cloudformation.yaml

Parameters:
  StreamName:
    AllowedPattern: ^[0-9a-zA-Z]+([0-9a-zA-Z-]*[0-9a-zA-Z])*$
    Default: OktaSecurityLakeDeliveryStream
    Type: String
  GlueDatabaseName:
    Type: String
    Default: "okta_ocsf_db"
    Description: "Name of the AWS Glue database for OCSF database"
  GlueTableName:
    Type: String
    MinLength: "4"
    Default: "okta_ocsf_tb"
    Description: "Name of the AWS Glue database for OCSF database"
  PartnerEventBus:
    Description: Name of Okta's Partner Event bus
    Type: String
  SecurityLakeS3:
    Description: Name of the Security Lake S3 Location from AWS Security Lake Custom Source location
    Type: String

Resources:
  # Create Event Rule
  OktaEventRule:
    Type: AWS::Events::Rule
    Properties:
      Description: Okta SysLog event
      EventBusName: !Ref PartnerEventBus
      EventPattern:
        {
          "detail": {
            "displayMessage": [ {
              "prefix": "Authentication of user"
            }]
          }
        }
      Name: OktaEventRule
      State: ENABLED

      Targets:
        - Arn: !GetAtt
            - DeliveryStream
            - Arn
          RoleArn: !GetAtt
            - EventBusRole
            - Arn
          Id: "OktaEventRuleid"
        #Create AWS Lambda Role
  TransformLambdaRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - lambda.amazonaws.com
            Action:
              - sts:AssumeRole
      Policies:
        - PolicyName: lambda-cloudwatch
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Effect: Allow
                Action:
                  - logs:CreateLogGroup
                  - logs:CreateLogStream
                  - logs:PutLogEvents
                Resource: !Sub arn:${AWS::Partition}:logs:*:*:*
        - PolicyName: flow-logs-policy
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Effect: Allow
                Action:
                  - '*'
                Resource: '*'
  # CloudFormation creates a lambda function named <CloudFormationStackName-ResourceName-RandomChars>
  # Example: CreateLambdaFunction-TransformLambdaFunction-N7S3FMXJ8Z8R
  TransformLambdaFunction:
    Type: AWS::Lambda::Function
    Properties:
      Description: aws:states:opt-in
      Code:
        ZipFile: |
          import base64
          from datetime import datetime
          import json


          def lambda_handler(event, context):
              """
              Purpose of this Lambda function is to provide a general guidance on converting Okta syslogs into OCSF format.
              This Lambda function ONLY CONSIDERS : SUCCESSFUL AUTHENTICATION EVENT FROM OKTA SYS LOG
              For different syslog event categories lambda should be enhanced/modified as per the OCSF schema and Sys Log event attributes
              Parameters
              ----------
              event: event Object represents Okta SysLog event

                  Event doc: https://developer.okta.com/docs/reference/api/system-log/#example-logevent-object

              Returns
              ------
              Output Format: Returning Okta Sys log event into an OCSF JSON format

                  To Understand OCSF Data Format: https://schema.ocsf.io/classes/authentication?extensions=
              """
              output = []
              # Access Record Data from Syslog event
              for record in event['records']:
                  data = base64.b64decode(record['data'])
                  data = json.loads(data.decode('utf8'))
                  # Invoke Transform Data to perform OCSF conversion
                  result = tranform_data(data)
                  # Add Dynamic Partioning for S3 buckets
                  format = "%Y-%m-%dT%H:%M:%S.%fZ"
                  date_input = data['detail']['published']

                  datetime1 = datetime.strptime(date_input, format)
                  partitionKeys = {}
                  partitionKeys["source"] = 'OktaEventSource'
                  partitionKeys["region"] = context.invoked_function_arn.split(":")[3]
                  partitionKeys["AWS_account"] = context.invoked_function_arn.split(":")[4]
                  partitionKeys["eventDay"] = datetime1.strftime("%Y%m%d")

                  # Reformats the output in a base64 encoded format.OCSF JSON Output will be used by Firehose datastream and AWS Glue Schema
                  output_record = {
                      'recordId': record['recordId'],  # is this the problem? I used sequenceNumber, it is not right.
                      'result': 'Ok',
                      'data': base64.b64encode(json.dumps(result, separators=(',', ':')).encode('utf-8') + b'\n').decode(
                          'utf-8'),
                      'metadata': {'partitionKeys': partitionKeys}
                  }
                  output.append(output_record)
              print("JSON Output base64 Encoded format:")
              print(output)
              return {'records': output}


          def get_activity_details(activity_info):
              """
              Function captures an Activity Name that is logged by Okta Syslog
              Parameters
              ----------
              activity_info: Activity Info captured by Okta system Log

              Returns
              ------
              activity: Name of the activity
              activity_id: Identifier for the activity
              """
              # Based on the OCSF schema definition, Successful Athentication is described as "unknown"
              # Activity Value will change based on a type of event you want to capture
              activity = "Unknown"
              # Use Activity ID associated with an activity
              activity_id = 0
              # Check if User Authentication is part of the activity Info
              if "user.authentication" in activity_info:
                  activity = 'Logon'
                  activity_id = 1
              return activity, activity_id


          def get_auth_protocol(auth_provider_detail):
              """
              Function captures an authentication protocol reported by the event source.
              Parameters
              ----------
              auth_provider_detail: Contains the identity of an actor using the credentials provided to it

              Returns
              ------
              auth_protocol: Name of the activity
              auth_protocol: Identifier for the activity
              """
              auth_protocol = "Unknown"
              auth_protocol_id = 0
              # Check if FACTOR is part of the activity Info
              # this can be extended to various scenarios and use cases
              if "FACTOR" in auth_provider_detail:
                  auth_protocol = "Other  / MFA"
                  auth_protocol_id = 1
              return auth_protocol, auth_protocol_id


          def get_audit_category(event_type):
              """
              Function captures the event category name for an event logged by Okta
              get_audit_category function is dedicated for all the Audit Activity Events
              This function can be enhanced as more events are included
              Returns
              ------
              category_name: Name of the event category
              category_uid: Category unique identifier for the activity
              """
              # The event category name, for Successful Authentication , category name and category_uid are selected based on the OCSF schema
              category_name = "Unknown"
              category_uid = 0
              if "user.authentication" in event_type:
                  category_name = 'Audit Activity events'
                  category_uid = 3
              return category_name, category_uid


          def get_event_class():
              """
              Function captures an event class

              Returns
              ------
              class_name: Name of the event class
              class_uid: Class unique identifier for the activity
              """
              class_name = "Authentication Audit"
              class_uid = 3002
              return class_name, class_uid


          def get_clear_text_value(auth_protocol):
              """
              Function checks if credentials were passed in clear text.
              Parameters
              ----------
              auth_protocol: Contains the metadata about the authentication
              Returns
              ------
                Returns the boolean value
              """
              # check if protocol is either FTP or Telnet
              return auth_protocol != 'FTP' and auth_protocol != 'TELNET'


          def get_destination_endpoint(destination_endpoint):
              """
              Function finds the endpoint for which Authn was targeted
              Parameters
              ----------
              destination_endpoint: Contains the metadata about the endpoint for which AuthN was targeted

              Returns
              ------
              detination_details: Returns the destination endpoint as a dictionary
              """
              # Create a JSON object in OCSF format
              detination_details = {"hostname": destination_endpoint['requestUri'],
                                    "ip": "",
                                    "instance_uid": "",
                                    "interface_id": "",
                                    "svc_name": destination_endpoint['url']}
              return detination_details


          def get_logon_type(login_transaction):
              """
              Function finds the type of the login based on the event source
              Parameters
              ----------
              login_transaction: Contains the metadata about the endpoint for which AuthN was targeted

              Returns
              ------
              logon_type: Returns the boolean value based on the event
              logon_type_id: Returns the logon id
              """
              # Capture the login transaction
              logon_type = login_transaction['type']
              # If WEB is not in logon_type return a normalized value
              logon_type_id = 99 if "WEB" in logon_type else 0

              return logon_type, logon_type_id


          def get_severity(severity):
              """
              Function to find the log severity
              Parameters
              ----------
              severity: Details about the event severity

              Returns
              ------
              severity: Returns the event severity
              severity_id: Returns event severity  id
              """
              # If the event severity is INFO assign value as 1
              severity_id = 1 if "INFO" in severity else 0

              return severity, severity_id


          def get_src_endpoint(data):
              """
              Function to find the endpoint where authentication is requested
              Parameters
              ----------
              data: Details about the event

              Returns
              ------
              src_end_point: Returns the src end point
              """
              # Create JSON formatted string compatible with OCSF schema
              return {
                  "hostname": data['debugContext']['debugData']['requestUri'],
                  "ip ": data['client']['ipAddress'],
                  "interface_id": data['client']['device']
              }


          def get_src_user(data):
              """
              Function to find the endpoint where authentication is requested
              Parameters
              ----------
              data: Get existing user data

              Returns
              ------
              src_user: Returns the user information
              """
              # Create JSON formatted string compatible with OCSF schema
              return {
                  'type': data['actor']['type'],
                  'name': data['actor']['displayName'],
                  'email_addr': data['actor']['alternateId']
              }


          def get_status_details(data):
              """
              Function to find the endpoint where authentication is requested
              Parameters
              ----------
              data: Get existing user data

              Returns
              ------
              status_result: Returns the event status
              status_code: Returns the event status code
              status_detail: Details about authentication Request
              status_id: Normalized ID for the status
              """
              status_result = data['outcome']['result']
              status_code = 'N/A'
              status_detail = ''
              status_id = -1
              if "SUCCESS" in status_result:
                  status_detail = "LOGON_USER_INITIATED"
                  status_id = 1
              return status_result, status_code, status_detail, status_id


          def get_type_category(eventType):
              """
              Function captures the event type for an event logged by Okta
              get_audit_category function is dedicated for all the Audit Activity Types
              This function can be enhanced as more events are included
              Returns
              ------
              type_name: Name of the event Type
              type_uid: Type unique identifier for the activity
              """
              # The event category name, for Successful Authentication , category name and category_uid are selected based on
              # the OCSF schema
              type_uid = 0
              type_name = "Unknown"
              if "user.authentication" in eventType:
                  type_name = 'Authentication Audit: Logon'
                  type_uid = 300201
              return type_uid, type_name

          def get_metadata(original_time,version):
              """
              Function captures the metadata about the event type for an event logged by Okta
              get_metadata function is dedicated for capturing the Metadata Object Type
              This function can be be enhanced as more events are included
              Returns
              ------
              metadata: Metadata Object is returned
              """
              # Create JSON formatted string compatible with OCSF schema
              return {
                  'original_time': original_time,
                  'product': {
                              'vendor_name':'Okta',
                              'name': 'Okta System Log'
                              },
                  'version': version
              }


          def get_enrichment_data(client_data):
              """
              Function captures the Enrichment data for an event logged by Okta
              get_enrichment_data function is dedicated for all the enrichment of data
              This function can be enhanced based on data user wants to enrich. In this we will only return
              Client, Devices and Geographical context

              Returns
              ------
              enrichment: Array of the enriched data
              """
              # Data that that will be enriched is location of a user
              # the OCSF schema
              enrichment = {'name': 'geographicalContext', 'data': client_data['geographicalContext'],
                                                   'value': client_data['ipAddress'], 'type': 'location'}

              return [enrichment]


          def tranform_data(data):
              # get activity details based on the eventType that is published
              activity, activity_id = get_activity_details(data['detail']['eventType'])
              # get the authentication protocol used to create the user session.
              auth_protocol, auth_protocol_id = get_auth_protocol(
                  data['detail']['authenticationContext']['authenticationProvider'])
              # get the event category name,
              category_name, category_uid = get_audit_category(data['detail']['eventType'])
              # get the event class name
              class_name, class_uid = get_event_class()
              # check if whether the credentials were passed in clear text.
              is_cleartext = get_clear_text_value(auth_protocol)
              # get the destination endpoint for which the authentication was targeted.
              dst_endpoint = get_destination_endpoint(data['detail']['debugContext']['debugData'])
              # get user details and account type used for authentication
              dst_user = data['detail']['actor']['alternateId']
              # get additional additional information which is critical for the event but doesn't fall under OCSF schema
              enrichments = get_enrichment_data(data['detail']['client'])
              # get time of the event
              date_time = datetime.strptime(data['time'],'%Y-%m-%dT%H:%M:%SZ')
              _time = int(date_time.timestamp())
              # get type of the logon
              logon_type, logon_type_id = get_logon_type(data['detail']['transaction'])
              # get the description of the message
              display_message = data['detail']['displayMessage']
              # get the original event as reported
              ref_time = data['time']
              # get userID value
              profile = data['detail']['actor']['alternateId']
              # get the Session UID value
              session_uid = data['detail']['authenticationContext']['externalSessionId']
              # get the log severity of the event
              severity, severity_id = get_severity(data['detail']['severity'])
              # get the endpoint from which the authentication was requested.
              src_endpoint = get_src_endpoint(data['detail'])
              # get existing user from which an activity was initiated.
              src_user = get_src_user(data['detail'])
              # get event status details in OCSF format
              status, status_code, status_detail, status_id = get_status_details(data['detail'])
              # get event type details in OCSF format
              type_uid, type_name = get_type_category(data['detail']['eventType'])
              # get metadata about the event type in OCSF format
              metadata= get_metadata(data['time'],data['version'])
              # Assemeble the JSON string in OCSF format
              json_data = {
                  'activity_name': activity,
                  'activity_id': activity_id,
                  'auth_protocol': auth_protocol,
                  'auth_protocol_id': auth_protocol_id,
                  'category_name': category_name,
                  'category_uid': category_uid,
                  'class_name': class_name,
                  'class_uid': class_uid,
                  'is_cleartext': is_cleartext,
                  'dst_endpoint': dst_endpoint,
                  'dst_user': dst_user,
                  'enrichments': enrichments,
                  'time': _time,
                  'logon_type': logon_type,
                  'logon_type_id': logon_type_id,
                  'displayMessage': display_message,
                  'ref_time': ref_time,
                  'profile': profile,
                  'session_uid': session_uid,
                  'severity': severity,
                  'severity_id': severity_id,
                  'src_endpoint': src_endpoint,
                  'user': src_user,
                  'status': status,
                  'status_code': status_code,
                  'status_detail': status_detail,
                  'status_id': status_id,
                  'type_uid': type_uid,
                  'type_name': type_name,
                  'metadata': metadata
              }
              # Return the JSON String
              return json_data
      Handler: index.lambda_handler
      Role: !GetAtt TransformLambdaRole.Arn
      Runtime: python3.8
      Timeout: 120
      MemorySize: 128

  #Creating AWS Glue Catalog

  OCSFOktaDatabase:
    Type: "AWS::Glue::Database"
    Properties:
      DatabaseInput:
        Description: "Cloudformation for Glue database"
        Name: !Ref GlueDatabaseName
      CatalogId: !Ref AWS::AccountId

  OCSFSchemaTable:
    Type: "AWS::Glue::Table"
    DependsOn: OCSFOktaDatabase
    Properties:
      TableInput:
        Description: "OCSF Schema Name"
        TableType: "EXTERNAL_TABLE"
        Parameters: {
          "classification": "json",
          "CrawlerSchemaDeserializerVersion": "1.0",
          "CrawlerSchemaSerializerVersion": "1.0",
          "averageRecordSize": "1465",
          "compressionType": "none",
          "objectCount": "1",
          "recordCount": "2",
          "sizeKey": "2930",
          "typeOfData": "file"
        }
        StorageDescriptor:
          StoredAsSubDirectories: False
          InputFormat: "org.apache.hadoop.mapred.TextInputFormat"
          OutputFormat: "org.apache.hadoop.hive.ql.io.HiveIgnoreKeyTextOutputFormat"
          Compressed: "false"
          Columns:
            - Type: string
              Name: activity_name
            - Type: bigint
              Name: activity_id
            - Type: string
              Name: auth_protocol
            - Type: bigint
              Name: auth_protocol_id
            - Type: string
              Name: category_name
            - Type: bigint
              Name: category_uid
            - Type: string
              Name: class_name
            - Type: bigint
              Name: class_uid
            - Type: boolean
              Name: is_cleartext
            - Type: struct<hostname:string,ip:string,instance_uid:string,interface_id:string,svc_name:string>
              Name: dst_endpoint
            - Type: string
              Name: dst_user
            - Type: struct<original_time:string,version:string,product:struct<vendor_name:string,name:string>>
              Name: metadata
            - Type: array<struct<name:string,type:string,value:string,data:struct<city:string,state:string,country:string,postalCode:string,type:string,value:string,geolocation:struct<lat:string,lon:string>>>>
              Name: enrichments
            - Type: bigint
              Name: time
            - Type: string
              Name: logon_type
            - Type: bigint
              Name: logon_type_id
            - Type: string
              Name: displaymessage
            - Type: string
              Name: ref_time
            - Type: string
              Name: profile
            - Type: string
              Name: session_uid
            - Type: string
              Name: severity
            - Type: bigint
              Name: severity_id
            - Type: struct<hostname:string,ip:string,interface_id:string>
              Name: src_endpoint
            - Type: struct<type:string,name:string,email_addr:string>
              Name: user
            - Type: string
              Name: status
            - Type: string
              Name: status_code
            - Type: string
              Name: status_detail
            - Type: bigint
              Name: status_id
            - Type: bigint
              Name: type_uid
            - Type: string
              Name: type_name
            - Type: string
              Name: partition_0
          SerdeInfo:
            Parameters: {
              "field.delim": ",",
              "paths": "time,activity,activity_id,auth_protocol,auth_protocol_id,category_name,category_uid,class_name,class_uid,displayMessage,dst_endpoint,dst_user,enrichments,is_cleartext,logon_type,logon_type_id,profile,ref_time,session_uid,severity,severity_id,src_endpoint,user,status,status_code,status_detail,status_id,type_name,type_uid,metadata"
            }
            SerializationLibrary: "org.openx.data.jsonserde.JsonSerDe"
          Location: !Ref SecurityLakeS3

        Name: !Ref GlueTableName
      DatabaseName: !Ref GlueDatabaseName
      CatalogId: !Ref AWS::AccountId

  #Create AWS Firehose Delivery Stream

  DeliveryStream:
    Type: AWS::KinesisFirehose::DeliveryStream
    DependsOn: DateLakePermission
    Properties:
      DeliveryStreamName: !Ref StreamName
      DeliveryStreamType: DirectPut
      ExtendedS3DestinationConfiguration:
        BucketARN: !Join
          - ''
          - - 'arn:aws:s3:::'
            - !Select [2, !Split ["/", !Ref SecurityLakeS3]]
        Prefix: !Join
          - ''
          - - 'ext/'
            - !Select [4, !Split ["/", !Ref SecurityLakeS3]]
            - '/region=!{partitionKeyFromLambda:region}/accountId=!{partitionKeyFromLambda:AWS_account}/eventDay=!{partitionKeyFromLambda:eventDay}/'
        ErrorOutputPrefix: okta-ocsf-error
        BufferingHints:
          IntervalInSeconds: 60
          SizeInMBs: 66
        RoleARN: !GetAtt DeliveryRole.Arn
        DynamicPartitioningConfiguration:
          Enabled: true
        DataFormatConversionConfiguration:
          Enabled: true
          InputFormatConfiguration:
            Deserializer:
              OpenXJsonSerDe : {}
          OutputFormatConfiguration :
            Serializer:
              ParquetSerDe: {}
          SchemaConfiguration :
            CatalogId: !Ref AWS::AccountId
            RoleARN: !GetAtt DeliveryRole.Arn
            DatabaseName: !Ref OCSFOktaDatabase
            TableName: !Ref OCSFSchemaTable
            Region: !Ref AWS::Region
            VersionId: LATEST
        ProcessingConfiguration:
          Enabled: true
          Processors:
            - Parameters:
                - ParameterName: LambdaArn
                  ParameterValue: !GetAtt TransformLambdaFunction.Arn
              Type: Lambda

  DeliveryRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Sid: ''
            Effect: Allow
            Principal:
              Service: firehose.amazonaws.com
            Action: 'sts:AssumeRole'
            Condition:
              StringEquals:
                'sts:ExternalId': !Ref 'AWS::AccountId'
      Path: "/"
      Policies:
        - PolicyName: firehose_delivery_policy
          PolicyDocument:
            Version: 2012-10-17
            Statement:
              - Effect: Allow
                Action:
                  - 's3:AbortMultipartUpload'
                  - 's3:GetBucketLocation'
                  - 's3:GetObject'
                  - 's3:ListBucket'
                  - 's3:ListBucketMultipartUploads'
                  - 's3:PutObject'
                Resource:
                  - !Join
                    - ''
                    - - 'arn:aws:s3:::'
                      - !Select [2, !Split ["/", !Ref SecurityLakeS3]]
                  - !Join
                    - ''
                    - - 'arn:aws:s3:::'
                      - !Select [2, !Split ["/", !Ref SecurityLakeS3]]
                      - '/'
                      - !Select [3, !Split ["/", !Ref SecurityLakeS3]]
                      - '/'
                      - !Select [4, !Split ["/", !Ref SecurityLakeS3]]
                      - '/*'
              - Effect: Allow
                Action:
                  - 'glue:GetTableVersions'
                  - 'glue:GetTableVersion'
                  - 'glue:GetTableVersions'
                Resource:
                  - !Join
                    - ''
                    - - 'arn:aws:glue:'
                      - !Ref AWS::Region
                      - ':'
                      - !Ref AWS::AccountId
                      - ':catalog'
                  - !Join
                    - ''
                    - - 'arn:aws:glue:'
                      - !Ref AWS::Region
                      - ':'
                      - !Ref AWS::AccountId
                      - ':database/'
                      -  !Ref OCSFOktaDatabase
                  - !Join
                    - ''
                    - - 'arn:aws:glue:'
                      - !Ref AWS::Region
                      - ':'
                      - !Ref AWS::AccountId
                      - ':table/'
                      - !Ref OCSFOktaDatabase
                      -  '/'
                      -  !Ref OCSFSchemaTable
              - Effect: Allow
                Action:
                  - 'lambda:InvokeFunction'
                  - 'lambda:GetFunctionConfiguration'
                Resource:
                  - !Join
                    - ''
                    - - 'arn:aws:lambda:'
                      - !Ref AWS::Region
                      - ':'
                      - !Ref AWS::AccountId
                      - ':function:'
                      - !Ref TransformLambdaFunction
              - Effect: Allow
                Action:
                  - 'kms:GenerateDataKey'
                  - 'kms:Decrypt'
                Resource:
                  - !Join
                    - ''
                    - - 'arn:aws:kms:'
                      - !Ref AWS::Region
                      - ':'
                      - !Ref AWS::AccountId
                      - ':key/%FIREHOSE_POLICY_TEMPLATE_PLACEHOLDER%'
                Condition:
                  StringEquals:
                    'kms:ViaService': !Sub 'kinesis.${AWS::Region}.amazonaws.com'
                  StringLike:
                    'kms:EncryptionContext:aws:s3:arn':
                      - 'arn:aws:s3:::%FIREHOSE_POLICY_TEMPLATE_PLACEHOLDER%/*'
                      - 'arn:aws:s3:::%FIREHOSE_POLICY_TEMPLATE_PLACEHOLDER%'
              - Effect: Allow
                Action: 'logs:PutLogEvents'
                Resource:
                  - !Join
                    - ''
                    - - 'arn:aws:logs:'
                      - !Ref 'AWS::Region'
                      - ':'
                      - !Ref 'AWS::AccountId'
                      - ':log-group:/aws/kinesisfirehose/'
                      - !Ref StreamName
                      - ':'
                      - ':log-stream:*'
                  - !Join
                    - ''
                    - - 'arn:aws:logs:'
                      - !Ref 'AWS::Region'
                      - ':'
                      - !Ref 'AWS::AccountId'
                      - ':log-group:%FIREHOSE_POLICY_TEMPLATE_PLACEHOLDER%:log-stream:*'
              - Effect: Allow
                Action:
                  - 'kinesis:DescribeStream'
                  - 'kinesis:GetShardIterator'
                  - 'kinesis:GetRecords'
                  - 'kinesis:ListShards'
                Resource:
                  - !Join
                    - ''
                    - - 'arn:aws:kinesis:'
                      - !Ref 'AWS::Region'
                      - ':'
                      - !Ref 'AWS::AccountId'
                      - ':stream/%FIREHOSE_POLICY_TEMPLATE_PLACEHOLDER%'
              - Effect: Allow
                Action: 'kms:Decrypt'
                Resource:
                  - !Join
                    - ''
                    - - 'arn:aws:kms:'
                      - !Ref 'AWS::Region'
                      - ':'
                      - !Ref 'AWS::AccountId'
                      - ':key/%FIREHOSE_POLICY_TEMPLATE_PLACEHOLDER%'
                Condition:
                  StringEquals:
                    'kms:ViaService': !Sub 'kinesis.${AWS::Region}.amazonaws.com'
                  StringLike:
                    'kms:EncryptionContext:aws:s3:arn':
                      - 'arn:aws:kinesis:::%FIREHOSE_POLICY_TEMPLATE_PLACEHOLDER%/*'

  DateLakePermission:
    Type: AWS::LakeFormation::PrincipalPermissions
    Properties:
      Principal:
        DataLakePrincipalIdentifier: !GetAtt DeliveryRole.Arn
      Resource:
        Table:
          CatalogId: !Ref 'AWS::AccountId'
          DatabaseName: !Ref OCSFOktaDatabase
          Name: !Ref OCSFSchemaTable
      Permissions:
        - "SELECT"
        - "INSERT"
        - "DELETE"
        - "ALTER"
        - "DROP"
        - "DESCRIBE"
      PermissionsWithGrantOption:
        - "SELECT"
        - "INSERT"
        - "DELETE"
        - "ALTER"
        - "DROP"
        - "DESCRIBE"

  EventBusRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Sid: ''
            Effect: Allow
            Principal:
              Service: events.amazonaws.com
            Action: 'sts:AssumeRole'
      Path: "/"
      Policies:
        - PolicyName: firehose_delivery_policy
          PolicyDocument:
            Version: 2012-10-17
            Statement:
              - Effect: Allow
                Action:
                  - 'firehose:PutRecord'
                  - 'firehose:PutRecordBatch'
                Resource:
                  - !Join
                    - ''
                    - - 'arn:aws:firehose:'
                      - !Ref AWS::Region
                      - ':'
                      - !Ref AWS::AccountId
                      - ':deliverystream/'
                      - !Ref StreamName
Outputs:
  KinesisFirehose:
    Description: Kinesis Firehose Name
    Value: !Ref DeliveryStream
  S3bucketname:
    Value: !Ref SecurityLakeS3
    Description: Name of the bucket created
  GlueDatabase:
    Value: !Ref OCSFOktaDatabase
    Description: AWS Glue Database
  GlueTable:
    Value: !Ref OCSFSchemaTable
    Description: AWS Glue Table