cf-hitman-batch.yml

AWSTemplateFormatVersion: '2010-09-09'
Description: Hitman Batch


Metadata:
  AWS::CloudFormation::Interface:
    ParameterGroups:
      - Label:
          default: 'ComputeEnv network'
        Parameters: ['ComputeEnvVPC', 'ComputeEnvSubnets']
      - Label:
          default: 'ComputeEnv Cpu'
        Parameters: ['ComputeEnvMinCpu', 'ComputeEnvDesiredCpu', 'ComputeEnvMaxCpu']
      - Label:
          default: 'Hitman Role on Spoke accounts'
        Parameters: ['NukeRoleToAssume', 'NukeRoleExternalId']
      - Label:
          default: 'Hitman Role on Organizations account'
        Parameters: ['HitmanOrganizationsAccount', 'HitmanOrganizationsRole']

Parameters:

  TagBlock:
    Description: Applicative block tag
    Type: String

  TagApp:
    Description: Application tag
    Type: String

  TagOrg:
    Description: Organization tag
    Type: String

  HitmanFrequency:
    Description: define execution frequency
    Type: String
    Default: "cron(30 2 ? * SAT *)"

  ComputeEnvVPC:
    Description: compute envs VPC location
    Type: AWS::EC2::VPC::Id

  ComputeEnvSubnets:
    Description: compute envs subnets location
    Type: List<AWS::EC2::Subnet::Id>

  ComputeEnvMinCpu:
    Description: compute env min number of CPUs
    Type: Number
    Default: 0

  ComputeEnvDesiredCpu:
    Description: compute env desired number of CPUs
    Type: Number
    Default: 0

  ComputeEnvMaxCpu:
    Description: compute env max number of CPUs
    Type: Number
    Default: 4

  JobDefinitionMemory:
    Description: job definition memory size
    Type: Number
    Default: 1000

  NukeEcrImage:
    Description: ECR image to use
    Type: String

  NukeRoleToAssume:
    Description: IAM role to assume on the account to Nuke
    Type: String
    Default: hitman-nuke-role

  NukeRoleExternalId:
    Description: Hitman Role External ID
    Type: String

  HitmanOrganizationsAccount:
    Description: Id of the account hosting AWS Organizations
    Type: String

  HitmanOrganizationsRole:
    Description: IAM role to assume on the Organizations account to Hitman
    Type: String
    Default: hitman-organizations-role

  HitmanConfigBucket:
    Description: S3 bucket with Hitman configuration
    Type: String


Resources:

  SecurityGroupForInstances:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupName: !Sub '${TagApp}-instances'
      GroupDescription: Security group for instances
      VpcId: !Ref ComputeEnvVPC
      Tags:
      - Key: Block
        Value: !Ref TagBlock
      - Key: Org
        Value: !Ref TagOrg
      - Key: App
        Value: !Ref TagApp

  SpotFleetRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - "spotfleet.amazonaws.com"
            Action:
              - "sts:AssumeRole"
      ManagedPolicyArns:
      - "arn:aws:iam::aws:policy/service-role/AmazonEC2SpotFleetRole"
      - "arn:aws:iam::aws:policy/service-role/AmazonEC2SpotFleetTaggingRole"
      Tags:
      - Key: Block
        Value: !Ref TagBlock
      - Key: App
        Value: !Ref TagApp
      - Key: Org
        Value: !Ref TagOrg

  HitmanComputeEnv:
    Type: "AWS::Batch::ComputeEnvironment"
    Properties:
      Type: MANAGED
      ServiceRole: !Ref ComputeEnvironmentRole
      ComputeResources:
        MinvCpus: !Ref ComputeEnvMinCpu
        MaxvCpus: !Ref ComputeEnvMaxCpu
        DesiredvCpus: !Ref ComputeEnvDesiredCpu
        SecurityGroupIds:
          - !Ref SecurityGroupForInstances
        Subnets: !Ref ComputeEnvSubnets
        Type: SPOT
        BidPercentage: 50
        SpotIamFleetRole: !Ref SpotFleetRole
        InstanceRole: !Ref EcsInstanceProfile
        InstanceTypes:
          - c3
        Tags: {Name: !Ref TagApp, Block: !Ref TagBlock, App: !Ref TagApp, Org: !Ref TagOrg}
      State: ENABLED

  ComputeEnvironmentRole:
    Type: AWS::IAM::Role
    Properties:
      Path: "/"
      RoleName: !Sub "${TagApp}-compute-environment"
      AssumeRolePolicyDocument:
        Statement:
        - Effect: Allow
          Principal:
            Service:
            - batch.amazonaws.com
          Action:
          - sts:AssumeRole
      ManagedPolicyArns:
      - "arn:aws:iam::aws:policy/service-role/AWSBatchServiceRole"
      Tags:
      - Key: Block
        Value: !Ref TagBlock
      - Key: App
        Value: !Ref TagApp
      - Key: Org
        Value: !Ref TagOrg

  NukeJobQueue:
    Type: "AWS::Batch::JobQueue"
    Properties:
      ComputeEnvironmentOrder:
        - Order: 1
          ComputeEnvironment: !Ref HitmanComputeEnv
      Priority: 1
      JobQueueName: !Sub "${TagApp}-queue"

  EcsInstanceRole:
    Type: AWS::IAM::Role
    Properties:
      Path: "/"
      RoleName: !Sub "${TagApp}-ecsinstance"
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/service-role/AmazonEC2ContainerServiceforEC2Role
      AssumeRolePolicyDocument:
        Statement:
        - Effect: Allow
          Principal:
            Service:
            - ec2.amazonaws.com
          Action:
          - sts:AssumeRole
      Tags:
      - Key: Block
        Value: !Ref TagBlock
      - Key: App
        Value: !Ref TagApp
      - Key: Org
        Value: !Ref TagOrg

  EcsInstanceProfile:
    Type: "AWS::IAM::InstanceProfile"
    Properties:
      Path: "/"
      Roles:
      - !Ref EcsInstanceRole

  HitmanJobDefinition:
    Type: "AWS::Batch::JobDefinition"
    Properties:
      JobDefinitionName: !Sub "${TagApp}-job-definition"
      Type: container
      Parameters: {}
      ContainerProperties:
        Memory: !Ref JobDefinitionMemory
        Privileged: false
        JobRoleArn: !Ref HitmanJobRole
        ReadonlyRootFilesystem: false
        Vcpus: 1
        Image: !Ref NukeEcrImage
        Environment:
          - Name: CONF_BUCKET
            Value: !Ref HitmanConfigBucket
          - Name: NUKE_ROLE_TO_ASSUME
            Value: !Ref NukeRoleToAssume
          - Name: NUKE_ROLE_EXTERNALID
            Value: !Ref NukeRoleExternalId
      RetryStrategy:
        Attempts: 1

  HitmanJobRole:
    Type: AWS::IAM::Role
    Properties:
      Path: "/"
      RoleName: !Sub "${TagApp}-jobrole"
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/service-role/AmazonECSTaskExecutionRolePolicy
      AssumeRolePolicyDocument:
        Statement:
        - Effect: Allow
          Principal:
            Service:
            - ecs-tasks.amazonaws.com
          Action:
          - sts:AssumeRole
      Policies:
      - PolicyName: accessConfigBucketPolicy
        PolicyDocument:
          Statement:
          - Effect: "Allow"
            Action:
            - "s3:ListBucket"
            - "s3:GetObject"
            Resource:
            - !Sub "arn:aws:s3:::${HitmanConfigBucket}"
            - !Sub "arn:aws:s3:::${HitmanConfigBucket}/*"
      - PolicyName: assumeRolePolicy
        PolicyDocument:
          Statement:
          - Effect: "Allow"
            Action:
            - "sts:AssumeRole"
            Resource:
            - !Sub "arn:aws:iam::*:role/${NukeRoleToAssume}"
      Tags:
      - Key: Block
        Value: !Ref TagBlock
      - Key: App
        Value: !Ref TagApp
      - Key: Org
        Value: !Ref TagOrg

  HitmanScheduledRule:
    Type: AWS::Events::Rule
    Properties:
      Description: "ScheduledRule"
      ScheduleExpression: !Ref HitmanFrequency
      State: ENABLED
      Targets:
      - Id: "HitmanSaturday"
        Arn: !GetAtt NukeJobLauncherLambda.Arn
        Input : '{ "mode": "list" }'

  PermissionForRuleToInvokeLambda:
    Type: "AWS::Lambda::Permission"
    Properties:
      FunctionName: !Ref NukeJobLauncherLambda
      Action: "lambda:InvokeFunction"
      Principal: "events.amazonaws.com"
      SourceArn: !GetAtt HitmanScheduledRule.Arn

  NukeJobLauncherLambdaRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: !Sub "${TagApp}-lambda-invoke"
      AssumeRolePolicyDocument:
        Statement:
        - Effect: Allow
          Principal:
            Service: "lambda.amazonaws.com"
          Action:
          - sts:AssumeRole
      Path: "/"
      Policies:
      - PolicyName: accessConfigBucketPolicy
        PolicyDocument:
          Statement:
          - Effect: "Allow"
            Action:
            - "s3:ListBucket"
            - "s3:GetObject"
            Resource:
            - !Sub "arn:aws:s3:::${HitmanConfigBucket}"
            - !Sub "arn:aws:s3:::${HitmanConfigBucket}/*"
      - PolicyName: launch-jobs-allow
        PolicyDocument:
          Statement:
          - Effect: Allow
            Action:
            - logs:PutLogEvents
            - logs:CreateLogGroup
            - logs:CreateLogStream
            Resource:
            - "arn:aws:logs:*:*:*"
          - Effect: Allow
            Action:
            - batch:DescribeJobs
            - batch:ListJobs
            - batch:SubmitJob
            Resource:
            - "*"
      - PolicyName: assumeRoleOrganizationsPolicy
        PolicyDocument:
          Statement:
          - Effect: "Allow"
            Action:
            - "sts:AssumeRole"
            Resource:
            - !Sub "arn:aws:iam::*:role/${HitmanOrganizationsRole}"
      Tags:
      - Key: Block
        Value: !Ref TagBlock
      - Key: App
        Value: !Ref TagApp
      - Key: Org
        Value: !Ref TagOrg

  HitmanLambdaLogGroup:
    Type: "AWS::Logs::LogGroup"
    Properties:
      LogGroupName: !Sub '/aws/lambda/${NukeJobLauncherLambda}'
      RetentionInDays: 30

  NukeJobLauncherLambda:
    Type: "AWS::Lambda::Function"
    Properties:
      FunctionName: !Sub '${TagApp}-launcher'
      Description: "Launch aws-nuke job"
      Handler: "index.lambda_handler"
      Code:
        ZipFile: |
                  import os
                  import json
                  import boto3

                  def lambda_handler(event, context):
                    print("Event received : " + json.dumps(event, indent=2))
                    configMode = event['mode']

                    if configMode == "list":
                      CONFIGFILE_BUCKET = os.environ['CONFIGFILE_BUCKET']
                      CONFIGFILE_NAME = os.environ['CONFIGFILE_NAME']
                      accountIds = getAccountIdsListS3(CONFIGFILE_BUCKET, CONFIGFILE_NAME)
                    elif configMode == "ou":
                      ouId = event['ouId']
                      ORGANIZATIONS_ROLE = os.environ['ORGANIZATIONS_ROLE']
                      ORGANIZATIONS_ACCOUNT = os.environ['ORGANIZATIONS_ACCOUNT']
                      session = get_session(role=ORGANIZATIONS_ROLE, account=ORGANIZATIONS_ACCOUNT, session_name='hitman_lambda')
                      accountIds = getActiveAccountIdsListOu(session, ouId)
                    elif configMode == "standalone":
                      accountIds = [event['accountId']]
                    else:
                      print("No mode detected")
                      accountIds = []
                    print("%s accounts to Nuke : %s" % (len(accountIds), accountIds))

                    client = boto3.client('batch')
                    for accountId in accountIds:
                      response = client.submit_job(
                        jobName=os.environ['JOBNAME'] + "-" + accountId,
                        jobQueue=os.environ['JOBQUEUE'],
                        jobDefinition=os.environ['JOBDEFINITION'],
                        containerOverrides={
                          'environment': [
                            {
                              'name': 'ACCOUNT_TO_NUKE',
                              'value': accountId
                            },
                          ]
                        }
                      )
                      print("Job %s launched with jobId %s to nuke account %s." % (response['jobName'], response['jobId'], accountId))

                  def getAccountIdsListS3(configFileBucket, configFileName):
                    tempFile = '/tmp/accounts.list'
                    accountList=[]
                    s3client = boto3.client('s3')
                    s3client.download_file(configFileBucket, configFileName, tempFile)
                    for line in open(tempFile):
                      li=line.strip()
                      if not li.startswith("#"):
                        accountList.append(line.rstrip())
                    return accountList

                  def getActiveAccountIdsListOu(session, OrganizationUnit):
                    client = session.client('organizations')
                    response = client.list_accounts_for_parent(ParentId=OrganizationUnit)
                    accountsFromOu = response.get('Accounts', [])
                    while(response.get('NextToken') is not None):
                      response = client.list_accounts_for_parent(ParentId=OrganizationUnit, NextToken=response['NextToken'])
                      accountsFromOu.extend(response.get('Accounts', []))
                    activeAccountIds = []
                    activeAccountIds = [account['Id'] for account in accountsFromOu if account['Status'] == "ACTIVE"]
                    return activeAccountIds

                  def get_session(role=None, account=None, region=None, session_name='my_session'):
                    # If the role is given : assumes a role and returns boto3 session
                    # otherwise : returns a regular session with the current IAM user/role
                    if role:
                      client = boto3.client('sts')
                      role_arn = 'arn:aws:iam::' + account + ':role/' + role
                      response = client.assume_role(RoleArn=role_arn, RoleSessionName=session_name)
                      session = boto3.Session(
                        aws_access_key_id=response['Credentials']['AccessKeyId'],
                        aws_secret_access_key=response['Credentials']['SecretAccessKey'],
                        aws_session_token=response['Credentials']['SessionToken'],
                        region_name=region)
                      return session
      Environment:
        Variables:
          JOBNAME: "hitman-job"
          JOBQUEUE: !Ref NukeJobQueue
          JOBDEFINITION: !Ref HitmanJobDefinition
          CONFIGFILE_BUCKET: !Ref HitmanConfigBucket
          CONFIGFILE_NAME: "accounts.list"
          ORGANIZATIONS_ROLE: !Ref HitmanOrganizationsRole
          ORGANIZATIONS_ACCOUNT: !Ref HitmanOrganizationsAccount
      MemorySize: 128
      Role: !GetAtt NukeJobLauncherLambdaRole.Arn
      Runtime: "python3.7"
      Timeout: 60
      Tags:
      - Key: Block
        Value: !Ref TagBlock
      - Key: Org
        Value: !Ref TagOrg
      - Key: App
        Value: !Ref TagApp