template.yaml

AWSTemplateFormatVersion: '2010-09-09'
Transform: AWS::Serverless-2016-10-31
Description: SAM Template for cost-reporter

#-----------------------------------------------------
# Parameters
#-----------------------------------------------------

Parameters:
  SlackTokenParameterName:
    Type: String
    Default: "/cost-reporter/slack-token"
  Title:
    Type: String
    Default: "Cost Report"
    Description: "The title to display in the cost report image"
  Days:
    Type: Number
    Default: 10
    Description: "The amount of days to include in the report"
  MinDailyCost:
    Type: Number
    Default: 0
    Description: "The minimal daily cost to trigger a report"
  OnlyNotifyOnIncrease:
    Type: String
    AllowedValues:
      - true
      - false
    Default: true
    Description: "Whether to only notify if cost increased within the last day"
  TargetChannel:
    Type: String
    Default: "#ohtru"
    Description: "The target slack channel"


#-----------------------------------------------------
# Resources
#-----------------------------------------------------
Resources:
  CostReporterLambda:
    Type: AWS::Serverless::Function
    Properties:
      CodeUri: cost-reporter/
      Handler: lambda_function.lambda_handler
      Runtime: python3.8
      Timeout: 30
      Role: !GetAtt LambdaRole.Arn
      Environment:
        Variables:
          TITLE: !Ref Title
          DAYS: !Ref Days
          MIN_DAILY_COST: !Ref MinDailyCost
          ONLY_NOTIFY_ON_INCREASE: !Ref OnlyNotifyOnIncrease
          TARGET_CHANNEL: !Ref TargetChannel
          SLACK_TOKEN_PARAMETER:  !Ref SlackTokenParameterName
    Metadata:
      BuildMethod: makefile

  LambdaRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - lambda.amazonaws.com
            Action:
              - sts:AssumeRole
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole
      Policies:
        -
          PolicyName: "CostReporterLambdaRole"
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
               -
                 Sid: "CostExplorer"
                 Effect: "Allow"
                 Action: "ce:GetCostAndUsage"
                 Resource: "*"
               -
                 Sid: "ParameterStore"
                 Effect: "Allow"
                 Action: "ssm:GetParameter"
                 Resource: !Sub "arn:aws:ssm:${AWS::Region}:${AWS::AccountId}:parameter${SlackTokenParameterName}"

  CWEventsRule:
    Type: AWS::Events::Rule
    Properties:
      ScheduleExpression: "cron(0 17 * * ? *)"
      State:  "ENABLED"
      Targets:
      -
        Arn: !GetAtt CostReporterLambda.Arn
        Id: CostReporterLambda

  permissionForEventsToInvokeLambda:
    Type: AWS::Lambda::Permission
    Properties:
      FunctionName: !Ref CostReporterLambda
      Action: lambda:InvokeFunction
      Principal: events.amazonaws.com
      SourceArn: !GetAtt CWEventsRule.Arn