AWSTemplateFormatVersion: "2010-09-09"
Description: "Cloudformation Template that provisions EventBridge rule for Security hub findings to the target security hub listener destination"

Parameters:
  APIEndPoint:
    Description: Security Hub Listener URL.
    Type: String
  APIKeyName:
    Description: Security Hub Listener API Key Name.
    Type: String
    Default: x-secret-key
  APIKeyValue:
    Description: Security Hub Listener Secret.
    Type: String

Resources:
  EventsApiDestination:
    Type: "AWS::Events::ApiDestination"
    Properties:
      Name: "autobotAI-security-hub-listener-webhook"
      Description: "autobotAI-security-hub-listener-webhook"
      ConnectionArn: !GetAtt EventsConnection.Arn
      InvocationEndpoint: !Ref APIEndPoint
      HttpMethod: "POST"
      InvocationRateLimitPerSecond: 300

  EventsConnection:
    Type: "AWS::Events::Connection"
    Properties:
      Name: "autobotAI-security-hub-listener-connection"
      AuthorizationType: "API_KEY"
      AuthParameters: 
        ApiKeyAuthParameters: 
          ApiKeyName: !Ref APIKeyName
          ApiKeyValue: !Ref APIKeyValue
        InvocationHttpParameters: {}

  IAMManagedPolicy:
    Type: "AWS::IAM::ManagedPolicy"
    Properties:
      ManagedPolicyName: "autobotAI_EventBridge_Invoke_Api_Destination_Policy"
      Path: "/service-role/"
      PolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Action: 
              - "events:InvokeApiDestination"
            Resource: !GetAtt EventsApiDestination.Arn

  InvokeAPIDestinationRole:
    Type: "AWS::IAM::Role"
    Properties:
      Path: "/service-role/"
      RoleName: "autobotAI_EventBridge_Invoke_Api_Destination"
      AssumeRolePolicyDocument: 
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Principal:
              Service: "events.amazonaws.com"
            Action: "sts:AssumeRole"
      MaxSessionDuration: 3600
      ManagedPolicyArns: 
        - !Ref IAMManagedPolicy

  EventsRule:
    Type: "AWS::Events::Rule"
    Properties:
      Name: "autobotAI-Security-Hub-Findings"
      EventPattern: 
        source:
          - "aws.securityhub"
        detail-type:
          - "Security Hub Findings - Imported"
        detail:
          findings:
            AwsAccountId:
              - !Sub "${AWS::AccountId}"
      State: "ENABLED"
      Targets: 
        - 
          Arn: !GetAtt EventsApiDestination.Arn
          HttpParameters: 
            HeaderParameters: {}
            QueryStringParameters: {}
          Id: "sh-findings-eb-rule"
          RoleArn: !GetAtt InvokeAPIDestinationRole.Arn
      EventBusName: "default"

Outputs:
  EventsApiDestinationArn:
    Description: "ARN of the Events API Destination"
    Value: !GetAtt EventsApiDestination.Arn

  EventsConnectionArn:
    Description: "ARN of the Events Connection"
    Value: !GetAtt EventsConnection.Arn

  IAMManagedPolicyArn:
    Description: "ARN of the IAM Managed Policy"
    Value: !Ref IAMManagedPolicy

  InvokeAPIDestinationRoleArn:
    Description: "ARN of the IAM Role for invoking API Destination"
    Value: !GetAtt InvokeAPIDestinationRole.Arn

  EventsRuleArn:
    Description: "ARN of the Events Rule"
    Value: !Ref EventsRule