : "false"
    },
    "SecurityGroupIds" : {
      "Type" : "CommaDelimitedList",
      "Description" : "A comma separated list of security group ids for the VPC configuration regarding the ingester lambda functions. Only required if VPC is enabled."
    },
    "SubnetIds" : {
      "Type" : "CommaDelimitedList",
      "Description" : "A comma separated list of subnet ids used by the VPC configuration that the ingester lamda functions will be deployed into. Only required if VPC is enabled."
    },
    "HumioLambdaLogLevel" : {
      "Type" : "String",
      "AllowedValues" : ["DEBUG", "INFO", "WARNING", "ERROR", "CRITICAL"],
      "Default" : "INFO"
    },
    "Version" : {
      "Type" : "String",
      "Description" : "The version of the integration you want installed.",
      "Default" : "v1.2.1"
    }
  },
  "Conditions" : {
    "CreateAutoSubscriptionResources" : {
      "Fn::Equals" : [ { "Ref" : "EnableCloudWatchLogsAutoSubscription" }, "true" ]
    },
    "CreateHumioBackfillerAutoRunner" : {
      "Fn::Equals" : [ { "Ref" : "EnableCloudWatchLogsBackfillerAutoRun" }, "true" ]
    },
    "ConfigureVPCForIngesterLambdas" : {
      "Fn::Equals" : [ { "Ref" : "EnableVPCForIngesterLambdas" }, "true" ]
    }
  },
  "Resources" : {
    "HumioCloudWatchRole" : {
      "Type" : "AWS::IAM::Role",
      "Properties" : {
        "AssumeRolePolicyDocument" : {
          "Version" : "2012-10-17",
          "Statement" : [
            {
              "Action" : "sts:AssumeRole",
              "Principal" : {
                "Service" : [
                  "lambda.amazonaws.com",
                  "apigateway.amazonaws.com",
                  "logs.amazonaws.com"
                ]
              },
              "Effect" : "Allow",
              "Sid" : ""
            }
          ]
        },
        "Policies" : [
          {
            "PolicyName" : "humio_cloudwatch_role",
            "PolicyDocument" : {
              "Fn::If" : [ "ConfigureVPCForIngesterLambdas",
                {
                  "Version" : "2012-10-17",
                  "Statement" : [
                    {
                      "Effect" : "Allow",
                      "Action" : [
                        "lambda:GetFunction",
                        "lambda:InvokeFunction",
                        "logs:CreateLogGroup",
                        "logs:CreateLogStream",
                        "logs:DescribeLogGroups",
                        "logs:DescribeLogStreams",
                        "logs:DescribeSubscriptionFilters",
                        "logs:PutSubscriptionFilter",
                        "logs:DeleteSubscriptionFilter",
                        "logs:PutLogEvents",
                        "logs:GetLogEvents",
                        "logs:FilterLogEvents",
                        "cloudwatch:GetMetricData",
                        "cloudwatch:GetMetricStatistics",
                        "ec2:CreateNetworkInterface",
                        "ec2:DescribeNetworkInterfaces",
                        "ec2:CreateNetworkInterfacePermission",
                        "ec2:DeleteNetworkInterface"
                      ],
                      "Resource" : "*"
                    }
                  ]
                },
                {
                  "Version" : "2012-10-17",
                  "Statement" : [
                    {
                      "Effect" : "Allow",
                      "Action" : [
                        "lambda:GetFunction",
                        "lambda:InvokeFunction",
                        "logs:CreateLogGroup",
                        "logs:CreateLogStream",
                        "logs:DescribeLogGroups",
                        "logs:DescribeLogStreams",
                        "logs:DescribeSubscriptionFilters",
                        "logs:PutSubscriptionFilter",
                        "logs:DeleteSubscriptionFilter",
                        "logs:PutLogEvents",
                        "logs:GetLogEvents",
                        "logs:FilterLogEvents",
                        "cloudwatch:GetMetricData",
                        "cloudwatch:GetMetricStatistics"
                      ],
                      "Resource" : "*"
                    }
                  ]
                }
              ]
            }
          }
        ]
      }
    },
    "HumioCloudWatchLogsIngester" : {
      "DependsOn" : [ "HumioCloudWatchRole" ],
      "Type" : "AWS::Lambda::Function",
      "Properties" : {
        "Code" : {
          "S3Bucket" : "cloudwatch2humio",
          "S3Key" : {
            "Fn::Join" : [ "_", [ { "Ref" : "Version" }, "cloudwatch2humio.zip" ] ]
          }
        },
        "Environment" : {
          "Variables" : {
            "humio_protocol" : { "Ref" : "HumioProtocol" },
            "humio_host" : { "Ref" : "HumioHost" },
            "humio_ingest_token" : { "Ref" : "HumioIngestToken" },
            "log_level" : { "Ref" : "HumioLambdaLogLevel" }
          }
        },
        "VpcConfig" : {
          "Fn::If" : [ "ConfigureVPCForIngesterLambdas",
            {
              "SecurityGroupIds" : { "Ref" : "SecurityGroupIds" },
              "SubnetIds" : { "Ref" : "SubnetIds" }
            },
            {
              "Ref" : "AWS::NoValue"
            }
          ]
        },
        "Description" : "CloudWatch Logs to Humio ingester.",
        "Handler" : "logs_ingester.lambda_handler",
        "MemorySize" : "128",
        "Role" : {
          "Fn::GetAtt" : [ "HumioCloudWatchRole", "Arn" ]
        },
        "Runtime" : "python3.8",
        "Timeout" : "300"
      }
    },
    "HumioCloudWatchLogsIngesterPermission" : {
      "Type" : "AWS::Lambda::Permission",
      "Properties" : {
        "Action" : "lambda:InvokeFunction",
        "FunctionName" : {
          "Fn::GetAtt" : [ "HumioCloudWatchLogsIngester", "Arn" ]
        },
        "Principal" : "logs.amazonaws.com"
      }
    },
    "HumioCloudWatchLogsIngesterLogGroup" : {
      "DependsOn" : [ "HumioCloudWatchRole" ],
      "Type" : "AWS::Logs::LogGroup",
      "Properties" : {
        "LogGroupName" : {
          "Fn::Join" : [ "", [ "/aws/lambda/", { "Ref" : "HumioCloudWatchLogsIngester" } ] ]
        },
        "RetentionInDays" : { "Ref" : "HumioLambdaLogRetention" }
      }
    },
    "HumioCloudWatchLogsSubscriber" : {
      "DependsOn" : [ "HumioCloudWatchRole" ],
      "Type" : "AWS::Lambda::Function",
      "Properties" : {
        "Code" : {
          "S3Bucket" : "cloudwatch2humio",
          "S3Key" : {
            "Fn::Join" : [ "_", [ { "Ref" : "Version" }, "cloudwatch2humio.zip" ] ]
          }
        },
        "Environment" : {
          "Variables" : {
            "humio_log_ingester_arn" : {
              "Fn::GetAtt" : [ "HumioCloudWatchLogsIngester", "Arn" ]
            },
            "humio_subscription_prefix" : { "Ref" : "HumioCloudWatchLogsSubscriptionPrefix" },
            "log_level" : { "Ref" : "HumioLambdaLogLevel" }
          }
        },
        "Description" : "CloudWatch Logs to Humio log group subscriber.",
        "Handler" : "logs_subscriber.lambda_handler",
        "MemorySize" : "128",
        "Role" : {
          "Fn::GetAtt" : [ "HumioCloudWatchRole", "Arn" ]
        },
        "Runtime" : "python3.8",
        "Timeout" : "300"
      }
    },
    "HumioCloudWatchLogsSubscriberPermission" : {
      "Condition" : "CreateAutoSubscriptionResources",
      "Type" : "AWS::Lambda::Permission",
      "Properties" : {
        "Action" : "lambda:InvokeFunction",
        "FunctionName" : {
          "Fn::GetAtt" : [ "HumioCloudWatchLogsSubscriber", "Arn" ]
        },
        "Principal" : "events.amazonaws.com",
        "SourceAccount" : { "Ref" : "AWS::AccountId" }
      }
    },
    "HumioCloudWatchLogsSubscriberPermission2" : {
      "Condition" : "CreateAutoSubscriptionResources",
      "Type" : "AWS::Lambda::Permission",
      "Properties" : {
        "Action" : "lambda:InvokeFunction",
        "FunctionName" : {
          "Fn::GetAtt" : [ "HumioCloudWatchLogsSubscriber", "Arn" ]
        },
        "Principal" : "events.amazonaws.com",
        "SourceArn" : {
          "Fn::GetAtt" : [ "HumioCloudWatchLogsSubscriberEventRule", "Arn" ]
        }
      }
    },
    "HumioCloudWatchLogsSubscriberLogGroup" : {
      "DependsOn" : [ "HumioCloudWatchRole" ],
      "Type" : "AWS::Logs::LogGroup",
      "Properties" : {
        "LogGroupName" : {
          "Fn::Join" : [ "", [ "/aws/lambda/", { "Ref" : "HumioCloudWatchLogsSubscriber" } ] ]
        },
        "RetentionInDays" : { "Ref" : "HumioLambdaLogRetention" }
      }
    },
    "HumioCloudWatchLogsBackfiller" : {
      "DependsOn" : [ "HumioCloudWatchRole" ],
      "Type" : "AWS::Lambda::Function",
      "Properties" : {
        "Code" : {
          "S3Bucket" : "cloudwatch2humio",
          "S3Key" : {
            "Fn::Join" : [ "_", [ { "Ref" : "Version" }, "cloudwatch2humio.zip" ] ]
          }
        },
        "Environment" : {
          "Variables" : {
            "humio_log_ingester_arn" : {
              "Fn::GetAtt" : [ "HumioCloudWatchLogsIngester", "Arn" ]
            },
            "humio_subscription_prefix" : { "Ref" : "HumioCloudWatchLogsSubscriptionPrefix" },
            "humio_protocol" : { "Ref" : "HumioProtocol" },
            "humio_host" : { "Ref" : "HumioHost" },
            "humio_ingest_token" : { "Ref" : "HumioIngestToken" },
            "log_level" : { "Ref" : "HumioLambdaLogLevel" }
          }
        },
        "Description" : "CloudWatch Logs to Humio logs backfiller.",
        "Handler" : "logs_backfiller.lambda_handler",
        "MemorySize" : "128",
        "Role" : {
          "Fn::GetAtt" : [ "HumioCloudWatchRole", "Arn" ]
        },
        "Runtime" : "python3.8",
        "Timeout" : "300"
      }
    },
    "HumioCloudWatchLogsBackfillerPermission" : {
      "Type" : "AWS::Lambda::Permission",
      "Properties" : {
        "Action" : "lambda:InvokeFunction",
        "FunctionName" : {
          "Fn::GetAtt" : [ "HumioCloudWatchLogsBackfiller", "Arn" ]
        },
        "Principal" : "logs.amazonaws.com"
      }
    },
    "HumioCloudWatchLogsBackfillerLogGroup" : {
      "DependsOn" : [ "HumioCloudWatchRole" ],
      "Type" : "AWS::Logs::LogGroup",
      "Properties" : {
        "LogGroupName" : {
          "Fn::Join" : [ "", [ "/aws/lambda/", { "Ref" : "HumioCloudWatchLogsBackfiller" } ] ]
        },
        "RetentionInDays" : { "Ref" : "HumioLambdaLogRetention" }
      }
    },
    "HumioBackfillerAutoRunner" : {
      "Condition" : "CreateHumioBackfillerAutoRunner",
      "DependsOn" : [ "HumioCloudWatchLogsBackfiller" ],
      "Type" : "Custom::BackfillerAutoRunner",
      "Properties" : {
        "ServiceToken" : { "Fn::GetAtt" : [ "HumioCloudWatchLogsBackfiller", "Arn" ] },
        "StackName" : { "Ref" : "AWS::StackName" }
      }
    },
    "HumioCloudWatchLogsSubscriberS3Bucket" : {
      "Condition" : "CreateAutoSubscriptionResources",
      "Type" : "AWS::S3::Bucket",
      "Properties" : {
        "AccessControl" : "BucketOwnerFullControl",
        "BucketName" : {
          "Fn::Join" : [ "-", [ { "Ref" : "AWS::StackName" }, "humio", "cloudtrail" ] ]
        }
      }
    },
    "HumioCloudWatchLogsSubscriberS3BucketPolicy" : {
      "Condition" : "CreateAutoSubscriptionResources",
      "DependsOn" : [ "HumioCloudWatchLogsSubscriberS3Bucket" ],
      "Type" : "AWS::S3::BucketPolicy",
      "Properties" : {
        "Bucket" : { "Ref" : "HumioCloudWatchLogsSubscriberS3Bucket" },
        "PolicyDocument" : {
          "Version" : "2012-10-17",
          "Statement" : [
            {
              "Sid" : "AWSCloudTrailAclCheck20150319",
              "Effect" : "Allow",
              "Principal" : {
                "Service" : "cloudtrail.amazonaws.com"
              },
              "Action" : "s3:GetBucketAcl",
              "Resource" : {
                "Fn::GetAtt" : [ "HumioCloudWatchLogsSubscriberS3Bucket", "Arn" ]
              }
            },
            {
              "Sid" : "AWSCloudTrailWrite20150319",
              "Effect" : "Allow",
              "Principal" : {
                "Service" : "cloudtrail.amazonaws.com"
              },
              "Action" : "s3:PutObject",
              "Resource" : {
                "Fn::Join" : [ "", [ { "Fn::GetAtt" : [ "HumioCloudWatchLogsSubscriberS3Bucket", "Arn" ] }, "/AWSLogs/", { "Ref" : "AWS::AccountId" }, "/*" ] ]
              },
              "Condition" : {
                "StringEquals" : { "s3:x-amz-acl" : "bucket-owner-full-control" }
              }
            }
          ]
        }
      }
    },
    "HumioCloudWatchLogsSubscriberCloudTrail" : {
      "Condition" : "CreateAutoSubscriptionResources",
      "DependsOn" : [ "HumioCloudWatchLogsSubscriberS3BucketPolicy" ],
      "Type" : "AWS::CloudTrail::Trail",
      "Properties" : {
        "EnableLogFileValidation" : false,
        "IncludeGlobalServiceEvents" : true,
        "IsMultiRegionTrail" : true,
        "IsLogging" : true,
        "S3BucketName" : {
          "Fn::Join" : [ "-", [ { "Ref" : "AWS::StackName" }, "humio", "cloudtrail" ] ]
        },
        "TrailName" : {
          "Fn::Join" : [ "-", [ { "Ref" : "AWS::StackName" }, "humio", { "Ref" : "AWS::AccountId" } ] ]
        }
      }
    },
    "HumioCloudWatchLogsSubscriberEventRule" : {
      "Condition" : "CreateAutoSubscriptionResources",
      "DependsOn" : [ "HumioCloudWatchLogsSubscriber" ],
      "Type" : "AWS::Events::Rule",
      "Properties" : {
        "Description" : "Humio log group auto subscription event rule.",
        "EventPattern" : {
          "source" : [ "aws.logs" ],
          "detail-type" : [ "AWS API Call via CloudTrail" ],
          "detail" : {
            "eventSource" : [ "logs.amazonaws.com" ],
            "eventName" : [ "CreateLogGroup" ]
          }
        },
        "Name" : {
          "Fn::Join" : [ "-", [ { "Ref" : "AWS::StackName" }, "humio-auto-subscription-rule" ] ]
        },
        "Targets" : [
          {
            "Id" : {
              "Fn::Join" : [ "-", [ { "Ref" : "AWS::StackName" }, "humio-auto-subscription-rule" ] ]
            },
            "Arn" : {
              "Fn::GetAtt" : [ "HumioCloudWatchLogsSubscriber", "Arn" ]
            }
          }
        ]
      }
    },
    "HumioCloudWatchMetricIngester" : {
      "DependsOn" : [ "HumioCloudWatchRole" ],
      "Type" : "AWS::Lambda::Function",
      "Properties" : {
        "Code" : {
          "S3Bucket" : "cloudwatch2humio",
          "S3Key" : {
            "Fn::Join" : [ "_", [ { "Ref" : "Version" }, "cloudwatch2humio.zip" ] ]
          }
        },
        "Environment" : {
          "Variables" : {
            "humio_protocol" : { "Ref" : "HumioProtocol" },
            "humio_host" : { "Ref" : "HumioHost" },
            "humio_ingest_token" : { "Ref" : "HumioIngestToken" },
            "log_level" : { "Ref" : "HumioLambdaLogLevel" }
          }
        },
        "VpcConfig" : {
          "Fn::If" : [ "ConfigureVPCForIngesterLambdas",
            {
              "SecurityGroupIds" : { "Ref" : "SecurityGroupIds" },
              "SubnetIds" : { "Ref" : "SubnetIds" }
            },
            {
              "Ref" : "AWS::NoValue"
            }
          ]
        },
        "Description" : "CloudWatch Metrics to Humio ingester.",
        "Handler" : "metric_ingester.lambda_handler",
        "MemorySize" : "128",
        "Role" : {
          "Fn::GetAtt" : [ "HumioCloudWatchRole", "Arn" ]
        },
        "Runtime" : "python3.8",
        "Timeout" : "300"
      }
    },
    "HumioCloudWatchMetricIngesterPermission" : {
      "Type" : "AWS::Lambda::Permission",
      "Properties" : {
        "Action" : "lambda:InvokeFunction",
        "FunctionName" : {
          "Fn::GetAtt" : [ "HumioCloudWatchMetricIngester", "Arn" ]
        },
        "Principal" : "logs.amazonaws.com"
      }
    },
    "HumioCloudWatchMetricIngesterLogGroup" : {
      "DependsOn" : [ "HumioCloudWatchRole" ],
      "Type" : "AWS::Logs::LogGroup",
      "Properties" : {
        "LogGroupName" : {
          "Fn::Join" : [ "", [ "/aws/lambda/", { "Ref" : "HumioCloudWatchMetricIngester" } ] ]
        },
        "RetentionInDays" : { "Ref" : "HumioLambdaLogRetention" }
      }
    },
    "HumioCloudWatchMetricStatisticsIngester" : {
      "DependsOn" : [ "HumioCloudWatchRole" ],
      "Type" : "AWS::Lambda::Function",
      "Properties" : {
        "Code" : {
          "S3Bucket" : "cloudwatch2humio",
          "S3Key" : {
            "Fn::Join" : [ "_", [ { "Ref" : "Version" }, "cloudwatch2humio.zip" ] ]
          }
        },
        "Environment" : {
          "Variables" : {
            "humio_protocol" : { "Ref" : "HumioProtocol" },
            "humio_host" : { "Ref" : "HumioHost" },
            "humio_ingest_token" : { "Ref" : "HumioIngestToken" },
            "log_level" : { "Ref" : "HumioLambdaLogLevel" }
          }
        },
        "VpcConfig" : {
          "Fn::If" : [ "ConfigureVPCForIngesterLambdas",
            {
              "SecurityGroupIds" : { "Ref" : "SecurityGroupIds" },
              "SubnetIds" : { "Ref" : "SubnetIds" }
            },
            {
              "Ref" : "AWS::NoValue"
            }
          ]
        },
        "Description" : "CloudWatch Metrics Statistics to Humio ingester.",
        "Handler" : "metric_statistics_ingester.lambda_handler",
        "MemorySize" : "128",
        "Role" : {
          "Fn::GetAtt" : [ "HumioCloudWatchRole", "Arn" ]
        },
        "Runtime" : "python3.8",
        "Timeout" : "300"
      }
    },
    "HumioCloudWatchMetricStatisticsIngesterPermission" : {
      "Type" : "AWS::Lambda::Permission",
      "Properties" : {
        "Action" : "lambda:InvokeFunction",
        "FunctionName" : {
          "Fn::GetAtt" : [ "HumioCloudWatchMetricStatisticsIngester", "Arn" ]
        },
        "Principal" : "logs.amazonaws.com"
      }
    },
    "HumioCloudWatchMetricStatisticsIngesterLogGroup" : {
      "DependsOn" : [ "HumioCloudWatchRole" ],
      "Type" : "AWS::Logs::LogGroup",
      "Properties" : {
        "LogGroupName" : {
          "Fn::Join" : [ "", [ "/aws/lambda/", { "Ref" : "HumioCloudWatchMetricStatisticsIngester" } ] ]
        },
        "RetentionInDays" : { "Ref" : "HumioLambdaLogRetention" }
      }
    }
  }
}