AWSTemplateFormatVersion: 2010-09-09
Description: >-
  This template deploys a single SNS topic with a subscription to a central SQS
  queue
Parameters:
  AllowList:
    Type: String
    Description: Comma delimited list of AWS Accounts
    AllowedPattern: '^(\d{12}){0,1}(,\d{12})*$'
    ConstraintDescription: >-
      The parameter should be empty or a list of AWS account ID eg.
      123456789012,234567890123
    Default: ''
  CentralRegion:
    Type: String
    Description: Region which hosts the centralization bucket and SQS queue
    AllowedValues:
      - eu-north-1
      - ap-south-1
      - eu-west-3
      - eu-west-2
      - eu-west-1
      - ap-northeast-3
      - ap-northeast-2
      - ap-northeast-1
      - sa-east-1
      - ca-central-1
      - ap-southeast-1
      - ap-southeast-2
      - eu-central-1
      - us-east-1
      - us-east-2
      - us-west-1
      - us-west-2
    ConstraintDescription: >-
      The parameter should be the AWS region which hosts the central SQS queue. eg.
      us-east-1, us-west-1, eu-west-1, etc...
    Default: 'eu-west-1'
Conditions:
  EmptyAllowList: !Equals 
    - Ref: AllowList
    - ''
Resources:
  rSNSTopic:
    Type: 'AWS::SNS::Topic'
    Properties:
      DisplayName: InventoryCentralizationTopic
      Subscription:
        - Endpoint: !Sub >-
            arn:aws:sqs:${CentralRegion}:${AWS::AccountId}:inventory-consolidation-queue
          Protocol: sqs
      TopicName: !Sub 'InventoryCentralizationTopic-${AWS::Region}'
  SnsPolicy:
    Type: 'AWS::SNS::TopicPolicy'
    Properties:
      PolicyDocument:
        Version: 2012-10-17
        Statement:
          Effect: Allow
          Principal:
            Service: s3.amazonaws.com
          Action: 'sns:Publish'
          Resource: !Ref rSNSTopic
          Condition:
            StringEquals:
              'aws:sourceAccount':
                - !Ref 'AWS::AccountId'
      Topics:
        - !Ref rSNSTopic
  rInventoryBucket:
    Type: 'AWS::S3::Bucket'
    Properties:
      BucketEncryption:
        ServerSideEncryptionConfiguration:
          - ServerSideEncryptionByDefault:
              SSEAlgorithm: AES256
      BucketName: !Join 
        - '-'
        - - inventory
          - !Sub '${AWS::Region}'
          - !Select 
            - 0
            - !Split 
              - '-'
              - !Select 
                - 2
                - !Split 
                  - /
                  - !Ref 'AWS::StackId'
      NotificationConfiguration:
        TopicConfigurations:
          - Event: 's3:ObjectCreated:*'
            Filter:
              S3Key:
                Rules:
                  - Name: suffix
                    Value: manifest.checksum
            Topic: !Ref rSNSTopic
      PublicAccessBlockConfiguration:
        BlockPublicAcls: true
        BlockPublicPolicy: true
        IgnorePublicAcls: true
        RestrictPublicBuckets: true
  rS3BucketInventoryDestinationPolicy:
    Type: 'AWS::S3::BucketPolicy'
    Properties:
      Bucket: !Ref rInventoryBucket
      PolicyDocument:
        Statement:
          - Sid: InventoryS3Policy
            Effect: Allow
            Principal:
              Service: s3.amazonaws.com
            Action: 's3:PutObject'
            Resource: !Join 
              - ''
              - - 'arn:aws:s3:::'
                - !Ref rInventoryBucket
                - /*
            Condition:
              StringEquals:
                's3:x-amz-acl': bucket-owner-full-control
                'aws:SourceAccount': !If 
                  - EmptyAllowList
                  - - !Ref 'AWS::AccountId'
                  - !Split 
                    - ','
                    - !Join 
                      - ','
                      - - !Ref 'AWS::AccountId'
                        - !Ref AllowList
Outputs:
  oInventoryBucket:
    Description: Bucket to store inventory reports to
    Value: !Ref rInventoryBucket
    Export:
      Name: !Sub '${AWS::StackName}-inventory-bucket'