aws-servicecatalog-prescriptivecompliance/cft/aws-servicecatalog-prescriptivecompliance-v1.yml [16:113]:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Parameters:
  S3StagingBucketURL:
    Type: String
    Description: S3 Staging Bucket Prefix that contains the Config Remediations Compliance template
    Default: 'https://s3-configremediations-<accountid>-<region>.s3.amazonaws.com/'

Outputs:

  SCAutomationAssumeRoleArn:
    Description: Arn for SC AutomationAssumeRole
    Value:
      Fn::Join:
        - ''
        - - 'arn:aws:iam::'
          - Ref: AWS::AccountId
          - ':role/'
          - !Ref SCAutomationAssumeRole
    Export: # added to export
      Name: SCAutomationAssumeRoleArn
 
  SCCloudTrailLogGroupArn:
    Description: Arn for SC CloudTrail CloudWatch Logs
    Value:
      Fn::Join:
          - ''
          - - 'arn:aws:logs:'
            - Ref: AWS::Region
            - ':'
            - Ref: AWS::AccountId
            - !Sub ':log-group:${SCCloudTrailLogGroup}:*'
    Export: # added to export
      Name: SCCloudTrailLogGroupArn

  SCS3CloudTrailBucket:
    Description: SC S3 CloudTrail Bucket
    Value: !Ref SCS3CloudTrailBucket
    Export: # added to export
      Name: SCS3CloudTrailBucket
  
  SCCloudTrailLogGroup:
    Description: SC CloudTrail CloudWatch Log Group
    Value: !Ref SCCloudTrailLogGroup
    Export: # added to export
      Name: SCCloudTrailLogGroup
  
  SCCloudTrail:
    Description: SC CloudTrail
    Value: 'remediation-sc-trail'
    Export: # added to export
      Name: SCCloudTrail
  
  SCCloudWatchRoleArn:
    Description: Arn for CloudTrail CloudWatch IAM Role 
    Value:
      Fn::Join:
        - ''
        - - 'arn:aws:iam::'
          - Ref: AWS::AccountId
          - ':role/'
          - !Ref SCCloudWatchRole
    Export: # added to export
      Name: SCCloudWatchRoleArn

  MisconfiguredTrail:
    Description: CloudTrail with Log File Validation and CW Logs Disabled
    Value: !Ref MisconfiguredTrail
    Export: # added to export
      Name: MisconfiguredTrail

  MisconfiguredKmsKey:
    Description: KMS Key with 
    Value: !Ref MisconfiguredKmsKey
    Export: # added to export
      Name: MisconfiguredKmsKey

  MisconfiguredEIP:
    Description: CIS CloudTrail CloudWatch Log Group
    Value: !Ref MisconfiguredEIP
    Export: # added to export
      Name: MisconfiguredEIP

Resources:

# ------------------------------------------------------------------------------------------
# Pre-requisites
# Provisions all pre-req AWS Services for AWS Config Remediations via Systems Manager Automations
#
# ---------------------------------------------------------------------------------------------

# Bucket Policy for CloudTrail S3 Bucket. Restrict to allow access to only SSL transport.
  SCBucketPolicy:
    Type: AWS::S3::BucketPolicy
    Properties:
      Bucket: !Ref SCS3CloudTrailBucket
      PolicyDocument:
        Statement:
          -
            Action:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -



aws-servicecatalog-prescriptivecompliance/cft/aws-servicecatalog-prescriptivecompliance.yml [16:113]:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Parameters:
  S3StagingBucketURL:
    Type: String
    Description: S3 Staging Bucket Prefix that contains the Config Remediations Compliance template
    Default: 'https://s3-configremediations-<accountid>-<region>.s3.amazonaws.com/'

Outputs:

  SCAutomationAssumeRoleArn:
    Description: Arn for SC AutomationAssumeRole
    Value:
      Fn::Join:
        - ''
        - - 'arn:aws:iam::'
          - Ref: AWS::AccountId
          - ':role/'
          - !Ref SCAutomationAssumeRole
    Export: # added to export
      Name: SCAutomationAssumeRoleArn
 
  SCCloudTrailLogGroupArn:
    Description: Arn for SC CloudTrail CloudWatch Logs
    Value:
      Fn::Join:
          - ''
          - - 'arn:aws:logs:'
            - Ref: AWS::Region
            - ':'
            - Ref: AWS::AccountId
            - !Sub ':log-group:${SCCloudTrailLogGroup}:*'
    Export: # added to export
      Name: SCCloudTrailLogGroupArn

  SCS3CloudTrailBucket:
    Description: SC S3 CloudTrail Bucket
    Value: !Ref SCS3CloudTrailBucket
    Export: # added to export
      Name: SCS3CloudTrailBucket
  
  SCCloudTrailLogGroup:
    Description: SC CloudTrail CloudWatch Log Group
    Value: !Ref SCCloudTrailLogGroup
    Export: # added to export
      Name: SCCloudTrailLogGroup
  
  SCCloudTrail:
    Description: SC CloudTrail
    Value: 'remediation-sc-trail'
    Export: # added to export
      Name: SCCloudTrail
  
  SCCloudWatchRoleArn:
    Description: Arn for CloudTrail CloudWatch IAM Role 
    Value:
      Fn::Join:
        - ''
        - - 'arn:aws:iam::'
          - Ref: AWS::AccountId
          - ':role/'
          - !Ref SCCloudWatchRole
    Export: # added to export
      Name: SCCloudWatchRoleArn

  MisconfiguredTrail:
    Description: CloudTrail with Log File Validation and CW Logs Disabled
    Value: !Ref MisconfiguredTrail
    Export: # added to export
      Name: MisconfiguredTrail

  MisconfiguredKmsKey:
    Description: KMS Key with 
    Value: !Ref MisconfiguredKmsKey
    Export: # added to export
      Name: MisconfiguredKmsKey

  MisconfiguredEIP:
    Description: CIS CloudTrail CloudWatch Log Group
    Value: !Ref MisconfiguredEIP
    Export: # added to export
      Name: MisconfiguredEIP

Resources:

# ------------------------------------------------------------------------------------------
# Pre-requisites
# Provisions all pre-req AWS Services for AWS Config Remediations via Systems Manager Automations
#
# ---------------------------------------------------------------------------------------------

# Bucket Policy for CloudTrail S3 Bucket. Restrict to allow access to only SSL transport.
  SCBucketPolicy:
    Type: AWS::S3::BucketPolicy
    Properties:
      Bucket: !Ref SCS3CloudTrailBucket
      PolicyDocument:
        Statement:
          -
            Action:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -



