template.yaml

AWSTemplateFormatVersion: "2010-09-09"
Transform: AWS::Serverless-2016-10-31
Description: >
  A serverless scheduled job to report aggregated project AWS usage costs across accounts and post to a Slack channel each week.
Parameters:
  TenantsRoleArn:
    Type: String
    Description: ARN for role to Get Cost and Usage from Tenants account.
  SlackWebhookUrl:
    Type: String
    Description: Incoming webhook for Slack channel to publish report to.

Resources:
  ProjectCostsFunction:
    Type: AWS::Serverless::Function
    Properties:
      CodeUri: get_costs/
      Handler: app.lambda_handler
      Runtime: python3.8
      Timeout: 20 # CostExplorer query can run long sometimes.
      # Layers:
      #   - !Ref PipDependenciesLayer
      Policies:
        - Statement:
            - Sid: GetCostAndUsage
              Effect: Allow
              Action:
                - ce:GetCostAndUsage
              Resource: "*"
            - Sid: AssumeTenantsRole
              Effect: Allow
              Action:
                - sts:AssumeRole
              Resource: !Ref TenantsRoleArn
            - Sid: PublishEvent
              Effect: Allow
              Action: events:PutEvents
              Resource: arn:aws:events:us-west-2:405338390729:event-bus/default
            - Sid: ReadSlackWebhookUrlSecret
              Effect: Allow
              Action:
                - secretsmanager:GetSecretValue
              Resource:
                - !Ref SlackWebhookUrlSecret
        - SNSPublishMessagePolicy:
            TopicName: !GetAtt SnsTopic.TopicName
      Environment:
        Variables:
          TENANTS_ROLE_ARN: !Ref TenantsRoleArn
          SLACK_WEBHOOK_URL_SECRET: !Ref SlackWebhookUrlSecret
      Events:
        RecurrenceEvent:
          Type: Schedule
          Properties:
            Schedule: cron(0 13 ? * MON *) # Every Mon at 7:00 AM
            Enabled: True

  # PipDependenciesLayer:
  #   Type: AWS::Serverless::LayerVersion
  #   Properties:
  #     ContentUri: .aws-sam/deps
  #     CompatibleRuntimes:
  #       - python3.8

  SnsTopic:
    Type: AWS::SNS::Topic
    Properties:
      DisplayName: Project Blue Cost Report
      Subscription:
        - Endpoint: https://global.sns-api.chatbot.amazonaws.com
          Protocol: https
      TopicName: !Ref AWS::StackName

  LambdaSnsDestination:
    Type: AWS::Lambda::EventInvokeConfig
    Properties:
      FunctionName: !Ref ProjectCostsFunction
      Qualifier: "$LATEST"
      DestinationConfig:
        OnSuccess:
          Destination: !Ref SnsTopic

  SlackWebhookUrlSecret:
    Type: AWS::SecretsManager::Secret
    Properties:
      Name: !Sub ${AWS::StackName}-SlackWebHookUrl
      SecretString: !Ref SlackWebhookUrl

Outputs:
  Function:
    Description: "Lambda Function ARN"
    Value: !GetAtt ProjectCostsFunction.Arn
  FunctionIamRole:
    Description: "Implicit IAM Role created for function"
    Value: !GetAtt ProjectCostsFunctionRole.Arn