aws-servicecatalog-prescriptivecompliance/cft/aws-servicecatalog-prescriptivecompliance-v1.yml [483:816]:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
  ConfigRemediationsConfPackPortfolioAssociation:
    Type: 'AWS::ServiceCatalog::PortfolioProductAssociation'
    Properties:
      PortfolioId: !Ref ConfigRemediationsPortfolio
      ProductId: !Ref ConfigRemediationsCompliance

  TeamMemberEnduserRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: TeamMemberEnduserRole
      ManagedPolicyArns: 
        - arn:aws:iam::aws:policy/AWSServiceCatalogEndUserFullAccess
      Path: /      
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Principal:
              AWS: !Sub 'arn:aws:iam::${AWS::AccountId}:root'
            Action:
              - 'sts:AssumeRole'

  TeamMemberEnduserRolePortfolioAssociation:
    Type: 'AWS::ServiceCatalog::PortfolioPrincipalAssociation'
    Properties:
      PrincipalARN: !Sub 'arn:aws:iam::${AWS::AccountId}:role/TeamRole'
      PortfolioId: !Ref ConfigRemediationsPortfolio
      PrincipalType: IAM


#------------------------------------------------------------------------------------------
# Custom Systems Manager Automation Documents for AWS Config Remediation:
#  -- Small sampling of PCI and CIS violations
#-------------------------------------------------------------------------------------------


# -------------------------------------------------------------------------------------------------------------------------------------------------------
# [PCI.KMS.1] Customer master key (CMK) rotation should be enabled
# -------------------------------------------------------------------------------------------------------------------------------------------------------
  SCCustomCMKBackingKeyRotationCF:
    Type: AWS::SSM::Document
    Properties:
      DocumentType: Automation
      Name: Custom-SCCMKBackingKeyRotationCF
      Content:
        schemaVersion: '0.3'
        assumeRole:
          Fn::Join:
            - ''
            - - 'arn:aws:iam::'
              - Ref: AWS::AccountId
              - ':role/'
              - !Ref SCAutomationAssumeRole
        parameters:
          KMSKeyArn:
            type: String
          AutomationAssumeRole:
            type: String
            default:
              Fn::Join:
                - ''
                - - 'arn:aws:iam::'
                  - Ref: AWS::AccountId
                  - ':role/'
                  - !Ref SCAutomationAssumeRole
        mainSteps:
          - name: rotatebackingkey
            action: 'aws:executeScript'
            inputs:
              Runtime: python3.6
              Handler: rotatebackingkey_handler
              Script: "def rotatebackingkey_handler(events, context):\r\n  import boto3\r\n  client = boto3.client('kms')\r\n\r\n  KMSKeyArn = events['KMSKeyArn']\r\n\r\n  response = client.enable_key_rotation(\r\n    KeyId=KMSKeyArn\r\n  )"
              InputPayload:
                AutomationAssumeRole: '{{AutomationAssumeRole}}'
                KMSKeyArn: '{{KMSKeyArn}}'

# -------------------------------------------------------------------------------------------------------------------------------------------------------
# [PCI.CloudTrail.4] CloudTrail trails should be integrated with CloudWatch Logs
# -------------------------------------------------------------------------------------------------------------------------------------------------------
  SCCustomCloudTrailUpdateCF:
    Type: AWS::SSM::Document
    Properties:
      DocumentType: Automation
      Name: Custom-SCCloudTrailUpdateCF
      Content:
        description: CIS 2.4 – Ensure CloudTrail trails are integrated with Amazon CloudWatch Logs
        schemaVersion: '0.3'
        assumeRole:
          Fn::Join:
            - ''
            - - 'arn:aws:iam::'
              - Ref: AWS::AccountId
              - ':role/'
              - !Ref SCAutomationAssumeRole
        parameters:
          AutomationAssumeRole:
            type: String
            default:
              Fn::Join:
                - ''
                - - 'arn:aws:iam::'
                  - Ref: AWS::AccountId
                  - ':role/'
                  - !Ref SCAutomationAssumeRole
          SCCloudTrailLogGroupArn:
            type: String
            default:
              Fn::Join:
                  - ''
                  - - 'arn:aws:logs:'
                    - Ref: AWS::Region
                    - ':'
                    - Ref: AWS::AccountId
                    - !Sub ':log-group:${SCCloudTrailLogGroup}:*'
          SCCloudWatchRoleArn:
            type: String
            default:
              Fn::Join:
                - ''
                - - 'arn:aws:iam::'
                  - Ref: AWS::AccountId
                  - ':role/'
                  - !Ref SCCloudWatchRole
          TrailName:
            type: String
        mainSteps:
          - name: UpdateCloudTrail
            action: 'aws:executeScript'
            inputs:
              Runtime: python3.6
              Handler: updatetrail_handler
              Script: "def updatetrail_handler(events, context):\r\n  import boto3\r\n  cloudtrail = boto3.client('cloudtrail')\r\n\r\n  CloudTrailLogGroupArn = events['SCCloudTrailLogGroupArn']\r\n  CloudWatchRoleArn = events['SCCloudWatchRoleArn']\r\n  TrailName = events['TrailName']\r\n\r\n  response = cloudtrail.update_trail(\r\n    Name=TrailName,\r\n    IncludeGlobalServiceEvents=True,\r\n    IsMultiRegionTrail=True,\r\n    EnableLogFileValidation=True,\r\n    CloudWatchLogsLogGroupArn=CloudTrailLogGroupArn,\r\n    CloudWatchLogsRoleArn=CloudWatchRoleArn\r\n  )\r\n"
              InputPayload:
                AutomationAssumeRole: '{{AutomationAssumeRole}}'
                SCCloudTrailLogGroupArn: '{{SCCloudTrailLogGroupArn}}'
                SCCloudWatchRoleArn: '{{SCCloudWatchRoleArn}}'
                TrailName: '{{TrailName}}'

# -------------------------------------------------------------------------------------------------------------------------------------------------------
# PCI IAM 4– Updates IAM Account Settings Password Policy
# -------------------------------------------------------------------------------------------------------------------------------------------------------
  SCCustomIAMPasswordUpdateCF:
    Type: AWS::SSM::Document
    Properties:
      DocumentType: Automation
      Name: Custom-SCIAMPasswordUpdateCF
      Content:
        schemaVersion: '0.3'
        assumeRole:
          Fn::Join:
            - ''
            - - 'arn:aws:iam::'
              - Ref: AWS::AccountId
              - ':role/'
              - !Ref SCAutomationAssumeRole
        parameters:
          AutomationAssumeRole:
            type: String
            default:
              Fn::Join:
                - ''
                - - 'arn:aws:iam::'
                  - Ref: AWS::AccountId
                  - ':role/'
                  - !Ref SCAutomationAssumeRole
        mainSteps:
          - name: updatepasswordpolicy
            action: 'aws:executeScript'
            inputs:
              Runtime: python3.6
              Handler: updateiampolicy_handler
              Script: |
                def updateiampolicy_handler(events, context):
                  import boto3
                  iam = boto3.client('iam')
                  
                  response = iam.update_account_password_policy(
                                AllowUsersToChangePassword=True,
                                HardExpiry=True,
                                MaxPasswordAge=90 ,
                                MinimumPasswordLength=14,
                                PasswordReusePrevention=24,
                                RequireLowercaseCharacters=True,
                                RequireNumbers=True,
                                RequireSymbols=True,
                                RequireUppercaseCharacters=True)
              InputPayload:
                AutomationAssumeRole: '{{AutomationAssumeRole}}'

# -------------------------------------------------------------------------------------------------------------------------------------------------------
# [PCI.CloudTrail.3] CloudTrail log file validation should be enabled
# -------------------------------------------------------------------------------------------------------------------------------------------------------
  SCCustomLogFileValidationCF:
    Type: AWS::SSM::Document
    Properties:
      DocumentType: Automation
      Name: Custom-SCLogFileValidationCF
      Content:
        schemaVersion: '0.3'
        assumeRole:
          Fn::Join:
            - ''
            - - 'arn:aws:iam::'
              - Ref: AWS::AccountId
              - ':role/'
              - !Ref SCAutomationAssumeRole
        parameters:
          AutomationAssumeRole:
            type: String
            default:
              Fn::Join:
                - ''
                - - 'arn:aws:iam::'
                  - Ref: AWS::AccountId
                  - ':role/'
                  - !Ref SCAutomationAssumeRole
          SCCloudTrailLogGroupArn:
            type: String
            default:
              Fn::Join:
                  - ''
                  - - 'arn:aws:logs:'
                    - Ref: AWS::Region
                    - ':'
                    - Ref: AWS::AccountId
                    - !Sub ':log-group:${SCCloudTrailLogGroup}:*'
          SCCloudWatchRoleArn:
            type: String
            default:
              Fn::Join:
                - ''
                - - 'arn:aws:iam::'
                  - Ref: AWS::AccountId
                  - ':role/'
                  - !Ref SCCloudWatchRole
          TrailName:
            type: String
        mainSteps:
          - name: EnableLogFileValidation
            action: 'aws:executeScript'
            inputs:
              Runtime: python3.6
              Handler: updatetrail_handler
              Script: "def updatetrail_handler(events, context):\r\n  import boto3\r\n  cloudtrail = boto3.client('cloudtrail')\r\n\r\n  CloudTrailLogGroupArn = events['SCCloudTrailLogGroupArn']\r\n  CloudWatchRoleArn = events['SCCloudWatchRoleArn']\r\n  TrailName = events['TrailName']\r\n\r\n  response = cloudtrail.update_trail(\r\n    Name=TrailName,\r\n    IncludeGlobalServiceEvents=True,\r\n    IsMultiRegionTrail=True,\r\n    EnableLogFileValidation=True,\r\n    CloudWatchLogsLogGroupArn=CloudTrailLogGroupArn,\r\n    CloudWatchLogsRoleArn=CloudWatchRoleArn\r\n  )   "
              InputPayload:
                AutomationAssumeRole: '{{AutomationAssumeRole}}'
                SCCloudTrailLogGroupArn: '{{SCCloudTrailLogGroupArn}}'
                SCCloudWatchRoleArn: '{{SCCloudWatchRoleArn}}'
                TrailName: '{{TrailName}}'

# -------------------------------------------------------------------------------------------------------------------------------------------------------
# [PCI.EC2.2] VPC default security group should prohibit inbound and outbound traffic
# -------------------------------------------------------------------------------------------------------------------------------------------------------
  SCRestrictSecurityGroupPublicAccess:
    Type: AWS::SSM::Document
    Properties:
      DocumentType: Automation
      Name: Custom-SCRestrictSecurityGroup
      Content:
        schemaVersion: '0.3'
        assumeRole:
          Fn::Join:
            - ''
            - - 'arn:aws:iam::'
              - Ref: AWS::AccountId
              - ':role/'
              - !Ref SCAutomationAssumeRole
        parameters:
          groupId:
            type: String
          IpAddressToBlock:
            type: String
            default: '0.0.0.0/0'
          AutomationAssumeRole:
            type: String
            default:
              Fn::Join:
                - ''
                - - 'arn:aws:iam::'
                  - Ref: AWS::AccountId
                  - ':role/'
                  - !Ref SCAutomationAssumeRole
        mainSteps:
          - name: RestrictSecurityGroup
            action: 'aws:executeScript'
            inputs:
              Runtime: python3.6
              Handler: restrict_sg
              Script: "def restrict_sg(events, context):\r\n  import boto3\r\n  import json\r\n  import os\r\n  ec2 = boto3.resource('ec2')\r\n  defaultSecGroupId = events['groupId']\r\n  try:\r\n      defaultSG = ec2.SecurityGroup(defaultSecGroupId)\r\n      defaultIngress = defaultSG.ip_permissions\r\n      defaultEgress = defaultSG.ip_permissions_egress\r\n      revokeIngress = defaultSG.revoke_ingress(IpPermissions=defaultIngress)\r\n      revokeEgress = defaultSG.revoke_egress(IpPermissions=defaultEgress)\r\n  except Exception as e:\r\n      print(e)"
              InputPayload:
                AutomationAssumeRole: '{{AutomationAssumeRole}}'
                groupId: '{{groupId}}'
                IpAddressToBlock: '{{IpAddressToBlock}}'


# -------------------------------------------------------------------------------------------------------------------------------------------------------
# [PCI.EC2.4] Unused EC2 EIPs should be removed
# -------------------------------------------------------------------------------------------------------------------------------------------------------
  SCReleaseEIP:
    Type: AWS::SSM::Document
    Properties:
      DocumentType: Automation
      Name: Custom-SCReleaseEIP
      Content:
        schemaVersion: '0.3'
        assumeRole:
          Fn::Join:
            - ''
            - - 'arn:aws:iam::'
              - Ref: AWS::AccountId
              - ':role/'
              - !Ref SCAutomationAssumeRole
        parameters:
          AutomationAssumeRole:
            type: String
            default:
              Fn::Join:
                - ''
                - - 'arn:aws:iam::'
                  - Ref: AWS::AccountId
                  - ':role/'
                  - !Ref SCAutomationAssumeRole
          allocationId:
            type: String       
        mainSteps:
          - name: ReleaseEIP
            action: 'aws:executeScript'
            inputs:
              Runtime: python3.6
              Handler: script_handler
              Script: "def script_handler(events, context):\r\n  import boto3\r\n  client = boto3.client('ec2')\r\n\r\n  allocationId = events['allocationId']\r\n\r\n  response = client.release_address(\r\n    AllocationId= allocationId\r\n  )"
              InputPayload:
                AutomationAssumeRole: '{{AutomationAssumeRole}}'
                allocationId: '{{allocationId}}'
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -



aws-servicecatalog-prescriptivecompliance/cft/aws-servicecatalog-prescriptivecompliance.yml [468:801]:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
  ConfigRemediationsConfPackPortfolioAssociation:
    Type: 'AWS::ServiceCatalog::PortfolioProductAssociation'
    Properties:
      PortfolioId: !Ref ConfigRemediationsPortfolio
      ProductId: !Ref ConfigRemediationsCompliance

  TeamMemberEnduserRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: TeamMemberEnduserRole
      ManagedPolicyArns: 
        - arn:aws:iam::aws:policy/AWSServiceCatalogEndUserFullAccess
      Path: /      
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Principal:
              AWS: !Sub 'arn:aws:iam::${AWS::AccountId}:root'
            Action:
              - 'sts:AssumeRole'

  TeamMemberEnduserRolePortfolioAssociation:
    Type: 'AWS::ServiceCatalog::PortfolioPrincipalAssociation'
    Properties:
      PrincipalARN: !Sub 'arn:aws:iam::${AWS::AccountId}:role/TeamRole'
      PortfolioId: !Ref ConfigRemediationsPortfolio
      PrincipalType: IAM


#------------------------------------------------------------------------------------------
# Custom Systems Manager Automation Documents for AWS Config Remediation:
#  -- Small sampling of PCI and CIS violations
#-------------------------------------------------------------------------------------------


# -------------------------------------------------------------------------------------------------------------------------------------------------------
# [PCI.KMS.1] Customer master key (CMK) rotation should be enabled
# -------------------------------------------------------------------------------------------------------------------------------------------------------
  SCCustomCMKBackingKeyRotationCF:
    Type: AWS::SSM::Document
    Properties:
      DocumentType: Automation
      Name: Custom-SCCMKBackingKeyRotationCF
      Content:
        schemaVersion: '0.3'
        assumeRole:
          Fn::Join:
            - ''
            - - 'arn:aws:iam::'
              - Ref: AWS::AccountId
              - ':role/'
              - !Ref SCAutomationAssumeRole
        parameters:
          KMSKeyArn:
            type: String
          AutomationAssumeRole:
            type: String
            default:
              Fn::Join:
                - ''
                - - 'arn:aws:iam::'
                  - Ref: AWS::AccountId
                  - ':role/'
                  - !Ref SCAutomationAssumeRole
        mainSteps:
          - name: rotatebackingkey
            action: 'aws:executeScript'
            inputs:
              Runtime: python3.6
              Handler: rotatebackingkey_handler
              Script: "def rotatebackingkey_handler(events, context):\r\n  import boto3\r\n  client = boto3.client('kms')\r\n\r\n  KMSKeyArn = events['KMSKeyArn']\r\n\r\n  response = client.enable_key_rotation(\r\n    KeyId=KMSKeyArn\r\n  )"
              InputPayload:
                AutomationAssumeRole: '{{AutomationAssumeRole}}'
                KMSKeyArn: '{{KMSKeyArn}}'

# -------------------------------------------------------------------------------------------------------------------------------------------------------
# [PCI.CloudTrail.4] CloudTrail trails should be integrated with CloudWatch Logs
# -------------------------------------------------------------------------------------------------------------------------------------------------------
  SCCustomCloudTrailUpdateCF:
    Type: AWS::SSM::Document
    Properties:
      DocumentType: Automation
      Name: Custom-SCCloudTrailUpdateCF
      Content:
        description: CIS 2.4 – Ensure CloudTrail trails are integrated with Amazon CloudWatch Logs
        schemaVersion: '0.3'
        assumeRole:
          Fn::Join:
            - ''
            - - 'arn:aws:iam::'
              - Ref: AWS::AccountId
              - ':role/'
              - !Ref SCAutomationAssumeRole
        parameters:
          AutomationAssumeRole:
            type: String
            default:
              Fn::Join:
                - ''
                - - 'arn:aws:iam::'
                  - Ref: AWS::AccountId
                  - ':role/'
                  - !Ref SCAutomationAssumeRole
          SCCloudTrailLogGroupArn:
            type: String
            default:
              Fn::Join:
                  - ''
                  - - 'arn:aws:logs:'
                    - Ref: AWS::Region
                    - ':'
                    - Ref: AWS::AccountId
                    - !Sub ':log-group:${SCCloudTrailLogGroup}:*'
          SCCloudWatchRoleArn:
            type: String
            default:
              Fn::Join:
                - ''
                - - 'arn:aws:iam::'
                  - Ref: AWS::AccountId
                  - ':role/'
                  - !Ref SCCloudWatchRole
          TrailName:
            type: String
        mainSteps:
          - name: UpdateCloudTrail
            action: 'aws:executeScript'
            inputs:
              Runtime: python3.6
              Handler: updatetrail_handler
              Script: "def updatetrail_handler(events, context):\r\n  import boto3\r\n  cloudtrail = boto3.client('cloudtrail')\r\n\r\n  CloudTrailLogGroupArn = events['SCCloudTrailLogGroupArn']\r\n  CloudWatchRoleArn = events['SCCloudWatchRoleArn']\r\n  TrailName = events['TrailName']\r\n\r\n  response = cloudtrail.update_trail(\r\n    Name=TrailName,\r\n    IncludeGlobalServiceEvents=True,\r\n    IsMultiRegionTrail=True,\r\n    EnableLogFileValidation=True,\r\n    CloudWatchLogsLogGroupArn=CloudTrailLogGroupArn,\r\n    CloudWatchLogsRoleArn=CloudWatchRoleArn\r\n  )\r\n"
              InputPayload:
                AutomationAssumeRole: '{{AutomationAssumeRole}}'
                SCCloudTrailLogGroupArn: '{{SCCloudTrailLogGroupArn}}'
                SCCloudWatchRoleArn: '{{SCCloudWatchRoleArn}}'
                TrailName: '{{TrailName}}'

# -------------------------------------------------------------------------------------------------------------------------------------------------------
# PCI IAM 4– Updates IAM Account Settings Password Policy
# -------------------------------------------------------------------------------------------------------------------------------------------------------
  SCCustomIAMPasswordUpdateCF:
    Type: AWS::SSM::Document
    Properties:
      DocumentType: Automation
      Name: Custom-SCIAMPasswordUpdateCF
      Content:
        schemaVersion: '0.3'
        assumeRole:
          Fn::Join:
            - ''
            - - 'arn:aws:iam::'
              - Ref: AWS::AccountId
              - ':role/'
              - !Ref SCAutomationAssumeRole
        parameters:
          AutomationAssumeRole:
            type: String
            default:
              Fn::Join:
                - ''
                - - 'arn:aws:iam::'
                  - Ref: AWS::AccountId
                  - ':role/'
                  - !Ref SCAutomationAssumeRole
        mainSteps:
          - name: updatepasswordpolicy
            action: 'aws:executeScript'
            inputs:
              Runtime: python3.6
              Handler: updateiampolicy_handler
              Script: |
                def updateiampolicy_handler(events, context):
                  import boto3
                  iam = boto3.client('iam')
                  
                  response = iam.update_account_password_policy(
                                AllowUsersToChangePassword=True,
                                HardExpiry=True,
                                MaxPasswordAge=90 ,
                                MinimumPasswordLength=14,
                                PasswordReusePrevention=24,
                                RequireLowercaseCharacters=True,
                                RequireNumbers=True,
                                RequireSymbols=True,
                                RequireUppercaseCharacters=True)
              InputPayload:
                AutomationAssumeRole: '{{AutomationAssumeRole}}'

# -------------------------------------------------------------------------------------------------------------------------------------------------------
# [PCI.CloudTrail.3] CloudTrail log file validation should be enabled
# -------------------------------------------------------------------------------------------------------------------------------------------------------
  SCCustomLogFileValidationCF:
    Type: AWS::SSM::Document
    Properties:
      DocumentType: Automation
      Name: Custom-SCLogFileValidationCF
      Content:
        schemaVersion: '0.3'
        assumeRole:
          Fn::Join:
            - ''
            - - 'arn:aws:iam::'
              - Ref: AWS::AccountId
              - ':role/'
              - !Ref SCAutomationAssumeRole
        parameters:
          AutomationAssumeRole:
            type: String
            default:
              Fn::Join:
                - ''
                - - 'arn:aws:iam::'
                  - Ref: AWS::AccountId
                  - ':role/'
                  - !Ref SCAutomationAssumeRole
          SCCloudTrailLogGroupArn:
            type: String
            default:
              Fn::Join:
                  - ''
                  - - 'arn:aws:logs:'
                    - Ref: AWS::Region
                    - ':'
                    - Ref: AWS::AccountId
                    - !Sub ':log-group:${SCCloudTrailLogGroup}:*'
          SCCloudWatchRoleArn:
            type: String
            default:
              Fn::Join:
                - ''
                - - 'arn:aws:iam::'
                  - Ref: AWS::AccountId
                  - ':role/'
                  - !Ref SCCloudWatchRole
          TrailName:
            type: String
        mainSteps:
          - name: EnableLogFileValidation
            action: 'aws:executeScript'
            inputs:
              Runtime: python3.6
              Handler: updatetrail_handler
              Script: "def updatetrail_handler(events, context):\r\n  import boto3\r\n  cloudtrail = boto3.client('cloudtrail')\r\n\r\n  CloudTrailLogGroupArn = events['SCCloudTrailLogGroupArn']\r\n  CloudWatchRoleArn = events['SCCloudWatchRoleArn']\r\n  TrailName = events['TrailName']\r\n\r\n  response = cloudtrail.update_trail(\r\n    Name=TrailName,\r\n    IncludeGlobalServiceEvents=True,\r\n    IsMultiRegionTrail=True,\r\n    EnableLogFileValidation=True,\r\n    CloudWatchLogsLogGroupArn=CloudTrailLogGroupArn,\r\n    CloudWatchLogsRoleArn=CloudWatchRoleArn\r\n  )   "
              InputPayload:
                AutomationAssumeRole: '{{AutomationAssumeRole}}'
                SCCloudTrailLogGroupArn: '{{SCCloudTrailLogGroupArn}}'
                SCCloudWatchRoleArn: '{{SCCloudWatchRoleArn}}'
                TrailName: '{{TrailName}}'

# -------------------------------------------------------------------------------------------------------------------------------------------------------
# [PCI.EC2.2] VPC default security group should prohibit inbound and outbound traffic
# -------------------------------------------------------------------------------------------------------------------------------------------------------
  SCRestrictSecurityGroupPublicAccess:
    Type: AWS::SSM::Document
    Properties:
      DocumentType: Automation
      Name: Custom-SCRestrictSecurityGroup
      Content:
        schemaVersion: '0.3'
        assumeRole:
          Fn::Join:
            - ''
            - - 'arn:aws:iam::'
              - Ref: AWS::AccountId
              - ':role/'
              - !Ref SCAutomationAssumeRole
        parameters:
          groupId:
            type: String
          IpAddressToBlock:
            type: String
            default: '0.0.0.0/0'
          AutomationAssumeRole:
            type: String
            default:
              Fn::Join:
                - ''
                - - 'arn:aws:iam::'
                  - Ref: AWS::AccountId
                  - ':role/'
                  - !Ref SCAutomationAssumeRole
        mainSteps:
          - name: RestrictSecurityGroup
            action: 'aws:executeScript'
            inputs:
              Runtime: python3.6
              Handler: restrict_sg
              Script: "def restrict_sg(events, context):\r\n  import boto3\r\n  import json\r\n  import os\r\n  ec2 = boto3.resource('ec2')\r\n  defaultSecGroupId = events['groupId']\r\n  try:\r\n      defaultSG = ec2.SecurityGroup(defaultSecGroupId)\r\n      defaultIngress = defaultSG.ip_permissions\r\n      defaultEgress = defaultSG.ip_permissions_egress\r\n      revokeIngress = defaultSG.revoke_ingress(IpPermissions=defaultIngress)\r\n      revokeEgress = defaultSG.revoke_egress(IpPermissions=defaultEgress)\r\n  except Exception as e:\r\n      print(e)"
              InputPayload:
                AutomationAssumeRole: '{{AutomationAssumeRole}}'
                groupId: '{{groupId}}'
                IpAddressToBlock: '{{IpAddressToBlock}}'


# -------------------------------------------------------------------------------------------------------------------------------------------------------
# [PCI.EC2.4] Unused EC2 EIPs should be removed
# -------------------------------------------------------------------------------------------------------------------------------------------------------
  SCReleaseEIP:
    Type: AWS::SSM::Document
    Properties:
      DocumentType: Automation
      Name: Custom-SCReleaseEIP
      Content:
        schemaVersion: '0.3'
        assumeRole:
          Fn::Join:
            - ''
            - - 'arn:aws:iam::'
              - Ref: AWS::AccountId
              - ':role/'
              - !Ref SCAutomationAssumeRole
        parameters:
          AutomationAssumeRole:
            type: String
            default:
              Fn::Join:
                - ''
                - - 'arn:aws:iam::'
                  - Ref: AWS::AccountId
                  - ':role/'
                  - !Ref SCAutomationAssumeRole
          allocationId:
            type: String       
        mainSteps:
          - name: ReleaseEIP
            action: 'aws:executeScript'
            inputs:
              Runtime: python3.6
              Handler: script_handler
              Script: "def script_handler(events, context):\r\n  import boto3\r\n  client = boto3.client('ec2')\r\n\r\n  allocationId = events['allocationId']\r\n\r\n  response = client.release_address(\r\n    AllocationId= allocationId\r\n  )"
              InputPayload:
                AutomationAssumeRole: '{{AutomationAssumeRole}}'
                allocationId: '{{allocationId}}'
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -



