<commit_before>AWSTemplateFormatVersion: 2010-09-09
Description: Global CloudTrail, S3 Bucket and SNS Topic
Resources:
  MozDefCloudTrail:
    Type: AWS::CloudTrail::Trail
    DependsOn:
      - MozDefCloudTrailBucketPolicy
      - MozDefCloudTrailSNSTopicPolicy
      - MozDefCloudTrailSNSSQSSubscription
      - MozDefCloudTrailSQSQueuePolicy
    Properties:
      S3BucketName: !Ref MozDefCloudTrailBucket
      SnsTopicName: !GetAtt MozDefCloudTrailSNSTopic.TopicName
      IsLogging: true
      IncludeGlobalServiceEvents: true
      IsMultiRegionTrail: true
  MozDefCloudTrailBucket:
    Type: AWS::S3::Bucket
    DeletionPolicy: Retain
  MozDefCloudTrailBucketPolicy:
    Type: AWS::S3::BucketPolicy
    Properties:
      Bucket: !Ref MozDefCloudTrailBucket
      PolicyDocument:
        Version: 2012-10-17
        Statement:
          - Sid: AWSCloudTrailAclCheck
            Effect: Allow
            Principal:
              Service: cloudtrail.amazonaws.com
            Action: s3:GetBucketAcl
            Resource: !GetAtt MozDefCloudTrailBucket.Arn
          - Sid: AWSCloudTrailWrite
            Effect: Allow
            Principal:
              Service: cloudtrail.amazonaws.com
            Action: s3:PutObject
            Resource: !Join ['/', [ !GetAtt MozDefCloudTrailBucket.Arn, AWSLogs, !Ref 'AWS::AccountId', '*']]
            Condition:
              StringEquals:
                "s3:x-amz-acl": bucket-owner-full-control
  MozDefCloudTrailSNSTopicPolicy:
    Type: AWS::SNS::TopicPolicy
    Properties:
      PolicyDocument:
        Version: 2012-10-17
        Statement:
        - Sid: AllowCloudTrailToPublishToSNS
          Effect: Allow
          Principal:
            Service: cloudtrail.amazonaws.com
          Action: sns:Publish
          Resource: !Ref MozDefCloudTrailSNSTopic
      Topics:
      - !Ref MozDefCloudTrailSNSTopic
  MozDefCloudTrailSNSTopic:
    Type: AWS::SNS::Topic
  MozDefCloudTrailSQSQueuePolicy:
    Type: AWS::SQS::QueuePolicy
    Properties:
      PolicyDocument:
        Version: 2012-10-17
        Statement:
        - Sid: AllowSNSToSendToSQS
          Effect: Allow
          Principal:
            AWS: !Join [ '', [ 'arn:', 'aws:', 'iam::', !Ref 'AWS::AccountId', ':root' ] ]
          Action: sqs:SendMessage
          Resource: !GetAtt MozDefCloudTrailSQSQueue.Arn
          Condition:
            ArnEquals:
              "aws:SourceArn": !Ref MozDefCloudTrailSNSTopic
      Queues:
        - !Ref MozDefCloudTrailSQSQueue
  MozDefCloudTrailSQSQueue:
    Type: AWS::SQS::Queue<commit_msg>Revert #1079 as the ArnEquals Conditions is how to constrain access to the queue, not with Principal<commit_after>AWSTemplateFormatVersion: 2010-09-09
Description: Global CloudTrail, S3 Bucket and SNS Topic
Resources:
  MozDefCloudTrail:
    Type: AWS::CloudTrail::Trail
    DependsOn:
      - MozDefCloudTrailBucketPolicy
      - MozDefCloudTrailSNSTopicPolicy
      - MozDefCloudTrailSNSSQSSubscription
      - MozDefCloudTrailSQSQueuePolicy
    Properties:
      S3BucketName: !Ref MozDefCloudTrailBucket
      SnsTopicName: !GetAtt MozDefCloudTrailSNSTopic.TopicName
      IsLogging: true
      IncludeGlobalServiceEvents: true
      IsMultiRegionTrail: true
  MozDefCloudTrailBucket:
    Type: AWS::S3::Bucket
    DeletionPolicy: Retain
  MozDefCloudTrailBucketPolicy:
    Type: AWS::S3::BucketPolicy
    Properties:
      Bucket: !Ref MozDefCloudTrailBucket
      PolicyDocument:
        Version: 2012-10-17
        Statement:
          - Sid: AWSCloudTrailAclCheck
            Effect: Allow
            Principal:
              Service: cloudtrail.amazonaws.com
            Action: s3:GetBucketAcl
            Resource: !GetAtt MozDefCloudTrailBucket.Arn
          - Sid: AWSCloudTrailWrite
            Effect: Allow
            Principal:
              Service: cloudtrail.amazonaws.com
            Action: s3:PutObject
            Resource: !Join ['/', [ !GetAtt MozDefCloudTrailBucket.Arn, AWSLogs, !Ref 'AWS::AccountId', '*']]
            Condition:
              StringEquals:
                "s3:x-amz-acl": bucket-owner-full-control
  MozDefCloudTrailSNSTopicPolicy:
    Type: AWS::SNS::TopicPolicy
    Properties:
      PolicyDocument:
        Version: 2012-10-17
        Statement:
        - Sid: AllowCloudTrailToPublishToSNS
          Effect: Allow
          Principal:
            Service: cloudtrail.amazonaws.com
          Action: sns:Publish
          Resource: !Ref MozDefCloudTrailSNSTopic
      Topics:
      - !Ref MozDefCloudTrailSNSTopic
  MozDefCloudTrailSNSTopic:
    Type: AWS::SNS::Topic
  MozDefCloudTrailSQSQueuePolicy:
    Type: AWS::SQS::QueuePolicy
    Properties:
      PolicyDocument:
        Version: 2012-10-17
        Statement:
        - Sid: AllowSNSToSendToSQS
          Effect: Allow
          Principal:
            AWS: '*'
          Action: sqs:SendMessage
          Resource: !GetAtt MozDefCloudTrailSQSQueue.Arn
          Condition:
            ArnEquals:
              "aws:SourceArn": !Ref MozDefCloudTrailSNSTopic
      Queues:
        - !Ref MozDefCloudTrailSQSQueue
  MozDefCloudTrailSQSQueue:
    Type: AWS::SQS::Queue
{'fraction_non_alphanumeric': 0.07500487044613287, 'fraction_numerical': 0.015975063315799728, 'mean_word_length': 2.391017173051519, 'pattern_counts': {'":': 4, '<': 3, '<?xml version=': 0, '>': 3, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '523668', 'n_tokens_mistral': 1609, 'n_tokens_neox': 1535, 'n_words': 294}