AWSTemplateFormatVersion: 2010-09-09
Description: Enables an AWS Config rule to check whether AWS CloudTrail is enabled in your AWS account. Optionally, you can specify which S3 bucket, SNS topic, and Amazon CloudWatch Logs ARN to use.

Metadata:
  AWS::CloudFormation::Interface:
    ParameterGroups:
      - Label:
          default: Configuration
        Parameters:
          - Frequency
      - Label:
          default: Rule Parameters
        Parameters:
          - BucketName
          - TopicArn
          - LogGroupArn
    ParameterLabels:
      Frequency:
        default: Frequency
      BucketName:
        default: S3 bucket name
      TopicArn:
        default: SNS topic ARN
      LogGroupArn:
        default: CloudWatch log group ARN

Parameters:

  BucketName:
    Type: String
    Description: "[Optional] Name of the S3 bucket for CloudTrail to deliver logs to."
    Default: ""

  TopicArn:
    Type: String
    Description: "[Optional] SNS topic ARN for CloudTrail to send notifications to."
    Default: ""

  LogGroupArn:
    Type: String
    Description: "[Optional] CloudWatch log group ARN for CloudTrail to send data to."
    Default: ""

  Frequency:
    Type: String
    Default: 24hours
    Description: Maximum rule execution frequency
    AllowedValues:
      - 1hour
      - 3hours
      - 6hours
      - 12hours
      - 24hours

Conditions:
  HasBucketName: !Not
    - !Equals
      - !Ref BucketName
      - ""

  HasTopic: !Not
    - !Equals
      - !Ref TopicArn
      - ""

  HasLogGroup: !Not
    - !Equals
      - !Ref LogGroupArn
      - ""

Mappings:
  Settings:
    FrequencyMap:
      1hour   : One_Hour
      3hours  : Three_Hours
      6hours  : Six_Hours
      12hours : Twelve_Hours
      24hours : TwentyFour_Hours

Resources:
  CheckForCloudTrail:
    Type: AWS::Config::ConfigRule
    Properties:
      Description: Checks whether AWS CloudTrail is enabled in your AWS account.
      MaximumExecutionFrequency: !FindInMap
          - Settings
          - FrequencyMap
          - !Ref Frequency
      Source:
        Owner: AWS
        SourceIdentifier: CLOUD_TRAIL_ENABLED
      InputParameters:
        s3BucketName: !If
          - HasBucketName
          - !Ref BucketName
          - !Ref AWS::NoValue
        snsTopicArn: !If
          - HasTopic
          - !Ref TopicArn
          - !Ref AWS::NoValue
        cloudWatchLogsLogGroupArn: !If
          - HasLogGroup
          - !Ref LogGroupArn
          - !Ref AWS::NoValue