{ "Description": "(SO0241-CMS.6) connected-mobility-solution-on-aws - acdp. Version v2.1.5", "Mappings": { "Solution": { "AssetsConfig": { "S3AssetBucketBaseName": "solutions", "S3AssetKeyPrefix": "connected-mobility-solution-on-aws/v2.1.5/acdp" }, "Config": { "SendAnonymousUsage": "Yes" } }, "LatestNodeRuntimeMap": { "af-south-1": { "value": "nodejs22.x" }, "ap-east-1": { "value": "nodejs22.x" }, "ap-east-2": { "value": "nodejs22.x" }, "ap-northeast-1": { "value": "nodejs22.x" }, "ap-northeast-2": { "value": "nodejs22.x" }, "ap-northeast-3": { "value": "nodejs22.x" }, "ap-south-1": { "value": "nodejs22.x" }, "ap-south-2": { "value": "nodejs22.x" }, "ap-southeast-1": { "value": "nodejs22.x" }, "ap-southeast-2": { "value": "nodejs22.x" }, "ap-southeast-3": { "value": "nodejs22.x" }, "ap-southeast-4": { "value": "nodejs22.x" }, "ap-southeast-5": { "value": "nodejs22.x" }, "ap-southeast-7": { "value": "nodejs22.x" }, "ca-central-1": { "value": "nodejs22.x" }, "ca-west-1": { "value": "nodejs22.x" }, "cn-north-1": { "value": "nodejs22.x" }, "cn-northwest-1": { "value": "nodejs22.x" }, "eu-central-1": { "value": "nodejs22.x" }, "eu-central-2": { "value": "nodejs22.x" }, "eu-isoe-west-1": { "value": "nodejs18.x" }, "eu-north-1": { "value": "nodejs22.x" }, "eu-south-1": { "value": "nodejs22.x" }, "eu-south-2": { "value": "nodejs22.x" }, "eu-west-1": { "value": "nodejs22.x" }, "eu-west-2": { "value": "nodejs22.x" }, "eu-west-3": { "value": "nodejs22.x" }, "il-central-1": { "value": "nodejs22.x" }, "me-central-1": { "value": "nodejs22.x" }, "me-south-1": { "value": "nodejs22.x" }, "mx-central-1": { "value": "nodejs22.x" }, "sa-east-1": { "value": "nodejs22.x" }, "us-east-1": { "value": "nodejs22.x" }, "us-east-2": { "value": "nodejs22.x" }, "us-gov-east-1": { "value": "nodejs22.x" }, "us-gov-west-1": { "value": "nodejs22.x" }, "us-iso-east-1": { "value": "nodejs18.x" }, "us-iso-west-1": { "value": "nodejs18.x" }, "us-isob-east-1": { "value": "nodejs18.x" }, "us-isob-west-1": { "value": "nodejs18.x" }, "us-west-1": { "value": "nodejs22.x" }, "us-west-2": { "value": "nodejs22.x" } } }, "Resources": { "acdpappregistryappregistryapplication0BC5FAC5": { "Type": "AWS::ServiceCatalogAppRegistry::Application", "Properties": { "Name": { "Fn::Join": [ "", [ { "Ref": "AWS::StackName" }, "-", { "Ref": "AWS::Region" }, "-", { "Ref": "AWS::AccountId" } ] ] }, "Tags": { "Solutions:ApplicationType": "AWS-Solutions", "Solutions:ModuleName": "acdp", "Solutions:SolutionID": "SO0241", "Solutions:SolutionName": "connected-mobility-solution-on-aws", "Solutions:SolutionVersion": "v2.1.5" } }, "Metadata": { "aws:cdk:path": "acdp/acdp-app-registry/app-registry-application" } }, "acdpappregistrydefaultapplicationattributes4DDA2479": { "Type": "AWS::ServiceCatalogAppRegistry::AttributeGroup", "Properties": { "Attributes": { "ApplicationType": "AWS-Solutions", "Version": "v2.1.5", "SolutionID": "SO0241", "SolutionName": "connected-mobility-solution-on-aws" }, "Description": "Attribute group for solution information", "Name": { "Fn::Join": [ "", [ { "Ref": "AWS::StackName" }, "-", { "Ref": "AWS::Region" }, "-", { "Ref": "AWS::AccountId" } ] ] }, "Tags": { "awsApplication": { "Fn::GetAtt": [ "acdpappregistryappregistryapplication0BC5FAC5", "ApplicationTagValue" ] }, "Solutions:ApplicationType": "AWS-Solutions", "Solutions:ModuleName": "acdp", "Solutions:SolutionID": "SO0241", "Solutions:SolutionName": "connected-mobility-solution-on-aws", "Solutions:SolutionVersion": "v2.1.5" } }, "Metadata": { "aws:cdk:path": "acdp/acdp-app-registry/default-application-attributes" } }, "acdpappregistryappregistryapplicationattributeassociation3418E518": { "Type": "AWS::ServiceCatalogAppRegistry::AttributeGroupAssociation", "Properties": { "Application": { "Fn::GetAtt": [ "acdpappregistryappregistryapplication0BC5FAC5", "Id" ] }, "AttributeGroup": { "Fn::GetAtt": [ "acdpappregistrydefaultapplicationattributes4DDA2479", "Id" ] } }, "Metadata": { "aws:cdk:path": "acdp/acdp-app-registry/app-registry-application-attribute-association" } }, "backstageassetbucketconstructlogbucketC5C46452": { "Type": "AWS::S3::Bucket", "Properties": { "AccessControl": "LogDeliveryWrite", "BucketEncryption": { "ServerSideEncryptionConfiguration": [ { "ServerSideEncryptionByDefault": { "SSEAlgorithm": "AES256" } } ] }, "LifecycleConfiguration": { "Rules": [ { "Id": "expire-current-version-and-delete-old-objects", "Status": "Enabled", "ExpirationInDays": { "Ref": "S3LogExpirationDays" }, "NoncurrentVersionExpirationInDays": { "Ref": "S3LogNoncurrentVersionExpirationDays" }, "AbortIncompleteMultipartUpload": { "DaysAfterInitiation": 1 } } ] }, "OwnershipControls": { "Rules": [ { "ObjectOwnership": "ObjectWriter" } ] }, "PublicAccessBlockConfiguration": { "BlockPublicAcls": true, "BlockPublicPolicy": true, "IgnorePublicAcls": true, "RestrictPublicBuckets": true }, "Tags": [ { "Key": "awsApplication", "Value": { "Fn::GetAtt": [ "acdpappregistryappregistryapplication0BC5FAC5", "ApplicationTagValue" ] } }, { "Key": "Solutions:ApplicationType", "Value": "AWS-Solutions" }, { "Key": "Solutions:ModuleName", "Value": "acdp" }, { "Key": "Solutions:SolutionID", "Value": "SO0241" }, { "Key": "Solutions:SolutionName", "Value": "connected-mobility-solution-on-aws" }, { "Key": "Solutions:SolutionVersion", "Value": "v2.1.5" } ], "VersioningConfiguration": { "Status": "Enabled" } }, "UpdateReplacePolicy": "Retain", "DeletionPolicy": "Retain", "Metadata": { "aws:cdk:path": "acdp/backstage-asset-bucket-construct/log-bucket/Resource" } }, "backstageassetbucketconstructlogbucketPolicyAAD7C2A4": { "Type": "AWS::S3::BucketPolicy", "Properties": { "Bucket": { "Ref": "backstageassetbucketconstructlogbucketC5C46452" }, "PolicyDocument": { "Statement": [ { "Action": "s3:*", "Condition": { "Bool": { "aws:SecureTransport": "false" } }, "Effect": "Deny", "Principal": { "AWS": "*" }, "Resource": [ { "Fn::GetAtt": [ "backstageassetbucketconstructlogbucketC5C46452", "Arn" ] }, { "Fn::Join": [ "", [ { "Fn::GetAtt": [ "backstageassetbucketconstructlogbucketC5C46452", "Arn" ] }, "/*" ] ] } ] } ], "Version": "2012-10-17" } }, "Metadata": { "aws:cdk:path": "acdp/backstage-asset-bucket-construct/log-bucket/Policy/Resource" } }, "backstageassetbucketconstructencryptedbucket8BE77EF0": { "Type": "AWS::S3::Bucket", "Properties": { "BucketEncryption": { "ServerSideEncryptionConfiguration": [ { "ServerSideEncryptionByDefault": { "SSEAlgorithm": "AES256" } } ] }, "LoggingConfiguration": { "DestinationBucketName": { "Ref": "backstageassetbucketconstructlogbucketC5C46452" } }, "PublicAccessBlockConfiguration": { "BlockPublicAcls": true, "BlockPublicPolicy": true, "IgnorePublicAcls": true, "RestrictPublicBuckets": true }, "Tags": [ { "Key": "awsApplication", "Value": { "Fn::GetAtt": [ "acdpappregistryappregistryapplication0BC5FAC5", "ApplicationTagValue" ] } }, { "Key": "Solutions:ApplicationType", "Value": "AWS-Solutions" }, { "Key": "Solutions:ModuleName", "Value": "acdp" }, { "Key": "Solutions:SolutionID", "Value": "SO0241" }, { "Key": "Solutions:SolutionName", "Value": "connected-mobility-solution-on-aws" }, { "Key": "Solutions:SolutionVersion", "Value": "v2.1.5" } ], "VersioningConfiguration": { "Status": "Enabled" } }, "UpdateReplacePolicy": "Retain", "DeletionPolicy": "Retain", "Metadata": { "aws:cdk:path": "acdp/backstage-asset-bucket-construct/encrypted-bucket/Resource" } }, "backstageassetbucketconstructencryptedbucketPolicyE07DA0EB": { "Type": "AWS::S3::BucketPolicy", "Properties": { "Bucket": { "Ref": "backstageassetbucketconstructencryptedbucket8BE77EF0" }, "PolicyDocument": { "Statement": [ { "Action": "s3:*", "Condition": { "Bool": { "aws:SecureTransport": "false" } }, "Effect": "Deny", "Principal": { "AWS": "*" }, "Resource": [ { "Fn::GetAtt": [ "backstageassetbucketconstructencryptedbucket8BE77EF0", "Arn" ] }, { "Fn::Join": [ "", [ { "Fn::GetAtt": [ "backstageassetbucketconstructencryptedbucket8BE77EF0", "Arn" ] }, "/*" ] ] } ] } ], "Version": "2012-10-17" } }, "Metadata": { "aws:cdk:path": "acdp/backstage-asset-bucket-construct/encrypted-bucket/Policy/Resource" } }, "moduleinputsconstructssmroute53hostedzonename917E8884": { "Type": "AWS::SSM::Parameter", "Properties": { "Description": "The id of the Route53 hosted zone to deploy in if Route53 is used", "Name": { "Fn::Join": [ "", [ "/solution/", { "Ref": "AcdpUniqueId" }, "/config/dns/route53-hosted-zone-id" ] ] }, "Tags": { "awsApplication": { "Fn::GetAtt": [ "acdpappregistryappregistryapplication0BC5FAC5", "ApplicationTagValue" ] }, "Solutions:ApplicationType": "AWS-Solutions", "Solutions:ModuleName": "acdp", "Solutions:SolutionID": "SO0241", "Solutions:SolutionName": "connected-mobility-solution-on-aws", "Solutions:SolutionVersion": "v2.1.5" }, "Type": "String", "Value": { "Fn::If": [ "moduleinputsconstructisroute53hostedzoneidsetcondition7B6D6B93", { "Ref": "Route53HostedZoneId" }, "unset" ] } }, "Metadata": { "aws:cdk:path": "acdp/module-inputs-construct/ssm-route53-hosted-zone-name/Resource" } }, "moduleinputsconstructssmacmcustomcertificatearn8344C6B1": { "Type": "AWS::SSM::Parameter", "Properties": { "Description": "Optional when using a Public Hosted Zone with Route53. Required when HostedZoneId is Private or not provided. Provide a custom ACM Certificate ARN to use for TLS.", "Name": { "Fn::Join": [ "", [ "/solution/", { "Ref": "AcdpUniqueId" }, "/config/dns/acm-custom-certificate-arn" ] ] }, "Tags": { "awsApplication": { "Fn::GetAtt": [ "acdpappregistryappregistryapplication0BC5FAC5", "ApplicationTagValue" ] }, "Solutions:ApplicationType": "AWS-Solutions", "Solutions:ModuleName": "acdp", "Solutions:SolutionID": "SO0241", "Solutions:SolutionName": "connected-mobility-solution-on-aws", "Solutions:SolutionVersion": "v2.1.5" }, "Type": "String", "Value": { "Fn::If": [ "moduleinputsconstructiscustomacmcertificatearnsetcondition409229F6", { "Ref": "CustomAcmCertificateArn" }, "unset" ] } }, "Metadata": { "aws:cdk:path": "acdp/module-inputs-construct/ssm-acm-custom-certificate-arn/Resource" } }, "moduleinputsconstructssmispublicfacing787E6E85": { "Type": "AWS::SSM::Parameter", "Properties": { "Description": "Boolean value representing if public endpoints should be created for relevant resources", "Name": { "Fn::Join": [ "", [ "/solution/", { "Ref": "AcdpUniqueId" }, "/config/dns/is-public-facing" ] ] }, "Tags": { "awsApplication": { "Fn::GetAtt": [ "acdpappregistryappregistryapplication0BC5FAC5", "ApplicationTagValue" ] }, "Solutions:ApplicationType": "AWS-Solutions", "Solutions:ModuleName": "acdp", "Solutions:SolutionID": "SO0241", "Solutions:SolutionName": "connected-mobility-solution-on-aws", "Solutions:SolutionVersion": "v2.1.5" }, "Type": "String", "Value": { "Ref": "IsPublicFacing" } }, "Metadata": { "aws:cdk:path": "acdp/module-inputs-construct/ssm-is-public-facing/Resource" } }, "moduleinputsconstructssmfullyqualifieddomainname6F31B012": { "Type": "AWS::SSM::Parameter", "Properties": { "Description": "The name of the base domain to deploy in", "Name": { "Fn::Join": [ "", [ "/solution/", { "Ref": "AcdpUniqueId" }, "/config/dns/fully-qualified-domain-name" ] ] }, "Tags": { "awsApplication": { "Fn::GetAtt": [ "acdpappregistryappregistryapplication0BC5FAC5", "ApplicationTagValue" ] }, "Solutions:ApplicationType": "AWS-Solutions", "Solutions:ModuleName": "acdp", "Solutions:SolutionID": "SO0241", "Solutions:SolutionName": "connected-mobility-solution-on-aws", "Solutions:SolutionVersion": "v2.1.5" }, "Type": "String", "Value": { "Ref": "FullyQualifiedDomainName" } }, "Metadata": { "aws:cdk:path": "acdp/module-inputs-construct/ssm-fully-qualified-domain-name/Resource" } }, "acdpdependencylayerlambdadependencylayerversion496A1EF0": { "Type": "AWS::Lambda::LayerVersion", "Properties": { "CompatibleArchitectures": [ "x86_64", "arm64" ], "CompatibleRuntimes": [ "python3.12" ], "Content": { "S3Bucket": { "Fn::Join": [ "-", [ { "Fn::FindInMap": [ "Solution", "AssetsConfig", "S3AssetBucketBaseName" ] }, { "Fn::Sub": "${AWS::Region}" } ] ] }, "S3Key": { "Fn::Join": [ "/", [ { "Fn::FindInMap": [ "Solution", "AssetsConfig", "S3AssetKeyPrefix" ] }, "asseta0714f755c81085f1cfcb55e0ec5512d7e245436d810e45d2c8e1d6674ac4202.zip" ] ] } } }, "Metadata": { "aws:cdk:path": "acdp/acdp-dependency-layer/lambda-dependency-layer-version/Resource", "aws:asset:path": "asset.a0714f755c81085f1cfcb55e0ec5512d7e245436d810e45d2c8e1d6674ac4202", "aws:asset:is-bundled": false, "aws:asset:property": "Content" } }, "ssmappuniqueidD1DCE51D": { "Type": "AWS::SSM::Parameter", "Properties": { "Description": "SSM parameter to register an app unique ID.", "Name": { "Fn::Join": [ "", [ "/solution/", { "Ref": "AcdpUniqueId" } ] ] }, "Tags": { "awsApplication": { "Fn::GetAtt": [ "acdpappregistryappregistryapplication0BC5FAC5", "ApplicationTagValue" ] }, "Solutions:ApplicationType": "AWS-Solutions", "Solutions:ModuleName": "acdp", "Solutions:SolutionID": "SO0241", "Solutions:SolutionName": "connected-mobility-solution-on-aws", "Solutions:SolutionVersion": "v2.1.5" }, "Type": "String", "Value": { "Ref": "AcdpUniqueId" } }, "Metadata": { "aws:cdk:path": "acdp/ssm-app-unique-id/Resource" } }, "cdklambdasvpcconstructsecuritygroupF9971F98": { "Type": "AWS::EC2::SecurityGroup", "Properties": { "GroupDescription": "acdp/cdk-lambdas-vpc-construct/security-group", "SecurityGroupEgress": [ { "CidrIp": "0.0.0.0/0", "Description": "Allow all outbound traffic by default", "IpProtocol": "-1" } ], "Tags": [ { "Key": "awsApplication", "Value": { "Fn::GetAtt": [ "acdpappregistryappregistryapplication0BC5FAC5", "ApplicationTagValue" ] } }, { "Key": "Solutions:ApplicationType", "Value": "AWS-Solutions" }, { "Key": "Solutions:ModuleName", "Value": "acdp" }, { "Key": "Solutions:SolutionID", "Value": "SO0241" }, { "Key": "Solutions:SolutionName", "Value": "connected-mobility-solution-on-aws" }, { "Key": "Solutions:SolutionVersion", "Value": "v2.1.5" } ], "VpcId": { "Fn::Join": [ "", [ "{{resolve:ssm:/solution/vpc/", { "Ref": "VpcName" }, "/vpcid}}" ] ] } }, "Metadata": { "aws:cdk:path": "acdp/cdk-lambdas-vpc-construct/security-group/Resource" } }, "customresourceconstructlambdaroleB2CB3F79": { "Type": "AWS::IAM::Role", "Properties": { "AssumeRolePolicyDocument": { "Statement": [ { "Action": "sts:AssumeRole", "Effect": "Allow", "Principal": { "Service": "lambda.amazonaws.com" } } ], "Version": "2012-10-17" }, "Policies": [ { "PolicyDocument": { "Statement": [ { "Action": [ "logs:CreateLogGroup", "logs:CreateLogStream", "logs:PutLogEvents" ], "Effect": "Allow", "Resource": [ { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":logs:", { "Ref": "AWS::Region" }, ":", { "Ref": "AWS::AccountId" }, ":log-group:/aws/lambda/", { "Ref": "AcdpUniqueId" }, "-acdp-custom-resource" ] ] }, { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":logs:", { "Ref": "AWS::Region" }, ":", { "Ref": "AWS::AccountId" }, ":log-group:/aws/lambda/", { "Ref": "AcdpUniqueId" }, "-acdp-custom-resource:log-stream:*" ] ] } ] } ], "Version": "2012-10-17" }, "PolicyName": "lambda-logs-policy" }, { "PolicyDocument": { "Statement": [ { "Action": "ec2:CreateNetworkInterfacePermission", "Condition": { "StringEquals": { "ec2:Subnet": [ { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":ec2:", { "Ref": "AWS::Region" }, ":", { "Ref": "AWS::AccountId" }, ":subnet/{{resolve:ssm:/solution/vpc/", { "Ref": "VpcName" }, "/subnets/private/1}}" ] ] }, { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":ec2:", { "Ref": "AWS::Region" }, ":", { "Ref": "AWS::AccountId" }, ":subnet/{{resolve:ssm:/solution/vpc/", { "Ref": "VpcName" }, "/subnets/private/2}}" ] ] } ], "ec2:AuthorizedService": "lambda.amazonaws.com" } }, "Effect": "Allow", "Resource": { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":ec2:", { "Ref": "AWS::Region" }, ":", { "Ref": "AWS::AccountId" }, ":network-interface/*" ] ] } }, { "Action": [ "ec2:DescribeNetworkInterfaces", "ec2:CreateNetworkInterface", "ec2:DeleteNetworkInterface" ], "Effect": "Allow", "Resource": "*" } ], "Version": "2012-10-17" }, "PolicyName": "ec2-policy" } ], "Tags": [ { "Key": "awsApplication", "Value": { "Fn::GetAtt": [ "acdpappregistryappregistryapplication0BC5FAC5", "ApplicationTagValue" ] } }, { "Key": "Solutions:ApplicationType", "Value": "AWS-Solutions" }, { "Key": "Solutions:ModuleName", "Value": "acdp" }, { "Key": "Solutions:SolutionID", "Value": "SO0241" }, { "Key": "Solutions:SolutionName", "Value": "connected-mobility-solution-on-aws" }, { "Key": "Solutions:SolutionVersion", "Value": "v2.1.5" } ] }, "Metadata": { "aws:cdk:path": "acdp/custom-resource-construct/lambda-role/Resource", "cdk_nag": { "rules_to_suppress": [ { "id": "AwsSolutions-IAM5", "appliesTo": [ "Resource::arn::logs:::log-group:/aws/lambda/-acdp-custom-resource:log-stream:*", "Resource::arn::logs:::log-group:/aws/lambda/-acdp-custom-resource:log-stream:*" ], "reason": "Log retention lambda uses policies that require wildcard permissions" }, { "id": "AwsSolutions-IAM5", "appliesTo": [ "Resource::arn::ec2:::network-interface/*", "Resource::*" ], "reason": "ec2 Network Interfaces permissions need to be wildcard" } ] } } }, "customresourceconstructsecuritygroup50DD39AF": { "Type": "AWS::EC2::SecurityGroup", "Properties": { "GroupDescription": "acdp/custom-resource-construct/security-group", "SecurityGroupEgress": [ { "CidrIp": "0.0.0.0/0", "Description": "Allow all outbound traffic by default", "IpProtocol": "-1" } ], "Tags": [ { "Key": "awsApplication", "Value": { "Fn::GetAtt": [ "acdpappregistryappregistryapplication0BC5FAC5", "ApplicationTagValue" ] } }, { "Key": "Solutions:ApplicationType", "Value": "AWS-Solutions" }, { "Key": "Solutions:ModuleName", "Value": "acdp" }, { "Key": "Solutions:SolutionID", "Value": "SO0241" }, { "Key": "Solutions:SolutionName", "Value": "connected-mobility-solution-on-aws" }, { "Key": "Solutions:SolutionVersion", "Value": "v2.1.5" } ], "VpcId": { "Fn::Join": [ "", [ "{{resolve:ssm:/solution/vpc/", { "Ref": "VpcName" }, "/vpcid}}" ] ] } }, "Metadata": { "aws:cdk:path": "acdp/custom-resource-construct/security-group/Resource" } }, "customresourceconstructlambdafunction78B09163": { "Type": "AWS::Lambda::Function", "Properties": { "Code": { "S3Bucket": { "Fn::Join": [ "-", [ { "Fn::FindInMap": [ "Solution", "AssetsConfig", "S3AssetBucketBaseName" ] }, { "Fn::Sub": "${AWS::Region}" } ] ] }, "S3Key": { "Fn::Join": [ "/", [ { "Fn::FindInMap": [ "Solution", "AssetsConfig", "S3AssetKeyPrefix" ] }, "asset364987b3acd63fbf6f95ea0dc24fe12af7334647edf6995340eb9d5b8a286272.zip" ] ] } }, "Environment": { "Variables": { "USER_AGENT_STRING": "AWSSOLUTION/SO0241/v2.1.5 AWSSOLUTION-CAPABILITY/CMS.6/v2.1.5" } }, "FunctionName": { "Fn::Join": [ "", [ { "Ref": "AcdpUniqueId" }, "-acdp-custom-resource" ] ] }, "Handler": "function.main.handler", "Layers": [ { "Ref": "acdpdependencylayerlambdadependencylayerversion496A1EF0" } ], "MemorySize": 1024, "Role": { "Fn::GetAtt": [ "customresourceconstructlambdaroleB2CB3F79", "Arn" ] }, "Runtime": "python3.12", "Tags": [ { "Key": "awsApplication", "Value": { "Fn::GetAtt": [ "acdpappregistryappregistryapplication0BC5FAC5", "ApplicationTagValue" ] } }, { "Key": "Solutions:ApplicationType", "Value": "AWS-Solutions" }, { "Key": "Solutions:ModuleName", "Value": "acdp" }, { "Key": "Solutions:SolutionID", "Value": "SO0241" }, { "Key": "Solutions:SolutionName", "Value": "connected-mobility-solution-on-aws" }, { "Key": "Solutions:SolutionVersion", "Value": "v2.1.5" } ], "Timeout": 300, "VpcConfig": { "SecurityGroupIds": [ { "Fn::GetAtt": [ "customresourceconstructsecuritygroup50DD39AF", "GroupId" ] } ], "SubnetIds": [ { "Fn::Join": [ "", [ "{{resolve:ssm:/solution/vpc/", { "Ref": "VpcName" }, "/subnets/private/1}}" ] ] }, { "Fn::Join": [ "", [ "{{resolve:ssm:/solution/vpc/", { "Ref": "VpcName" }, "/subnets/private/2}}" ] ] } ] } }, "DependsOn": [ "customresourceconstructlambdaroleB2CB3F79" ], "Metadata": { "aws:cdk:path": "acdp/custom-resource-construct/lambda-function/Resource", "aws:asset:path": "asset.364987b3acd63fbf6f95ea0dc24fe12af7334647edf6995340eb9d5b8a286272.zip", "aws:asset:is-bundled": false, "aws:asset:property": "Code", "cdk_nag": { "rules_to_suppress": [ { "id": "AwsSolutions-IAM5", "reason": "Log groups have wildcards." }, { "id": "AwsSolutions-L1", "reason": "The non-container Lambda function is not configured to use the latest runtime version." } ] } } }, "customresourceconstructlambdafunctionLogRetentionEBB715A8": { "Type": "Custom::LogRetention", "Properties": { "ServiceToken": { "Fn::GetAtt": [ "LogRetentionaae0aa3c5b4d4f87b02d85b201efdd8aFD4BFC8A", "Arn" ] }, "LogGroupName": { "Fn::Join": [ "", [ "/aws/lambda/", { "Ref": "customresourceconstructlambdafunction78B09163" } ] ] }, "RetentionInDays": 90 }, "Metadata": { "aws:cdk:path": "acdp/custom-resource-construct/lambda-function/LogRetention/Resource" } }, "LogRetentionaae0aa3c5b4d4f87b02d85b201efdd8aServiceRole9741ECFB": { "Type": "AWS::IAM::Role", "Properties": { "AssumeRolePolicyDocument": { "Statement": [ { "Action": "sts:AssumeRole", "Effect": "Allow", "Principal": { "Service": "lambda.amazonaws.com" } } ], "Version": "2012-10-17" }, "ManagedPolicyArns": [ { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":iam::aws:policy/service-role/AWSLambdaBasicExecutionRole" ] ] } ], "Policies": [ { "PolicyDocument": { "Statement": [ { "Action": [ "ec2:CreateNetworkInterfacePermission" ], "Condition": { "StringEquals": { "ec2:Subnet": [ { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":ec2:", { "Ref": "AWS::Region" }, ":", { "Ref": "AWS::AccountId" }, ":subnet/", { "Fn::Join": [ "", [ "{{resolve:ssm:/solution/vpc/", { "Ref": "VpcName" }, "/subnets/private/1}}" ] ] } ] ] }, { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":ec2:", { "Ref": "AWS::Region" }, ":", { "Ref": "AWS::AccountId" }, ":subnet/", { "Fn::Join": [ "", [ "{{resolve:ssm:/solution/vpc/", { "Ref": "VpcName" }, "/subnets/private/2}}" ] ] } ] ] } ], "ec2:AuthorizedService": "lambda.amazonaws.com" } }, "Effect": "Allow", "Resource": { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":ec2:", { "Ref": "AWS::Region" }, ":", { "Ref": "AWS::AccountId" }, ":network-interface/*" ] ] } }, { "Action": [ "ec2:DescribeNetworkInterfaces", "ec2:CreateNetworkInterface", "ec2:DeleteNetworkInterface" ], "Effect": "Allow", "Resource": "*" } ], "Version": "2012-10-17" }, "PolicyName": "ec2-policy" } ], "Tags": [ { "Key": "awsApplication", "Value": { "Fn::GetAtt": [ "acdpappregistryappregistryapplication0BC5FAC5", "ApplicationTagValue" ] } }, { "Key": "Solutions:ApplicationType", "Value": "AWS-Solutions" }, { "Key": "Solutions:ModuleName", "Value": "acdp" }, { "Key": "Solutions:SolutionID", "Value": "SO0241" }, { "Key": "Solutions:SolutionName", "Value": "connected-mobility-solution-on-aws" }, { "Key": "Solutions:SolutionVersion", "Value": "v2.1.5" } ] }, "Metadata": { "aws:cdk:path": "acdp/LogRetentionaae0aa3c5b4d4f87b02d85b201efdd8a/ServiceRole/Resource", "cdk_nag": { "rules_to_suppress": [ { "id": "AwsSolutions-IAM4", "appliesTo": [ "Policy::arn::iam::aws:policy/service-role/AWSLambdaBasicExecutionRole" ], "reason": "Log retention lambda uses managed policies." } ] } } }, "LogRetentionaae0aa3c5b4d4f87b02d85b201efdd8aServiceRoleDefaultPolicyADDA7DEB": { "Type": "AWS::IAM::Policy", "Properties": { "PolicyDocument": { "Statement": [ { "Action": [ "logs:PutRetentionPolicy", "logs:DeleteRetentionPolicy" ], "Effect": "Allow", "Resource": "*" } ], "Version": "2012-10-17" }, "PolicyName": "LogRetentionaae0aa3c5b4d4f87b02d85b201efdd8aServiceRoleDefaultPolicyADDA7DEB", "Roles": [ { "Ref": "LogRetentionaae0aa3c5b4d4f87b02d85b201efdd8aServiceRole9741ECFB" } ] }, "Metadata": { "aws:cdk:path": "acdp/LogRetentionaae0aa3c5b4d4f87b02d85b201efdd8a/ServiceRole/DefaultPolicy/Resource", "cdk_nag": { "rules_to_suppress": [ { "id": "AwsSolutions-IAM5", "appliesTo": [ "Resource::*" ], "reason": "Log retention lambda uses managed policies which have wildcard permissions." } ] } } }, "LogRetentionaae0aa3c5b4d4f87b02d85b201efdd8aFD4BFC8A": { "Type": "AWS::Lambda::Function", "Properties": { "Handler": "index.handler", "Runtime": { "Fn::FindInMap": [ "LatestNodeRuntimeMap", { "Ref": "AWS::Region" }, "value" ] }, "Timeout": 900, "Code": { "S3Bucket": { "Fn::Join": [ "-", [ { "Fn::FindInMap": [ "Solution", "AssetsConfig", "S3AssetBucketBaseName" ] }, { "Fn::Sub": "${AWS::Region}" } ] ] }, "S3Key": { "Fn::Join": [ "/", [ { "Fn::FindInMap": [ "Solution", "AssetsConfig", "S3AssetKeyPrefix" ] }, "asset2819175352ad1ce0dae768e83fc328fb70fb5f10b4a8ff0ccbcb791f02b0716d.zip" ] ] } }, "Role": { "Fn::GetAtt": [ "LogRetentionaae0aa3c5b4d4f87b02d85b201efdd8aServiceRole9741ECFB", "Arn" ] }, "Tags": [ { "Key": "awsApplication", "Value": { "Fn::GetAtt": [ "acdpappregistryappregistryapplication0BC5FAC5", "ApplicationTagValue" ] } }, { "Key": "Solutions:ApplicationType", "Value": "AWS-Solutions" }, { "Key": "Solutions:ModuleName", "Value": "acdp" }, { "Key": "Solutions:SolutionID", "Value": "SO0241" }, { "Key": "Solutions:SolutionName", "Value": "connected-mobility-solution-on-aws" }, { "Key": "Solutions:SolutionVersion", "Value": "v2.1.5" } ], "VpcConfig": { "SecurityGroupIds": [ { "Fn::GetAtt": [ "cdklambdasvpcconstructsecuritygroupF9971F98", "GroupId" ] } ], "SubnetIds": [ { "Fn::Join": [ "", [ "{{resolve:ssm:/solution/vpc/", { "Ref": "VpcName" }, "/subnets/private/1}}" ] ] }, { "Fn::Join": [ "", [ "{{resolve:ssm:/solution/vpc/", { "Ref": "VpcName" }, "/subnets/private/2}}" ] ] } ] } }, "DependsOn": [ "LogRetentionaae0aa3c5b4d4f87b02d85b201efdd8aServiceRoleDefaultPolicyADDA7DEB", "LogRetentionaae0aa3c5b4d4f87b02d85b201efdd8aServiceRole9741ECFB" ], "Metadata": { "aws:cdk:path": "acdp/LogRetentionaae0aa3c5b4d4f87b02d85b201efdd8a/Resource", "aws:asset:path": "asset.2819175352ad1ce0dae768e83fc328fb70fb5f10b4a8ff0ccbcb791f02b0716d", "aws:asset:is-bundled": false, "aws:asset:property": "Code" } }, "deploymentuuidconstructdeploymentuuidcustomresourceC885F329": { "Type": "Custom::CreateDeploymentUUID", "Properties": { "ServiceToken": { "Fn::GetAtt": [ "customresourceconstructlambdafunction78B09163", "Arn" ] }, "Resource": "CreateDeploymentUUID" }, "UpdateReplacePolicy": "Delete", "DeletionPolicy": "Delete", "Metadata": { "aws:cdk:path": "acdp/deployment-uuid-construct/deployment-uuid-custom-resource/Default" } }, "acdpcloudformationroleC3BA7F88": { "Type": "AWS::IAM::Role", "Properties": { "AssumeRolePolicyDocument": { "Statement": [ { "Action": "sts:AssumeRole", "Effect": "Allow", "Principal": { "Service": "cloudformation.amazonaws.com" } } ], "Version": "2012-10-17" }, "Description": "CloudFormation Role", "Policies": [ { "PolicyDocument": { "Statement": [ { "Action": "*", "Effect": "Allow", "Resource": "*" } ], "Version": "2012-10-17" }, "PolicyName": "admin-policy" } ], "Tags": [ { "Key": "awsApplication", "Value": { "Fn::GetAtt": [ "acdpappregistryappregistryapplication0BC5FAC5", "ApplicationTagValue" ] } }, { "Key": "Solutions:ApplicationType", "Value": "AWS-Solutions" }, { "Key": "Solutions:DeploymentUUID", "Value": { "Fn::GetAtt": [ "deploymentuuidconstructdeploymentuuidcustomresourceC885F329", "SolutionUUID" ] } }, { "Key": "Solutions:ModuleName", "Value": "acdp" }, { "Key": "Solutions:SolutionID", "Value": "SO0241" }, { "Key": "Solutions:SolutionName", "Value": "connected-mobility-solution-on-aws" }, { "Key": "Solutions:SolutionVersion", "Value": "v2.1.5" } ] }, "DependsOn": [ "ssmappuniqueidD1DCE51D" ], "Metadata": { "aws:cdk:path": "acdp/acdp/cloudformation-role/role/Resource", "cdk_nag": { "rules_to_suppress": [ { "id": "AwsSolutions-IAM5", "appliesTo": [ "Action::*", "Resource::*" ], "reason": "The CodeBuild job should be able to pass an admin role to the CloudFormation service principal to be able to deploy module stacks from CodeBuild" } ] } } }, "acdpbackstageassetsconstructs3policyA50772A6": { "Type": "AWS::IAM::Policy", "Properties": { "PolicyDocument": { "Statement": [ { "Action": [ "s3:GetBucketLocation", "s3:GetObject", "s3:ListBucket", "s3:HeadObject" ], "Effect": "Allow", "Resource": [ { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":s3:::", { "Fn::FindInMap": [ "Solution", "AssetsConfig", "S3AssetBucketBaseName" ] }, "-", { "Ref": "AWS::Region" } ] ] }, { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":s3:::", { "Fn::FindInMap": [ "Solution", "AssetsConfig", "S3AssetBucketBaseName" ] }, "-", { "Ref": "AWS::Region" }, "/*" ] ] } ] }, { "Action": [ "s3:GetBucketLocation", "s3:GetObject", "s3:ListBucket", "s3:PutObject", "s3:HeadObject" ], "Effect": "Allow", "Resource": [ { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":s3:::", { "Ref": "backstageassetbucketconstructencryptedbucket8BE77EF0" } ] ] }, { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":s3:::", { "Ref": "backstageassetbucketconstructencryptedbucket8BE77EF0" }, "/*" ] ] } ] } ], "Version": "2012-10-17" }, "PolicyName": "acdpbackstageassetsconstructs3policyA50772A6", "Roles": [ { "Ref": "customresourceconstructlambdaroleB2CB3F79" } ] }, "DependsOn": [ "ssmappuniqueidD1DCE51D" ], "Metadata": { "aws:cdk:path": "acdp/acdp/backstage-assets-construct/s3-policy/Resource", "cdk_nag": { "rules_to_suppress": [ { "id": "AwsSolutions-IAM5", "appliesTo": [ "Resource::arn::s3:::{\"Fn::FindInMap\":[\"Solution\",\"AssetsConfig\",\"S3AssetBucketBaseName\"]}-/*", "Resource::arn::s3:::/*" ], "reason": "unknown asset locations upfront, so need wildcard access to regional buckets" } ] } } }, "acdpbackstageassetsconstructbackstagedefaultusersandgroupscustomresource72402F10": { "Type": "Custom::CreateAndUploadDefaultUsersAndGroups", "Properties": { "ServiceToken": { "Fn::GetAtt": [ "customresourceconstructlambdafunction78B09163", "Arn" ] }, "Resource": "CreateAndUploadDefaultUsersAndGroups", "DestinationBucket": { "Ref": "backstageassetbucketconstructencryptedbucket8BE77EF0" }, "DestinationKeyPrefix": "backstage/catalog", "CustomEnvironment": { "ADMIN_USER_EMAIL": { "Ref": "AdminUserEmail" }, "ADMIN_USERNAME": { "Fn::Select": [ 0, { "Fn::Split": [ "@", { "Ref": "AdminUserEmail" } ] } ] } } }, "DependsOn": [ "ssmappuniqueidD1DCE51D" ], "UpdateReplacePolicy": "Delete", "DeletionPolicy": "Delete", "Metadata": { "aws:cdk:path": "acdp/acdp/backstage-assets-construct/backstage-default-users-and-groups-custom-resource/Default" } }, "acdpbackstageassetsconstructdeploymentbackstagezipassetB64A29C2": { "Type": "Custom::CopyS3Object", "Properties": { "ServiceToken": { "Fn::GetAtt": [ "customresourceconstructlambdafunction78B09163", "Arn" ] }, "Resource": "CopyS3Object", "SourceBucket": { "Fn::Join": [ "", [ { "Fn::FindInMap": [ "Solution", "AssetsConfig", "S3AssetBucketBaseName" ] }, "-", { "Ref": "AWS::Region" } ] ] }, "SourceKey": "connected-mobility-solution-on-aws/v2.1.5/backstage/pipeline/backstage_pipeline_source.zip", "DestinationBucket": { "Ref": "backstageassetbucketconstructencryptedbucket8BE77EF0" }, "DestinationKey": "connected-mobility-solution-on-aws/v2.1.5/backstage/pipeline/backstage_pipeline_source.zip" }, "DependsOn": [ "ssmappuniqueidD1DCE51D" ], "UpdateReplacePolicy": "Delete", "DeletionPolicy": "Delete", "Metadata": { "aws:cdk:path": "acdp/acdp/backstage-assets-construct/deployment-backstage-zip-asset/Default" } }, "acdpbackstageassetsconstructbackstagetemplateassetscopycustomresource32AF3B04": { "Type": "Custom::ExtractS3ZipToTargetBucket", "Properties": { "ServiceToken": { "Fn::GetAtt": [ "customresourceconstructlambdafunction78B09163", "Arn" ] }, "Resource": "ExtractS3ZipToTargetBucket", "SourceBucket": { "Fn::Join": [ "", [ { "Fn::FindInMap": [ "Solution", "AssetsConfig", "S3AssetBucketBaseName" ] }, "-", { "Ref": "AWS::Region" } ] ] }, "SourceZipKey": "connected-mobility-solution-on-aws/v2.1.5/backstage.zip", "DestinationBucket": { "Ref": "backstageassetbucketconstructencryptedbucket8BE77EF0" }, "DestinationKeyPrefix": "backstage-default-assets" }, "DependsOn": [ "ssmappuniqueidD1DCE51D" ], "UpdateReplacePolicy": "Delete", "DeletionPolicy": "Delete", "Metadata": { "aws:cdk:path": "acdp/acdp/backstage-assets-construct/backstage-template-assets-copy-custom-resource/Default" } }, "acdppipelinesconstructbackstageecrA3584D57": { "Type": "AWS::ECR::Repository", "Properties": { "ImageScanningConfiguration": { "ScanOnPush": true }, "ImageTagMutability": "MUTABLE", "RepositoryName": { "Fn::Join": [ "", [ { "Ref": "AcdpUniqueId" }, "-backstage" ] ] }, "Tags": [ { "Key": "awsApplication", "Value": { "Fn::GetAtt": [ "acdpappregistryappregistryapplication0BC5FAC5", "ApplicationTagValue" ] } }, { "Key": "Solutions:ApplicationType", "Value": "AWS-Solutions" }, { "Key": "Solutions:DeploymentUUID", "Value": { "Fn::GetAtt": [ "deploymentuuidconstructdeploymentuuidcustomresourceC885F329", "SolutionUUID" ] } }, { "Key": "Solutions:ModuleName", "Value": "acdp" }, { "Key": "Solutions:SolutionID", "Value": "SO0241" }, { "Key": "Solutions:SolutionName", "Value": "connected-mobility-solution-on-aws" }, { "Key": "Solutions:SolutionVersion", "Value": "v2.1.5" } ] }, "DependsOn": [ "acdpbackstageassetsconstructbackstagedefaultusersandgroupscustomresource72402F10", "acdpbackstageassetsconstructbackstagetemplateassetscopycustomresource32AF3B04", "acdpbackstageassetsconstructdeploymentbackstagezipassetB64A29C2", "acdpbackstageassetsconstructs3policyA50772A6", "ssmappuniqueidD1DCE51D" ], "UpdateReplacePolicy": "Delete", "DeletionPolicy": "Delete", "Metadata": { "aws:cdk:path": "acdp/acdp/pipelines-construct/backstage-ecr/Resource" } }, "acdppipelinesconstructbackstagecodebuildsecuritygroupE511867D": { "Type": "AWS::EC2::SecurityGroup", "Properties": { "GroupDescription": "acdp/acdp/pipelines-construct/backstage-codebuild-security-group", "SecurityGroupEgress": [ { "CidrIp": "0.0.0.0/0", "Description": "Allow all outbound traffic by default", "IpProtocol": "-1" } ], "Tags": [ { "Key": "awsApplication", "Value": { "Fn::GetAtt": [ "acdpappregistryappregistryapplication0BC5FAC5", "ApplicationTagValue" ] } }, { "Key": "Solutions:ApplicationType", "Value": "AWS-Solutions" }, { "Key": "Solutions:DeploymentUUID", "Value": { "Fn::GetAtt": [ "deploymentuuidconstructdeploymentuuidcustomresourceC885F329", "SolutionUUID" ] } }, { "Key": "Solutions:ModuleName", "Value": "acdp" }, { "Key": "Solutions:SolutionID", "Value": "SO0241" }, { "Key": "Solutions:SolutionName", "Value": "connected-mobility-solution-on-aws" }, { "Key": "Solutions:SolutionVersion", "Value": "v2.1.5" } ], "VpcId": { "Fn::Join": [ "", [ "{{resolve:ssm:/solution/vpc/", { "Ref": "VpcName" }, "/vpcid}}" ] ] } }, "DependsOn": [ "acdpbackstageassetsconstructbackstagedefaultusersandgroupscustomresource72402F10", "acdpbackstageassetsconstructbackstagetemplateassetscopycustomresource32AF3B04", "acdpbackstageassetsconstructdeploymentbackstagezipassetB64A29C2", "acdpbackstageassetsconstructs3policyA50772A6", "ssmappuniqueidD1DCE51D" ], "Metadata": { "aws:cdk:path": "acdp/acdp/pipelines-construct/backstage-codebuild-security-group/Resource" } }, "acdppipelinesconstructbackstagedeployroleC909101A": { "Type": "AWS::IAM::Role", "Properties": { "AssumeRolePolicyDocument": { "Statement": [ { "Action": "sts:AssumeRole", "Effect": "Allow", "Principal": { "Service": "codebuild.amazonaws.com" } } ], "Version": "2012-10-17" }, "Description": "Backstage Configuration Deploy Role", "Policies": [ { "PolicyDocument": { "Statement": [ { "Action": [ "s3:PutObject", "s3:GetBucketAcl", "s3:GetBucketLocation", "s3:GetBucketVersioning", "s3:GetObject", "s3:GetObjectAcl", "s3:GetObjectAttributes", "s3:GetObjectVersion", "s3:GetObjectVersionAcl", "s3:GetObjectVersionTagging", "s3:ListAllMyBuckets", "s3:ListBucket", "s3:ListBucketVersions" ], "Effect": "Allow", "Resource": [ { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":s3:::", { "Fn::FindInMap": [ "Solution", "AssetsConfig", "S3AssetBucketBaseName" ] }, "-", { "Ref": "AWS::Region" } ] ] }, { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":s3:::", { "Fn::FindInMap": [ "Solution", "AssetsConfig", "S3AssetBucketBaseName" ] }, "-", { "Ref": "AWS::Region" }, "/*" ] ] }, { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":s3:::", { "Ref": "backstageassetbucketconstructencryptedbucket8BE77EF0" } ] ] }, { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":s3:::", { "Ref": "backstageassetbucketconstructencryptedbucket8BE77EF0" }, "/*" ] ] } ] } ], "Version": "2012-10-17" }, "PolicyName": "s3-policy" }, { "PolicyDocument": { "Statement": [ { "Action": [ "cloudformation:DescribeStacks", "cloudformation:CreateChangeSet", "cloudformation:DescribeChangeSet", "cloudformation:ExecuteChangeSet", "cloudformation:CreateStack", "cloudformation:GetTemplateSummary" ], "Effect": "Allow", "Resource": [ { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":cloudformation:", { "Ref": "AWS::Region" }, ":", { "Ref": "AWS::AccountId" }, ":stack/", { "Ref": "AcdpUniqueId" }, "--acdp-backstage-*" ] ] }, { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":cloudformation:", { "Ref": "AWS::Region" }, ":", { "Ref": "AWS::AccountId" }, ":stack/", { "Ref": "AcdpUniqueId" }, "--acdp-backstage" ] ] }, { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":cloudformation:", { "Ref": "AWS::Region" }, ":", { "Ref": "AWS::AccountId" }, ":stack/", { "Ref": "AcdpUniqueId" }, "--acdp-backstage/*" ] ] } ] } ], "Version": "2012-10-17" }, "PolicyName": "cloudformation-policy" }, { "PolicyDocument": { "Statement": [ { "Action": [ "ssm:GetParameters", "ssm:GetParameter" ], "Effect": "Allow", "Resource": { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":ssm:", { "Ref": "AWS::Region" }, ":", { "Ref": "AWS::AccountId" }, ":parameter/solution/", { "Ref": "AcdpUniqueId" }, "/*" ] ] } } ], "Version": "2012-10-17" }, "PolicyName": "ssm-policy" }, { "PolicyDocument": { "Statement": [ { "Action": "iam:PassRole", "Effect": "Allow", "Resource": { "Fn::GetAtt": [ "acdpcloudformationroleC3BA7F88", "Arn" ] } } ], "Version": "2012-10-17" }, "PolicyName": "iam-policy" }, { "PolicyDocument": { "Statement": [ { "Action": [ "ec2:DescribeVpcs", "ec2:DescribeSubnets", "ec2:DescribeRouteTables", "ec2:DescribeVpnGateways" ], "Effect": "Allow", "Resource": "*" } ], "Version": "2012-10-17" }, "PolicyName": "ec2-policy" }, { "PolicyDocument": { "Statement": [ { "Action": "route53:ListHostedZonesByName", "Effect": "Allow", "Resource": "*" } ], "Version": "2012-10-17" }, "PolicyName": "route53-policy" } ], "Tags": [ { "Key": "awsApplication", "Value": { "Fn::GetAtt": [ "acdpappregistryappregistryapplication0BC5FAC5", "ApplicationTagValue" ] } }, { "Key": "Solutions:ApplicationType", "Value": "AWS-Solutions" }, { "Key": "Solutions:DeploymentUUID", "Value": { "Fn::GetAtt": [ "deploymentuuidconstructdeploymentuuidcustomresourceC885F329", "SolutionUUID" ] } }, { "Key": "Solutions:ModuleName", "Value": "acdp" }, { "Key": "Solutions:SolutionID", "Value": "SO0241" }, { "Key": "Solutions:SolutionName", "Value": "connected-mobility-solution-on-aws" }, { "Key": "Solutions:SolutionVersion", "Value": "v2.1.5" } ] }, "DependsOn": [ "acdpbackstageassetsconstructbackstagedefaultusersandgroupscustomresource72402F10", "acdpbackstageassetsconstructbackstagetemplateassetscopycustomresource32AF3B04", "acdpbackstageassetsconstructdeploymentbackstagezipassetB64A29C2", "acdpbackstageassetsconstructs3policyA50772A6", "ssmappuniqueidD1DCE51D" ], "Metadata": { "aws:cdk:path": "acdp/acdp/pipelines-construct/backstage-deploy-role/Resource", "cdk_nag": { "rules_to_suppress": [ { "id": "AwsSolutions-IAM5", "appliesTo": [ "Resource::arn::ssm:::parameter/acdp/config/*", "Resource::arn::s3:::{\"Fn::FindInMap\":[\"Solution\",\"AssetsConfig\",\"S3AssetBucketBaseName\"]}-/*", "Resource::arn::cloudformation:::stack/cms-*", "Resource::arn::cloudformation:::stack/acdp-backstage-*", "Resource::arn::ssm:::parameter/dev/acdp-dev/*", "Resource::*", "Resource::arn::cloudformation:::stack/--acdp-backstage-*", "Resource::arn::cloudformation:::stack/--acdp-backstage/*", "Resource::arn::ssm:::parameter/solution//*", "Resource::arn::s3:::/*" ], "reason": "Need wildcard to read SSM parameters when deploying modules" } ] } } }, "acdppipelinesconstructbackstagedeployroleDefaultPolicy79C58584": { "Type": "AWS::IAM::Policy", "Properties": { "PolicyDocument": { "Statement": [ { "Action": "ssm:GetParameters", "Effect": "Allow", "Resource": [ { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":ssm:", { "Ref": "AWS::Region" }, ":", { "Ref": "AWS::AccountId" }, ":parameter/", { "Ref": "moduleinputsconstructssmroute53hostedzonename917E8884" } ] ] }, { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":ssm:", { "Ref": "AWS::Region" }, ":", { "Ref": "AWS::AccountId" }, ":parameter/", { "Ref": "moduleinputsconstructssmfullyqualifieddomainname6F31B012" } ] ] }, { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":ssm:", { "Ref": "AWS::Region" }, ":", { "Ref": "AWS::AccountId" }, ":parameter/", { "Ref": "moduleinputsconstructssmacmcustomcertificatearn8344C6B1" } ] ] }, { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":ssm:", { "Ref": "AWS::Region" }, ":", { "Ref": "AWS::AccountId" }, ":parameter/", { "Ref": "moduleinputsconstructssmispublicfacing787E6E85" } ] ] } ] }, { "Action": "ec2:CreateNetworkInterfacePermission", "Condition": { "StringEquals": { "ec2:Subnet": [ { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":ec2:", { "Ref": "AWS::Region" }, ":", { "Ref": "AWS::AccountId" }, ":subnet/{{resolve:ssm:/solution/vpc/", { "Ref": "VpcName" }, "/subnets/private/1}}" ] ] }, { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":ec2:", { "Ref": "AWS::Region" }, ":", { "Ref": "AWS::AccountId" }, ":subnet/{{resolve:ssm:/solution/vpc/", { "Ref": "VpcName" }, "/subnets/private/2}}" ] ] } ], "ec2:AuthorizedService": "codebuild.amazonaws.com" } }, "Effect": "Allow", "Resource": { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":ec2:", { "Ref": "AWS::Region" }, ":", { "Ref": "AWS::AccountId" }, ":network-interface/*" ] ] } }, { "Action": [ "logs:CreateLogGroup", "logs:CreateLogStream", "logs:PutLogEvents" ], "Effect": "Allow", "Resource": [ { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":logs:", { "Ref": "AWS::Region" }, ":", { "Ref": "AWS::AccountId" }, ":log-group:/aws/codebuild/", { "Ref": "acdppipelinesconstructbackstagedeploypipelineproject3068AE0E" } ] ] }, { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":logs:", { "Ref": "AWS::Region" }, ":", { "Ref": "AWS::AccountId" }, ":log-group:/aws/codebuild/", { "Ref": "acdppipelinesconstructbackstagedeploypipelineproject3068AE0E" }, ":*" ] ] } ] }, { "Action": [ "codebuild:CreateReportGroup", "codebuild:CreateReport", "codebuild:UpdateReport", "codebuild:BatchPutTestCases", "codebuild:BatchPutCodeCoverages" ], "Effect": "Allow", "Resource": { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":codebuild:", { "Ref": "AWS::Region" }, ":", { "Ref": "AWS::AccountId" }, ":report-group/", { "Ref": "acdppipelinesconstructbackstagedeploypipelineproject3068AE0E" }, "-*" ] ] } }, { "Action": [ "kms:Decrypt", "kms:Encrypt", "kms:ReEncrypt*", "kms:GenerateDataKey*" ], "Effect": "Allow", "Resource": { "Fn::GetAtt": [ "acdppipelinesconstructbackstagedeploykey6400441D", "Arn" ] } }, { "Action": [ "s3:GetObject*", "s3:GetBucket*", "s3:List*" ], "Effect": "Allow", "Resource": [ { "Fn::GetAtt": [ "acdppipelinesconstructbackstagecodepipelineArtifactsBucket9777AC61", "Arn" ] }, { "Fn::Join": [ "", [ { "Fn::GetAtt": [ "acdppipelinesconstructbackstagecodepipelineArtifactsBucket9777AC61", "Arn" ] }, "/*" ] ] } ] }, { "Action": [ "kms:Decrypt", "kms:DescribeKey" ], "Effect": "Allow", "Resource": { "Fn::GetAtt": [ "acdppipelinesconstructbackstagecodepipelineArtifactsBucketEncryptionKeyF6DDC81C", "Arn" ] } } ], "Version": "2012-10-17" }, "PolicyName": "acdppipelinesconstructbackstagedeployroleDefaultPolicy79C58584", "Roles": [ { "Ref": "acdppipelinesconstructbackstagedeployroleC909101A" } ] }, "DependsOn": [ "acdpbackstageassetsconstructbackstagedefaultusersandgroupscustomresource72402F10", "acdpbackstageassetsconstructbackstagetemplateassetscopycustomresource32AF3B04", "acdpbackstageassetsconstructdeploymentbackstagezipassetB64A29C2", "acdpbackstageassetsconstructs3policyA50772A6", "ssmappuniqueidD1DCE51D" ], "Metadata": { "aws:cdk:path": "acdp/acdp/pipelines-construct/backstage-deploy-role/DefaultPolicy/Resource", "cdk_nag": { "rules_to_suppress": [ { "id": "AwsSolutions-IAM5", "appliesTo": [ "Action::kms:GenerateDataKey*", "Action::kms:ReEncrypt*", "Resource::arn::codebuild:::report-group/-*", "Resource::arn::logs:::log-group:/aws/codebuild/:*", "Resource::/*", "Action::s3:Abort*", "Action::s3:DeleteObject*", "Action::s3:List*", "Action::s3:GetBucket*", "Action::s3:GetObject*", "Action::ecr:*", "Resource::*", "Resource::arn::ec2:::network-interface/*", "Resource::arn::logs:::log-group:/aws/codebuild/:*", "Resource::arn::codebuild:::report-group/-*", "Resource::/*" ], "reason": "Pipelines default role policy is least privilege." } ] } } }, "acdppipelinesconstructbackstagebuildkey53146B85": { "Type": "AWS::KMS::Key", "Properties": { "EnableKeyRotation": true, "KeyPolicy": { "Statement": [ { "Action": "kms:*", "Effect": "Allow", "Principal": { "AWS": { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":iam::", { "Ref": "AWS::AccountId" }, ":root" ] ] } }, "Resource": "*" } ], "Version": "2012-10-17" }, "Tags": [ { "Key": "awsApplication", "Value": { "Fn::GetAtt": [ "acdpappregistryappregistryapplication0BC5FAC5", "ApplicationTagValue" ] } }, { "Key": "Solutions:ApplicationType", "Value": "AWS-Solutions" }, { "Key": "Solutions:DeploymentUUID", "Value": { "Fn::GetAtt": [ "deploymentuuidconstructdeploymentuuidcustomresourceC885F329", "SolutionUUID" ] } }, { "Key": "Solutions:ModuleName", "Value": "acdp" }, { "Key": "Solutions:SolutionID", "Value": "SO0241" }, { "Key": "Solutions:SolutionName", "Value": "connected-mobility-solution-on-aws" }, { "Key": "Solutions:SolutionVersion", "Value": "v2.1.5" } ] }, "DependsOn": [ "acdpbackstageassetsconstructbackstagedefaultusersandgroupscustomresource72402F10", "acdpbackstageassetsconstructbackstagetemplateassetscopycustomresource32AF3B04", "acdpbackstageassetsconstructdeploymentbackstagezipassetB64A29C2", "acdpbackstageassetsconstructs3policyA50772A6", "ssmappuniqueidD1DCE51D" ], "UpdateReplacePolicy": "Retain", "DeletionPolicy": "Retain", "Metadata": { "aws:cdk:path": "acdp/acdp/pipelines-construct/backstage-build-key/Resource" } }, "acdppipelinesconstructbackstagebuildrole470B2DCB": { "Type": "AWS::IAM::Role", "Properties": { "AssumeRolePolicyDocument": { "Statement": [ { "Action": "sts:AssumeRole", "Effect": "Allow", "Principal": { "Service": "codebuild.amazonaws.com" } } ], "Version": "2012-10-17" }, "Description": "Backstage Build Role", "Policies": [ { "PolicyDocument": { "Statement": [ { "Action": "secretsmanager:GetSecretValue", "Effect": "Allow", "Resource": { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":secretsmanager:", { "Ref": "AWS::Region" }, ":", { "Ref": "AWS::AccountId" }, ":secret:solution/", { "Ref": "AcdpUniqueId" }, "/*" ] ] } } ], "Version": "2012-10-17" }, "PolicyName": "backstage-build-secretsmanager-policy" }, { "PolicyDocument": { "Statement": [ { "Action": [ "ssm:GetParameters", "ssm:GetParameter" ], "Effect": "Allow", "Resource": { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":ssm:", { "Ref": "AWS::Region" }, ":", { "Ref": "AWS::AccountId" }, ":parameter/solution/", { "Ref": "AcdpUniqueId" }, "/*" ] ] } } ], "Version": "2012-10-17" }, "PolicyName": "backstage-build-ssm-policy" } ], "Tags": [ { "Key": "awsApplication", "Value": { "Fn::GetAtt": [ "acdpappregistryappregistryapplication0BC5FAC5", "ApplicationTagValue" ] } }, { "Key": "Solutions:ApplicationType", "Value": "AWS-Solutions" }, { "Key": "Solutions:DeploymentUUID", "Value": { "Fn::GetAtt": [ "deploymentuuidconstructdeploymentuuidcustomresourceC885F329", "SolutionUUID" ] } }, { "Key": "Solutions:ModuleName", "Value": "acdp" }, { "Key": "Solutions:SolutionID", "Value": "SO0241" }, { "Key": "Solutions:SolutionName", "Value": "connected-mobility-solution-on-aws" }, { "Key": "Solutions:SolutionVersion", "Value": "v2.1.5" } ] }, "DependsOn": [ "acdpbackstageassetsconstructbackstagedefaultusersandgroupscustomresource72402F10", "acdpbackstageassetsconstructbackstagetemplateassetscopycustomresource32AF3B04", "acdpbackstageassetsconstructdeploymentbackstagezipassetB64A29C2", "acdpbackstageassetsconstructs3policyA50772A6", "ssmappuniqueidD1DCE51D" ], "Metadata": { "aws:cdk:path": "acdp/acdp/pipelines-construct/backstage-build-role/Resource", "cdk_nag": { "rules_to_suppress": [ { "id": "AwsSolutions-IAM5", "appliesTo": [ "Action::secretsmanager:*", "Action::ssm:*", "Resource::arn::ssm:::*", "Resource::arn::ssm:::parameter/acdp/config/*", "Resource::arn::secretsmanager:::secret:/acdp/config/*", "Resource::arn::secretsmanager:::secret:solution//*", "Resource::arn::ssm:::parameter/solution//*" ], "reason": "Pipeline creates and reads multiple secrets and SSM parameters." } ] } } }, "acdppipelinesconstructbackstagebuildroleDefaultPolicyEF6D76B7": { "Type": "AWS::IAM::Policy", "Properties": { "PolicyDocument": { "Statement": [ { "Action": "ec2:CreateNetworkInterfacePermission", "Condition": { "StringEquals": { "ec2:Subnet": [ { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":ec2:", { "Ref": "AWS::Region" }, ":", { "Ref": "AWS::AccountId" }, ":subnet/{{resolve:ssm:/solution/vpc/", { "Ref": "VpcName" }, "/subnets/private/1}}" ] ] }, { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":ec2:", { "Ref": "AWS::Region" }, ":", { "Ref": "AWS::AccountId" }, ":subnet/{{resolve:ssm:/solution/vpc/", { "Ref": "VpcName" }, "/subnets/private/2}}" ] ] } ], "ec2:AuthorizedService": "codebuild.amazonaws.com" } }, "Effect": "Allow", "Resource": { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":ec2:", { "Ref": "AWS::Region" }, ":", { "Ref": "AWS::AccountId" }, ":network-interface/*" ] ] } }, { "Action": [ "logs:CreateLogGroup", "logs:CreateLogStream", "logs:PutLogEvents" ], "Effect": "Allow", "Resource": [ { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":logs:", { "Ref": "AWS::Region" }, ":", { "Ref": "AWS::AccountId" }, ":log-group:/aws/codebuild/", { "Ref": "acdppipelinesconstructbackstagebuildpipelineproject8C07A386" } ] ] }, { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":logs:", { "Ref": "AWS::Region" }, ":", { "Ref": "AWS::AccountId" }, ":log-group:/aws/codebuild/", { "Ref": "acdppipelinesconstructbackstagebuildpipelineproject8C07A386" }, ":*" ] ] } ] }, { "Action": [ "codebuild:CreateReportGroup", "codebuild:CreateReport", "codebuild:UpdateReport", "codebuild:BatchPutTestCases", "codebuild:BatchPutCodeCoverages" ], "Effect": "Allow", "Resource": { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":codebuild:", { "Ref": "AWS::Region" }, ":", { "Ref": "AWS::AccountId" }, ":report-group/", { "Ref": "acdppipelinesconstructbackstagebuildpipelineproject8C07A386" }, "-*" ] ] } }, { "Action": [ "kms:Decrypt", "kms:Encrypt", "kms:ReEncrypt*", "kms:GenerateDataKey*" ], "Effect": "Allow", "Resource": { "Fn::GetAtt": [ "acdppipelinesconstructbackstagebuildkey53146B85", "Arn" ] } }, { "Action": [ "ecr:BatchCheckLayerAvailability", "ecr:GetDownloadUrlForLayer", "ecr:BatchGetImage", "ecr:CompleteLayerUpload", "ecr:UploadLayerPart", "ecr:InitiateLayerUpload", "ecr:PutImage" ], "Effect": "Allow", "Resource": { "Fn::GetAtt": [ "acdppipelinesconstructbackstageecrA3584D57", "Arn" ] } }, { "Action": "ecr:GetAuthorizationToken", "Effect": "Allow", "Resource": "*" }, { "Action": "ecr:*", "Effect": "Allow", "Resource": { "Fn::GetAtt": [ "acdppipelinesconstructbackstageecrA3584D57", "Arn" ] } }, { "Action": [ "s3:GetObject*", "s3:GetBucket*", "s3:List*" ], "Effect": "Allow", "Resource": [ { "Fn::GetAtt": [ "acdppipelinesconstructbackstagecodepipelineArtifactsBucket9777AC61", "Arn" ] }, { "Fn::Join": [ "", [ { "Fn::GetAtt": [ "acdppipelinesconstructbackstagecodepipelineArtifactsBucket9777AC61", "Arn" ] }, "/*" ] ] } ] }, { "Action": [ "kms:Decrypt", "kms:DescribeKey" ], "Effect": "Allow", "Resource": { "Fn::GetAtt": [ "acdppipelinesconstructbackstagecodepipelineArtifactsBucketEncryptionKeyF6DDC81C", "Arn" ] } } ], "Version": "2012-10-17" }, "PolicyName": "acdppipelinesconstructbackstagebuildroleDefaultPolicyEF6D76B7", "Roles": [ { "Ref": "acdppipelinesconstructbackstagebuildrole470B2DCB" } ] }, "DependsOn": [ "acdpbackstageassetsconstructbackstagedefaultusersandgroupscustomresource72402F10", "acdpbackstageassetsconstructbackstagetemplateassetscopycustomresource32AF3B04", "acdpbackstageassetsconstructdeploymentbackstagezipassetB64A29C2", "acdpbackstageassetsconstructs3policyA50772A6", "ssmappuniqueidD1DCE51D" ], "Metadata": { "aws:cdk:path": "acdp/acdp/pipelines-construct/backstage-build-role/DefaultPolicy/Resource", "cdk_nag": { "rules_to_suppress": [ { "id": "AwsSolutions-IAM5", "appliesTo": [ "Action::kms:GenerateDataKey*", "Action::kms:ReEncrypt*", "Resource::arn::codebuild:::report-group/-*", "Resource::arn::logs:::log-group:/aws/codebuild/:*", "Resource::/*", "Action::s3:Abort*", "Action::s3:DeleteObject*", "Action::s3:List*", "Action::s3:GetBucket*", "Action::s3:GetObject*", "Action::ecr:*", "Resource::*", "Resource::arn::ec2:::network-interface/*", "Resource::arn::secretsmanager:::secret:solution//*", "Resource::arn::ssm:::parameter:solution//*", "Resource::/*", "Resource::arn::logs:::log-group:/aws/codebuild/:*", "Resource::arn::codebuild:::report-group/-*" ], "reason": "Pipelines default role policy is least privilege." } ] } } }, "acdppipelinesconstructbackstagebuildpipelineproject8C07A386": { "Type": "AWS::CodeBuild::Project", "Properties": { "Artifacts": { "Type": "CODEPIPELINE" }, "Cache": { "Modes": [ "LOCAL_DOCKER_LAYER_CACHE", "LOCAL_CUSTOM_CACHE" ], "Type": "LOCAL" }, "EncryptionKey": { "Fn::GetAtt": [ "acdppipelinesconstructbackstagebuildkey53146B85", "Arn" ] }, "Environment": { "ComputeType": "BUILD_GENERAL1_LARGE", "EnvironmentVariables": [ { "Name": "DOCKER_BUILDKIT", "Type": "PLAINTEXT", "Value": "1" }, { "Name": "IMAGE_NAME", "Type": "PLAINTEXT", "Value": { "Ref": "acdppipelinesconstructbackstageecrA3584D57" } }, { "Name": "IMAGE_TAG", "Type": "PLAINTEXT", "Value": "latest" }, { "Name": "AWS_DEFAULT_REGION", "Type": "PLAINTEXT", "Value": { "Ref": "AWS::Region" } }, { "Name": "AWS_ACCOUNT_ID", "Type": "PLAINTEXT", "Value": { "Ref": "AWS::AccountId" } }, { "Name": "NODE_OPTIONS", "Type": "PLAINTEXT", "Value": "--max-old-space-size=8192" } ], "Image": "aws/codebuild/standard:7.0", "ImagePullCredentialsType": "CODEBUILD", "PrivilegedMode": true, "Type": "LINUX_CONTAINER" }, "Name": "backstage-build-image", "ServiceRole": { "Fn::GetAtt": [ "acdppipelinesconstructbackstagebuildrole470B2DCB", "Arn" ] }, "Source": { "BuildSpec": "./source/modules/backstage/cdk/source/infrastructure/buildspecs/backstage_image_buildspec.json", "Type": "CODEPIPELINE" }, "Tags": [ { "Key": "awsApplication", "Value": { "Fn::GetAtt": [ "acdpappregistryappregistryapplication0BC5FAC5", "ApplicationTagValue" ] } }, { "Key": "Solutions:ApplicationType", "Value": "AWS-Solutions" }, { "Key": "Solutions:DeploymentUUID", "Value": { "Fn::GetAtt": [ "deploymentuuidconstructdeploymentuuidcustomresourceC885F329", "SolutionUUID" ] } }, { "Key": "Solutions:ModuleName", "Value": "acdp" }, { "Key": "Solutions:SolutionID", "Value": "SO0241" }, { "Key": "Solutions:SolutionName", "Value": "connected-mobility-solution-on-aws" }, { "Key": "Solutions:SolutionVersion", "Value": "v2.1.5" } ], "VpcConfig": { "SecurityGroupIds": [ { "Fn::GetAtt": [ "acdppipelinesconstructbackstagecodebuildsecuritygroupE511867D", "GroupId" ] } ], "Subnets": [ { "Fn::Join": [ "", [ "{{resolve:ssm:/solution/vpc/", { "Ref": "VpcName" }, "/subnets/private/1}}" ] ] }, { "Fn::Join": [ "", [ "{{resolve:ssm:/solution/vpc/", { "Ref": "VpcName" }, "/subnets/private/2}}" ] ] } ], "VpcId": { "Fn::Join": [ "", [ "{{resolve:ssm:/solution/vpc/", { "Ref": "VpcName" }, "/vpcid}}" ] ] } } }, "DependsOn": [ "acdpbackstageassetsconstructbackstagedefaultusersandgroupscustomresource72402F10", "acdpbackstageassetsconstructbackstagetemplateassetscopycustomresource32AF3B04", "acdpbackstageassetsconstructdeploymentbackstagezipassetB64A29C2", "acdpbackstageassetsconstructs3policyA50772A6", "acdppipelinesconstructbackstagebuildpipelineprojectPolicyDocument67EA1C00", "ssmappuniqueidD1DCE51D" ], "Metadata": { "aws:cdk:path": "acdp/acdp/pipelines-construct/backstage-build-pipeline-project/Resource", "cdk_nag": { "rules_to_suppress": [ { "id": "AwsSolutions-CB3", "reason": "The CodeBuild project has privileged mode enabled." } ] } } }, "acdppipelinesconstructbackstagebuildpipelineprojectPolicyDocument67EA1C00": { "Type": "AWS::IAM::Policy", "Properties": { "PolicyDocument": { "Statement": [ { "Action": [ "ec2:CreateNetworkInterface", "ec2:DescribeNetworkInterfaces", "ec2:DeleteNetworkInterface", "ec2:DescribeSubnets", "ec2:DescribeSecurityGroups", "ec2:DescribeDhcpOptions", "ec2:DescribeVpcs" ], "Effect": "Allow", "Resource": "*" } ], "Version": "2012-10-17" }, "PolicyName": "acdppipelinesconstructbackstagebuildpipelineprojectPolicyDocument67EA1C00", "Roles": [ { "Ref": "acdppipelinesconstructbackstagebuildrole470B2DCB" } ] }, "DependsOn": [ "acdpbackstageassetsconstructbackstagedefaultusersandgroupscustomresource72402F10", "acdpbackstageassetsconstructbackstagetemplateassetscopycustomresource32AF3B04", "acdpbackstageassetsconstructdeploymentbackstagezipassetB64A29C2", "acdpbackstageassetsconstructs3policyA50772A6", "ssmappuniqueidD1DCE51D" ], "Metadata": { "aws:cdk:path": "acdp/acdp/pipelines-construct/backstage-build-pipeline-project/PolicyDocument/Resource", "cdk_nag": { "rules_to_suppress": [ { "id": "AwsSolutions-IAM5", "appliesTo": [ "Resource::*" ], "reason": "Pipelines project default role policy is least privilege." } ] } } }, "acdppipelinesconstructvalidatemultiaccountparameters65AFB1B6": { "Type": "Custom::ValidateMultiAccountParameters", "Properties": { "ServiceToken": { "Fn::GetAtt": [ "customresourceconstructlambdafunction78B09163", "Arn" ] }, "Resource": "ValidateMultiAccountParameters", "EnableMultiAccountDeployment": { "Ref": "EnableMultiAccountDeployment" }, "OrgsManagementAwsAccountId": { "Ref": "OrgsManagementAwsAccountId" }, "OrgsManagementAccountRegion": { "Ref": "OrgsManagementAccountRegion" } }, "DependsOn": [ "acdpbackstageassetsconstructbackstagedefaultusersandgroupscustomresource72402F10", "acdpbackstageassetsconstructbackstagetemplateassetscopycustomresource32AF3B04", "acdpbackstageassetsconstructdeploymentbackstagezipassetB64A29C2", "acdpbackstageassetsconstructs3policyA50772A6", "ssmappuniqueidD1DCE51D" ], "UpdateReplacePolicy": "Delete", "DeletionPolicy": "Delete", "Metadata": { "aws:cdk:path": "acdp/acdp/pipelines-construct/validate-multi-account-parameters/Default" } }, "acdppipelinesconstructbackstagedeploykey6400441D": { "Type": "AWS::KMS::Key", "Properties": { "EnableKeyRotation": true, "KeyPolicy": { "Statement": [ { "Action": "kms:*", "Effect": "Allow", "Principal": { "AWS": { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":iam::", { "Ref": "AWS::AccountId" }, ":root" ] ] } }, "Resource": "*" } ], "Version": "2012-10-17" }, "Tags": [ { "Key": "awsApplication", "Value": { "Fn::GetAtt": [ "acdpappregistryappregistryapplication0BC5FAC5", "ApplicationTagValue" ] } }, { "Key": "Solutions:ApplicationType", "Value": "AWS-Solutions" }, { "Key": "Solutions:DeploymentUUID", "Value": { "Fn::GetAtt": [ "deploymentuuidconstructdeploymentuuidcustomresourceC885F329", "SolutionUUID" ] } }, { "Key": "Solutions:ModuleName", "Value": "acdp" }, { "Key": "Solutions:SolutionID", "Value": "SO0241" }, { "Key": "Solutions:SolutionName", "Value": "connected-mobility-solution-on-aws" }, { "Key": "Solutions:SolutionVersion", "Value": "v2.1.5" } ] }, "DependsOn": [ "acdpbackstageassetsconstructbackstagedefaultusersandgroupscustomresource72402F10", "acdpbackstageassetsconstructbackstagetemplateassetscopycustomresource32AF3B04", "acdpbackstageassetsconstructdeploymentbackstagezipassetB64A29C2", "acdpbackstageassetsconstructs3policyA50772A6", "ssmappuniqueidD1DCE51D" ], "UpdateReplacePolicy": "Retain", "DeletionPolicy": "Retain", "Metadata": { "aws:cdk:path": "acdp/acdp/pipelines-construct/backstage-deploy-key/Resource" } }, "acdppipelinesconstructbackstagedeploypipelineproject3068AE0E": { "Type": "AWS::CodeBuild::Project", "Properties": { "Artifacts": { "Type": "CODEPIPELINE" }, "Cache": { "Type": "NO_CACHE" }, "EncryptionKey": { "Fn::GetAtt": [ "acdppipelinesconstructbackstagedeploykey6400441D", "Arn" ] }, "Environment": { "ComputeType": "BUILD_GENERAL1_LARGE", "EnvironmentVariables": [ { "Name": "ACDP_UNIQUE_ID", "Type": "PLAINTEXT", "Value": { "Ref": "AcdpUniqueId" } }, { "Name": "VPC_NAME", "Type": "PLAINTEXT", "Value": { "Ref": "VpcName" } }, { "Name": "IDENTITY_PROVIDER_ID", "Type": "PLAINTEXT", "Value": { "Ref": "IdentityProviderId" } }, { "Name": "ADMIN_USER_EMAIL", "Type": "PLAINTEXT", "Value": { "Ref": "AdminUserEmail" } }, { "Name": "SHOULD_CREATE_COGNITO_USER", "Type": "PLAINTEXT", "Value": { "Ref": "ShouldCreateCognitoUser" } }, { "Name": "AWS_REGION", "Type": "PLAINTEXT", "Value": { "Ref": "AWS::Region" } }, { "Name": "AWS_ACCOUNT_ID", "Type": "PLAINTEXT", "Value": { "Ref": "AWS::AccountId" } }, { "Name": "NODE_OPTIONS", "Type": "PLAINTEXT", "Value": "--max-old-space-size=8192" }, { "Name": "CLOUDFORMATION_ROLE_ARN", "Type": "PLAINTEXT", "Value": { "Fn::GetAtt": [ "acdpcloudformationroleC3BA7F88", "Arn" ] } }, { "Name": "SOLUTION_ID", "Type": "PLAINTEXT", "Value": "SO0241" }, { "Name": "SOLUTION_VERSION", "Type": "PLAINTEXT", "Value": "v2.1.5" }, { "Name": "SOLUTION_NAME", "Type": "PLAINTEXT", "Value": "connected-mobility-solution-on-aws" }, { "Name": "APPLICATION_TYPE", "Type": "PLAINTEXT", "Value": "AWS-Solutions" }, { "Name": "REGIONAL_ASSET_BUCKET_BASE_NAME", "Type": "PLAINTEXT", "Value": { "Fn::FindInMap": [ "Solution", "AssetsConfig", "S3AssetBucketBaseName" ] } }, { "Name": "LOCAL_ASSET_BUCKET_NAME", "Type": "PLAINTEXT", "Value": { "Ref": "backstageassetbucketconstructencryptedbucket8BE77EF0" } }, { "Name": "BACKSTAGE_IMAGE_TAG", "Type": "PLAINTEXT", "Value": "latest" }, { "Name": "ROUTE53_HOSTED_ZONE_ID", "Type": "PARAMETER_STORE", "Value": { "Ref": "moduleinputsconstructssmroute53hostedzonename917E8884" } }, { "Name": "FULLY_QUALIFIED_DOMAIN_NAME", "Type": "PARAMETER_STORE", "Value": { "Ref": "moduleinputsconstructssmfullyqualifieddomainname6F31B012" } }, { "Name": "CUSTOM_ACM_CERTIFICATE_ARN", "Type": "PARAMETER_STORE", "Value": { "Ref": "moduleinputsconstructssmacmcustomcertificatearn8344C6B1" } }, { "Name": "IS_PUBLIC_FACING", "Type": "PARAMETER_STORE", "Value": { "Ref": "moduleinputsconstructssmispublicfacing787E6E85" } }, { "Name": "ENABLE_MULTI_ACCOUNT_DEPLOYMENT", "Type": "PLAINTEXT", "Value": { "Ref": "EnableMultiAccountDeployment" } }, { "Name": "LOG_BUCKET_RETENTION_DAYS", "Type": "PLAINTEXT", "Value": { "Ref": "S3LogExpirationDays" } } ], "Image": "aws/codebuild/standard:7.0", "ImagePullCredentialsType": "CODEBUILD", "PrivilegedMode": false, "Type": "LINUX_CONTAINER" }, "Name": "backstage-deploy-project", "ServiceRole": { "Fn::GetAtt": [ "acdppipelinesconstructbackstagedeployroleC909101A", "Arn" ] }, "Source": { "BuildSpec": "./source/modules/backstage/cdk/source/infrastructure/buildspecs/backstage_deploy_buildspec.json", "Type": "CODEPIPELINE" }, "Tags": [ { "Key": "awsApplication", "Value": { "Fn::GetAtt": [ "acdpappregistryappregistryapplication0BC5FAC5", "ApplicationTagValue" ] } }, { "Key": "Solutions:ApplicationType", "Value": "AWS-Solutions" }, { "Key": "Solutions:DeploymentUUID", "Value": { "Fn::GetAtt": [ "deploymentuuidconstructdeploymentuuidcustomresourceC885F329", "SolutionUUID" ] } }, { "Key": "Solutions:ModuleName", "Value": "acdp" }, { "Key": "Solutions:SolutionID", "Value": "SO0241" }, { "Key": "Solutions:SolutionName", "Value": "connected-mobility-solution-on-aws" }, { "Key": "Solutions:SolutionVersion", "Value": "v2.1.5" } ], "VpcConfig": { "SecurityGroupIds": [ { "Fn::GetAtt": [ "acdppipelinesconstructbackstagecodebuildsecuritygroupE511867D", "GroupId" ] } ], "Subnets": [ { "Fn::Join": [ "", [ "{{resolve:ssm:/solution/vpc/", { "Ref": "VpcName" }, "/subnets/private/1}}" ] ] }, { "Fn::Join": [ "", [ "{{resolve:ssm:/solution/vpc/", { "Ref": "VpcName" }, "/subnets/private/2}}" ] ] } ], "VpcId": { "Fn::Join": [ "", [ "{{resolve:ssm:/solution/vpc/", { "Ref": "VpcName" }, "/vpcid}}" ] ] } } }, "DependsOn": [ "acdpbackstageassetsconstructbackstagedefaultusersandgroupscustomresource72402F10", "acdpbackstageassetsconstructbackstagetemplateassetscopycustomresource32AF3B04", "acdpbackstageassetsconstructdeploymentbackstagezipassetB64A29C2", "acdpbackstageassetsconstructs3policyA50772A6", "acdppipelinesconstructbackstagedeploypipelineprojectPolicyDocumentB45C6A12", "acdppipelinesconstructvalidatemultiaccountparameters65AFB1B6", "ssmappuniqueidD1DCE51D" ], "Metadata": { "aws:cdk:path": "acdp/acdp/pipelines-construct/backstage-deploy-pipeline-project/Resource" } }, "acdppipelinesconstructbackstagedeploypipelineprojectPolicyDocumentB45C6A12": { "Type": "AWS::IAM::Policy", "Properties": { "PolicyDocument": { "Statement": [ { "Action": [ "ec2:CreateNetworkInterface", "ec2:DescribeNetworkInterfaces", "ec2:DeleteNetworkInterface", "ec2:DescribeSubnets", "ec2:DescribeSecurityGroups", "ec2:DescribeDhcpOptions", "ec2:DescribeVpcs" ], "Effect": "Allow", "Resource": "*" } ], "Version": "2012-10-17" }, "PolicyName": "acdppipelinesconstructbackstagedeploypipelineprojectPolicyDocumentB45C6A12", "Roles": [ { "Ref": "acdppipelinesconstructbackstagedeployroleC909101A" } ] }, "DependsOn": [ "acdpbackstageassetsconstructbackstagedefaultusersandgroupscustomresource72402F10", "acdpbackstageassetsconstructbackstagetemplateassetscopycustomresource32AF3B04", "acdpbackstageassetsconstructdeploymentbackstagezipassetB64A29C2", "acdpbackstageassetsconstructs3policyA50772A6", "acdppipelinesconstructvalidatemultiaccountparameters65AFB1B6", "ssmappuniqueidD1DCE51D" ], "Metadata": { "aws:cdk:path": "acdp/acdp/pipelines-construct/backstage-deploy-pipeline-project/PolicyDocument/Resource", "cdk_nag": { "rules_to_suppress": [ { "id": "AwsSolutions-IAM5", "appliesTo": [ "Resource::*" ], "reason": "Pipelines project default role policy is least privilege." } ] } } }, "acdppipelinesconstructbackstagepipelineroleC81291F3": { "Type": "AWS::IAM::Role", "Properties": { "AssumeRolePolicyDocument": { "Statement": [ { "Action": "sts:AssumeRole", "Effect": "Allow", "Principal": { "Service": "codepipeline.amazonaws.com" } } ], "Version": "2012-10-17" }, "Description": "Backstage Pipeline Role", "Policies": [ { "PolicyDocument": { "Statement": [ { "Action": [ "s3:GetBucketAcl", "s3:GetBucketLocation", "s3:GetBucketVersioning", "s3:GetObject", "s3:GetObjectAcl", "s3:GetObjectAttributes", "s3:GetObjectVersion", "s3:GetObjectVersionAcl", "s3:GetObjectVersionTagging", "s3:ListAllMyBuckets", "s3:ListBucket", "s3:ListBucketVersions" ], "Effect": "Allow", "Resource": [ { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":s3:::", { "Ref": "backstageassetbucketconstructencryptedbucket8BE77EF0" } ] ] }, { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":s3:::", { "Ref": "backstageassetbucketconstructencryptedbucket8BE77EF0" }, "/", { "Fn::GetAtt": [ "acdpbackstageassetsconstructdeploymentbackstagezipassetB64A29C2", "DestinationKey" ] } ] ] } ] } ], "Version": "2012-10-17" }, "PolicyName": "backstage-s3-asset" }, { "PolicyDocument": { "Statement": [ { "Action": "secretsmanager:GetSecretValue", "Effect": "Allow", "Resource": { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":secretsmanager:", { "Ref": "AWS::Region" }, ":", { "Ref": "AWS::AccountId" }, ":secret:solution/", { "Ref": "AcdpUniqueId" }, "/*" ] ] } } ], "Version": "2012-10-17" }, "PolicyName": "backstage-pipeline-role" }, { "PolicyDocument": { "Statement": [ { "Action": [ "ssm:GetParameter", "ssm:GetParameters" ], "Effect": "Allow", "Resource": { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":ssm:", { "Ref": "AWS::Region" }, ":", { "Ref": "AWS::AccountId" }, ":parameter/solution/", { "Ref": "AcdpUniqueId" }, "/*" ] ] } } ], "Version": "2012-10-17" }, "PolicyName": "backstage-pipeline-ssm-policy" } ], "RoleName": { "Fn::Join": [ "", [ { "Ref": "AWS::StackName" }, "-", { "Ref": "AWS::Region" }, "-backstage-codepipeline" ] ] }, "Tags": [ { "Key": "awsApplication", "Value": { "Fn::GetAtt": [ "acdpappregistryappregistryapplication0BC5FAC5", "ApplicationTagValue" ] } }, { "Key": "Solutions:ApplicationType", "Value": "AWS-Solutions" }, { "Key": "Solutions:DeploymentUUID", "Value": { "Fn::GetAtt": [ "deploymentuuidconstructdeploymentuuidcustomresourceC885F329", "SolutionUUID" ] } }, { "Key": "Solutions:ModuleName", "Value": "acdp" }, { "Key": "Solutions:SolutionID", "Value": "SO0241" }, { "Key": "Solutions:SolutionName", "Value": "connected-mobility-solution-on-aws" }, { "Key": "Solutions:SolutionVersion", "Value": "v2.1.5" } ] }, "DependsOn": [ "acdpbackstageassetsconstructbackstagedefaultusersandgroupscustomresource72402F10", "acdpbackstageassetsconstructbackstagetemplateassetscopycustomresource32AF3B04", "acdpbackstageassetsconstructdeploymentbackstagezipassetB64A29C2", "acdpbackstageassetsconstructs3policyA50772A6", "ssmappuniqueidD1DCE51D" ], "Metadata": { "aws:cdk:path": "acdp/acdp/pipelines-construct/backstage-pipeline-role/Resource", "cdk_nag": { "rules_to_suppress": [ { "id": "AwsSolutions-IAM5", "appliesTo": [ "Action::secretsmanager:*", "Resource::arn::secretsmanager:::secret:/dev/cms-backstage/*", "Resource::arn::secretsmanager:::secret:cms/*", "Resource::arn::ssm:::parameter:/dev/acdp-stack-dev/*", "Resource::arn::secretsmanager:::secret:solution//*", "Resource::arn::ssm:::parameter/solution//*" ], "reason": "Pipeline creates and reads multiple secrets and SSM parameters." } ] } } }, "acdppipelinesconstructbackstagepipelineroleDefaultPolicy5CCDEA82": { "Type": "AWS::IAM::Policy", "Properties": { "PolicyDocument": { "Statement": [ { "Action": [ "s3:GetObject*", "s3:GetBucket*", "s3:List*", "s3:DeleteObject*", "s3:PutObject", "s3:PutObjectLegalHold", "s3:PutObjectRetention", "s3:PutObjectTagging", "s3:PutObjectVersionTagging", "s3:Abort*" ], "Effect": "Allow", "Resource": [ { "Fn::GetAtt": [ "acdppipelinesconstructbackstagecodepipelineArtifactsBucket9777AC61", "Arn" ] }, { "Fn::Join": [ "", [ { "Fn::GetAtt": [ "acdppipelinesconstructbackstagecodepipelineArtifactsBucket9777AC61", "Arn" ] }, "/*" ] ] } ] }, { "Action": [ "kms:Decrypt", "kms:DescribeKey", "kms:Encrypt", "kms:ReEncrypt*", "kms:GenerateDataKey*" ], "Effect": "Allow", "Resource": { "Fn::GetAtt": [ "acdppipelinesconstructbackstagecodepipelineArtifactsBucketEncryptionKeyF6DDC81C", "Arn" ] } }, { "Action": "sts:AssumeRole", "Effect": "Allow", "Resource": { "Fn::GetAtt": [ "acdppipelinesconstructbackstagecodepipelineSourceStageBackstageS3SourceBackstageAssetCodePipelineActionRole111364E2", "Arn" ] } }, { "Action": "sts:AssumeRole", "Effect": "Allow", "Resource": { "Fn::GetAtt": [ "acdppipelinesconstructbackstagecodepipelineBuildStageBackstageBuildImageCodePipelineActionRole350B235B", "Arn" ] } }, { "Action": "sts:AssumeRole", "Effect": "Allow", "Resource": { "Fn::GetAtt": [ "acdppipelinesconstructbackstagecodepipelineDeployStageBackstageDeployCodePipelineActionRole5B9646C2", "Arn" ] } } ], "Version": "2012-10-17" }, "PolicyName": "acdppipelinesconstructbackstagepipelineroleDefaultPolicy5CCDEA82", "Roles": [ { "Ref": "acdppipelinesconstructbackstagepipelineroleC81291F3" } ] }, "DependsOn": [ "acdpbackstageassetsconstructbackstagedefaultusersandgroupscustomresource72402F10", "acdpbackstageassetsconstructbackstagetemplateassetscopycustomresource32AF3B04", "acdpbackstageassetsconstructdeploymentbackstagezipassetB64A29C2", "acdpbackstageassetsconstructs3policyA50772A6", "ssmappuniqueidD1DCE51D" ], "Metadata": { "aws:cdk:path": "acdp/acdp/pipelines-construct/backstage-pipeline-role/DefaultPolicy/Resource", "cdk_nag": { "rules_to_suppress": [ { "id": "AwsSolutions-IAM5", "appliesTo": [ "Resource::/*", "Action::kms:GenerateDataKey*", "Action::kms:ReEncrypt*", "Action::s3:Abort*", "Action::s3:DeleteObject*", "Action::s3:List*", "Action::s3:GetBucket*", "Action::s3:GetObject*", "Resource::/*" ], "reason": "Pipelines default role policy is least privilege." } ] } } }, "acdppipelinesconstructbackstagecodepipelineArtifactsBucketEncryptionKeyF6DDC81C": { "Type": "AWS::KMS::Key", "Properties": { "EnableKeyRotation": true, "KeyPolicy": { "Statement": [ { "Action": "kms:*", "Effect": "Allow", "Principal": { "AWS": { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":iam::", { "Ref": "AWS::AccountId" }, ":root" ] ] } }, "Resource": "*" } ], "Version": "2012-10-17" }, "Tags": [ { "Key": "awsApplication", "Value": { "Fn::GetAtt": [ "acdpappregistryappregistryapplication0BC5FAC5", "ApplicationTagValue" ] } }, { "Key": "Solutions:ApplicationType", "Value": "AWS-Solutions" }, { "Key": "Solutions:DeploymentUUID", "Value": { "Fn::GetAtt": [ "deploymentuuidconstructdeploymentuuidcustomresourceC885F329", "SolutionUUID" ] } }, { "Key": "Solutions:ModuleName", "Value": "acdp" }, { "Key": "Solutions:SolutionID", "Value": "SO0241" }, { "Key": "Solutions:SolutionName", "Value": "connected-mobility-solution-on-aws" }, { "Key": "Solutions:SolutionVersion", "Value": "v2.1.5" } ] }, "DependsOn": [ "acdpbackstageassetsconstructbackstagedefaultusersandgroupscustomresource72402F10", "acdpbackstageassetsconstructbackstagetemplateassetscopycustomresource32AF3B04", "acdpbackstageassetsconstructdeploymentbackstagezipassetB64A29C2", "acdpbackstageassetsconstructs3policyA50772A6", "ssmappuniqueidD1DCE51D" ], "UpdateReplacePolicy": "Delete", "DeletionPolicy": "Delete", "Metadata": { "aws:cdk:path": "acdp/acdp/pipelines-construct/backstage-code-pipeline/ArtifactsBucketEncryptionKey/Resource" } }, "acdppipelinesconstructbackstagecodepipelineArtifactsBucketEncryptionKeyAliasDC847BFB": { "Type": "AWS::KMS::Alias", "Properties": { "AliasName": "alias/codepipeline-acdppipelinesconstructbackstagecodepipeline88fccf7a", "TargetKeyId": { "Fn::GetAtt": [ "acdppipelinesconstructbackstagecodepipelineArtifactsBucketEncryptionKeyF6DDC81C", "Arn" ] } }, "DependsOn": [ "acdpbackstageassetsconstructbackstagedefaultusersandgroupscustomresource72402F10", "acdpbackstageassetsconstructbackstagetemplateassetscopycustomresource32AF3B04", "acdpbackstageassetsconstructdeploymentbackstagezipassetB64A29C2", "acdpbackstageassetsconstructs3policyA50772A6", "ssmappuniqueidD1DCE51D" ], "UpdateReplacePolicy": "Delete", "DeletionPolicy": "Delete", "Metadata": { "aws:cdk:path": "acdp/acdp/pipelines-construct/backstage-code-pipeline/ArtifactsBucketEncryptionKeyAlias/Resource" } }, "acdppipelinesconstructbackstagecodepipelineArtifactsBucket9777AC61": { "Type": "AWS::S3::Bucket", "Properties": { "BucketEncryption": { "ServerSideEncryptionConfiguration": [ { "ServerSideEncryptionByDefault": { "KMSMasterKeyID": { "Fn::GetAtt": [ "acdppipelinesconstructbackstagecodepipelineArtifactsBucketEncryptionKeyF6DDC81C", "Arn" ] }, "SSEAlgorithm": "aws:kms" } } ] }, "PublicAccessBlockConfiguration": { "BlockPublicAcls": true, "BlockPublicPolicy": true, "IgnorePublicAcls": true, "RestrictPublicBuckets": true }, "Tags": [ { "Key": "awsApplication", "Value": { "Fn::GetAtt": [ "acdpappregistryappregistryapplication0BC5FAC5", "ApplicationTagValue" ] } }, { "Key": "Solutions:ApplicationType", "Value": "AWS-Solutions" }, { "Key": "Solutions:DeploymentUUID", "Value": { "Fn::GetAtt": [ "deploymentuuidconstructdeploymentuuidcustomresourceC885F329", "SolutionUUID" ] } }, { "Key": "Solutions:ModuleName", "Value": "acdp" }, { "Key": "Solutions:SolutionID", "Value": "SO0241" }, { "Key": "Solutions:SolutionName", "Value": "connected-mobility-solution-on-aws" }, { "Key": "Solutions:SolutionVersion", "Value": "v2.1.5" } ] }, "DependsOn": [ "acdpbackstageassetsconstructbackstagedefaultusersandgroupscustomresource72402F10", "acdpbackstageassetsconstructbackstagetemplateassetscopycustomresource32AF3B04", "acdpbackstageassetsconstructdeploymentbackstagezipassetB64A29C2", "acdpbackstageassetsconstructs3policyA50772A6", "ssmappuniqueidD1DCE51D" ], "UpdateReplacePolicy": "Retain", "DeletionPolicy": "Retain", "Metadata": { "aws:cdk:path": "acdp/acdp/pipelines-construct/backstage-code-pipeline/ArtifactsBucket/Resource", "cdk_nag": { "rules_to_suppress": [ { "id": "AwsSolutions-S1", "reason": "An artifact bucket does not need S3 bucket for access logs" } ] } } }, "acdppipelinesconstructbackstagecodepipelineArtifactsBucketPolicyA7030BC8": { "Type": "AWS::S3::BucketPolicy", "Properties": { "Bucket": { "Ref": "acdppipelinesconstructbackstagecodepipelineArtifactsBucket9777AC61" }, "PolicyDocument": { "Statement": [ { "Action": "s3:*", "Condition": { "Bool": { "aws:SecureTransport": "false" } }, "Effect": "Deny", "Principal": { "AWS": "*" }, "Resource": [ { "Fn::GetAtt": [ "acdppipelinesconstructbackstagecodepipelineArtifactsBucket9777AC61", "Arn" ] }, { "Fn::Join": [ "", [ { "Fn::GetAtt": [ "acdppipelinesconstructbackstagecodepipelineArtifactsBucket9777AC61", "Arn" ] }, "/*" ] ] } ] } ], "Version": "2012-10-17" } }, "DependsOn": [ "acdpbackstageassetsconstructbackstagedefaultusersandgroupscustomresource72402F10", "acdpbackstageassetsconstructbackstagetemplateassetscopycustomresource32AF3B04", "acdpbackstageassetsconstructdeploymentbackstagezipassetB64A29C2", "acdpbackstageassetsconstructs3policyA50772A6", "ssmappuniqueidD1DCE51D" ], "Metadata": { "aws:cdk:path": "acdp/acdp/pipelines-construct/backstage-code-pipeline/ArtifactsBucket/Policy/Resource" } }, "acdppipelinesconstructbackstagecodepipeline2D3F668A": { "Type": "AWS::CodePipeline::Pipeline", "Properties": { "ArtifactStore": { "EncryptionKey": { "Id": { "Fn::GetAtt": [ "acdppipelinesconstructbackstagecodepipelineArtifactsBucketEncryptionKeyF6DDC81C", "Arn" ] }, "Type": "KMS" }, "Location": { "Ref": "acdppipelinesconstructbackstagecodepipelineArtifactsBucket9777AC61" }, "Type": "S3" }, "Name": { "Fn::Join": [ "", [ { "Ref": "AcdpUniqueId" }, "-backstage-pipeline" ] ] }, "RestartExecutionOnUpdate": true, "RoleArn": { "Fn::GetAtt": [ "acdppipelinesconstructbackstagepipelineroleC81291F3", "Arn" ] }, "Stages": [ { "Actions": [ { "ActionTypeId": { "Category": "Source", "Owner": "AWS", "Provider": "S3", "Version": "1" }, "Configuration": { "S3Bucket": { "Ref": "backstageassetbucketconstructencryptedbucket8BE77EF0" }, "S3ObjectKey": { "Fn::GetAtt": [ "acdpbackstageassetsconstructdeploymentbackstagezipassetB64A29C2", "DestinationKey" ] }, "PollForSourceChanges": false }, "Name": "S3-Source-Backstage-Asset", "OutputArtifacts": [ { "Name": { "Ref": "acdppipelinesconstructbackstageecrA3584D57" } } ], "RoleArn": { "Fn::GetAtt": [ "acdppipelinesconstructbackstagecodepipelineSourceStageBackstageS3SourceBackstageAssetCodePipelineActionRole111364E2", "Arn" ] }, "RunOrder": 1 } ], "Name": "Source-Stage-Backstage" }, { "Actions": [ { "ActionTypeId": { "Category": "Build", "Owner": "AWS", "Provider": "CodeBuild", "Version": "1" }, "Configuration": { "ProjectName": { "Ref": "acdppipelinesconstructbackstagebuildpipelineproject8C07A386" } }, "InputArtifacts": [ { "Name": { "Ref": "acdppipelinesconstructbackstageecrA3584D57" } } ], "Name": "Build-Image", "RoleArn": { "Fn::GetAtt": [ "acdppipelinesconstructbackstagecodepipelineBuildStageBackstageBuildImageCodePipelineActionRole350B235B", "Arn" ] }, "RunOrder": 1 } ], "Name": "Build-Stage-Backstage" }, { "Actions": [ { "ActionTypeId": { "Category": "Build", "Owner": "AWS", "Provider": "CodeBuild", "Version": "1" }, "Configuration": { "ProjectName": { "Ref": "acdppipelinesconstructbackstagedeploypipelineproject3068AE0E" }, "PrimarySource": { "Ref": "acdppipelinesconstructbackstageecrA3584D57" } }, "InputArtifacts": [ { "Name": { "Ref": "acdppipelinesconstructbackstageecrA3584D57" } } ], "Name": "Deploy", "RoleArn": { "Fn::GetAtt": [ "acdppipelinesconstructbackstagecodepipelineDeployStageBackstageDeployCodePipelineActionRole5B9646C2", "Arn" ] }, "RunOrder": 1 } ], "Name": "Deploy-Stage-Backstage" } ], "Tags": [ { "Key": "awsApplication", "Value": { "Fn::GetAtt": [ "acdpappregistryappregistryapplication0BC5FAC5", "ApplicationTagValue" ] } }, { "Key": "Solutions:ApplicationType", "Value": "AWS-Solutions" }, { "Key": "Solutions:DeploymentUUID", "Value": { "Fn::GetAtt": [ "deploymentuuidconstructdeploymentuuidcustomresourceC885F329", "SolutionUUID" ] } }, { "Key": "Solutions:ModuleName", "Value": "acdp" }, { "Key": "Solutions:SolutionID", "Value": "SO0241" }, { "Key": "Solutions:SolutionName", "Value": "connected-mobility-solution-on-aws" }, { "Key": "Solutions:SolutionVersion", "Value": "v2.1.5" } ] }, "DependsOn": [ "acdpbackstageassetsconstructbackstagedefaultusersandgroupscustomresource72402F10", "acdpbackstageassetsconstructbackstagetemplateassetscopycustomresource32AF3B04", "acdpbackstageassetsconstructdeploymentbackstagezipassetB64A29C2", "acdpbackstageassetsconstructs3policyA50772A6", "acdppipelinesconstructbackstagepipelineroleDefaultPolicy5CCDEA82", "acdppipelinesconstructbackstagepipelineroleC81291F3", "ssmappuniqueidD1DCE51D" ], "Metadata": { "aws:cdk:path": "acdp/acdp/pipelines-construct/backstage-code-pipeline/Resource" } }, "acdppipelinesconstructbackstagecodepipelineSourceStageBackstageS3SourceBackstageAssetCodePipelineActionRole111364E2": { "Type": "AWS::IAM::Role", "Properties": { "AssumeRolePolicyDocument": { "Statement": [ { "Action": "sts:AssumeRole", "Effect": "Allow", "Principal": { "AWS": { "Fn::GetAtt": [ "acdppipelinesconstructbackstagepipelineroleC81291F3", "Arn" ] } } } ], "Version": "2012-10-17" }, "Tags": [ { "Key": "awsApplication", "Value": { "Fn::GetAtt": [ "acdpappregistryappregistryapplication0BC5FAC5", "ApplicationTagValue" ] } }, { "Key": "Solutions:ApplicationType", "Value": "AWS-Solutions" }, { "Key": "Solutions:DeploymentUUID", "Value": { "Fn::GetAtt": [ "deploymentuuidconstructdeploymentuuidcustomresourceC885F329", "SolutionUUID" ] } }, { "Key": "Solutions:ModuleName", "Value": "acdp" }, { "Key": "Solutions:SolutionID", "Value": "SO0241" }, { "Key": "Solutions:SolutionName", "Value": "connected-mobility-solution-on-aws" }, { "Key": "Solutions:SolutionVersion", "Value": "v2.1.5" } ] }, "DependsOn": [ "acdpbackstageassetsconstructbackstagedefaultusersandgroupscustomresource72402F10", "acdpbackstageassetsconstructbackstagetemplateassetscopycustomresource32AF3B04", "acdpbackstageassetsconstructdeploymentbackstagezipassetB64A29C2", "acdpbackstageassetsconstructs3policyA50772A6", "ssmappuniqueidD1DCE51D" ], "Metadata": { "aws:cdk:path": "acdp/acdp/pipelines-construct/backstage-code-pipeline/Source-Stage-Backstage/S3-Source-Backstage-Asset/CodePipelineActionRole/Resource" } }, "acdppipelinesconstructbackstagecodepipelineSourceStageBackstageS3SourceBackstageAssetCodePipelineActionRoleDefaultPolicyCAB844F9": { "Type": "AWS::IAM::Policy", "Properties": { "PolicyDocument": { "Statement": [ { "Action": [ "s3:GetObject*", "s3:GetBucket*", "s3:List*" ], "Effect": "Allow", "Resource": [ { "Fn::GetAtt": [ "backstageassetbucketconstructencryptedbucket8BE77EF0", "Arn" ] }, { "Fn::Join": [ "", [ { "Fn::GetAtt": [ "backstageassetbucketconstructencryptedbucket8BE77EF0", "Arn" ] }, "/", { "Fn::GetAtt": [ "acdpbackstageassetsconstructdeploymentbackstagezipassetB64A29C2", "DestinationKey" ] } ] ] } ] }, { "Action": [ "s3:DeleteObject*", "s3:PutObject", "s3:PutObjectLegalHold", "s3:PutObjectRetention", "s3:PutObjectTagging", "s3:PutObjectVersionTagging", "s3:Abort*" ], "Effect": "Allow", "Resource": [ { "Fn::GetAtt": [ "acdppipelinesconstructbackstagecodepipelineArtifactsBucket9777AC61", "Arn" ] }, { "Fn::Join": [ "", [ { "Fn::GetAtt": [ "acdppipelinesconstructbackstagecodepipelineArtifactsBucket9777AC61", "Arn" ] }, "/*" ] ] } ] }, { "Action": [ "kms:Encrypt", "kms:ReEncrypt*", "kms:GenerateDataKey*", "kms:Decrypt" ], "Effect": "Allow", "Resource": { "Fn::GetAtt": [ "acdppipelinesconstructbackstagecodepipelineArtifactsBucketEncryptionKeyF6DDC81C", "Arn" ] } } ], "Version": "2012-10-17" }, "PolicyName": "acdppipelinesconstructbackstagecodepipelineSourceStageBackstageS3SourceBackstageAssetCodePipelineActionRoleDefaultPolicyCAB844F9", "Roles": [ { "Ref": "acdppipelinesconstructbackstagecodepipelineSourceStageBackstageS3SourceBackstageAssetCodePipelineActionRole111364E2" } ] }, "DependsOn": [ "acdpbackstageassetsconstructbackstagedefaultusersandgroupscustomresource72402F10", "acdpbackstageassetsconstructbackstagetemplateassetscopycustomresource32AF3B04", "acdpbackstageassetsconstructdeploymentbackstagezipassetB64A29C2", "acdpbackstageassetsconstructs3policyA50772A6", "ssmappuniqueidD1DCE51D" ], "Metadata": { "aws:cdk:path": "acdp/acdp/pipelines-construct/backstage-code-pipeline/Source-Stage-Backstage/S3-Source-Backstage-Asset/CodePipelineActionRole/DefaultPolicy/Resource", "cdk_nag": { "rules_to_suppress": [ { "id": "AwsSolutions-IAM5", "appliesTo": [ "Resource::/*", "Action::kms:GenerateDataKey*", "Action::kms:ReEncrypt*", "Action::s3:Abort*", "Action::s3:DeleteObject*", "Action::s3:List*", "Action::s3:GetBucket*", "Action::s3:GetObject*", "Resource::/*" ], "reason": "Pipelines default role policy is least privilege." } ] } } }, "acdppipelinesconstructbackstagecodepipelineBuildStageBackstageBuildImageCodePipelineActionRole350B235B": { "Type": "AWS::IAM::Role", "Properties": { "AssumeRolePolicyDocument": { "Statement": [ { "Action": "sts:AssumeRole", "Effect": "Allow", "Principal": { "AWS": { "Fn::GetAtt": [ "acdppipelinesconstructbackstagepipelineroleC81291F3", "Arn" ] } } } ], "Version": "2012-10-17" }, "Tags": [ { "Key": "awsApplication", "Value": { "Fn::GetAtt": [ "acdpappregistryappregistryapplication0BC5FAC5", "ApplicationTagValue" ] } }, { "Key": "Solutions:ApplicationType", "Value": "AWS-Solutions" }, { "Key": "Solutions:DeploymentUUID", "Value": { "Fn::GetAtt": [ "deploymentuuidconstructdeploymentuuidcustomresourceC885F329", "SolutionUUID" ] } }, { "Key": "Solutions:ModuleName", "Value": "acdp" }, { "Key": "Solutions:SolutionID", "Value": "SO0241" }, { "Key": "Solutions:SolutionName", "Value": "connected-mobility-solution-on-aws" }, { "Key": "Solutions:SolutionVersion", "Value": "v2.1.5" } ] }, "DependsOn": [ "acdpbackstageassetsconstructbackstagedefaultusersandgroupscustomresource72402F10", "acdpbackstageassetsconstructbackstagetemplateassetscopycustomresource32AF3B04", "acdpbackstageassetsconstructdeploymentbackstagezipassetB64A29C2", "acdpbackstageassetsconstructs3policyA50772A6", "ssmappuniqueidD1DCE51D" ], "Metadata": { "aws:cdk:path": "acdp/acdp/pipelines-construct/backstage-code-pipeline/Build-Stage-Backstage/Build-Image/CodePipelineActionRole/Resource" } }, "acdppipelinesconstructbackstagecodepipelineBuildStageBackstageBuildImageCodePipelineActionRoleDefaultPolicyA57AC59F": { "Type": "AWS::IAM::Policy", "Properties": { "PolicyDocument": { "Statement": [ { "Action": [ "codebuild:BatchGetBuilds", "codebuild:StartBuild", "codebuild:StopBuild" ], "Effect": "Allow", "Resource": { "Fn::GetAtt": [ "acdppipelinesconstructbackstagebuildpipelineproject8C07A386", "Arn" ] } } ], "Version": "2012-10-17" }, "PolicyName": "acdppipelinesconstructbackstagecodepipelineBuildStageBackstageBuildImageCodePipelineActionRoleDefaultPolicyA57AC59F", "Roles": [ { "Ref": "acdppipelinesconstructbackstagecodepipelineBuildStageBackstageBuildImageCodePipelineActionRole350B235B" } ] }, "DependsOn": [ "acdpbackstageassetsconstructbackstagedefaultusersandgroupscustomresource72402F10", "acdpbackstageassetsconstructbackstagetemplateassetscopycustomresource32AF3B04", "acdpbackstageassetsconstructdeploymentbackstagezipassetB64A29C2", "acdpbackstageassetsconstructs3policyA50772A6", "ssmappuniqueidD1DCE51D" ], "Metadata": { "aws:cdk:path": "acdp/acdp/pipelines-construct/backstage-code-pipeline/Build-Stage-Backstage/Build-Image/CodePipelineActionRole/DefaultPolicy/Resource" } }, "acdppipelinesconstructbackstagecodepipelineDeployStageBackstageDeployCodePipelineActionRole5B9646C2": { "Type": "AWS::IAM::Role", "Properties": { "AssumeRolePolicyDocument": { "Statement": [ { "Action": "sts:AssumeRole", "Effect": "Allow", "Principal": { "AWS": { "Fn::GetAtt": [ "acdppipelinesconstructbackstagepipelineroleC81291F3", "Arn" ] } } } ], "Version": "2012-10-17" }, "Tags": [ { "Key": "awsApplication", "Value": { "Fn::GetAtt": [ "acdpappregistryappregistryapplication0BC5FAC5", "ApplicationTagValue" ] } }, { "Key": "Solutions:ApplicationType", "Value": "AWS-Solutions" }, { "Key": "Solutions:DeploymentUUID", "Value": { "Fn::GetAtt": [ "deploymentuuidconstructdeploymentuuidcustomresourceC885F329", "SolutionUUID" ] } }, { "Key": "Solutions:ModuleName", "Value": "acdp" }, { "Key": "Solutions:SolutionID", "Value": "SO0241" }, { "Key": "Solutions:SolutionName", "Value": "connected-mobility-solution-on-aws" }, { "Key": "Solutions:SolutionVersion", "Value": "v2.1.5" } ] }, "DependsOn": [ "acdpbackstageassetsconstructbackstagedefaultusersandgroupscustomresource72402F10", "acdpbackstageassetsconstructbackstagetemplateassetscopycustomresource32AF3B04", "acdpbackstageassetsconstructdeploymentbackstagezipassetB64A29C2", "acdpbackstageassetsconstructs3policyA50772A6", "ssmappuniqueidD1DCE51D" ], "Metadata": { "aws:cdk:path": "acdp/acdp/pipelines-construct/backstage-code-pipeline/Deploy-Stage-Backstage/Deploy/CodePipelineActionRole/Resource" } }, "acdppipelinesconstructbackstagecodepipelineDeployStageBackstageDeployCodePipelineActionRoleDefaultPolicy5CFA45E0": { "Type": "AWS::IAM::Policy", "Properties": { "PolicyDocument": { "Statement": [ { "Action": [ "codebuild:BatchGetBuilds", "codebuild:StartBuild", "codebuild:StopBuild" ], "Effect": "Allow", "Resource": { "Fn::GetAtt": [ "acdppipelinesconstructbackstagedeploypipelineproject3068AE0E", "Arn" ] } } ], "Version": "2012-10-17" }, "PolicyName": "acdppipelinesconstructbackstagecodepipelineDeployStageBackstageDeployCodePipelineActionRoleDefaultPolicy5CFA45E0", "Roles": [ { "Ref": "acdppipelinesconstructbackstagecodepipelineDeployStageBackstageDeployCodePipelineActionRole5B9646C2" } ] }, "DependsOn": [ "acdpbackstageassetsconstructbackstagedefaultusersandgroupscustomresource72402F10", "acdpbackstageassetsconstructbackstagetemplateassetscopycustomresource32AF3B04", "acdpbackstageassetsconstructdeploymentbackstagezipassetB64A29C2", "acdpbackstageassetsconstructs3policyA50772A6", "ssmappuniqueidD1DCE51D" ], "Metadata": { "aws:cdk:path": "acdp/acdp/pipelines-construct/backstage-code-pipeline/Deploy-Stage-Backstage/Deploy/CodePipelineActionRole/DefaultPolicy/Resource" } }, "acdpmoduledeployprojectmoduledeploycodebuildroleB125328F": { "Type": "AWS::IAM::Role", "Properties": { "AssumeRolePolicyDocument": { "Statement": [ { "Action": "sts:AssumeRole", "Effect": "Allow", "Principal": { "Service": "codebuild.amazonaws.com" } } ], "Version": "2012-10-17" }, "Description": "Module Deploy CodeBuild Role", "Policies": [ { "PolicyDocument": { "Statement": [ { "Action": [ "s3:GetBucketLocation", "s3:GetObject", "s3:ListBucket" ], "Effect": "Allow", "Resource": [ { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":s3:::", { "Fn::FindInMap": [ "Solution", "AssetsConfig", "S3AssetBucketBaseName" ] }, "-", { "Ref": "AWS::Region" } ] ] }, { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":s3:::", { "Fn::FindInMap": [ "Solution", "AssetsConfig", "S3AssetBucketBaseName" ] }, "-", { "Ref": "AWS::Region" }, "/*" ] ] }, { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":s3:::", { "Ref": "backstageassetbucketconstructencryptedbucket8BE77EF0" } ] ] }, { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":s3:::", { "Ref": "backstageassetbucketconstructencryptedbucket8BE77EF0" }, "/*" ] ] } ] } ], "Version": "2012-10-17" }, "PolicyName": "s3-policy" }, { "PolicyDocument": { "Statement": [ { "Action": [ "cloudformation:DescribeStacks", "cloudformation:CreateChangeSet", "cloudformation:DescribeChangeSet", "cloudformation:ExecuteChangeSet", "cloudformation:DeleteChangeSet", "cloudformation:CreateStack", "cloudformation:DeleteStack", "cloudformation:GetTemplateSummary" ], "Effect": "Allow", "Resource": { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":cloudformation:", { "Ref": "AWS::Region" }, ":", { "Ref": "AWS::AccountId" }, ":stack/*" ] ] } } ], "Version": "2012-10-17" }, "PolicyName": "cloudformation-policy" }, { "PolicyDocument": { "Statement": [ { "Action": "iam:PassRole", "Effect": "Allow", "Resource": { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":iam::", { "Ref": "AWS::AccountId" }, ":role/", { "Ref": "acdpcloudformationroleC3BA7F88" } ] ] } } ], "Version": "2012-10-17" }, "PolicyName": "iam-policy" } ], "RoleName": { "Fn::Join": [ "", [ { "Ref": "AcdpUniqueId" }, "-", { "Ref": "AWS::Region" }, "-deploy-project" ] ] }, "Tags": [ { "Key": "awsApplication", "Value": { "Fn::GetAtt": [ "acdpappregistryappregistryapplication0BC5FAC5", "ApplicationTagValue" ] } }, { "Key": "Solutions:ApplicationType", "Value": "AWS-Solutions" }, { "Key": "Solutions:DeploymentUUID", "Value": { "Fn::GetAtt": [ "deploymentuuidconstructdeploymentuuidcustomresourceC885F329", "SolutionUUID" ] } }, { "Key": "Solutions:ModuleName", "Value": "acdp" }, { "Key": "Solutions:SolutionID", "Value": "SO0241" }, { "Key": "Solutions:SolutionName", "Value": "connected-mobility-solution-on-aws" }, { "Key": "Solutions:SolutionVersion", "Value": "v2.1.5" } ] }, "DependsOn": [ "ssmappuniqueidD1DCE51D" ], "Metadata": { "aws:cdk:path": "acdp/acdp/module-deploy-project/module-deploy-code-build-role/Resource", "cdk_nag": { "rules_to_suppress": [ { "id": "AwsSolutions-IAM5", "appliesTo": [ "Resource::arn::s3:::{\"Fn::FindInMap\":[\"Solution\",\"AssetsConfig\",\"S3AssetBucketBaseName\"]}-/*", "Resource::arn::cloudformation:::stack/*", "Resource::arn::ssm:::parameter/dev/acdp-dev/*", "Resource::arn::ssm:::parameter/dev/cms/*", "Resource::arn::ssm:::parameter/dev/common/*", "Resource::arn::ssm:::parameter/solution/*", "Resource::arn::s3:::/*" ], "reason": "Need wildcard to read and write objects to the specified resources" } ] } } }, "acdpmoduledeployprojectmoduledeploycodebuildroleDefaultPolicy281C675D": { "Type": "AWS::IAM::Policy", "Properties": { "PolicyDocument": { "Statement": [ { "Action": "ec2:CreateNetworkInterfacePermission", "Condition": { "StringEquals": { "ec2:Subnet": [ { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":ec2:", { "Ref": "AWS::Region" }, ":", { "Ref": "AWS::AccountId" }, ":subnet/{{resolve:ssm:/solution/vpc/", { "Ref": "VpcName" }, "/subnets/private/1}}" ] ] }, { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":ec2:", { "Ref": "AWS::Region" }, ":", { "Ref": "AWS::AccountId" }, ":subnet/{{resolve:ssm:/solution/vpc/", { "Ref": "VpcName" }, "/subnets/private/2}}" ] ] } ], "ec2:AuthorizedService": "codebuild.amazonaws.com" } }, "Effect": "Allow", "Resource": { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":ec2:", { "Ref": "AWS::Region" }, ":", { "Ref": "AWS::AccountId" }, ":network-interface/*" ] ] } }, { "Action": [ "logs:CreateLogGroup", "logs:CreateLogStream", "logs:PutLogEvents" ], "Effect": "Allow", "Resource": [ { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":logs:", { "Ref": "AWS::Region" }, ":", { "Ref": "AWS::AccountId" }, ":log-group:/aws/codebuild/", { "Ref": "acdpmoduledeployprojectmoduledeploycodebuildprojectADB9C6C3" } ] ] }, { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":logs:", { "Ref": "AWS::Region" }, ":", { "Ref": "AWS::AccountId" }, ":log-group:/aws/codebuild/", { "Ref": "acdpmoduledeployprojectmoduledeploycodebuildprojectADB9C6C3" }, ":*" ] ] } ] }, { "Action": [ "codebuild:CreateReportGroup", "codebuild:CreateReport", "codebuild:UpdateReport", "codebuild:BatchPutTestCases", "codebuild:BatchPutCodeCoverages" ], "Effect": "Allow", "Resource": { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":codebuild:", { "Ref": "AWS::Region" }, ":", { "Ref": "AWS::AccountId" }, ":report-group/", { "Ref": "acdpmoduledeployprojectmoduledeploycodebuildprojectADB9C6C3" }, "-*" ] ] } }, { "Action": [ "kms:Decrypt", "kms:Encrypt", "kms:ReEncrypt*", "kms:GenerateDataKey*" ], "Effect": "Allow", "Resource": { "Fn::GetAtt": [ "acdpmoduledeployprojectmoduledeploycodebuildkeyC966AB49", "Arn" ] } } ], "Version": "2012-10-17" }, "PolicyName": "acdpmoduledeployprojectmoduledeploycodebuildroleDefaultPolicy281C675D", "Roles": [ { "Ref": "acdpmoduledeployprojectmoduledeploycodebuildroleB125328F" } ] }, "DependsOn": [ "ssmappuniqueidD1DCE51D" ], "Metadata": { "aws:cdk:path": "acdp/acdp/module-deploy-project/module-deploy-code-build-role/DefaultPolicy/Resource", "cdk_nag": { "rules_to_suppress": [ { "id": "AwsSolutions-IAM5", "appliesTo": [ "Resource::arn::logs:::log-group:/aws/codebuild/:*", "Resource::arn::codebuild:::report-group/-*", "Action::kms:ReEncrypt*", "Action::kms:GenerateDataKey*", "Resource::arn::ec2:::network-interface/*", "Resource::arn::logs:::log-group:/aws/codebuild/:*", "Resource::arn::codebuild:::report-group/-*" ], "reason": "Need wildcard to read and write objects to the specified resources" } ] } } }, "acdpmoduledeployprojectmoduledeployprojectsecuritygroup2E42EF84": { "Type": "AWS::EC2::SecurityGroup", "Properties": { "GroupDescription": "acdp/acdp/module-deploy-project/module-deploy-project-security-group", "SecurityGroupEgress": [ { "CidrIp": "0.0.0.0/0", "Description": "Allow all outbound traffic by default", "IpProtocol": "-1" } ], "Tags": [ { "Key": "awsApplication", "Value": { "Fn::GetAtt": [ "acdpappregistryappregistryapplication0BC5FAC5", "ApplicationTagValue" ] } }, { "Key": "Solutions:ApplicationType", "Value": "AWS-Solutions" }, { "Key": "Solutions:DeploymentUUID", "Value": { "Fn::GetAtt": [ "deploymentuuidconstructdeploymentuuidcustomresourceC885F329", "SolutionUUID" ] } }, { "Key": "Solutions:ModuleName", "Value": "acdp" }, { "Key": "Solutions:SolutionID", "Value": "SO0241" }, { "Key": "Solutions:SolutionName", "Value": "connected-mobility-solution-on-aws" }, { "Key": "Solutions:SolutionVersion", "Value": "v2.1.5" } ], "VpcId": { "Fn::Join": [ "", [ "{{resolve:ssm:/solution/vpc/", { "Ref": "VpcName" }, "/vpcid}}" ] ] } }, "DependsOn": [ "ssmappuniqueidD1DCE51D" ], "Metadata": { "aws:cdk:path": "acdp/acdp/module-deploy-project/module-deploy-project-security-group/Resource" } }, "acdpmoduledeployprojectmoduledeploycodebuildkeyC966AB49": { "Type": "AWS::KMS::Key", "Properties": { "EnableKeyRotation": true, "KeyPolicy": { "Statement": [ { "Action": "kms:*", "Effect": "Allow", "Principal": { "AWS": { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":iam::", { "Ref": "AWS::AccountId" }, ":root" ] ] } }, "Resource": "*" } ], "Version": "2012-10-17" }, "Tags": [ { "Key": "awsApplication", "Value": { "Fn::GetAtt": [ "acdpappregistryappregistryapplication0BC5FAC5", "ApplicationTagValue" ] } }, { "Key": "Solutions:ApplicationType", "Value": "AWS-Solutions" }, { "Key": "Solutions:DeploymentUUID", "Value": { "Fn::GetAtt": [ "deploymentuuidconstructdeploymentuuidcustomresourceC885F329", "SolutionUUID" ] } }, { "Key": "Solutions:ModuleName", "Value": "acdp" }, { "Key": "Solutions:SolutionID", "Value": "SO0241" }, { "Key": "Solutions:SolutionName", "Value": "connected-mobility-solution-on-aws" }, { "Key": "Solutions:SolutionVersion", "Value": "v2.1.5" } ] }, "DependsOn": [ "ssmappuniqueidD1DCE51D" ], "UpdateReplacePolicy": "Retain", "DeletionPolicy": "Retain", "Metadata": { "aws:cdk:path": "acdp/acdp/module-deploy-project/module-deploy-codebuild-key/Resource" } }, "acdpmoduledeployprojectmoduledeploycodebuildprojectADB9C6C3": { "Type": "AWS::CodeBuild::Project", "Properties": { "Artifacts": { "Type": "NO_ARTIFACTS" }, "Cache": { "Type": "NO_CACHE" }, "EncryptionKey": { "Fn::GetAtt": [ "acdpmoduledeployprojectmoduledeploycodebuildkeyC966AB49", "Arn" ] }, "Environment": { "ComputeType": "BUILD_GENERAL1_LARGE", "EnvironmentVariables": [ { "Name": "CLOUDFORMATION_ROLE_NAME", "Type": "PLAINTEXT", "Value": "acdp-cloudformation-role" }, { "Name": "DEFAULT_CLOUDFORMATION_ROLE_NAME", "Type": "PLAINTEXT", "Value": { "Ref": "acdpcloudformationroleC3BA7F88" } }, { "Name": "DEPLOYMENT_ROLE_NAME", "Type": "PLAINTEXT", "Value": "acdp-codebuild-assume-role" } ], "Image": "aws/codebuild/standard:7.0", "ImagePullCredentialsType": "CODEBUILD", "PrivilegedMode": false, "Type": "LINUX_CONTAINER" }, "Name": { "Fn::Join": [ "", [ { "Ref": "AcdpUniqueId" }, "-deployment-project" ] ] }, "ServiceRole": { "Fn::GetAtt": [ "acdpmoduledeployprojectmoduledeploycodebuildroleB125328F", "Arn" ] }, "Source": { "BuildSpec": "{\n \"version\": \"0.2\",\n \"phases\": {\n \"build\": {\n \"commands\": [\n \"echo \\\"Hello, CodeBuild!\\\"\"\n ]\n }\n }\n}", "Type": "NO_SOURCE" }, "Tags": [ { "Key": "awsApplication", "Value": { "Fn::GetAtt": [ "acdpappregistryappregistryapplication0BC5FAC5", "ApplicationTagValue" ] } }, { "Key": "Solutions:ApplicationType", "Value": "AWS-Solutions" }, { "Key": "Solutions:DeploymentUUID", "Value": { "Fn::GetAtt": [ "deploymentuuidconstructdeploymentuuidcustomresourceC885F329", "SolutionUUID" ] } }, { "Key": "Solutions:ModuleName", "Value": "acdp" }, { "Key": "Solutions:SolutionID", "Value": "SO0241" }, { "Key": "Solutions:SolutionName", "Value": "connected-mobility-solution-on-aws" }, { "Key": "Solutions:SolutionVersion", "Value": "v2.1.5" } ], "VpcConfig": { "SecurityGroupIds": [ { "Fn::GetAtt": [ "acdpmoduledeployprojectmoduledeployprojectsecuritygroup2E42EF84", "GroupId" ] } ], "Subnets": [ { "Fn::Join": [ "", [ "{{resolve:ssm:/solution/vpc/", { "Ref": "VpcName" }, "/subnets/private/1}}" ] ] }, { "Fn::Join": [ "", [ "{{resolve:ssm:/solution/vpc/", { "Ref": "VpcName" }, "/subnets/private/2}}" ] ] } ], "VpcId": { "Fn::Join": [ "", [ "{{resolve:ssm:/solution/vpc/", { "Ref": "VpcName" }, "/vpcid}}" ] ] } } }, "DependsOn": [ "acdpmoduledeployprojectmoduledeploycodebuildprojectPolicyDocument480156B7", "ssmappuniqueidD1DCE51D" ], "Metadata": { "aws:cdk:path": "acdp/acdp/module-deploy-project/module-deploy-codebuild-project/Resource" } }, "acdpmoduledeployprojectmoduledeploycodebuildprojectPolicyDocument480156B7": { "Type": "AWS::IAM::Policy", "Properties": { "PolicyDocument": { "Statement": [ { "Action": [ "ec2:CreateNetworkInterface", "ec2:DescribeNetworkInterfaces", "ec2:DeleteNetworkInterface", "ec2:DescribeSubnets", "ec2:DescribeSecurityGroups", "ec2:DescribeDhcpOptions", "ec2:DescribeVpcs" ], "Effect": "Allow", "Resource": "*" } ], "Version": "2012-10-17" }, "PolicyName": "acdpmoduledeployprojectmoduledeploycodebuildprojectPolicyDocument480156B7", "Roles": [ { "Ref": "acdpmoduledeployprojectmoduledeploycodebuildroleB125328F" } ] }, "DependsOn": [ "ssmappuniqueidD1DCE51D" ], "Metadata": { "aws:cdk:path": "acdp/acdp/module-deploy-project/module-deploy-codebuild-project/PolicyDocument/Resource", "cdk_nag": { "rules_to_suppress": [ { "id": "AwsSolutions-IAM5", "appliesTo": [ "Resource::*" ], "reason": "Pipelines project default role policy is least privilege." } ] } } }, "acdpmultiaccountconstructmultiacctpolicy3D0C2353": { "Type": "AWS::IAM::Policy", "Properties": { "PolicyDocument": { "Statement": [ { "Action": "sts:AssumeRole", "Effect": "Allow", "Resource": { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":iam::*:role/acdp-codebuild-assume-role-*" ] ] } }, { "Action": "iam:PassRole", "Effect": "Allow", "Resource": { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":iam::*:role/acdp-cloudformation-role-*" ] ] } } ], "Version": "2012-10-17" }, "PolicyName": "acdpmultiaccountconstructmultiacctpolicy3D0C2353", "Roles": [ { "Ref": "acdpmoduledeployprojectmoduledeploycodebuildroleB125328F" } ] }, "DependsOn": [ "ssmappuniqueidD1DCE51D" ], "Metadata": { "aws:cdk:path": "acdp/acdp/multi-account-construct/multi-acct-policy/Resource" }, "Condition": "acdpmultiaccountconstructshouldcreatemultiaccountpolicy6E0243F1" }, "acdpmoduleoutputsconstructssmacdpdeploymentuuidF2707E3B": { "Type": "AWS::SSM::Parameter", "Properties": { "Description": "Solution UUID used to tag resources within ACDP", "Name": { "Fn::Join": [ "", [ "/solution/", { "Ref": "AcdpUniqueId" }, "/config/deployment-uuid" ] ] }, "Tags": { "awsApplication": { "Fn::GetAtt": [ "acdpappregistryappregistryapplication0BC5FAC5", "ApplicationTagValue" ] }, "Solutions:ApplicationType": "AWS-Solutions", "Solutions:DeploymentUUID": { "Fn::GetAtt": [ "deploymentuuidconstructdeploymentuuidcustomresourceC885F329", "SolutionUUID" ] }, "Solutions:ModuleName": "acdp", "Solutions:SolutionID": "SO0241", "Solutions:SolutionName": "connected-mobility-solution-on-aws", "Solutions:SolutionVersion": "v2.1.5" }, "Type": "String", "Value": { "Fn::GetAtt": [ "deploymentuuidconstructdeploymentuuidcustomresourceC885F329", "SolutionUUID" ] } }, "DependsOn": [ "ssmappuniqueidD1DCE51D" ], "Metadata": { "aws:cdk:path": "acdp/acdp/module-outputs-construct/ssm-acdp-deployment-uuid/Resource" } }, "acdpmoduleoutputsconstructssmbackstageecrrepositoryname672ECAF5": { "Type": "AWS::SSM::Parameter", "Properties": { "Description": "Backstage ECR Repository Name", "Name": { "Fn::Join": [ "", [ "/solution/", { "Ref": "AcdpUniqueId" }, "/config/backstage/ecr-repository/name" ] ] }, "Tags": { "awsApplication": { "Fn::GetAtt": [ "acdpappregistryappregistryapplication0BC5FAC5", "ApplicationTagValue" ] }, "Solutions:ApplicationType": "AWS-Solutions", "Solutions:DeploymentUUID": { "Fn::GetAtt": [ "deploymentuuidconstructdeploymentuuidcustomresourceC885F329", "SolutionUUID" ] }, "Solutions:ModuleName": "acdp", "Solutions:SolutionID": "SO0241", "Solutions:SolutionName": "connected-mobility-solution-on-aws", "Solutions:SolutionVersion": "v2.1.5" }, "Type": "String", "Value": { "Ref": "acdppipelinesconstructbackstageecrA3584D57" } }, "DependsOn": [ "ssmappuniqueidD1DCE51D" ], "Metadata": { "aws:cdk:path": "acdp/acdp/module-outputs-construct/ssm-backstage-ecr-repository-name/Resource" } }, "acdpmoduleoutputsconstructssmcodepipelineprojectname6551C577": { "Type": "AWS::SSM::Parameter", "Properties": { "Description": "CodePipeline Project Name for ACDP Backstage Deployment", "Name": { "Fn::Join": [ "", [ "/solution/", { "Ref": "AcdpUniqueId" }, "/config/codepipeline-project/name" ] ] }, "Tags": { "awsApplication": { "Fn::GetAtt": [ "acdpappregistryappregistryapplication0BC5FAC5", "ApplicationTagValue" ] }, "Solutions:ApplicationType": "AWS-Solutions", "Solutions:DeploymentUUID": { "Fn::GetAtt": [ "deploymentuuidconstructdeploymentuuidcustomresourceC885F329", "SolutionUUID" ] }, "Solutions:ModuleName": "acdp", "Solutions:SolutionID": "SO0241", "Solutions:SolutionName": "connected-mobility-solution-on-aws", "Solutions:SolutionVersion": "v2.1.5" }, "Type": "String", "Value": { "Ref": "acdppipelinesconstructbackstagecodepipeline2D3F668A" } }, "DependsOn": [ "ssmappuniqueidD1DCE51D" ], "Metadata": { "aws:cdk:path": "acdp/acdp/module-outputs-construct/ssm-codepipeline-project-name/Resource" } }, "acdpmoduleoutputsconstructssmcodebuildprojectarnmulti867436FD": { "Type": "AWS::SSM::Parameter", "Properties": { "Description": "CodeBuild Project ARN for Backstage ACDP plugin (Multi-Account)", "Name": { "Fn::Join": [ "", [ "/solution/", { "Ref": "AcdpUniqueId" }, "/config/codebuild-project/arn" ] ] }, "Tags": { "awsApplication": { "Fn::GetAtt": [ "acdpappregistryappregistryapplication0BC5FAC5", "ApplicationTagValue" ] }, "Solutions:ApplicationType": "AWS-Solutions", "Solutions:DeploymentUUID": { "Fn::GetAtt": [ "deploymentuuidconstructdeploymentuuidcustomresourceC885F329", "SolutionUUID" ] }, "Solutions:ModuleName": "acdp", "Solutions:SolutionID": "SO0241", "Solutions:SolutionName": "connected-mobility-solution-on-aws", "Solutions:SolutionVersion": "v2.1.5" }, "Type": "String", "Value": { "Fn::GetAtt": [ "acdpmoduledeployprojectmoduledeploycodebuildprojectADB9C6C3", "Arn" ] } }, "DependsOn": [ "ssmappuniqueidD1DCE51D" ], "Metadata": { "aws:cdk:path": "acdp/acdp/module-outputs-construct/ssm-codebuild-project-arn-multi/Resource" } }, "acdpmoduleoutputsconstructssmbackstageuseauthredirectflow2B9477EC": { "Type": "AWS::SSM::Parameter", "Properties": { "Description": "Whether Backstage should use the experimental auth redirect flow rather than the default popup flow", "Name": { "Fn::Join": [ "", [ "/solution/", { "Ref": "AcdpUniqueId" }, "/config/backstage/use-auth-redirect-flow" ] ] }, "Tags": { "awsApplication": { "Fn::GetAtt": [ "acdpappregistryappregistryapplication0BC5FAC5", "ApplicationTagValue" ] }, "Solutions:ApplicationType": "AWS-Solutions", "Solutions:DeploymentUUID": { "Fn::GetAtt": [ "deploymentuuidconstructdeploymentuuidcustomresourceC885F329", "SolutionUUID" ] }, "Solutions:ModuleName": "acdp", "Solutions:SolutionID": "SO0241", "Solutions:SolutionName": "connected-mobility-solution-on-aws", "Solutions:SolutionVersion": "v2.1.5" }, "Type": "String", "Value": { "Ref": "UseBackstageAuthRedirectFlow" } }, "DependsOn": [ "ssmappuniqueidD1DCE51D" ], "Metadata": { "aws:cdk:path": "acdp/acdp/module-outputs-construct/ssm-backstage-use-auth-redirect-flow/Resource" } }, "acdpmoduleoutputsconstructssmbackstageadditionalscopes3C55C0A2": { "Type": "AWS::SSM::Parameter", "Properties": { "Description": "Additional scopes which Backstage will request from the configured identity provider on login", "Name": { "Fn::Join": [ "", [ "/solution/", { "Ref": "AcdpUniqueId" }, "/config/backstage/additional-scopes" ] ] }, "Tags": { "awsApplication": { "Fn::GetAtt": [ "acdpappregistryappregistryapplication0BC5FAC5", "ApplicationTagValue" ] }, "Solutions:ApplicationType": "AWS-Solutions", "Solutions:DeploymentUUID": { "Fn::GetAtt": [ "deploymentuuidconstructdeploymentuuidcustomresourceC885F329", "SolutionUUID" ] }, "Solutions:ModuleName": "acdp", "Solutions:SolutionID": "SO0241", "Solutions:SolutionName": "connected-mobility-solution-on-aws", "Solutions:SolutionVersion": "v2.1.5" }, "Type": "String", "Value": { "Fn::If": [ "moduleinputsconstructisbackstageadditionalscopessetcondition622861A7", { "Ref": "BackstageAdditionalScopes" }, "cms-unset" ] } }, "DependsOn": [ "ssmappuniqueidD1DCE51D" ], "Metadata": { "aws:cdk:path": "acdp/acdp/module-outputs-construct/ssm-backstage-additional-scopes/Resource" } }, "acdpmoduleoutputsconstructssmbackstagenameDECB65E1": { "Type": "AWS::SSM::Parameter", "Properties": { "Description": "The name to display on Backstage", "Name": { "Fn::Join": [ "", [ "/solution/", { "Ref": "AcdpUniqueId" }, "/config/backstage/name" ] ] }, "Tags": { "awsApplication": { "Fn::GetAtt": [ "acdpappregistryappregistryapplication0BC5FAC5", "ApplicationTagValue" ] }, "Solutions:ApplicationType": "AWS-Solutions", "Solutions:DeploymentUUID": { "Fn::GetAtt": [ "deploymentuuidconstructdeploymentuuidcustomresourceC885F329", "SolutionUUID" ] }, "Solutions:ModuleName": "acdp", "Solutions:SolutionID": "SO0241", "Solutions:SolutionName": "connected-mobility-solution-on-aws", "Solutions:SolutionVersion": "v2.1.5" }, "Type": "String", "Value": { "Ref": "BackstageName" } }, "DependsOn": [ "ssmappuniqueidD1DCE51D" ], "Metadata": { "aws:cdk:path": "acdp/acdp/module-outputs-construct/ssm-backstage-name/Resource" } }, "acdpmoduleoutputsconstructssmbackstageorgAC460578": { "Type": "AWS::SSM::Parameter", "Properties": { "Description": "The organization to display on Backstage", "Name": { "Fn::Join": [ "", [ "/solution/", { "Ref": "AcdpUniqueId" }, "/config/backstage/organization" ] ] }, "Tags": { "awsApplication": { "Fn::GetAtt": [ "acdpappregistryappregistryapplication0BC5FAC5", "ApplicationTagValue" ] }, "Solutions:ApplicationType": "AWS-Solutions", "Solutions:DeploymentUUID": { "Fn::GetAtt": [ "deploymentuuidconstructdeploymentuuidcustomresourceC885F329", "SolutionUUID" ] }, "Solutions:ModuleName": "acdp", "Solutions:SolutionID": "SO0241", "Solutions:SolutionName": "connected-mobility-solution-on-aws", "Solutions:SolutionVersion": "v2.1.5" }, "Type": "String", "Value": { "Ref": "BackstageOrg" } }, "DependsOn": [ "ssmappuniqueidD1DCE51D" ], "Metadata": { "aws:cdk:path": "acdp/acdp/module-outputs-construct/ssm-backstage-org/Resource" } }, "acdpmoduleoutputsconstructssmbackstageloglevel5613964C": { "Type": "AWS::SSM::Parameter", "Properties": { "Description": "Level of logs to display (trace, debug, info, warn, error, critical)", "Name": { "Fn::Join": [ "", [ "/solution/", { "Ref": "AcdpUniqueId" }, "/config/backstage/log-level" ] ] }, "Tags": { "awsApplication": { "Fn::GetAtt": [ "acdpappregistryappregistryapplication0BC5FAC5", "ApplicationTagValue" ] }, "Solutions:ApplicationType": "AWS-Solutions", "Solutions:DeploymentUUID": { "Fn::GetAtt": [ "deploymentuuidconstructdeploymentuuidcustomresourceC885F329", "SolutionUUID" ] }, "Solutions:ModuleName": "acdp", "Solutions:SolutionID": "SO0241", "Solutions:SolutionName": "connected-mobility-solution-on-aws", "Solutions:SolutionVersion": "v2.1.5" }, "Type": "String", "Value": { "Ref": "BackstageLogLevel" } }, "DependsOn": [ "ssmappuniqueidD1DCE51D" ], "Metadata": { "aws:cdk:path": "acdp/acdp/module-outputs-construct/ssm-backstage-log-level/Resource" } }, "acdpmoduleoutputsconstructssmregionalassetconfigbucketname67207F39": { "Type": "AWS::SSM::Parameter", "Properties": { "Description": "Name of the regional asset bucket where ACDP Deployable resources are discovered", "Name": { "Fn::Join": [ "", [ "/solution/", { "Ref": "AcdpUniqueId" }, "/config/acdp-asset-config/regional/asset-bucket/name" ] ] }, "Tags": { "awsApplication": { "Fn::GetAtt": [ "acdpappregistryappregistryapplication0BC5FAC5", "ApplicationTagValue" ] }, "Solutions:ApplicationType": "AWS-Solutions", "Solutions:DeploymentUUID": { "Fn::GetAtt": [ "deploymentuuidconstructdeploymentuuidcustomresourceC885F329", "SolutionUUID" ] }, "Solutions:ModuleName": "acdp", "Solutions:SolutionID": "SO0241", "Solutions:SolutionName": "connected-mobility-solution-on-aws", "Solutions:SolutionVersion": "v2.1.5" }, "Type": "String", "Value": { "Fn::Join": [ "", [ { "Fn::FindInMap": [ "Solution", "AssetsConfig", "S3AssetBucketBaseName" ] }, "-", { "Ref": "AWS::Region" } ] ] } }, "DependsOn": [ "ssmappuniqueidD1DCE51D" ], "Metadata": { "aws:cdk:path": "acdp/acdp/module-outputs-construct/ssm-regional-asset-config-bucket-name/Resource" } }, "acdpmoduleoutputsconstructssmregionalassetconfigbucketregion8923C0E2": { "Type": "AWS::SSM::Parameter", "Properties": { "Description": "Region of the regional bucket where ACDP Deployable resources are discovered", "Name": { "Fn::Join": [ "", [ "/solution/", { "Ref": "AcdpUniqueId" }, "/config/acdp-asset-config/regional/asset-bucket/region" ] ] }, "Tags": { "awsApplication": { "Fn::GetAtt": [ "acdpappregistryappregistryapplication0BC5FAC5", "ApplicationTagValue" ] }, "Solutions:ApplicationType": "AWS-Solutions", "Solutions:DeploymentUUID": { "Fn::GetAtt": [ "deploymentuuidconstructdeploymentuuidcustomresourceC885F329", "SolutionUUID" ] }, "Solutions:ModuleName": "acdp", "Solutions:SolutionID": "SO0241", "Solutions:SolutionName": "connected-mobility-solution-on-aws", "Solutions:SolutionVersion": "v2.1.5" }, "Type": "String", "Value": { "Ref": "AWS::Region" } }, "DependsOn": [ "ssmappuniqueidD1DCE51D" ], "Metadata": { "aws:cdk:path": "acdp/acdp/module-outputs-construct/ssm-regional-asset-config-bucket-region/Resource" } }, "acdpmoduleoutputsconstructssmregionalassetconfigbackstagetemplatekeyprefix7B36400E": { "Type": "AWS::SSM::Parameter", "Properties": { "Description": "Bucket key prefix for the regional bucket where ACDP Deployable resources are discovered", "Name": { "Fn::Join": [ "", [ "/solution/", { "Ref": "AcdpUniqueId" }, "/config/acdp-asset-config/regional/backstage-template-key-prefix" ] ] }, "Tags": { "awsApplication": { "Fn::GetAtt": [ "acdpappregistryappregistryapplication0BC5FAC5", "ApplicationTagValue" ] }, "Solutions:ApplicationType": "AWS-Solutions", "Solutions:DeploymentUUID": { "Fn::GetAtt": [ "deploymentuuidconstructdeploymentuuidcustomresourceC885F329", "SolutionUUID" ] }, "Solutions:ModuleName": "acdp", "Solutions:SolutionID": "SO0241", "Solutions:SolutionName": "connected-mobility-solution-on-aws", "Solutions:SolutionVersion": "v2.1.5" }, "Type": "String", "Value": "connected-mobility-solution-on-aws/v2.1.5/backstage/templates" }, "DependsOn": [ "ssmappuniqueidD1DCE51D" ], "Metadata": { "aws:cdk:path": "acdp/acdp/module-outputs-construct/ssm-regional-asset-config-backstage-template-key-prefix/Resource" } }, "acdpmoduleoutputsconstructssmregionalassetconfigbackstagebuildspeckeyprefix3E3724F0": { "Type": "AWS::SSM::Parameter", "Properties": { "Description": "Bucket key prefix where ACDP BuildSpecs are to be accessed from", "Name": { "Fn::Join": [ "", [ "/solution/", { "Ref": "AcdpUniqueId" }, "/config/acdp-asset-config/regional/buildspec-key-prefix" ] ] }, "Tags": { "awsApplication": { "Fn::GetAtt": [ "acdpappregistryappregistryapplication0BC5FAC5", "ApplicationTagValue" ] }, "Solutions:ApplicationType": "AWS-Solutions", "Solutions:DeploymentUUID": { "Fn::GetAtt": [ "deploymentuuidconstructdeploymentuuidcustomresourceC885F329", "SolutionUUID" ] }, "Solutions:ModuleName": "acdp", "Solutions:SolutionID": "SO0241", "Solutions:SolutionName": "connected-mobility-solution-on-aws", "Solutions:SolutionVersion": "v2.1.5" }, "Type": "String", "Value": "connected-mobility-solution-on-aws/v2.1.5/backstage/acdp" }, "DependsOn": [ "ssmappuniqueidD1DCE51D" ], "Metadata": { "aws:cdk:path": "acdp/acdp/module-outputs-construct/ssm-regional-asset-config-backstage-buildspec-key-prefix/Resource" } }, "acdpmoduleoutputsconstructssmregionalassetconfigbackstagediscoveryrefreshfreqmins36F0CE54": { "Type": "AWS::SSM::Parameter", "Properties": { "Description": "Frequency to allow refresh of Backstage catalog provider from the regional bucket", "Name": { "Fn::Join": [ "", [ "/solution/", { "Ref": "AcdpUniqueId" }, "/config/acdp-asset-config/regional/discovery-refresh-frequency-mins" ] ] }, "Tags": { "awsApplication": { "Fn::GetAtt": [ "acdpappregistryappregistryapplication0BC5FAC5", "ApplicationTagValue" ] }, "Solutions:ApplicationType": "AWS-Solutions", "Solutions:DeploymentUUID": { "Fn::GetAtt": [ "deploymentuuidconstructdeploymentuuidcustomresourceC885F329", "SolutionUUID" ] }, "Solutions:ModuleName": "acdp", "Solutions:SolutionID": "SO0241", "Solutions:SolutionName": "connected-mobility-solution-on-aws", "Solutions:SolutionVersion": "v2.1.5" }, "Type": "String", "Value": "1440" }, "DependsOn": [ "ssmappuniqueidD1DCE51D" ], "Metadata": { "aws:cdk:path": "acdp/acdp/module-outputs-construct/ssm-regional-asset-config-backstage-discovery-refresh-freq-mins/Resource" } }, "acdpmoduleoutputsconstructssmlocalassetbucketconfigname17DB11D0": { "Type": "AWS::SSM::Parameter", "Properties": { "Description": "Name of the local asset bucket where ACDP Deployable resources are discovered", "Name": { "Fn::Join": [ "", [ "/solution/", { "Ref": "AcdpUniqueId" }, "/config/acdp-asset-config/local/asset-bucket/name" ] ] }, "Tags": { "awsApplication": { "Fn::GetAtt": [ "acdpappregistryappregistryapplication0BC5FAC5", "ApplicationTagValue" ] }, "Solutions:ApplicationType": "AWS-Solutions", "Solutions:DeploymentUUID": { "Fn::GetAtt": [ "deploymentuuidconstructdeploymentuuidcustomresourceC885F329", "SolutionUUID" ] }, "Solutions:ModuleName": "acdp", "Solutions:SolutionID": "SO0241", "Solutions:SolutionName": "connected-mobility-solution-on-aws", "Solutions:SolutionVersion": "v2.1.5" }, "Type": "String", "Value": { "Ref": "backstageassetbucketconstructencryptedbucket8BE77EF0" } }, "DependsOn": [ "ssmappuniqueidD1DCE51D" ], "Metadata": { "aws:cdk:path": "acdp/acdp/module-outputs-construct/ssm-local-asset-bucket-config-name/Resource" } }, "acdpmoduleoutputsconstructssmlocalassetbucketconfigregionF71CA860": { "Type": "AWS::SSM::Parameter", "Properties": { "Description": "Region of the local bucket where ACDP Deployable resources are discovered", "Name": { "Fn::Join": [ "", [ "/solution/", { "Ref": "AcdpUniqueId" }, "/config/acdp-asset-config/local/asset-bucket/region" ] ] }, "Tags": { "awsApplication": { "Fn::GetAtt": [ "acdpappregistryappregistryapplication0BC5FAC5", "ApplicationTagValue" ] }, "Solutions:ApplicationType": "AWS-Solutions", "Solutions:DeploymentUUID": { "Fn::GetAtt": [ "deploymentuuidconstructdeploymentuuidcustomresourceC885F329", "SolutionUUID" ] }, "Solutions:ModuleName": "acdp", "Solutions:SolutionID": "SO0241", "Solutions:SolutionName": "connected-mobility-solution-on-aws", "Solutions:SolutionVersion": "v2.1.5" }, "Type": "String", "Value": { "Ref": "AWS::Region" } }, "DependsOn": [ "ssmappuniqueidD1DCE51D" ], "Metadata": { "aws:cdk:path": "acdp/acdp/module-outputs-construct/ssm-local-asset-bucket-config-region/Resource" } }, "acdpmoduleoutputsconstructssmlocalassetbucketconfigentititesprefixF250C4AB": { "Type": "AWS::SSM::Parameter", "Properties": { "Description": "Root s3 prefix to give backstage access to in the local asset bucket", "Name": { "Fn::Join": [ "", [ "/solution/", { "Ref": "AcdpUniqueId" }, "/config/acdp-asset-config/local/entities-prefix" ] ] }, "Tags": { "awsApplication": { "Fn::GetAtt": [ "acdpappregistryappregistryapplication0BC5FAC5", "ApplicationTagValue" ] }, "Solutions:ApplicationType": "AWS-Solutions", "Solutions:DeploymentUUID": { "Fn::GetAtt": [ "deploymentuuidconstructdeploymentuuidcustomresourceC885F329", "SolutionUUID" ] }, "Solutions:ModuleName": "acdp", "Solutions:SolutionID": "SO0241", "Solutions:SolutionName": "connected-mobility-solution-on-aws", "Solutions:SolutionVersion": "v2.1.5" }, "Type": "String", "Value": "backstage" }, "DependsOn": [ "ssmappuniqueidD1DCE51D" ], "Metadata": { "aws:cdk:path": "acdp/acdp/module-outputs-construct/ssm-local-asset-bucket-config-entitites-prefix/Resource" } }, "acdpmoduleoutputsconstructssmlocalassetbucketconfigdefaultassetsprefixC5C9CF95": { "Type": "AWS::SSM::Parameter", "Properties": { "Description": "S3 prefix for default ACDP assets (docs, buildspecs, entities, etc.) in the local asset bucket", "Name": { "Fn::Join": [ "", [ "/solution/", { "Ref": "AcdpUniqueId" }, "/config/acdp-asset-config/local/default-assets-prefix" ] ] }, "Tags": { "awsApplication": { "Fn::GetAtt": [ "acdpappregistryappregistryapplication0BC5FAC5", "ApplicationTagValue" ] }, "Solutions:ApplicationType": "AWS-Solutions", "Solutions:DeploymentUUID": { "Fn::GetAtt": [ "deploymentuuidconstructdeploymentuuidcustomresourceC885F329", "SolutionUUID" ] }, "Solutions:ModuleName": "acdp", "Solutions:SolutionID": "SO0241", "Solutions:SolutionName": "connected-mobility-solution-on-aws", "Solutions:SolutionVersion": "v2.1.5" }, "Type": "String", "Value": "backstage-default-assets" }, "DependsOn": [ "ssmappuniqueidD1DCE51D" ], "Metadata": { "aws:cdk:path": "acdp/acdp/module-outputs-construct/ssm-local-asset-bucket-config-default-assets-prefix/Resource" } }, "acdpmoduleoutputsconstructssmlocalassetbucketconfigdefaultentitiesprefix4C1A0268": { "Type": "AWS::SSM::Parameter", "Properties": { "Description": "S3 prefix for default ACDP catalog entities (templates, users, groups, etc.) in the local asset bucket", "Name": { "Fn::Join": [ "", [ "/solution/", { "Ref": "AcdpUniqueId" }, "/config/acdp-asset-config/local/default-entities-prefix" ] ] }, "Tags": { "awsApplication": { "Fn::GetAtt": [ "acdpappregistryappregistryapplication0BC5FAC5", "ApplicationTagValue" ] }, "Solutions:ApplicationType": "AWS-Solutions", "Solutions:DeploymentUUID": { "Fn::GetAtt": [ "deploymentuuidconstructdeploymentuuidcustomresourceC885F329", "SolutionUUID" ] }, "Solutions:ModuleName": "acdp", "Solutions:SolutionID": "SO0241", "Solutions:SolutionName": "connected-mobility-solution-on-aws", "Solutions:SolutionVersion": "v2.1.5" }, "Type": "String", "Value": "backstage-default-assets/entities" }, "DependsOn": [ "ssmappuniqueidD1DCE51D" ], "Metadata": { "aws:cdk:path": "acdp/acdp/module-outputs-construct/ssm-local-asset-bucket-config-default-entities-prefix/Resource" } }, "acdpmoduleoutputsconstructssmlocalassetbucketconfigcatalogkeyprefix866935FD": { "Type": "AWS::SSM::Parameter", "Properties": { "Description": "Bucket key prefix where Backstage Catalog Items are published to", "Name": { "Fn::Join": [ "", [ "/solution/", { "Ref": "AcdpUniqueId" }, "/config/acdp-asset-config/local/catalog-key-prefix" ] ] }, "Tags": { "awsApplication": { "Fn::GetAtt": [ "acdpappregistryappregistryapplication0BC5FAC5", "ApplicationTagValue" ] }, "Solutions:ApplicationType": "AWS-Solutions", "Solutions:DeploymentUUID": { "Fn::GetAtt": [ "deploymentuuidconstructdeploymentuuidcustomresourceC885F329", "SolutionUUID" ] }, "Solutions:ModuleName": "acdp", "Solutions:SolutionID": "SO0241", "Solutions:SolutionName": "connected-mobility-solution-on-aws", "Solutions:SolutionVersion": "v2.1.5" }, "Type": "String", "Value": "backstage/catalog" }, "DependsOn": [ "ssmappuniqueidD1DCE51D" ], "Metadata": { "aws:cdk:path": "acdp/acdp/module-outputs-construct/ssm-local-asset-bucket-config-catalog-key-prefix/Resource" } }, "acdpmoduleoutputsconstructssmlocalassetbucketconfigtechdocskeyprefixD7ADD8E5": { "Type": "AWS::SSM::Parameter", "Properties": { "Description": "Bucket key prefix where Techdocs resources are published to", "Name": { "Fn::Join": [ "", [ "/solution/", { "Ref": "AcdpUniqueId" }, "/config/acdp-asset-config/local/techdocs-key-prefix" ] ] }, "Tags": { "awsApplication": { "Fn::GetAtt": [ "acdpappregistryappregistryapplication0BC5FAC5", "ApplicationTagValue" ] }, "Solutions:ApplicationType": "AWS-Solutions", "Solutions:DeploymentUUID": { "Fn::GetAtt": [ "deploymentuuidconstructdeploymentuuidcustomresourceC885F329", "SolutionUUID" ] }, "Solutions:ModuleName": "acdp", "Solutions:SolutionID": "SO0241", "Solutions:SolutionName": "connected-mobility-solution-on-aws", "Solutions:SolutionVersion": "v2.1.5" }, "Type": "String", "Value": "backstage/techdocs" }, "DependsOn": [ "ssmappuniqueidD1DCE51D" ], "Metadata": { "aws:cdk:path": "acdp/acdp/module-outputs-construct/ssm-local-asset-bucket-config-techdocs-key-prefix/Resource" } }, "acdpmoduleoutputsconstructssmlocalassetbucketconfigdiscoveryrefreshfreqminsBB994993": { "Type": "AWS::SSM::Parameter", "Properties": { "Description": "Frequency to allow refresh of Backstage catalog provider from the local bucket", "Name": { "Fn::Join": [ "", [ "/solution/", { "Ref": "AcdpUniqueId" }, "/config/acdp-asset-config/local/discovery-refresh-frequency-mins" ] ] }, "Tags": { "awsApplication": { "Fn::GetAtt": [ "acdpappregistryappregistryapplication0BC5FAC5", "ApplicationTagValue" ] }, "Solutions:ApplicationType": "AWS-Solutions", "Solutions:DeploymentUUID": { "Fn::GetAtt": [ "deploymentuuidconstructdeploymentuuidcustomresourceC885F329", "SolutionUUID" ] }, "Solutions:ModuleName": "acdp", "Solutions:SolutionID": "SO0241", "Solutions:SolutionName": "connected-mobility-solution-on-aws", "Solutions:SolutionVersion": "v2.1.5" }, "Type": "String", "Value": { "Ref": "BackstageLocalAssetDiscoveryRefreshMins" } }, "DependsOn": [ "ssmappuniqueidD1DCE51D" ], "Metadata": { "aws:cdk:path": "acdp/acdp/module-outputs-construct/ssm-local-asset-bucket-config-discovery-refresh-freq-mins/Resource" } }, "acdpmoduleoutputsconstructssmmultiacctorgsenablemultiaccountdeployment6C40A277": { "Type": "AWS::SSM::Parameter", "Properties": { "Description": "The flag that toggles multi-account-deployment feature", "Name": { "Fn::Join": [ "", [ "/solution/", { "Ref": "AcdpUniqueId" }, "/multi-acct/enable-multi-account-deployment" ] ] }, "Tags": { "awsApplication": { "Fn::GetAtt": [ "acdpappregistryappregistryapplication0BC5FAC5", "ApplicationTagValue" ] }, "Solutions:ApplicationType": "AWS-Solutions", "Solutions:DeploymentUUID": { "Fn::GetAtt": [ "deploymentuuidconstructdeploymentuuidcustomresourceC885F329", "SolutionUUID" ] }, "Solutions:ModuleName": "acdp", "Solutions:SolutionID": "SO0241", "Solutions:SolutionName": "connected-mobility-solution-on-aws", "Solutions:SolutionVersion": "v2.1.5" }, "Type": "String", "Value": { "Ref": "EnableMultiAccountDeployment" } }, "DependsOn": [ "ssmappuniqueidD1DCE51D" ], "Metadata": { "aws:cdk:path": "acdp/acdp/module-outputs-construct/ssm-multi-acct-orgs-enable-multi-account-deployment/Resource" } }, "acdpmoduleoutputsconstructssmmultiacctorgsmanagementawsaccountidFB216B02": { "Type": "AWS::SSM::Parameter", "Properties": { "Description": "The 12-digit AWS account ID where Org Management Account resources are deployed", "Name": { "Fn::Join": [ "", [ "/solution/", { "Ref": "AcdpUniqueId" }, "/multi-acct/orgs-management-account-id" ] ] }, "Tags": { "awsApplication": { "Fn::GetAtt": [ "acdpappregistryappregistryapplication0BC5FAC5", "ApplicationTagValue" ] }, "Solutions:ApplicationType": "AWS-Solutions", "Solutions:DeploymentUUID": { "Fn::GetAtt": [ "deploymentuuidconstructdeploymentuuidcustomresourceC885F329", "SolutionUUID" ] }, "Solutions:ModuleName": "acdp", "Solutions:SolutionID": "SO0241", "Solutions:SolutionName": "connected-mobility-solution-on-aws", "Solutions:SolutionVersion": "v2.1.5" }, "Type": "String", "Value": { "Ref": "OrgsManagementAwsAccountId" } }, "DependsOn": [ "ssmappuniqueidD1DCE51D" ], "Metadata": { "aws:cdk:path": "acdp/acdp/module-outputs-construct/ssm-multi-acct-orgs-management-aws-account-id/Resource" } }, "acdpmoduleoutputsconstructssmmultiacctorgsmanagementaccountawsregion750E3521": { "Type": "AWS::SSM::Parameter", "Properties": { "Description": "Region where org management accounts resources are located", "Name": { "Fn::Join": [ "", [ "/solution/", { "Ref": "AcdpUniqueId" }, "/multi-acct/orgs-management-account-region" ] ] }, "Tags": { "awsApplication": { "Fn::GetAtt": [ "acdpappregistryappregistryapplication0BC5FAC5", "ApplicationTagValue" ] }, "Solutions:ApplicationType": "AWS-Solutions", "Solutions:DeploymentUUID": { "Fn::GetAtt": [ "deploymentuuidconstructdeploymentuuidcustomresourceC885F329", "SolutionUUID" ] }, "Solutions:ModuleName": "acdp", "Solutions:SolutionID": "SO0241", "Solutions:SolutionName": "connected-mobility-solution-on-aws", "Solutions:SolutionVersion": "v2.1.5" }, "Type": "String", "Value": { "Ref": "OrgsManagementAccountRegion" } }, "DependsOn": [ "ssmappuniqueidD1DCE51D" ], "Metadata": { "aws:cdk:path": "acdp/acdp/module-outputs-construct/ssm-multi-acct-orgs-management-account-aws-region/Resource" } }, "CDKMetadata": { "Type": "AWS::CDK::Metadata", "Properties": { "Analytics": "v2:deflate64:H4sIAAAAAAAA/2VSy07DMBD8Fu6uoeELQiU4AFKUSlzR1lnCto5teW1QZPnfkZ20VcVpHpmVZ1dpZPPQyIc7+OWNGk4bTQeZ9gHUSey+zDs4R2YU8MufidH/kEIFAbQdwTmPI3Hws0y7L9M6p0lBIGvKZBuCp0MM+OJtdP+dltkqqvEs+FGmp6hOGEpwZQt0VpOar/aqF/EEjFkwT6WyJzN24GHCgL4MXEQWGqbDADK9wYz+Az2vLW/0czTqXP/MS7dPYMbAsi0gUDUy7VFFT2G+LHdjZEEwydRbjeVbxeseC8tC25Hlmx17DGjqu6i8TD06yxSsr+GryuI0sUyvWP0CrSbgetlCslB2wEMkPcjUkUNNBjtvj6jqVc90xSXu1tx1okZXnvPNGYvYWTNQLVuvsQ8wlv+jR7bRq2XdC48c7HSWWXRz+Lbm/lFuG7nd3h2ZaOOjCTSh7Bf8A/Ymu5qOAgAA" }, "Metadata": { "aws:cdk:path": "acdp/CDKMetadata/Default" }, "Condition": "CDKMetadataAvailable" } }, "Parameters": { "S3LogExpirationDays": { "Type": "Number", "Default": 90, "Description": "The number of days before log bucket objects expire." }, "S3LogNoncurrentVersionExpirationDays": { "Type": "Number", "Default": 1, "Description": "The number of days before log bucket non-current versions are deleted after they've expired." }, "AcdpUniqueId": { "Type": "String", "Default": "acdp", "Description": "Name of the ACDP deployment" }, "VpcName": { "Type": "String", "Description": "name of the imported vpc" }, "IsPublicFacing": { "Type": "String", "Default": "true", "AllowedValues": [ "true", "false" ], "ConstraintDescription": "Value must be boolean (true, false)", "Description": "Boolean flag that configures if public endpoints should be created for ACDP/Backstage resources. If true, the VPC must have an Internet Gateway" }, "FullyQualifiedDomainName": { "Type": "String", "AllowedPattern": "^([A-Za-z0-9][A-Za-z0-9-]*\\.)+[A-Za-z]+$", "ConstraintDescription": "Fully Qualified Domain Name must be a valid domain name", "Description": "Fully Qualified Domain Name for ACDP resources to be accessed. If using Route53, this must be a subset of the Route53 Zone Name" }, "Route53HostedZoneId": { "Type": "String", "Default": "", "AllowedPattern": "^(|Z[A-Z0-9]{1,30})$", "ConstraintDescription": "Must be '' or a valid Route53 Hosted Zone Id", "Description": "Optional: Id of the Route53 Hosted Zone. Set to create records in Route53 for the required DNS entries." }, "CustomAcmCertificateArn": { "Type": "String", "Default": "", "AllowedPattern": "(^$)|(^arn:aws:acm:[a-z0-9-]+:\\d{12}:certificate/[a-f0-9-]+$)", "ConstraintDescription": "Must be '' or a valid ACM certificate ARN", "Description": "Optional when using a Public Hosted Zone with Route53. Required when HostedZoneId is Private or not provided. Provide a custom ACM Certificate ARN to use for TLS." }, "BackstageName": { "Type": "String", "Default": "ACDP", "AllowedPattern": "^[A-Za-z0-9][A-Za-z0-9-_ ]*[A-Za-z0-9]$", "ConstraintDescription": "Backstage Name must begin and end with an alphanumeric character and only consist of alphanumeric characters, space, hyphen(-) and underscore(_)", "Description": "Name to use for the Backstage Portal" }, "BackstageOrg": { "Type": "String", "Default": "Auto", "AllowedPattern": "^[A-Za-z0-9][A-Za-z0-9-_ ]*[A-Za-z0-9]$", "ConstraintDescription": "Backstage Org must begin and end with an alphanumeric character and only consist of alphanumeric characters, space, hyphen(-) and underscore(_)", "Description": "Organization Name to use for the Backstage Portal" }, "BackstageLogLevel": { "Type": "String", "Default": "info", "AllowedValues": [ "debug", "info" ], "Description": "Log-level to set for the Backstage resources" }, "BackstageAdditionalScopes": { "Type": "String", "Default": "", "AllowedPattern": "^(?:[^\\s]+(?: [^\\s]+)*)?$", "ConstraintDescription": "Scopes should be a space separated list of strings, allowing most printable ASCII characters", "Description": "Additional scopes which Backstage will request from the configured identity provider on sign-in" }, "AdminUserEmail": { "Type": "String", "AllowedPattern": "(^$)|^[_A-Za-z0-9-\\+]+(\\.[_A-Za-z0-9-]+)*@[A-Za-z0-9-]+(\\.[A-Za-z0-9]+)*(\\.[A-Za-z]{2,})$", "ConstraintDescription": "User E-Mail must be a valid E-Mail address", "Description": "The user E-Mail to access backstage UI" }, "IdentityProviderId": { "Type": "String", "Default": "cms", "ConstraintDescription": "The identity provider ID must be a minimum of 3 characters.", "Description": "The ID associated with the identity provider configurations used for validation and exchange.", "MinLength": 3 }, "UseBackstageAuthRedirectFlow": { "Type": "String", "Default": "true", "AllowedValues": [ "true", "false" ], "ConstraintDescription": "Value must be boolean (true, false)", "Description": "Boolean flag that determines whether Backstage uses an experimental redirect flow instead of the default popup flow" }, "ShouldCreateCognitoUser": { "Type": "String", "Default": "true", "AllowedValues": [ "true", "false" ], "ConstraintDescription": "Value must be boolean (true, false)", "Description": "Boolean flag that determined whether to create an Amazon Cognito user using the Admin user email." }, "BackstageLocalAssetDiscoveryRefreshMins": { "Type": "Number", "Default": 30, "Description": "Refresh Frequency (minutes) for Backstage catalog provider from the Backstage Local Asset Bucket", "MinValue": 1 }, "EnableMultiAccountDeployment": { "Type": "String", "Default": "false", "AllowedValues": [ "true", "false" ], "ConstraintDescription": "Value must be boolean (true, false)", "Description": "Boolean flag that configures multi account deployment support" }, "OrgsManagementAwsAccountId": { "Type": "String", "Default": "null", "AllowedPattern": "^\\d{12}$|null$", "ConstraintDescription": "AWS Account Id must be a 12-digit number. This is only required if EnableMultiAccountDeployment is set to true.", "Description": "The 12-digit AWS account ID where Org Management Account resources are deployed. This is only required if EnableMultiAccountDeployment is set to true." }, "OrgsManagementAccountRegion": { "Type": "String", "Default": "null", "AllowedPattern": "^(us|eu|ap|sa|ca|me|af|il)-(north|south|east|west|central)-(1|2|3|4)$|null$", "ConstraintDescription": "Provide valid region name[Non government regions only]", "Description": "Region where org management accounts resources are located" } }, "Conditions": { "moduleinputsconstructisroute53hostedzoneidsetcondition7B6D6B93": { "Fn::Not": [ { "Fn::Equals": [ { "Ref": "Route53HostedZoneId" }, "" ] } ] }, "moduleinputsconstructiscustomacmcertificatearnsetcondition409229F6": { "Fn::Not": [ { "Fn::Equals": [ { "Ref": "CustomAcmCertificateArn" }, "" ] } ] }, "moduleinputsconstructisbackstageadditionalscopessetcondition622861A7": { "Fn::Not": [ { "Fn::Equals": [ { "Ref": "BackstageAdditionalScopes" }, "" ] } ] }, "acdpmultiaccountconstructshouldcreatemultiaccountpolicy6E0243F1": { "Fn::Equals": [ { "Ref": "EnableMultiAccountDeployment" }, "true" ] }, "CDKMetadataAvailable": { "Fn::Or": [ { "Fn::Or": [ { "Fn::Equals": [ { "Ref": "AWS::Region" }, "af-south-1" ] }, { "Fn::Equals": [ { "Ref": "AWS::Region" }, "ap-east-1" ] }, { "Fn::Equals": [ { "Ref": "AWS::Region" }, "ap-northeast-1" ] }, { "Fn::Equals": [ { "Ref": "AWS::Region" }, "ap-northeast-2" ] }, { "Fn::Equals": [ { "Ref": "AWS::Region" }, "ap-northeast-3" ] }, { "Fn::Equals": [ { "Ref": "AWS::Region" }, "ap-south-1" ] }, { "Fn::Equals": [ { "Ref": "AWS::Region" }, "ap-south-2" ] }, { "Fn::Equals": [ { "Ref": "AWS::Region" }, "ap-southeast-1" ] }, { "Fn::Equals": [ { "Ref": "AWS::Region" }, "ap-southeast-2" ] }, { "Fn::Equals": [ { "Ref": "AWS::Region" }, "ap-southeast-3" ] } ] }, { "Fn::Or": [ { "Fn::Equals": [ { "Ref": "AWS::Region" }, "ap-southeast-4" ] }, { "Fn::Equals": [ { "Ref": "AWS::Region" }, "ca-central-1" ] }, { "Fn::Equals": [ { "Ref": "AWS::Region" }, "ca-west-1" ] }, { "Fn::Equals": [ { "Ref": "AWS::Region" }, "cn-north-1" ] }, { "Fn::Equals": [ { "Ref": "AWS::Region" }, "cn-northwest-1" ] }, { "Fn::Equals": [ { "Ref": "AWS::Region" }, "eu-central-1" ] }, { "Fn::Equals": [ { "Ref": "AWS::Region" }, "eu-central-2" ] }, { "Fn::Equals": [ { "Ref": "AWS::Region" }, "eu-north-1" ] }, { "Fn::Equals": [ { "Ref": "AWS::Region" }, "eu-south-1" ] }, { "Fn::Equals": [ { "Ref": "AWS::Region" }, "eu-south-2" ] } ] }, { "Fn::Or": [ { "Fn::Equals": [ { "Ref": "AWS::Region" }, "eu-west-1" ] }, { "Fn::Equals": [ { "Ref": "AWS::Region" }, "eu-west-2" ] }, { "Fn::Equals": [ { "Ref": "AWS::Region" }, "eu-west-3" ] }, { "Fn::Equals": [ { "Ref": "AWS::Region" }, "il-central-1" ] }, { "Fn::Equals": [ { "Ref": "AWS::Region" }, "me-central-1" ] }, { "Fn::Equals": [ { "Ref": "AWS::Region" }, "me-south-1" ] }, { "Fn::Equals": [ { "Ref": "AWS::Region" }, "sa-east-1" ] }, { "Fn::Equals": [ { "Ref": "AWS::Region" }, "us-east-1" ] }, { "Fn::Equals": [ { "Ref": "AWS::Region" }, "us-east-2" ] }, { "Fn::Equals": [ { "Ref": "AWS::Region" }, "us-west-1" ] } ] }, { "Fn::Equals": [ { "Ref": "AWS::Region" }, "us-west-2" ] } ] } } }