template.yaml

Parameters:
  snsScanResultTopicArn:
    Type: String
    Description: FSS Results SNS Topic ARN.
  LambdaZipBucket:
    Type: String
    Description: S3 bucket for lambda zip. If your have it under s3://bucket/path/to/zip.zip, enter 'bucket' here. 
  LambdaZipKey:
    Type: String
    Description: S3 key for lambda zip. If your have it under s3://bucket/path/to/zip.zip, enter 'path/to/zip.zip' here. 
Resources:
  sentToSecurityHubLambdaFunctionServiceRole58D0F596:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Statement:
          - Action: sts:AssumeRole
            Effect: Allow
            Principal:
              Service: lambda.amazonaws.com
        Version: "2012-10-17"
      ManagedPolicyArns:
        - Fn::Join:
            - ""
            - - "arn:"
              - Ref: AWS::Partition
              - :iam::aws:policy/service-role/AWSLambdaBasicExecutionRole
  sentToSecurityHubLambdaFunctionServiceRoleDefaultPolicy9B55E2DF:
    Type: AWS::IAM::Policy
    Properties:
      PolicyDocument:
        Statement:
          - Action: securityhub:BatchImportFindings
            Effect: Allow
            Resource:
              Fn::Join:
                - ""
                - - "arn:aws:securityhub:"
                  - Ref: AWS::Region
                  - ":"
                  - Ref: AWS::AccountId
                  - :product/
                  - Ref: AWS::AccountId
                  - /default
        Version: "2012-10-17"
      PolicyName: sentToSecurityHubLambdaFunctionServiceRoleDefaultPolicy9B55E2DF
      Roles:
        - Ref: sentToSecurityHubLambdaFunctionServiceRole58D0F596
  sentToSecurityHubLambdaFunction532BC798:
    Type: AWS::Lambda::Function
    Properties:
      Code:
        S3Bucket:
          Ref: LambdaZipBucket
        S3Key:
          Ref: LambdaZipKey               
      Handler: index.handler
      Role:
        Fn::GetAtt:
          - sentToSecurityHubLambdaFunctionServiceRole58D0F596
          - Arn
      Runtime: nodejs12.x
      Environment:
        Variables:
          SECURITY_HUB_ARN:
            Fn::Join:
              - ""
              - - "arn:aws:securityhub:"
                - Ref: AWS::Region
                - ":"
                - Ref: AWS::AccountId
                - :product/
                - Ref: AWS::AccountId
                - /default
          ACCOUNT_ID:
            Ref: AWS::AccountId
    DependsOn:
      - sentToSecurityHubLambdaFunctionServiceRoleDefaultPolicy9B55E2DF
      - sentToSecurityHubLambdaFunctionServiceRole58D0F596
  sentToSecurityHubLambdaFunctionAllowInvokeFssToSecurityhubStacksnsScanResultTopic91BD24BC8B29A3C3:
    Type: AWS::Lambda::Permission
    Properties:
      Action: lambda:InvokeFunction
      FunctionName:
        Fn::GetAtt:
          - sentToSecurityHubLambdaFunction532BC798
          - Arn
      Principal: sns.amazonaws.com
      SourceArn:
        Ref: snsScanResultTopicArn
  sentToSecurityHubLambdaFunctionsnsScanResultTopic97C3C50C:
    Type: AWS::SNS::Subscription
    Properties:
      Protocol: lambda
      TopicArn:
        Ref: snsScanResultTopicArn
      Endpoint:
        Fn::GetAtt:
          - sentToSecurityHubLambdaFunction532BC798
          - Arn
      Region:
        Fn::Select:
          - 3
          - Fn::Split:
              - ":"
              - Ref: snsScanResultTopicArn