template.yaml

AWSTemplateFormatVersion: '2010-09-09'
Transform: AWS::Serverless-2016-10-31
Description: >
  A lambda for sending monthly cloud-spend emails for STRIDES accounts

Parameters:
  Sender:
    Type: String
    Description: Sender email address

  Recipients:
    Type: String
    Description: Comma-separated list of email recipients

  OmitCostsLessThan:
    Type: Number
    Description: 'Totals less than this amount will not be reported. Default: $0.01'
    Default: '0.01'

  ScheduleExpression:
    Type: String
    Description: EventBridge Schedule Expression
    Default: cron(30 10 2 * ? *)

# More info about Globals: https://github.com/awslabs/serverless-application-model/blob/master/docs/globals.rst
Globals:
  Function:
    Timeout: 120

Resources:
#lambda execution role config
  MonthlyS3UsageLambdaRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
          Version: '2012-10-17'
          Statement:
          - Sid: 'LambdaSSMAssume'
            Effect: Allow
            Principal:
              Service:
              - lambda.amazonaws.com
            Action: sts:AssumeRole
      Policies:
        - PolicyName: LambdaAccess
          PolicyDocument:
            Statement:
            - Action:
                 - "ce:Describe*"
                 - "ce:Get*"
                 - "ce:List*"
                 - "iam:ListAccountAliases"
                 - "logs:CreateLogGroup"
                 - "logs:CreateLogStream"
                 - "logs:DescribeLogStreams"
                 - "logs:PutLogEvents"
                 - "ses:SendEmail"
              Resource: "*"
              Effect: Allow

# This Lambda will query Cost Explorer for costs related to S3
  MonthlyS3Usage:
    Type: AWS::Serverless::Function
    Properties:
      Handler: s3_cost_report/app.lambda_handler
      CodeUri: .
      Runtime: python3.12
      MemorySize: 128
      Role: !GetAtt MonthlyS3UsageLambdaRole.Arn
      Environment:
        Variables:
          SENDER: !Ref Sender
          RECIPIENTS: !Ref Recipients
          MINIMUM: !Ref OmitCostsLessThan
      Events:
        ScheduledEventTrigger:
          Type: Schedule
          Properties:
            Schedule: !Ref ScheduleExpression

  LambdaInvokePermission:
    Type: AWS::Lambda::Permission
    Properties:
      Action: 'lambda:InvokeFunction'
      FunctionName: !Ref MonthlyS3Usage
      Principal: 'events.amazonaws.com'

Outputs:
  MonthlySe3UsageFunctionArn:
    Description: "MonthlyS3Usage Lambda Function ARN"
    Value: !GetAtt MonthlyS3Usage.Arn
  MonthlyS3UsageFunctionRoleArn:
    Description: "IAM Role created for MonthlyS3Usage function"
    Value: !GetAtt MonthlyS3UsageLambdaRole.Arn