serverless.yml

service: auto-remediate
frameworkVersion: "^3"

plugins:
  - serverless-plugin-split-stacks
  - serverless-stack-termination-protection

custom:
  splitStacks:
    perFunction: false
    perType: true
    perGroupFunction: false

provider:
  logRetentionInDays: 30
  name: aws
  runtime: nodejs16.x
  stage: v1
  region: ${opt:region, 'us-east-1'}
  timeout: 10 # optional, in seconds, default is 6
  tracing:
    lambda: true
  stackTags:
    service: auto-remediate


functions:

  AutoRemediateOrchestrator:
    handler: functions/AutoRemediateOrchestrator.handler
    timeout: 10
    memorySize: 128
    reservedConcurrency: 1
    events:
      - sqs:
          arn: !GetAtt
            - AutoRemediateQueue
            - Arn
          batchSize: 1
    tags:
      Name: Auto Remediate Orchestrator
      Owner: CloudConformity
      Role: Auto Remediate
      Environment: Ops
    package:
      include:
        - functions/AutoRemediateOrchestrator.js
    role: AutoRemediateOrchestratorRole

  AutoRemediateS3-016:
    handler: functions/AutoRemediateS3-016.handler
    memorySize: 128
    tags:
      Name: Auto Remediate S3-016
      Owner: CloudConformity
      Role: Auto Remediate
      Environment: Ops
    package:
      include:
        - functions/AutoRemediateS3-016.js
    role: AutoRemediateS3016Role

  AutoRemediateIAM-001:
    handler: functions/AutoRemediateIAM-001.handler
    memorySize: 128
    tags:
      Name: Auto Remediate IAM-001
      Owner: CloudConformity
      Role: Auto Remediate
      Environment: Ops
    package:
      include:
        - functions/AutoRemediateIAM-001.js
    role: AutoRemediateIAM001Role

  AutoRemediateCT-001:
    handler: functions/AutoRemediateCT-001.handler
    memorySize: 128
    tags:
      Name: Auto Remediate CT-001
      Owner: CloudConformity
      Role: Auto Remediate
      Environment: Ops
    package:
      include:
        - functions/AutoRemediateCT-001.js
    role: AutoRemediateCT001Role

  AutoRemediateLambda-003:
    handler: functions/AutoRemediateLambda-003.handler
    memorySize: 128
    tags:
      Name: Auto Remediate Lambda-003
      Owner: CloudConformity
      Role: Auto Remediate
      Environment: Ops
    package:
      include:
        - functions/AutoRemediateLambda-003.js
    role: AutoRemediateLambda003Role

  AutoRemediateS3-001:
    handler: functions/AutoRemediateS3-001.handler
    memorySize: 128
    tags:
      Name: Auto Remediate S3-001
      Owner: CloudConformity
      Role: Auto Remediate
      Environment: Ops
    package:
      include:
        - functions/AutoRemediateS3-001.js
    role: AutoRemediateS3001Role

  AutoRemediateS3-002:
    handler: functions/AutoRemediateS3-002.handler
    memorySize: 128
    timeout: 10
    tags:
      Name: Auto Remediate S3-002
      Owner: CloudConformity
      Role: Auto Remediate
      Environment: Ops
    package:
      include:
        - functions/AutoRemediateS3-002.js
        - utils/S3_utils.js
        - node_modules/lodash.isequal/**
    role: AutoRemediateS3002Role


  AutoRemediateIAM-038:
    handler: functions/AutoRemediateIAM-038.handler
    memorySize: 128
    timeout: 10
    tags:
      Name: Auto Remediate IAM-038
      Owner: CloudConformity
      Role: Auto Remediate
      Environment: Ops
    package:
      include:
        - functions/AutoRemediateIAM-038.js
    role: AutoRemediateIAM038Role

  AutoRemediateS3-014:
    handler: functions/AutoRemediateS3-014.handler
    memorySize: 128
    timeout: 10
    tags:
      Name: Auto Remediate S3-014
      Owner: CloudConformity
      Role: Auto Remediate
      Environment: Ops
    package:
      include:
        - functions/AutoRemediateS3-014.js
    role: AutoRemediateS3014Role

  AutoRemediateS3-003:
    handler: functions/AutoRemediateS3-003.handler
    memorySize: 128
    timeout: 10
    tags:
      Name: Auto Remediate S3-003
      Owner: CloudConformity
      Role: Auto Remediate
      Environment: Ops
    package:
      include:
        - functions/AutoRemediateS3-003.js
        - utils/S3_utils.js
        - node_modules/lodash.isequal/**
    role: AutoRemediateS3003Role

  AutoRemediateKMS-002:
    handler: functions/AutoRemediateKMS-002.handler
    timeout: 120
    memorySize: 128
    tags:
      Name: Auto Remediate KMS-002
      Owner: CloudConformity
      Role: Auto Remediate
      Environment: Ops
    package:
      include:
        - functions/AutoRemediateKMS-002.js
    role: AutoRemediateKMS002Role



  AutoRemediateS3-004:
    handler: functions/AutoRemediateS3-004.handler
    memorySize: 128
    timeout: 10
    tags:
      Name: Auto Remediate S3-004
      Owner: CloudConformity
      Role: Auto Remediate
      Environment: Ops
    package:
      include:
        - functions/AutoRemediateS3-004.js
        - utils/S3_utils.js
        - node_modules/lodash.isequal/**
    role: AutoRemediateS3004Role


  AutoRemediateRDS-023:
    handler: functions/AutoRemediateRDS-023.handler
    memorySize: 128
    timeout: 10
    tags:
      Name: Auto Remediate RDS-023
      Owner: CloudConformity
      Role: Auto Remediate
      Environment: Ops
    package:
      include:
        - functions/AutoRemediateRDS-023.js
    role: AutoRemediateRDS023Role

  AutoRemediateGD-001:
    handler: functions/AutoRemediateGD-001.handler
    memorySize: 128
    timeout: 10
    tags:
      Name: Auto Remediate GD-001
      Owner: CloudConformity
      Role: Auto Remediate
      Environment: Ops
    package:
      include:
        - functions/AutoRemediateGD-001.js
    role: AutoRemediateGD001Role

  AutoRemediateS3-005:
    handler: functions/AutoRemediateS3-005.handler
    memorySize: 128
    timeout: 10
    tags:
      Name: Auto Remediate S3-005
      Owner: CloudConformity
      Role: Auto Remediate
      Environment: Ops
    package:
      include:
        - functions/AutoRemediateS3-005.js
        - utils/S3_utils.js
        - node_modules/lodash.isequal/**
    role: AutoRemediateS3005Role

  AutoRemediateS3-006:
    handler: functions/AutoRemediateS3-006.handler
    memorySize: 128
    timeout: 10
    tags:
      Name: Auto Remediate S3-006
      Owner: CloudConformity
      Role: Auto Remediate
      Environment: Ops
    package:
      include:
        - functions/AutoRemediateS3-006.js
        - utils/S3_utils.js
        - node_modules/lodash.isequal/**
    role: AutoRemediateS3006Role

  AutoRemediateS3-007:
    handler: functions/AutoRemediateS3-007.handler
    memorySize: 128
    timeout: 10
    tags:
      Name: Auto Remediate S3-007
      Owner: CloudConformity
      Role: Auto Remediate
      Environment: Ops
    package:
      include:
        - functions/AutoRemediateS3-007.js
        - utils/S3_utils.js
        - node_modules/lodash.isequal/**
    role: AutoRemediateS3007Role


  AutoRemediateKMS-004:
    handler: functions/AutoRemediateKMS-004.handler
    timeout: 120
    memorySize: 128
    tags:
      Name: Auto Remediate KMS-004
      Owner: CloudConformity
      Role: Auto Remediate
      Environment: Ops
    package:
      include:
        - functions/AutoRemediateKMS-004.js
    role: AutoRemediateKMS004Role


  AutoRemediateOrganizations-002:
    handler: functions/AutoRemediateOrganizations-002.handler
    memorySize: 128
    timeout: 10
    tags:
      Name: Auto Remediate Organizations-002
      Owner: CloudConformity
      Role: Auto Remediate
      Environment: Ops
    package:
      include:
        - functions/AutoRemediateOrganizations-002.js
    role: AutoRemediateOrganizations002Role

  AutoRemediateS3-008:
    handler: functions/AutoRemediateS3-008.handler
    memorySize: 128
    timeout: 10
    tags:
      Name: Auto Remediate S3-008
      Owner: CloudConformity
      Role: Auto Remediate
      Environment: Ops
    package:
      include:
        - functions/AutoRemediateS3-008.js
        - utils/S3_utils.js
        - node_modules/lodash.isequal/**
    role: AutoRemediateS3008Role

  AutoRemediateS3-009:
    handler: functions/AutoRemediateS3-009.handler
    memorySize: 128
    timeout: 10
    tags:
      Name: Auto Remediate S3-009
      Owner: CloudConformity
      Role: Auto Remediate
      Environment: Ops
    package:
      include:
        - functions/AutoRemediateS3-009.js
        - utils/S3_utils.js
        - node_modules/lodash.isequal/**
    role: AutoRemediateS3009Role

  AutoRemediateCT-003:
    handler: functions/AutoRemediateCT-003.handler
    timeout: 120
    memorySize: 128
    tags:
      Name: Auto Remediate CT-003
      Owner: CloudConformity
      Role: Auto Remediate
      Environment: Ops
    package:
      include:
        - functions/AutoRemediateCT-003.js
    role: AutoRemediateCT003Role

  AutoRemediateRDS-006:
    handler: functions/AutoRemediateRDS-006.handler
    timeout: 120
    memorySize: 128
    tags:
      Name: Auto Remediate RDS-006
      Owner: CloudConformity
      Role: Auto Remediate
      Environment: Ops
    package:
      include:
        - functions/AutoRemediateRDS-006.js
    role: AutoRemediateRDS006Role

  AutoRemediateS3-010:
    handler: functions/AutoRemediateS3-010.handler
    memorySize: 128
    timeout: 10
    tags:
      Name: Auto Remediate S3-010
      Owner: CloudConformity
      Role: Auto Remediate
      Environment: Ops
    package:
      include:
        - functions/AutoRemediateS3-010.js
        - utils/S3_utils.js
        - node_modules/lodash.isequal/**
    role: AutoRemediateS3010Role

  AutoRemediateS3-012:
    handler: functions/AutoRemediateS3-012.handler
    memorySize: 128
    tags:
      Name: Auto Remediate S3-012
      Owner: CloudConformity
      Role: Auto Remediate
      Environment: Ops
    package:
      include:
        - functions/AutoRemediateS3-012.js
    role: AutoRemediateS3012Role

  AutoRemediateSQS-004:
    handler: functions/AutoRemediateSQS-004.handler
    timeout: 120
    memorySize: 128
    tags:
      Name: Auto Remediate SQS-004
      Owner: CloudConformity
      Role: Auto Remediate
      Environment: Ops
    package:
      include:
        - functions/AutoRemediateSQS-004.js
    role: AutoRemediateSQS004Role
  AutoRemediateRDS-008:
    handler: functions/AutoRemediateRDS-008.handler
    memorySize: 128
    tags:
      Name: Auto Remediate RDS-008
      Owner: CloudConformity
      Role: Auto Remediate
      Environment: Ops
    package:
      include:
        - functions/AutoRemediateRDS-008.js
    role: AutoRemediateRDS008Role

  AutoRemediateConfig-001:
    handler: functions/AutoRemediateConfig-001.handler
    timeout: 120
    memorySize: 128
    tags:
      Name: Auto Remediate Config-001
      Owner: CloudConformity
      Role: Auto Remediate
      Environment: Ops
    package:
      include:
        - functions/AutoRemediateConfig-001.js
    role: AutoRemediateConfig001Role

  AutoRemediateCFM-005:
    handler: functions/AutoRemediateCFM-005.handler
    timeout: 120
    memorySize: 128
    tags:
      Name: Auto Remediate CFM-005
      Owner: CloudConformity
      Role: Auto Remediate
      Environment: Ops
    package:
      include:
        - functions/AutoRemediateCFM-005.js
    role: AutoRemediateCFM005Role

  AutoRemediateVPC-001:
    handler: functions/AutoRemediateVPC-001.handler
    timeout: 120
    memorySize: 128
    tags:
      Name: Auto Remediate VPC-001
      Owner: CloudConformity
      Role: Auto Remediate
      Environment: Ops
    package:
      include:
        - functions/AutoRemediateVPC-001.js
    role: AutoRemediateVPC001Role

  AutoRemediateEBS-009:
    handler: functions/AutoRemediateEBS-009.handler
    timeout: 120
    memorySize: 128
    tags:
      Name: Auto Remediate EBS-009
      Owner: CloudConformity
      Role: Auto Remediate
      Environment: Ops
    package:
      include:
        - functions/AutoRemediateEBS-009.js
    role: AutoRemediateEBS009Role


  AutoRemediateRS-001:
    handler: functions/AutoRemediateRS-001.handler
    timeout: 120
    memorySize: 128
    tags:
      Name: Auto Remediate RS-001
      Owner: CloudConformity
      Role: Auto Remediate
      Environment: Ops
    package:
      include:
        - functions/AutoRemediateRS-001.js
    role: AutoRemediateRS001Role

  AutoRemediateEC2-002:
    handler: functions/AutoRemediateEC2-002.handler
    timeout: 120
    memorySize: 128
    tags:
      Name: Auto Remediate EC2-002
      Owner: CloudConformity
      Role: Auto Remediate
      Environment: Ops
    package:
      include:
        - functions/AutoRemediateEC2-002.js
    role: AutoRemediateEC2002Role

  AutoRemediateRS-019:
    handler: functions/AutoRemediateRS-019.handler
    timeout: 120
    memorySize: 128
    tags:
      Name: Auto Remediate RS-019
      Owner: CloudConformity
      Role: Auto Remediate
      Environment: Ops
    package:
      include:
        - functions/AutoRemediateRS-019.js
    role: AutoRemediateRS019Role

  AutoRemediateEC2-003:
    handler: functions/AutoRemediateEC2-003.handler
    timeout: 120
    memorySize: 128
    tags:
      Name: Auto Remediate EC2-003
      Owner: CloudConformity
      Role: Auto Remediate
      Environment: Ops
    package:
      include:
        - functions/AutoRemediateEC2-003.js
    role: AutoRemediateEC2003Role

  AutoRemediateEC2-005:
    handler: functions/AutoRemediateEC2-005.handler
    timeout: 120
    memorySize: 128
    tags:
      Name: Auto Remediate EC2-005
      Owner: CloudConformity
      Role: Auto Remediate
      Environment: Ops
    package:
      include:
        - functions/AutoRemediateEC2-005.js
    role: AutoRemediateEC2005Role

  AutoRemediateEC2-019:
    handler: functions/AutoRemediateEC2-019.handler
    timeout: 120
    memorySize: 128
    tags:
      Name: Auto Remediate EC2-019
      Owner: CloudConformity
      Role: Auto Remediate
      Environment: Ops
    package:
      include:
        - functions/AutoRemediateEC2-019.js
    role: AutoRemediateEC2019Role

  AutoRemediateEC2-004:
    handler: functions/AutoRemediateEC2-004.handler
    timeout: 120
    memorySize: 128
    tags:
      Name: Auto Remediate EC2-004
      Owner: CloudConformity
      Role: Auto Remediate
      Environment: Ops
    package:
      include:
        - functions/AutoRemediateEC2-004.js
    role: AutoRemediateEC2004Role

  AutoRemediateEC2-006:
    handler: functions/AutoRemediateEC2-006.handler
    timeout: 120
    memorySize: 128
    tags:
      Name: Auto Remediate EC2-006
      Owner: CloudConformity
      Role: Auto Remediate
      Environment: Ops
    package:
      include:
        - functions/AutoRemediateEC2-006.js
    role: AutoRemediateEC2006Role

  AutoRemediateEC2-008:
    handler: functions/AutoRemediateEC2-008.handler
    timeout: 120
    memorySize: 128
    tags:
      Name: Auto Remediate EC2-008
      Owner: CloudConformity
      Role: Auto Remediate
      Environment: Ops
    package:
      include:
        - functions/AutoRemediateEC2-008.js
    role: AutoRemediateEC2008Role

  AutoRemediateEC2-043:
    handler: functions/AutoRemediateEC2-043.handler
    timeout: 120
    memorySize: 128
    tags:
      Name: Auto Remediate EC2-043
      Owner: CloudConformity
      Role: Auto Remediate
      Environment: Ops
    package:
      include:
        - functions/AutoRemediateEC2-043.js
    role: AutoRemediateEC2043Role

  AutoRemediateRS-023:
    handler: functions/AutoRemediateRS-023.handler
    timeout: 120
    memorySize: 128
    tags:
      Name: Auto Remediate RS-023
      Owner: CloudConformity
      Role: Auto Remediate
      Environment: Ops
    package:
      include:
        - functions/AutoRemediateRS-023.js
    role: AutoRemediateRS023Role


  AutoRemediateEC2-045:
    handler: functions/AutoRemediateEC2-045.handler
    timeout: 120
    memorySize: 128
    tags:
      Name: Auto Remediate EC2-045
      Owner: CloudConformity
      Role: Auto Remediate
      Environment: Ops
    package:
      include:
        - functions/AutoRemediateEC2-045.js
    role: AutoRemediateEC2045Role

  AutoRemediateEC2-038:
    handler: functions/AutoRemediateEC2-038.handler
    timeout: 120
    memorySize: 128
    tags:
      Name: Auto Remediate EC2-038
      Owner: CloudConformity
      Role: Auto Remediate
      Environment: Ops
    package:
      include:
        - functions/AutoRemediateEC2-038.js
    role: AutoRemediateEC2038Role

  AutoRemediateEC2-040:
    handler: functions/AutoRemediateEC2-040.handler
    timeout: 120
    memorySize: 128
    tags:
      Name: Auto Remediate EC2-040
      Owner: CloudConformity
      Role: Auto Remediate
      Environment: Ops
    package:
      include:
        - functions/AutoRemediateEC2-040.js
    role: AutoRemediateEC2040Role

  AutoRemediateEC2-039:
    handler: functions/AutoRemediateEC2-039.handler
    timeout: 120
    memorySize: 128
    tags:
      Name: Auto Remediate EC2-039
      Owner: CloudConformity
      Role: Auto Remediate
      Environment: Ops
    package:
      include:
        - functions/AutoRemediateEC2-039.js
    role: AutoRemediateEC2039Role

  TrustedAdvisor-003:
    handler: functions/AutoRemediateTrustedAdvisor-003.handler
    timeout: 120
    memorySize: 128
    tags:
      Name: Auto Remediate TrustedAdvisor-003
      Owner: CloudConformity
      Role: Auto Remediate
      Environment: Ops
    package:
      include:
        - functions/AutoRemediateTrustedAdvisor-003.js
    role: AutoRemediateTrustedAdvisor003Role

  AutoRemediateKinesis-001:
    handler: functions/AutoRemediateKinesis-001.handler
    timeout: 120
    memorySize: 128
    tags:
      Name: Auto Remediate Kinesis-001
      Owner: CloudConformity
      Role: Auto Remediate
      Environment: Ops
    package:
      include:
        - functions/AutoRemediateKinesis-001.js
    role: AutoRemediateKinesis001Role
resources:

  Resources:
    KmsKeySqsQueueFromSns:
      Type: "AWS::KMS::Key"
      Properties:
        Description: "Encrypts messages publishes to an SQS queue from an SNS topic"
        EnableKeyRotation: true
        KeyPolicy: '
                  {
                    "Version": "2012-10-17",
                    "Id": "Conformity-SNS-to-SQS-Key-${self:provider.region}",
                    "Statement":[
                      {
                        "Sid": "Enable IAM User Permissions",
                        "Effect": "Allow",
                        "Principal": {
                          "AWS": [ "arn:aws:iam::${aws:accountId}:root"]
                        },
                        "Action": "kms:*",
                        "Resource": "*"
                      },
                      {
                        "Sid": "Allow SQS",
                        "Effect": "Allow",
                        "Principal": {
                          "Service": "sqs.amazonaws.com"
                        },
                        "Action": [
                          "kms:GenerateDataKey",
                          "kms:Decrypt",
                          "kms:Encrypt"
                        ],
                        "Resource": "*"
                      },
                      {
                        "Sid": "Allow SNS",
                        "Effect": "Allow",
                        "Principal": {
                          "Service": "sns.amazonaws.com"
                        },
                        "Action": [
                          "kms:GenerateDataKey",
                          "kms:Decrypt",
                          "kms:Encrypt"
                        ],
                        "Resource": "*"
                      }
                    ]
                  }'

    KeyAlias:
      Type: AWS::KMS::Alias
      Properties:
        AliasName: alias/SNS-to-SQS-Key-${self:provider.region}
        TargetKeyId:
          Fn::GetAtt:
            - KmsKeySqsQueueFromSns
            - Arn

    SNSTopicAutoRemediate:
      Type: AWS::SNS::Topic
      Properties:
        DisplayName: CloudConformity Topic
        KmsMasterKeyId: alias/aws/sns
        TopicName: CloudConformity
        Tags:
          - Key: Service
            Value: ${self:service}
          - Key: Name
            Value: CloudConformity
          - Key: Owner
            Value: CloudConformity

    AutoRemediateQueue:
      Type: AWS::SQS::Queue
      Properties:
        QueueName: ${self:service}-${self:provider.stage}-queue
        VisibilityTimeout: 10
        DelaySeconds: 3
        RedrivePolicy:
          deadLetterTargetArn: !GetAtt
            - AutoRemediateQueueDLQ
            - Arn
          maxReceiveCount: 3
        KmsMasterKeyId: !GetAtt
          - KmsKeySqsQueueFromSns
          - Arn
        Tags:
          - Key: Service
            Value: ${self:service}
          - Key: Name
            Value: AutoRemediateQueue
          - Key: Owner
            Value: CloudConformity

    AutoRemediateQueueDLQ:
      Type: AWS::SQS::Queue
      Properties:
        QueueName: ${self:service}-${self:provider.stage}-queue-dlq
        KmsMasterKeyId: !GetAtt
          - KmsKeySqsQueueFromSns
          - Arn
        Tags:
          - Key: Service
            Value: ${self:service}
          - Key: Name
            Value: AutoRemediateQueueDLQ
          - Key: Owner
            Value: CloudConformity

    SNSToAutoRemediateQueueSqsPolicy:
      Type: AWS::SQS::QueuePolicy
      Properties:
        PolicyDocument:
          Version: "2012-10-17"
          Statement:
            - Sid: "allow-sns-messages"
              Effect: Allow
              Principal: "*"
              Resource: !GetAtt
                - AutoRemediateQueue
                - Arn
              Action: "SQS:SendMessage"
              Condition:
                ArnEquals:
                  "aws:SourceArn": !Ref SNSTopicAutoRemediate
        Queues:
          - Ref: AutoRemediateQueue

    AutoRemediateQueueSubscription:
      Type: AWS::SNS::Subscription
      Properties:
        TopicArn: !Ref SNSTopicAutoRemediate
        Endpoint: !GetAtt
          - AutoRemediateQueue
          - Arn
        Protocol: sqs
        RawMessageDelivery: "true"

    AutoRemediateEC2002Role:
      Type: AWS::IAM::Role
      Properties:
        RoleName: AutoRemediateEC2-002Role
        AssumeRolePolicyDocument:
          Version: '2012-10-17'
          Statement:
            - Effect: Allow
              Principal:
                Service:
                  - lambda.amazonaws.com
              Action:
                - sts:AssumeRole
        Policies:
          - PolicyName: AutoRemediationXRayPolicy
            PolicyDocument:
              Statement:
                - Effect: Allow
                  Action:
                    - xray:PutTraceSegments
                    - xray:PutTelemetryRecords
                  Resource: "*"
          - PolicyName: AutoRemediateEC2-002Policy
            PolicyDocument:
              Statement:
                - Effect: Allow
                  Action:
                    - logs:CreateLogGroup
                    - logs:CreateLogStream
                    - logs:PutLogEvents
                  Resource:
                    - 'Fn::Join':
                      - ':'
                      -
                        - 'arn:aws:logs'
                        - Ref: 'AWS::Region'
                        - Ref: 'AWS::AccountId'
                        - 'log-group:/aws/lambda/*:*:*'
                - Effect: Allow
                  Action:
                    - ec2:RevokeSecurityGroupIngress
                  Resource: "*"

    AutoRemediateEC2003Role:
      Type: AWS::IAM::Role
      Properties:
        RoleName: AutoRemediateEC2-003Role
        AssumeRolePolicyDocument:
          Version: '2012-10-17'
          Statement:
            - Effect: Allow
              Principal:
                Service:
                  - lambda.amazonaws.com
              Action:
                - sts:AssumeRole
        Policies:
          - PolicyName: AutoRemediationXRayPolicy
            PolicyDocument:
              Statement:
                - Effect: Allow
                  Action:
                    - xray:PutTraceSegments
                    - xray:PutTelemetryRecords
                  Resource: "*"
          - PolicyName: AutoRemediateEC2-003Policy
            PolicyDocument:
              Statement:
                - Effect: Allow
                  Action:
                    - logs:CreateLogGroup
                    - logs:CreateLogStream
                    - logs:PutLogEvents
                  Resource:
                    - 'Fn::Join':
                      - ':'
                      -
                        - 'arn:aws:logs'
                        - Ref: 'AWS::Region'
                        - Ref: 'AWS::AccountId'
                        - 'log-group:/aws/lambda/*:*:*'
                - Effect: Allow
                  Action:
                    - ec2:RevokeSecurityGroupIngress
                  Resource: "*"

    AutoRemediateS3014Role:
      Type: AWS::IAM::Role
      Properties:
        RoleName: AutoRemediateS3-014Role
        AssumeRolePolicyDocument:
          Version: '2012-10-17'
          Statement:
            - Effect: Allow
              Principal:
                Service:
                  - lambda.amazonaws.com
              Action:
                - sts:AssumeRole
        Policies:
          - PolicyName: AutoRemediationXRayPolicy
            PolicyDocument:
              Statement:
                - Effect: Allow
                  Action:
                    - xray:PutTraceSegments
                    - xray:PutTelemetryRecords
                  Resource: "*"
          - PolicyName: AutoRemediateS3-014Policy
            PolicyDocument:
              Statement:
                - Effect: Allow
                  Action:
                    - logs:CreateLogGroup
                    - logs:CreateLogStream
                    - logs:PutLogEvents
                  Resource:
                    - 'Fn::Join':
                      - ':'
                      -
                        - 'arn:aws:logs'
                        - Ref: 'AWS::Region'
                        - Ref: 'AWS::AccountId'
                        - 'log-group:/aws/lambda/*:*:*'
                - Effect: Allow
                  Action:
                    - s3:GetBucketPolicy
                    - s3:PutBucketPolicy
                  Resource: "*"


    AutoRemediateEC2005Role:
      Type: AWS::IAM::Role
      Properties:
        RoleName: AutoRemediateEC2-005Role
        AssumeRolePolicyDocument:
          Version: '2012-10-17'
          Statement:
            - Effect: Allow
              Principal:
                Service:
                  - lambda.amazonaws.com
              Action:
                - sts:AssumeRole
        Policies:
          - PolicyName: AutoRemediationXRayPolicy
            PolicyDocument:
              Statement:
                - Effect: Allow
                  Action:
                    - xray:PutTraceSegments
                    - xray:PutTelemetryRecords
                  Resource: "*"
          - PolicyName: AutoRemediateEC2-005Policy
            PolicyDocument:
              Statement:
                - Effect: Allow
                  Action:
                    - logs:CreateLogGroup
                    - logs:CreateLogStream
                    - logs:PutLogEvents
                  Resource:
                    - 'Fn::Join':
                      - ':'
                      -
                        - 'arn:aws:logs'
                        - Ref: 'AWS::Region'
                        - Ref: 'AWS::AccountId'
                        - 'log-group:/aws/lambda/*:*:*'
                - Effect: Allow
                  Action:
                    - ec2:RevokeSecurityGroupIngress
                  Resource: "*"

    AutoRemediateLambda003Role:
      Type: AWS::IAM::Role
      Properties:
        RoleName: AutoRemediateLambda-003Role
        AssumeRolePolicyDocument:
          Version: '2012-10-17'
          Statement:
            - Effect: Allow
              Principal:
                Service:
                  - lambda.amazonaws.com
              Action:
                - sts:AssumeRole
        Policies:
          - PolicyName: AutoRemediationXRayPolicy
            PolicyDocument:
              Statement:
                - Effect: Allow
                  Action:
                    - xray:PutTraceSegments
                    - xray:PutTelemetryRecords
                  Resource: "*"
          - PolicyName: AutoRemediateLambda-003Policy
            PolicyDocument:
              Statement:
                - Effect: Allow
                  Action:
                    - logs:CreateLogGroup
                    - logs:CreateLogStream
                    - logs:PutLogEvents
                  Resource:
                    - 'Fn::Join':
                      - ':'
                      -
                        - 'arn:aws:logs'
                        - Ref: 'AWS::Region'
                        - Ref: 'AWS::AccountId'
                        - 'log-group:/aws/lambda/*:*:*'
                - Effect: Allow
                  Action:
                    - lambda:UpdateFunctionConfiguration
                    - lambda:GetFunctionConfiguration
                    - iam:AttachRolePolicy

                  Resource: "*"

    AutoRemediateEC2043Role:
      Type: AWS::IAM::Role
      Properties:
        RoleName: AutoRemediateEC2-043Role
        AssumeRolePolicyDocument:
          Version: '2012-10-17'
          Statement:
            - Effect: Allow
              Principal:
                Service:
                  - lambda.amazonaws.com
              Action:
                - sts:AssumeRole
        Policies:
          - PolicyName: AutoRemediationXRayPolicy
            PolicyDocument:
              Statement:
                - Effect: Allow
                  Action:
                    - xray:PutTraceSegments
                    - xray:PutTelemetryRecords
                  Resource: "*"
          - PolicyName: AutoRemediateEC2-043Policy
            PolicyDocument:
              Statement:
                - Effect: Allow
                  Action:
                    - logs:CreateLogGroup
                    - logs:CreateLogStream
                    - logs:PutLogEvents
                  Resource:
                    - 'Fn::Join':
                      - ':'
                      -
                        - 'arn:aws:logs'
                        - Ref: 'AWS::Region'
                        - Ref: 'AWS::AccountId'
                        - 'log-group:/aws/lambda/*:*:*'
                - Effect: Allow
                  Action:
                    - ec2:RevokeSecurityGroupIngress
                  Resource: "*"

    AutoRemediateIAM001Role:
      Type: AWS::IAM::Role
      Properties:
        RoleName: AutoRemediateIAM-001Role
        AssumeRolePolicyDocument:
          Version: '2012-10-17'
          Statement:
            - Effect: Allow
              Principal:
                Service:
                  - lambda.amazonaws.com
              Action:
                - sts:AssumeRole
        Policies:
          - PolicyName: AutoRemediationXRayPolicy
            PolicyDocument:
              Statement:
                - Effect: Allow
                  Action:
                    - xray:PutTraceSegments
                    - xray:PutTelemetryRecords
                  Resource: "*"
          - PolicyName: AutoRemediateIAM-001Policy
            PolicyDocument:
              Statement:
                - Effect: Allow
                  Action:
                    - logs:CreateLogGroup
                    - logs:CreateLogStream
                    - logs:PutLogEvents
                  Resource:
                    - 'Fn::Join':
                      - ':'
                      -
                        - 'arn:aws:logs'
                        - Ref: 'AWS::Region'
                        - Ref: 'AWS::AccountId'
                        - 'log-group:/aws/lambda/*:*:*'
                - Effect: Allow
                  Action:
                    - iam:UpdateAccessKey
                  Resource: "*"

    AutoRemediateEC2042Role:
      Type: AWS::IAM::Role
      Properties:
        RoleName: AutoRemediateEC2-042Role
        AssumeRolePolicyDocument:
          Version: '2012-10-17'
          Statement:
            - Effect: Allow
              Principal:
                Service:
                  - lambda.amazonaws.com
              Action:
                - sts:AssumeRole
        Policies:
          - PolicyName: AutoRemediationXRayPolicy
            PolicyDocument:
              Statement:
                - Effect: Allow
                  Action:
                    - xray:PutTraceSegments
                    - xray:PutTelemetryRecords
                  Resource: "*"
          - PolicyName: AutoRemediateEC2-042Policy
            PolicyDocument:
              Statement:
                - Effect: Allow
                  Action:
                    - logs:CreateLogGroup
                    - logs:CreateLogStream
                    - logs:PutLogEvents
                  Resource:
                    - 'Fn::Join':
                      - ':'
                      -
                        - 'arn:aws:logs'
                        - Ref: 'AWS::Region'
                        - Ref: 'AWS::AccountId'
                        - 'log-group:/aws/lambda/*:*:*'
                - Effect: Allow
                  Action:
                    - ec2:RevokeSecurityGroupIngress
                  Resource: "*"

    AutoRemediateRS001Role:
      Type: AWS::IAM::Role
      Properties:
        RoleName: AutoRemediateRS-001Role
        AssumeRolePolicyDocument:
          Version: '2012-10-17'
          Statement:
            - Effect: Allow
              Principal:
                Service:
                  - lambda.amazonaws.com
              Action:
                - sts:AssumeRole
        Policies:
          - PolicyName: AutoRemediationXRayPolicy
            PolicyDocument:
              Statement:
                - Effect: Allow
                  Action:
                    - xray:PutTraceSegments
                    - xray:PutTelemetryRecords
                  Resource: "*"
          - PolicyName: AutoRemediateRS-001Policy
            PolicyDocument:
              Statement:
                - Effect: Allow
                  Action:
                    - logs:CreateLogGroup
                    - logs:CreateLogStream
                    - logs:PutLogEvents
                  Resource:
                    - 'Fn::Join':
                      - ':'
                      -
                        - 'arn:aws:logs'
                        - Ref: 'AWS::Region'
                        - Ref: 'AWS::AccountId'
                        - 'log-group:/aws/lambda/*:*:*'
                - Effect: Allow
                  Action:
                    - redshift:ModifyCluster
                  Resource: "*"

    AutoRemediateKMS002Role:
      Type: AWS::IAM::Role
      Properties:
        RoleName: AutoRemediateKMS-002Role
        AssumeRolePolicyDocument:
          Version: '2012-10-17'
          Statement:
            - Effect: Allow
              Principal:
                Service:
                  - lambda.amazonaws.com
              Action:
                - sts:AssumeRole
        Policies:
          - PolicyName: AutoRemediationXRayPolicy
            PolicyDocument:
              Statement:
                - Effect: Allow
                  Action:
                    - xray:PutTraceSegments
                    - xray:PutTelemetryRecords
                  Resource: "*"
          - PolicyName: AutoRemediateKMS-002Policy
            PolicyDocument:
              Statement:
                - Effect: Allow
                  Action:
                    - logs:CreateLogGroup
                    - logs:CreateLogStream
                    - logs:PutLogEvents
                  Resource:
                    - 'Fn::Join':
                      - ':'
                      -
                        - 'arn:aws:logs'
                        - Ref: 'AWS::Region'
                        - Ref: 'AWS::AccountId'
                        - 'log-group:/aws/lambda/*:*:*'
                - Effect: Allow
                  Action:
                    - kms:EnableKeyRotation
                  Resource: "*"

    AutoRemediateCFM005Role:
      Type: AWS::IAM::Role
      Properties:
        RoleName: AutoRemediateCFM-005Role
        AssumeRolePolicyDocument:
          Version: '2012-10-17'
          Statement:
            - Effect: Allow
              Principal:
                Service:
                  - lambda.amazonaws.com
              Action:
                - sts:AssumeRole
        Policies:
          - PolicyName: AutoRemediationXRayPolicy
            PolicyDocument:
              Statement:
                - Effect: Allow
                  Action:
                    - xray:PutTraceSegments
                    - xray:PutTelemetryRecords
                  Resource: "*"
          - PolicyName: AutoRemediateCFM-005Policy
            PolicyDocument:
              Statement:
                - Effect: Allow
                  Action:
                    - logs:CreateLogGroup
                    - logs:CreateLogStream
                    - logs:PutLogEvents
                  Resource:
                    - 'Fn::Join':
                      - ':'
                      -
                        - 'arn:aws:logs'
                        - Ref: 'AWS::Region'
                        - Ref: 'AWS::AccountId'
                        - 'log-group:/aws/lambda/*:*:*'
                - Effect: Allow
                  Action:
                    - cloudformation:UpdateTerminationProtection
                  Resource: "*"

    AutoRemediateRS019Role:
      Type: AWS::IAM::Role
      Properties:
        RoleName: AutoRemediateRS-019Role
        AssumeRolePolicyDocument:
          Version: '2012-10-17'
          Statement:
            - Effect: Allow
              Principal:
                Service:
                  - lambda.amazonaws.com
              Action:
                - sts:AssumeRole
        Policies:
          - PolicyName: AutoRemediationXRayPolicy
            PolicyDocument:
              Statement:
                - Effect: Allow
                  Action:
                    - xray:PutTraceSegments
                    - xray:PutTelemetryRecords
                  Resource: "*"
          - PolicyName: AutoRemediateRS-019Policy
            PolicyDocument:
              Statement:
                - Effect: Allow
                  Action:
                    - logs:CreateLogGroup
                    - logs:CreateLogStream
                    - logs:PutLogEvents
                  Resource:
                    - 'Fn::Join':
                      - ':'
                      -
                        - 'arn:aws:logs'
                        - Ref: 'AWS::Region'
                        - Ref: 'AWS::AccountId'
                        - 'log-group:/aws/lambda/*:*:*'
                - Effect: Allow
                  Action:
                    - redshift:ModifyCluster
                  Resource: "*"

    AutoRemediateConfig001Role:
      Type: AWS::IAM::Role
      Properties:
        RoleName: AutoRemediateConfig-001Role
        AssumeRolePolicyDocument:
          Version: '2012-10-17'
          Statement:
            - Effect: Allow
              Principal:
                Service:
                  - lambda.amazonaws.com
              Action:
                - sts:AssumeRole
        Policies:
          - PolicyName: AutoRemediationXRayPolicy
            PolicyDocument:
              Statement:
                - Effect: Allow
                  Action:
                    - xray:PutTraceSegments
                    - xray:PutTelemetryRecords
                  Resource: "*"
          - PolicyName: AutoRemediateConfig-001Policy
            PolicyDocument:
              Statement:
                - Effect: Allow
                  Action:
                    - logs:CreateLogGroup
                    - logs:CreateLogStream
                    - logs:PutLogEvents
                  Resource:
                    - 'Fn::Join':
                      - ':'
                      -
                        - 'arn:aws:logs'
                        - Ref: 'AWS::Region'
                        - Ref: 'AWS::AccountId'
                        - 'log-group:/aws/lambda/*:*:*'
                - Effect: Allow
                  Action:
                    - config:PutConfigurationRecorder
                    - config:PutDeliveryChannel
                    - config:StartConfigurationRecorder
                  Resource: "*"
                - Effect: Allow
                  Action:
                    - iam:AttachRolePolicy
                    - iam:CreateRole
                    - iam:GetRole
                    - iam:PutRolePolicy
                  Resource: "*"
                - Effect: Allow
                  Action:
                    - sts:GetCallerIdentity
                  Resource: "*"

    AutoRemediateRDS008Role:
      Type: AWS::IAM::Role
      Properties:
        RoleName: AutoRemediateRDS-008Role
        AssumeRolePolicyDocument:
          Version: '2012-10-17'
          Statement:
            - Effect: Allow
              Principal:
                Service:
                  - lambda.amazonaws.com
              Action:
                - sts:AssumeRole
        Policies:
          - PolicyName: AutoRemediationXRayPolicy
            PolicyDocument:
              Statement:
                - Effect: Allow
                  Action:
                    - xray:PutTraceSegments
                    - xray:PutTelemetryRecords
                  Resource: "*"
          - PolicyName: AutoRemediateRDS-008Policy
            PolicyDocument:
              Statement:
                - Effect: Allow
                  Action:
                    - logs:CreateLogGroup
                    - logs:CreateLogStream
                    - logs:PutLogEvents
                  Resource:
                    - 'Fn::Join':
                      - ':'
                      -
                        - 'arn:aws:logs'
                        - Ref: 'AWS::Region'
                        - Ref: 'AWS::AccountId'
                        - 'log-group:/aws/lambda/*:*:*'
                - Effect: Allow
                  Action:
                    - rds:ModifyDBInstance
                  Resource: "*"

    AutoRemediateCT001Role:
      Type: AWS::IAM::Role
      Properties:
        RoleName: AutoRemediateCT-001Role
        AssumeRolePolicyDocument:
          Version: '2012-10-17'
          Statement:
            - Effect: Allow
              Principal:
                Service:
                  - lambda.amazonaws.com
              Action:
                - sts:AssumeRole
        Policies:
          - PolicyName: AutoRemediationXRayPolicy
            PolicyDocument:
              Statement:
                - Effect: Allow
                  Action:
                    - xray:PutTraceSegments
                    - xray:PutTelemetryRecords
                  Resource: "*"
          - PolicyName: AutoRemediateCT-001Policy
            PolicyDocument:
              Statement:
                - Effect: Allow
                  Action:
                    - logs:CreateLogGroup
                    - logs:CreateLogStream
                    - logs:PutLogEvents
                  Resource:
                    - 'Fn::Join':
                      - ':'
                      -
                        - 'arn:aws:logs'
                        - Ref: 'AWS::Region'
                        - Ref: 'AWS::AccountId'
                        - 'log-group:/aws/lambda/*:*:*'
                - Effect: Allow
                  Action:
                    - cloudtrail:UpdateTrail
                  Resource: "*"

    AutoRemediateS3001Role:
      Type: AWS::IAM::Role
      Properties:
        RoleName: AutoRemediateS3-001Role
        AssumeRolePolicyDocument:
          Version: '2012-10-17'
          Statement:
            - Effect: Allow
              Principal:
                Service:
                  - lambda.amazonaws.com
              Action:
                - sts:AssumeRole
        Policies:
          - PolicyName: AutoRemediationXRayPolicy
            PolicyDocument:
              Statement:
                - Effect: Allow
                  Action:
                    - xray:PutTraceSegments
                    - xray:PutTelemetryRecords
                  Resource: "*"
          - PolicyName: AutoRemediateS3-001Policy
            PolicyDocument:
              Statement:
                - Effect: Allow
                  Action:
                    - logs:CreateLogGroup
                    - logs:CreateLogStream
                    - logs:PutLogEvents
                  Resource:
                    - 'Fn::Join':
                      - ':'
                      -
                        - 'arn:aws:logs'
                        - Ref: 'AWS::Region'
                        - Ref: 'AWS::AccountId'
                        - 'log-group:/aws/lambda/*:*:*'
                - Effect: Allow
                  Action:
                    - s3:GetBucketAcl
                    - s3:PutBucketAcl
                  Resource: "*"

    AutoRemediateS3002Role:
      Type: AWS::IAM::Role
      Properties:
        RoleName: AutoRemediateS3-002Role
        AssumeRolePolicyDocument:
          Version: '2012-10-17'
          Statement:
            - Effect: Allow
              Principal:
                Service:
                  - lambda.amazonaws.com
              Action:
                - sts:AssumeRole
        Policies:
          - PolicyName: AutoRemediationXRayPolicy
            PolicyDocument:
              Statement:
                - Effect: Allow
                  Action:
                    - xray:PutTraceSegments
                    - xray:PutTelemetryRecords
                  Resource: "*"
          - PolicyName: AutoRemediateS3-002Policy
            PolicyDocument:
              Statement:
                - Effect: Allow
                  Action:
                    - logs:CreateLogGroup
                    - logs:CreateLogStream
                    - logs:PutLogEvents
                  Resource:
                    - 'Fn::Join':
                      - ':'
                      -
                        - 'arn:aws:logs'
                        - Ref: 'AWS::Region'
                        - Ref: 'AWS::AccountId'
                        - 'log-group:/aws/lambda/*:*:*'
                - Effect: Allow
                  Action:
                    - s3:GetBucketAcl
                    - s3:PutBucketAcl
                  Resource: "*"

    AutoRemediateS3003Role:
      Type: AWS::IAM::Role
      Properties:
        RoleName: AutoRemediateS3-003Role
        AssumeRolePolicyDocument:
          Version: '2012-10-17'
          Statement:
            - Effect: Allow
              Principal:
                Service:
                  - lambda.amazonaws.com
              Action:
                - sts:AssumeRole
        Policies:
          - PolicyName: AutoRemediationXRayPolicy
            PolicyDocument:
              Statement:
                - Effect: Allow
                  Action:
                    - xray:PutTraceSegments
                    - xray:PutTelemetryRecords
                  Resource: "*"
          - PolicyName: AutoRemediateS3-003Policy
            PolicyDocument:
              Statement:
                - Effect: Allow
                  Action:
                    - logs:CreateLogGroup
                    - logs:CreateLogStream
                    - logs:PutLogEvents
                  Resource:
                    - 'Fn::Join':
                      - ':'
                      -
                        - 'arn:aws:logs'
                        - Ref: 'AWS::Region'
                        - Ref: 'AWS::AccountId'
                        - 'log-group:/aws/lambda/*:*:*'
                - Effect: Allow
                  Action:
                    - s3:GetBucketAcl
                    - s3:PutBucketAcl
                  Resource: "*"

    AutoRemediateGD001Role:
      Type: AWS::IAM::Role
      Properties:
        RoleName: AutoRemediateGD-001Role
        AssumeRolePolicyDocument:
          Version: '2012-10-17'
          Statement:
            - Effect: Allow
              Principal:
                Service:
                  - lambda.amazonaws.com
              Action:
                - sts:AssumeRole
        Policies:
          - PolicyName: AutoRemediationXRayPolicy
            PolicyDocument:
              Statement:
                - Effect: Allow
                  Action:
                    - xray:PutTraceSegments
                    - xray:PutTelemetryRecords
                  Resource: "*"
          - PolicyName: AutoRemediateGD-001Policy
            PolicyDocument:
              Statement:
                - Effect: Allow
                  Action:
                    - logs:CreateLogGroup
                    - logs:CreateLogStream
                    - logs:PutLogEvents
                  Resource:
                    - 'Fn::Join':
                      - ':'
                      -
                        - 'arn:aws:logs'
                        - Ref: 'AWS::Region'
                        - Ref: 'AWS::AccountId'
                        - 'log-group:/aws/lambda/*:*:*'
                - Effect: Allow
                  Action:
                    - guardduty:CreateDetector
                    - iam:CreateServiceLinkedRole
                  Resource: "*"

    AutoRemediateS3009Role:
      Type: AWS::IAM::Role
      Properties:
        RoleName: AutoRemediateS3-009Role
        AssumeRolePolicyDocument:
          Version: '2012-10-17'
          Statement:
            - Effect: Allow
              Principal:
                Service:
                  - lambda.amazonaws.com
              Action:
                - sts:AssumeRole
        Policies:
          - PolicyName: AutoRemediationXRayPolicy
            PolicyDocument:
              Statement:
                - Effect: Allow
                  Action:
                    - xray:PutTraceSegments
                    - xray:PutTelemetryRecords
                  Resource: "*"
          - PolicyName: AutoRemediateS3-009Policy
            PolicyDocument:
              Statement:
                - Effect: Allow
                  Action:
                    - logs:CreateLogGroup
                    - logs:CreateLogStream
                    - logs:PutLogEvents
                  Resource:
                    - 'Fn::Join':
                      - ':'
                      -
                        - 'arn:aws:logs'
                        - Ref: 'AWS::Region'
                        - Ref: 'AWS::AccountId'
                        - 'log-group:/aws/lambda/*:*:*'
                - Effect: Allow
                  Action:
                    - s3:GetBucketAcl
                    - s3:PutBucketAcl
                  Resource: "*"

    AutoRemediateIAM038Role:
      Type: AWS::IAM::Role
      Properties:
        RoleName: AutoRemediateIAM-038Role
        AssumeRolePolicyDocument:
          Version: '2012-10-17'
          Statement:
            - Effect: Allow
              Principal:
                Service:
                  - lambda.amazonaws.com
              Action:
                - sts:AssumeRole
        Policies:
          - PolicyName: AutoRemediationXRayPolicy
            PolicyDocument:
              Statement:
                - Effect: Allow
                  Action:
                    - xray:PutTraceSegments
                    - xray:PutTelemetryRecords
                  Resource: "*"
          - PolicyName: AutoRemediateIAM-038Policy
            PolicyDocument:
              Statement:
                - Effect: Allow
                  Action:
                    - logs:CreateLogGroup
                    - logs:CreateLogStream
                    - logs:PutLogEvents
                  Resource:
                    - 'Fn::Join':
                      - ':'
                      -
                        - 'arn:aws:logs'
                        - Ref: 'AWS::Region'
                        - Ref: 'AWS::AccountId'
                        - 'log-group:/aws/lambda/*:*:*'
                - Effect: Allow
                  Action:
                    - iam:UpdateAccessKey
                  Resource: "*"

    AutoRemediateS3012Role:
      Type: AWS::IAM::Role
      Properties:
        RoleName: AutoRemediateS3-012Role
        AssumeRolePolicyDocument:
          Version: '2012-10-17'
          Statement:
            - Effect: Allow
              Principal:
                Service:
                  - lambda.amazonaws.com
              Action:
                - sts:AssumeRole
        Policies:
          - PolicyName: AutoRemediationXRayPolicy
            PolicyDocument:
              Statement:
                - Effect: Allow
                  Action:
                    - xray:PutTraceSegments
                    - xray:PutTelemetryRecords
                  Resource: "*"
          - PolicyName: AutoRemediateS3-012Policy
            PolicyDocument:
              Statement:
                - Effect: Allow
                  Action:
                    - logs:CreateLogGroup
                    - logs:CreateLogStream
                    - logs:PutLogEvents
                  Resource:
                    - 'Fn::Join':
                      - ':'
                      -
                        - 'arn:aws:logs'
                        - Ref: 'AWS::Region'
                        - Ref: 'AWS::AccountId'
                        - 'log-group:/aws/lambda/*:*:*'
                - Effect: Allow
                  Action:
                    - s3:PutBucketVersioning
                  Resource: "*"


    AutoRemediateOrganizations002Role:
      Type: AWS::IAM::Role
      Properties:
        RoleName: AutoRemediateOrganizations-002Role
        AssumeRolePolicyDocument:
          Version: '2012-10-17'
          Statement:
            - Effect: Allow
              Principal:
                Service:
                  - lambda.amazonaws.com
              Action:
                - sts:AssumeRole
        Policies:
          - PolicyName: AutoRemediationXRayPolicy
            PolicyDocument:
              Statement:
                - Effect: Allow
                  Action:
                    - xray:PutTraceSegments
                    - xray:PutTelemetryRecords
                  Resource: "*"
          - PolicyName: AutoRemediateOrganizations-002Policy
            PolicyDocument:
              Statement:
                - Effect: Allow
                  Action:
                    - logs:CreateLogGroup
                    - logs:CreateLogStream
                    - logs:PutLogEvents
                  Resource:
                    - 'Fn::Join':
                      - ':'
                      -
                        - 'arn:aws:logs'
                        - Ref: 'AWS::Region'
                        - Ref: 'AWS::AccountId'
                        - 'log-group:/aws/lambda/*:*:*'
                - Effect: Allow
                  Action:
                    - organizations:EnableAllFeatures
                  Resource: "*"

    AutoRemediateOrchestratorRole:
      Type: AWS::IAM::Role
      Properties:
        RoleName: AutoRemediateOrchestratorRole
        AssumeRolePolicyDocument:
          Version: '2012-10-17'
          Statement:
            - Effect: Allow
              Principal:
                Service:
                  - lambda.amazonaws.com
              Action:
                - sts:AssumeRole
        Policies:
          - PolicyName: AutoRemediationXRayPolicy
            PolicyDocument:
              Statement:
                - Effect: Allow
                  Action:
                    - xray:PutTraceSegments
                    - xray:PutTelemetryRecords
                  Resource: "*"
          - PolicyName: AutoRemediateOrchestratorPolicy
            PolicyDocument:
              Statement:
                - Effect: Allow
                  Action:
                    - logs:CreateLogGroup
                    - logs:CreateLogStream
                    - logs:PutLogEvents
                  Resource:
                    - 'Fn::Join':
                      - ':'
                      -
                        - 'arn:aws:logs'
                        - Ref: 'AWS::Region'
                        - Ref: 'AWS::AccountId'
                        - 'log-group:/aws/lambda/*:*:*'
                - Effect: Allow
                  Action:
                    - lambda:InvokeFunction
                  Resource: "*"
                - Effect: Allow
                  Action:
                    - kms:Decrypt
                    - kms:GenerateDataKey
                  Resource: !GetAtt
                    - KmsKeySqsQueueFromSns
                    - Arn
                - Effect: Allow
                  Action:
                    - sqs:SendMessage
                    - sqs:ReceiveMessage
                    - sqs:DeleteMessage
                    - sqs:ListQueues*
                    - sqs:GetQueueAttributes
                  Resource: !GetAtt
                    - AutoRemediateQueue
                    - Arn

    AutoRemediateS3004Role:
      Type: AWS::IAM::Role
      Properties:
        RoleName: AutoRemediateS3-004Role
        AssumeRolePolicyDocument:
          Version: '2012-10-17'
          Statement:
            - Effect: Allow
              Principal:
                Service:
                  - lambda.amazonaws.com
              Action:
                - sts:AssumeRole
        Policies:
          - PolicyName: AutoRemediationXRayPolicy
            PolicyDocument:
              Statement:
                - Effect: Allow
                  Action:
                    - xray:PutTraceSegments
                    - xray:PutTelemetryRecords
                  Resource: "*"
          - PolicyName: AutoRemediateS3-004Policy
            PolicyDocument:
              Statement:
                - Effect: Allow
                  Action:
                    - logs:CreateLogGroup
                    - logs:CreateLogStream
                    - logs:PutLogEvents
                  Resource:
                    - 'Fn::Join':
                      - ':'
                      -
                        - 'arn:aws:logs'
                        - Ref: 'AWS::Region'
                        - Ref: 'AWS::AccountId'
                        - 'log-group:/aws/lambda/*:*:*'
                - Effect: Allow
                  Action:
                    - s3:GetBucketAcl
                    - s3:PutBucketAcl
                  Resource: "*"

    AutoRemediateEBS009Role:
      Type: AWS::IAM::Role
      Properties:
        RoleName: AutoRemediateEBS-009Role
        AssumeRolePolicyDocument:
          Version: '2012-10-17'
          Statement:
            - Effect: Allow
              Principal:
                Service:
                  - lambda.amazonaws.com
              Action:
                - sts:AssumeRole
        Policies:
          - PolicyName: AutoRemediationXRayPolicy
            PolicyDocument:
              Statement:
                - Effect: Allow
                  Action:
                    - xray:PutTraceSegments
                    - xray:PutTelemetryRecords
                  Resource: "*"
          - PolicyName: AutoRemediateEBS-009Policy
            PolicyDocument:
              Statement:
                - Effect: Allow
                  Action:
                    - logs:CreateLogGroup
                    - logs:CreateLogStream
                    - logs:PutLogEvents
                  Resource:
                    - 'Fn::Join':
                      - ':'
                      -
                        - 'arn:aws:logs'
                        - Ref: 'AWS::Region'
                        - Ref: 'AWS::AccountId'
                        - 'log-group:/aws/lambda/*:*:*'
                - Effect: Allow
                  Action:
                    - ec2:ModifySnapshotAttribute
                  Resource: "*"

    AutoRemediateS3005Role:
      Type: AWS::IAM::Role
      Properties:
        RoleName: AutoRemediateS3-005Role
        AssumeRolePolicyDocument:
          Version: '2012-10-17'
          Statement:
            - Effect: Allow
              Principal:
                Service:
                  - lambda.amazonaws.com
              Action:
                - sts:AssumeRole
        Policies:
          - PolicyName: AutoRemediationXRayPolicy
            PolicyDocument:
              Statement:
                - Effect: Allow
                  Action:
                    - xray:PutTraceSegments
                    - xray:PutTelemetryRecords
                  Resource: "*"
          - PolicyName: AutoRemediateS3-005Policy
            PolicyDocument:
              Statement:
                - Effect: Allow
                  Action:
                    - logs:CreateLogGroup
                    - logs:CreateLogStream
                    - logs:PutLogEvents
                  Resource:
                    - 'Fn::Join':
                      - ':'
                      -
                        - 'arn:aws:logs'
                        - Ref: 'AWS::Region'
                        - Ref: 'AWS::AccountId'
                        - 'log-group:/aws/lambda/*:*:*'
                - Effect: Allow
                  Action:
                    - s3:GetBucketAcl
                    - s3:PutBucketAcl
                  Resource: "*"

    AutoRemediateS3006Role:
      Type: AWS::IAM::Role
      Properties:
        RoleName: AutoRemediateS3-006Role
        AssumeRolePolicyDocument:
          Version: '2012-10-17'
          Statement:
            - Effect: Allow
              Principal:
                Service:
                  - lambda.amazonaws.com
              Action:
                - sts:AssumeRole
        Policies:
          - PolicyName: AutoRemediationXRayPolicy
            PolicyDocument:
              Statement:
                - Effect: Allow
                  Action:
                    - xray:PutTraceSegments
                    - xray:PutTelemetryRecords
                  Resource: "*"
          - PolicyName: AutoRemediateS3-006Policy
            PolicyDocument:
              Statement:
                - Effect: Allow
                  Action:
                    - logs:CreateLogGroup
                    - logs:CreateLogStream
                    - logs:PutLogEvents
                  Resource:
                    - 'Fn::Join':
                      - ':'
                      -
                        - 'arn:aws:logs'
                        - Ref: 'AWS::Region'
                        - Ref: 'AWS::AccountId'
                        - 'log-group:/aws/lambda/*:*:*'
                - Effect: Allow
                  Action:
                    - s3:GetBucketAcl
                    - s3:PutBucketAcl
                  Resource: "*"

    AutoRemediateS3007Role:
      Type: AWS::IAM::Role
      Properties:
        RoleName: AutoRemediateS3-007Role
        AssumeRolePolicyDocument:
          Version: '2012-10-17'
          Statement:
            - Effect: Allow
              Principal:
                Service:
                  - lambda.amazonaws.com
              Action:
                - sts:AssumeRole
        Policies:
          - PolicyName: AutoRemediationXRayPolicy
            PolicyDocument:
              Statement:
                - Effect: Allow
                  Action:
                    - xray:PutTraceSegments
                    - xray:PutTelemetryRecords
                  Resource: "*"
          - PolicyName: AutoRemediateS3-007Policy
            PolicyDocument:
              Statement:
                - Effect: Allow
                  Action:
                    - logs:CreateLogGroup
                    - logs:CreateLogStream
                    - logs:PutLogEvents
                  Resource:
                    - 'Fn::Join':
                      - ':'
                      -
                        - 'arn:aws:logs'
                        - Ref: 'AWS::Region'
                        - Ref: 'AWS::AccountId'
                        - 'log-group:/aws/lambda/*:*:*'
                - Effect: Allow
                  Action:
                    - s3:GetBucketAcl
                    - s3:PutBucketAcl
                  Resource: "*"

    AutoRemediateEC2019Role:
      Type: AWS::IAM::Role
      Properties:
        RoleName: AutoRemediateEC2-019Role
        AssumeRolePolicyDocument:
          Version: '2012-10-17'
          Statement:
            - Effect: Allow
              Principal:
                Service:
                  - lambda.amazonaws.com
              Action:
                - sts:AssumeRole
        Policies:
          - PolicyName: AutoRemediationXRayPolicy
            PolicyDocument:
              Statement:
                - Effect: Allow
                  Action:
                    - xray:PutTraceSegments
                    - xray:PutTelemetryRecords
                  Resource: "*"
          - PolicyName: AutoRemediateEC2-019Policy
            PolicyDocument:
              Statement:
                - Effect: Allow
                  Action:
                    - logs:CreateLogGroup
                    - logs:CreateLogStream
                    - logs:PutLogEvents
                  Resource:
                    - 'Fn::Join':
                      - ':'
                      -
                        - 'arn:aws:logs'
                        - Ref: 'AWS::Region'
                        - Ref: 'AWS::AccountId'
                        - 'log-group:/aws/lambda/*:*:*'
                - Effect: Allow
                  Action:
                    - ec2:ModifyImageAttribute
                  Resource: "*"


    AutoRemediateS3008Role:
      Type: AWS::IAM::Role
      Properties:
        RoleName: AutoRemediateS3-008Role
        AssumeRolePolicyDocument:
          Version: '2012-10-17'
          Statement:
            - Effect: Allow
              Principal:
                Service:
                  - lambda.amazonaws.com
              Action:
                - sts:AssumeRole
        Policies:
          - PolicyName: AutoRemediationXRayPolicy
            PolicyDocument:
              Statement:
                - Effect: Allow
                  Action:
                    - xray:PutTraceSegments
                    - xray:PutTelemetryRecords
                  Resource: "*"
          - PolicyName: AutoRemediateS3-008Policy
            PolicyDocument:
              Statement:
                - Effect: Allow
                  Action:
                    - logs:CreateLogGroup
                    - logs:CreateLogStream
                    - logs:PutLogEvents
                  Resource:
                    - 'Fn::Join':
                      - ':'
                      -
                        - 'arn:aws:logs'
                        - Ref: 'AWS::Region'
                        - Ref: 'AWS::AccountId'
                        - 'log-group:/aws/lambda/*:*:*'
                - Effect: Allow
                  Action:
                    - s3:GetBucketAcl
                    - s3:PutBucketAcl
                  Resource: "*"

    AutoRemediateS3010Role:
      Type: AWS::IAM::Role
      Properties:
        RoleName: AutoRemediateS3-010Role
        AssumeRolePolicyDocument:
          Version: '2012-10-17'
          Statement:
            - Effect: Allow
              Principal:
                Service:
                  - lambda.amazonaws.com
              Action:
                - sts:AssumeRole
        Policies:
          - PolicyName: AutoRemediationXRayPolicy
            PolicyDocument:
              Statement:
                - Effect: Allow
                  Action:
                    - xray:PutTraceSegments
                    - xray:PutTelemetryRecords
                  Resource: "*"
          - PolicyName: AutoRemediateS3-010Policy
            PolicyDocument:
              Statement:
                - Effect: Allow
                  Action:
                    - logs:CreateLogGroup
                    - logs:CreateLogStream
                    - logs:PutLogEvents
                  Resource:
                    - 'Fn::Join':
                      - ':'
                      -
                        - 'arn:aws:logs'
                        - Ref: 'AWS::Region'
                        - Ref: 'AWS::AccountId'
                        - 'log-group:/aws/lambda/*:*:*'
                - Effect: Allow
                  Action:
                    - s3:GetBucketAcl
                    - s3:PutBucketAcl
                  Resource: "*"

    AutoRemediateRDS006Role:
      Type: AWS::IAM::Role
      Properties:
        RoleName: AutoRemediateRDS-006Role
        AssumeRolePolicyDocument:
          Version: '2012-10-17'
          Statement:
            - Effect: Allow
              Principal:
                Service:
                  - lambda.amazonaws.com
              Action:
                - sts:AssumeRole
        Policies:
          - PolicyName: AutoRemediationXRayPolicy
            PolicyDocument:
              Statement:
                - Effect: Allow
                  Action:
                    - xray:PutTraceSegments
                    - xray:PutTelemetryRecords
                  Resource: "*"
          - PolicyName: AutoRemediateRDS-006Policy
            PolicyDocument:
              Statement:
                - Effect: Allow
                  Action:
                    - logs:CreateLogGroup
                    - logs:CreateLogStream
                    - logs:PutLogEvents
                  Resource:
                    - 'Fn::Join':
                      - ':'
                      -
                        - 'arn:aws:logs'
                        - Ref: 'AWS::Region'
                        - Ref: 'AWS::AccountId'
                        - 'log-group:/aws/lambda/*:*:*'
                - Effect: Allow
                  Action:
                    - rds:ModifyDbInstance
                  Resource: "*"

    AutoRemediateS3016Role:
      Type: AWS::IAM::Role
      Properties:
        RoleName: AutoRemediateS3-016Role
        AssumeRolePolicyDocument:
          Version: '2012-10-17'
          Statement:
            - Effect: Allow
              Principal:
                Service:
                  - lambda.amazonaws.com
              Action:
                - sts:AssumeRole
        Policies:
          - PolicyName: AutoRemediationXRayPolicy
            PolicyDocument:
              Statement:
                - Effect: Allow
                  Action:
                    - xray:PutTraceSegments
                    - xray:PutTelemetryRecords
                  Resource: "*"
          - PolicyName: AutoRemediateS3-016Policy
            PolicyDocument:
              Statement:
                - Effect: Allow
                  Action:
                    - logs:CreateLogGroup
                    - logs:CreateLogStream
                    - logs:PutLogEvents
                  Resource:
                    - 'Fn::Join':
                      - ':'
                      -
                        - 'arn:aws:logs'
                        - Ref: 'AWS::Region'
                        - Ref: 'AWS::AccountId'
                        - 'log-group:/aws/lambda/*:*:*'
                - Effect: Allow
                  Action:
                    - s3:GetBucketPolicy
                    - s3:PutBucketPolicy
                  Resource: "*"

    AutoRemediateVPC001Role:
      Type: AWS::IAM::Role
      Properties:
        RoleName: AutoRemediateVPC-001Role
        AssumeRolePolicyDocument:
          Version: '2012-10-17'
          Statement:
            - Effect: Allow
              Principal:
                Service:
                  - lambda.amazonaws.com
              Action:
                - sts:AssumeRole
        Policies:
          - PolicyName: AutoRemediationXRayPolicy
            PolicyDocument:
              Statement:
                - Effect: Allow
                  Action:
                    - xray:PutTraceSegments
                    - xray:PutTelemetryRecords
                  Resource: "*"
          - PolicyName: AutoRemediateVPC-001Policy
            PolicyDocument:
              Statement:
                - Effect: Allow
                  Action:
                    - logs:CreateLogGroup
                    - logs:CreateLogStream
                    - logs:PutLogEvents
                  Resource:
                    - 'Fn::Join':
                      - ':'
                      -
                        - 'arn:aws:logs'
                        - Ref: 'AWS::Region'
                        - Ref: 'AWS::AccountId'
                        - 'log-group:/aws/lambda/*:*:*'
                - Effect: Allow
                  Action:
                    - iam:AttachRolePolicy
                    - iam:CreateRole
                    - iam:GetRole
                    - iam:PutRolePolicy
                  Resource: "*"
                - Effect: Allow
                  Action:
                    - ec2:CreateFlowLogs
                    - ec2:DescribeFlowLogs
                  Resource: "*"
                - Effect: Allow
                  Action:
                    - iam:PassRole
                  Resource:
                    - 'Fn::Join':
                      - ':'
                      -
                        - 'arn:aws:iam:'
                        - Ref: 'AWS::AccountId'
                        - 'role/VPCFlowLogRole'

    AutoRemediateEC2008Role:
      Type: AWS::IAM::Role
      Properties:
        RoleName: AutoRemediateEC2-008Role
        AssumeRolePolicyDocument:
          Version: '2012-10-17'
          Statement:
            - Effect: Allow
              Principal:
                Service:
                  - lambda.amazonaws.com
              Action:
                - sts:AssumeRole
        Policies:
          - PolicyName: AutoRemediationXRayPolicy
            PolicyDocument:
              Statement:
                - Effect: Allow
                  Action:
                    - xray:PutTraceSegments
                    - xray:PutTelemetryRecords
                  Resource: "*"
          - PolicyName: AutoRemediateEC2-008Policy
            PolicyDocument:
              Statement:
                - Effect: Allow
                  Action:
                    - logs:CreateLogGroup
                    - logs:CreateLogStream
                    - logs:PutLogEvents
                  Resource:
                    - 'Fn::Join':
                      - ':'
                      -
                        - 'arn:aws:logs'
                        - Ref: 'AWS::Region'
                        - Ref: 'AWS::AccountId'
                        - 'log-group:/aws/lambda/*:*:*'
                - Effect: Allow
                  Action:
                    - ec2:RevokeSecurityGroupIngress
                  Resource: "*"

    AutoRemediateEC2045Role:
      Type: AWS::IAM::Role
      Properties:
        RoleName: AutoRemediateEC2-045Role
        AssumeRolePolicyDocument:
          Version: '2012-10-17'
          Statement:
            - Effect: Allow
              Principal:
                Service:
                  - lambda.amazonaws.com
              Action:
                - sts:AssumeRole
        Policies:
          - PolicyName: AutoRemediationXRayPolicy
            PolicyDocument:
              Statement:
                - Effect: Allow
                  Action:
                    - xray:PutTraceSegments
                    - xray:PutTelemetryRecords
                  Resource: "*"
          - PolicyName: AutoRemediateEC2-045Policy
            PolicyDocument:
              Statement:
                - Effect: Allow
                  Action:
                    - logs:CreateLogGroup
                    - logs:CreateLogStream
                    - logs:PutLogEvents
                  Resource:
                    - 'Fn::Join':
                      - ':'
                      -
                        - 'arn:aws:logs'
                        - Ref: 'AWS::Region'
                        - Ref: 'AWS::AccountId'
                        - 'log-group:/aws/lambda/*:*:*'
                - Effect: Allow
                  Action:
                    - ec2:RevokeSecurityGroupIngress
                  Resource: "*"

    AutoRemediateRS023Role:
      Type: AWS::IAM::Role
      Properties:
        RoleName: AutoRemediateRS-023Role
        AssumeRolePolicyDocument:
          Version: '2012-10-17'
          Statement:
            - Effect: Allow
              Principal:
                Service:
                  - lambda.amazonaws.com
              Action:
                - sts:AssumeRole
        Policies:
          - PolicyName: AutoRemediationXRayPolicy
            PolicyDocument:
              Statement:
                - Effect: Allow
                  Action:
                    - xray:PutTraceSegments
                    - xray:PutTelemetryRecords
                  Resource: "*"
          - PolicyName: AutoRemediateRS-023Policy
            PolicyDocument:
              Statement:
                - Effect: Allow
                  Action:
                    - logs:CreateLogGroup
                    - logs:CreateLogStream
                    - logs:PutLogEvents
                  Resource:
                    - 'Fn::Join':
                      - ':'
                      -
                        - 'arn:aws:logs'
                        - Ref: 'AWS::Region'
                        - Ref: 'AWS::AccountId'
                        - 'log-group:/aws/lambda/*:*:*'
                - Effect: Allow
                  Action:
                    - redshift:ModifyClusterParameterGroup
                  Resource: "*"

    AutoRemediateEC2006Role:
      Type: AWS::IAM::Role
      Properties:
        RoleName: AutoRemediateEC2-006Role
        AssumeRolePolicyDocument:
          Version: '2012-10-17'
          Statement:
            - Effect: Allow
              Principal:
                Service:
                  - lambda.amazonaws.com
              Action:
                - sts:AssumeRole
        Policies:
          - PolicyName: AutoRemediationXRayPolicy
            PolicyDocument:
              Statement:
                - Effect: Allow
                  Action:
                    - xray:PutTraceSegments
                    - xray:PutTelemetryRecords
                  Resource: "*"
          - PolicyName: AutoRemediateEC2-006Policy
            PolicyDocument:
              Statement:
                - Effect: Allow
                  Action:
                    - logs:CreateLogGroup
                    - logs:CreateLogStream
                    - logs:PutLogEvents
                  Resource:
                    - 'Fn::Join':
                      - ':'
                      -
                        - 'arn:aws:logs'
                        - Ref: 'AWS::Region'
                        - Ref: 'AWS::AccountId'
                        - 'log-group:/aws/lambda/*:*:*'
                - Effect: Allow
                  Action:
                    - ec2:RevokeSecurityGroupIngress
                  Resource: "*"

    AutoRemediateRDS023Role:
      Type: AWS::IAM::Role
      Properties:
        RoleName: AutoRemediateRDS-023Role
        AssumeRolePolicyDocument:
          Version: '2012-10-17'
          Statement:
            - Effect: Allow
              Principal:
                Service:
                  - lambda.amazonaws.com
              Action:
                - sts:AssumeRole
        Policies:
          - PolicyName: AutoRemediationXRayPolicy
            PolicyDocument:
              Statement:
                - Effect: Allow
                  Action:
                    - xray:PutTraceSegments
                    - xray:PutTelemetryRecords
                  Resource: "*"
          - PolicyName: AutoRemediateRDS-023Policy
            PolicyDocument:
              Statement:
                - Effect: Allow
                  Action:
                    - logs:CreateLogGroup
                    - logs:CreateLogStream
                    - logs:PutLogEvents
                  Resource:
                    - 'Fn::Join':
                      - ':'
                      -
                        - 'arn:aws:logs'
                        - Ref: 'AWS::Region'
                        - Ref: 'AWS::AccountId'
                        - 'log-group:/aws/lambda/*:*:*'
                - Effect: Allow
                  Action:
                    - rds:ModifyDBSnapshotAttribute
                  Resource: "*"

    AutoRemediateEC2038Role:
      Type: AWS::IAM::Role
      Properties:
        RoleName: AutoRemediateEC2-038Role
        AssumeRolePolicyDocument:
          Version: '2012-10-17'
          Statement:
            - Effect: Allow
              Principal:
                Service:
                  - lambda.amazonaws.com
              Action:
                - sts:AssumeRole
        Policies:
          - PolicyName: AutoRemediationXRayPolicy
            PolicyDocument:
              Statement:
                - Effect: Allow
                  Action:
                    - xray:PutTraceSegments
                    - xray:PutTelemetryRecords
                  Resource: "*"
          - PolicyName: AutoRemediateEC2-038Policy
            PolicyDocument:
              Statement:
                - Effect: Allow
                  Action:
                    - logs:CreateLogGroup
                    - logs:CreateLogStream
                    - logs:PutLogEvents
                  Resource:
                    - 'Fn::Join':
                      - ':'
                      -
                        - 'arn:aws:logs'
                        - Ref: 'AWS::Region'
                        - Ref: 'AWS::AccountId'
                        - 'log-group:/aws/lambda/*:*:*'
                - Effect: Allow
                  Action:
                    - ec2:RevokeSecurityGroupIngress
                  Resource: "*"


    AutoRemediateEC2040Role:
      Type: AWS::IAM::Role
      Properties:
        RoleName: AutoRemediateEC2-040Role
        AssumeRolePolicyDocument:
          Version: '2012-10-17'
          Statement:
            - Effect: Allow
              Principal:
                Service:
                  - lambda.amazonaws.com
              Action:
                - sts:AssumeRole
        Policies:
          - PolicyName: AutoRemediationXRayPolicy
            PolicyDocument:
              Statement:
                - Effect: Allow
                  Action:
                    - xray:PutTraceSegments
                    - xray:PutTelemetryRecords
                  Resource: "*"
          - PolicyName: AutoRemediateEC2-040Policy
            PolicyDocument:
              Statement:
                - Effect: Allow
                  Action:
                    - logs:CreateLogGroup
                    - logs:CreateLogStream
                    - logs:PutLogEvents
                  Resource:
                    - 'Fn::Join':
                      - ':'
                      -
                        - 'arn:aws:logs'
                        - Ref: 'AWS::Region'
                        - Ref: 'AWS::AccountId'
                        - 'log-group:/aws/lambda/*:*:*'
                - Effect: Allow
                  Action:
                    - ec2:RevokeSecurityGroupIngress
                  Resource: "*"

    AutoRemediateCT003Role:
      Type: AWS::IAM::Role
      Properties:
        RoleName: AutoRemediateCT-003Role
        AssumeRolePolicyDocument:
          Version: '2012-10-17'
          Statement:
            - Effect: Allow
              Principal:
                Service:
                  - lambda.amazonaws.com
              Action:
                - sts:AssumeRole
        Policies:
          - PolicyName: AutoRemediationXRayPolicy
            PolicyDocument:
              Statement:
                - Effect: Allow
                  Action:
                    - xray:PutTraceSegments
                    - xray:PutTelemetryRecords
                  Resource: "*"
          - PolicyName: AutoRemediateCT-003Policy
            PolicyDocument:
              Statement:
                - Effect: Allow
                  Action:
                    - logs:CreateLogGroup
                    - logs:CreateLogStream
                    - logs:PutLogEvents
                  Resource:
                    - 'Fn::Join':
                      - ':'
                      -
                        - 'arn:aws:logs'
                        - Ref: 'AWS::Region'
                        - Ref: 'AWS::AccountId'
                        - 'log-group:/aws/lambda/*:*:*'
                - Effect: Allow
                  Action:
                    - s3:PutBucketAcl
                  Resource: "*"

    AutoRemediateKMS004Role:
      Type: AWS::IAM::Role
      Properties:
        RoleName: AutoRemediateKMS-004Role
        AssumeRolePolicyDocument:
          Version: '2012-10-17'
          Statement:
            - Effect: Allow
              Principal:
                Service:
                  - lambda.amazonaws.com
              Action:
                - sts:AssumeRole
        Policies:
          - PolicyName: AutoRemediationXRayPolicy
            PolicyDocument:
              Statement:
                - Effect: Allow
                  Action:
                    - xray:PutTraceSegments
                    - xray:PutTelemetryRecords
                  Resource: "*"
          - PolicyName: AutoRemediateKMS-004Policy
            PolicyDocument:
              Statement:
                - Effect: Allow
                  Action:
                    - logs:CreateLogGroup
                    - logs:CreateLogStream
                    - logs:PutLogEvents
                  Resource:
                    - 'Fn::Join':
                      - ':'
                      -
                        - 'arn:aws:logs'
                        - Ref: 'AWS::Region'
                        - Ref: 'AWS::AccountId'
                        - 'log-group:/aws/lambda/*:*:*'
                - Effect: Allow
                  Action:
                    - kms:CancelKeyDeletion
                  Resource: "*"

    AutoRemediateEC2004Role:
      Type: AWS::IAM::Role
      Properties:
        RoleName: AutoRemediateEC2-004Role
        AssumeRolePolicyDocument:
          Version: '2012-10-17'
          Statement:
            - Effect: Allow
              Principal:
                Service:
                  - lambda.amazonaws.com
              Action:
                - sts:AssumeRole
        Policies:
          - PolicyName: AutoRemediationXRayPolicy
            PolicyDocument:
              Statement:
                - Effect: Allow
                  Action:
                    - xray:PutTraceSegments
                    - xray:PutTelemetryRecords
                  Resource: "*"
          - PolicyName: AutoRemediateEC2-004Policy
            PolicyDocument:
              Statement:
                - Effect: Allow
                  Action:
                    - logs:CreateLogGroup
                    - logs:CreateLogStream
                    - logs:PutLogEvents
                  Resource:
                    - 'Fn::Join':
                      - ':'
                      -
                        - 'arn:aws:logs'
                        - Ref: 'AWS::Region'
                        - Ref: 'AWS::AccountId'
                        - 'log-group:/aws/lambda/*:*:*'
                - Effect: Allow
                  Action:
                    - ec2:RevokeSecurityGroupIngress
                  Resource: "*"

    AutoRemediateEC2039Role:
      Type: AWS::IAM::Role
      Properties:
        RoleName: AutoRemediateEC2-039Role
        AssumeRolePolicyDocument:
          Version: '2012-10-17'
          Statement:
            - Effect: Allow
              Principal:
                Service:
                  - lambda.amazonaws.com
              Action:
                - sts:AssumeRole
        Policies:
          - PolicyName: AutoRemediationXRayPolicy
            PolicyDocument:
              Statement:
                - Effect: Allow
                  Action:
                    - xray:PutTraceSegments
                    - xray:PutTelemetryRecords
                  Resource: "*"
          - PolicyName: AutoRemediateEC2-039Policy
            PolicyDocument:
              Statement:
                - Effect: Allow
                  Action:
                    - logs:CreateLogGroup
                    - logs:CreateLogStream
                    - logs:PutLogEvents
                  Resource:
                    - 'Fn::Join':
                      - ':'
                      -
                        - 'arn:aws:logs'
                        - Ref: 'AWS::Region'
                        - Ref: 'AWS::AccountId'
                        - 'log-group:/aws/lambda/*:*:*'
                - Effect: Allow
                  Action:
                    - ec2:RevokeSecurityGroupIngress
                  Resource: "*"

    AutoRemediateTrustedAdvisor003Role:
      Type: AWS::IAM::Role
      Properties:
        RoleName: AutoRemediateTrustedAdvisor-003Role
        AssumeRolePolicyDocument:
          Version: '2012-10-17'
          Statement:
            - Effect: Allow
              Principal:
                Service:
                  - lambda.amazonaws.com
              Action:
                - sts:AssumeRole
        Policies:
          - PolicyName: AutoRemediationXRayPolicy
            PolicyDocument:
              Statement:
                - Effect: Allow
                  Action:
                    - xray:PutTraceSegments
                    - xray:PutTelemetryRecords
                  Resource: "*"
          - PolicyName: AutoRemediateTrustedAdvisor-003Policy
            PolicyDocument:
              Statement:
                - Effect: Allow
                  Action:
                    - logs:CreateLogGroup
                    - logs:CreateLogStream
                    - logs:PutLogEvents
                  Resource:
                    - 'Fn::Join':
                      - ':'
                      -
                        - 'arn:aws:logs'
                        - Ref: 'AWS::Region'
                        - Ref: 'AWS::AccountId'
                        - 'log-group:/aws/lambda/*:*:*'
                - Effect: Allow
                  Action:
                    - iam:UpdateAccessKey
                  Resource: "*"

    AutoRemediateSQS004Role:
      Type: AWS::IAM::Role
      Properties:
        RoleName: AutoRemediateSQS-004Role
        AssumeRolePolicyDocument:
          Version: '2012-10-17'
          Statement:
            - Effect: Allow
              Principal:
                Service:
                  - lambda.amazonaws.com
              Action:
                - sts:AssumeRole
        Policies:
          - PolicyName: AutoRemediationXRayPolicy
            PolicyDocument:
              Statement:
                - Effect: Allow
                  Action:
                    - xray:PutTraceSegments
                    - xray:PutTelemetryRecords
                  Resource: "*"
          - PolicyName: SQS-004Policy
            PolicyDocument:
              Statement:
                - Effect: Allow
                  Action:
                    - logs:CreateLogGroup
                    - logs:CreateLogStream
                    - logs:PutLogEvents
                  Resource:
                    - 'Fn::Join':
                      - ':'
                      -
                        - 'arn:aws:logs'
                        - Ref: 'AWS::Region'
                        - Ref: 'AWS::AccountId'
                        - 'log-group:/aws/lambda/*:*:*'
                - Effect: Allow
                  Action:
                    - "kms:ListKeys"
                    - "kms:ListAliases"
                    - "kms:DescribeKey"
                    - "sqs:SetQueueAttributes"
                  Resource: "*"

    AutoRemediateKinesis001Role:
      Type: AWS::IAM::Role
      Properties:
        RoleName: AutoRemediateKinesis-001Role
        AssumeRolePolicyDocument:
          Version: '2012-10-17'
          Statement:
            - Effect: Allow
              Principal:
                Service:
                  - lambda.amazonaws.com
              Action:
                - sts:AssumeRole
        Policies:
          - PolicyName: AutoRemediationXRayPolicy
            PolicyDocument:
              Statement:
                - Effect: Allow
                  Action:
                    - xray:PutTraceSegments
                    - xray:PutTelemetryRecords
                  Resource: "*"
          - PolicyName: Kinesis-001Policy
            PolicyDocument:
              Statement:
                - Effect: Allow
                  Action:
                    - logs:CreateLogGroup
                    - logs:CreateLogStream
                    - logs:PutLogEvents
                  Resource:
                    - 'Fn::Join':
                      - ':'
                      -
                        - 'arn:aws:logs'
                        - Ref: 'AWS::Region'
                        - Ref: 'AWS::AccountId'
                        - 'log-group:/aws/lambda/*:*:*'
                - Effect: Allow
                  Action:
                    - "kms:ListKeys"
                    - "kms:ListAliases"
                    - "kms:DescribeKey"
                    - "kinesis:StartStreamEncryption"
                  Resource: "*"