template.yaml

AWSTemplateFormatVersion: '2010-09-09'
Transform: AWS::Serverless-2016-10-31
Description: Routes ec2 events from Cloudtrail logs groups to a lambda function for notification

Parameters:
    TOPICARN:
        Type: String
        Description: Topic to publish cross region EC2 events to

Resources:
    LogRouter:
        Type: AWS::Serverless::Function
        Properties:
            Handler: index.handler
            Runtime: nodejs12.x
            Environment:
                Variables:
                    TOPICARN: !Ref TOPICARN
            Policies:
                Statement:
                    - Effect: Allow
                      Action: sns:Publish
                      Resource: !Ref TOPICARN
    LogRouterCloudWatchPermission:
        Type: AWS::Lambda::Permission
        Properties:
            Action: "lambda:*"
            FunctionName:
                Ref: LogRouter
            Principal: logs.ap-southeast-1.amazonaws.com
    CloudtrailSubscription:
        Type: AWS::Logs::SubscriptionFilter
        DependsOn: LogRouterCloudWatchPermission
        Properties:
            DestinationArn:
                "Fn::GetAtt": [LogRouter, Arn]
            FilterPattern: "{ ($.eventName = RunInstances) || ($.eventName = TerminateInstances) }"
            LogGroupName: CloudTrail/DefaultLogGroup