template.yaml

AWSTemplateFormatVersion: '2010-09-09'
Transform: AWS::Serverless-2016-10-31
Description: When request to s3 api using signature version 2, notification to email address.

Parameters:
  EmailAddress:
    Type: String

Resources:
  CloudTrail:
    Type: AWS::CloudTrail::Trail
    Properties:
      EventSelectors:
        - DataResources:
            - Type: AWS::S3::Object
              Values:
                - 'arn:aws:s3:::'
          IncludeManagementEvents: false
      IncludeGlobalServiceEvents: true
      IsLogging: true
      IsMultiRegionTrail: true
      S3BucketName: !Ref LogBucket
    DependsOn:
      - LogBucketPolicy

  LogBucket:
    Type: AWS::S3::Bucket
    Properties:
      BucketEncryption:
        ServerSideEncryptionConfiguration:
          - ServerSideEncryptionByDefault:
              SSEAlgorithm: AES256
      LifecycleConfiguration:
        Rules:
          - ExpirationInDays: 10
            Status: Enabled

  LogBucketPolicy:
    Type: AWS::S3::BucketPolicy
    Properties:
      Bucket: !Ref LogBucket
      PolicyDocument:
        Statement:
          - Action: s3:GetBucketAcl
            Effect: Allow
            Resource: !Sub arn:aws:s3:::${LogBucket}
            Principal:
              Service: cloudtrail.amazonaws.com
          - Action: s3:PutObject
            Effect: Allow
            Resource: !Sub arn:aws:s3:::${LogBucket}/AWSLogs/${AWS::AccountId}/*
            Principal:
              Service: cloudtrail.amazonaws.com
            Condition:
              StringEquals:
                s3:x-amz-acl: bucket-owner-full-control

  EventRule:
    Type: AWS::Events::Rule
    Properties:
      EventPattern:
        detail-type:
          - AWS API Call via CloudTrail
        detail:
          eventSource:
            - s3.amazonaws.com
          additionalEventData:
            SignatureVersion:
              - SigV2
      State: ENABLED
      Targets:
        - Id: sns
          Arn: !Ref SNS

  SNS:
    Type: AWS::SNS::Topic
    Properties:
      Subscription:
        - Endpoint: !Ref EmailAddress
          Protocol: email

  SNSPolicy:
    Type: AWS::SNS::TopicPolicy
    Properties:
      PolicyDocument:
        Statement:
          - Effect: Allow
            Principal:
              Service: events.amazonaws.com
            Action: sns:Publish
            Resource: '*'
      Topics:
        - !Ref SNS