template.yaml

AWSTemplateFormatVersion: '2010-09-09'
Transform: AWS::Serverless-2016-10-31
Description: AWS Budget making lambda

Globals:
  Function:
    Timeout: 30

Parameters:
  EndUserRoleName:
    Description: 'The name of the AWS IAM role used to access the Service Catalog'
    Type: String
    Default: 'ServiceCatalogExternalEndusers'
  Thresholds:
    Description: 'Yaml string defining thresholds for budget notifications'
    Type: String
  BudgetRules:
    Description: 'Yaml string defining rules for creating AWS budgets'
    Type: String

Resources:
  BudgetMakerFunction:
    Type: AWS::Serverless::Function
    Properties:
      CodeUri: .
      Handler: budget.app.lambda_handler
      Runtime: python3.11
      Role: !GetAtt BudgetMakerFunctionRole.Arn
      Environment:
        Variables:
          NOTIFICATION_TOPIC_ARN: !Ref BudgetMakerNotificationTopic
          AWS_ACCOUNT_ID: !Ref 'AWS::AccountId'
          BUDGET_RULES: !Ref BudgetRules
          THRESHOLDS: !Ref Thresholds
          END_USER_ROLE_NAME: !Ref EndUserRoleName
      Events:
        FiveMinute: # Trigger every five minutes
          Type: Schedule
          Properties:
            Schedule: rate(5 minutes)

  BudgetMakerFunctionRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - lambda.amazonaws.com
            Action:
              - sts:AssumeRole
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole
        - !Ref BudgetMakerFunctionPolicy

  BudgetMakerFunctionPolicy:
    Type: AWS::IAM::ManagedPolicy
    Properties:
      PolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Sid: BudgetReadWrite
            Effect: 'Allow'
            Action:
              - budgets:ViewBudget
              - budgets:ModifyBudget
            Resource: '*'

  BudgetMakerNotificationTopic:
    Type: AWS::SNS::Topic

  BudgetMakerNotificationTopicPolicy:
    Type: AWS::SNS::TopicPolicy
    Properties:
      PolicyDocument:
        Version: '2012-10-17'
        Statement:
        - Sid: BudgetNotificationPublication
          Effect: Allow
          Principal:
            Service: 'budgets.amazonaws.com'
          Action: sns:Publish
          Resource: '*'
      Topics:
        - !Ref BudgetMakerNotificationTopic

Outputs:
  BudgetMakerFunctionArn:
    Description: 'Budget-making Lambda Function ARN'
    Value: !GetAtt BudgetMakerFunction.Arn
    Export:
      Name: !Sub '${AWS::Region}-${AWS::StackName}-BudgetMakerFunctionArn'
  BudgetMakerFunctionRoleArn:
    Description: 'IAM Role created for Budget-making function'
    Value: !GetAtt BudgetMakerFunctionRole.Arn
    Export:
      Name: !Sub '${AWS::Region}-${AWS::StackName}-BudgetMakerFunctionRoleArn'
  BudgetMakerFunctionPolicyArn:
    Value: !Ref BudgetMakerFunctionPolicy
    Export:
      Name: !Sub '${AWS::Region}-${AWS::StackName}-BudgetMakerFunctionPolicyArn'
  BudgetMakerNotificationTopicArn:
    Value: !Ref 'BudgetMakerNotificationTopic'
    Export:
      Name: !Sub '${AWS::Region}-${AWS::StackName}-BudgetMakerNotificationTopicArn'
  BudgetMakerNotificationTopicPolicyArn:
    Value: !Ref 'BudgetMakerNotificationTopicPolicy'
    Export:
      Name: !Sub '${AWS::Region}-${AWS::StackName}-BudgetMakerNotificationTopicPolicyArn'