{ "Description": "(SO0108) - The AWS CloudFormation template for deployment of the centralized-network-inspection-on-aws, Version: v1.1.3", "AWSTemplateFormatVersion": "2010-09-09", "Metadata": { "AWS::CloudFormation::Interface": { "ParameterGroups": [ { "Label": { "default": "VPC Configuration" }, "Parameters": [ "cidrBlock" ] }, { "Label": { "default": "Transit Gateway Configuration" }, "Parameters": [ "ExistingTransitGateway", "TransitGatewayRouteTableIdForAssociation", "TransitGatewayRTIdForDefaultRoute" ] }, { "Label": { "default": "Firewall Logging Configuration" }, "Parameters": [ "logDestinationType", "logType", "LogRetentionPeriod" ] } ], "ParameterLabels": { "cidrBlock": { "default": "Provide the CIDR block for the Inspection VPC" }, "ExistingTransitGateway": { "default": "Provide the existing AWS Transit Gateway ID you wish to attach to the Inspection VPC" }, "TransitGatewayRouteTableIdForAssociation": { "default": "Provide AWS Transit Gateway Route Table to be associated with the Inspection VPC TGW Attachment." }, "TransitGatewayRTIdForDefaultRoute": { "default": "Provide the AWS Transit Gateway Route Table to receive 0.0.0.0/0 route to the Inspection VPC TGW Attachment." }, "logType": { "default": "Select the type of log to send to the defined log destination." }, "logDestinationType": { "default": "Select the type of log destination for the Network Firewall" }, "LogRetentionPeriod": { "default": "Select the log retention period for Network Firewall Logs." } } } }, "Parameters": { "cidrBlock": { "Type": "String", "Default": "192.168.1.0/26", "AllowedPattern": "^(?:[0-9]{1,3}.){3}[0-9]{1,3}[/]([0-9]?[0-6]?|[1][7-9])$", "Description": "CIDR Block for VPC. Must be /26 or larger CIDR block." }, "LogRetentionPeriod": { "Type": "Number", "Default": 90, "AllowedValues": [ "1", "3", "5", "7", "14", "30", "60", "90", "120", "150", "180", "365", "400", "545", "731", "1827", "3653" ], "Description": "Log retention period in days." }, "ExistingTransitGateway": { "Type": "String", "Default": "", "Description": "Existing AWS Transit Gateway id." }, "TransitGatewayRouteTableIdForAssociation": { "Type": "String", "Default": "", "Description": "Existing AWS Transit Gateway route table id. Example: Firewall Route Table. Format: tgw-rtb-0a1b2c3d" }, "TransitGatewayRTIdForDefaultRoute": { "Type": "String", "Default": "", "Description": "Existing AWS Transit Gateway route table id. Example: Spoke VPC Route Table. Format: tgw-rtb-4e5f6g7h" }, "logType": { "Type": "String", "Default": "FLOW", "AllowedValues": [ "ALERT", "FLOW", "EnableBoth" ], "Description": "The type of log to send. Alert logs report traffic that matches a StatefulRule with an action setting that sends an alert log message. Flow logs are standard network traffic flow logs." }, "logDestinationType": { "Type": "String", "Default": "CloudWatchLogs", "AllowedValues": [ "S3", "CloudWatchLogs", "ConfigureManually" ], "Description": "The type of storage destination to send these logs to. You can send logs to an Amazon S3 bucket or a CloudWatch log group." } }, "Mappings": { "SolutionMapping": { "Route": { "QuadZero": "0.0.0.0/0" }, "Log": { "Level": "info" }, "Metrics": { "URL": "https://metrics.awssolutionsbuilder.com/generic" }, "Solution": { "Identifier": "SO0108", "Version": "v1.1.3", "ConfigurationFileName": "centralized-network-inspection-configuration.zip", "ConfigurationS3KeyPrefix": "configuration" }, "TransitGatewayAttachment": { "ApplianceMode": "enable" }, "ParameterKey": { "UniqueId": "Solutions/centralized-network-inspection-on-aws/UUID" } }, "AnonymizedData": { "SendAnonymizedData": { "Data": "Yes" } }, "LatestNodeRuntimeMap": { "af-south-1": { "value": "nodejs22.x" }, "ap-east-1": { "value": "nodejs22.x" }, "ap-east-2": { "value": "nodejs22.x" }, "ap-northeast-1": { "value": "nodejs22.x" }, "ap-northeast-2": { "value": "nodejs22.x" }, "ap-northeast-3": { "value": "nodejs22.x" }, "ap-south-1": { "value": "nodejs22.x" }, "ap-south-2": { "value": "nodejs22.x" }, "ap-southeast-1": { "value": "nodejs22.x" }, "ap-southeast-2": { "value": "nodejs22.x" }, "ap-southeast-3": { "value": "nodejs22.x" }, "ap-southeast-4": { "value": "nodejs22.x" }, "ap-southeast-5": { "value": "nodejs22.x" }, "ap-southeast-7": { "value": "nodejs22.x" }, "ca-central-1": { "value": "nodejs22.x" }, "ca-west-1": { "value": "nodejs22.x" }, "cn-north-1": { "value": "nodejs22.x" }, "cn-northwest-1": { "value": "nodejs22.x" }, "eu-central-1": { "value": "nodejs22.x" }, "eu-central-2": { "value": "nodejs22.x" }, "eu-isoe-west-1": { "value": "nodejs18.x" }, "eu-north-1": { "value": "nodejs22.x" }, "eu-south-1": { "value": "nodejs22.x" }, "eu-south-2": { "value": "nodejs22.x" }, "eu-west-1": { "value": "nodejs22.x" }, "eu-west-2": { "value": "nodejs22.x" }, "eu-west-3": { "value": "nodejs22.x" }, "il-central-1": { "value": "nodejs22.x" }, "me-central-1": { "value": "nodejs22.x" }, "me-south-1": { "value": "nodejs22.x" }, "mx-central-1": { "value": "nodejs22.x" }, "sa-east-1": { "value": "nodejs22.x" }, "us-east-1": { "value": "nodejs22.x" }, "us-east-2": { "value": "nodejs22.x" }, "us-gov-east-1": { "value": "nodejs22.x" }, "us-gov-west-1": { "value": "nodejs22.x" }, "us-iso-east-1": { "value": "nodejs18.x" }, "us-iso-west-1": { "value": "nodejs18.x" }, "us-isob-east-1": { "value": "nodejs18.x" }, "us-isob-west-1": { "value": "nodejs18.x" }, "us-west-1": { "value": "nodejs22.x" }, "us-west-2": { "value": "nodejs22.x" } } }, "Conditions": { "LoggingInS3": { "Fn::Equals": [ { "Ref": "logDestinationType" }, "S3" ] }, "LoggingInCloudWatch": { "Fn::Equals": [ { "Ref": "logDestinationType" }, "CloudWatchLogs" ] }, "NotLoggingConfigureManually": { "Fn::Not": [ { "Fn::Equals": [ { "Ref": "logDestinationType" }, "ConfigureManually" ] } ] }, "CreateTransitGatewayAttachment": { "Fn::Not": [ { "Fn::Equals": [ { "Ref": "ExistingTransitGateway" }, "" ] } ] }, "CreateTransitGatewayRTAssociation": { "Fn::And": [ { "Fn::Not": [ { "Fn::Equals": [ { "Ref": "TransitGatewayRouteTableIdForAssociation" }, "" ] } ] }, { "Condition": "CreateTransitGatewayAttachment" } ] }, "CreateDefaultRouteFirewallRT": { "Fn::And": [ { "Fn::Not": [ { "Fn::Equals": [ { "Ref": "TransitGatewayRTIdForDefaultRoute" }, "" ] } ] }, { "Condition": "CreateTransitGatewayAttachment" } ] }, "CDKMetadataAvailable": { "Fn::Or": [ { "Fn::Or": [ { "Fn::Equals": [ { "Ref": "AWS::Region" }, "af-south-1" ] }, { "Fn::Equals": [ { "Ref": "AWS::Region" }, "ap-east-1" ] }, { "Fn::Equals": [ { "Ref": "AWS::Region" }, "ap-northeast-1" ] }, { "Fn::Equals": [ { "Ref": "AWS::Region" }, "ap-northeast-2" ] }, { "Fn::Equals": [ { "Ref": "AWS::Region" }, "ap-northeast-3" ] }, { "Fn::Equals": [ { "Ref": "AWS::Region" }, "ap-south-1" ] }, { "Fn::Equals": [ { "Ref": "AWS::Region" }, "ap-south-2" ] }, { "Fn::Equals": [ { "Ref": "AWS::Region" }, "ap-southeast-1" ] }, { "Fn::Equals": [ { "Ref": "AWS::Region" }, "ap-southeast-2" ] }, { "Fn::Equals": [ { "Ref": "AWS::Region" }, "ap-southeast-3" ] } ] }, { "Fn::Or": [ { "Fn::Equals": [ { "Ref": "AWS::Region" }, "ap-southeast-4" ] }, { "Fn::Equals": [ { "Ref": "AWS::Region" }, "ca-central-1" ] }, { "Fn::Equals": [ { "Ref": "AWS::Region" }, "ca-west-1" ] }, { "Fn::Equals": [ { "Ref": "AWS::Region" }, "cn-north-1" ] }, { "Fn::Equals": [ { "Ref": "AWS::Region" }, "cn-northwest-1" ] }, { "Fn::Equals": [ { "Ref": "AWS::Region" }, "eu-central-1" ] }, { "Fn::Equals": [ { "Ref": "AWS::Region" }, "eu-central-2" ] }, { "Fn::Equals": [ { "Ref": "AWS::Region" }, "eu-north-1" ] }, { "Fn::Equals": [ { "Ref": "AWS::Region" }, "eu-south-1" ] }, { "Fn::Equals": [ { "Ref": "AWS::Region" }, "eu-south-2" ] } ] }, { "Fn::Or": [ { "Fn::Equals": [ { "Ref": "AWS::Region" }, "eu-west-1" ] }, { "Fn::Equals": [ { "Ref": "AWS::Region" }, "eu-west-2" ] }, { "Fn::Equals": [ { "Ref": "AWS::Region" }, "eu-west-3" ] }, { "Fn::Equals": [ { "Ref": "AWS::Region" }, "il-central-1" ] }, { "Fn::Equals": [ { "Ref": "AWS::Region" }, "me-central-1" ] }, { "Fn::Equals": [ { "Ref": "AWS::Region" }, "me-south-1" ] }, { "Fn::Equals": [ { "Ref": "AWS::Region" }, "sa-east-1" ] }, { "Fn::Equals": [ { "Ref": "AWS::Region" }, "us-east-1" ] }, { "Fn::Equals": [ { "Ref": "AWS::Region" }, "us-east-2" ] }, { "Fn::Equals": [ { "Ref": "AWS::Region" }, "us-west-1" ] } ] }, { "Fn::Equals": [ { "Ref": "AWS::Region" }, "us-west-2" ] } ] } }, "Resources": { "VPC": { "Type": "AWS::EC2::VPC", "Properties": { "CidrBlock": { "Ref": "cidrBlock" }, "Tags": [ { "Key": "created-by", "Value": "centralized-network-inspection-on-aws" }, { "Key": "Name", "Value": { "Fn::Join": [ "", [ { "Ref": "AWS::StackName" }, "-Inspection-VPC" ] ] } } ] }, "UpdateReplacePolicy": "Retain", "DeletionPolicy": "Retain", "Metadata": { "aws:cdk:path": "centralized-network-inspection-on-aws/VPC" } }, "KMSKeyForNetworkFirewallBuckets73A57817": { "Type": "AWS::KMS::Key", "Properties": { "Description": "This key will be used for encrypting the vpc flow logs and firewall logs.", "EnableKeyRotation": true, "KeyPolicy": { "Statement": [ { "Action": "kms:*", "Effect": "Allow", "Principal": { "AWS": { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":iam::", { "Ref": "AWS::AccountId" }, ":root" ] ] } }, "Resource": "*" }, { "Action": "kms:GenerateDataKey*", "Effect": "Allow", "Principal": { "Service": "delivery.logs.amazonaws.com" }, "Resource": "*" }, { "Action": [ "kms:Encrypt*", "kms:Decrypt*", "kms:ReEncrypt*", "kms:GenerateDataKey*", "kms:Describe*" ], "Effect": "Allow", "Principal": { "Service": { "Fn::Join": [ "", [ "logs.", { "Ref": "AWS::Region" }, ".amazonaws.com" ] ] } }, "Resource": "*" } ], "Version": "2012-10-17" } }, "UpdateReplacePolicy": "Retain", "DeletionPolicy": "Retain", "Metadata": { "aws:cdk:path": "centralized-network-inspection-on-aws/KMSKeyForNetworkFirewallBuckets/Resource" } }, "CloudWatchLogGroup": { "Type": "AWS::Logs::LogGroup", "Properties": { "KmsKeyId": { "Fn::GetAtt": [ "KMSKeyForNetworkFirewallBuckets73A57817", "Arn" ] }, "RetentionInDays": { "Ref": "LogRetentionPeriod" } }, "Metadata": { "aws:cdk:path": "centralized-network-inspection-on-aws/CloudWatchLogGroup", "guard": { "SuppressedRules": [ "CW_LOGGROUP_RETENTION_PERIOD_CHECK" ] } }, "Condition": "LoggingInCloudWatch" }, "Logs6819BB44": { "Type": "AWS::S3::Bucket", "Properties": { "BucketEncryption": { "ServerSideEncryptionConfiguration": [ { "ServerSideEncryptionByDefault": { "KMSMasterKeyID": { "Fn::GetAtt": [ "KMSKeyForNetworkFirewallBuckets73A57817", "Arn" ] }, "SSEAlgorithm": "aws:kms" } } ] }, "LifecycleConfiguration": { "Rules": [ { "ExpirationInDays": { "Ref": "LogRetentionPeriod" }, "Status": "Enabled" } ] }, "PublicAccessBlockConfiguration": { "BlockPublicAcls": true, "BlockPublicPolicy": true, "IgnorePublicAcls": true, "RestrictPublicBuckets": true } }, "UpdateReplacePolicy": "Retain", "DeletionPolicy": "Retain", "Metadata": { "cfn_nag": { "rules_to_suppress": [ { "id": "W35", "reason": "Logs bucket does not require logging configuration" }, { "id": "W51", "reason": "Logs bucket is private and does not require a bucket policy" } ] } }, "Condition": "LoggingInS3" }, "NetworkFirewallSubnet1": { "Type": "AWS::EC2::Subnet", "Properties": { "AvailabilityZone": { "Fn::Select": [ "0", { "Fn::GetAZs": "" } ] }, "CidrBlock": { "Fn::Select": [ 0, { "Fn::Cidr": [ { "Fn::GetAtt": [ "VPC", "CidrBlock" ] }, 4, "4" ] } ] }, "Tags": [ { "Key": "Name", "Value": { "Fn::Join": [ "", [ { "Ref": "AWS::StackName" }, "-FirewallSubnet1" ] ] } } ], "VpcId": { "Ref": "VPC" } }, "UpdateReplacePolicy": "Retain", "DeletionPolicy": "Retain", "Metadata": { "aws:cdk:path": "centralized-network-inspection-on-aws/NetworkFirewallSubnet1" } }, "NetworkFirewallSubnet2": { "Type": "AWS::EC2::Subnet", "Properties": { "AvailabilityZone": { "Fn::Select": [ "1", { "Fn::GetAZs": "" } ] }, "CidrBlock": { "Fn::Select": [ 1, { "Fn::Cidr": [ { "Fn::GetAtt": [ "VPC", "CidrBlock" ] }, 4, "4" ] } ] }, "Tags": [ { "Key": "Name", "Value": { "Fn::Join": [ "", [ { "Ref": "AWS::StackName" }, "-FirewallSubnet2" ] ] } } ], "VpcId": { "Ref": "VPC" } }, "UpdateReplacePolicy": "Retain", "DeletionPolicy": "Retain", "Metadata": { "aws:cdk:path": "centralized-network-inspection-on-aws/NetworkFirewallSubnet2" } }, "FirewallSubnetRouteTable": { "Type": "AWS::EC2::RouteTable", "Properties": { "Tags": [ { "Key": "Name", "Value": { "Fn::Join": [ "", [ { "Ref": "AWS::StackName" }, "-FirewallSubnetRouteTable" ] ] } } ], "VpcId": { "Ref": "VPC" } }, "UpdateReplacePolicy": "Retain", "DeletionPolicy": "Retain", "Metadata": { "aws:cdk:path": "centralized-network-inspection-on-aws/FirewallSubnetRouteTable" } }, "NetworkFirewallSubnet1RouteTableAssociation": { "Type": "AWS::EC2::SubnetRouteTableAssociation", "Properties": { "RouteTableId": { "Ref": "FirewallSubnetRouteTable" }, "SubnetId": { "Ref": "NetworkFirewallSubnet1" } }, "UpdateReplacePolicy": "Retain", "DeletionPolicy": "Retain", "Metadata": { "aws:cdk:path": "centralized-network-inspection-on-aws/NetworkFirewallSubnet1RouteTableAssociation" } }, "NetworkFirewallSubnet2RouteTableAssociation": { "Type": "AWS::EC2::SubnetRouteTableAssociation", "Properties": { "RouteTableId": { "Ref": "FirewallSubnetRouteTable" }, "SubnetId": { "Ref": "NetworkFirewallSubnet2" } }, "UpdateReplacePolicy": "Retain", "DeletionPolicy": "Retain", "Metadata": { "aws:cdk:path": "centralized-network-inspection-on-aws/NetworkFirewallSubnet2RouteTableAssociation" } }, "VPCTGWSubnet1": { "Type": "AWS::EC2::Subnet", "Properties": { "AvailabilityZone": { "Fn::Select": [ "0", { "Fn::GetAZs": "" } ] }, "CidrBlock": { "Fn::Select": [ 2, { "Fn::Cidr": [ { "Fn::GetAtt": [ "VPC", "CidrBlock" ] }, 4, "4" ] } ] }, "Tags": [ { "Key": "Name", "Value": { "Fn::Join": [ "", [ { "Ref": "AWS::StackName" }, "-VPCTGWSubnet1" ] ] } } ], "VpcId": { "Ref": "VPC" } }, "UpdateReplacePolicy": "Retain", "DeletionPolicy": "Retain", "Metadata": { "aws:cdk:path": "centralized-network-inspection-on-aws/VPCTGWSubnet1" } }, "VPCTGWSubnet2": { "Type": "AWS::EC2::Subnet", "Properties": { "AvailabilityZone": { "Fn::Select": [ "1", { "Fn::GetAZs": "" } ] }, "CidrBlock": { "Fn::Select": [ 3, { "Fn::Cidr": [ { "Fn::GetAtt": [ "VPC", "CidrBlock" ] }, 4, "4" ] } ] }, "Tags": [ { "Key": "Name", "Value": { "Fn::Join": [ "", [ { "Ref": "AWS::StackName" }, "-VPCTGWSubnet2" ] ] } } ], "VpcId": { "Ref": "VPC" } }, "UpdateReplacePolicy": "Retain", "DeletionPolicy": "Retain", "Metadata": { "aws:cdk:path": "centralized-network-inspection-on-aws/VPCTGWSubnet2" } }, "VPCTGWRouteTable1": { "Type": "AWS::EC2::RouteTable", "Properties": { "Tags": [ { "Key": "Name", "Value": { "Fn::Join": [ "", [ { "Ref": "AWS::StackName" }, "-TGWSubnetRouteTable1" ] ] } } ], "VpcId": { "Ref": "VPC" } }, "UpdateReplacePolicy": "Retain", "DeletionPolicy": "Retain", "Metadata": { "aws:cdk:path": "centralized-network-inspection-on-aws/VPCTGWRouteTable1" } }, "VPCTGWRouteTable2": { "Type": "AWS::EC2::RouteTable", "Properties": { "Tags": [ { "Key": "Name", "Value": { "Fn::Join": [ "", [ { "Ref": "AWS::StackName" }, "-TGWSubnetRouteTable2" ] ] } } ], "VpcId": { "Ref": "VPC" } }, "UpdateReplacePolicy": "Retain", "DeletionPolicy": "Retain", "Metadata": { "aws:cdk:path": "centralized-network-inspection-on-aws/VPCTGWRouteTable2" } }, "VPCTGWSubnet1RouteTableAssociation": { "Type": "AWS::EC2::SubnetRouteTableAssociation", "Properties": { "RouteTableId": { "Ref": "VPCTGWRouteTable1" }, "SubnetId": { "Ref": "VPCTGWSubnet1" } }, "UpdateReplacePolicy": "Retain", "DeletionPolicy": "Retain", "Metadata": { "aws:cdk:path": "centralized-network-inspection-on-aws/VPCTGWSubnet1RouteTableAssociation" } }, "VPCTGWSubnet2RouteTableAssociation": { "Type": "AWS::EC2::SubnetRouteTableAssociation", "Properties": { "RouteTableId": { "Ref": "VPCTGWRouteTable2" }, "SubnetId": { "Ref": "VPCTGWSubnet2" } }, "UpdateReplacePolicy": "Retain", "DeletionPolicy": "Retain", "Metadata": { "aws:cdk:path": "centralized-network-inspection-on-aws/VPCTGWSubnet2RouteTableAssociation" } }, "LogGroupFlowLogs": { "Type": "AWS::Logs::LogGroup", "Properties": { "KmsKeyId": { "Fn::GetAtt": [ "KMSKeyForNetworkFirewallBuckets73A57817", "Arn" ] }, "LogGroupName": { "Ref": "AWS::StackName" }, "RetentionInDays": { "Ref": "LogRetentionPeriod" } }, "Metadata": { "aws:cdk:path": "centralized-network-inspection-on-aws/LogGroupFlowLogs", "guard": { "SuppressedRules": [ "CW_LOGGROUP_RETENTION_PERIOD_CHECK" ] } } }, "RoleFlowLogsCA794118": { "Type": "AWS::IAM::Role", "Properties": { "AssumeRolePolicyDocument": { "Statement": [ { "Action": "sts:AssumeRole", "Effect": "Allow", "Principal": { "Service": "vpc-flow-logs.amazonaws.com" } } ], "Version": "2012-10-17" } }, "Metadata": { "aws:cdk:path": "centralized-network-inspection-on-aws/RoleFlowLogs/Resource" } }, "RoleFlowLogsDefaultPolicyD1F03EF4": { "Type": "AWS::IAM::Policy", "Properties": { "PolicyDocument": { "Statement": [ { "Action": [ "logs:CreateLogStream", "logs:DescribeLogStreams", "logs:PutLogEvents", "logs:CreateLogGroup", "logs:DescribeLogGroups" ], "Effect": "Allow", "Resource": { "Fn::GetAtt": [ "LogGroupFlowLogs", "Arn" ] } } ], "Version": "2012-10-17" }, "PolicyName": "RoleFlowLogsDefaultPolicyD1F03EF4", "Roles": [ { "Ref": "RoleFlowLogsCA794118" } ] }, "Metadata": { "aws:cdk:path": "centralized-network-inspection-on-aws/RoleFlowLogs/DefaultPolicy/Resource" } }, "FlowLog": { "Type": "AWS::EC2::FlowLog", "Properties": { "DeliverLogsPermissionArn": { "Fn::GetAtt": [ "RoleFlowLogsCA794118", "Arn" ] }, "LogGroupName": { "Ref": "AWS::StackName" }, "ResourceId": { "Ref": "VPC" }, "ResourceType": "VPC", "TrafficType": "ALL" }, "Metadata": { "aws:cdk:path": "centralized-network-inspection-on-aws/FlowLog" } }, "VPCTGWATTACHMENT": { "Type": "AWS::EC2::TransitGatewayAttachment", "Properties": { "SubnetIds": [ { "Ref": "VPCTGWSubnet1" }, { "Ref": "VPCTGWSubnet2" } ], "Tags": [ { "Key": "Name", "Value": { "Fn::Join": [ "", [ { "Ref": "AWS::StackName" }, "-Inspection-VPC-Attachment" ] ] } } ], "TransitGatewayId": { "Ref": "ExistingTransitGateway" }, "VpcId": { "Ref": "VPC" } }, "DeletionPolicy": "Retain", "Metadata": { "aws:cdk:path": "centralized-network-inspection-on-aws/VPC_TGW_ATTACHMENT" }, "Condition": "CreateTransitGatewayAttachment" }, "TGWRoute": { "Type": "AWS::EC2::Route", "Properties": { "DestinationCidrBlock": { "Fn::FindInMap": [ "SolutionMapping", "Route", "QuadZero" ] }, "RouteTableId": { "Ref": "FirewallSubnetRouteTable" }, "TransitGatewayId": { "Ref": "ExistingTransitGateway" } }, "DependsOn": [ "VPCTGWATTACHMENT" ], "Metadata": { "aws:cdk:path": "centralized-network-inspection-on-aws/TGWRoute" }, "Condition": "CreateTransitGatewayAttachment" }, "VPCTGWRouteTableAssociation": { "Type": "AWS::EC2::TransitGatewayRouteTableAssociation", "Properties": { "TransitGatewayAttachmentId": { "Ref": "VPCTGWATTACHMENT" }, "TransitGatewayRouteTableId": { "Ref": "TransitGatewayRouteTableIdForAssociation" } }, "Metadata": { "aws:cdk:path": "centralized-network-inspection-on-aws/VPCTGWRouteTableAssociation" }, "Condition": "CreateTransitGatewayRTAssociation", "DeletionPolicy": "Retain" }, "DefaultRouteSpokeVPCTGWRouteTable": { "Type": "AWS::EC2::TransitGatewayRoute", "Properties": { "DestinationCidrBlock": { "Fn::FindInMap": [ "SolutionMapping", "Route", "QuadZero" ] }, "TransitGatewayAttachmentId": { "Ref": "VPCTGWATTACHMENT" }, "TransitGatewayRouteTableId": { "Ref": "TransitGatewayRTIdForDefaultRoute" } }, "Metadata": { "aws:cdk:path": "centralized-network-inspection-on-aws/DefaultRouteSpokeVPCTGWRouteTable" }, "Condition": "CreateDefaultRouteFirewallRT", "DeletionPolicy": "Retain" }, "CodeBuildStagesSourceCodeBucketFA98E7C7": { "Type": "AWS::S3::Bucket", "Properties": { "BucketEncryption": { "ServerSideEncryptionConfiguration": [ { "ServerSideEncryptionByDefault": { "SSEAlgorithm": "AES256" } } ] }, "PublicAccessBlockConfiguration": { "BlockPublicAcls": true, "BlockPublicPolicy": true, "IgnorePublicAcls": true, "RestrictPublicBuckets": true }, "VersioningConfiguration": { "Status": "Enabled" } }, "UpdateReplacePolicy": "Retain", "DeletionPolicy": "Retain", "Metadata": { "cfn_nag": { "rules_to_suppress": [ { "id": "W35", "reason": "Source Code bucket bucket does not require logging configuration" }, { "id": "W51", "reason": "Source Code bucket is private and does not require a bucket policy" } ] } } }, "BuildProjectRoleAA92C755": { "Type": "AWS::IAM::Role", "Properties": { "AssumeRolePolicyDocument": { "Statement": [ { "Action": "sts:AssumeRole", "Effect": "Allow", "Principal": { "Service": "codebuild.amazonaws.com" } } ], "Version": "2012-10-17" } }, "Metadata": { "aws:cdk:path": "centralized-network-inspection-on-aws/BuildProject/Role/Resource" } }, "BuildProjectRoleDefaultPolicy3E9F248C": { "Type": "AWS::IAM::Policy", "Properties": { "PolicyDocument": { "Statement": [ { "Action": [ "logs:CreateLogGroup", "logs:CreateLogStream", "logs:PutLogEvents" ], "Effect": "Allow", "Resource": [ { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":logs:", { "Ref": "AWS::Region" }, ":", { "Ref": "AWS::AccountId" }, ":log-group:/aws/codebuild/", { "Ref": "BuildProject097C5DB7" } ] ] }, { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":logs:", { "Ref": "AWS::Region" }, ":", { "Ref": "AWS::AccountId" }, ":log-group:/aws/codebuild/", { "Ref": "BuildProject097C5DB7" }, ":*" ] ] } ] }, { "Action": [ "codebuild:CreateReportGroup", "codebuild:CreateReport", "codebuild:UpdateReport", "codebuild:BatchPutTestCases", "codebuild:BatchPutCodeCoverages" ], "Effect": "Allow", "Resource": { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":codebuild:", { "Ref": "AWS::Region" }, ":", { "Ref": "AWS::AccountId" }, ":report-group/", { "Ref": "BuildProject097C5DB7" }, "-*" ] ] } }, { "Action": [ "s3:GetObject*", "s3:GetBucket*", "s3:List*", "s3:DeleteObject*", "s3:PutObject", "s3:PutObjectLegalHold", "s3:PutObjectRetention", "s3:PutObjectTagging", "s3:PutObjectVersionTagging", "s3:Abort*" ], "Effect": "Allow", "Resource": [ { "Fn::GetAtt": [ "CentralizedNetworkInspectionCodePipelineArtifactsBucket20C04501", "Arn" ] }, { "Fn::Join": [ "", [ { "Fn::GetAtt": [ "CentralizedNetworkInspectionCodePipelineArtifactsBucket20C04501", "Arn" ] }, "/*" ] ] } ] }, { "Action": [ "kms:Decrypt", "kms:DescribeKey", "kms:Encrypt", "kms:ReEncrypt*", "kms:GenerateDataKey*" ], "Effect": "Allow", "Resource": { "Fn::GetAtt": [ "CentralizedNetworkInspectionCodePipelineArtifactsBucketEncryptionKey03CCD69F", "Arn" ] } }, { "Action": [ "kms:Decrypt", "kms:Encrypt", "kms:ReEncrypt*", "kms:GenerateDataKey*" ], "Effect": "Allow", "Resource": { "Fn::GetAtt": [ "CentralizedNetworkInspectionCodePipelineArtifactsBucketEncryptionKey03CCD69F", "Arn" ] } } ], "Version": "2012-10-17" }, "PolicyName": "BuildProjectRoleDefaultPolicy3E9F248C", "Roles": [ { "Ref": "BuildProjectRoleAA92C755" } ] }, "Metadata": { "aws:cdk:path": "centralized-network-inspection-on-aws/BuildProject/Role/DefaultPolicy/Resource" } }, "BuildProject097C5DB7": { "Type": "AWS::CodeBuild::Project", "Properties": { "Artifacts": { "Type": "CODEPIPELINE" }, "Cache": { "Type": "NO_CACHE" }, "EncryptionKey": { "Fn::GetAtt": [ "CentralizedNetworkInspectionCodePipelineArtifactsBucketEncryptionKey03CCD69F", "Arn" ] }, "Environment": { "ComputeType": "BUILD_GENERAL1_SMALL", "EnvironmentVariables": [ { "Name": "LOG_LEVEL", "Type": "PLAINTEXT", "Value": { "Fn::FindInMap": [ "SolutionMapping", "Log", "Level" ] } }, { "Name": "VPC_ID", "Type": "PLAINTEXT", "Value": { "Ref": "VPC" } }, { "Name": "SUBNET_IDS", "Type": "PLAINTEXT", "Value": { "Fn::Join": [ "", [ { "Ref": "NetworkFirewallSubnet1" }, ",", { "Ref": "NetworkFirewallSubnet2" } ] ] } }, { "Name": "LOG_TYPE", "Type": "PLAINTEXT", "Value": { "Ref": "logType" } }, { "Name": "LOG_DESTINATION_TYPE", "Type": "PLAINTEXT", "Value": { "Ref": "logDestinationType" } }, { "Name": "S3_LOG_BUCKET_NAME", "Type": "PLAINTEXT", "Value": { "Fn::If": [ "LoggingInS3", { "Ref": "Logs6819BB44" }, "NotConfigured" ] } }, { "Name": "CLOUDWATCH_LOG_GROUP_NAME", "Type": "PLAINTEXT", "Value": { "Fn::If": [ "LoggingInCloudWatch", { "Ref": "CloudWatchLogGroup" }, "NotConfigured" ] } }, { "Name": "VPC_TGW_ATTACHMENT_AZ_1", "Type": "PLAINTEXT", "Value": { "Fn::GetAtt": [ "NetworkFirewallSubnet1", "AvailabilityZone" ] } }, { "Name": "VPC_TGW_ATTACHMENT_AZ_2", "Type": "PLAINTEXT", "Value": { "Fn::GetAtt": [ "NetworkFirewallSubnet2", "AvailabilityZone" ] } }, { "Name": "VPC_TGW_ATTACHMENT_ROUTE_TABLE_ID_1", "Type": "PLAINTEXT", "Value": { "Ref": "VPCTGWRouteTable1" } }, { "Name": "VPC_TGW_ATTACHMENT_ROUTE_TABLE_ID_2", "Type": "PLAINTEXT", "Value": { "Ref": "VPCTGWRouteTable2" } }, { "Name": "CODE_BUILD_SOURCE_CODE_S3_KEY", "Type": "PLAINTEXT", "Value": "centralized-network-inspection-on-aws/v1.1.3" }, { "Name": "STACK_ID", "Type": "PLAINTEXT", "Value": { "Ref": "AWS::StackId" } }, { "Name": "SSM_PARAM_FOR_UUID", "Type": "PLAINTEXT", "Value": { "Fn::Join": [ "", [ "/", { "Fn::FindInMap": [ "SolutionMapping", "ParameterKey", "UniqueId" ] } ] ] } }, { "Name": "SEND_ANONYMIZED_METRICS", "Type": "PLAINTEXT", "Value": { "Fn::FindInMap": [ "AnonymizedData", "SendAnonymizedData", "Data" ] } }, { "Name": "SOLUTION_ID", "Type": "PLAINTEXT", "Value": { "Fn::FindInMap": [ "SolutionMapping", "Solution", "Identifier" ] } }, { "Name": "METRICS_URL", "Type": "PLAINTEXT", "Value": { "Fn::FindInMap": [ "SolutionMapping", "Metrics", "URL" ] } }, { "Name": "TRANSIT_GATEWAY_ATTACHMENT_ID", "Type": "PLAINTEXT", "Value": { "Fn::If": [ "CreateTransitGatewayAttachment", { "Ref": "VPCTGWATTACHMENT" }, "" ] } }, { "Name": "TRANSIT_GATEWAY_ATTACHMENT_APPLIANCE_MODE", "Type": "PLAINTEXT", "Value": { "Fn::FindInMap": [ "SolutionMapping", "TransitGatewayAttachment", "ApplianceMode" ] } }, { "Name": "CUSTOM_SDK_USER_AGENT", "Type": "PLAINTEXT", "Value": { "Fn::Join": [ "", [ "AwsSolution/", { "Fn::FindInMap": [ "SolutionMapping", "Solution", "Identifier" ] }, "/", { "Fn::FindInMap": [ "SolutionMapping", "Solution", "Version" ] } ] ] } } ], "Image": "aws/codebuild/standard:7.0", "ImagePullCredentialsType": "CODEBUILD", "PrivilegedMode": false, "Type": "LINUX_CONTAINER" }, "ServiceRole": { "Fn::GetAtt": [ "BuildProjectRoleAA92C755", "Arn" ] }, "Source": { "BuildSpec": { "Fn::Join": [ "", [ "{\n \"version\": \"0.2\",\n \"phases\": {\n \"install\": {\n \"runtime-versions\": {\n \"nodejs\": \"22\"\n },\n \"commands\": [\n \"export current=$(pwd)\",\n \"export sourceCodeKey=$CODE_BUILD_SOURCE_CODE_S3_KEY\"\n ]\n },\n \"pre_build\": {\n \"commands\": [\n \"cd $current\",\n \"pwd; ls -ltr\",\n \"echo 'Download Centralized Network Inspection Solution Package'\",\n \"aws s3 cp s3://", { "Ref": "CodeBuildStagesSourceCodeBucketFA98E7C7" }, "/$sourceCodeKey/centralized-network-inspection.zip $current || true\",\n \"if [ -f $current/centralized-network-inspection.zip ];then exit 0;else echo \\\"Copy file to s3 bucket\\\"; aws s3 cp s3://solutions-", { "Ref": "AWS::Region" }, "/$sourceCodeKey/centralized-network-inspection.zip s3://", { "Ref": "CodeBuildStagesSourceCodeBucketFA98E7C7" }, "/$sourceCodeKey/centralized-network-inspection.zip --copy-props none; aws s3 cp s3://", { "Ref": "CodeBuildStagesSourceCodeBucketFA98E7C7" }, "/$sourceCodeKey/centralized-network-inspection.zip $current; fi;\",\n \"unzip -o $current/centralized-network-inspection.zip -d $current\",\n \"pwd; ls -ltr\"\n ]\n },\n \"build\": {\n \"commands\": [\n \"echo \\\"Validating the firewall config\\\"\",\n \"node build.js\"\n ]\n }\n },\n \"artifacts\": {\n \"files\": \"**/*\"\n }\n}" ] ] }, "Type": "CODEPIPELINE" } }, "Metadata": { "aws:cdk:path": "centralized-network-inspection-on-aws/BuildProject/Resource" } }, "buildStageIAMPolicyB31D4B98": { "Type": "AWS::IAM::Policy", "Properties": { "PolicyDocument": { "Statement": [ { "Action": [ "network-firewall:CreateFirewallPolicy", "network-firewall:CreateRuleGroup" ], "Effect": "Allow", "Resource": [ { "Fn::Sub": "arn:${AWS::Partition}:network-firewall:${AWS::Region}:${AWS::AccountId}:stateful-rulegroup/*" }, { "Fn::Sub": "arn:${AWS::Partition}:network-firewall:${AWS::Region}:${AWS::AccountId}:firewall-policy/*" }, { "Fn::Sub": "arn:${AWS::Partition}:network-firewall:${AWS::Region}:${AWS::AccountId}:stateless-rulegroup/*" } ] }, { "Action": "s3:GetObject", "Effect": "Allow", "Resource": [ { "Fn::Sub": [ "arn:${AWS::Partition}:s3:::${CodeBucketName}/${KeyName}/*", { "CodeBucketName": { "Fn::Join": [ "", [ "solutions-", { "Ref": "AWS::Region" } ] ] }, "KeyName": "centralized-network-inspection-on-aws" } ] }, { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":s3:::", { "Ref": "CodeBuildStagesSourceCodeBucketFA98E7C7" }, "/*" ] ] } ] }, { "Action": "s3:PutObject", "Effect": "Allow", "Resource": { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":s3:::", { "Ref": "CodeBuildStagesSourceCodeBucketFA98E7C7" }, "/*" ] ] } }, { "Action": [ "ssm:PutParameter", "ssm:GetParameter" ], "Effect": "Allow", "Resource": { "Fn::Sub": [ "arn:${AWS::Partition}:ssm:${AWS::Region}:${AWS::AccountId}:parameter/${ParameterKey}-*", { "ParameterKey": { "Fn::FindInMap": [ "SolutionMapping", "ParameterKey", "UniqueId" ] } } ] } } ], "Version": "2012-10-17" }, "PolicyName": "buildStageIAMPolicyB31D4B98", "Roles": [ { "Ref": "BuildProjectRoleAA92C755" } ] }, "Metadata": { "aws:cdk:path": "centralized-network-inspection-on-aws/buildStageIAMPolicy/Resource" } }, "deployStageFirewallPolicy72BE60BE": { "Type": "AWS::IAM::Policy", "Properties": { "PolicyDocument": { "Statement": [ { "Action": [ "network-firewall:CreateFirewall", "network-firewall:UpdateFirewallDeleteProtection", "network-firewall:DeleteRuleGroup", "network-firewall:DescribeLoggingConfiguration", "network-firewall:UpdateFirewallDescription", "network-firewall:CreateRuleGroup", "network-firewall:DescribeFirewall", "network-firewall:DeleteFirewallPolicy", "network-firewall:UpdateRuleGroup", "network-firewall:DescribeRuleGroup", "network-firewall:ListRuleGroups", "network-firewall:UpdateSubnetChangeProtection", "network-firewall:UpdateFirewallPolicyChangeProtection", "network-firewall:AssociateFirewallPolicy", "network-firewall:DescribeFirewallPolicy", "network-firewall:UpdateFirewallPolicy", "network-firewall:DescribeResourcePolicy", "network-firewall:CreateFirewallPolicy", "network-firewall:UpdateLoggingConfiguration", "network-firewall:TagResource" ], "Effect": "Allow", "Resource": [ { "Fn::Sub": "arn:${AWS::Partition}:network-firewall:${AWS::Region}:${AWS::AccountId}:stateful-rulegroup/*" }, { "Fn::Sub": "arn:${AWS::Partition}:network-firewall:${AWS::Region}:${AWS::AccountId}:firewall-policy/*" }, { "Fn::Sub": "arn:${AWS::Partition}:network-firewall:${AWS::Region}:${AWS::AccountId}:firewall/*" }, { "Fn::Sub": "arn:${AWS::Partition}:network-firewall:${AWS::Region}:${AWS::AccountId}:stateless-rulegroup/*" } ] }, { "Action": "s3:GetObject", "Effect": "Allow", "Resource": [ { "Fn::Sub": [ "arn:${AWS::Partition}:s3:::${CodeBucketName}/${KeyName}/*", { "CodeBucketName": { "Fn::Join": [ "", [ "solutions-", { "Ref": "AWS::Region" } ] ] }, "KeyName": "centralized-network-inspection-on-aws" } ] }, { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":s3:::", { "Ref": "CodeBuildStagesSourceCodeBucketFA98E7C7" }, "/*" ] ] } ] }, { "Action": [ "ec2:DescribeVpcs", "ec2:DescribeSubnets", "ec2:DescribeRouteTables" ], "Effect": "Allow", "Resource": "*" }, { "Action": [ "ec2:CreateRoute", "ec2:DeleteRoute" ], "Effect": "Allow", "Resource": [ { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":ec2:", { "Ref": "AWS::Region" }, ":", { "Ref": "AWS::AccountId" }, ":route-table/", { "Ref": "VPCTGWRouteTable1" } ] ] }, { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":ec2:", { "Ref": "AWS::Region" }, ":", { "Ref": "AWS::AccountId" }, ":route-table/", { "Ref": "VPCTGWRouteTable2" } ] ] } ] }, { "Action": "iam:CreateServiceLinkedRole", "Effect": "Allow", "Resource": { "Fn::Sub": "arn:aws:iam::${AWS::AccountId}:role/aws-service-role/network-firewall.amazonaws.com/AWSServiceRoleForNetworkFirewall" } } ], "Version": "2012-10-17" }, "PolicyName": "deployStageFirewallPolicy72BE60BE", "Roles": [ { "Ref": "DeployProjectRole588C8C1D" } ] }, "Metadata": { "cfn_nag": { "rules_to_suppress": [ { "id": "W12", "reason": "Resource * is required for describe APIs" } ] } } }, "deployStageModifyTransitGatewayAttachmentPolicy993566C2": { "Type": "AWS::IAM::Policy", "Properties": { "PolicyDocument": { "Statement": [ { "Action": "ec2:ModifyTransitGatewayVpcAttachment", "Effect": "Allow", "Resource": { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":ec2:", { "Ref": "AWS::Region" }, ":", { "Ref": "AWS::AccountId" }, ":transit-gateway-attachment/", { "Ref": "VPCTGWATTACHMENT" } ] ] } } ], "Version": "2012-10-17" }, "PolicyName": "deployStageModifyTransitGatewayAttachmentPolicy993566C2", "Roles": [ { "Ref": "DeployProjectRole588C8C1D" } ] }, "Metadata": { "aws:cdk:path": "centralized-network-inspection-on-aws/deployStageModifyTransitGatewayAttachmentPolicy/Resource" }, "Condition": "CreateTransitGatewayAttachment" }, "deployStageFirewallLoggingPolicy15AD5CD5": { "Type": "AWS::IAM::Policy", "Properties": { "PolicyDocument": { "Statement": [ { "Action": [ "logs:CreateLogDelivery", "logs:GetLogDelivery", "logs:UpdateLogDelivery", "logs:DeleteLogDelivery", "logs:ListLogDeliveries" ], "Effect": "Allow", "Resource": "*" } ], "Version": "2012-10-17" }, "PolicyName": "deployStageFirewallLoggingPolicy15AD5CD5", "Roles": [ { "Ref": "DeployProjectRole588C8C1D" } ] }, "Metadata": { "cfn_nag": { "rules_to_suppress": [ { "id": "W12", "reason": "Resource * is required for these actions." } ] } }, "Condition": "NotLoggingConfigureManually" }, "deployStageFirewallLoggingS3Policy8F79BDD2": { "Type": "AWS::IAM::Policy", "Properties": { "PolicyDocument": { "Statement": [ { "Action": [ "s3:PutBucketPolicy", "s3:GetBucketPolicy" ], "Effect": "Allow", "Resource": { "Fn::GetAtt": [ "Logs6819BB44", "Arn" ] } } ], "Version": "2012-10-17" }, "PolicyName": "deployStageFirewallLoggingS3Policy8F79BDD2", "Roles": [ { "Ref": "DeployProjectRole588C8C1D" } ] }, "Metadata": { "aws:cdk:path": "centralized-network-inspection-on-aws/deployStageFirewallLoggingS3Policy/Resource" }, "Condition": "LoggingInS3" }, "deployStageFirewallLoggingCWPolicyD4098456": { "Type": "AWS::IAM::Policy", "Properties": { "PolicyDocument": { "Statement": [ { "Action": [ "logs:PutResourcePolicy", "logs:DescribeResourcePolicies" ], "Effect": "Allow", "Resource": "*" }, { "Action": "logs:DescribeLogGroups", "Effect": "Allow", "Resource": { "Fn::Sub": "arn:${AWS::Partition}:logs:*:${AWS::AccountId}:log-group:*" } } ], "Version": "2012-10-17" }, "PolicyName": "deployStageFirewallLoggingCWPolicyD4098456", "Roles": [ { "Ref": "DeployProjectRole588C8C1D" } ] }, "Metadata": { "cfn_nag": { "rules_to_suppress": [ { "id": "W12", "reason": "Resource * is required for describe APIs" } ] } }, "Condition": "LoggingInCloudWatch" }, "DeployProjectRole588C8C1D": { "Type": "AWS::IAM::Role", "Properties": { "AssumeRolePolicyDocument": { "Statement": [ { "Action": "sts:AssumeRole", "Effect": "Allow", "Principal": { "Service": "codebuild.amazonaws.com" } } ], "Version": "2012-10-17" } }, "Metadata": { "aws:cdk:path": "centralized-network-inspection-on-aws/DeployProject/Role/Resource" } }, "DeployProjectRoleDefaultPolicy52AEA98B": { "Type": "AWS::IAM::Policy", "Properties": { "PolicyDocument": { "Statement": [ { "Action": [ "logs:CreateLogGroup", "logs:CreateLogStream", "logs:PutLogEvents" ], "Effect": "Allow", "Resource": [ { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":logs:", { "Ref": "AWS::Region" }, ":", { "Ref": "AWS::AccountId" }, ":log-group:/aws/codebuild/", { "Ref": "DeployProject1CF7CB79" } ] ] }, { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":logs:", { "Ref": "AWS::Region" }, ":", { "Ref": "AWS::AccountId" }, ":log-group:/aws/codebuild/", { "Ref": "DeployProject1CF7CB79" }, ":*" ] ] } ] }, { "Action": [ "codebuild:CreateReportGroup", "codebuild:CreateReport", "codebuild:UpdateReport", "codebuild:BatchPutTestCases", "codebuild:BatchPutCodeCoverages" ], "Effect": "Allow", "Resource": { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":codebuild:", { "Ref": "AWS::Region" }, ":", { "Ref": "AWS::AccountId" }, ":report-group/", { "Ref": "DeployProject1CF7CB79" }, "-*" ] ] } }, { "Action": [ "s3:GetObject*", "s3:GetBucket*", "s3:List*" ], "Effect": "Allow", "Resource": [ { "Fn::GetAtt": [ "CentralizedNetworkInspectionCodePipelineArtifactsBucket20C04501", "Arn" ] }, { "Fn::Join": [ "", [ { "Fn::GetAtt": [ "CentralizedNetworkInspectionCodePipelineArtifactsBucket20C04501", "Arn" ] }, "/*" ] ] } ] }, { "Action": [ "kms:Decrypt", "kms:DescribeKey" ], "Effect": "Allow", "Resource": { "Fn::GetAtt": [ "CentralizedNetworkInspectionCodePipelineArtifactsBucketEncryptionKey03CCD69F", "Arn" ] } }, { "Action": [ "kms:Decrypt", "kms:Encrypt", "kms:ReEncrypt*", "kms:GenerateDataKey*" ], "Effect": "Allow", "Resource": { "Fn::GetAtt": [ "CentralizedNetworkInspectionCodePipelineArtifactsBucketEncryptionKey03CCD69F", "Arn" ] } } ], "Version": "2012-10-17" }, "PolicyName": "DeployProjectRoleDefaultPolicy52AEA98B", "Roles": [ { "Ref": "DeployProjectRole588C8C1D" } ] }, "Metadata": { "aws:cdk:path": "centralized-network-inspection-on-aws/DeployProject/Role/DefaultPolicy/Resource" } }, "DeployProject1CF7CB79": { "Type": "AWS::CodeBuild::Project", "Properties": { "Artifacts": { "Type": "CODEPIPELINE" }, "Cache": { "Type": "NO_CACHE" }, "EncryptionKey": { "Fn::GetAtt": [ "CentralizedNetworkInspectionCodePipelineArtifactsBucketEncryptionKey03CCD69F", "Arn" ] }, "Environment": { "ComputeType": "BUILD_GENERAL1_SMALL", "EnvironmentVariables": [ { "Name": "LOG_LEVEL", "Type": "PLAINTEXT", "Value": { "Fn::FindInMap": [ "SolutionMapping", "Log", "Level" ] } }, { "Name": "VPC_ID", "Type": "PLAINTEXT", "Value": { "Ref": "VPC" } }, { "Name": "SUBNET_IDS", "Type": "PLAINTEXT", "Value": { "Fn::Join": [ "", [ { "Ref": "NetworkFirewallSubnet1" }, ",", { "Ref": "NetworkFirewallSubnet2" } ] ] } }, { "Name": "LOG_TYPE", "Type": "PLAINTEXT", "Value": { "Ref": "logType" } }, { "Name": "LOG_DESTINATION_TYPE", "Type": "PLAINTEXT", "Value": { "Ref": "logDestinationType" } }, { "Name": "S3_LOG_BUCKET_NAME", "Type": "PLAINTEXT", "Value": { "Fn::If": [ "LoggingInS3", { "Ref": "Logs6819BB44" }, "NotConfigured" ] } }, { "Name": "CLOUDWATCH_LOG_GROUP_NAME", "Type": "PLAINTEXT", "Value": { "Fn::If": [ "LoggingInCloudWatch", { "Ref": "CloudWatchLogGroup" }, "NotConfigured" ] } }, { "Name": "VPC_TGW_ATTACHMENT_AZ_1", "Type": "PLAINTEXT", "Value": { "Fn::GetAtt": [ "NetworkFirewallSubnet1", "AvailabilityZone" ] } }, { "Name": "VPC_TGW_ATTACHMENT_AZ_2", "Type": "PLAINTEXT", "Value": { "Fn::GetAtt": [ "NetworkFirewallSubnet2", "AvailabilityZone" ] } }, { "Name": "VPC_TGW_ATTACHMENT_ROUTE_TABLE_ID_1", "Type": "PLAINTEXT", "Value": { "Ref": "VPCTGWRouteTable1" } }, { "Name": "VPC_TGW_ATTACHMENT_ROUTE_TABLE_ID_2", "Type": "PLAINTEXT", "Value": { "Ref": "VPCTGWRouteTable2" } }, { "Name": "CODE_BUILD_SOURCE_CODE_S3_KEY", "Type": "PLAINTEXT", "Value": "centralized-network-inspection-on-aws/v1.1.3" }, { "Name": "STACK_ID", "Type": "PLAINTEXT", "Value": { "Ref": "AWS::StackId" } }, { "Name": "SSM_PARAM_FOR_UUID", "Type": "PLAINTEXT", "Value": { "Fn::Join": [ "", [ "/", { "Fn::FindInMap": [ "SolutionMapping", "ParameterKey", "UniqueId" ] } ] ] } }, { "Name": "SEND_ANONYMIZED_METRICS", "Type": "PLAINTEXT", "Value": { "Fn::FindInMap": [ "AnonymizedData", "SendAnonymizedData", "Data" ] } }, { "Name": "SOLUTION_ID", "Type": "PLAINTEXT", "Value": { "Fn::FindInMap": [ "SolutionMapping", "Solution", "Identifier" ] } }, { "Name": "METRICS_URL", "Type": "PLAINTEXT", "Value": { "Fn::FindInMap": [ "SolutionMapping", "Metrics", "URL" ] } }, { "Name": "TRANSIT_GATEWAY_ATTACHMENT_ID", "Type": "PLAINTEXT", "Value": { "Fn::If": [ "CreateTransitGatewayAttachment", { "Ref": "VPCTGWATTACHMENT" }, "" ] } }, { "Name": "TRANSIT_GATEWAY_ATTACHMENT_APPLIANCE_MODE", "Type": "PLAINTEXT", "Value": { "Fn::FindInMap": [ "SolutionMapping", "TransitGatewayAttachment", "ApplianceMode" ] } }, { "Name": "CUSTOM_SDK_USER_AGENT", "Type": "PLAINTEXT", "Value": { "Fn::Join": [ "", [ "AwsSolution/", { "Fn::FindInMap": [ "SolutionMapping", "Solution", "Identifier" ] }, "/", { "Fn::FindInMap": [ "SolutionMapping", "Solution", "Version" ] } ] ] } } ], "Image": "aws/codebuild/standard:7.0", "ImagePullCredentialsType": "CODEBUILD", "PrivilegedMode": false, "Type": "LINUX_CONTAINER" }, "ServiceRole": { "Fn::GetAtt": [ "DeployProjectRole588C8C1D", "Arn" ] }, "Source": { "BuildSpec": { "Fn::Join": [ "", [ "{\n \"version\": \"0.2\",\n \"phases\": {\n \"install\": {\n \"runtime-versions\": {\n \"nodejs\": \"22\"\n },\n \"commands\": [\n \"export current=$(pwd)\",\n \"export sourceCodeKey=$CODE_BUILD_SOURCE_CODE_S3_KEY\"\n ]\n },\n \"pre_build\": {\n \"commands\": [\n \"cd $current\",\n \"pwd; ls -ltr\",\n \"echo 'Download Centralized Network Inspection Solution Package'\",\n \"aws s3 cp s3://", { "Ref": "CodeBuildStagesSourceCodeBucketFA98E7C7" }, "/$sourceCodeKey/centralized-network-inspection.zip $current\",\n \"unzip -o $current/centralized-network-inspection.zip -d $current\",\n \"pwd; ls -ltr\"\n ]\n },\n \"build\": {\n \"commands\": [\n \"echo \\\"Initiating Network Firewall Automation\\\"\",\n \"node index.js\"\n ]\n },\n \"post_build\": {\n \"commands\": []\n }\n },\n \"artifacts\": {\n \"files\": \"**/*\"\n }\n}" ] ] }, "Type": "CODEPIPELINE" } }, "Metadata": { "aws:cdk:path": "centralized-network-inspection-on-aws/DeployProject/Resource" } }, "CentralizedNetworkInspectionCodePipelineArtifactsBucketEncryptionKey03CCD69F": { "Type": "AWS::KMS::Key", "Properties": { "EnableKeyRotation": true, "KeyPolicy": { "Statement": [ { "Action": "kms:*", "Effect": "Allow", "Principal": { "AWS": { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":iam::", { "Ref": "AWS::AccountId" }, ":root" ] ] } }, "Resource": "*" } ], "Version": "2012-10-17" } }, "UpdateReplacePolicy": "Delete", "DeletionPolicy": "Delete", "Metadata": { "aws:cdk:path": "centralized-network-inspection-on-aws/CentralizedNetworkInspectionCodePipeline/ArtifactsBucketEncryptionKey/Resource" } }, "CentralizedNetworkInspectionCodePipelineArtifactsBucketEncryptionKeyAlias9DFA06B4": { "Type": "AWS::KMS::Alias", "Properties": { "AliasName": { "Fn::Join": [ "", [ "alias/", { "Ref": "AWS::StackName" }, "-artifactBucket-EncryptionKeyAlias" ] ] }, "TargetKeyId": { "Fn::GetAtt": [ "CentralizedNetworkInspectionCodePipelineArtifactsBucketEncryptionKey03CCD69F", "Arn" ] } }, "UpdateReplacePolicy": "Delete", "DeletionPolicy": "Delete", "Metadata": { "aws:cdk:path": "centralized-network-inspection-on-aws/CentralizedNetworkInspectionCodePipeline/ArtifactsBucketEncryptionKeyAlias/Resource" } }, "CentralizedNetworkInspectionCodePipelineArtifactsBucket20C04501": { "Type": "AWS::S3::Bucket", "Properties": { "BucketEncryption": { "ServerSideEncryptionConfiguration": [ { "ServerSideEncryptionByDefault": { "KMSMasterKeyID": { "Fn::GetAtt": [ "CentralizedNetworkInspectionCodePipelineArtifactsBucketEncryptionKey03CCD69F", "Arn" ] }, "SSEAlgorithm": "aws:kms" } } ] }, "PublicAccessBlockConfiguration": { "BlockPublicAcls": true, "BlockPublicPolicy": true, "IgnorePublicAcls": true, "RestrictPublicBuckets": true } }, "UpdateReplacePolicy": "Retain", "DeletionPolicy": "Retain", "Metadata": { "cfn_nag": { "rules_to_suppress": [ { "id": "W35", "reason": "This S3 bucket is used as the destination for 'CentralizedNetworkInspectionCodePipelineArtifactsBucket'" } ] } } }, "CentralizedNetworkInspectionCodePipelineArtifactsBucketPolicy5F0F855C": { "Type": "AWS::S3::BucketPolicy", "Properties": { "Bucket": { "Ref": "CentralizedNetworkInspectionCodePipelineArtifactsBucket20C04501" }, "PolicyDocument": { "Statement": [ { "Action": "s3:*", "Condition": { "Bool": { "aws:SecureTransport": "false" } }, "Effect": "Deny", "Principal": { "AWS": "*" }, "Resource": [ { "Fn::GetAtt": [ "CentralizedNetworkInspectionCodePipelineArtifactsBucket20C04501", "Arn" ] }, { "Fn::Join": [ "", [ { "Fn::GetAtt": [ "CentralizedNetworkInspectionCodePipelineArtifactsBucket20C04501", "Arn" ] }, "/*" ] ] } ] } ], "Version": "2012-10-17" } }, "Metadata": { "aws:cdk:path": "centralized-network-inspection-on-aws/CentralizedNetworkInspectionCodePipeline/ArtifactsBucket/Policy/Resource" } }, "CentralizedNetworkInspectionCodePipelineRoleAB1E4DBC": { "Type": "AWS::IAM::Role", "Properties": { "AssumeRolePolicyDocument": { "Statement": [ { "Action": "sts:AssumeRole", "Effect": "Allow", "Principal": { "Service": "codepipeline.amazonaws.com" } } ], "Version": "2012-10-17" } }, "Metadata": { "aws:cdk:path": "centralized-network-inspection-on-aws/CentralizedNetworkInspectionCodePipeline/Role/Resource" } }, "CentralizedNetworkInspectionCodePipelineRoleDefaultPolicyBA0503B1": { "Type": "AWS::IAM::Policy", "Properties": { "PolicyDocument": { "Statement": [ { "Action": [ "s3:GetObject*", "s3:GetBucket*", "s3:List*", "s3:DeleteObject*", "s3:PutObject", "s3:PutObjectLegalHold", "s3:PutObjectRetention", "s3:PutObjectTagging", "s3:PutObjectVersionTagging", "s3:Abort*" ], "Effect": "Allow", "Resource": [ { "Fn::GetAtt": [ "CentralizedNetworkInspectionCodePipelineArtifactsBucket20C04501", "Arn" ] }, { "Fn::Join": [ "", [ { "Fn::GetAtt": [ "CentralizedNetworkInspectionCodePipelineArtifactsBucket20C04501", "Arn" ] }, "/*" ] ] } ] }, { "Action": [ "kms:Decrypt", "kms:DescribeKey", "kms:Encrypt", "kms:ReEncrypt*", "kms:GenerateDataKey*" ], "Effect": "Allow", "Resource": { "Fn::GetAtt": [ "CentralizedNetworkInspectionCodePipelineArtifactsBucketEncryptionKey03CCD69F", "Arn" ] } }, { "Action": "sts:AssumeRole", "Effect": "Allow", "Resource": { "Fn::GetAtt": [ "CentralizedNetworkInspectionCodePipelineSourceCodePipelineActionRole3D6B4FEA", "Arn" ] } }, { "Action": "sts:AssumeRole", "Effect": "Allow", "Resource": { "Fn::GetAtt": [ "CentralizedNetworkInspectionCodePipelineValidationCodeBuildCodePipelineActionRole9701BECD", "Arn" ] } }, { "Action": "sts:AssumeRole", "Effect": "Allow", "Resource": { "Fn::GetAtt": [ "CentralizedNetworkInspectionCodePipelineDeploymentCodeDeployCodePipelineActionRoleD0D66949", "Arn" ] } } ], "Version": "2012-10-17" }, "PolicyName": "CentralizedNetworkInspectionCodePipelineRoleDefaultPolicyBA0503B1", "Roles": [ { "Ref": "CentralizedNetworkInspectionCodePipelineRoleAB1E4DBC" } ] }, "Metadata": { "aws:cdk:path": "centralized-network-inspection-on-aws/CentralizedNetworkInspectionCodePipeline/Role/DefaultPolicy/Resource" } }, "CentralizedNetworkInspectionCodePipeline757F698C": { "Type": "AWS::CodePipeline::Pipeline", "Properties": { "ArtifactStore": { "EncryptionKey": { "Id": { "Fn::GetAtt": [ "CentralizedNetworkInspectionCodePipelineArtifactsBucketEncryptionKey03CCD69F", "Arn" ] }, "Type": "KMS" }, "Location": { "Ref": "CentralizedNetworkInspectionCodePipelineArtifactsBucket20C04501" }, "Type": "S3" }, "RoleArn": { "Fn::GetAtt": [ "CentralizedNetworkInspectionCodePipelineRoleAB1E4DBC", "Arn" ] }, "Stages": [ { "Actions": [ { "ActionTypeId": { "Category": "Source", "Owner": "AWS", "Provider": "S3", "Version": "1" }, "Configuration": { "S3Bucket": { "Ref": "CodeBuildStagesSourceCodeBucketFA98E7C7" }, "S3ObjectKey": { "Fn::Join": [ "", [ "centralized-network-inspection-on-aws/", { "Fn::FindInMap": [ "SolutionMapping", "Solution", "ConfigurationS3KeyPrefix" ] }, "/", { "Fn::FindInMap": [ "SolutionMapping", "Solution", "ConfigurationFileName" ] } ] ] }, "PollForSourceChanges": false }, "Name": "Source", "OutputArtifacts": [ { "Name": "SourceArtifact" } ], "RoleArn": { "Fn::GetAtt": [ "CentralizedNetworkInspectionCodePipelineSourceCodePipelineActionRole3D6B4FEA", "Arn" ] }, "RunOrder": 1 } ], "Name": "Source" }, { "Actions": [ { "ActionTypeId": { "Category": "Build", "Owner": "AWS", "Provider": "CodeBuild", "Version": "1" }, "Configuration": { "ProjectName": { "Ref": "BuildProject097C5DB7" } }, "InputArtifacts": [ { "Name": "SourceArtifact" } ], "Name": "CodeBuild", "OutputArtifacts": [ { "Name": "BuildArtifact" } ], "RoleArn": { "Fn::GetAtt": [ "CentralizedNetworkInspectionCodePipelineValidationCodeBuildCodePipelineActionRole9701BECD", "Arn" ] }, "RunOrder": 1 } ], "Name": "Validation" }, { "Actions": [ { "ActionTypeId": { "Category": "Build", "Owner": "AWS", "Provider": "CodeBuild", "Version": "1" }, "Configuration": { "ProjectName": { "Ref": "DeployProject1CF7CB79" } }, "InputArtifacts": [ { "Name": "BuildArtifact" } ], "Name": "CodeDeploy", "RoleArn": { "Fn::GetAtt": [ "CentralizedNetworkInspectionCodePipelineDeploymentCodeDeployCodePipelineActionRoleD0D66949", "Arn" ] }, "RunOrder": 1 } ], "Name": "Deployment" } ] }, "DependsOn": [ "CentralizedNetworkInspectionCodePipelineRoleDefaultPolicyBA0503B1", "CentralizedNetworkInspectionCodePipelineRoleAB1E4DBC", "CopyCentralizedNetworkInspectionConfig1198A6D4" ], "Metadata": { "aws:cdk:path": "centralized-network-inspection-on-aws/CentralizedNetworkInspectionCodePipeline/Resource" } }, "CentralizedNetworkInspectionCodePipelineSourceCodePipelineActionRole3D6B4FEA": { "Type": "AWS::IAM::Role", "Properties": { "AssumeRolePolicyDocument": { "Statement": [ { "Action": "sts:AssumeRole", "Effect": "Allow", "Principal": { "AWS": { "Fn::GetAtt": [ "CentralizedNetworkInspectionCodePipelineRoleAB1E4DBC", "Arn" ] } } } ], "Version": "2012-10-17" } }, "Metadata": { "aws:cdk:path": "centralized-network-inspection-on-aws/CentralizedNetworkInspectionCodePipeline/Source/Source/CodePipelineActionRole/Resource" } }, "CentralizedNetworkInspectionCodePipelineSourceCodePipelineActionRoleDefaultPolicy57ADB0FA": { "Type": "AWS::IAM::Policy", "Properties": { "PolicyDocument": { "Statement": [ { "Action": [ "s3:GetObject*", "s3:GetBucket*", "s3:List*" ], "Effect": "Allow", "Resource": [ { "Fn::GetAtt": [ "CodeBuildStagesSourceCodeBucketFA98E7C7", "Arn" ] }, { "Fn::Join": [ "", [ { "Fn::GetAtt": [ "CodeBuildStagesSourceCodeBucketFA98E7C7", "Arn" ] }, "/centralized-network-inspection-on-aws/", { "Fn::FindInMap": [ "SolutionMapping", "Solution", "ConfigurationS3KeyPrefix" ] }, "/", { "Fn::FindInMap": [ "SolutionMapping", "Solution", "ConfigurationFileName" ] } ] ] } ] }, { "Action": [ "s3:DeleteObject*", "s3:PutObject", "s3:PutObjectLegalHold", "s3:PutObjectRetention", "s3:PutObjectTagging", "s3:PutObjectVersionTagging", "s3:Abort*" ], "Effect": "Allow", "Resource": [ { "Fn::GetAtt": [ "CentralizedNetworkInspectionCodePipelineArtifactsBucket20C04501", "Arn" ] }, { "Fn::Join": [ "", [ { "Fn::GetAtt": [ "CentralizedNetworkInspectionCodePipelineArtifactsBucket20C04501", "Arn" ] }, "/*" ] ] } ] }, { "Action": [ "kms:Encrypt", "kms:ReEncrypt*", "kms:GenerateDataKey*", "kms:Decrypt" ], "Effect": "Allow", "Resource": { "Fn::GetAtt": [ "CentralizedNetworkInspectionCodePipelineArtifactsBucketEncryptionKey03CCD69F", "Arn" ] } } ], "Version": "2012-10-17" }, "PolicyName": "CentralizedNetworkInspectionCodePipelineSourceCodePipelineActionRoleDefaultPolicy57ADB0FA", "Roles": [ { "Ref": "CentralizedNetworkInspectionCodePipelineSourceCodePipelineActionRole3D6B4FEA" } ] }, "Metadata": { "aws:cdk:path": "centralized-network-inspection-on-aws/CentralizedNetworkInspectionCodePipeline/Source/Source/CodePipelineActionRole/DefaultPolicy/Resource" } }, "CentralizedNetworkInspectionCodePipelineValidationCodeBuildCodePipelineActionRole9701BECD": { "Type": "AWS::IAM::Role", "Properties": { "AssumeRolePolicyDocument": { "Statement": [ { "Action": "sts:AssumeRole", "Effect": "Allow", "Principal": { "AWS": { "Fn::GetAtt": [ "CentralizedNetworkInspectionCodePipelineRoleAB1E4DBC", "Arn" ] } } } ], "Version": "2012-10-17" } }, "Metadata": { "aws:cdk:path": "centralized-network-inspection-on-aws/CentralizedNetworkInspectionCodePipeline/Validation/CodeBuild/CodePipelineActionRole/Resource" } }, "CentralizedNetworkInspectionCodePipelineValidationCodeBuildCodePipelineActionRoleDefaultPolicy24B30E4B": { "Type": "AWS::IAM::Policy", "Properties": { "PolicyDocument": { "Statement": [ { "Action": [ "codebuild:BatchGetBuilds", "codebuild:StartBuild", "codebuild:StopBuild" ], "Effect": "Allow", "Resource": { "Fn::GetAtt": [ "BuildProject097C5DB7", "Arn" ] } } ], "Version": "2012-10-17" }, "PolicyName": "CentralizedNetworkInspectionCodePipelineValidationCodeBuildCodePipelineActionRoleDefaultPolicy24B30E4B", "Roles": [ { "Ref": "CentralizedNetworkInspectionCodePipelineValidationCodeBuildCodePipelineActionRole9701BECD" } ] }, "Metadata": { "aws:cdk:path": "centralized-network-inspection-on-aws/CentralizedNetworkInspectionCodePipeline/Validation/CodeBuild/CodePipelineActionRole/DefaultPolicy/Resource" } }, "CentralizedNetworkInspectionCodePipelineDeploymentCodeDeployCodePipelineActionRoleD0D66949": { "Type": "AWS::IAM::Role", "Properties": { "AssumeRolePolicyDocument": { "Statement": [ { "Action": "sts:AssumeRole", "Effect": "Allow", "Principal": { "AWS": { "Fn::GetAtt": [ "CentralizedNetworkInspectionCodePipelineRoleAB1E4DBC", "Arn" ] } } } ], "Version": "2012-10-17" } }, "Metadata": { "aws:cdk:path": "centralized-network-inspection-on-aws/CentralizedNetworkInspectionCodePipeline/Deployment/CodeDeploy/CodePipelineActionRole/Resource" } }, "CentralizedNetworkInspectionCodePipelineDeploymentCodeDeployCodePipelineActionRoleDefaultPolicy4ADCBB84": { "Type": "AWS::IAM::Policy", "Properties": { "PolicyDocument": { "Statement": [ { "Action": [ "codebuild:BatchGetBuilds", "codebuild:StartBuild", "codebuild:StopBuild" ], "Effect": "Allow", "Resource": { "Fn::GetAtt": [ "DeployProject1CF7CB79", "Arn" ] } } ], "Version": "2012-10-17" }, "PolicyName": "CentralizedNetworkInspectionCodePipelineDeploymentCodeDeployCodePipelineActionRoleDefaultPolicy4ADCBB84", "Roles": [ { "Ref": "CentralizedNetworkInspectionCodePipelineDeploymentCodeDeployCodePipelineActionRoleD0D66949" } ] }, "Metadata": { "aws:cdk:path": "centralized-network-inspection-on-aws/CentralizedNetworkInspectionCodePipeline/Deployment/CodeDeploy/CodePipelineActionRole/DefaultPolicy/Resource" } }, "CloudWatchLogsForNetworkFirewallBucketPolicy611AC31C": { "Type": "AWS::S3::BucketPolicy", "Properties": { "Bucket": { "Ref": "Logs6819BB44" }, "PolicyDocument": { "Statement": [ { "Action": "s3:GetObject", "Condition": { "Bool": { "aws:SecureTransport": false } }, "Effect": "Deny", "Principal": { "AWS": "*" }, "Resource": [ { "Fn::Join": [ "", [ { "Fn::GetAtt": [ "Logs6819BB44", "Arn" ] }, "/*" ] ] }, { "Fn::GetAtt": [ "Logs6819BB44", "Arn" ] } ] } ], "Version": "2012-10-17" } }, "UpdateReplacePolicy": "Retain", "DeletionPolicy": "Retain", "Metadata": { "aws:cdk:path": "centralized-network-inspection-on-aws/CloudWatchLogsForNetworkFirewallBucketPolicy/Resource" }, "Condition": "LoggingInS3" }, "CodeBuildStageSourceCodeBucketPolicyF19BA2A0": { "Type": "AWS::S3::BucketPolicy", "Properties": { "Bucket": { "Ref": "CodeBuildStagesSourceCodeBucketFA98E7C7" }, "PolicyDocument": { "Statement": [ { "Action": "s3:GetObject", "Condition": { "Bool": { "aws:SecureTransport": false } }, "Effect": "Deny", "Principal": { "AWS": "*" }, "Resource": [ { "Fn::GetAtt": [ "CodeBuildStagesSourceCodeBucketFA98E7C7", "Arn" ] }, { "Fn::Join": [ "", [ { "Fn::GetAtt": [ "CodeBuildStagesSourceCodeBucketFA98E7C7", "Arn" ] }, "/*" ] ] } ] } ], "Version": "2012-10-17" } }, "UpdateReplacePolicy": "Retain", "DeletionPolicy": "Retain", "Metadata": { "aws:cdk:path": "centralized-network-inspection-on-aws/CodeBuildStageSourceCodeBucketPolicy/Resource" } }, "CopyCentralizedNetworkInspectionConfig1198A6D4": { "Type": "Custom::AWS", "Properties": { "ServiceToken": { "Fn::GetAtt": [ "AWS679f53fac002430cb0da5b7982bd22872D164C4C", "Arn" ] }, "Create": { "Fn::Join": [ "", [ "{\"service\":\"S3\",\"action\":\"copyObject\",\"parameters\":{\"Bucket\":\"", { "Ref": "CodeBuildStagesSourceCodeBucketFA98E7C7" }, "\",\"CopySource\":\"solutions-", { "Ref": "AWS::Region" }, "/centralized-network-inspection-on-aws/v1.1.3/", { "Fn::FindInMap": [ "SolutionMapping", "Solution", "ConfigurationFileName" ] }, "\",\"Key\":\"centralized-network-inspection-on-aws/", { "Fn::FindInMap": [ "SolutionMapping", "Solution", "ConfigurationS3KeyPrefix" ] }, "/", { "Fn::FindInMap": [ "SolutionMapping", "Solution", "ConfigurationFileName" ] }, "\"},\"physicalResourceId\":{\"id\":\"1749698875001\"}}" ] ] }, "InstallLatestAwsSdk": false }, "DependsOn": [ "CopyCentralizedNetworkInspectionConfigCustomResourcePolicy1AFB3C1C" ], "UpdateReplacePolicy": "Delete", "DeletionPolicy": "Delete", "Metadata": { "aws:cdk:path": "centralized-network-inspection-on-aws/CopyCentralizedNetworkInspectionConfig/Resource/Default" } }, "CopyCentralizedNetworkInspectionConfigCustomResourcePolicy1AFB3C1C": { "Type": "AWS::IAM::Policy", "Properties": { "PolicyDocument": { "Statement": [ { "Action": "s3:GetObject", "Effect": "Allow", "Resource": { "Fn::Join": [ "", [ "arn:aws:s3:::solutions-", { "Ref": "AWS::Region" }, "/*" ] ] }, "Sid": "S3Get" }, { "Action": "s3:PutObject", "Effect": "Allow", "Resource": { "Fn::Join": [ "", [ { "Fn::GetAtt": [ "CodeBuildStagesSourceCodeBucketFA98E7C7", "Arn" ] }, "/*" ] ] }, "Sid": "S3Put" } ], "Version": "2012-10-17" }, "PolicyName": "CopyCentralizedNetworkInspectionConfigCustomResourcePolicy1AFB3C1C", "Roles": [ { "Ref": "AWS679f53fac002430cb0da5b7982bd2287ServiceRoleC1EA0FF2" } ] }, "Metadata": { "aws:cdk:path": "centralized-network-inspection-on-aws/CopyCentralizedNetworkInspectionConfig/CustomResourcePolicy/Resource" } }, "AWS679f53fac002430cb0da5b7982bd2287ServiceRoleC1EA0FF2": { "Type": "AWS::IAM::Role", "Properties": { "AssumeRolePolicyDocument": { "Statement": [ { "Action": "sts:AssumeRole", "Effect": "Allow", "Principal": { "Service": "lambda.amazonaws.com" } } ], "Version": "2012-10-17" }, "ManagedPolicyArns": [ { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":iam::aws:policy/service-role/AWSLambdaBasicExecutionRole" ] ] } ] }, "Metadata": { "aws:cdk:path": "centralized-network-inspection-on-aws/AWS679f53fac002430cb0da5b7982bd2287/ServiceRole/Resource" } }, "AWS679f53fac002430cb0da5b7982bd22872D164C4C": { "Type": "AWS::Lambda::Function", "Properties": { "Code": { "S3Bucket": { "Fn::Sub": "solutions-${AWS::Region}" }, "S3Key": "centralized-network-inspection-on-aws/v1.1.3/9d043014be736e8162bcc7ec5590cc6d2ff24fd0d9c73a5c5d595151c5fdad00.zip" }, "Handler": "index.handler", "Role": { "Fn::GetAtt": [ "AWS679f53fac002430cb0da5b7982bd2287ServiceRoleC1EA0FF2", "Arn" ] }, "Runtime": { "Fn::FindInMap": [ "LatestNodeRuntimeMap", { "Ref": "AWS::Region" }, "value" ] }, "Timeout": 120 }, "DependsOn": [ "AWS679f53fac002430cb0da5b7982bd2287ServiceRoleC1EA0FF2" ], "Metadata": { "aws:cdk:path": "centralized-network-inspection-on-aws/AWS679f53fac002430cb0da5b7982bd2287/Resource", "guard": { "SuppressedRules": [ "LAMBDA_INSIDE_VPC", "LAMBDA_CONCURRENCY_CHECK" ] } } }, "CDKMetadata": { "Type": "AWS::CDK::Metadata", "Properties": { "Analytics": "v2:deflate64:H4sIAAAAAAAA/3WST2+jMBDFP0vvjrdJLt0jRWoObVWUVHuNBjNQJ2YGMfaiCPHdKxsUpP1zer83fn6IkXd6+/NJPz7AIBtTXTfOlno8eTBXlddUQA8teuyjeYeus9REzJkq6y2TgkHOI5qdHvOafhV5PD2FktBHOnLw+Amlw3W+zjIRNhZST17Ti+PhjVP/Zw8k1h/A4wC3zHswXy3S2vl36L+1/4hN6tqKHl/xFgNRMmdBokkwKceN6LymN24OPYdOyV6Pz8Fc5/9aaJaCnTW3dbz42TyD4KQstHo88ryGpOulmSZluMIyWFfpsbAdOktY9HxBk7644BzrlvM1mSILT8pBW1agx5OlxqFneglk0j7uEPe98KRkfwYR9KKzKJM6onDoDSoTxHN77hcvOhskT7N75E9b051T28lDszybj+C74CdFXKG+yI/fu53e7vX24SLWbvpA3raoj7N+AwNVIIWaAgAA" }, "Metadata": { "aws:cdk:path": "centralized-network-inspection-on-aws/CDKMetadata/Default" }, "Condition": "CDKMetadataAvailable" } }, "Outputs": { "InspectionVPCID": { "Description": "Inspection VPC ID to create Network Firewall.", "Value": { "Ref": "VPC" } }, "FirewallSubnet1ID": { "Description": "Subnet 1 associated with Network Firewall.", "Value": { "Ref": "NetworkFirewallSubnet1" } }, "FirewallSubnet2ID": { "Description": "Subnet 2 associated with Network Firewall.", "Value": { "Ref": "NetworkFirewallSubnet2" } }, "TransitGatewaySubnet1ID": { "Description": "Subnet 1 associated with Transit Gateway.", "Value": { "Ref": "VPCTGWSubnet1" } }, "TransitGatewaySubnet2ID": { "Description": "Subnet 1 associated with Transit Gateway.", "Value": { "Ref": "VPCTGWSubnet2" } }, "NetworkFirewallAvailabilityZone1": { "Description": "Availability Zone configured for Network Firewall subnet 1", "Value": { "Fn::GetAtt": [ "NetworkFirewallSubnet1", "AvailabilityZone" ] } }, "NetworkFirewallAvailabilityZone2": { "Description": "Availability Zone configured for Network Firewall subnet 2", "Value": { "Fn::GetAtt": [ "NetworkFirewallSubnet2", "AvailabilityZone" ] } }, "ArtifactBucketforCodePipeline": { "Description": "Artifact bucket name configured for the CodePipeline.", "Value": { "Ref": "CentralizedNetworkInspectionCodePipelineArtifactsBucket20C04501" } }, "CodeBuildsourcecodeandfirewallconfigurationbucket": { "Description": "Code Build source code and firewall configuration bucket", "Value": { "Ref": "CodeBuildStagesSourceCodeBucketFA98E7C7" } }, "S3BucketforFirewallLogs": { "Description": "S3 Bucket used as the log destination for Firewall Logs.", "Value": { "Fn::If": [ "LoggingInS3", { "Ref": "Logs6819BB44" }, "NotConfigured" ] } }, "CloudWatchLogGroupforFirewallLogs": { "Description": "CloudWatch Log Group used as the log destination for Firewall Logs.", "Value": { "Fn::If": [ "LoggingInCloudWatch", { "Ref": "CloudWatchLogGroup" }, "NotConfigured" ] } } } }