CloudFormation

AWS CloudFormation is a provisioning and configuration service that can ease AWS access and configuration. ChaosSearch has created some CloudFormation templates to help automate the configuration of AWS S3 access policies for ChaosSearch indexing and querying.

This topic describes how to use CloudFormation to configure your AWS S3 storage infrastructure for use with ChaosSearch.

Getting Started

The prerequisites required for this section are:

A ChaosSearch account and external ID
An AWS account

Using the CloudFormation Access Setup

To use CloudFormation to set up access for the ChaosSearch indexing services:

Log in to the ChaosSearch console using your account.
Click your account name in the top right corner, and select the Settings/Help menu.
Click AWS Credentials in the left menu.

On the AWS Credentials page, click Open CloudFormation.
Log in using your AWS account. The Quick create stack page appears.
In the Stack name field, type a unique stack name for your setup.

Scroll down to the Parameters section and specify/verify the following information:

Verify or specify (if not present) the external ID for your ChaosSearch instance.
In the CSAccountID field, verify or specify your account ID.
In the CSBucketName field, type the name(s) of the desired bucket(s). You can use * for all buckets.
In the CSRecoveryAccountID, note the recovery account ID used for backup and possible recovery of the primary account.

Scroll down to the Capabilities section and select I acknowledge that AWS CloudFormation might create IAM resources.
Click Create stack.

AWS creates the ChaosSearch stack for your resources. A sample stack window follows.

Click the Resources tab and wait for the stack to be created.

NOTE: If the create stack process fails, contact ChaosSearch for assistance.

Once complete, click the Physical ID hyperlink for CHAOSSEARCHRole. The Summary page appears.

Copy the Role ARN for your new AWS stack.
In the ChaosSearch Settings/Help > AWS Credentials window, paste the role ARN value into the AWS Role ARN field.
Click Update to save the role ARN.
Make sure that a check icon is displayed to verify the ARN value.

CloudFormation Template

The following is the definition of the standard CloudFormation template. The resources used in this template are:

CHAOSSEARCH Account ID
CHAOSSEARCH External ID
AWS IAM Role
AWS IAM Policy
AWS S3
AWS SQS
AWS SNS

---
AWSTemplateFormatVersion: '2010-09-09'
Description: CHAOSSEARCH AWS Integration
Metadata:
  AWS::CloudFormation::Interface:
    ParameterGroups:
    - Label:
        default: CHAOSSEARCH Authentication
      Parameters:
      - CSExternalID
    ParameterLabels:
      CSExternalID:
        default: What is your provided CHAOSSEARCH External ID?
      CSBucketName:
        default: What bucket for CHAOSSEARCH access?
      CSAccountID:
        default: CHAOSSEARCH account that is allowed to assume this role.
      CSRecoveryAccountID:
        default: (Optional) CHAOSSEARCH recovery account used for backup that is allowed to assume this role.
Parameters:
  CSExternalID:
    Description: The provided CHAOSSEARCH External ID
    Type: String
  CSBucketName:
    Description: The desired name for the S3 bucket CHAOSSEARCH will be indexing. Lowercase names only.
    Type: String
  CSAccountID:
    Description: CHAOSSEARCH account that is allowed to assume this role.
    Type: String
  CSRecoveryAccountID:
    Description: (Optional) CHAOSSEARCH recovery account used for backup and is allowed to assume this role.
    Default: "079363773741"
    Type: String
Conditions:
  RecoveryDisabled: !Equals [!Ref 'CSRecoveryAccountID', '']
Resources:
  CHAOSSEARCHRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
        - Effect: Allow
          Principal:
            AWS:
              Fn::If:
              - RecoveryDisabled
              - - Fn::Join:
                  - ''
                  - - 'arn:aws:iam::'
                    - Ref: CSAccountID
                    - ':root'
                - arn:aws:iam::515570774723:root
              - - Fn::Join:
                  - ''
                  - - 'arn:aws:iam::'
                    - Ref: CSAccountID
                    - ':root'
                - Fn::Join:
                  - ''
                  - - 'arn:aws:iam::'
                    - Ref: CSRecoveryAccountID
                    - ':root'
                - arn:aws:iam::515570774723:root
          Action: sts:AssumeRole
          Condition:
            StringEquals:
              sts:ExternalId:
                Ref: CSExternalID
  CHAOSSEARCHPolicy:
    Type: AWS::IAM::Policy
    Properties:
      PolicyName: CHAOSSEARCHPolicy
      PolicyDocument:
        Version: '2012-10-17'
        Statement:
        - Effect: Allow
          Action:
          - sqs:DeleteMessage
          - sqs:DeleteMessageBatch
          - sqs:ReceiveMessage
          - sqs:GetQueueUrl
          - sqs:GetQueueAttributes
          Resource: !Sub 'arn:aws:sqs:*:${AWS::AccountId}:*'
        - Effect: Allow
          Action:
          - s3:ListAllMyBuckets
          - s3:GetBucketLocation
          - s3:GetBucketTagging
          Resource: "*"
        - Effect: Allow
          Action:
          - s3:ListBucket
          Resource:
          - Fn::Join:
            - ''
            - - 'arn:aws:s3:::'
              - Ref: CSBucketName
        - Effect: Allow
          Action:
          - s3:GetObject
          - s3:GetObjectTagging
          - s3:PutObjectTagging
          Resource:
          - Fn::Join:
            - ''
            - - 'arn:aws:s3:::'
              - Ref: CSBucketName
              - "/*"
        - Effect: Allow
          Action: 
          - s3:GetObjectTagging
          - s3:PutObjectTagging
          - s3:ListBucket
          - s3:CreateBucket
          - s3:GetObject
          - s3:PutObject
          - s3:DeleteObject
          Resource:
          - Fn::Join:
            - ''
            - - 'arn:aws:s3:::cs-'
              - Ref: CSExternalID
          - Fn::Join:
            - ''
            - - 'arn:aws:s3:::cs-'
              - Ref: CSExternalID
              - "/*"
      Roles:
      - Ref: CHAOSSEARCHRole
Outputs:
  RoleARN:
    Description: The ARN of the new CHAOSSEARCH Role
    Value:
      Fn::GetAtt:
      - CHAOSSEARCHRole
      - Arn
  S3Bucket:
    Description: The name of the CHAOSSEARCH S3 bucket that was created
    Value:
      Ref: CSBucketName