template.yaml

---
AWSTemplateFormatVersion: '2010-09-09'
Description: 'SNS notification sent to Slack channel'

Transform:
- AWS::Serverless-2016-10-31

Metadata:
  'AWS::CloudFormation::Interface':
    ParameterGroups:
    - Label:
        default: 'Slack Setup'
      Parameters:
      - HookUrl
      - Channel
      - KmsDecryptKeyArn
    - Label:
        default: 'Default Subscriptions'
      Parameters:
      - ErrorAlertEmail
Parameters:
  ErrorAlertEmail:
    Description: 'Optional: email address to receive alert that function is failing. The email will only contain a count of failures -- you will need to then review CloudWatch logs to determine cause of the issue. HIGHLY RECOMMEND handling failures like this within a DeadLetterQueue via ParentAlertStack instead.'
    Type: String
    Default: ''
  HookUrl:
    Type: String
    Description: 'Slack webhook URL; see https://example.slack.com/apps/'
  Channel:
    Type: String
    Description: 'Optional: Channel name to post within'
    Default: ''
  KmsDecryptKeyArn:
    Type: String
    Description: 'Optional: Key used to encrypt Hook or Channel values. If provided will create IAM policy to grant access to decrypt the values.'
    Default: ''

Conditions:
  HasChannel: !Not [!Equals [!Ref Channel, '']]
  HasKmsKey: !Not [!Equals [!Ref KmsDecryptKeyArn, '']]
  HasAlertEmail: !Not [!Equals [!Ref ErrorAlertEmail, '']]

Resources:

  SlackAlertTopic:
    Type: AWS::SNS::Topic
    Properties:
      TopicName:
        Fn::Sub: ${AWS::StackName}
      Tags:
      - Key: Name
        Value:
          Fn::Sub: ${AWS::StackName}

  SlackFunction:
    Type: AWS::Serverless::Function
    Properties:
      Handler: src/index.handler
      Runtime: nodejs16.x
      Role: !GetAtt FunctionRole.Arn
      MemorySize: 256
      Timeout: 15 # Cross-region metrics lookup requires at least 10s
      Tracing: Active
      Environment:
        Variables:
          SLACK_CHANNEL: !If
            - HasChannel
            - !Ref Channel
            - !Ref 'AWS::NoValue'
          SLACK_HOOK_URL: !Ref HookUrl
      Events:
        SNSEvent:
          Type: SNS
          Properties:
            Topic:
              Ref: SlackAlertTopic

  FunctionRole:
    Type: 'AWS::IAM::Role'
    Properties:
      ManagedPolicyArns:
      - arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole
      - arn:aws:iam::aws:policy/CloudWatchReadOnlyAccess
      - arn:aws:iam::aws:policy/AWSCodeCommitReadOnly
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
        - Action: [ 'sts:AssumeRole' ]
          Effect: Allow
          Principal:
            Service: [ 'lambda.amazonaws.com' ]

  KmsDecryptPolicy:
    Condition: HasKmsKey
    Type: 'AWS::IAM::Policy'
    Properties:
      Roles: [ !Ref FunctionRole ]
      PolicyName: AllowDecryptKms
      PolicyDocument:
        Version: '2012-10-17'
        Statement:
        - Effect: Allow
          Action: [ 'kms:Decrypt' ]
          Resource: !Ref KmsDecryptKeyArn

  #
  # CloudWatch Alarm
  #
  FunctionFailing:
    Type: 'AWS::CloudWatch::Alarm'
    Properties:
      AlarmDescription: 'AWS-to-Slack Lambda function is failing'
      Namespace: 'AWS/Lambda'
      MetricName: Errors
      Statistic: Sum
      Period: 300
      EvaluationPeriods: 1
      ComparisonOperator: GreaterThanThreshold
      Threshold: 0
      TreatMissingData: notBreaching
      Dimensions:
      - Name: FunctionName
        Value: !Ref SlackFunction
      AlarmActions:
      - !Ref FunctionFailingTopic

  FunctionFailingTopic:
    Type: 'AWS::SNS::Topic'
    Properties: {}

  FunctionFailingEmailSubscription:
    Condition: HasAlertEmail
    Type: 'AWS::SNS::Subscription'
    Properties:
      TopicArn: !Ref FunctionFailingTopic
      Protocol: email
      Endpoint: !Ref ErrorAlertEmail

Outputs:
  LambdaFunction:
    Description: 'Lambda function name created by this stack.'
    Value: !Ref SlackFunction

  LambdaFunctionArn:
    Description: 'Lambda function ARN created by this stack.'
    Value: !GetAtt SlackFunction.Arn