template.yaml

AWSTemplateFormatVersion: '2010-09-09'
Transform: AWS::Serverless-2016-10-31
Description: >
  A lambda for sending monthly cloud-spend emails with a link to cost explorer

Parameters:
  ScheduleExpression:
    Type: String
    Description: Schedule expressions using cron
    Default: cron(30 10 2 * ? *)

  SenderEmail:
    Type: String
    Description: Sender Email Address
    Default: '"Cloud Cost Notifications" <cloud-cost-notifications@sagebase.org>'

  SkipRecipients:
    Type: String
    Description: Comma-separated list of email recipients to always skip
    Default: ''

  MinimumValue:
    Type: String
    Description: 'Minimum total to send an email. Default: $1.0'
    Default: '1.0'
    AllowedPattern: '^\d+(\.\d+)?$'
    ConstraintDescription: 'must be a floating point number'

  RestrictRecipients:
    Type: String
    Description: Whether or not to restict sending emails to approved addresses
    Default: "False"
    AllowedValues:
      - "True"
      - "False"

  ApprovedRecipients:
    Type: String
    Description: Comma-separated list of approved email recipients
    Default: ''

  SynapseTeamId:
    Type: String
    Description: Synapse ID for Team Sage
    Default: '273957'

  SynapseTeamDomain:
    Type: String
    Description: Email domain used by Synapse
    Default: '@synapse.org'

  AdminEmail:
    Type: String
    Description: Email recipient for admin notifications (e.g. uncategorized costs)
    Default: '"Cloud Cost Notifications" <cloud-cost-notifications@sagebase.org>'

  CopyRecipients:
    Type: String
    Description: Comma-separated list of email recipients to CC on all reports
    Default: ''


# More info about Globals: https://github.com/awslabs/serverless-application-model/blob/master/docs/globals.rst
Globals:
  Function:
    Timeout: 120

Resources:
#lambda execution role config
  MonthlyServicesUsageLambdaRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
          Version: '2012-10-17'
          Statement:
          - Sid: 'LambdaSSMAssume'
            Effect: Allow
            Principal:
              Service:
              - lambda.amazonaws.com
            Action: sts:AssumeRole
      Policies:
        - PolicyName: LambdaAccess
          PolicyDocument:
            Statement:
            - Action:
                 - "ce:Describe*"
                 - "ce:Get*"
                 - "ce:List*"
                 - "logs:CreateLogGroup"
                 - "logs:CreateLogStream"
                 - "logs:DescribeLogStreams"
                 - "logs:PutLogEvents"
                 - "organizations:ListAccounts"
                 - "organizations:ListTagsForResource"
                 - "ses:SendEmail"
              Resource: "*"
              Effect: Allow

#This Lambda Function will fetch Billing details for AWS linked Account and will send it over mail.
  MonthlyServicesUsage:
    Type: AWS::Serverless::Function
    Properties:
      Handler: email_totals/app.lambda_handler
      CodeUri: .
      Runtime: python3.9
      MemorySize: 128
      Role: !GetAtt MonthlyServicesUsageLambdaRole.Arn
      Environment:
        Variables:
          ADMIN_EMAIL: !Ref AdminEmail
          SENDER: !Ref SenderEmail
          RESTRICT: !Ref RestrictRecipients
          APPROVED: !Ref ApprovedRecipients
          SKIPLIST: !Ref SkipRecipients
          MINIMUM: !Ref MinimumValue
          SYNAPSE_TEAM_ID: !Ref SynapseTeamId
          SYNAPSE_TEAM_DOMAIN: !Ref SynapseTeamDomain
          CC_LIST: !Ref CopyRecipients
      Events:
        ScheduledEventTrigger:
          Type: Schedule
          Properties:
            Schedule: !Ref ScheduleExpression

  LambdaInvokePermission:
    Type: AWS::Lambda::Permission
    Properties:
      Action: 'lambda:InvokeFunction'
      FunctionName: !Ref MonthlyServicesUsage
      Principal: 'events.amazonaws.com'

Outputs:
  MonthlyServicesUsageFunctionArn:
    Description: "MonthlyServicesUsage Lambda Function ARN"
    Value: !GetAtt MonthlyServicesUsage.Arn
  MonthlyServicesUsageFunctionRoleArn:
    Description: "IAM Role created for MonthlyServicesUsage function"
    Value: !GetAtt MonthlyServicesUsageLambdaRole.Arn