template.yaml

AWSTemplateFormatVersion: '2010-09-09'
Transform: AWS::Serverless-2016-10-31
Description: 'AWS CloudFormation drift-detector to Slack'
Parameters:
  DriftDetectionQueueName:
    Description: 'SQS queue name'
    Type: String
    AllowedPattern: '^[-a-zA-Z0-9_]{1,75}$'
    Default: 'DriftDetectionQueue'
  SlackWebhook:
    Description: 'Webhook used to post messages about drift detection'
    Type: String
  Cron:
    Default: '0 0 */12 * ? *'
    Description: 'Interval at which drift detector should scan stacks'
    Type: String
  ShowInSyncResources:
    AllowedValues:
      - 'true'
      - 'false'
    Default: 'false'
    Description: 'Switch to display resources that have no drift (in sync)'
    Type: String
  ShowInSyncStacks:
    AllowedValues:
      - 'true'
      - 'false'
    Default: 'false'
    Description: 'Switch to display stacks that have no drift (in sync)'
    Type: String
  StackRegex:
    Default: '.*'
    Description: 'Regex to define which stacks should scanned. This is using python style regex ("re" module). Example: to only monitor stacks with "prod" in their name, use ".*prod.*"'
    Type: String
  StackBatches:
    Default: 10
    Description: 'Number that indicates how many stacks should be send to sqs in one batch'
    Type: Number
  DriftDetectionMaxRetries:
    Default: 5
    Description: 'Number indicating how many retries to make after an unsuccessful drift detection'
    Type: Number
Globals:
  Function:
    Timeout: 900
Metadata:
  AWS::ServerlessRepo::Application:
    Name: slack-drift-detector-notification
    Description: 'Serverless stack which notifies you about drift detection on your Slack channel. You can specify which stacks should be checked, and at what interval.'
    Author: pattern-match-team
    SpdxLicenseId: Apache-2.0
    LicenseUrl: docs/LICENCE
    ReadmeUrl: docs/README.md
    Labels: [ 'cloudformation', 'slack', 'drift' ]
    HomePageUrl: https://driftdetector.com
    SemanticVersion: 2.2.1
    SourceCodeUrl: https://github.com/patternmatch/aws-drift-detector-slack

Resources:
  DiscoverStacksFunction:
    Type: AWS::Serverless::Function
    Properties:
      CodeUri: drift_detector/
      Handler: discover_stacks.lambda_handler
      Runtime: python3.7
      Policies:
        - SQSSendMessagePolicy:
            QueueName:
              Fn::GetAtt:
                - DriftDetectionQueue
                - QueueName
        - Statement:
            - Sid: DiscoverCloudFormationPolicy
              Effect: Allow
              Action:
                - cloudformation:DescribeStacks
              Resource: '*'
      Environment:
        Variables:
          STACK_REGEX:
            Ref: StackRegex
          DRIFT_DETECTION_QUEUE:
            Ref: DriftDetectionQueue
          STACK_BATCHES:
            Ref: StackBatches
      Events:
        RunOnSchedule:
          Type: Schedule
          Properties:
            Schedule:
              Fn::Sub: cron(${Cron})

  DriftDetectorFunction:
    Type: AWS::Serverless::Function
    Properties:
      CodeUri: drift_detector/
      Handler: drift_detector.lambda_handler
      Runtime: python3.7
      Policies:
        - ReadOnlyAccess
        - SQSPollerPolicy:
            QueueName:
              Fn::GetAtt:
                - DriftDetectionQueue
                - QueueName
        - LambdaInvokePolicy:
            FunctionName:
              Ref: SlackNotificationFuntion
      Environment:
        Variables:
          SLACK_NOTIFICATION_FUNCTION:
            Ref: SlackNotificationFuntion
          DRIFT_DETECTION_MAX_RETRIES:
            Ref: DriftDetectionMaxRetries
      Events:
        SQSEvent:
          Type: SQS
          Properties:
            Queue:
              Fn::GetAtt:
                - DriftDetectionQueue
                - Arn
            BatchSize: 1
            Enabled: true

  SlackNotificationFuntion:
    Type: AWS::Serverless::Function
    Properties:
      CodeUri: drift_detector/
      Handler: slack_notification.lambda_handler
      Runtime: python3.7
      Environment:
        Variables:
          SLACK_WEBHOOK:
            Ref: SlackWebhook
          SHOW_IN_SYNC_RESOURCES:
            Ref: ShowInSyncResources
          SHOW_IN_SYNC_STACKS:
            Ref: ShowInSyncStacks

  DriftDetectionQueue:
    Type: AWS::SQS::Queue
    Properties:
      QueueName: !Sub '${DriftDetectionQueueName}.fifo'
      FifoQueue: true
      VisibilityTimeout: 900
      ContentBasedDeduplication: true