template.yml

AWSTemplateFormatVersion: '2010-09-09'
Description: 'Send a slack notification for untagged resources and stops/terminates them'
Parameters:
  AwsRegions:
    Type: String
  SlackWebHook:
    Type: String
  PersistentTagKey:
    Type: String
  PersistentTagValue:
    Type: String
  LifetimeTagKey:
    Type: String
  DesiredMessage:
    Type: String
    Default: TestMessage
  Behavior:
    Type: String
    Default: notify
    AllowedValues:
      - notify
      - stop
      - terminate
  ScheduleExpression:
    Type: String
    Default: "cron(0 16 ? * THU *)"
Resources:
  AWSCleanUntaggedResourcesRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName:
        Fn::Join:
          - '-'
          - - AWSCleanUntaggedResourcesRole
            - Ref: AWS::StackName
      AssumeRolePolicyDocument:
        Statement:
          - Action:
            - sts:AssumeRole
            Effect: Allow
            Principal:
              Service:
              - lambda.amazonaws.com
        Version: 2012-10-17
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/AWSLambdaExecute
        - arn:aws:iam::aws:policy/AmazonEC2FullAccess
        - arn:aws:iam::aws:policy/AmazonRDSFullAccess
        - arn:aws:iam::aws:policy/AmazonECS_FullAccess

  AWSCleanUntaggedResourcesFunction:
    Type: AWS::Lambda::Function
    Properties:
      Description: Send a slack notification for untagged resources and stops/terminates them
      Handler: clean_untagged_resources.lambda_handler
      Runtime: python3.9
      Role: !GetAtt 'AWSCleanUntaggedResourcesRole.Arn'
      Timeout: 900
      Environment:
        Variables:
          SLACK_WEBHOOK_URL: !Ref SlackWebHook
          TAG_KEY: !Ref PersistentTagKey
          TAG_VALUE: !Ref PersistentTagValue
          BEHAVIOR: !Ref Behavior
          REGIONS: !Ref AwsRegions
          LIFETIME_TAG_KEY: !Ref LifetimeTagKey
          MESSAGE: !Ref DesiredMessage
      Code: aws-clean-untagged-resources.zip
  AWSCleanUntaggedResourcesRule:
    Type: AWS::Events::Rule
    Properties:
      ScheduleExpression: !Ref ScheduleExpression
      Targets:
      - Id: AWSCleanUntaggedResourcesScheduler
        Arn: !GetAtt AWSCleanUntaggedResourcesFunction.Arn
  InvokeLambdaPermission:
    Type: AWS::Lambda::Permission
    Properties:
      FunctionName:
        Fn::GetAtt:
        - AWSCleanUntaggedResourcesFunction
        - Arn
      Action: lambda:InvokeFunction
      Principal: events.amazonaws.com
      SourceArn:
        Fn::GetAtt:
        - AWSCleanUntaggedResourcesRule
        - Arn