SecurityHubFindingsToEmail.json

{
"AWSTemplateFormatVersion": "2010-09-09",
    "Description": "This CloudFormation Template will enable you to create custom action in AWS SecurityHub console to allow findings to be sent to an email address ",
    "Parameters": {
        "EmailAddress": {
            "Type": "String",
            "Description": "An email address to recieve Security Hub Findings"
        }
    },
    "Resources": {
        "SendFindingsTopic": {
          "Type": "AWS::SNS::Topic",
          "Properties": {
            "DisplayName": "SendFindingsTopic",
            "Subscription": [ {
                "Endpoint" : {"Ref" : "EmailAddress"},
                "Protocol" : "email"
            } ],
            "TopicName": "SendFindingsTopic"
        }
        },
        "CWESnsPolicy": {
            "Type": "AWS::SNS::TopicPolicy",
            "Properties": {
                "PolicyDocument": {
                    "Version": "2012-10-17",
                    "Statement": [
                        {
                            "Sid": "TrustCWEToPublsihEvents",
                            "Effect": "Allow",
                            "Principal": {
                                "Service": "events.amazonaws.com"
                            },
                            "Action": "sns:Publish",
                            "Resource": "*"
                        }
                    ]
                },
                "Topics": [
                    {
                        "Ref": "SendFindingsTopic"
                    }
                ]
            }
        },
        
        "SecurityHubFindingsToEmail": {
            "Type": "AWS::Events::Rule",
            "Properties": {
            "Name" : "SecurityHubFindingsToEmail",
            "Description": "CloudWatchEvents Rule to enable SecurityHub Findings in email ",
            "EventPattern": {
                "source": ["aws.securityhub"],
                "resources":  [{ "Fn::Join" : [ ":", [ "arn", "aws", "securityhub", { "Ref" : "AWS::Region" }, { "Ref" : "AWS::AccountId" }, { "Fn::Join" : [ "/", [ "action", "custom", "SendToEmail"] ] }]]}]
                },
            "State": "ENABLED",
            "Targets": [{"Id": "SendFindingsTopic","Arn": {"Ref": "SendFindingsTopic"}}]
            }
        }
        
    
    },
    "Outputs": {

    }
}