# Converted from CloudTrail example.
# http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-cloudtrail-trail.html.

from troposphere import GetAtt, Join, Parameter, Ref, Template
from troposphere.cloudtrail import Trail
from troposphere.s3 import Bucket, BucketPolicy
from troposphere.sns import Subscription, Topic, TopicPolicy

t = Template()

t.set_version("2010-09-09")

OperatorEmail = t.add_parameter(
    Parameter(
        "OperatorEmail",
        Type="String",
        Description="Email address to notify when new logs are published.",
    )
)

S3Bucket = t.add_resource(Bucket("S3Bucket", DeletionPolicy="Retain"))

Topic = t.add_resource(
    Topic(
        "Topic",
        Subscription=[
            Subscription(
                Endpoint=Ref(OperatorEmail),
                Protocol="email",
            ),
        ],
    )
)

TopicPolicy = t.add_resource(
    TopicPolicy(
        "TopicPolicy",
        Topics=[Ref(Topic)],
        PolicyDocument={
            "Version": "2008-10-17",
            "Statement": [
                {
                    "Action": "SNS:Publish",
                    "Principal": {"Service": "cloudtrail.amazonaws.com"},
                    "Resource": "*",
                    "Effect": "Allow",
                    "Sid": "AWSCloudTrailSNSPolicy",
                }
            ],
        },
    )
)

BucketPolicy = t.add_resource(
    BucketPolicy(
        "BucketPolicy",
        PolicyDocument={
            "Version": "2012-10-17",
            "Statement": [
                {
                    "Action": "s3:GetBucketAcl",
                    "Principal": {"Service": "cloudtrail.amazonaws.com"},
                    "Resource": Join("", ["arn:aws:s3:::", Ref(S3Bucket)]),
                    "Effect": "Allow",
                    "Sid": "AWSCloudTrailAclCheck",
                },
                {
                    "Action": "s3:PutObject",
                    "Principal": {"Service": "cloudtrail.amazonaws.com"},
                    "Resource": Join(
                        "",
                        [
                            "arn:aws:s3:::",
                            Ref(S3Bucket),
                            "/AWSLogs/",
                            Ref("AWS::AccountId"),
                            "/*",
                        ],
                    ),
                    "Effect": "Allow",
                    "Sid": "AWSCloudTrailWrite",
                    "Condition": {
                        "StringEquals": {"s3:x-amz-acl": "bucket-owner-full-control"}
                    },
                },
            ],
        },
        Bucket=Ref(S3Bucket),
    )
)

myTrail = t.add_resource(
    Trail(
        "myTrail",
        IsLogging=True,
        S3BucketName=Ref(S3Bucket),
        SnsTopicName=GetAtt(Topic, "TopicName"),
        DependsOn=["BucketPolicy", "TopicPolicy"],
    )
)

print(t.to_json())
