Description: Automated Best Practices for AWS Cloud setups - https://superwerker.cloud (qs-1rhrhoi4t)
Metadata:
  SuperwerkerVersion: 1.3.0
  QuickStartDocumentation:
    EntrypointName: Parameters for launching Superwerker
    Order: '1'
  cdk_nag:
    rules_to_suppress:
      - reason: Custom resource lambdas are not using latest runtime
        id: AwsSolutions-L1
      - reason: Superwerker makes extensive usage of managed policies. Even Lambda Basic execution role added by custom resources triggers this.
        id: AwsSolutions-IAM4
      - reason: Superwerker makes extensive usage of wildcard often required to make organization wide changes.
        id: AwsSolutions-IAM5
      - reason: >-
          Encryption-at-rest for SNS topics has been removed as a control for the AWS Foundational Security Best Practices (FSBP) standard in April 2024, https://docs.aws.amazon.com/securityhub/latest/userguide/sns-controls.html#sns-1
        id: AwsSolutions-SNS2
      - reason: Tracing for Stepfunction is not necessary in our case
        id: AwsSolutions-SF1
      - reason: Tracing for Stepfunction is not necessary in our case
        id: AwsSolutions-SF2
      - reason: S3 access logs not required
        id: AwsSolutions-S1
Parameters:
  Domain:
    Type: String
    Description: Domain used for root mail feature. Please see https://github.com/superwerker/superwerker/blob/main/README.md#technical-faq for more information
  Subdomain:
    Type: String
    Default: aws
    Description: Subdomain used for root mail feature. Please see https://github.com/superwerker/superwerker/blob/main/README.md#technical-faq for more information
  NotificationsMail:
    Type: String
    Default: ''
    AllowedPattern: (^$|^.*@.*\..*$)
    Description: Mail address used for notifications. Please see https://github.com/superwerker/superwerker/blob/main/README.md#technical-faq for more information
  IncludeBudget:
    Type: String
    Default: 'Yes'
    AllowedValues:
      - 'Yes'
      - 'No'
    Description: Enable AWS Budgets alarm for monthly AWS spending
  IncludeGuardDuty:
    Type: String
    Default: 'Yes'
    AllowedValues:
      - 'Yes'
      - 'No'
    Description: Enable Amazon GuardDuty
  IncludeSecurityHub:
    Type: String
    Default: 'Yes'
    AllowedValues:
      - 'Yes'
      - 'No'
    Description: Enable AWS Security Hub
  IncludeBackup:
    Type: String
    Default: 'Yes'
    AllowedValues:
      - 'Yes'
      - 'No'
    Description: Enable automated backups
  IncludeServiceControlPolicies:
    Type: String
    Default: 'Yes'
    AllowedValues:
      - 'Yes'
      - 'No'
    Description: Enable service control policies in AWS organizations
Resources:
  GeneratedAuditAWSAccountEmail426CA952:
    Type: Custom::GenerateEmailAddress
    Properties:
      ServiceToken: !GetAtt 'superwerkergenerateemailaddressproviderframeworkonEvent3AC8AF01.Arn'
      Domain: !Join
        - ''
        - - !Ref 'Subdomain'
          - .
          - !Ref 'Domain'
      Name: Audit
    UpdateReplacePolicy: Delete
    DeletionPolicy: Delete
    Metadata:
      aws:cdk:path: SuperwerkerStack/GeneratedAuditAWSAccountEmail/Resource/Default
  superwerkergenerateemailaddressprovidergenerateemailaddressoneventServiceRoleC486FCF1:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Statement:
          - Action: sts:AssumeRole
            Effect: Allow
            Principal:
              Service: lambda.amazonaws.com
        Version: '2012-10-17'
      ManagedPolicyArns:
        - !Join
          - ''
          - - 'arn:'
            - !Ref 'AWS::Partition'
            - :iam::aws:policy/service-role/AWSLambdaBasicExecutionRole
    Metadata:
      aws:cdk:path: SuperwerkerStack/superwerker.generate-email-address-provider/generate-email-address-on-event/ServiceRole/Resource
  superwerkergenerateemailaddressprovidergenerateemailaddressoneventServiceRoleDefaultPolicyCA8C0038:
    Type: AWS::IAM::Policy
    Properties:
      PolicyDocument:
        Statement:
          - Action:
              - organizations:ListAccounts
              - organizations:ListAccountsForParent
              - organizations:ListOrganizationalUnitsForParent
              - organizations:ListRoots
            Effect: Allow
            Resource: '*'
        Version: '2012-10-17'
      PolicyName: superwerkergenerateemailaddressprovidergenerateemailaddressoneventServiceRoleDefaultPolicyCA8C0038
      Roles:
        - !Ref 'superwerkergenerateemailaddressprovidergenerateemailaddressoneventServiceRoleC486FCF1'
    Metadata:
      aws:cdk:path: SuperwerkerStack/superwerker.generate-email-address-provider/generate-email-address-on-event/ServiceRole/DefaultPolicy/Resource
  superwerkergenerateemailaddressprovidergenerateemailaddressoneventE83D0932:
    Type: AWS::Lambda::Function
    Properties:
      Code:
        S3Bucket: !Sub 'superwerker-resources-${AWS::Region}'
        S3Key: 1.3.0/33070a767a8a2adc11c20c35e0e3c1537953f3eaa3204e5f01a2040e0da2adb3.zip
      Handler: index.handler
      Role: !GetAtt 'superwerkergenerateemailaddressprovidergenerateemailaddressoneventServiceRoleC486FCF1.Arn'
      Runtime: nodejs20.x
    DependsOn:
      - superwerkergenerateemailaddressprovidergenerateemailaddressoneventServiceRoleDefaultPolicyCA8C0038
      - superwerkergenerateemailaddressprovidergenerateemailaddressoneventServiceRoleC486FCF1
    Metadata:
      aws:cdk:path: SuperwerkerStack/superwerker.generate-email-address-provider/generate-email-address-on-event/Resource
      aws:asset:path: asset.33070a767a8a2adc11c20c35e0e3c1537953f3eaa3204e5f01a2040e0da2adb3
      aws:asset:is-bundled: true
      aws:asset:property: Code
  superwerkergenerateemailaddressproviderframeworkonEventServiceRole116C3F83:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Statement:
          - Action: sts:AssumeRole
            Effect: Allow
            Principal:
              Service: lambda.amazonaws.com
        Version: '2012-10-17'
      ManagedPolicyArns:
        - !Join
          - ''
          - - 'arn:'
            - !Ref 'AWS::Partition'
            - :iam::aws:policy/service-role/AWSLambdaBasicExecutionRole
    Metadata:
      aws:cdk:path: SuperwerkerStack/superwerker.generate-email-address-provider/generate-email-address-provider/framework-onEvent/ServiceRole/Resource
  superwerkergenerateemailaddressproviderframeworkonEventServiceRoleDefaultPolicy38FE703D:
    Type: AWS::IAM::Policy
    Properties:
      PolicyDocument:
        Statement:
          - Action: lambda:InvokeFunction
            Effect: Allow
            Resource:
              - !GetAtt 'superwerkergenerateemailaddressprovidergenerateemailaddressoneventE83D0932.Arn'
              - !Join
                - ''
                - - !GetAtt 'superwerkergenerateemailaddressprovidergenerateemailaddressoneventE83D0932.Arn'
                  - :*
          - Action: lambda:GetFunction
            Effect: Allow
            Resource: !GetAtt 'superwerkergenerateemailaddressprovidergenerateemailaddressoneventE83D0932.Arn'
        Version: '2012-10-17'
      PolicyName: superwerkergenerateemailaddressproviderframeworkonEventServiceRoleDefaultPolicy38FE703D
      Roles:
        - !Ref 'superwerkergenerateemailaddressproviderframeworkonEventServiceRole116C3F83'
    Metadata:
      aws:cdk:path: SuperwerkerStack/superwerker.generate-email-address-provider/generate-email-address-provider/framework-onEvent/ServiceRole/DefaultPolicy/Resource
  superwerkergenerateemailaddressproviderframeworkonEvent3AC8AF01:
    Type: AWS::Lambda::Function
    Properties:
      Code:
        S3Bucket: !Sub 'superwerker-resources-${AWS::Region}'
        S3Key: 1.3.0/bdc104ed9cab1b5b6421713c8155f0b753380595356f710400609664d3635eca.zip
      Description: AWS CDK resource provider framework - onEvent (SuperwerkerStack/superwerker.generate-email-address-provider/generate-email-address-provider)
      Environment:
        Variables:
          USER_ON_EVENT_FUNCTION_ARN: !GetAtt 'superwerkergenerateemailaddressprovidergenerateemailaddressoneventE83D0932.Arn'
      Handler: framework.onEvent
      LoggingConfig:
        ApplicationLogLevel: FATAL
        LogFormat: JSON
      Role: !GetAtt 'superwerkergenerateemailaddressproviderframeworkonEventServiceRole116C3F83.Arn'
      Runtime: nodejs22.x
      Timeout: 900
    DependsOn:
      - superwerkergenerateemailaddressproviderframeworkonEventServiceRoleDefaultPolicy38FE703D
      - superwerkergenerateemailaddressproviderframeworkonEventServiceRole116C3F83
    Metadata:
      aws:cdk:path: SuperwerkerStack/superwerker.generate-email-address-provider/generate-email-address-provider/framework-onEvent/Resource
      aws:asset:path: asset.bdc104ed9cab1b5b6421713c8155f0b753380595356f710400609664d3635eca
      aws:asset:is-bundled: false
      aws:asset:property: Code
  GeneratedLogArchiveAWSAccountEmail92CF255B:
    Type: Custom::GenerateEmailAddress
    Properties:
      ServiceToken: !GetAtt 'superwerkergenerateemailaddressproviderframeworkonEvent3AC8AF01.Arn'
      Domain: !Join
        - ''
        - - !Ref 'Subdomain'
          - .
          - !Ref 'Domain'
      Name: Log Archive
    UpdateReplacePolicy: Delete
    DeletionPolicy: Delete
    Metadata:
      aws:cdk:path: SuperwerkerStack/GeneratedLogArchiveAWSAccountEmail/Resource/Default
  Prepare:
    Type: AWS::CloudFormation::Stack
    Properties:
      TemplateURL: !Join
        - ''
        - - https://s3.
          - !Ref 'AWS::Region'
          - .
          - !Ref 'AWS::URLSuffix'
          - /
          - !Sub 'superwerker-resources-${AWS::Region}'
          - /1.3.0/f93627c457da9b135ebef3d181f14b3847d67ab892de1dc1997c7a86941c244b.json
    UpdateReplacePolicy: Delete
    DeletionPolicy: Delete
    Metadata:
      aws:cdk:path: SuperwerkerStack/Prepare.NestedStack/Prepare.NestedStackResource
      aws:asset:path: SuperwerkerStackPrepareF9489A91.nested.template.json
      aws:asset:property: TemplateURL
  RootMail:
    Type: AWS::CloudFormation::Stack
    Properties:
      Parameters:
        Domain: !Ref 'Domain'
        Subdomain: !Ref 'Subdomain'
        PropagationParameterName: /superwerker/propagation_status
        HostedZoneParameterName: /superwerker/domain_name_servers
      TemplateURL: !Join
        - ''
        - - https://s3.
          - !Ref 'AWS::Region'
          - .
          - !Ref 'AWS::URLSuffix'
          - /
          - !Sub 'superwerker-resources-${AWS::Region}'
          - /1.3.0/627d394f8fc47dc8fd705d66250b1fd446d3754cbc467bd5d6a2b9af4d0caf32.json
    UpdateReplacePolicy: Delete
    DeletionPolicy: Delete
    Metadata:
      aws:cdk:path: SuperwerkerStack/RootMail.NestedStack/RootMail.NestedStackResource
      aws:asset:path: SuperwerkerStackRootMail79641A79.nested.template.json
      aws:asset:property: TemplateURL
  ControlTower:
    Type: AWS::CloudFormation::Stack
    Properties:
      Parameters:
        AuditAWSAccountEmail: !GetAtt 'GeneratedAuditAWSAccountEmail426CA952.Email'
        LogArchiveAWSAccountEmail: !GetAtt 'GeneratedLogArchiveAWSAccountEmail92CF255B.Email'
      TemplateURL: !Join
        - ''
        - - https://s3.
          - !Ref 'AWS::Region'
          - .
          - !Ref 'AWS::URLSuffix'
          - /
          - !Sub 'superwerker-resources-${AWS::Region}'
          - /1.3.0/75849e8da0132a411136ab1c7b6e932851d7feca6310dbaf963d73645738690c.json
    DependsOn:
      - Prepare
    UpdateReplacePolicy: Delete
    DeletionPolicy: Delete
    Metadata:
      aws:cdk:path: SuperwerkerStack/ControlTower.NestedStack/ControlTower.NestedStackResource
      aws:asset:path: SuperwerkerStackControlTowerA5957978.nested.template.json
      aws:asset:property: TemplateURL
  LivingDocumentation:
    Type: AWS::CloudFormation::Stack
    Properties:
      Parameters:
        SuperwerkerDomain: !Join
          - ''
          - - !Ref 'Subdomain'
            - .
            - !Ref 'Domain'
        PropagationParamName: /superwerker/propagation_status
        HostedZoneParamName: /superwerker/domain_name_servers
      TemplateURL: !Join
        - ''
        - - https://s3.
          - !Ref 'AWS::Region'
          - .
          - !Ref 'AWS::URLSuffix'
          - /
          - !Sub 'superwerker-resources-${AWS::Region}'
          - /1.3.0/b4aec6267f4c929be7384b2a2f0f9a46ec62792f771e705b8cd1508fa53394a8.json
    UpdateReplacePolicy: Delete
    DeletionPolicy: Delete
    Metadata:
      aws:cdk:path: SuperwerkerStack/LivingDocumentation.NestedStack/LivingDocumentation.NestedStackResource
      aws:asset:path: SuperwerkerStackLivingDocumentation7D832A3F.nested.template.json
      aws:asset:property: TemplateURL
  Backup:
    Type: AWS::CloudFormation::Stack
    Properties:
      TemplateURL: !Join
        - ''
        - - https://s3.
          - !Ref 'AWS::Region'
          - .
          - !Ref 'AWS::URLSuffix'
          - /
          - !Sub 'superwerker-resources-${AWS::Region}'
          - /1.3.0/15c532578d8c41eaee1ff173f4bf1282ca07ef7ca47193e538c59b7b19b7cb16.json
    DependsOn:
      - ControlTower
    UpdateReplacePolicy: Delete
    DeletionPolicy: Delete
    Metadata:
      aws:cdk:path: SuperwerkerStack/Backup.NestedStack/Backup.NestedStackResource
      aws:asset:path: SuperwerkerStackBackup2EDC043E.nested.template.json
      aws:asset:property: TemplateURL
    Condition: IncludeBackup
  Budget:
    Type: AWS::CloudFormation::Stack
    Properties:
      TemplateURL: !Join
        - ''
        - - https://s3.
          - !Ref 'AWS::Region'
          - .
          - !Ref 'AWS::URLSuffix'
          - /
          - !Sub 'superwerker-resources-${AWS::Region}'
          - /1.3.0/f2d338650940e082e0ea31c5de25684c7bacb3328703cfa37a70d4ecda764c94.json
    UpdateReplacePolicy: Delete
    DeletionPolicy: Delete
    Metadata:
      aws:cdk:path: SuperwerkerStack/Budget.NestedStack/Budget.NestedStackResource
      aws:asset:path: SuperwerkerStackBudget4EA13C09.nested.template.json
      aws:asset:property: TemplateURL
    Condition: IncludeBudget
  GuardDuty:
    Type: AWS::CloudFormation::Stack
    Properties:
      TemplateURL: !Join
        - ''
        - - https://s3.
          - !Ref 'AWS::Region'
          - .
          - !Ref 'AWS::URLSuffix'
          - /
          - !Sub 'superwerker-resources-${AWS::Region}'
          - /1.3.0/e99159748a2470bf540725de63f1579cb8e16236294c7aba8540cb9676e2f6bf.json
    UpdateReplacePolicy: Delete
    DeletionPolicy: Delete
    Metadata:
      aws:cdk:path: SuperwerkerStack/GuardDuty.NestedStack/GuardDuty.NestedStackResource
      aws:asset:path: SuperwerkerStackGuardDutyF56F7940.nested.template.json
      aws:asset:property: TemplateURL
    Condition: IncludeGuardDuty
  Notifications:
    Type: AWS::CloudFormation::Stack
    Properties:
      Parameters:
        NotificationsMail: !Ref 'NotificationsMail'
      TemplateURL: !Join
        - ''
        - - https://s3.
          - !Ref 'AWS::Region'
          - .
          - !Ref 'AWS::URLSuffix'
          - /
          - !Sub 'superwerker-resources-${AWS::Region}'
          - /1.3.0/29e2c00a2b4066fb02c8675327ca7bd1ca0333d31fc9a1afb48cd43c8560c017.json
    DependsOn:
      - RootMail
    UpdateReplacePolicy: Delete
    DeletionPolicy: Delete
    Metadata:
      aws:cdk:path: SuperwerkerStack/Notifications.NestedStack/Notifications.NestedStackResource
      aws:asset:path: SuperwerkerStackNotifications153068C2.nested.template.json
      aws:asset:property: TemplateURL
    Condition: IncludeNotifications
  SecurityHub:
    Type: AWS::CloudFormation::Stack
    Properties:
      TemplateURL: !Join
        - ''
        - - https://s3.
          - !Ref 'AWS::Region'
          - .
          - !Ref 'AWS::URLSuffix'
          - /
          - !Sub 'superwerker-resources-${AWS::Region}'
          - /1.3.0/802a5f84af2bd0bf29ef15ebec4166962b1c70ee28e5bdbd1b92b5b0339c2cf2.json
    UpdateReplacePolicy: Delete
    DeletionPolicy: Delete
    Metadata:
      aws:cdk:path: SuperwerkerStack/SecurityHub.NestedStack/SecurityHub.NestedStackResource
      aws:asset:path: SuperwerkerStackSecurityHubF52922D9.nested.template.json
      aws:asset:property: TemplateURL
    Condition: IncludeSecurityHub
  ServiceControlPolicies:
    Type: AWS::CloudFormation::Stack
    Properties:
      Parameters:
        IncludeBackup: !Ref 'IncludeBackup'
        IncludeSecurityHub: !Ref 'IncludeSecurityHub'
      TemplateURL: !Join
        - ''
        - - https://s3.
          - !Ref 'AWS::Region'
          - .
          - !Ref 'AWS::URLSuffix'
          - /
          - !Sub 'superwerker-resources-${AWS::Region}'
          - /1.3.0/9b19db9e6a696a782dd0fc99171d0639f79e81b8e148aabe0b22d344b91d9c6f.json
    DependsOn:
      - ControlTower
    UpdateReplacePolicy: Delete
    DeletionPolicy: Delete
    Metadata:
      aws:cdk:path: SuperwerkerStack/ServiceControlPolicies.NestedStack/ServiceControlPolicies.NestedStackResource
      aws:asset:path: SuperwerkerStackServiceControlPolicies29C013D1.nested.template.json
      aws:asset:property: TemplateURL
    Condition: IncludeServiceControlPolicies
  Billing:
    Type: AWS::CloudFormation::Stack
    Properties:
      TemplateURL: !Join
        - ''
        - - https://s3.
          - !Ref 'AWS::Region'
          - .
          - !Ref 'AWS::URLSuffix'
          - /
          - !Sub 'superwerker-resources-${AWS::Region}'
          - /1.3.0/40dcc5547fc6164651c379893f6583644ac86ba03148cf2339e6b882faf45fef.json
    DependsOn:
      - ControlTower
    UpdateReplacePolicy: Delete
    DeletionPolicy: Delete
    Metadata:
      aws:cdk:path: SuperwerkerStack/Billing.NestedStack/Billing.NestedStackResource
      aws:asset:path: SuperwerkerStackBilling9A34A7F5.nested.template.json
      aws:asset:property: TemplateURL
Conditions:
  IncludeBackup: !Equals
    - !Ref 'IncludeBackup'
    - 'Yes'
  IncludeBudget: !Equals
    - !Ref 'IncludeBudget'
    - 'Yes'
  IncludeGuardDuty: !Equals
    - !Ref 'IncludeGuardDuty'
    - 'Yes'
  IncludeNotifications: !Not
    - !Equals
      - !Ref 'NotificationsMail'
      - ''
  IncludeSecurityHub: !Equals
    - !Ref 'IncludeSecurityHub'
    - 'Yes'
  IncludeServiceControlPolicies: !Equals
    - !Ref 'IncludeServiceControlPolicies'
    - 'Yes'
