lambda.yaml

AWSTemplateFormatVersion: '2010-09-09'
Description: >
  This CloudFormation template creates simple Lambda functions,
  which prints CloudFormation resource Arn from the stack.  

Metadata:
  AWS::CloudFormation::Interface:
    ParameterGroups:
      - Label:
          default: Advanced Settings
        Parameters:
          - LambdaFunctionLayerARN
    ParameterLabels:
      LambdaFunctionLayerARN:
        default : Lambda Layer Arn

Parameters:

  LambdaFunctionLayerARN:
    Type: String
    Default: 'None'
    Description: Provide Arn of the layer need to attach to Lambda Function


Resources:
  LambdaExecutionRole:
    Type: AWS::IAM::Role
    Properties: 
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - lambda.amazonaws.com
            Action:
              - 'sts:AssumeRole'
      Path: /
      Description: Role for the execution of Lambda function
      ManagedPolicyArns: 
        - "arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"

  LambdaFunctionRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
        - Effect: Allow
          Principal:
            Service:
              - lambda.amazonaws.com
          Action:
            - sts:AssumeRole
      Path: "/"
      RoleName: !Join ['-', [!Ref 'AWS::StackName', Role, !Ref 'AWS::Region']]
      Policies:
      - PolicyName: LambdaFunctionPolicy
        PolicyDocument:
          Version: '2012-10-17'
          Statement:
          - Effect: Allow
            Action:
              - logs:CreateLogGroup
              - logs:CreateLogStream
              - logs:PutLogEvents
            Resource: '*'

  LambdaFunction:
    Type: AWS::Lambda::Function
    Properties:
      Runtime: python3.6
      Timeout: 5
      Handler: index.handler
      Role: !GetAtt LambdaFunctionRole.Arn
      FunctionName: !Join ['-', [!Ref 'AWS::StackName', Lambdafunction, !Ref 'AWS::Region']]  # Added Function name
      Environment:
        Variables:
          WEBHOOK_URL: "https://hooks.slack.com/"
          CHANNEL: "#aakashtestchannel"
      Layers: 
        - !Ref LambdaFunctionLayerARN
      Code:
        ZipFile:
          !Sub
            - |-
              #!/usr/bin/env python3

              import json
              import logging
              import os
              import requests


              def lambda_handler(event, context):
                  detail = event["detail"]
                  username = detail["userIdentity"]["arn"]
                  event_type = detail["eventName"]
                  region = detail["awsRegion"]
                  user_agent = detail["userAgent"]
                  webacl = detail["requestParameter"]["name"]
                
                  title_text = "AWS EventBridge Alarm."
                  alarm_description = "User : " + str(username) + "\n Event : " + str(event_type) + "\n Region : " + str(region) + "\n User-Agent : " + str(user_agent) + "\n Web-ACL" + str(webacl)
                  payload = {
                      "channel": os.environ.get("CHANNEL"),
                      "text": title_text,
                      "blocks": [
                        {
                          "type": "section",
                          "text": {
                            "type": "mrkdwn",
                            "text": f"*Reason*:\n ```{alarm_description}```"
                          }
                        }
                      ]
                    
                  }
                  
                  webhook_url = os.environ.get("WEBHOOK_URL")
                  response = requests.post(webhook_url, json=payload, headers={'Content-Type': 'application/json'})
                  print(response.text)              
            -
              lambda_function_role_arn: !Ref LambdaFunctionRole

  EventBridgeWAF:
    Type: AWS::Events::Rule
    Properties: 
      Description: Rule for Alert on any changes on WAF on console.
      EventPattern:
        source:
          - aws.wafv2
        detail:
          eventSource:
            - wafv2.amazonaws.com
          eventName:
            - UpdateWebACL
      Name: EventBridgeWAF
      Targets: 
        - Arn: !GetAtt LambdaFunction.Arn
          Id: EventBridgeWAFLambdaFunction
  
  LambdaInvokePermission: 
    Type: AWS::Lambda::Permission
    Properties: 
      Action: lambda:InvokeFunction
      Principal: events.amazonaws.com
      SourceArn:  !GetAtt EventBridgeWAF.Arn
      FunctionName: !Ref LambdaFunction