{ "Description": "(SO0170) - Maintaining Personalized Experiences with Machine Learning. Version v1.5.0", "Metadata": { "AWS::CloudFormation::Interface": { "ParameterGroups": [ { "Label": { "default": "Solution Configuration" }, "Parameters": [ "Email" ] }, { "Label": { "default": "Security Configuration" }, "Parameters": [ "PersonalizeKmsKeyArn" ] } ], "ParameterLabels": { "Email": { "default": "Email" }, "PersonalizeKmsKeyArn": { "default": "(Optional) KMS key ARN used to encrypt Datasets managed by Amazon Personalize" } } }, "aws:solutions:templatename": "maintaining-personalized-experiences-with-machine-learning.template", "aws:solutions:solution_id": "SO0170", "aws:solutions:solution_version": "v1.5.0", "cdk_nag": { "rules_to_suppress": [ { "reason": "Python lambda runtime is maintained at version 3.11 as a stable version.", "id": "AwsSolutions-L1" } ] } }, "Mappings": { "Solution": { "Data": { "ID": "SO0170", "Version": "v1.5.0", "SendAnonymousUsageData": "Yes", "SolutionName": "maintaining-personalized-experiences-with-machine-learning", "ApplicationType": "AWS-Solutions" } }, "SourceCode": { "General": { "S3Bucket": "solutions", "KeyPrefix": "maintaining-personalized-experiences-with-machine-learning/v1.5.0" } }, "ServiceprincipalMap": { "af-south-1": { "states": "states.af-south-1.amazonaws.com" }, "ap-east-1": { "states": "states.ap-east-1.amazonaws.com" }, "ap-northeast-1": { "states": "states.ap-northeast-1.amazonaws.com" }, "ap-northeast-2": { "states": "states.ap-northeast-2.amazonaws.com" }, "ap-northeast-3": { "states": "states.ap-northeast-3.amazonaws.com" }, "ap-south-1": { "states": "states.ap-south-1.amazonaws.com" }, "ap-south-2": { "states": "states.ap-south-2.amazonaws.com" }, "ap-southeast-1": { "states": "states.ap-southeast-1.amazonaws.com" }, "ap-southeast-2": { "states": "states.ap-southeast-2.amazonaws.com" }, "ap-southeast-3": { "states": "states.ap-southeast-3.amazonaws.com" }, "ca-central-1": { "states": "states.ca-central-1.amazonaws.com" }, "cn-north-1": { "states": "states.cn-north-1.amazonaws.com" }, "cn-northwest-1": { "states": "states.cn-northwest-1.amazonaws.com" }, "eu-central-1": { "states": "states.eu-central-1.amazonaws.com" }, "eu-central-2": { "states": "states.eu-central-2.amazonaws.com" }, "eu-north-1": { "states": "states.eu-north-1.amazonaws.com" }, "eu-south-1": { "states": "states.eu-south-1.amazonaws.com" }, "eu-south-2": { "states": "states.eu-south-2.amazonaws.com" }, "eu-west-1": { "states": "states.eu-west-1.amazonaws.com" }, "eu-west-2": { "states": "states.eu-west-2.amazonaws.com" }, "eu-west-3": { "states": "states.eu-west-3.amazonaws.com" }, "me-central-1": { "states": "states.me-central-1.amazonaws.com" }, "me-south-1": { "states": "states.me-south-1.amazonaws.com" }, "sa-east-1": { "states": "states.sa-east-1.amazonaws.com" }, "us-east-1": { "states": "states.us-east-1.amazonaws.com" }, "us-east-2": { "states": "states.us-east-2.amazonaws.com" }, "us-gov-east-1": { "states": "states.us-gov-east-1.amazonaws.com" }, "us-gov-west-1": { "states": "states.us-gov-west-1.amazonaws.com" }, "us-iso-east-1": { "states": "states.amazonaws.com" }, "us-iso-west-1": { "states": "states.amazonaws.com" }, "us-isob-east-1": { "states": "states.amazonaws.com" }, "us-west-1": { "states": "states.us-west-1.amazonaws.com" }, "us-west-2": { "states": "states.us-west-2.amazonaws.com" } } }, "Parameters": { "Email": { "Type": "String", "Default": "", "AllowedPattern": "(^[a-zA-Z0-9_.+-]+@[a-zA-Z0-9-]+\\.[a-zA-Z0-9-.]+$|^$)", "ConstraintDescription": "Must be a valid email address or blank", "Description": "Email to notify with personalize workflow results", "MaxLength": 50 }, "PersonalizeKmsKeyArn": { "Type": "String", "Default": "", "AllowedPattern": "(^arn:.*:kms:.*:.*:key/.*$|^$)", "Description": "Provide Amazon Personalize with an alternate AWS Key Management (KMS) key to use to encrypt your datasets" } }, "Conditions": { "EmailProvided": { "Fn::Not": [ { "Fn::Equals": [ { "Ref": "Email" }, "" ] } ] }, "PersonalizeSseKmsEnabled": { "Fn::Not": [ { "Fn::Equals": [ { "Ref": "PersonalizeKmsKeyArn" }, "" ] } ] }, "SendAnonymousUsageData": { "Fn::Equals": [ { "Fn::FindInMap": [ "Solution", "Data", "SendAnonymousUsageData" ] }, "Yes" ] } }, "Resources": { "PowertoolsLayer8E932F0F197D4026A35423D184C2A624D967C184": { "Type": "AWS::Lambda::LayerVersion", "Properties": { "Content": { "S3Bucket": { "Fn::Join": [ "-", [ { "Fn::FindInMap": [ "SourceCode", "General", "S3Bucket" ] }, { "Ref": "AWS::Region" } ] ] }, "S3Key": { "Fn::Join": [ "/", [ { "Fn::FindInMap": [ "SourceCode", "General", "KeyPrefix" ] }, "PowertoolsLayer8E932F0F197D4026A35423D184C2A624D967C184.zip" ] ] } } } }, "SolutionsLayerDAE8E12F3DEA43FBA4AAE55AC50BD2E9B9D361F0": { "Type": "AWS::Lambda::LayerVersion", "Properties": { "Content": { "S3Bucket": { "Fn::Join": [ "-", [ { "Fn::FindInMap": [ "SourceCode", "General", "S3Bucket" ] }, { "Ref": "AWS::Region" } ] ] }, "S3Key": { "Fn::Join": [ "/", [ { "Fn::FindInMap": [ "SourceCode", "General", "KeyPrefix" ] }, "SolutionsLayerDAE8E12F3DEA43FBA4AAE55AC50BD2E9B9D361F0.zip" ] ] } } } }, "AccessLogsBucket": { "Type": "AWS::S3::Bucket", "Properties": { "BucketEncryption": { "ServerSideEncryptionConfiguration": [ { "ServerSideEncryptionByDefault": { "SSEAlgorithm": "AES256" } } ] }, "PublicAccessBlockConfiguration": { "BlockPublicAcls": true, "BlockPublicPolicy": true, "IgnorePublicAcls": true, "RestrictPublicBuckets": true }, "Tags": [ { "Key": "SOLUTION_ID", "Value": "SO0170" }, { "Key": "SOLUTION_NAME", "Value": "maintaining-personalized-experiences-with-machine-learning" }, { "Key": "SOLUTION_VERSION", "Value": "v1.5.0" } ] }, "UpdateReplacePolicy": "Retain", "DeletionPolicy": "Retain", "Metadata": { "cfn_nag": { "rules_to_suppress": [ { "id": "W35", "reason": "This bucket is used as the logging destination for personalization data processing" } ] } } }, "AccessLogsBucketPolicy7F77476F": { "Type": "AWS::S3::BucketPolicy", "Properties": { "Bucket": { "Ref": "AccessLogsBucket" }, "PolicyDocument": { "Statement": [ { "Action": "s3:*", "Condition": { "Bool": { "aws:SecureTransport": "false" } }, "Effect": "Deny", "Principal": { "AWS": "*" }, "Resource": [ { "Fn::GetAtt": [ "AccessLogsBucket", "Arn" ] }, { "Fn::Join": [ "", [ { "Fn::GetAtt": [ "AccessLogsBucket", "Arn" ] }, "/*" ] ] } ] }, { "Action": "*", "Condition": { "Bool": { "aws:SecureTransport": false } }, "Effect": "Deny", "Principal": { "AWS": "*" }, "Resource": { "Fn::Join": [ "", [ { "Fn::GetAtt": [ "AccessLogsBucket", "Arn" ] }, "/*" ] ] }, "Sid": "HttpsOnly" }, { "Action": "s3:PutObject", "Condition": { "ArnLike": { "aws:SourceArn": { "Fn::GetAtt": [ "PersonalizeBucket", "Arn" ] } }, "StringEquals": { "aws:SourceAccount": { "Ref": "AWS::AccountId" } } }, "Effect": "Allow", "Principal": { "Service": "logging.s3.amazonaws.com" }, "Resource": { "Fn::Join": [ "", [ { "Fn::GetAtt": [ "AccessLogsBucket", "Arn" ] }, "/personalize-bucket-access-logs/*" ] ] } } ], "Version": "2012-10-17" } } }, "PersonalizeBucket": { "Type": "AWS::S3::Bucket", "Properties": { "BucketEncryption": { "ServerSideEncryptionConfiguration": [ { "ServerSideEncryptionByDefault": { "SSEAlgorithm": "AES256" } } ] }, "LoggingConfiguration": { "DestinationBucketName": { "Ref": "AccessLogsBucket" }, "LogFilePrefix": "personalize-bucket-access-logs/" }, "PublicAccessBlockConfiguration": { "BlockPublicAcls": true, "BlockPublicPolicy": true, "IgnorePublicAcls": true, "RestrictPublicBuckets": true }, "Tags": [ { "Key": "SOLUTION_ID", "Value": "SO0170" }, { "Key": "SOLUTION_NAME", "Value": "maintaining-personalized-experiences-with-machine-learning" }, { "Key": "SOLUTION_VERSION", "Value": "v1.5.0" } ] }, "UpdateReplacePolicy": "Retain", "DeletionPolicy": "Retain" }, "PersonalizeBucketPolicy5818C815": { "Type": "AWS::S3::BucketPolicy", "Properties": { "Bucket": { "Ref": "PersonalizeBucket" }, "PolicyDocument": { "Statement": [ { "Action": "s3:*", "Condition": { "Bool": { "aws:SecureTransport": "false" } }, "Effect": "Deny", "Principal": { "AWS": "*" }, "Resource": [ { "Fn::GetAtt": [ "PersonalizeBucket", "Arn" ] }, { "Fn::Join": [ "", [ { "Fn::GetAtt": [ "PersonalizeBucket", "Arn" ] }, "/*" ] ] } ] }, { "Action": "*", "Condition": { "Bool": { "aws:SecureTransport": false } }, "Effect": "Deny", "Principal": { "AWS": "*" }, "Resource": { "Fn::Join": [ "", [ { "Fn::GetAtt": [ "PersonalizeBucket", "Arn" ] }, "/*" ] ] }, "Sid": "HttpsOnly" }, { "Action": [ "s3:GetObject", "s3:ListBucket" ], "Effect": "Allow", "Principal": { "Service": "personalize.amazonaws.com" }, "Resource": [ { "Fn::Join": [ "", [ { "Fn::GetAtt": [ "PersonalizeBucket", "Arn" ] }, "/*" ] ] }, { "Fn::GetAtt": [ "PersonalizeBucket", "Arn" ] } ] }, { "Action": [ "s3:GetObject", "s3:ListBucket", "s3:PutObject" ], "Effect": "Allow", "Principal": { "Service": "personalize.amazonaws.com" }, "Resource": [ { "Fn::Join": [ "", [ { "Fn::GetAtt": [ "PersonalizeBucket", "Arn" ] }, "/*" ] ] }, { "Fn::GetAtt": [ "PersonalizeBucket", "Arn" ] } ] } ], "Version": "2012-10-17" } } }, "PersonalizeBucketNotifications3328A32B": { "Type": "Custom::S3BucketNotifications", "Properties": { "ServiceToken": { "Fn::GetAtt": [ "BucketNotificationsHandler050a0587b7544547bf325f094a3db8347ECC3691", "Arn" ] }, "BucketName": { "Ref": "PersonalizeBucket" }, "NotificationConfiguration": { "LambdaFunctionConfigurations": [ { "Events": [ "s3:ObjectCreated:*" ], "Filter": { "Key": { "FilterRules": [ { "Name": "suffix", "Value": ".json" }, { "Name": "prefix", "Value": "train/" } ] } }, "LambdaFunctionArn": { "Fn::GetAtt": [ "S3EventHandlerBAFC08A8", "Arn" ] } } ] }, "Managed": true }, "DependsOn": [ "PersonalizeBucketAllowBucketNotificationsToPersonalizeStackS3EventHandler1E615CC4FE1A168A", "PersonalizeBucketPolicy5818C815" ] }, "PersonalizeBucketAllowBucketNotificationsToPersonalizeStackS3EventHandler1E615CC4FE1A168A": { "Type": "AWS::Lambda::Permission", "Properties": { "Action": "lambda:InvokeFunction", "FunctionName": { "Fn::GetAtt": [ "S3EventHandlerBAFC08A8", "Arn" ] }, "Principal": "s3.amazonaws.com", "SourceAccount": { "Ref": "AWS::AccountId" }, "SourceArn": { "Fn::GetAtt": [ "PersonalizeBucket", "Arn" ] } } }, "CreateConfigRole4E0B2FA5": { "Type": "AWS::IAM::Role", "Properties": { "AssumeRolePolicyDocument": { "Statement": [ { "Action": "sts:AssumeRole", "Effect": "Allow", "Principal": { "Service": "lambda.amazonaws.com" } } ], "Version": "2012-10-17" }, "Policies": [ { "PolicyDocument": { "Statement": [ { "Action": [ "logs:CreateLogGroup", "logs:CreateLogStream", "logs:PutLogEvents" ], "Effect": "Allow", "Resource": { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":logs:", { "Ref": "AWS::Region" }, ":", { "Ref": "AWS::AccountId" }, ":log-group:/aws/lambda/*" ] ] } } ], "Version": "2012-10-17" }, "PolicyName": "LambdaFunctionServiceRolePolicy" } ], "Tags": [ { "Key": "SOLUTION_ID", "Value": "SO0170" }, { "Key": "SOLUTION_NAME", "Value": "maintaining-personalized-experiences-with-machine-learning" }, { "Key": "SOLUTION_VERSION", "Value": "v1.5.0" } ] }, "Metadata": { "guard": { "SuppressedRules": [ "IAM_NO_INLINE_POLICY_CHECK" ] }, "cdk_nag": { "rules_to_suppress": [ { "reason": "All IAM policies defined in this solutiongrant only least-privilege permissions. Wildcard for resources is used only for serviceswhich do not have a resource arn", "id": "AwsSolutions-IAM5" }, { "reason": "We use AWS managed policies and do not need tochange as the \"*\" in resource is due to circular dependency.", "id": "AwsSolutions-IAM4" } ] } } }, "CreateConfigRoleDefaultPolicyBA07DEE7": { "Type": "AWS::IAM::Policy", "Properties": { "PolicyDocument": { "Statement": [ { "Action": [ "xray:PutTraceSegments", "xray:PutTelemetryRecords" ], "Effect": "Allow", "Resource": "*" }, { "Action": [ "personalize:Describe*", "personalize:List*" ], "Effect": "Allow", "Resource": { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":personalize:", { "Ref": "AWS::Region" }, ":", { "Ref": "AWS::AccountId" }, ":*" ] ] } } ], "Version": "2012-10-17" }, "PolicyName": "CreateConfigRoleDefaultPolicyBA07DEE7", "Roles": [ { "Ref": "CreateConfigRole4E0B2FA5" } ] }, "Metadata": { "cfn_nag": { "rules_to_suppress": [ { "id": "W12", "reason": "IAM policy for AWS X-Ray requires an allow on *" } ] }, "cdk_nag": { "rules_to_suppress": [ { "reason": "All IAM policies defined in this solutiongrant only least-privilege permissions. Wildcard for resources is used only for serviceswhich do not have a resource arn", "id": "AwsSolutions-IAM5" }, { "reason": "We use AWS managed policies and do not need tochange as the \"*\" in resource is due to circular dependency.", "id": "AwsSolutions-IAM4" } ] } } }, "CreateConfigF36C02E3": { "Type": "AWS::Lambda::Function", "Properties": { "Code": { "S3Bucket": { "Fn::Join": [ "-", [ { "Fn::FindInMap": [ "SourceCode", "General", "S3Bucket" ] }, { "Ref": "AWS::Region" } ] ] }, "S3Key": { "Fn::Join": [ "/", [ { "Fn::FindInMap": [ "SourceCode", "General", "KeyPrefix" ] }, "CreateConfigF36C02E3.zip" ] ] } }, "Environment": { "Variables": { "SOLUTION_NAME": "maintaining-personalized-experiences-with-machine-learning", "SOLUTION_ID": "SO0170", "SOLUTION_VERSION": "v1.5.0", "LOG_LEVEL": "INFO", "POWERTOOLS_SERVICE_NAME": "Workflow", "POWERTOOLS_METRICS_NAMESPACE": { "Fn::Join": [ "", [ "personalize_solution_", { "Ref": "AWS::StackName" } ] ] } } }, "Handler": "handler.lambda_handler", "Layers": [ { "Ref": "PowertoolsLayer8E932F0F197D4026A35423D184C2A624D967C184" }, { "Ref": "SolutionsLayerDAE8E12F3DEA43FBA4AAE55AC50BD2E9B9D361F0" } ], "Role": { "Fn::GetAtt": [ "CreateConfigRole4E0B2FA5", "Arn" ] }, "Runtime": "python3.11", "Tags": [ { "Key": "SOLUTION_ID", "Value": "SO0170" }, { "Key": "SOLUTION_NAME", "Value": "maintaining-personalized-experiences-with-machine-learning" }, { "Key": "SOLUTION_VERSION", "Value": "v1.5.0" } ], "Timeout": 90, "TracingConfig": { "Mode": "Active" } }, "DependsOn": [ "CreateConfigRoleDefaultPolicyBA07DEE7", "CreateConfigRole4E0B2FA5" ], "Metadata": { "cfn_nag": { "rules_to_suppress": [ { "id": "W89", "reason": "functions deployed by this solution do not require VPC access" }, { "id": "W92", "reason": "functions deployed by this solution do not require reserved concurrency" }, { "id": "W58", "reason": "functions deployed by this solution use custom policy to write to CloudWatch logs" } ] } } }, "PrepareInputSolutionStepprepareinputfnRole8C7731D0": { "Type": "AWS::IAM::Role", "Properties": { "AssumeRolePolicyDocument": { "Statement": [ { "Action": "sts:AssumeRole", "Effect": "Allow", "Principal": { "Service": "lambda.amazonaws.com" } } ], "Version": "2012-10-17" }, "Policies": [ { "PolicyDocument": { "Statement": [ { "Action": [ "logs:CreateLogGroup", "logs:CreateLogStream", "logs:PutLogEvents" ], "Effect": "Allow", "Resource": { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":logs:", { "Ref": "AWS::Region" }, ":", { "Ref": "AWS::AccountId" }, ":log-group:/aws/lambda/*" ] ] } } ], "Version": "2012-10-17" }, "PolicyName": "LambdaFunctionServiceRolePolicy" } ], "Tags": [ { "Key": "SOLUTION_ID", "Value": "SO0170" }, { "Key": "SOLUTION_NAME", "Value": "maintaining-personalized-experiences-with-machine-learning" }, { "Key": "SOLUTION_VERSION", "Value": "v1.5.0" } ] }, "Metadata": { "guard": { "SuppressedRules": [ "IAM_NO_INLINE_POLICY_CHECK" ] }, "cdk_nag": { "rules_to_suppress": [ { "reason": "All IAM policies defined in this solutiongrant only least-privilege permissions. Wildcard for resources is used only for serviceswhich do not have a resource arn", "id": "AwsSolutions-IAM5" }, { "reason": "We use AWS managed policies and do not need tochange as the \"*\" in resource is due to circular dependency.", "id": "AwsSolutions-IAM4" } ] } } }, "PrepareInputSolutionStepprepareinputfnRoleDefaultPolicy86D2515F": { "Type": "AWS::IAM::Policy", "Properties": { "PolicyDocument": { "Statement": [ { "Action": [ "xray:PutTraceSegments", "xray:PutTelemetryRecords" ], "Effect": "Allow", "Resource": "*" } ], "Version": "2012-10-17" }, "PolicyName": "PrepareInputSolutionStepprepareinputfnRoleDefaultPolicy86D2515F", "Roles": [ { "Ref": "PrepareInputSolutionStepprepareinputfnRole8C7731D0" } ] }, "Metadata": { "cfn_nag": { "rules_to_suppress": [ { "id": "W12", "reason": "IAM policy for AWS X-Ray requires an allow on *" } ] }, "cdk_nag": { "rules_to_suppress": [ { "reason": "All IAM policies defined in this solutiongrant only least-privilege permissions. Wildcard for resources is used only for serviceswhich do not have a resource arn", "id": "AwsSolutions-IAM5" }, { "reason": "We use AWS managed policies and do not need tochange as the \"*\" in resource is due to circular dependency.", "id": "AwsSolutions-IAM4" } ] } } }, "PrepareInputSolutionStepprepareinputfn2F0001F7": { "Type": "AWS::Lambda::Function", "Properties": { "Code": { "S3Bucket": { "Fn::Join": [ "-", [ { "Fn::FindInMap": [ "SourceCode", "General", "S3Bucket" ] }, { "Ref": "AWS::Region" } ] ] }, "S3Key": { "Fn::Join": [ "/", [ { "Fn::FindInMap": [ "SourceCode", "General", "KeyPrefix" ] }, "PrepareInputSolutionStepprepareinputfn2F0001F7.zip" ] ] } }, "Environment": { "Variables": { "SOLUTION_NAME": "maintaining-personalized-experiences-with-machine-learning", "SOLUTION_ID": "SO0170", "SOLUTION_VERSION": "v1.5.0", "LOG_LEVEL": "INFO", "POWERTOOLS_SERVICE_NAME": "Workflow", "POWERTOOLS_METRICS_NAMESPACE": { "Fn::Join": [ "", [ "personalize_solution_", { "Ref": "AWS::StackName" } ] ] } } }, "Handler": "handler.lambda_handler", "Layers": [ { "Ref": "PowertoolsLayer8E932F0F197D4026A35423D184C2A624D967C184" }, { "Ref": "SolutionsLayerDAE8E12F3DEA43FBA4AAE55AC50BD2E9B9D361F0" } ], "Role": { "Fn::GetAtt": [ "PrepareInputSolutionStepprepareinputfnRole8C7731D0", "Arn" ] }, "Runtime": "python3.11", "Tags": [ { "Key": "SOLUTION_ID", "Value": "SO0170" }, { "Key": "SOLUTION_NAME", "Value": "maintaining-personalized-experiences-with-machine-learning" }, { "Key": "SOLUTION_VERSION", "Value": "v1.5.0" } ], "Timeout": 15, "TracingConfig": { "Mode": "Active" } }, "DependsOn": [ "PrepareInputSolutionStepprepareinputfnRoleDefaultPolicy86D2515F", "PrepareInputSolutionStepprepareinputfnRole8C7731D0" ], "Metadata": { "cdk_nag": { "rules_to_suppress": [ { "reason": "All IAM policies defined in this solutiongrant only least-privilege permissions. Wildcard for resources is used only for serviceswhich do not have a resource arn", "id": "AwsSolutions-IAM5" }, { "reason": "We use AWS managed policies and do not need tochange as the \"*\" in resource is due to circular dependency.", "id": "AwsSolutions-IAM4" } ] }, "cfn_nag": { "rules_to_suppress": [ { "id": "W89", "reason": "functions deployed by this solution do not require VPC access" }, { "id": "W92", "reason": "functions deployed by this solution do not require reserved concurrency" }, { "id": "W58", "reason": "functions deployed by this solution use custom policy to write to CloudWatch logs" } ] } } }, "CreateDatasetGroupSolutionStepcreatedatasetgroupfnRole6DF95387": { "Type": "AWS::IAM::Role", "Properties": { "AssumeRolePolicyDocument": { "Statement": [ { "Action": "sts:AssumeRole", "Effect": "Allow", "Principal": { "Service": "lambda.amazonaws.com" } } ], "Version": "2012-10-17" }, "Policies": [ { "PolicyDocument": { "Statement": [ { "Action": [ "logs:CreateLogGroup", "logs:CreateLogStream", "logs:PutLogEvents" ], "Effect": "Allow", "Resource": { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":logs:", { "Ref": "AWS::Region" }, ":", { "Ref": "AWS::AccountId" }, ":log-group:/aws/lambda/*" ] ] } } ], "Version": "2012-10-17" }, "PolicyName": "LambdaFunctionServiceRolePolicy" } ], "Tags": [ { "Key": "SOLUTION_ID", "Value": "SO0170" }, { "Key": "SOLUTION_NAME", "Value": "maintaining-personalized-experiences-with-machine-learning" }, { "Key": "SOLUTION_VERSION", "Value": "v1.5.0" } ] }, "Metadata": { "guard": { "SuppressedRules": [ "IAM_NO_INLINE_POLICY_CHECK" ] }, "cdk_nag": { "rules_to_suppress": [ { "reason": "All IAM policies defined in this solutiongrant only least-privilege permissions. Wildcard for resources is used only for serviceswhich do not have a resource arn", "id": "AwsSolutions-IAM5" }, { "reason": "We use AWS managed policies and do not need tochange as the \"*\" in resource is due to circular dependency.", "id": "AwsSolutions-IAM4" } ] } } }, "CreateDatasetGroupSolutionStepcreatedatasetgroupfnRoleDefaultPolicyCB0F0284": { "Type": "AWS::IAM::Policy", "Properties": { "PolicyDocument": { "Statement": [ { "Action": [ "xray:PutTraceSegments", "xray:PutTelemetryRecords" ], "Effect": "Allow", "Resource": "*" }, { "Action": [ "personalize:DescribeDatasetGroup", "personalize:CreateDatasetGroup", "personalize:TagResource", "personalize:ListTagsForResource" ], "Effect": "Allow", "Resource": { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":personalize:", { "Ref": "AWS::Region" }, ":", { "Ref": "AWS::AccountId" }, ":dataset-group/*" ] ] } }, { "Action": "events:PutEvents", "Effect": "Allow", "Resource": { "Fn::GetAtt": [ "Notifications87298708", "Arn" ] } } ], "Version": "2012-10-17" }, "PolicyName": "CreateDatasetGroupSolutionStepcreatedatasetgroupfnRoleDefaultPolicyCB0F0284", "Roles": [ { "Ref": "CreateDatasetGroupSolutionStepcreatedatasetgroupfnRole6DF95387" } ] }, "Metadata": { "cfn_nag": { "rules_to_suppress": [ { "id": "W12", "reason": "IAM policy for AWS X-Ray requires an allow on *" } ] }, "cdk_nag": { "rules_to_suppress": [ { "reason": "All IAM policies defined in this solutiongrant only least-privilege permissions. Wildcard for resources is used only for serviceswhich do not have a resource arn", "id": "AwsSolutions-IAM5" }, { "reason": "We use AWS managed policies and do not need tochange as the \"*\" in resource is due to circular dependency.", "id": "AwsSolutions-IAM4" } ] } } }, "CreateDatasetGroupSolutionStepcreatedatasetgroupfnA7D8C46A": { "Type": "AWS::Lambda::Function", "Properties": { "Code": { "S3Bucket": { "Fn::Join": [ "-", [ { "Fn::FindInMap": [ "SourceCode", "General", "S3Bucket" ] }, { "Ref": "AWS::Region" } ] ] }, "S3Key": { "Fn::Join": [ "/", [ { "Fn::FindInMap": [ "SourceCode", "General", "KeyPrefix" ] }, "CreateDatasetGroupSolutionStepcreatedatasetgroupfnA7D8C46A.zip" ] ] } }, "Environment": { "Variables": { "KMS_ROLE_ARN": { "Fn::If": [ "PersonalizeSseKmsEnabled", { "Fn::GetAtt": [ "CreateDatasetGroupSolutionStepPersonalizeKMSReadWriteRole7EC5F318", "Arn" ] }, "" ] }, "KMS_KEY_ARN": { "Fn::If": [ "PersonalizeSseKmsEnabled", { "Ref": "PersonalizeKmsKeyArn" }, "" ] }, "SOLUTION_NAME": "maintaining-personalized-experiences-with-machine-learning", "SOLUTION_ID": "SO0170", "SOLUTION_VERSION": "v1.5.0", "LOG_LEVEL": "INFO", "POWERTOOLS_SERVICE_NAME": "Workflow", "POWERTOOLS_METRICS_NAMESPACE": { "Fn::Join": [ "", [ "personalize_solution_", { "Ref": "AWS::StackName" } ] ] }, "EVENT_BUS_ARN": { "Fn::GetAtt": [ "Notifications87298708", "Arn" ] } } }, "Handler": "handler.lambda_handler", "Layers": [ { "Ref": "PowertoolsLayer8E932F0F197D4026A35423D184C2A624D967C184" }, { "Ref": "SolutionsLayerDAE8E12F3DEA43FBA4AAE55AC50BD2E9B9D361F0" } ], "Role": { "Fn::GetAtt": [ "CreateDatasetGroupSolutionStepcreatedatasetgroupfnRole6DF95387", "Arn" ] }, "Runtime": "python3.11", "Tags": [ { "Key": "SOLUTION_ID", "Value": "SO0170" }, { "Key": "SOLUTION_NAME", "Value": "maintaining-personalized-experiences-with-machine-learning" }, { "Key": "SOLUTION_VERSION", "Value": "v1.5.0" } ], "Timeout": 15, "TracingConfig": { "Mode": "Active" } }, "DependsOn": [ "CreateDatasetGroupSolutionStepcreatedatasetgroupfnRoleDefaultPolicyCB0F0284", "CreateDatasetGroupSolutionStepcreatedatasetgroupfnRole6DF95387" ], "Metadata": { "cdk_nag": { "rules_to_suppress": [ { "reason": "All IAM policies defined in this solutiongrant only least-privilege permissions. Wildcard for resources is used only for serviceswhich do not have a resource arn", "id": "AwsSolutions-IAM5" }, { "reason": "We use AWS managed policies and do not need tochange as the \"*\" in resource is due to circular dependency.", "id": "AwsSolutions-IAM4" } ] }, "cfn_nag": { "rules_to_suppress": [ { "id": "W89", "reason": "functions deployed by this solution do not require VPC access" }, { "id": "W92", "reason": "functions deployed by this solution do not require reserved concurrency" }, { "id": "W58", "reason": "functions deployed by this solution use custom policy to write to CloudWatch logs" } ] } } }, "CreateDatasetGroupSolutionStepKmsResourceNameHashKmsResourceNameHashHashResourceB003B746": { "Type": "Custom::ResourceHash", "Properties": { "ServiceToken": { "Fn::GetAtt": [ "ResourceHashFunctionb8785f5315314bfba11926aa638d7b19963F2822", "Arn" ] }, "Purpose": "PersonalizeKMSReadWriteRole", "MaxLength": 64 }, "Metadata": { "cdk_nag": { "rules_to_suppress": [ { "reason": "All IAM policies defined in this solutiongrant only least-privilege permissions. Wildcard for resources is used only for serviceswhich do not have a resource arn", "id": "AwsSolutions-IAM5" }, { "reason": "We use AWS managed policies and do not need tochange as the \"*\" in resource is due to circular dependency.", "id": "AwsSolutions-IAM4" } ] } } }, "CreateDatasetGroupSolutionStepPersonalizeKMSReadWriteRole7EC5F318": { "Type": "AWS::IAM::Role", "Properties": { "AssumeRolePolicyDocument": { "Statement": [ { "Action": "sts:AssumeRole", "Effect": "Allow", "Principal": { "Service": "personalize.amazonaws.com" } } ], "Version": "2012-10-17" }, "Description": "Grants Amazon Personalize access to use the specified KMS Key for SSE-KMS", "Policies": [ { "PolicyDocument": { "Statement": [ { "Action": [ "kms:Encrypt", "kms:ReEncrypt", "kms:Decrypt", "kms:CreateGrant", "kms:RevokeGrant", "kms:RetireGrant", "kms:ListGrants", "kms:GenerateDataKey", "kms:DescribeKey" ], "Effect": "Allow", "Resource": { "Ref": "PersonalizeKmsKeyArn" } } ], "Version": "2012-10-17" }, "PolicyName": "PersonalizeKmsWriteAccess" }, { "PolicyDocument": { "Statement": [ { "Action": [ "kms:Decrypt", "kms:DescribeKey", "kms:GenerateDataKey" ], "Effect": "Allow", "Resource": { "Ref": "PersonalizeKmsKeyArn" } } ], "Version": "2012-10-17" }, "PolicyName": "PersonalizeKmsReadAccess" } ], "RoleName": { "Fn::GetAtt": [ "CreateDatasetGroupSolutionStepKmsResourceNameHashKmsResourceNameHashHashResourceB003B746", "Name" ] }, "Tags": [ { "Key": "SOLUTION_ID", "Value": "SO0170" }, { "Key": "SOLUTION_NAME", "Value": "maintaining-personalized-experiences-with-machine-learning" }, { "Key": "SOLUTION_VERSION", "Value": "v1.5.0" } ] }, "Metadata": { "cfn_nag": { "rules_to_suppress": [ { "id": "W28", "reason": "Resource requires consistent name across stack deployments and is unique per region + stack" } ] }, "guard": { "SuppressedRules": [ "IAM_NO_INLINE_POLICY_CHECK" ] }, "cdk_nag": { "rules_to_suppress": [ { "reason": "All IAM policies defined in this solutiongrant only least-privilege permissions. Wildcard for resources is used only for serviceswhich do not have a resource arn", "id": "AwsSolutions-IAM5" }, { "reason": "We use AWS managed policies and do not need tochange as the \"*\" in resource is due to circular dependency.", "id": "AwsSolutions-IAM4" } ] } }, "Condition": "PersonalizeSseKmsEnabled" }, "CreateDatasetGroupSolutionStepPersonalizeKmsPassRole1C16D150": { "Type": "AWS::IAM::ManagedPolicy", "Properties": { "Description": "", "Path": "/", "PolicyDocument": { "Statement": [ { "Action": "iam:PassRole", "Effect": "Allow", "Resource": { "Fn::GetAtt": [ "CreateDatasetGroupSolutionStepPersonalizeKMSReadWriteRole7EC5F318", "Arn" ] } } ], "Version": "2012-10-17" }, "Roles": [ { "Ref": "CreateDatasetGroupSolutionStepcreatedatasetgroupfnRole6DF95387" } ] }, "Metadata": { "cdk_nag": { "rules_to_suppress": [ { "reason": "All IAM policies defined in this solutiongrant only least-privilege permissions. Wildcard for resources is used only for serviceswhich do not have a resource arn", "id": "AwsSolutions-IAM5" }, { "reason": "We use AWS managed policies and do not need tochange as the \"*\" in resource is due to circular dependency.", "id": "AwsSolutions-IAM4" } ] } }, "Condition": "PersonalizeSseKmsEnabled" }, "ResourceHashFunctionb8785f5315314bfba11926aa638d7b19Role5FEB0590": { "Type": "AWS::IAM::Role", "Properties": { "AssumeRolePolicyDocument": { "Statement": [ { "Action": "sts:AssumeRole", "Effect": "Allow", "Principal": { "Service": "lambda.amazonaws.com" } } ], "Version": "2012-10-17" }, "Policies": [ { "PolicyDocument": { "Statement": [ { "Action": [ "logs:CreateLogGroup", "logs:CreateLogStream", "logs:PutLogEvents" ], "Effect": "Allow", "Resource": { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":logs:", { "Ref": "AWS::Region" }, ":", { "Ref": "AWS::AccountId" }, ":log-group:/aws/lambda/*" ] ] } } ], "Version": "2012-10-17" }, "PolicyName": "LambdaFunctionServiceRolePolicy" } ], "Tags": [ { "Key": "SOLUTION_ID", "Value": "SO0170" }, { "Key": "SOLUTION_NAME", "Value": "maintaining-personalized-experiences-with-machine-learning" }, { "Key": "SOLUTION_VERSION", "Value": "v1.5.0" } ] }, "Metadata": { "guard": { "SuppressedRules": [ "IAM_NO_INLINE_POLICY_CHECK" ] }, "cdk_nag": { "rules_to_suppress": [ { "reason": "All IAM policies defined in this solutiongrant only least-privilege permissions. Wild card for resources is used only for services which do not have a resource arn", "id": "AwsSolutions-IAM5" } ] } } }, "ResourceHashFunctionb8785f5315314bfba11926aa638d7b19963F2822": { "Type": "AWS::Lambda::Function", "Properties": { "Code": { "S3Bucket": { "Fn::Join": [ "-", [ { "Fn::FindInMap": [ "SourceCode", "General", "S3Bucket" ] }, { "Ref": "AWS::Region" } ] ] }, "S3Key": { "Fn::Join": [ "/", [ { "Fn::FindInMap": [ "SourceCode", "General", "KeyPrefix" ] }, "ResourceHashFunctionb8785f5315314bfba11926aa638d7b19963F2822.zip" ] ] } }, "Handler": "hash.handler", "Role": { "Fn::GetAtt": [ "ResourceHashFunctionb8785f5315314bfba11926aa638d7b19Role5FEB0590", "Arn" ] }, "Runtime": "python3.11", "Tags": [ { "Key": "SOLUTION_ID", "Value": "SO0170" }, { "Key": "SOLUTION_NAME", "Value": "maintaining-personalized-experiences-with-machine-learning" }, { "Key": "SOLUTION_VERSION", "Value": "v1.5.0" } ] }, "DependsOn": [ "ResourceHashFunctionb8785f5315314bfba11926aa638d7b19Role5FEB0590" ], "Metadata": { "cfn_nag": { "rules_to_suppress": [ { "id": "W89", "reason": "functions deployed by this solution do not require VPC access" }, { "id": "W92", "reason": "functions deployed by this solution do not require reserved concurrency" }, { "id": "W58", "reason": "functions deployed by this solution use custom policy to write to CloudWatch logs" } ] } } }, "CreateSchemaSolutionStepcreateschemafnRoleB256E0C7": { "Type": "AWS::IAM::Role", "Properties": { "AssumeRolePolicyDocument": { "Statement": [ { "Action": "sts:AssumeRole", "Effect": "Allow", "Principal": { "Service": "lambda.amazonaws.com" } } ], "Version": "2012-10-17" }, "Policies": [ { "PolicyDocument": { "Statement": [ { "Action": [ "logs:CreateLogGroup", "logs:CreateLogStream", "logs:PutLogEvents" ], "Effect": "Allow", "Resource": { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":logs:", { "Ref": "AWS::Region" }, ":", { "Ref": "AWS::AccountId" }, ":log-group:/aws/lambda/*" ] ] } } ], "Version": "2012-10-17" }, "PolicyName": "LambdaFunctionServiceRolePolicy" } ], "Tags": [ { "Key": "SOLUTION_ID", "Value": "SO0170" }, { "Key": "SOLUTION_NAME", "Value": "maintaining-personalized-experiences-with-machine-learning" }, { "Key": "SOLUTION_VERSION", "Value": "v1.5.0" } ] }, "Metadata": { "guard": { "SuppressedRules": [ "IAM_NO_INLINE_POLICY_CHECK" ] }, "cdk_nag": { "rules_to_suppress": [ { "reason": "All IAM policies defined in this solutiongrant only least-privilege permissions. Wildcard for resources is used only for serviceswhich do not have a resource arn", "id": "AwsSolutions-IAM5" }, { "reason": "We use AWS managed policies and do not need tochange as the \"*\" in resource is due to circular dependency.", "id": "AwsSolutions-IAM4" } ] } } }, "CreateSchemaSolutionStepcreateschemafnRoleDefaultPolicyC3BE3F40": { "Type": "AWS::IAM::Policy", "Properties": { "PolicyDocument": { "Statement": [ { "Action": [ "xray:PutTraceSegments", "xray:PutTelemetryRecords" ], "Effect": "Allow", "Resource": "*" }, { "Action": [ "personalize:DescribeSchema", "personalize:CreateSchema" ], "Effect": "Allow", "Resource": { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":personalize:", { "Ref": "AWS::Region" }, ":", { "Ref": "AWS::AccountId" }, ":schema/*" ] ] } }, { "Action": "events:PutEvents", "Effect": "Allow", "Resource": { "Fn::GetAtt": [ "Notifications87298708", "Arn" ] } } ], "Version": "2012-10-17" }, "PolicyName": "CreateSchemaSolutionStepcreateschemafnRoleDefaultPolicyC3BE3F40", "Roles": [ { "Ref": "CreateSchemaSolutionStepcreateschemafnRoleB256E0C7" } ] }, "Metadata": { "cfn_nag": { "rules_to_suppress": [ { "id": "W12", "reason": "IAM policy for AWS X-Ray requires an allow on *" } ] }, "cdk_nag": { "rules_to_suppress": [ { "reason": "All IAM policies defined in this solutiongrant only least-privilege permissions. Wildcard for resources is used only for serviceswhich do not have a resource arn", "id": "AwsSolutions-IAM5" }, { "reason": "We use AWS managed policies and do not need tochange as the \"*\" in resource is due to circular dependency.", "id": "AwsSolutions-IAM4" } ] } } }, "CreateSchemaSolutionStepcreateschemafn2A793C8A": { "Type": "AWS::Lambda::Function", "Properties": { "Code": { "S3Bucket": { "Fn::Join": [ "-", [ { "Fn::FindInMap": [ "SourceCode", "General", "S3Bucket" ] }, { "Ref": "AWS::Region" } ] ] }, "S3Key": { "Fn::Join": [ "/", [ { "Fn::FindInMap": [ "SourceCode", "General", "KeyPrefix" ] }, "CreateSchemaSolutionStepcreateschemafn2A793C8A.zip" ] ] } }, "Environment": { "Variables": { "SOLUTION_NAME": "maintaining-personalized-experiences-with-machine-learning", "SOLUTION_ID": "SO0170", "SOLUTION_VERSION": "v1.5.0", "LOG_LEVEL": "INFO", "POWERTOOLS_SERVICE_NAME": "Workflow", "POWERTOOLS_METRICS_NAMESPACE": { "Fn::Join": [ "", [ "personalize_solution_", { "Ref": "AWS::StackName" } ] ] }, "EVENT_BUS_ARN": { "Fn::GetAtt": [ "Notifications87298708", "Arn" ] } } }, "Handler": "handler.lambda_handler", "Layers": [ { "Ref": "PowertoolsLayer8E932F0F197D4026A35423D184C2A624D967C184" }, { "Ref": "SolutionsLayerDAE8E12F3DEA43FBA4AAE55AC50BD2E9B9D361F0" } ], "Role": { "Fn::GetAtt": [ "CreateSchemaSolutionStepcreateschemafnRoleB256E0C7", "Arn" ] }, "Runtime": "python3.11", "Tags": [ { "Key": "SOLUTION_ID", "Value": "SO0170" }, { "Key": "SOLUTION_NAME", "Value": "maintaining-personalized-experiences-with-machine-learning" }, { "Key": "SOLUTION_VERSION", "Value": "v1.5.0" } ], "Timeout": 15, "TracingConfig": { "Mode": "Active" } }, "DependsOn": [ "CreateSchemaSolutionStepcreateschemafnRoleDefaultPolicyC3BE3F40", "CreateSchemaSolutionStepcreateschemafnRoleB256E0C7" ], "Metadata": { "cdk_nag": { "rules_to_suppress": [ { "reason": "All IAM policies defined in this solutiongrant only least-privilege permissions. Wildcard for resources is used only for serviceswhich do not have a resource arn", "id": "AwsSolutions-IAM5" }, { "reason": "We use AWS managed policies and do not need tochange as the \"*\" in resource is due to circular dependency.", "id": "AwsSolutions-IAM4" } ] }, "cfn_nag": { "rules_to_suppress": [ { "id": "W89", "reason": "functions deployed by this solution do not require VPC access" }, { "id": "W92", "reason": "functions deployed by this solution do not require reserved concurrency" }, { "id": "W58", "reason": "functions deployed by this solution use custom policy to write to CloudWatch logs" } ] } } }, "CreateDatasetSolutionStepcreatedatasetfnRole6648EB3D": { "Type": "AWS::IAM::Role", "Properties": { "AssumeRolePolicyDocument": { "Statement": [ { "Action": "sts:AssumeRole", "Effect": "Allow", "Principal": { "Service": "lambda.amazonaws.com" } } ], "Version": "2012-10-17" }, "Policies": [ { "PolicyDocument": { "Statement": [ { "Action": [ "logs:CreateLogGroup", "logs:CreateLogStream", "logs:PutLogEvents" ], "Effect": "Allow", "Resource": { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":logs:", { "Ref": "AWS::Region" }, ":", { "Ref": "AWS::AccountId" }, ":log-group:/aws/lambda/*" ] ] } } ], "Version": "2012-10-17" }, "PolicyName": "LambdaFunctionServiceRolePolicy" } ], "Tags": [ { "Key": "SOLUTION_ID", "Value": "SO0170" }, { "Key": "SOLUTION_NAME", "Value": "maintaining-personalized-experiences-with-machine-learning" }, { "Key": "SOLUTION_VERSION", "Value": "v1.5.0" } ] }, "Metadata": { "guard": { "SuppressedRules": [ "IAM_NO_INLINE_POLICY_CHECK" ] }, "cdk_nag": { "rules_to_suppress": [ { "reason": "All IAM policies defined in this solutiongrant only least-privilege permissions. Wildcard for resources is used only for serviceswhich do not have a resource arn", "id": "AwsSolutions-IAM5" }, { "reason": "We use AWS managed policies and do not need tochange as the \"*\" in resource is due to circular dependency.", "id": "AwsSolutions-IAM4" } ] } } }, "CreateDatasetSolutionStepcreatedatasetfnRoleDefaultPolicy3115CD68": { "Type": "AWS::IAM::Policy", "Properties": { "PolicyDocument": { "Statement": [ { "Action": [ "xray:PutTraceSegments", "xray:PutTelemetryRecords" ], "Effect": "Allow", "Resource": "*" }, { "Action": [ "personalize:DescribeDatasetGroup", "personalize:DescribeSchema", "personalize:CreateDataset", "personalize:DescribeDataset", "personalize:ListDatasets", "personalize:TagResource", "personalize:ListTagsForResource" ], "Effect": "Allow", "Resource": [ { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":personalize:", { "Ref": "AWS::Region" }, ":", { "Ref": "AWS::AccountId" }, ":dataset-group/*" ] ] }, { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":personalize:", { "Ref": "AWS::Region" }, ":", { "Ref": "AWS::AccountId" }, ":schema/*" ] ] }, { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":personalize:", { "Ref": "AWS::Region" }, ":", { "Ref": "AWS::AccountId" }, ":dataset/*" ] ] } ] }, { "Action": "events:PutEvents", "Effect": "Allow", "Resource": { "Fn::GetAtt": [ "Notifications87298708", "Arn" ] } } ], "Version": "2012-10-17" }, "PolicyName": "CreateDatasetSolutionStepcreatedatasetfnRoleDefaultPolicy3115CD68", "Roles": [ { "Ref": "CreateDatasetSolutionStepcreatedatasetfnRole6648EB3D" } ] }, "Metadata": { "cfn_nag": { "rules_to_suppress": [ { "id": "W12", "reason": "IAM policy for AWS X-Ray requires an allow on *" } ] }, "cdk_nag": { "rules_to_suppress": [ { "reason": "All IAM policies defined in this solutiongrant only least-privilege permissions. Wildcard for resources is used only for serviceswhich do not have a resource arn", "id": "AwsSolutions-IAM5" }, { "reason": "We use AWS managed policies and do not need tochange as the \"*\" in resource is due to circular dependency.", "id": "AwsSolutions-IAM4" } ] } } }, "CreateDatasetSolutionStepcreatedatasetfn072D6427": { "Type": "AWS::Lambda::Function", "Properties": { "Code": { "S3Bucket": { "Fn::Join": [ "-", [ { "Fn::FindInMap": [ "SourceCode", "General", "S3Bucket" ] }, { "Ref": "AWS::Region" } ] ] }, "S3Key": { "Fn::Join": [ "/", [ { "Fn::FindInMap": [ "SourceCode", "General", "KeyPrefix" ] }, "CreateDatasetSolutionStepcreatedatasetfn072D6427.zip" ] ] } }, "Environment": { "Variables": { "SOLUTION_NAME": "maintaining-personalized-experiences-with-machine-learning", "SOLUTION_ID": "SO0170", "SOLUTION_VERSION": "v1.5.0", "LOG_LEVEL": "INFO", "POWERTOOLS_SERVICE_NAME": "Workflow", "POWERTOOLS_METRICS_NAMESPACE": { "Fn::Join": [ "", [ "personalize_solution_", { "Ref": "AWS::StackName" } ] ] }, "EVENT_BUS_ARN": { "Fn::GetAtt": [ "Notifications87298708", "Arn" ] } } }, "Handler": "handler.lambda_handler", "Layers": [ { "Ref": "PowertoolsLayer8E932F0F197D4026A35423D184C2A624D967C184" }, { "Ref": "SolutionsLayerDAE8E12F3DEA43FBA4AAE55AC50BD2E9B9D361F0" } ], "Role": { "Fn::GetAtt": [ "CreateDatasetSolutionStepcreatedatasetfnRole6648EB3D", "Arn" ] }, "Runtime": "python3.11", "Tags": [ { "Key": "SOLUTION_ID", "Value": "SO0170" }, { "Key": "SOLUTION_NAME", "Value": "maintaining-personalized-experiences-with-machine-learning" }, { "Key": "SOLUTION_VERSION", "Value": "v1.5.0" } ], "Timeout": 15, "TracingConfig": { "Mode": "Active" } }, "DependsOn": [ "CreateDatasetSolutionStepcreatedatasetfnRoleDefaultPolicy3115CD68", "CreateDatasetSolutionStepcreatedatasetfnRole6648EB3D" ], "Metadata": { "cdk_nag": { "rules_to_suppress": [ { "reason": "All IAM policies defined in this solutiongrant only least-privilege permissions. Wildcard for resources is used only for serviceswhich do not have a resource arn", "id": "AwsSolutions-IAM5" }, { "reason": "We use AWS managed policies and do not need tochange as the \"*\" in resource is due to circular dependency.", "id": "AwsSolutions-IAM4" } ] }, "cfn_nag": { "rules_to_suppress": [ { "id": "W89", "reason": "functions deployed by this solution do not require VPC access" }, { "id": "W92", "reason": "functions deployed by this solution do not require reserved concurrency" }, { "id": "W58", "reason": "functions deployed by this solution use custom policy to write to CloudWatch logs" } ] } } }, "PersonalizeS3ReadRole7BE661E6": { "Type": "AWS::IAM::Role", "Properties": { "AssumeRolePolicyDocument": { "Statement": [ { "Action": "sts:AssumeRole", "Effect": "Allow", "Principal": { "Service": "personalize.amazonaws.com" } } ], "Version": "2012-10-17" }, "Description": "Grants Amazon Personalize access to read from S3", "Policies": [ { "PolicyDocument": { "Statement": [ { "Action": [ "s3:GetObject", "s3:ListBucket" ], "Effect": "Allow", "Resource": [ { "Fn::Join": [ "", [ { "Fn::GetAtt": [ "PersonalizeBucket", "Arn" ] }, "/*" ] ] }, { "Fn::GetAtt": [ "PersonalizeBucket", "Arn" ] } ] } ], "Version": "2012-10-17" }, "PolicyName": "PersonalizeS3ReadPolicy" } ], "Tags": [ { "Key": "SOLUTION_ID", "Value": "SO0170" }, { "Key": "SOLUTION_NAME", "Value": "maintaining-personalized-experiences-with-machine-learning" }, { "Key": "SOLUTION_VERSION", "Value": "v1.5.0" } ] }, "Metadata": { "cdk_nag": { "rules_to_suppress": [ { "reason": "All IAM policies defined in this solutiongrant only least-privilege permissions. Wild card for resources is used only for services which do not have a resource arn", "id": "AwsSolutions-IAM5" } ] }, "guard": { "SuppressedRules": [ "IAM_NO_INLINE_POLICY_CHECK" ] } } }, "CreateDatasetImportJobSolutionStepcreatedatasetimportjobfnRole1D83FDE8": { "Type": "AWS::IAM::Role", "Properties": { "AssumeRolePolicyDocument": { "Statement": [ { "Action": "sts:AssumeRole", "Effect": "Allow", "Principal": { "Service": "lambda.amazonaws.com" } } ], "Version": "2012-10-17" }, "Policies": [ { "PolicyDocument": { "Statement": [ { "Action": [ "logs:CreateLogGroup", "logs:CreateLogStream", "logs:PutLogEvents" ], "Effect": "Allow", "Resource": { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":logs:", { "Ref": "AWS::Region" }, ":", { "Ref": "AWS::AccountId" }, ":log-group:/aws/lambda/*" ] ] } } ], "Version": "2012-10-17" }, "PolicyName": "LambdaFunctionServiceRolePolicy" } ], "Tags": [ { "Key": "SOLUTION_ID", "Value": "SO0170" }, { "Key": "SOLUTION_NAME", "Value": "maintaining-personalized-experiences-with-machine-learning" }, { "Key": "SOLUTION_VERSION", "Value": "v1.5.0" } ] }, "Metadata": { "guard": { "SuppressedRules": [ "IAM_NO_INLINE_POLICY_CHECK" ] }, "cdk_nag": { "rules_to_suppress": [ { "reason": "All IAM policies defined in this solutiongrant only least-privilege permissions. Wildcard for resources is used only for serviceswhich do not have a resource arn", "id": "AwsSolutions-IAM5" }, { "reason": "We use AWS managed policies and do not need tochange as the \"*\" in resource is due to circular dependency.", "id": "AwsSolutions-IAM4" } ] } } }, "CreateDatasetImportJobSolutionStepcreatedatasetimportjobfnRoleDefaultPolicyF6CFDA4A": { "Type": "AWS::IAM::Policy", "Properties": { "PolicyDocument": { "Statement": [ { "Action": [ "xray:PutTraceSegments", "xray:PutTelemetryRecords" ], "Effect": "Allow", "Resource": "*" }, { "Action": [ "personalize:DescribeDatasetGroup", "personalize:DescribeSchema", "personalize:DescribeDataset", "personalize:CreateDatasetImportJob", "personalize:DescribeDatasetImportJob", "personalize:ListDatasetImportJobs", "personalize:TagResource", "personalize:ListTagsForResource" ], "Effect": "Allow", "Resource": [ { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":personalize:", { "Ref": "AWS::Region" }, ":", { "Ref": "AWS::AccountId" }, ":dataset-group/*" ] ] }, { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":personalize:", { "Ref": "AWS::Region" }, ":", { "Ref": "AWS::AccountId" }, ":schema/*" ] ] }, { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":personalize:", { "Ref": "AWS::Region" }, ":", { "Ref": "AWS::AccountId" }, ":dataset/*" ] ] }, { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":personalize:", { "Ref": "AWS::Region" }, ":", { "Ref": "AWS::AccountId" }, ":dataset-import-job/*" ] ] } ] }, { "Action": [ "s3:GetObject*", "s3:GetBucket*", "s3:List*" ], "Effect": "Allow", "Resource": [ { "Fn::GetAtt": [ "PersonalizeBucket", "Arn" ] }, { "Fn::Join": [ "", [ { "Fn::GetAtt": [ "PersonalizeBucket", "Arn" ] }, "/train/*" ] ] } ] }, { "Action": "iam:PassRole", "Effect": "Allow", "Resource": { "Fn::GetAtt": [ "PersonalizeS3ReadRole7BE661E6", "Arn" ] } }, { "Action": "events:PutEvents", "Effect": "Allow", "Resource": { "Fn::GetAtt": [ "Notifications87298708", "Arn" ] } } ], "Version": "2012-10-17" }, "PolicyName": "CreateDatasetImportJobSolutionStepcreatedatasetimportjobfnRoleDefaultPolicyF6CFDA4A", "Roles": [ { "Ref": "CreateDatasetImportJobSolutionStepcreatedatasetimportjobfnRole1D83FDE8" } ] }, "Metadata": { "cfn_nag": { "rules_to_suppress": [ { "id": "W12", "reason": "IAM policy for AWS X-Ray requires an allow on *" } ] }, "cdk_nag": { "rules_to_suppress": [ { "reason": "All IAM policies defined in this solutiongrant only least-privilege permissions. Wildcard for resources is used only for serviceswhich do not have a resource arn", "id": "AwsSolutions-IAM5" }, { "reason": "We use AWS managed policies and do not need tochange as the \"*\" in resource is due to circular dependency.", "id": "AwsSolutions-IAM4" } ] } } }, "CreateDatasetImportJobSolutionStepcreatedatasetimportjobfn4FF1A8F1": { "Type": "AWS::Lambda::Function", "Properties": { "Code": { "S3Bucket": { "Fn::Join": [ "-", [ { "Fn::FindInMap": [ "SourceCode", "General", "S3Bucket" ] }, { "Ref": "AWS::Region" } ] ] }, "S3Key": { "Fn::Join": [ "/", [ { "Fn::FindInMap": [ "SourceCode", "General", "KeyPrefix" ] }, "CreateDatasetImportJobSolutionStepcreatedatasetimportjobfn4FF1A8F1.zip" ] ] } }, "Environment": { "Variables": { "ROLE_ARN": { "Fn::GetAtt": [ "PersonalizeS3ReadRole7BE661E6", "Arn" ] }, "SOLUTION_NAME": "maintaining-personalized-experiences-with-machine-learning", "SOLUTION_ID": "SO0170", "SOLUTION_VERSION": "v1.5.0", "LOG_LEVEL": "INFO", "POWERTOOLS_SERVICE_NAME": "Workflow", "POWERTOOLS_METRICS_NAMESPACE": { "Fn::Join": [ "", [ "personalize_solution_", { "Ref": "AWS::StackName" } ] ] }, "EVENT_BUS_ARN": { "Fn::GetAtt": [ "Notifications87298708", "Arn" ] } } }, "Handler": "handler.lambda_handler", "Layers": [ { "Ref": "PowertoolsLayer8E932F0F197D4026A35423D184C2A624D967C184" }, { "Ref": "SolutionsLayerDAE8E12F3DEA43FBA4AAE55AC50BD2E9B9D361F0" } ], "Role": { "Fn::GetAtt": [ "CreateDatasetImportJobSolutionStepcreatedatasetimportjobfnRole1D83FDE8", "Arn" ] }, "Runtime": "python3.11", "Tags": [ { "Key": "SOLUTION_ID", "Value": "SO0170" }, { "Key": "SOLUTION_NAME", "Value": "maintaining-personalized-experiences-with-machine-learning" }, { "Key": "SOLUTION_VERSION", "Value": "v1.5.0" } ], "Timeout": 15, "TracingConfig": { "Mode": "Active" } }, "DependsOn": [ "CreateDatasetImportJobSolutionStepcreatedatasetimportjobfnRoleDefaultPolicyF6CFDA4A", "CreateDatasetImportJobSolutionStepcreatedatasetimportjobfnRole1D83FDE8" ], "Metadata": { "cdk_nag": { "rules_to_suppress": [ { "reason": "All IAM policies defined in this solutiongrant only least-privilege permissions. Wildcard for resources is used only for serviceswhich do not have a resource arn", "id": "AwsSolutions-IAM5" }, { "reason": "We use AWS managed policies and do not need tochange as the \"*\" in resource is due to circular dependency.", "id": "AwsSolutions-IAM4" } ] }, "cfn_nag": { "rules_to_suppress": [ { "id": "W89", "reason": "functions deployed by this solution do not require VPC access" }, { "id": "W92", "reason": "functions deployed by this solution do not require reserved concurrency" }, { "id": "W58", "reason": "functions deployed by this solution use custom policy to write to CloudWatch logs" } ] } } }, "SNSNotificationSolutionStepsnsnotificationfnRole5A54A784": { "Type": "AWS::IAM::Role", "Properties": { "AssumeRolePolicyDocument": { "Statement": [ { "Action": "sts:AssumeRole", "Effect": "Allow", "Principal": { "Service": "lambda.amazonaws.com" } } ], "Version": "2012-10-17" }, "Policies": [ { "PolicyDocument": { "Statement": [ { "Action": [ "logs:CreateLogGroup", "logs:CreateLogStream", "logs:PutLogEvents" ], "Effect": "Allow", "Resource": { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":logs:", { "Ref": "AWS::Region" }, ":", { "Ref": "AWS::AccountId" }, ":log-group:/aws/lambda/*" ] ] } } ], "Version": "2012-10-17" }, "PolicyName": "LambdaFunctionServiceRolePolicy" } ], "Tags": [ { "Key": "SOLUTION_ID", "Value": "SO0170" }, { "Key": "SOLUTION_NAME", "Value": "maintaining-personalized-experiences-with-machine-learning" }, { "Key": "SOLUTION_VERSION", "Value": "v1.5.0" } ] }, "Metadata": { "guard": { "SuppressedRules": [ "IAM_NO_INLINE_POLICY_CHECK" ] }, "cdk_nag": { "rules_to_suppress": [ { "reason": "All IAM policies defined in this solutiongrant only least-privilege permissions. Wildcard for resources is used only for serviceswhich do not have a resource arn", "id": "AwsSolutions-IAM5" }, { "reason": "We use AWS managed policies and do not need tochange as the \"*\" in resource is due to circular dependency.", "id": "AwsSolutions-IAM4" } ] } } }, "SNSNotificationSolutionStepsnsnotificationfnRoleDefaultPolicy96503559": { "Type": "AWS::IAM::Policy", "Properties": { "PolicyDocument": { "Statement": [ { "Action": [ "xray:PutTraceSegments", "xray:PutTelemetryRecords" ], "Effect": "Allow", "Resource": "*" }, { "Action": "sns:Publish", "Effect": "Allow", "Resource": { "Ref": "NotificationTopic" } } ], "Version": "2012-10-17" }, "PolicyName": "SNSNotificationSolutionStepsnsnotificationfnRoleDefaultPolicy96503559", "Roles": [ { "Ref": "SNSNotificationSolutionStepsnsnotificationfnRole5A54A784" } ] }, "Metadata": { "cfn_nag": { "rules_to_suppress": [ { "id": "W12", "reason": "IAM policy for AWS X-Ray requires an allow on *" } ] }, "cdk_nag": { "rules_to_suppress": [ { "reason": "All IAM policies defined in this solutiongrant only least-privilege permissions. Wildcard for resources is used only for serviceswhich do not have a resource arn", "id": "AwsSolutions-IAM5" }, { "reason": "We use AWS managed policies and do not need tochange as the \"*\" in resource is due to circular dependency.", "id": "AwsSolutions-IAM4" } ] } } }, "SNSNotificationSolutionStepsnsnotificationfn6973DEFB": { "Type": "AWS::Lambda::Function", "Properties": { "Code": { "S3Bucket": { "Fn::Join": [ "-", [ { "Fn::FindInMap": [ "SourceCode", "General", "S3Bucket" ] }, { "Ref": "AWS::Region" } ] ] }, "S3Key": { "Fn::Join": [ "/", [ { "Fn::FindInMap": [ "SourceCode", "General", "KeyPrefix" ] }, "SNSNotificationSolutionStepsnsnotificationfn6973DEFB.zip" ] ] } }, "Environment": { "Variables": { "SNS_TOPIC_ARN": { "Ref": "NotificationTopic" }, "SNS_TOPIC_NAME": { "Fn::GetAtt": [ "NotificationTopic", "TopicName" ] }, "SOLUTION_NAME": "maintaining-personalized-experiences-with-machine-learning", "SOLUTION_ID": "SO0170", "SOLUTION_VERSION": "v1.5.0", "LOG_LEVEL": "INFO", "POWERTOOLS_SERVICE_NAME": "Workflow", "POWERTOOLS_METRICS_NAMESPACE": { "Fn::Join": [ "", [ "personalize_solution_", { "Ref": "AWS::StackName" } ] ] } } }, "Handler": "handler.lambda_handler", "Layers": [ { "Ref": "PowertoolsLayer8E932F0F197D4026A35423D184C2A624D967C184" }, { "Ref": "SolutionsLayerDAE8E12F3DEA43FBA4AAE55AC50BD2E9B9D361F0" } ], "Role": { "Fn::GetAtt": [ "SNSNotificationSolutionStepsnsnotificationfnRole5A54A784", "Arn" ] }, "Runtime": "python3.11", "Tags": [ { "Key": "SOLUTION_ID", "Value": "SO0170" }, { "Key": "SOLUTION_NAME", "Value": "maintaining-personalized-experiences-with-machine-learning" }, { "Key": "SOLUTION_VERSION", "Value": "v1.5.0" } ], "Timeout": 15, "TracingConfig": { "Mode": "Active" } }, "DependsOn": [ "SNSNotificationSolutionStepsnsnotificationfnRoleDefaultPolicy96503559", "SNSNotificationSolutionStepsnsnotificationfnRole5A54A784" ], "Metadata": { "cdk_nag": { "rules_to_suppress": [ { "reason": "All IAM policies defined in this solutiongrant only least-privilege permissions. Wildcard for resources is used only for serviceswhich do not have a resource arn", "id": "AwsSolutions-IAM5" }, { "reason": "We use AWS managed policies and do not need tochange as the \"*\" in resource is due to circular dependency.", "id": "AwsSolutions-IAM4" } ] }, "cfn_nag": { "rules_to_suppress": [ { "id": "W89", "reason": "functions deployed by this solution do not require VPC access" }, { "id": "W92", "reason": "functions deployed by this solution do not require reserved concurrency" }, { "id": "W58", "reason": "functions deployed by this solution use custom policy to write to CloudWatch logs" } ] } } }, "NotificationTopic": { "Type": "AWS::SNS::Topic", "Properties": { "DisplayName": "maintaining-personalized-experiences-with-machine-learning Notifications", "KmsMasterKeyId": { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":kms:", { "Ref": "AWS::Region" }, ":", { "Ref": "AWS::AccountId" }, ":alias/aws/sns" ] ] }, "Tags": [ { "Key": "SOLUTION_ID", "Value": "SO0170" }, { "Key": "SOLUTION_NAME", "Value": "maintaining-personalized-experiences-with-machine-learning" }, { "Key": "SOLUTION_VERSION", "Value": "v1.5.0" } ] }, "Metadata": { "cdk_nag": { "rules_to_suppress": [ { "reason": "All IAM policies defined in this solutiongrant only least-privilege permissions. Wildcard for resources is used only for serviceswhich do not have a resource arn", "id": "AwsSolutions-IAM5" }, { "reason": "We use AWS managed policies and do not need tochange as the \"*\" in resource is due to circular dependency.", "id": "AwsSolutions-IAM4" } ] } } }, "SNSNotificationSolutionStepNotificationConfigurationSnsTopicPolicy65B05D41": { "Type": "AWS::SNS::TopicPolicy", "Properties": { "PolicyDocument": { "Statement": [ { "Action": [ "SNS:Publish", "SNS:RemovePermission", "SNS:SetTopicAttributes", "SNS:DeleteTopic", "SNS:ListSubscriptionsByTopic", "SNS:GetTopicAttributes", "SNS:Receive", "SNS:AddPermission", "SNS:Subscribe" ], "Condition": { "StringEquals": { "AWS:SourceOwner": { "Ref": "AWS::AccountId" } } }, "Effect": "Allow", "Principal": { "AWS": { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":iam::", { "Ref": "AWS::AccountId" }, ":root" ] ] } }, "Resource": { "Ref": "NotificationTopic" }, "Sid": "TopicOwnerOnlyAccess" }, { "Action": [ "SNS:Publish", "SNS:RemovePermission", "SNS:SetTopicAttributes", "SNS:DeleteTopic", "SNS:ListSubscriptionsByTopic", "SNS:GetTopicAttributes", "SNS:Receive", "SNS:AddPermission", "SNS:Subscribe" ], "Condition": { "Bool": { "aws:SecureTransport": "false" } }, "Effect": "Deny", "Principal": { "AWS": "*" }, "Resource": { "Ref": "NotificationTopic" }, "Sid": "HttpsOnly" } ], "Version": "2012-10-17" }, "Topics": [ { "Ref": "NotificationTopic" } ] }, "Metadata": { "cdk_nag": { "rules_to_suppress": [ { "reason": "All IAM policies defined in this solutiongrant only least-privilege permissions. Wildcard for resources is used only for serviceswhich do not have a resource arn", "id": "AwsSolutions-IAM5" }, { "reason": "We use AWS managed policies and do not need tochange as the \"*\" in resource is due to circular dependency.", "id": "AwsSolutions-IAM4" } ] } } }, "NotificationSubscription": { "Type": "AWS::SNS::Subscription", "Properties": { "Endpoint": { "Ref": "Email" }, "Protocol": "email", "TopicArn": { "Ref": "NotificationTopic" } }, "Metadata": { "cdk_nag": { "rules_to_suppress": [ { "reason": "All IAM policies defined in this solutiongrant only least-privilege permissions. Wildcard for resources is used only for serviceswhich do not have a resource arn", "id": "AwsSolutions-IAM5" }, { "reason": "We use AWS managed policies and do not need tochange as the \"*\" in resource is due to circular dependency.", "id": "AwsSolutions-IAM4" } ] } }, "Condition": "EmailProvided" }, "CreateEventTrackerSolutionStepcreateeventtrackerfnRole56E6DB08": { "Type": "AWS::IAM::Role", "Properties": { "AssumeRolePolicyDocument": { "Statement": [ { "Action": "sts:AssumeRole", "Effect": "Allow", "Principal": { "Service": "lambda.amazonaws.com" } } ], "Version": "2012-10-17" }, "Policies": [ { "PolicyDocument": { "Statement": [ { "Action": [ "logs:CreateLogGroup", "logs:CreateLogStream", "logs:PutLogEvents" ], "Effect": "Allow", "Resource": { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":logs:", { "Ref": "AWS::Region" }, ":", { "Ref": "AWS::AccountId" }, ":log-group:/aws/lambda/*" ] ] } } ], "Version": "2012-10-17" }, "PolicyName": "LambdaFunctionServiceRolePolicy" } ], "Tags": [ { "Key": "SOLUTION_ID", "Value": "SO0170" }, { "Key": "SOLUTION_NAME", "Value": "maintaining-personalized-experiences-with-machine-learning" }, { "Key": "SOLUTION_VERSION", "Value": "v1.5.0" } ] }, "Metadata": { "guard": { "SuppressedRules": [ "IAM_NO_INLINE_POLICY_CHECK" ] }, "cdk_nag": { "rules_to_suppress": [ { "reason": "All IAM policies defined in this solutiongrant only least-privilege permissions. Wildcard for resources is used only for serviceswhich do not have a resource arn", "id": "AwsSolutions-IAM5" }, { "reason": "We use AWS managed policies and do not need tochange as the \"*\" in resource is due to circular dependency.", "id": "AwsSolutions-IAM4" } ] } } }, "CreateEventTrackerSolutionStepcreateeventtrackerfnRoleDefaultPolicy124201CA": { "Type": "AWS::IAM::Policy", "Properties": { "PolicyDocument": { "Statement": [ { "Action": [ "xray:PutTraceSegments", "xray:PutTelemetryRecords" ], "Effect": "Allow", "Resource": "*" }, { "Action": [ "personalize:DescribeEventTracker", "personalize:ListEventTrackers", "personalize:CreateEventTracker", "personalize:TagResource", "personalize:ListTagsForResource" ], "Effect": "Allow", "Resource": [ { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":personalize:", { "Ref": "AWS::Region" }, ":", { "Ref": "AWS::AccountId" }, ":dataset-group/*" ] ] }, { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":personalize:", { "Ref": "AWS::Region" }, ":", { "Ref": "AWS::AccountId" }, ":event-tracker/*" ] ] } ] }, { "Action": "events:PutEvents", "Effect": "Allow", "Resource": { "Fn::GetAtt": [ "Notifications87298708", "Arn" ] } } ], "Version": "2012-10-17" }, "PolicyName": "CreateEventTrackerSolutionStepcreateeventtrackerfnRoleDefaultPolicy124201CA", "Roles": [ { "Ref": "CreateEventTrackerSolutionStepcreateeventtrackerfnRole56E6DB08" } ] }, "Metadata": { "cfn_nag": { "rules_to_suppress": [ { "id": "W12", "reason": "IAM policy for AWS X-Ray requires an allow on *" } ] }, "cdk_nag": { "rules_to_suppress": [ { "reason": "All IAM policies defined in this solutiongrant only least-privilege permissions. Wildcard for resources is used only for serviceswhich do not have a resource arn", "id": "AwsSolutions-IAM5" }, { "reason": "We use AWS managed policies and do not need tochange as the \"*\" in resource is due to circular dependency.", "id": "AwsSolutions-IAM4" } ] } } }, "CreateEventTrackerSolutionStepcreateeventtrackerfnD0E776E2": { "Type": "AWS::Lambda::Function", "Properties": { "Code": { "S3Bucket": { "Fn::Join": [ "-", [ { "Fn::FindInMap": [ "SourceCode", "General", "S3Bucket" ] }, { "Ref": "AWS::Region" } ] ] }, "S3Key": { "Fn::Join": [ "/", [ { "Fn::FindInMap": [ "SourceCode", "General", "KeyPrefix" ] }, "CreateEventTrackerSolutionStepcreateeventtrackerfnD0E776E2.zip" ] ] } }, "Environment": { "Variables": { "SOLUTION_NAME": "maintaining-personalized-experiences-with-machine-learning", "SOLUTION_ID": "SO0170", "SOLUTION_VERSION": "v1.5.0", "LOG_LEVEL": "INFO", "POWERTOOLS_SERVICE_NAME": "Workflow", "POWERTOOLS_METRICS_NAMESPACE": { "Fn::Join": [ "", [ "personalize_solution_", { "Ref": "AWS::StackName" } ] ] }, "EVENT_BUS_ARN": { "Fn::GetAtt": [ "Notifications87298708", "Arn" ] } } }, "Handler": "handler.lambda_handler", "Layers": [ { "Ref": "PowertoolsLayer8E932F0F197D4026A35423D184C2A624D967C184" }, { "Ref": "SolutionsLayerDAE8E12F3DEA43FBA4AAE55AC50BD2E9B9D361F0" } ], "Role": { "Fn::GetAtt": [ "CreateEventTrackerSolutionStepcreateeventtrackerfnRole56E6DB08", "Arn" ] }, "Runtime": "python3.11", "Tags": [ { "Key": "SOLUTION_ID", "Value": "SO0170" }, { "Key": "SOLUTION_NAME", "Value": "maintaining-personalized-experiences-with-machine-learning" }, { "Key": "SOLUTION_VERSION", "Value": "v1.5.0" } ], "Timeout": 15, "TracingConfig": { "Mode": "Active" } }, "DependsOn": [ "CreateEventTrackerSolutionStepcreateeventtrackerfnRoleDefaultPolicy124201CA", "CreateEventTrackerSolutionStepcreateeventtrackerfnRole56E6DB08" ], "Metadata": { "cdk_nag": { "rules_to_suppress": [ { "reason": "All IAM policies defined in this solutiongrant only least-privilege permissions. Wildcard for resources is used only for serviceswhich do not have a resource arn", "id": "AwsSolutions-IAM5" }, { "reason": "We use AWS managed policies and do not need tochange as the \"*\" in resource is due to circular dependency.", "id": "AwsSolutions-IAM4" } ] }, "cfn_nag": { "rules_to_suppress": [ { "id": "W89", "reason": "functions deployed by this solution do not require VPC access" }, { "id": "W92", "reason": "functions deployed by this solution do not require reserved concurrency" }, { "id": "W58", "reason": "functions deployed by this solution use custom policy to write to CloudWatch logs" } ] } } }, "CreateSolutionSolutionStepcreatesolutionfnRole81CBA04F": { "Type": "AWS::IAM::Role", "Properties": { "AssumeRolePolicyDocument": { "Statement": [ { "Action": "sts:AssumeRole", "Effect": "Allow", "Principal": { "Service": "lambda.amazonaws.com" } } ], "Version": "2012-10-17" }, "Policies": [ { "PolicyDocument": { "Statement": [ { "Action": [ "logs:CreateLogGroup", "logs:CreateLogStream", "logs:PutLogEvents" ], "Effect": "Allow", "Resource": { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":logs:", { "Ref": "AWS::Region" }, ":", { "Ref": "AWS::AccountId" }, ":log-group:/aws/lambda/*" ] ] } } ], "Version": "2012-10-17" }, "PolicyName": "LambdaFunctionServiceRolePolicy" } ], "Tags": [ { "Key": "SOLUTION_ID", "Value": "SO0170" }, { "Key": "SOLUTION_NAME", "Value": "maintaining-personalized-experiences-with-machine-learning" }, { "Key": "SOLUTION_VERSION", "Value": "v1.5.0" } ] }, "Metadata": { "guard": { "SuppressedRules": [ "IAM_NO_INLINE_POLICY_CHECK" ] }, "cdk_nag": { "rules_to_suppress": [ { "reason": "All IAM policies defined in this solutiongrant only least-privilege permissions. Wildcard for resources is used only for serviceswhich do not have a resource arn", "id": "AwsSolutions-IAM5" }, { "reason": "We use AWS managed policies and do not need tochange as the \"*\" in resource is due to circular dependency.", "id": "AwsSolutions-IAM4" } ] } } }, "CreateSolutionSolutionStepcreatesolutionfnRoleDefaultPolicyC58A687B": { "Type": "AWS::IAM::Policy", "Properties": { "PolicyDocument": { "Statement": [ { "Action": [ "xray:PutTraceSegments", "xray:PutTelemetryRecords" ], "Effect": "Allow", "Resource": "*" }, { "Action": [ "personalize:DescribeSolution", "personalize:CreateSolution", "personalize:ListSolutions", "personalize:DescribeDatasetGroup", "personalize:TagResource", "personalize:ListTagsForResource" ], "Effect": "Allow", "Resource": [ { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":personalize:", { "Ref": "AWS::Region" }, ":", { "Ref": "AWS::AccountId" }, ":solution/*" ] ] }, { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":personalize:", { "Ref": "AWS::Region" }, ":", { "Ref": "AWS::AccountId" }, ":dataset-group/*" ] ] }, { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":personalize:::recipe/*" ] ] } ] }, { "Action": "events:PutEvents", "Effect": "Allow", "Resource": { "Fn::GetAtt": [ "Notifications87298708", "Arn" ] } } ], "Version": "2012-10-17" }, "PolicyName": "CreateSolutionSolutionStepcreatesolutionfnRoleDefaultPolicyC58A687B", "Roles": [ { "Ref": "CreateSolutionSolutionStepcreatesolutionfnRole81CBA04F" } ] }, "Metadata": { "cfn_nag": { "rules_to_suppress": [ { "id": "W12", "reason": "IAM policy for AWS X-Ray requires an allow on *" } ] }, "cdk_nag": { "rules_to_suppress": [ { "reason": "All IAM policies defined in this solutiongrant only least-privilege permissions. Wildcard for resources is used only for serviceswhich do not have a resource arn", "id": "AwsSolutions-IAM5" }, { "reason": "We use AWS managed policies and do not need tochange as the \"*\" in resource is due to circular dependency.", "id": "AwsSolutions-IAM4" } ] } } }, "CreateSolutionSolutionStepcreatesolutionfn1F463E79": { "Type": "AWS::Lambda::Function", "Properties": { "Code": { "S3Bucket": { "Fn::Join": [ "-", [ { "Fn::FindInMap": [ "SourceCode", "General", "S3Bucket" ] }, { "Ref": "AWS::Region" } ] ] }, "S3Key": { "Fn::Join": [ "/", [ { "Fn::FindInMap": [ "SourceCode", "General", "KeyPrefix" ] }, "CreateSolutionSolutionStepcreatesolutionfn1F463E79.zip" ] ] } }, "Environment": { "Variables": { "SOLUTION_NAME": "maintaining-personalized-experiences-with-machine-learning", "SOLUTION_ID": "SO0170", "SOLUTION_VERSION": "v1.5.0", "LOG_LEVEL": "INFO", "POWERTOOLS_SERVICE_NAME": "Workflow", "POWERTOOLS_METRICS_NAMESPACE": { "Fn::Join": [ "", [ "personalize_solution_", { "Ref": "AWS::StackName" } ] ] }, "EVENT_BUS_ARN": { "Fn::GetAtt": [ "Notifications87298708", "Arn" ] } } }, "Handler": "handler.lambda_handler", "Layers": [ { "Ref": "PowertoolsLayer8E932F0F197D4026A35423D184C2A624D967C184" }, { "Ref": "SolutionsLayerDAE8E12F3DEA43FBA4AAE55AC50BD2E9B9D361F0" } ], "Role": { "Fn::GetAtt": [ "CreateSolutionSolutionStepcreatesolutionfnRole81CBA04F", "Arn" ] }, "Runtime": "python3.11", "Tags": [ { "Key": "SOLUTION_ID", "Value": "SO0170" }, { "Key": "SOLUTION_NAME", "Value": "maintaining-personalized-experiences-with-machine-learning" }, { "Key": "SOLUTION_VERSION", "Value": "v1.5.0" } ], "Timeout": 15, "TracingConfig": { "Mode": "Active" } }, "DependsOn": [ "CreateSolutionSolutionStepcreatesolutionfnRoleDefaultPolicyC58A687B", "CreateSolutionSolutionStepcreatesolutionfnRole81CBA04F" ], "Metadata": { "cdk_nag": { "rules_to_suppress": [ { "reason": "All IAM policies defined in this solutiongrant only least-privilege permissions. Wildcard for resources is used only for serviceswhich do not have a resource arn", "id": "AwsSolutions-IAM5" }, { "reason": "We use AWS managed policies and do not need tochange as the \"*\" in resource is due to circular dependency.", "id": "AwsSolutions-IAM4" } ] }, "cfn_nag": { "rules_to_suppress": [ { "id": "W89", "reason": "functions deployed by this solution do not require VPC access" }, { "id": "W92", "reason": "functions deployed by this solution do not require reserved concurrency" }, { "id": "W58", "reason": "functions deployed by this solution use custom policy to write to CloudWatch logs" } ] } } }, "CreateRecommenderSolutionStepcreaterecommenderfnRoleFBF21868": { "Type": "AWS::IAM::Role", "Properties": { "AssumeRolePolicyDocument": { "Statement": [ { "Action": "sts:AssumeRole", "Effect": "Allow", "Principal": { "Service": "lambda.amazonaws.com" } } ], "Version": "2012-10-17" }, "Policies": [ { "PolicyDocument": { "Statement": [ { "Action": [ "logs:CreateLogGroup", "logs:CreateLogStream", "logs:PutLogEvents" ], "Effect": "Allow", "Resource": { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":logs:", { "Ref": "AWS::Region" }, ":", { "Ref": "AWS::AccountId" }, ":log-group:/aws/lambda/*" ] ] } } ], "Version": "2012-10-17" }, "PolicyName": "LambdaFunctionServiceRolePolicy" } ], "Tags": [ { "Key": "SOLUTION_ID", "Value": "SO0170" }, { "Key": "SOLUTION_NAME", "Value": "maintaining-personalized-experiences-with-machine-learning" }, { "Key": "SOLUTION_VERSION", "Value": "v1.5.0" } ] }, "Metadata": { "guard": { "SuppressedRules": [ "IAM_NO_INLINE_POLICY_CHECK" ] }, "cdk_nag": { "rules_to_suppress": [ { "reason": "All IAM policies defined in this solutiongrant only least-privilege permissions. Wildcard for resources is used only for serviceswhich do not have a resource arn", "id": "AwsSolutions-IAM5" }, { "reason": "We use AWS managed policies and do not need tochange as the \"*\" in resource is due to circular dependency.", "id": "AwsSolutions-IAM4" } ] } } }, "CreateRecommenderSolutionStepcreaterecommenderfnRoleDefaultPolicyCFFB3EE3": { "Type": "AWS::IAM::Policy", "Properties": { "PolicyDocument": { "Statement": [ { "Action": [ "xray:PutTraceSegments", "xray:PutTelemetryRecords" ], "Effect": "Allow", "Resource": "*" }, { "Action": [ "personalize:DescribeRecommender", "personalize:CreateRecommender", "personalize:ListRecommenders", "personalize:DescribeDatasetGroup", "personalize:TagResource", "personalize:ListTagsForResource" ], "Effect": "Allow", "Resource": [ { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":personalize:", { "Ref": "AWS::Region" }, ":", { "Ref": "AWS::AccountId" }, ":recommender/*" ] ] }, { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":personalize:", { "Ref": "AWS::Region" }, ":", { "Ref": "AWS::AccountId" }, ":dataset-group/*" ] ] }, { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":personalize:::recipe/*" ] ] } ] }, { "Action": "events:PutEvents", "Effect": "Allow", "Resource": { "Fn::GetAtt": [ "Notifications87298708", "Arn" ] } } ], "Version": "2012-10-17" }, "PolicyName": "CreateRecommenderSolutionStepcreaterecommenderfnRoleDefaultPolicyCFFB3EE3", "Roles": [ { "Ref": "CreateRecommenderSolutionStepcreaterecommenderfnRoleFBF21868" } ] }, "Metadata": { "cfn_nag": { "rules_to_suppress": [ { "id": "W12", "reason": "IAM policy for AWS X-Ray requires an allow on *" } ] }, "cdk_nag": { "rules_to_suppress": [ { "reason": "All IAM policies defined in this solutiongrant only least-privilege permissions. Wildcard for resources is used only for serviceswhich do not have a resource arn", "id": "AwsSolutions-IAM5" }, { "reason": "We use AWS managed policies and do not need tochange as the \"*\" in resource is due to circular dependency.", "id": "AwsSolutions-IAM4" } ] } } }, "CreateRecommenderSolutionStepcreaterecommenderfnF63FF7BD": { "Type": "AWS::Lambda::Function", "Properties": { "Code": { "S3Bucket": { "Fn::Join": [ "-", [ { "Fn::FindInMap": [ "SourceCode", "General", "S3Bucket" ] }, { "Ref": "AWS::Region" } ] ] }, "S3Key": { "Fn::Join": [ "/", [ { "Fn::FindInMap": [ "SourceCode", "General", "KeyPrefix" ] }, "CreateRecommenderSolutionStepcreaterecommenderfnF63FF7BD.zip" ] ] } }, "Environment": { "Variables": { "SOLUTION_NAME": "maintaining-personalized-experiences-with-machine-learning", "SOLUTION_ID": "SO0170", "SOLUTION_VERSION": "v1.5.0", "LOG_LEVEL": "INFO", "POWERTOOLS_SERVICE_NAME": "Workflow", "POWERTOOLS_METRICS_NAMESPACE": { "Fn::Join": [ "", [ "personalize_solution_", { "Ref": "AWS::StackName" } ] ] }, "EVENT_BUS_ARN": { "Fn::GetAtt": [ "Notifications87298708", "Arn" ] } } }, "Handler": "handler.lambda_handler", "Layers": [ { "Ref": "PowertoolsLayer8E932F0F197D4026A35423D184C2A624D967C184" }, { "Ref": "SolutionsLayerDAE8E12F3DEA43FBA4AAE55AC50BD2E9B9D361F0" } ], "Role": { "Fn::GetAtt": [ "CreateRecommenderSolutionStepcreaterecommenderfnRoleFBF21868", "Arn" ] }, "Runtime": "python3.11", "Tags": [ { "Key": "SOLUTION_ID", "Value": "SO0170" }, { "Key": "SOLUTION_NAME", "Value": "maintaining-personalized-experiences-with-machine-learning" }, { "Key": "SOLUTION_VERSION", "Value": "v1.5.0" } ], "Timeout": 15, "TracingConfig": { "Mode": "Active" } }, "DependsOn": [ "CreateRecommenderSolutionStepcreaterecommenderfnRoleDefaultPolicyCFFB3EE3", "CreateRecommenderSolutionStepcreaterecommenderfnRoleFBF21868" ], "Metadata": { "cdk_nag": { "rules_to_suppress": [ { "reason": "All IAM policies defined in this solutiongrant only least-privilege permissions. Wildcard for resources is used only for serviceswhich do not have a resource arn", "id": "AwsSolutions-IAM5" }, { "reason": "We use AWS managed policies and do not need tochange as the \"*\" in resource is due to circular dependency.", "id": "AwsSolutions-IAM4" } ] }, "cfn_nag": { "rules_to_suppress": [ { "id": "W89", "reason": "functions deployed by this solution do not require VPC access" }, { "id": "W92", "reason": "functions deployed by this solution do not require reserved concurrency" }, { "id": "W58", "reason": "functions deployed by this solution use custom policy to write to CloudWatch logs" } ] } } }, "CreateSolutionVersionSolutionStepcreatesolutionversionfnRoleB1FCF49E": { "Type": "AWS::IAM::Role", "Properties": { "AssumeRolePolicyDocument": { "Statement": [ { "Action": "sts:AssumeRole", "Effect": "Allow", "Principal": { "Service": "lambda.amazonaws.com" } } ], "Version": "2012-10-17" }, "Policies": [ { "PolicyDocument": { "Statement": [ { "Action": [ "logs:CreateLogGroup", "logs:CreateLogStream", "logs:PutLogEvents" ], "Effect": "Allow", "Resource": { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":logs:", { "Ref": "AWS::Region" }, ":", { "Ref": "AWS::AccountId" }, ":log-group:/aws/lambda/*" ] ] } } ], "Version": "2012-10-17" }, "PolicyName": "LambdaFunctionServiceRolePolicy" } ], "Tags": [ { "Key": "SOLUTION_ID", "Value": "SO0170" }, { "Key": "SOLUTION_NAME", "Value": "maintaining-personalized-experiences-with-machine-learning" }, { "Key": "SOLUTION_VERSION", "Value": "v1.5.0" } ] }, "Metadata": { "guard": { "SuppressedRules": [ "IAM_NO_INLINE_POLICY_CHECK" ] }, "cdk_nag": { "rules_to_suppress": [ { "reason": "All IAM policies defined in this solutiongrant only least-privilege permissions. Wildcard for resources is used only for serviceswhich do not have a resource arn", "id": "AwsSolutions-IAM5" }, { "reason": "We use AWS managed policies and do not need tochange as the \"*\" in resource is due to circular dependency.", "id": "AwsSolutions-IAM4" } ] } } }, "CreateSolutionVersionSolutionStepcreatesolutionversionfnRoleDefaultPolicyA22647AF": { "Type": "AWS::IAM::Policy", "Properties": { "PolicyDocument": { "Statement": [ { "Action": [ "xray:PutTraceSegments", "xray:PutTelemetryRecords" ], "Effect": "Allow", "Resource": "*" }, { "Action": [ "personalize:DescribeSolutionVersion", "personalize:CreateSolutionVersion", "personalize:ListSolutionVersions", "personalize:DescribeSolution", "personalize:GetSolutionMetrics", "personalize:TagResource", "personalize:ListTagsForResource" ], "Effect": "Allow", "Resource": [ { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":personalize:", { "Ref": "AWS::Region" }, ":", { "Ref": "AWS::AccountId" }, ":solution-version/*" ] ] }, { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":personalize:", { "Ref": "AWS::Region" }, ":", { "Ref": "AWS::AccountId" }, ":solution/*" ] ] } ] }, { "Action": "events:PutEvents", "Effect": "Allow", "Resource": { "Fn::GetAtt": [ "Notifications87298708", "Arn" ] } } ], "Version": "2012-10-17" }, "PolicyName": "CreateSolutionVersionSolutionStepcreatesolutionversionfnRoleDefaultPolicyA22647AF", "Roles": [ { "Ref": "CreateSolutionVersionSolutionStepcreatesolutionversionfnRoleB1FCF49E" } ] }, "Metadata": { "cfn_nag": { "rules_to_suppress": [ { "id": "W12", "reason": "IAM policy for AWS X-Ray requires an allow on *" } ] }, "cdk_nag": { "rules_to_suppress": [ { "reason": "All IAM policies defined in this solutiongrant only least-privilege permissions. Wildcard for resources is used only for serviceswhich do not have a resource arn", "id": "AwsSolutions-IAM5" }, { "reason": "We use AWS managed policies and do not need tochange as the \"*\" in resource is due to circular dependency.", "id": "AwsSolutions-IAM4" } ] } } }, "CreateSolutionVersionSolutionStepcreatesolutionversionfn0681411E": { "Type": "AWS::Lambda::Function", "Properties": { "Code": { "S3Bucket": { "Fn::Join": [ "-", [ { "Fn::FindInMap": [ "SourceCode", "General", "S3Bucket" ] }, { "Ref": "AWS::Region" } ] ] }, "S3Key": { "Fn::Join": [ "/", [ { "Fn::FindInMap": [ "SourceCode", "General", "KeyPrefix" ] }, "CreateSolutionVersionSolutionStepcreatesolutionversionfn0681411E.zip" ] ] } }, "Environment": { "Variables": { "SOLUTION_NAME": "maintaining-personalized-experiences-with-machine-learning", "SOLUTION_ID": "SO0170", "SOLUTION_VERSION": "v1.5.0", "LOG_LEVEL": "INFO", "POWERTOOLS_SERVICE_NAME": "Workflow", "POWERTOOLS_METRICS_NAMESPACE": { "Fn::Join": [ "", [ "personalize_solution_", { "Ref": "AWS::StackName" } ] ] }, "EVENT_BUS_ARN": { "Fn::GetAtt": [ "Notifications87298708", "Arn" ] } } }, "Handler": "handler.lambda_handler", "Layers": [ { "Ref": "PowertoolsLayer8E932F0F197D4026A35423D184C2A624D967C184" }, { "Ref": "SolutionsLayerDAE8E12F3DEA43FBA4AAE55AC50BD2E9B9D361F0" } ], "Role": { "Fn::GetAtt": [ "CreateSolutionVersionSolutionStepcreatesolutionversionfnRoleB1FCF49E", "Arn" ] }, "Runtime": "python3.11", "Tags": [ { "Key": "SOLUTION_ID", "Value": "SO0170" }, { "Key": "SOLUTION_NAME", "Value": "maintaining-personalized-experiences-with-machine-learning" }, { "Key": "SOLUTION_VERSION", "Value": "v1.5.0" } ], "Timeout": 15, "TracingConfig": { "Mode": "Active" } }, "DependsOn": [ "CreateSolutionVersionSolutionStepcreatesolutionversionfnRoleDefaultPolicyA22647AF", "CreateSolutionVersionSolutionStepcreatesolutionversionfnRoleB1FCF49E" ], "Metadata": { "cdk_nag": { "rules_to_suppress": [ { "reason": "All IAM policies defined in this solutiongrant only least-privilege permissions. Wildcard for resources is used only for serviceswhich do not have a resource arn", "id": "AwsSolutions-IAM5" }, { "reason": "We use AWS managed policies and do not need tochange as the \"*\" in resource is due to circular dependency.", "id": "AwsSolutions-IAM4" } ] }, "cfn_nag": { "rules_to_suppress": [ { "id": "W89", "reason": "functions deployed by this solution do not require VPC access" }, { "id": "W92", "reason": "functions deployed by this solution do not require reserved concurrency" }, { "id": "W58", "reason": "functions deployed by this solution use custom policy to write to CloudWatch logs" } ] } } }, "CreateCampaignSolutionStepcreatecampaignfnRole7348FBA1": { "Type": "AWS::IAM::Role", "Properties": { "AssumeRolePolicyDocument": { "Statement": [ { "Action": "sts:AssumeRole", "Effect": "Allow", "Principal": { "Service": "lambda.amazonaws.com" } } ], "Version": "2012-10-17" }, "Policies": [ { "PolicyDocument": { "Statement": [ { "Action": [ "logs:CreateLogGroup", "logs:CreateLogStream", "logs:PutLogEvents" ], "Effect": "Allow", "Resource": { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":logs:", { "Ref": "AWS::Region" }, ":", { "Ref": "AWS::AccountId" }, ":log-group:/aws/lambda/*" ] ] } } ], "Version": "2012-10-17" }, "PolicyName": "LambdaFunctionServiceRolePolicy" } ], "Tags": [ { "Key": "SOLUTION_ID", "Value": "SO0170" }, { "Key": "SOLUTION_NAME", "Value": "maintaining-personalized-experiences-with-machine-learning" }, { "Key": "SOLUTION_VERSION", "Value": "v1.5.0" } ] }, "Metadata": { "guard": { "SuppressedRules": [ "IAM_NO_INLINE_POLICY_CHECK" ] }, "cdk_nag": { "rules_to_suppress": [ { "reason": "All IAM policies defined in this solutiongrant only least-privilege permissions. Wildcard for resources is used only for serviceswhich do not have a resource arn", "id": "AwsSolutions-IAM5" }, { "reason": "We use AWS managed policies and do not need tochange as the \"*\" in resource is due to circular dependency.", "id": "AwsSolutions-IAM4" } ] } } }, "CreateCampaignSolutionStepcreatecampaignfnRoleDefaultPolicyA90FB36F": { "Type": "AWS::IAM::Policy", "Properties": { "PolicyDocument": { "Statement": [ { "Action": [ "xray:PutTraceSegments", "xray:PutTelemetryRecords" ], "Effect": "Allow", "Resource": "*" }, { "Action": [ "personalize:DescribeSolutionVersion", "personalize:ListSolutionVersions", "personalize:CreateCampaign", "personalize:ListCampaigns", "personalize:DescribeCampaign", "personalize:UpdateCampaign", "personalize:TagResource", "personalize:ListTagsForResource" ], "Effect": "Allow", "Resource": [ { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":personalize:", { "Ref": "AWS::Region" }, ":", { "Ref": "AWS::AccountId" }, ":solution-version/*" ] ] }, { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":personalize:", { "Ref": "AWS::Region" }, ":", { "Ref": "AWS::AccountId" }, ":solution/*" ] ] }, { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":personalize:", { "Ref": "AWS::Region" }, ":", { "Ref": "AWS::AccountId" }, ":campaign/*" ] ] } ] }, { "Action": "events:PutEvents", "Effect": "Allow", "Resource": { "Fn::GetAtt": [ "Notifications87298708", "Arn" ] } } ], "Version": "2012-10-17" }, "PolicyName": "CreateCampaignSolutionStepcreatecampaignfnRoleDefaultPolicyA90FB36F", "Roles": [ { "Ref": "CreateCampaignSolutionStepcreatecampaignfnRole7348FBA1" } ] }, "Metadata": { "cfn_nag": { "rules_to_suppress": [ { "id": "W12", "reason": "IAM policy for AWS X-Ray requires an allow on *" } ] }, "cdk_nag": { "rules_to_suppress": [ { "reason": "All IAM policies defined in this solutiongrant only least-privilege permissions. Wildcard for resources is used only for serviceswhich do not have a resource arn", "id": "AwsSolutions-IAM5" }, { "reason": "We use AWS managed policies and do not need tochange as the \"*\" in resource is due to circular dependency.", "id": "AwsSolutions-IAM4" } ] } } }, "CreateCampaignSolutionStepcreatecampaignfn5F83F6AB": { "Type": "AWS::Lambda::Function", "Properties": { "Code": { "S3Bucket": { "Fn::Join": [ "-", [ { "Fn::FindInMap": [ "SourceCode", "General", "S3Bucket" ] }, { "Ref": "AWS::Region" } ] ] }, "S3Key": { "Fn::Join": [ "/", [ { "Fn::FindInMap": [ "SourceCode", "General", "KeyPrefix" ] }, "CreateCampaignSolutionStepcreatecampaignfn5F83F6AB.zip" ] ] } }, "Environment": { "Variables": { "SOLUTION_NAME": "maintaining-personalized-experiences-with-machine-learning", "SOLUTION_ID": "SO0170", "SOLUTION_VERSION": "v1.5.0", "LOG_LEVEL": "INFO", "POWERTOOLS_SERVICE_NAME": "Workflow", "POWERTOOLS_METRICS_NAMESPACE": { "Fn::Join": [ "", [ "personalize_solution_", { "Ref": "AWS::StackName" } ] ] }, "EVENT_BUS_ARN": { "Fn::GetAtt": [ "Notifications87298708", "Arn" ] } } }, "Handler": "handler.lambda_handler", "Layers": [ { "Ref": "PowertoolsLayer8E932F0F197D4026A35423D184C2A624D967C184" }, { "Ref": "SolutionsLayerDAE8E12F3DEA43FBA4AAE55AC50BD2E9B9D361F0" } ], "Role": { "Fn::GetAtt": [ "CreateCampaignSolutionStepcreatecampaignfnRole7348FBA1", "Arn" ] }, "Runtime": "python3.11", "Tags": [ { "Key": "SOLUTION_ID", "Value": "SO0170" }, { "Key": "SOLUTION_NAME", "Value": "maintaining-personalized-experiences-with-machine-learning" }, { "Key": "SOLUTION_VERSION", "Value": "v1.5.0" } ], "Timeout": 15, "TracingConfig": { "Mode": "Active" } }, "DependsOn": [ "CreateCampaignSolutionStepcreatecampaignfnRoleDefaultPolicyA90FB36F", "CreateCampaignSolutionStepcreatecampaignfnRole7348FBA1" ], "Metadata": { "cdk_nag": { "rules_to_suppress": [ { "reason": "All IAM policies defined in this solutiongrant only least-privilege permissions. Wildcard for resources is used only for serviceswhich do not have a resource arn", "id": "AwsSolutions-IAM5" }, { "reason": "We use AWS managed policies and do not need tochange as the \"*\" in resource is due to circular dependency.", "id": "AwsSolutions-IAM4" } ] }, "cfn_nag": { "rules_to_suppress": [ { "id": "W89", "reason": "functions deployed by this solution do not require VPC access" }, { "id": "W92", "reason": "functions deployed by this solution do not require reserved concurrency" }, { "id": "W58", "reason": "functions deployed by this solution use custom policy to write to CloudWatch logs" } ] } } }, "PersonalizeInferenceS3ReadWriteRole184D1560": { "Type": "AWS::IAM::Role", "Properties": { "AssumeRolePolicyDocument": { "Statement": [ { "Action": "sts:AssumeRole", "Effect": "Allow", "Principal": { "Service": "personalize.amazonaws.com" } } ], "Version": "2012-10-17" }, "Description": "Grants Amazon Personalize access to read/write to S3 for batch inference jobs", "Policies": [ { "PolicyDocument": { "Statement": [ { "Action": [ "s3:GetObject", "s3:ListBucket", "s3:PutObject" ], "Effect": "Allow", "Resource": [ { "Fn::Join": [ "", [ { "Fn::GetAtt": [ "PersonalizeBucket", "Arn" ] }, "/batch/*" ] ] }, { "Fn::GetAtt": [ "PersonalizeBucket", "Arn" ] } ] } ], "Version": "2012-10-17" }, "PolicyName": "PersonalizeS3ReadPolicy" } ], "Tags": [ { "Key": "SOLUTION_ID", "Value": "SO0170" }, { "Key": "SOLUTION_NAME", "Value": "maintaining-personalized-experiences-with-machine-learning" }, { "Key": "SOLUTION_VERSION", "Value": "v1.5.0" } ] }, "Metadata": { "cdk_nag": { "rules_to_suppress": [ { "reason": "All IAM policies defined in this solutiongrant only least-privilege permissions. Wild card for resources is used only for services which do not have a resource arn", "id": "AwsSolutions-IAM5" } ] }, "guard": { "SuppressedRules": [ "IAM_NO_INLINE_POLICY_CHECK" ] } } }, "CreateBatchInferenceJobSolutionStepcreatebatchinferencejobfnRoleF9AA5858": { "Type": "AWS::IAM::Role", "Properties": { "AssumeRolePolicyDocument": { "Statement": [ { "Action": "sts:AssumeRole", "Effect": "Allow", "Principal": { "Service": "lambda.amazonaws.com" } } ], "Version": "2012-10-17" }, "Policies": [ { "PolicyDocument": { "Statement": [ { "Action": [ "logs:CreateLogGroup", "logs:CreateLogStream", "logs:PutLogEvents" ], "Effect": "Allow", "Resource": { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":logs:", { "Ref": "AWS::Region" }, ":", { "Ref": "AWS::AccountId" }, ":log-group:/aws/lambda/*" ] ] } } ], "Version": "2012-10-17" }, "PolicyName": "LambdaFunctionServiceRolePolicy" } ], "Tags": [ { "Key": "SOLUTION_ID", "Value": "SO0170" }, { "Key": "SOLUTION_NAME", "Value": "maintaining-personalized-experiences-with-machine-learning" }, { "Key": "SOLUTION_VERSION", "Value": "v1.5.0" } ] }, "Metadata": { "guard": { "SuppressedRules": [ "IAM_NO_INLINE_POLICY_CHECK" ] }, "cdk_nag": { "rules_to_suppress": [ { "reason": "All IAM policies defined in this solutiongrant only least-privilege permissions. Wildcard for resources is used only for serviceswhich do not have a resource arn", "id": "AwsSolutions-IAM5" }, { "reason": "We use AWS managed policies and do not need tochange as the \"*\" in resource is due to circular dependency.", "id": "AwsSolutions-IAM4" } ] } } }, "CreateBatchInferenceJobSolutionStepcreatebatchinferencejobfnRoleDefaultPolicyBD47AE5F": { "Type": "AWS::IAM::Policy", "Properties": { "PolicyDocument": { "Statement": [ { "Action": [ "xray:PutTraceSegments", "xray:PutTelemetryRecords" ], "Effect": "Allow", "Resource": "*" }, { "Action": [ "personalize:DescribeDatasetGroup", "personalize:ListBatchInferenceJobs", "personalize:ListSolutionVersions", "personalize:ListSolutions", "personalize:CreateBatchInferenceJob", "personalize:DescribeBatchInferenceJob", "personalize:DescribeSolution", "personalize:DescribeSolutionVersion", "personalize:TagResource", "personalize:ListTagsForResource" ], "Effect": "Allow", "Resource": [ { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":personalize:", { "Ref": "AWS::Region" }, ":", { "Ref": "AWS::AccountId" }, ":dataset-group/*" ] ] }, { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":personalize:", { "Ref": "AWS::Region" }, ":", { "Ref": "AWS::AccountId" }, ":batch-inference-job/*" ] ] }, { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":personalize:", { "Ref": "AWS::Region" }, ":", { "Ref": "AWS::AccountId" }, ":solution/*" ] ] } ] }, { "Action": [ "s3:GetObject*", "s3:GetBucket*", "s3:List*", "s3:DeleteObject*", "s3:PutObject", "s3:PutObjectLegalHold", "s3:PutObjectRetention", "s3:PutObjectTagging", "s3:PutObjectVersionTagging", "s3:Abort*" ], "Effect": "Allow", "Resource": [ { "Fn::GetAtt": [ "PersonalizeBucket", "Arn" ] }, { "Fn::Join": [ "", [ { "Fn::GetAtt": [ "PersonalizeBucket", "Arn" ] }, "/batch/*" ] ] } ] }, { "Action": "iam:PassRole", "Effect": "Allow", "Resource": { "Fn::GetAtt": [ "PersonalizeInferenceS3ReadWriteRole184D1560", "Arn" ] } }, { "Action": "events:PutEvents", "Effect": "Allow", "Resource": { "Fn::GetAtt": [ "Notifications87298708", "Arn" ] } } ], "Version": "2012-10-17" }, "PolicyName": "CreateBatchInferenceJobSolutionStepcreatebatchinferencejobfnRoleDefaultPolicyBD47AE5F", "Roles": [ { "Ref": "CreateBatchInferenceJobSolutionStepcreatebatchinferencejobfnRoleF9AA5858" } ] }, "Metadata": { "cfn_nag": { "rules_to_suppress": [ { "id": "W12", "reason": "IAM policy for AWS X-Ray requires an allow on *" } ] }, "cdk_nag": { "rules_to_suppress": [ { "reason": "All IAM policies defined in this solutiongrant only least-privilege permissions. Wildcard for resources is used only for serviceswhich do not have a resource arn", "id": "AwsSolutions-IAM5" }, { "reason": "We use AWS managed policies and do not need tochange as the \"*\" in resource is due to circular dependency.", "id": "AwsSolutions-IAM4" } ] } } }, "CreateBatchInferenceJobSolutionStepcreatebatchinferencejobfn8B4A8B4F": { "Type": "AWS::Lambda::Function", "Properties": { "Code": { "S3Bucket": { "Fn::Join": [ "-", [ { "Fn::FindInMap": [ "SourceCode", "General", "S3Bucket" ] }, { "Ref": "AWS::Region" } ] ] }, "S3Key": { "Fn::Join": [ "/", [ { "Fn::FindInMap": [ "SourceCode", "General", "KeyPrefix" ] }, "CreateBatchInferenceJobSolutionStepcreatebatchinferencejobfn8B4A8B4F.zip" ] ] } }, "Environment": { "Variables": { "ROLE_ARN": { "Fn::GetAtt": [ "PersonalizeInferenceS3ReadWriteRole184D1560", "Arn" ] }, "SOLUTION_NAME": "maintaining-personalized-experiences-with-machine-learning", "SOLUTION_ID": "SO0170", "SOLUTION_VERSION": "v1.5.0", "LOG_LEVEL": "INFO", "POWERTOOLS_SERVICE_NAME": "Workflow", "POWERTOOLS_METRICS_NAMESPACE": { "Fn::Join": [ "", [ "personalize_solution_", { "Ref": "AWS::StackName" } ] ] }, "EVENT_BUS_ARN": { "Fn::GetAtt": [ "Notifications87298708", "Arn" ] } } }, "Handler": "handler.lambda_handler", "Layers": [ { "Ref": "PowertoolsLayer8E932F0F197D4026A35423D184C2A624D967C184" }, { "Ref": "SolutionsLayerDAE8E12F3DEA43FBA4AAE55AC50BD2E9B9D361F0" } ], "Role": { "Fn::GetAtt": [ "CreateBatchInferenceJobSolutionStepcreatebatchinferencejobfnRoleF9AA5858", "Arn" ] }, "Runtime": "python3.11", "Tags": [ { "Key": "SOLUTION_ID", "Value": "SO0170" }, { "Key": "SOLUTION_NAME", "Value": "maintaining-personalized-experiences-with-machine-learning" }, { "Key": "SOLUTION_VERSION", "Value": "v1.5.0" } ], "Timeout": 15, "TracingConfig": { "Mode": "Active" } }, "DependsOn": [ "CreateBatchInferenceJobSolutionStepcreatebatchinferencejobfnRoleDefaultPolicyBD47AE5F", "CreateBatchInferenceJobSolutionStepcreatebatchinferencejobfnRoleF9AA5858" ], "Metadata": { "cdk_nag": { "rules_to_suppress": [ { "reason": "All IAM policies defined in this solutiongrant only least-privilege permissions. Wildcard for resources is used only for serviceswhich do not have a resource arn", "id": "AwsSolutions-IAM5" }, { "reason": "We use AWS managed policies and do not need tochange as the \"*\" in resource is due to circular dependency.", "id": "AwsSolutions-IAM4" } ] }, "cfn_nag": { "rules_to_suppress": [ { "id": "W89", "reason": "functions deployed by this solution do not require VPC access" }, { "id": "W92", "reason": "functions deployed by this solution do not require reserved concurrency" }, { "id": "W58", "reason": "functions deployed by this solution use custom policy to write to CloudWatch logs" } ] } } }, "PersonalizeSegmentS3ReadWriteRole9ECFB5B1": { "Type": "AWS::IAM::Role", "Properties": { "AssumeRolePolicyDocument": { "Statement": [ { "Action": "sts:AssumeRole", "Effect": "Allow", "Principal": { "Service": "personalize.amazonaws.com" } } ], "Version": "2012-10-17" }, "Description": "Grants Amazon Personalize access to read/write to S3 for batch segment jobs", "Policies": [ { "PolicyDocument": { "Statement": [ { "Action": [ "s3:GetObject", "s3:ListBucket", "s3:PutObject" ], "Effect": "Allow", "Resource": [ { "Fn::Join": [ "", [ { "Fn::GetAtt": [ "PersonalizeBucket", "Arn" ] }, "/batch/*" ] ] }, { "Fn::GetAtt": [ "PersonalizeBucket", "Arn" ] } ] } ], "Version": "2012-10-17" }, "PolicyName": "PersonalizeS3ReadPolicy" } ], "Tags": [ { "Key": "SOLUTION_ID", "Value": "SO0170" }, { "Key": "SOLUTION_NAME", "Value": "maintaining-personalized-experiences-with-machine-learning" }, { "Key": "SOLUTION_VERSION", "Value": "v1.5.0" } ] }, "Metadata": { "cdk_nag": { "rules_to_suppress": [ { "reason": "All IAM policies defined in this solutiongrant only least-privilege permissions. Wild card for resources is used only for services which do not have a resource arn", "id": "AwsSolutions-IAM5" } ] }, "guard": { "SuppressedRules": [ "IAM_NO_INLINE_POLICY_CHECK" ] } } }, "CreateBatchSegmentJobSolutionStepcreatebatchsegmentjobfnRole8F0F9EA9": { "Type": "AWS::IAM::Role", "Properties": { "AssumeRolePolicyDocument": { "Statement": [ { "Action": "sts:AssumeRole", "Effect": "Allow", "Principal": { "Service": "lambda.amazonaws.com" } } ], "Version": "2012-10-17" }, "Policies": [ { "PolicyDocument": { "Statement": [ { "Action": [ "logs:CreateLogGroup", "logs:CreateLogStream", "logs:PutLogEvents" ], "Effect": "Allow", "Resource": { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":logs:", { "Ref": "AWS::Region" }, ":", { "Ref": "AWS::AccountId" }, ":log-group:/aws/lambda/*" ] ] } } ], "Version": "2012-10-17" }, "PolicyName": "LambdaFunctionServiceRolePolicy" } ], "Tags": [ { "Key": "SOLUTION_ID", "Value": "SO0170" }, { "Key": "SOLUTION_NAME", "Value": "maintaining-personalized-experiences-with-machine-learning" }, { "Key": "SOLUTION_VERSION", "Value": "v1.5.0" } ] }, "Metadata": { "guard": { "SuppressedRules": [ "IAM_NO_INLINE_POLICY_CHECK" ] }, "cdk_nag": { "rules_to_suppress": [ { "reason": "All IAM policies defined in this solutiongrant only least-privilege permissions. Wildcard for resources is used only for serviceswhich do not have a resource arn", "id": "AwsSolutions-IAM5" }, { "reason": "We use AWS managed policies and do not need tochange as the \"*\" in resource is due to circular dependency.", "id": "AwsSolutions-IAM4" } ] } } }, "CreateBatchSegmentJobSolutionStepcreatebatchsegmentjobfnRoleDefaultPolicyE2797422": { "Type": "AWS::IAM::Policy", "Properties": { "PolicyDocument": { "Statement": [ { "Action": [ "xray:PutTraceSegments", "xray:PutTelemetryRecords" ], "Effect": "Allow", "Resource": "*" }, { "Action": [ "personalize:DescribeDatasetGroup", "personalize:ListBatchSegmentJobs", "personalize:ListSolutionVersions", "personalize:ListSolutions", "personalize:CreateBatchSegmentJob", "personalize:DescribeBatchSegmentJob", "personalize:DescribeSolution", "personalize:DescribeSolutionVersion", "personalize:TagResource", "personalize:ListTagsForResource" ], "Effect": "Allow", "Resource": [ { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":personalize:", { "Ref": "AWS::Region" }, ":", { "Ref": "AWS::AccountId" }, ":dataset-group/*" ] ] }, { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":personalize:", { "Ref": "AWS::Region" }, ":", { "Ref": "AWS::AccountId" }, ":batch-segment-job/*" ] ] }, { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":personalize:", { "Ref": "AWS::Region" }, ":", { "Ref": "AWS::AccountId" }, ":solution/*" ] ] } ] }, { "Action": [ "s3:GetObject*", "s3:GetBucket*", "s3:List*", "s3:DeleteObject*", "s3:PutObject", "s3:PutObjectLegalHold", "s3:PutObjectRetention", "s3:PutObjectTagging", "s3:PutObjectVersionTagging", "s3:Abort*" ], "Effect": "Allow", "Resource": [ { "Fn::GetAtt": [ "PersonalizeBucket", "Arn" ] }, { "Fn::Join": [ "", [ { "Fn::GetAtt": [ "PersonalizeBucket", "Arn" ] }, "/batch/*" ] ] } ] }, { "Action": "iam:PassRole", "Effect": "Allow", "Resource": { "Fn::GetAtt": [ "PersonalizeSegmentS3ReadWriteRole9ECFB5B1", "Arn" ] } }, { "Action": "events:PutEvents", "Effect": "Allow", "Resource": { "Fn::GetAtt": [ "Notifications87298708", "Arn" ] } } ], "Version": "2012-10-17" }, "PolicyName": "CreateBatchSegmentJobSolutionStepcreatebatchsegmentjobfnRoleDefaultPolicyE2797422", "Roles": [ { "Ref": "CreateBatchSegmentJobSolutionStepcreatebatchsegmentjobfnRole8F0F9EA9" } ] }, "Metadata": { "cfn_nag": { "rules_to_suppress": [ { "id": "W12", "reason": "IAM policy for AWS X-Ray requires an allow on *" } ] }, "cdk_nag": { "rules_to_suppress": [ { "reason": "All IAM policies defined in this solutiongrant only least-privilege permissions. Wildcard for resources is used only for serviceswhich do not have a resource arn", "id": "AwsSolutions-IAM5" }, { "reason": "We use AWS managed policies and do not need tochange as the \"*\" in resource is due to circular dependency.", "id": "AwsSolutions-IAM4" } ] } } }, "CreateBatchSegmentJobSolutionStepcreatebatchsegmentjobfn01ACE97D": { "Type": "AWS::Lambda::Function", "Properties": { "Code": { "S3Bucket": { "Fn::Join": [ "-", [ { "Fn::FindInMap": [ "SourceCode", "General", "S3Bucket" ] }, { "Ref": "AWS::Region" } ] ] }, "S3Key": { "Fn::Join": [ "/", [ { "Fn::FindInMap": [ "SourceCode", "General", "KeyPrefix" ] }, "CreateBatchSegmentJobSolutionStepcreatebatchsegmentjobfn01ACE97D.zip" ] ] } }, "Environment": { "Variables": { "ROLE_ARN": { "Fn::GetAtt": [ "PersonalizeSegmentS3ReadWriteRole9ECFB5B1", "Arn" ] }, "SOLUTION_NAME": "maintaining-personalized-experiences-with-machine-learning", "SOLUTION_ID": "SO0170", "SOLUTION_VERSION": "v1.5.0", "LOG_LEVEL": "INFO", "POWERTOOLS_SERVICE_NAME": "Workflow", "POWERTOOLS_METRICS_NAMESPACE": { "Fn::Join": [ "", [ "personalize_solution_", { "Ref": "AWS::StackName" } ] ] }, "EVENT_BUS_ARN": { "Fn::GetAtt": [ "Notifications87298708", "Arn" ] } } }, "Handler": "handler.lambda_handler", "Layers": [ { "Ref": "PowertoolsLayer8E932F0F197D4026A35423D184C2A624D967C184" }, { "Ref": "SolutionsLayerDAE8E12F3DEA43FBA4AAE55AC50BD2E9B9D361F0" } ], "Role": { "Fn::GetAtt": [ "CreateBatchSegmentJobSolutionStepcreatebatchsegmentjobfnRole8F0F9EA9", "Arn" ] }, "Runtime": "python3.11", "Tags": [ { "Key": "SOLUTION_ID", "Value": "SO0170" }, { "Key": "SOLUTION_NAME", "Value": "maintaining-personalized-experiences-with-machine-learning" }, { "Key": "SOLUTION_VERSION", "Value": "v1.5.0" } ], "Timeout": 15, "TracingConfig": { "Mode": "Active" } }, "DependsOn": [ "CreateBatchSegmentJobSolutionStepcreatebatchsegmentjobfnRoleDefaultPolicyE2797422", "CreateBatchSegmentJobSolutionStepcreatebatchsegmentjobfnRole8F0F9EA9" ], "Metadata": { "cdk_nag": { "rules_to_suppress": [ { "reason": "All IAM policies defined in this solutiongrant only least-privilege permissions. Wildcard for resources is used only for serviceswhich do not have a resource arn", "id": "AwsSolutions-IAM5" }, { "reason": "We use AWS managed policies and do not need tochange as the \"*\" in resource is due to circular dependency.", "id": "AwsSolutions-IAM4" } ] }, "cfn_nag": { "rules_to_suppress": [ { "id": "W89", "reason": "functions deployed by this solution do not require VPC access" }, { "id": "W92", "reason": "functions deployed by this solution do not require reserved concurrency" }, { "id": "W58", "reason": "functions deployed by this solution use custom policy to write to CloudWatch logs" } ] } } }, "CreateFilterSolutionStepcreatefilterfnRoleE2C88F18": { "Type": "AWS::IAM::Role", "Properties": { "AssumeRolePolicyDocument": { "Statement": [ { "Action": "sts:AssumeRole", "Effect": "Allow", "Principal": { "Service": "lambda.amazonaws.com" } } ], "Version": "2012-10-17" }, "Policies": [ { "PolicyDocument": { "Statement": [ { "Action": [ "logs:CreateLogGroup", "logs:CreateLogStream", "logs:PutLogEvents" ], "Effect": "Allow", "Resource": { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":logs:", { "Ref": "AWS::Region" }, ":", { "Ref": "AWS::AccountId" }, ":log-group:/aws/lambda/*" ] ] } } ], "Version": "2012-10-17" }, "PolicyName": "LambdaFunctionServiceRolePolicy" } ], "Tags": [ { "Key": "SOLUTION_ID", "Value": "SO0170" }, { "Key": "SOLUTION_NAME", "Value": "maintaining-personalized-experiences-with-machine-learning" }, { "Key": "SOLUTION_VERSION", "Value": "v1.5.0" } ] }, "Metadata": { "guard": { "SuppressedRules": [ "IAM_NO_INLINE_POLICY_CHECK" ] }, "cdk_nag": { "rules_to_suppress": [ { "reason": "All IAM policies defined in this solutiongrant only least-privilege permissions. Wildcard for resources is used only for serviceswhich do not have a resource arn", "id": "AwsSolutions-IAM5" }, { "reason": "We use AWS managed policies and do not need tochange as the \"*\" in resource is due to circular dependency.", "id": "AwsSolutions-IAM4" } ] } } }, "CreateFilterSolutionStepcreatefilterfnRoleDefaultPolicy9CD13A92": { "Type": "AWS::IAM::Policy", "Properties": { "PolicyDocument": { "Statement": [ { "Action": [ "xray:PutTraceSegments", "xray:PutTelemetryRecords" ], "Effect": "Allow", "Resource": "*" }, { "Action": [ "personalize:DescribeDatasetGroup", "personalize:CreateFilter", "personalize:DescribeFilter", "personalize:TagResource", "personalize:ListTagsForResource" ], "Effect": "Allow", "Resource": [ { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":personalize:", { "Ref": "AWS::Region" }, ":", { "Ref": "AWS::AccountId" }, ":filter/*" ] ] }, { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":personalize:", { "Ref": "AWS::Region" }, ":", { "Ref": "AWS::AccountId" }, ":dataset-group/*" ] ] } ] }, { "Action": "events:PutEvents", "Effect": "Allow", "Resource": { "Fn::GetAtt": [ "Notifications87298708", "Arn" ] } } ], "Version": "2012-10-17" }, "PolicyName": "CreateFilterSolutionStepcreatefilterfnRoleDefaultPolicy9CD13A92", "Roles": [ { "Ref": "CreateFilterSolutionStepcreatefilterfnRoleE2C88F18" } ] }, "Metadata": { "cfn_nag": { "rules_to_suppress": [ { "id": "W12", "reason": "IAM policy for AWS X-Ray requires an allow on *" } ] }, "cdk_nag": { "rules_to_suppress": [ { "reason": "All IAM policies defined in this solutiongrant only least-privilege permissions. Wildcard for resources is used only for serviceswhich do not have a resource arn", "id": "AwsSolutions-IAM5" }, { "reason": "We use AWS managed policies and do not need tochange as the \"*\" in resource is due to circular dependency.", "id": "AwsSolutions-IAM4" } ] } } }, "CreateFilterSolutionStepcreatefilterfnF2859FD9": { "Type": "AWS::Lambda::Function", "Properties": { "Code": { "S3Bucket": { "Fn::Join": [ "-", [ { "Fn::FindInMap": [ "SourceCode", "General", "S3Bucket" ] }, { "Ref": "AWS::Region" } ] ] }, "S3Key": { "Fn::Join": [ "/", [ { "Fn::FindInMap": [ "SourceCode", "General", "KeyPrefix" ] }, "CreateFilterSolutionStepcreatefilterfnF2859FD9.zip" ] ] } }, "Environment": { "Variables": { "SOLUTION_NAME": "maintaining-personalized-experiences-with-machine-learning", "SOLUTION_ID": "SO0170", "SOLUTION_VERSION": "v1.5.0", "LOG_LEVEL": "INFO", "POWERTOOLS_SERVICE_NAME": "Workflow", "POWERTOOLS_METRICS_NAMESPACE": { "Fn::Join": [ "", [ "personalize_solution_", { "Ref": "AWS::StackName" } ] ] }, "EVENT_BUS_ARN": { "Fn::GetAtt": [ "Notifications87298708", "Arn" ] } } }, "Handler": "handler.lambda_handler", "Layers": [ { "Ref": "PowertoolsLayer8E932F0F197D4026A35423D184C2A624D967C184" }, { "Ref": "SolutionsLayerDAE8E12F3DEA43FBA4AAE55AC50BD2E9B9D361F0" } ], "Role": { "Fn::GetAtt": [ "CreateFilterSolutionStepcreatefilterfnRoleE2C88F18", "Arn" ] }, "Runtime": "python3.11", "Tags": [ { "Key": "SOLUTION_ID", "Value": "SO0170" }, { "Key": "SOLUTION_NAME", "Value": "maintaining-personalized-experiences-with-machine-learning" }, { "Key": "SOLUTION_VERSION", "Value": "v1.5.0" } ], "Timeout": 15, "TracingConfig": { "Mode": "Active" } }, "DependsOn": [ "CreateFilterSolutionStepcreatefilterfnRoleDefaultPolicy9CD13A92", "CreateFilterSolutionStepcreatefilterfnRoleE2C88F18" ], "Metadata": { "cdk_nag": { "rules_to_suppress": [ { "reason": "All IAM policies defined in this solutiongrant only least-privilege permissions. Wildcard for resources is used only for serviceswhich do not have a resource arn", "id": "AwsSolutions-IAM5" }, { "reason": "We use AWS managed policies and do not need tochange as the \"*\" in resource is due to circular dependency.", "id": "AwsSolutions-IAM4" } ] }, "cfn_nag": { "rules_to_suppress": [ { "id": "W89", "reason": "functions deployed by this solution do not require VPC access" }, { "id": "W92", "reason": "functions deployed by this solution do not require reserved concurrency" }, { "id": "W58", "reason": "functions deployed by this solution use custom policy to write to CloudWatch logs" } ] } } }, "CreateTimestampSolutionStepcreatetimestampfnRoleA3EE0EA2": { "Type": "AWS::IAM::Role", "Properties": { "AssumeRolePolicyDocument": { "Statement": [ { "Action": "sts:AssumeRole", "Effect": "Allow", "Principal": { "Service": "lambda.amazonaws.com" } } ], "Version": "2012-10-17" }, "Policies": [ { "PolicyDocument": { "Statement": [ { "Action": [ "logs:CreateLogGroup", "logs:CreateLogStream", "logs:PutLogEvents" ], "Effect": "Allow", "Resource": { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":logs:", { "Ref": "AWS::Region" }, ":", { "Ref": "AWS::AccountId" }, ":log-group:/aws/lambda/*" ] ] } } ], "Version": "2012-10-17" }, "PolicyName": "LambdaFunctionServiceRolePolicy" } ], "Tags": [ { "Key": "SOLUTION_ID", "Value": "SO0170" }, { "Key": "SOLUTION_NAME", "Value": "maintaining-personalized-experiences-with-machine-learning" }, { "Key": "SOLUTION_VERSION", "Value": "v1.5.0" } ] }, "Metadata": { "guard": { "SuppressedRules": [ "IAM_NO_INLINE_POLICY_CHECK" ] }, "cdk_nag": { "rules_to_suppress": [ { "reason": "All IAM policies defined in this solutiongrant only least-privilege permissions. Wildcard for resources is used only for serviceswhich do not have a resource arn", "id": "AwsSolutions-IAM5" }, { "reason": "We use AWS managed policies and do not need tochange as the \"*\" in resource is due to circular dependency.", "id": "AwsSolutions-IAM4" } ] } } }, "CreateTimestampSolutionStepcreatetimestampfnRoleDefaultPolicyCA043C72": { "Type": "AWS::IAM::Policy", "Properties": { "PolicyDocument": { "Statement": [ { "Action": [ "xray:PutTraceSegments", "xray:PutTelemetryRecords" ], "Effect": "Allow", "Resource": "*" } ], "Version": "2012-10-17" }, "PolicyName": "CreateTimestampSolutionStepcreatetimestampfnRoleDefaultPolicyCA043C72", "Roles": [ { "Ref": "CreateTimestampSolutionStepcreatetimestampfnRoleA3EE0EA2" } ] }, "Metadata": { "cfn_nag": { "rules_to_suppress": [ { "id": "W12", "reason": "IAM policy for AWS X-Ray requires an allow on *" } ] }, "cdk_nag": { "rules_to_suppress": [ { "reason": "All IAM policies defined in this solutiongrant only least-privilege permissions. Wildcard for resources is used only for serviceswhich do not have a resource arn", "id": "AwsSolutions-IAM5" }, { "reason": "We use AWS managed policies and do not need tochange as the \"*\" in resource is due to circular dependency.", "id": "AwsSolutions-IAM4" } ] } } }, "CreateTimestampSolutionStepcreatetimestampfn13532149": { "Type": "AWS::Lambda::Function", "Properties": { "Code": { "S3Bucket": { "Fn::Join": [ "-", [ { "Fn::FindInMap": [ "SourceCode", "General", "S3Bucket" ] }, { "Ref": "AWS::Region" } ] ] }, "S3Key": { "Fn::Join": [ "/", [ { "Fn::FindInMap": [ "SourceCode", "General", "KeyPrefix" ] }, "CreateTimestampSolutionStepcreatetimestampfn13532149.zip" ] ] } }, "Environment": { "Variables": { "SOLUTION_NAME": "maintaining-personalized-experiences-with-machine-learning", "SOLUTION_ID": "SO0170", "SOLUTION_VERSION": "v1.5.0", "LOG_LEVEL": "INFO", "POWERTOOLS_SERVICE_NAME": "Workflow", "POWERTOOLS_METRICS_NAMESPACE": { "Fn::Join": [ "", [ "personalize_solution_", { "Ref": "AWS::StackName" } ] ] } } }, "Handler": "handler.lambda_handler", "Layers": [ { "Ref": "PowertoolsLayer8E932F0F197D4026A35423D184C2A624D967C184" } ], "Role": { "Fn::GetAtt": [ "CreateTimestampSolutionStepcreatetimestampfnRoleA3EE0EA2", "Arn" ] }, "Runtime": "python3.11", "Tags": [ { "Key": "SOLUTION_ID", "Value": "SO0170" }, { "Key": "SOLUTION_NAME", "Value": "maintaining-personalized-experiences-with-machine-learning" }, { "Key": "SOLUTION_VERSION", "Value": "v1.5.0" } ], "Timeout": 15, "TracingConfig": { "Mode": "Active" } }, "DependsOn": [ "CreateTimestampSolutionStepcreatetimestampfnRoleDefaultPolicyCA043C72", "CreateTimestampSolutionStepcreatetimestampfnRoleA3EE0EA2" ], "Metadata": { "cdk_nag": { "rules_to_suppress": [ { "reason": "All IAM policies defined in this solutiongrant only least-privilege permissions. Wildcard for resources is used only for serviceswhich do not have a resource arn", "id": "AwsSolutions-IAM5" }, { "reason": "We use AWS managed policies and do not need tochange as the \"*\" in resource is due to circular dependency.", "id": "AwsSolutions-IAM4" } ] }, "cfn_nag": { "rules_to_suppress": [ { "id": "W89", "reason": "functions deployed by this solution do not require VPC access" }, { "id": "W92", "reason": "functions deployed by this solution do not require reserved concurrency" }, { "id": "W58", "reason": "functions deployed by this solution use custom policy to write to CloudWatch logs" } ] } } }, "Notifications87298708": { "Type": "AWS::Events::EventBus", "Properties": { "Name": { "Fn::Join": [ "", [ "aws-solutions-SO0170-", { "Ref": "AWS::StackName" } ] ] } } }, "ScheduledDatasetImportStateMachineNameStateMachineNameNameResource555C997B": { "Type": "Custom::ResourceName", "Properties": { "ServiceToken": { "Fn::GetAtt": [ "ResourceNameFunctiond45b185afe3444aba37517f89597d9ec4F793A21", "Arn" ] }, "Purpose": "periodic-dataset-import", "StackName": { "Ref": "AWS::StackName" }, "MaxLength": 80 } }, "ScheduledDatasetImportPeriodicDatasetImportRole67B947D1": { "Type": "AWS::IAM::Role", "Properties": { "AssumeRolePolicyDocument": { "Statement": [ { "Action": "sts:AssumeRole", "Effect": "Allow", "Principal": { "Service": { "Fn::FindInMap": [ "ServiceprincipalMap", { "Ref": "AWS::Region" }, "states" ] } } } ], "Version": "2012-10-17" }, "Tags": [ { "Key": "SOLUTION_ID", "Value": "SO0170" }, { "Key": "SOLUTION_NAME", "Value": "maintaining-personalized-experiences-with-machine-learning" }, { "Key": "SOLUTION_VERSION", "Value": "v1.5.0" } ] }, "Metadata": { "cdk_nag": { "rules_to_suppress": [ { "reason": "All IAM policies defined in this solutiongrant only least-privilege permissions. Wildcard for resources is used only for serviceswhich do not have a resource arn", "id": "AwsSolutions-IAM5" }, { "reason": "We use AWS managed policies and do not need tochange as the \"*\" in resource is due to circular dependency.", "id": "AwsSolutions-IAM4" } ] } } }, "ScheduledDatasetImportPeriodicDatasetImportRoleDefaultPolicyCB7440F4": { "Type": "AWS::IAM::Policy", "Properties": { "PolicyDocument": { "Statement": [ { "Action": [ "xray:PutTraceSegments", "xray:PutTelemetryRecords", "xray:GetSamplingRules", "xray:GetSamplingTargets" ], "Effect": "Allow", "Resource": "*" }, { "Action": "lambda:InvokeFunction", "Effect": "Allow", "Resource": [ { "Fn::GetAtt": [ "SNSNotificationSolutionStepsnsnotificationfn6973DEFB", "Arn" ] }, { "Fn::Join": [ "", [ { "Fn::GetAtt": [ "SNSNotificationSolutionStepsnsnotificationfn6973DEFB", "Arn" ] }, ":*" ] ] } ] }, { "Action": "lambda:InvokeFunction", "Effect": "Allow", "Resource": [ { "Fn::GetAtt": [ "CreateTimestampSolutionStepcreatetimestampfn13532149", "Arn" ] }, { "Fn::Join": [ "", [ { "Fn::GetAtt": [ "CreateTimestampSolutionStepcreatetimestampfn13532149", "Arn" ] }, ":*" ] ] } ] }, { "Action": "lambda:InvokeFunction", "Effect": "Allow", "Resource": [ { "Fn::GetAtt": [ "PrepareInputSolutionStepprepareinputfn2F0001F7", "Arn" ] }, { "Fn::Join": [ "", [ { "Fn::GetAtt": [ "PrepareInputSolutionStepprepareinputfn2F0001F7", "Arn" ] }, ":*" ] ] } ] }, { "Action": "lambda:InvokeFunction", "Effect": "Allow", "Resource": [ { "Fn::GetAtt": [ "CreateDatasetImportJobSolutionStepcreatedatasetimportjobfn4FF1A8F1", "Arn" ] }, { "Fn::Join": [ "", [ { "Fn::GetAtt": [ "CreateDatasetImportJobSolutionStepcreatedatasetimportjobfn4FF1A8F1", "Arn" ] }, ":*" ] ] } ] }, { "Action": "lambda:InvokeFunction", "Effect": "Allow", "Resource": [ { "Fn::GetAtt": [ "CreateDatasetSolutionStepcreatedatasetfn072D6427", "Arn" ] }, { "Fn::Join": [ "", [ { "Fn::GetAtt": [ "CreateDatasetSolutionStepcreatedatasetfn072D6427", "Arn" ] }, ":*" ] ] } ] }, { "Action": "lambda:InvokeFunction", "Effect": "Allow", "Resource": [ { "Fn::GetAtt": [ "CreateSchemaSolutionStepcreateschemafn2A793C8A", "Arn" ] }, { "Fn::Join": [ "", [ { "Fn::GetAtt": [ "CreateSchemaSolutionStepcreateschemafn2A793C8A", "Arn" ] }, ":*" ] ] } ] } ], "Version": "2012-10-17" }, "PolicyName": "ScheduledDatasetImportPeriodicDatasetImportRoleDefaultPolicyCB7440F4", "Roles": [ { "Ref": "ScheduledDatasetImportPeriodicDatasetImportRole67B947D1" } ] }, "Metadata": { "cfn_nag": { "rules_to_suppress": [ { "id": "W12", "reason": "IAM policy for AWS X-Ray requires an allow on *" }, { "id": "W76", "reason": "Large step functions need larger IAM roles to access all managed AWS Lambda functions" } ] }, "cdk_nag": { "rules_to_suppress": [ { "reason": "All IAM policies defined in this solutiongrant only least-privilege permissions. Wildcard for resources is used only for serviceswhich do not have a resource arn", "id": "AwsSolutions-IAM5" }, { "reason": "We use AWS managed policies and do not need tochange as the \"*\" in resource is due to circular dependency.", "id": "AwsSolutions-IAM4" } ] } } }, "ScheduledDatasetImportPeriodicDatasetImport3830A3E8": { "Type": "AWS::StepFunctions::StateMachine", "Properties": { "DefinitionString": { "Fn::Join": [ "", [ "{\"StartAt\":\"Manage The Execution\",\"States\":{\"Manage The Execution\":{\"Type\":\"Parallel\",\"Next\":\"Success\",\"Catch\":[{\"ErrorEquals\":[\"States.ALL\"],\"ResultPath\":\"$.statesError\",\"Next\":\"Send Failure Message\"}],\"Branches\":[{\"StartAt\":\"Set Current Timestamp\",\"States\":{\"Set Current Timestamp\":{\"Next\":\"Prepare Input\",\"Retry\":[{\"ErrorEquals\":[\"Lambda.ServiceException\",\"Lambda.AWSLambdaException\",\"Lambda.SdkClientException\"],\"IntervalSeconds\":2,\"MaxAttempts\":6,\"BackoffRate\":2},{\"ErrorEquals\":[\"ResourcePending\"],\"IntervalSeconds\":5,\"MaxAttempts\":5,\"BackoffRate\":1.05}],\"Type\":\"Task\",\"InputPath\":\"$\",\"OutputPath\":\"$\",\"ResultPath\":\"$.currentDate\",\"Resource\":\"", { "Fn::GetAtt": [ "CreateTimestampSolutionStepcreatetimestampfn13532149", "Arn" ] }, "\"},\"Prepare Input\":{\"Next\":\"Create and Import Datasets\",\"Retry\":[{\"ErrorEquals\":[\"Lambda.ServiceException\",\"Lambda.AWSLambdaException\",\"Lambda.SdkClientException\"],\"IntervalSeconds\":2,\"MaxAttempts\":6,\"BackoffRate\":2},{\"ErrorEquals\":[\"ResourcePending\"],\"IntervalSeconds\":5,\"MaxAttempts\":5,\"BackoffRate\":1.05}],\"Type\":\"Task\",\"InputPath\":\"$\",\"OutputPath\":\"$\",\"ResultPath\":\"$\",\"Resource\":\"", { "Fn::GetAtt": [ "PrepareInputSolutionStepprepareinputfn2F0001F7", "Arn" ] }, "\"},\"Create and Import Datasets\":{\"Type\":\"Parallel\",\"ResultPath\":null,\"End\":true,\"Branches\":[{\"StartAt\":\"Check if Interactions Data Configuration Present\",\"States\":{\"Check if Interactions Data Configuration Present\":{\"Type\":\"Choice\",\"Choices\":[{\"Variable\":\"$.datasets.interactions\",\"IsPresent\":true,\"Next\":\"Create Interactions Schema\"}],\"Default\":\"Interactions Not Provided\"},\"Interactions Not Provided\":{\"Type\":\"Pass\",\"ResultPath\":null,\"End\":true},\"Try Interactions Dataset Import from CSV\":{\"End\":true,\"Retry\":[{\"ErrorEquals\":[\"Lambda.ServiceException\",\"Lambda.AWSLambdaException\",\"Lambda.SdkClientException\"],\"IntervalSeconds\":2,\"MaxAttempts\":6,\"BackoffRate\":2},{\"ErrorEquals\":[\"ResourcePending\"],\"IntervalSeconds\":60,\"MaxAttempts\":100,\"BackoffRate\":1.02}],\"Catch\":[{\"ErrorEquals\":[\"NoSuchKey\"],\"ResultPath\":null,\"Next\":\"Interactions Not Provided\"}],\"Type\":\"Task\",\"InputPath\":\"$\",\"OutputPath\":\"$\",\"ResultPath\":null,\"Resource\":\"", { "Fn::GetAtt": [ "CreateDatasetImportJobSolutionStepcreatedatasetimportjobfn4FF1A8F1", "Arn" ] }, "\",\"Parameters\":{\"serviceConfig\":{\"jobName.$\":\"States.Format('dataset_import_interactions_{}', $.currentDate)\",\"datasetArn.$\":\"$.datasets.interactions.dataset.serviceConfig.datasetArn\",\"dataSource\":{\"dataLocation.$\":\"States.Format('s3://{}/{}/interactions.csv', $.bucket.name, $.bucket.key)\"},\"importMode\":\"FULL\",\"publishAttributionMetricsToS3.$\":\"$.datasets.serviceConfig.publishAttributionMetricsToS3\",\"tags.$\":\"$.datasets.serviceConfig.tags\"},\"workflowConfig\":{\"maxAge.$\":\"$.datasetGroup.workflowConfig.maxAge\",\"timeStarted.$\":\"$$.State.EnteredTime\"}}},\"Try Interactions Dataset Import from Prefix\":{\"End\":true,\"Retry\":[{\"ErrorEquals\":[\"Lambda.ServiceException\",\"Lambda.AWSLambdaException\",\"Lambda.SdkClientException\"],\"IntervalSeconds\":2,\"MaxAttempts\":6,\"BackoffRate\":2},{\"ErrorEquals\":[\"ResourcePending\"],\"IntervalSeconds\":60,\"MaxAttempts\":100,\"BackoffRate\":1.02}],\"Catch\":[{\"ErrorEquals\":[\"NoSuchKey\"],\"ResultPath\":null,\"Next\":\"Try Interactions Dataset Import from CSV\"}],\"Type\":\"Task\",\"InputPath\":\"$\",\"OutputPath\":\"$\",\"ResultPath\":null,\"Resource\":\"", { "Fn::GetAtt": [ "CreateDatasetImportJobSolutionStepcreatedatasetimportjobfn4FF1A8F1", "Arn" ] }, "\",\"Parameters\":{\"serviceConfig\":{\"jobName.$\":\"States.Format('dataset_import_interactions_{}', $.currentDate)\",\"datasetArn.$\":\"$.datasets.interactions.dataset.serviceConfig.datasetArn\",\"dataSource\":{\"dataLocation.$\":\"States.Format('s3://{}/{}/interactions', $.bucket.name, $.bucket.key)\"},\"importMode\":\"FULL\",\"publishAttributionMetricsToS3.$\":\"$.datasets.serviceConfig.publishAttributionMetricsToS3\",\"tags.$\":\"$.datasets.serviceConfig.tags\"},\"workflowConfig\":{\"maxAge.$\":\"$.datasetGroup.workflowConfig.maxAge\",\"timeStarted.$\":\"$$.State.EnteredTime\"}}},\"Create Interactions Dataset\":{\"Next\":\"Try Interactions Dataset Import from Prefix\",\"Retry\":[{\"ErrorEquals\":[\"Lambda.ServiceException\",\"Lambda.AWSLambdaException\",\"Lambda.SdkClientException\"],\"IntervalSeconds\":2,\"MaxAttempts\":6,\"BackoffRate\":2},{\"ErrorEquals\":[\"ResourcePending\"],\"IntervalSeconds\":60,\"MaxAttempts\":100,\"BackoffRate\":1.02}],\"Type\":\"Task\",\"InputPath\":\"$\",\"OutputPath\":\"$\",\"ResultPath\":\"$.datasets.interactions.dataset.serviceConfig\",\"Resource\":\"", { "Fn::GetAtt": [ "CreateDatasetSolutionStepcreatedatasetfn072D6427", "Arn" ] }, "\",\"Parameters\":{\"serviceConfig\":{\"name.$\":\"$.datasets.interactions.dataset.serviceConfig.name\",\"schemaArn.$\":\"$.datasets.interactions.schema.serviceConfig.schemaArn\",\"datasetGroupArn.$\":\"$.datasetGroup.serviceConfig.datasetGroupArn\",\"datasetType\":\"interactions\",\"tags.$\":\"$.datasets.interactions.dataset.serviceConfig.tags\"},\"workflowConfig\":{\"maxAge.$\":\"$.datasetGroup.workflowConfig.maxAge\",\"timeStarted.$\":\"$$.State.EnteredTime\"}}},\"Create Interactions Schema\":{\"Next\":\"Create Interactions Dataset\",\"Retry\":[{\"ErrorEquals\":[\"Lambda.ServiceException\",\"Lambda.AWSLambdaException\",\"Lambda.SdkClientException\"],\"IntervalSeconds\":2,\"MaxAttempts\":6,\"BackoffRate\":2},{\"ErrorEquals\":[\"ResourcePending\"],\"IntervalSeconds\":5,\"MaxAttempts\":5,\"BackoffRate\":1.05}],\"Type\":\"Task\",\"InputPath\":\"$.datasets.interactions.schema\",\"OutputPath\":\"$\",\"ResultPath\":\"$.datasets.interactions.schema.serviceConfig\",\"Resource\":\"", { "Fn::GetAtt": [ "CreateSchemaSolutionStepcreateschemafn2A793C8A", "Arn" ] }, "\"}}},{\"StartAt\":\"Check if Users Data Configuration Present\",\"States\":{\"Check if Users Data Configuration Present\":{\"Type\":\"Choice\",\"Choices\":[{\"Variable\":\"$.datasets.users\",\"IsPresent\":true,\"Next\":\"Create Users Schema\"}],\"Default\":\"Users Not Provided\"},\"Users Not Provided\":{\"Type\":\"Pass\",\"ResultPath\":null,\"End\":true},\"Try Users Dataset Import from CSV\":{\"End\":true,\"Retry\":[{\"ErrorEquals\":[\"Lambda.ServiceException\",\"Lambda.AWSLambdaException\",\"Lambda.SdkClientException\"],\"IntervalSeconds\":2,\"MaxAttempts\":6,\"BackoffRate\":2},{\"ErrorEquals\":[\"ResourcePending\"],\"IntervalSeconds\":60,\"MaxAttempts\":100,\"BackoffRate\":1.02}],\"Catch\":[{\"ErrorEquals\":[\"NoSuchKey\"],\"ResultPath\":null,\"Next\":\"Users Not Provided\"}],\"Type\":\"Task\",\"InputPath\":\"$\",\"OutputPath\":\"$\",\"ResultPath\":null,\"Resource\":\"", { "Fn::GetAtt": [ "CreateDatasetImportJobSolutionStepcreatedatasetimportjobfn4FF1A8F1", "Arn" ] }, "\",\"Parameters\":{\"serviceConfig\":{\"jobName.$\":\"States.Format('dataset_import_users_{}', $.currentDate)\",\"datasetArn.$\":\"$.datasets.users.dataset.serviceConfig.datasetArn\",\"dataSource\":{\"dataLocation.$\":\"States.Format('s3://{}/{}/users.csv', $.bucket.name, $.bucket.key)\"},\"importMode\":\"FULL\",\"publishAttributionMetricsToS3.$\":\"$.datasets.serviceConfig.publishAttributionMetricsToS3\",\"tags.$\":\"$.datasets.serviceConfig.tags\"},\"workflowConfig\":{\"maxAge.$\":\"$.datasetGroup.workflowConfig.maxAge\",\"timeStarted.$\":\"$$.State.EnteredTime\"}}},\"Try Users Dataset Import from Prefix\":{\"End\":true,\"Retry\":[{\"ErrorEquals\":[\"Lambda.ServiceException\",\"Lambda.AWSLambdaException\",\"Lambda.SdkClientException\"],\"IntervalSeconds\":2,\"MaxAttempts\":6,\"BackoffRate\":2},{\"ErrorEquals\":[\"ResourcePending\"],\"IntervalSeconds\":60,\"MaxAttempts\":100,\"BackoffRate\":1.02}],\"Catch\":[{\"ErrorEquals\":[\"NoSuchKey\"],\"ResultPath\":null,\"Next\":\"Try Users Dataset Import from CSV\"}],\"Type\":\"Task\",\"InputPath\":\"$\",\"OutputPath\":\"$\",\"ResultPath\":null,\"Resource\":\"", { "Fn::GetAtt": [ "CreateDatasetImportJobSolutionStepcreatedatasetimportjobfn4FF1A8F1", "Arn" ] }, "\",\"Parameters\":{\"serviceConfig\":{\"jobName.$\":\"States.Format('dataset_import_users_{}', $.currentDate)\",\"datasetArn.$\":\"$.datasets.users.dataset.serviceConfig.datasetArn\",\"dataSource\":{\"dataLocation.$\":\"States.Format('s3://{}/{}/users', $.bucket.name, $.bucket.key)\"},\"importMode\":\"FULL\",\"publishAttributionMetricsToS3.$\":\"$.datasets.serviceConfig.publishAttributionMetricsToS3\",\"tags.$\":\"$.datasets.serviceConfig.tags\"},\"workflowConfig\":{\"maxAge.$\":\"$.datasetGroup.workflowConfig.maxAge\",\"timeStarted.$\":\"$$.State.EnteredTime\"}}},\"Create Users Dataset\":{\"Next\":\"Try Users Dataset Import from Prefix\",\"Retry\":[{\"ErrorEquals\":[\"Lambda.ServiceException\",\"Lambda.AWSLambdaException\",\"Lambda.SdkClientException\"],\"IntervalSeconds\":2,\"MaxAttempts\":6,\"BackoffRate\":2},{\"ErrorEquals\":[\"ResourcePending\"],\"IntervalSeconds\":60,\"MaxAttempts\":100,\"BackoffRate\":1.02}],\"Type\":\"Task\",\"InputPath\":\"$\",\"OutputPath\":\"$\",\"ResultPath\":\"$.datasets.users.dataset.serviceConfig\",\"Resource\":\"", { "Fn::GetAtt": [ "CreateDatasetSolutionStepcreatedatasetfn072D6427", "Arn" ] }, "\",\"Parameters\":{\"serviceConfig\":{\"name.$\":\"$.datasets.users.dataset.serviceConfig.name\",\"schemaArn.$\":\"$.datasets.users.schema.serviceConfig.schemaArn\",\"datasetGroupArn.$\":\"$.datasetGroup.serviceConfig.datasetGroupArn\",\"datasetType\":\"users\",\"tags.$\":\"$.datasets.users.dataset.serviceConfig.tags\"},\"workflowConfig\":{\"maxAge.$\":\"$.datasetGroup.workflowConfig.maxAge\",\"timeStarted.$\":\"$$.State.EnteredTime\"}}},\"Create Users Schema\":{\"Next\":\"Create Users Dataset\",\"Retry\":[{\"ErrorEquals\":[\"Lambda.ServiceException\",\"Lambda.AWSLambdaException\",\"Lambda.SdkClientException\"],\"IntervalSeconds\":2,\"MaxAttempts\":6,\"BackoffRate\":2},{\"ErrorEquals\":[\"ResourcePending\"],\"IntervalSeconds\":5,\"MaxAttempts\":5,\"BackoffRate\":1.05}],\"Type\":\"Task\",\"InputPath\":\"$.datasets.users.schema\",\"OutputPath\":\"$\",\"ResultPath\":\"$.datasets.users.schema.serviceConfig\",\"Resource\":\"", { "Fn::GetAtt": [ "CreateSchemaSolutionStepcreateschemafn2A793C8A", "Arn" ] }, "\"}}},{\"StartAt\":\"Check if Items Data Configuration Present\",\"States\":{\"Check if Items Data Configuration Present\":{\"Type\":\"Choice\",\"Choices\":[{\"Variable\":\"$.datasets.items\",\"IsPresent\":true,\"Next\":\"Create Items Schema\"}],\"Default\":\"Items Not Provided\"},\"Items Not Provided\":{\"Type\":\"Pass\",\"ResultPath\":null,\"End\":true},\"Try Items Dataset Import from CSV\":{\"End\":true,\"Retry\":[{\"ErrorEquals\":[\"Lambda.ServiceException\",\"Lambda.AWSLambdaException\",\"Lambda.SdkClientException\"],\"IntervalSeconds\":2,\"MaxAttempts\":6,\"BackoffRate\":2},{\"ErrorEquals\":[\"ResourcePending\"],\"IntervalSeconds\":60,\"MaxAttempts\":100,\"BackoffRate\":1.02}],\"Catch\":[{\"ErrorEquals\":[\"NoSuchKey\"],\"ResultPath\":null,\"Next\":\"Items Not Provided\"}],\"Type\":\"Task\",\"InputPath\":\"$\",\"OutputPath\":\"$\",\"ResultPath\":null,\"Resource\":\"", { "Fn::GetAtt": [ "CreateDatasetImportJobSolutionStepcreatedatasetimportjobfn4FF1A8F1", "Arn" ] }, "\",\"Parameters\":{\"serviceConfig\":{\"jobName.$\":\"States.Format('dataset_import_items_{}', $.currentDate)\",\"datasetArn.$\":\"$.datasets.items.dataset.serviceConfig.datasetArn\",\"dataSource\":{\"dataLocation.$\":\"States.Format('s3://{}/{}/items.csv', $.bucket.name, $.bucket.key)\"},\"importMode\":\"FULL\",\"publishAttributionMetricsToS3.$\":\"$.datasets.serviceConfig.publishAttributionMetricsToS3\",\"tags.$\":\"$.datasets.serviceConfig.tags\"},\"workflowConfig\":{\"maxAge.$\":\"$.datasetGroup.workflowConfig.maxAge\",\"timeStarted.$\":\"$$.State.EnteredTime\"}}},\"Try Items Dataset Import from Prefix\":{\"End\":true,\"Retry\":[{\"ErrorEquals\":[\"Lambda.ServiceException\",\"Lambda.AWSLambdaException\",\"Lambda.SdkClientException\"],\"IntervalSeconds\":2,\"MaxAttempts\":6,\"BackoffRate\":2},{\"ErrorEquals\":[\"ResourcePending\"],\"IntervalSeconds\":60,\"MaxAttempts\":100,\"BackoffRate\":1.02}],\"Catch\":[{\"ErrorEquals\":[\"NoSuchKey\"],\"ResultPath\":null,\"Next\":\"Try Items Dataset Import from CSV\"}],\"Type\":\"Task\",\"InputPath\":\"$\",\"OutputPath\":\"$\",\"ResultPath\":null,\"Resource\":\"", { "Fn::GetAtt": [ "CreateDatasetImportJobSolutionStepcreatedatasetimportjobfn4FF1A8F1", "Arn" ] }, "\",\"Parameters\":{\"serviceConfig\":{\"jobName.$\":\"States.Format('dataset_import_items_{}', $.currentDate)\",\"datasetArn.$\":\"$.datasets.items.dataset.serviceConfig.datasetArn\",\"dataSource\":{\"dataLocation.$\":\"States.Format('s3://{}/{}/items', $.bucket.name, $.bucket.key)\"},\"importMode\":\"FULL\",\"publishAttributionMetricsToS3.$\":\"$.datasets.serviceConfig.publishAttributionMetricsToS3\",\"tags.$\":\"$.datasets.serviceConfig.tags\"},\"workflowConfig\":{\"maxAge.$\":\"$.datasetGroup.workflowConfig.maxAge\",\"timeStarted.$\":\"$$.State.EnteredTime\"}}},\"Create Items Dataset\":{\"Next\":\"Try Items Dataset Import from Prefix\",\"Retry\":[{\"ErrorEquals\":[\"Lambda.ServiceException\",\"Lambda.AWSLambdaException\",\"Lambda.SdkClientException\"],\"IntervalSeconds\":2,\"MaxAttempts\":6,\"BackoffRate\":2},{\"ErrorEquals\":[\"ResourcePending\"],\"IntervalSeconds\":60,\"MaxAttempts\":100,\"BackoffRate\":1.02}],\"Type\":\"Task\",\"InputPath\":\"$\",\"OutputPath\":\"$\",\"ResultPath\":\"$.datasets.items.dataset.serviceConfig\",\"Resource\":\"", { "Fn::GetAtt": [ "CreateDatasetSolutionStepcreatedatasetfn072D6427", "Arn" ] }, "\",\"Parameters\":{\"serviceConfig\":{\"name.$\":\"$.datasets.items.dataset.serviceConfig.name\",\"schemaArn.$\":\"$.datasets.items.schema.serviceConfig.schemaArn\",\"datasetGroupArn.$\":\"$.datasetGroup.serviceConfig.datasetGroupArn\",\"datasetType\":\"items\",\"tags.$\":\"$.datasets.items.dataset.serviceConfig.tags\"},\"workflowConfig\":{\"maxAge.$\":\"$.datasetGroup.workflowConfig.maxAge\",\"timeStarted.$\":\"$$.State.EnteredTime\"}}},\"Create Items Schema\":{\"Next\":\"Create Items Dataset\",\"Retry\":[{\"ErrorEquals\":[\"Lambda.ServiceException\",\"Lambda.AWSLambdaException\",\"Lambda.SdkClientException\"],\"IntervalSeconds\":2,\"MaxAttempts\":6,\"BackoffRate\":2},{\"ErrorEquals\":[\"ResourcePending\"],\"IntervalSeconds\":5,\"MaxAttempts\":5,\"BackoffRate\":1.05}],\"Type\":\"Task\",\"InputPath\":\"$.datasets.items.schema\",\"OutputPath\":\"$\",\"ResultPath\":\"$.datasets.items.schema.serviceConfig\",\"Resource\":\"", { "Fn::GetAtt": [ "CreateSchemaSolutionStepcreateschemafn2A793C8A", "Arn" ] }, "\"}}}]}}}]},\"Success\":{\"End\":true,\"Retry\":[{\"ErrorEquals\":[\"Lambda.ServiceException\",\"Lambda.AWSLambdaException\",\"Lambda.SdkClientException\"],\"IntervalSeconds\":2,\"MaxAttempts\":6,\"BackoffRate\":2},{\"ErrorEquals\":[\"ResourcePending\"],\"IntervalSeconds\":5,\"MaxAttempts\":5,\"BackoffRate\":1.05}],\"Type\":\"Task\",\"InputPath\":\"$\",\"OutputPath\":\"$\",\"ResultPath\":\"$\",\"Resource\":\"", { "Fn::GetAtt": [ "SNSNotificationSolutionStepsnsnotificationfn6973DEFB", "Arn" ] }, "\",\"Parameters\":{\"datasetGroup.$\":\"$[0].datasetGroup.serviceConfig.name\"}},\"Send Failure Message\":{\"Next\":\"Failure\",\"Retry\":[{\"ErrorEquals\":[\"Lambda.ServiceException\",\"Lambda.AWSLambdaException\",\"Lambda.SdkClientException\"],\"IntervalSeconds\":2,\"MaxAttempts\":6,\"BackoffRate\":2},{\"ErrorEquals\":[\"ResourcePending\"],\"IntervalSeconds\":5,\"MaxAttempts\":5,\"BackoffRate\":1.05}],\"Type\":\"Task\",\"InputPath\":\"$\",\"OutputPath\":\"$\",\"ResultPath\":\"$\",\"Resource\":\"", { "Fn::GetAtt": [ "SNSNotificationSolutionStepsnsnotificationfn6973DEFB", "Arn" ] }, "\",\"Parameters\":{\"datasetGroup.$\":\"$.datasetGroup.serviceConfig.name\",\"statesError.$\":\"$.statesError\"}},\"Failure\":{\"Type\":\"Fail\"}}}" ] ] }, "RoleArn": { "Fn::GetAtt": [ "ScheduledDatasetImportPeriodicDatasetImportRole67B947D1", "Arn" ] }, "StateMachineName": { "Fn::GetAtt": [ "ScheduledDatasetImportStateMachineNameStateMachineNameNameResource555C997B", "Name" ] }, "Tags": [ { "Key": "SOLUTION_ID", "Value": "SO0170" }, { "Key": "SOLUTION_NAME", "Value": "maintaining-personalized-experiences-with-machine-learning" }, { "Key": "SOLUTION_VERSION", "Value": "v1.5.0" } ], "TracingConfiguration": { "Enabled": true } }, "DependsOn": [ "ScheduledDatasetImportPeriodicDatasetImportRoleDefaultPolicyCB7440F4", "ScheduledDatasetImportPeriodicDatasetImportRole67B947D1" ], "UpdateReplacePolicy": "Delete", "DeletionPolicy": "Delete", "Metadata": { "cdk_nag": { "rules_to_suppress": [ { "reason": "Information required for troubleshooting is logged by state function and lambda functions", "id": "AwsSolutions-SF1" }, { "reason": "All IAM policies defined in this solutiongrant only least-privilege permissions. Wildcard for resources is used only for serviceswhich do not have a resource arn", "id": "AwsSolutions-IAM5" }, { "reason": "We use AWS managed policies and do not need tochange as the \"*\" in resource is due to circular dependency.", "id": "AwsSolutions-IAM4" } ] } } }, "ResourceNameFunctiond45b185afe3444aba37517f89597d9ecRoleE234DCDF": { "Type": "AWS::IAM::Role", "Properties": { "AssumeRolePolicyDocument": { "Statement": [ { "Action": "sts:AssumeRole", "Effect": "Allow", "Principal": { "Service": "lambda.amazonaws.com" } } ], "Version": "2012-10-17" }, "Policies": [ { "PolicyDocument": { "Statement": [ { "Action": [ "logs:CreateLogGroup", "logs:CreateLogStream", "logs:PutLogEvents" ], "Effect": "Allow", "Resource": { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":logs:", { "Ref": "AWS::Region" }, ":", { "Ref": "AWS::AccountId" }, ":log-group:/aws/lambda/*" ] ] } } ], "Version": "2012-10-17" }, "PolicyName": "LambdaFunctionServiceRolePolicy" } ], "Tags": [ { "Key": "SOLUTION_ID", "Value": "SO0170" }, { "Key": "SOLUTION_NAME", "Value": "maintaining-personalized-experiences-with-machine-learning" }, { "Key": "SOLUTION_VERSION", "Value": "v1.5.0" } ] }, "Metadata": { "cdk_nag": { "rules_to_suppress": [ { "reason": "All IAM policies defined in this solutiongrant only least-privilege permissions. Wild card for resources is used only for services which do not have a resource arn", "id": "AwsSolutions-IAM5" } ] }, "guard": { "SuppressedRules": [ "IAM_NO_INLINE_POLICY_CHECK" ] } } }, "ResourceNameFunctiond45b185afe3444aba37517f89597d9ec4F793A21": { "Type": "AWS::Lambda::Function", "Properties": { "Code": { "S3Bucket": { "Fn::Join": [ "-", [ { "Fn::FindInMap": [ "SourceCode", "General", "S3Bucket" ] }, { "Ref": "AWS::Region" } ] ] }, "S3Key": { "Fn::Join": [ "/", [ { "Fn::FindInMap": [ "SourceCode", "General", "KeyPrefix" ] }, "ResourceNameFunctiond45b185afe3444aba37517f89597d9ec4F793A21.zip" ] ] } }, "Handler": "name.handler", "Role": { "Fn::GetAtt": [ "ResourceNameFunctiond45b185afe3444aba37517f89597d9ecRoleE234DCDF", "Arn" ] }, "Runtime": "python3.11", "Tags": [ { "Key": "SOLUTION_ID", "Value": "SO0170" }, { "Key": "SOLUTION_NAME", "Value": "maintaining-personalized-experiences-with-machine-learning" }, { "Key": "SOLUTION_VERSION", "Value": "v1.5.0" } ] }, "DependsOn": [ "ResourceNameFunctiond45b185afe3444aba37517f89597d9ecRoleE234DCDF" ], "Metadata": { "cfn_nag": { "rules_to_suppress": [ { "id": "W89", "reason": "functions deployed by this solution do not require VPC access" }, { "id": "W92", "reason": "functions deployed by this solution do not require reserved concurrency" }, { "id": "W58", "reason": "functions deployed by this solution use custom policy to write to CloudWatch logs" } ] } } }, "ScheduledSolutionMaintenanceStateMachineNameStateMachineNameNameResource93326218": { "Type": "Custom::ResourceName", "Properties": { "ServiceToken": { "Fn::GetAtt": [ "ResourceNameFunctiond45b185afe3444aba37517f89597d9ec4F793A21", "Arn" ] }, "Purpose": "periodic-solution-maintenance", "StackName": { "Ref": "AWS::StackName" }, "MaxLength": 80 } }, "ScheduledSolutionMaintenancePeriodicSolutionMaintenanceRoleBB209E6E": { "Type": "AWS::IAM::Role", "Properties": { "AssumeRolePolicyDocument": { "Statement": [ { "Action": "sts:AssumeRole", "Effect": "Allow", "Principal": { "Service": { "Fn::FindInMap": [ "ServiceprincipalMap", { "Ref": "AWS::Region" }, "states" ] } } } ], "Version": "2012-10-17" }, "Tags": [ { "Key": "SOLUTION_ID", "Value": "SO0170" }, { "Key": "SOLUTION_NAME", "Value": "maintaining-personalized-experiences-with-machine-learning" }, { "Key": "SOLUTION_VERSION", "Value": "v1.5.0" } ] }, "Metadata": { "cdk_nag": { "rules_to_suppress": [ { "reason": "All IAM policies defined in this solutiongrant only least-privilege permissions. Wildcard for resources is used only for serviceswhich do not have a resource arn", "id": "AwsSolutions-IAM5" }, { "reason": "We use AWS managed policies and do not need tochange as the \"*\" in resource is due to circular dependency.", "id": "AwsSolutions-IAM4" } ] } } }, "ScheduledSolutionMaintenancePeriodicSolutionMaintenanceRoleDefaultPolicyAF675022": { "Type": "AWS::IAM::Policy", "Properties": { "PolicyDocument": { "Statement": [ { "Action": [ "xray:PutTraceSegments", "xray:PutTelemetryRecords", "xray:GetSamplingRules", "xray:GetSamplingTargets" ], "Effect": "Allow", "Resource": "*" }, { "Action": "lambda:InvokeFunction", "Effect": "Allow", "Resource": [ { "Fn::GetAtt": [ "SNSNotificationSolutionStepsnsnotificationfn6973DEFB", "Arn" ] }, { "Fn::Join": [ "", [ { "Fn::GetAtt": [ "SNSNotificationSolutionStepsnsnotificationfn6973DEFB", "Arn" ] }, ":*" ] ] } ] }, { "Action": "lambda:InvokeFunction", "Effect": "Allow", "Resource": [ { "Fn::GetAtt": [ "CreateTimestampSolutionStepcreatetimestampfn13532149", "Arn" ] }, { "Fn::Join": [ "", [ { "Fn::GetAtt": [ "CreateTimestampSolutionStepcreatetimestampfn13532149", "Arn" ] }, ":*" ] ] } ] }, { "Action": "lambda:InvokeFunction", "Effect": "Allow", "Resource": [ { "Fn::GetAtt": [ "PrepareInputSolutionStepprepareinputfn2F0001F7", "Arn" ] }, { "Fn::Join": [ "", [ { "Fn::GetAtt": [ "PrepareInputSolutionStepprepareinputfn2F0001F7", "Arn" ] }, ":*" ] ] } ] }, { "Action": "lambda:InvokeFunction", "Effect": "Allow", "Resource": [ { "Fn::GetAtt": [ "CreateSolutionSolutionStepcreatesolutionfn1F463E79", "Arn" ] }, { "Fn::Join": [ "", [ { "Fn::GetAtt": [ "CreateSolutionSolutionStepcreatesolutionfn1F463E79", "Arn" ] }, ":*" ] ] } ] }, { "Action": "lambda:InvokeFunction", "Effect": "Allow", "Resource": [ { "Fn::GetAtt": [ "CreateSolutionVersionSolutionStepcreatesolutionversionfn0681411E", "Arn" ] }, { "Fn::Join": [ "", [ { "Fn::GetAtt": [ "CreateSolutionVersionSolutionStepcreatesolutionversionfn0681411E", "Arn" ] }, ":*" ] ] } ] }, { "Action": "lambda:InvokeFunction", "Effect": "Allow", "Resource": [ { "Fn::GetAtt": [ "CreateCampaignSolutionStepcreatecampaignfn5F83F6AB", "Arn" ] }, { "Fn::Join": [ "", [ { "Fn::GetAtt": [ "CreateCampaignSolutionStepcreatecampaignfn5F83F6AB", "Arn" ] }, ":*" ] ] } ] }, { "Action": "lambda:InvokeFunction", "Effect": "Allow", "Resource": [ { "Fn::GetAtt": [ "CreateBatchInferenceJobSolutionStepcreatebatchinferencejobfn8B4A8B4F", "Arn" ] }, { "Fn::Join": [ "", [ { "Fn::GetAtt": [ "CreateBatchInferenceJobSolutionStepcreatebatchinferencejobfn8B4A8B4F", "Arn" ] }, ":*" ] ] } ] }, { "Action": "lambda:InvokeFunction", "Effect": "Allow", "Resource": [ { "Fn::GetAtt": [ "CreateBatchSegmentJobSolutionStepcreatebatchsegmentjobfn01ACE97D", "Arn" ] }, { "Fn::Join": [ "", [ { "Fn::GetAtt": [ "CreateBatchSegmentJobSolutionStepcreatebatchsegmentjobfn01ACE97D", "Arn" ] }, ":*" ] ] } ] }, { "Action": "lambda:InvokeFunction", "Effect": "Allow", "Resource": [ { "Fn::GetAtt": [ "CreateRecommenderSolutionStepcreaterecommenderfnF63FF7BD", "Arn" ] }, { "Fn::Join": [ "", [ { "Fn::GetAtt": [ "CreateRecommenderSolutionStepcreaterecommenderfnF63FF7BD", "Arn" ] }, ":*" ] ] } ] } ], "Version": "2012-10-17" }, "PolicyName": "ScheduledSolutionMaintenancePeriodicSolutionMaintenanceRoleDefaultPolicyAF675022", "Roles": [ { "Ref": "ScheduledSolutionMaintenancePeriodicSolutionMaintenanceRoleBB209E6E" } ] }, "Metadata": { "cfn_nag": { "rules_to_suppress": [ { "id": "W12", "reason": "IAM policy for AWS X-Ray requires an allow on *" }, { "id": "W76", "reason": "Large step functions need larger IAM roles to access all managed AWS Lambda functions" } ] }, "cdk_nag": { "rules_to_suppress": [ { "reason": "All IAM policies defined in this solutiongrant only least-privilege permissions. Wildcard for resources is used only for serviceswhich do not have a resource arn", "id": "AwsSolutions-IAM5" }, { "reason": "We use AWS managed policies and do not need tochange as the \"*\" in resource is due to circular dependency.", "id": "AwsSolutions-IAM4" } ] } } }, "ScheduledSolutionMaintenancePeriodicSolutionMaintenance814E56C3": { "Type": "AWS::StepFunctions::StateMachine", "Properties": { "DefinitionString": { "Fn::Join": [ "", [ "{\"StartAt\":\"Manage Solution Maintenance\",\"States\":{\"Manage Solution Maintenance\":{\"Type\":\"Parallel\",\"Next\":\"Success\",\"Catch\":[{\"ErrorEquals\":[\"States.ALL\"],\"ResultPath\":\"$.statesError\",\"Next\":\"Send Failure Message\"}],\"Branches\":[{\"StartAt\":\"Set Current Timestamp\",\"States\":{\"Set Current Timestamp\":{\"Next\":\"Prepare Input\",\"Retry\":[{\"ErrorEquals\":[\"Lambda.ServiceException\",\"Lambda.AWSLambdaException\",\"Lambda.SdkClientException\"],\"IntervalSeconds\":2,\"MaxAttempts\":6,\"BackoffRate\":2},{\"ErrorEquals\":[\"ResourcePending\"],\"IntervalSeconds\":5,\"MaxAttempts\":5,\"BackoffRate\":1.05}],\"Type\":\"Task\",\"InputPath\":\"$\",\"OutputPath\":\"$\",\"ResultPath\":\"$.currentDate\",\"Resource\":\"", { "Fn::GetAtt": [ "CreateTimestampSolutionStepcreatetimestampfn13532149", "Arn" ] }, "\"},\"Prepare Input\":{\"Next\":\"Recommenders and Solutions\",\"Retry\":[{\"ErrorEquals\":[\"Lambda.ServiceException\",\"Lambda.AWSLambdaException\",\"Lambda.SdkClientException\"],\"IntervalSeconds\":2,\"MaxAttempts\":6,\"BackoffRate\":2},{\"ErrorEquals\":[\"ResourcePending\"],\"IntervalSeconds\":5,\"MaxAttempts\":5,\"BackoffRate\":1.05}],\"Type\":\"Task\",\"InputPath\":\"$\",\"OutputPath\":\"$\",\"ResultPath\":\"$\",\"Resource\":\"", { "Fn::GetAtt": [ "PrepareInputSolutionStepprepareinputfn2F0001F7", "Arn" ] }, "\"},\"Recommenders and Solutions\":{\"Type\":\"Parallel\",\"ResultPath\":null,\"End\":true,\"Branches\":[{\"StartAt\":\"Check for Solutions\",\"States\":{\"Check for Solutions\":{\"Type\":\"Choice\",\"Choices\":[{\"Variable\":\"$.solutions[0]\",\"IsPresent\":true,\"Next\":\"Create Solutions\"}],\"Default\":\"Solutions not Provided\"},\"Solutions not Provided\":{\"Type\":\"Pass\",\"End\":true},\"Create Solutions\":{\"Type\":\"Map\",\"ResultPath\":null,\"End\":true,\"Parameters\":{\"datasetGroupArn.$\":\"$.datasetGroup.serviceConfig.datasetGroupArn\",\"datasetGroupName.$\":\"$.datasetGroup.serviceConfig.name\",\"solution.$\":\"$$.Map.Item.Value\",\"bucket.$\":\"$.bucket\",\"currentDate.$\":\"$.currentDate\"},\"Iterator\":{\"StartAt\":\"Prepare Solution Input Data\",\"States\":{\"Prepare Solution Input Data\":{\"Type\":\"Pass\",\"ResultPath\":\"$.solution.serviceConfig.datasetGroupArn\",\"InputPath\":\"$.datasetGroupArn\",\"Next\":\"Create Solution\"},\"Create Solution\":{\"Next\":\"Prepare Solution Output Data\",\"Retry\":[{\"ErrorEquals\":[\"Lambda.ServiceException\",\"Lambda.AWSLambdaException\",\"Lambda.SdkClientException\"],\"IntervalSeconds\":2,\"MaxAttempts\":6,\"BackoffRate\":2},{\"ErrorEquals\":[\"ResourcePending\"],\"IntervalSeconds\":5,\"MaxAttempts\":5,\"BackoffRate\":1.05}],\"Type\":\"Task\",\"InputPath\":\"$.solution\",\"OutputPath\":\"$\",\"ResultPath\":\"$._tmp\",\"ResultSelector\":{\"solutionArn.$\":\"$.solutionArn\"},\"Resource\":\"", { "Fn::GetAtt": [ "CreateSolutionSolutionStepcreatesolutionfn1F463E79", "Arn" ] }, "\"},\"Prepare Solution Output Data\":{\"Type\":\"Pass\",\"ResultPath\":\"$.solution.serviceConfig.solutionArn\",\"InputPath\":\"$._tmp.solutionArn\",\"Next\":\"Check for Solution Version\"},\"Check for Solution Version\":{\"Type\":\"Choice\",\"Choices\":[{\"Variable\":\"$.solution.solutionVersion\",\"IsPresent\":false,\"Next\":\"Prepare Solution Version Input Data\"}],\"Default\":\"Create Solution Version\"},\"Create Solution Version\":{\"Next\":\"Prepare Solution Version Output Data\",\"Retry\":[{\"ErrorEquals\":[\"Lambda.ServiceException\",\"Lambda.AWSLambdaException\",\"Lambda.SdkClientException\"],\"IntervalSeconds\":2,\"MaxAttempts\":6,\"BackoffRate\":2},{\"ErrorEquals\":[\"ResourcePending\"],\"IntervalSeconds\":60,\"MaxAttempts\":100,\"BackoffRate\":1.02}],\"Catch\":[{\"ErrorEquals\":[\"SolutionVersionPending\"],\"ResultPath\":\"$.solutionVersionPending\",\"Next\":\"Save Solution Version ID\"}],\"Type\":\"Task\",\"InputPath\":\"$.solution.solutionVersion\",\"OutputPath\":\"$\",\"ResultPath\":\"$._tmp\",\"ResultSelector\":{\"solutionVersionArn.$\":\"$.solutionVersionArn\"},\"Resource\":\"", { "Fn::GetAtt": [ "CreateSolutionVersionSolutionStepcreatesolutionversionfn0681411E", "Arn" ] }, "\"},\"Set Solution Version ID\":{\"Type\":\"Pass\",\"ResultPath\":\"$.solution.solutionVersion\",\"Parameters\":{\"serviceConfig\":{\"trainingMode.$\":\"$.solution.serviceConfig.solutionVersion.trainingMode\",\"solutionArn.$\":\"$.solution.solutionVersion.serviceConfig.solutionArn\",\"tags.$\":\"$.solution.solutionVersion.serviceConfig.tags\"},\"workflowConfig\":{\"maxAge.$\":\"$.solution.solutionVersion.workflowConfig.maxAge\",\"solutionVersionArn.$\":\"$._tmp.errorInfo.errorMessage\",\"timeStarted.$\":\"$$.State.EnteredTime\"}},\"Next\":\"Create Solution Version\"},\"Save Solution Version ID\":{\"Type\":\"Pass\",\"ResultPath\":\"$._tmp\",\"Parameters\":{\"errorInfo.$\":\"States.StringToJson($.solutionVersionPending.Cause)\"},\"Next\":\"Set Solution Version ID\"},\"Prepare Solution Version Input Data\":{\"Type\":\"Pass\",\"ResultPath\":\"$.solution.solutionVersion\",\"Parameters\":{\"serviceConfig\":{\"solutionArn.$\":\"$.solution.serviceConfig.solutionArn\",\"trainingMode\":\"FULL\",\"tags.$\":\"$.solution.serviceConfig.solutionVersion.tags\"},\"workflowConfig\":{\"maxAge\":\"365 days\",\"timeStarted.$\":\"$$.State.EnteredTime\"}},\"Next\":\"Create Solution Version\"},\"Prepare Solution Version Output Data\":{\"Type\":\"Pass\",\"ResultPath\":\"$.solution.solutionVersion.serviceConfig.solutionVersionArn\",\"InputPath\":\"$._tmp.solutionVersionArn\",\"Next\":\"Create Campaigns and Batch Inference Jobs\"},\"Create Campaigns and Batch Inference Jobs\":{\"Type\":\"Parallel\",\"ResultPath\":null,\"End\":true,\"Branches\":[{\"StartAt\":\"Check for Campaigns\",\"States\":{\"Check for Campaigns\":{\"Type\":\"Choice\",\"Choices\":[{\"Variable\":\"$.solution.campaigns[0]\",\"IsPresent\":true,\"Next\":\"Create Campaigns\"}],\"Default\":\"Campaigns not Provided\"},\"Campaigns not Provided\":{\"Type\":\"Pass\",\"End\":true},\"Create Campaigns\":{\"Type\":\"Map\",\"End\":true,\"Parameters\":{\"solutionVersionArn.$\":\"$.solution.solutionVersion.serviceConfig.solutionVersionArn\",\"campaign.$\":\"$$.Map.Item.Value\"},\"Iterator\":{\"StartAt\":\"Prepare Campaign Input Data\",\"States\":{\"Prepare Campaign Input Data\":{\"Type\":\"Pass\",\"ResultPath\":\"$.campaign.serviceConfig.solutionVersionArn\",\"InputPath\":\"$.solutionVersionArn\",\"Next\":\"Create Campaign\"},\"Create Campaign\":{\"End\":true,\"Retry\":[{\"ErrorEquals\":[\"Lambda.ServiceException\",\"Lambda.AWSLambdaException\",\"Lambda.SdkClientException\"],\"IntervalSeconds\":2,\"MaxAttempts\":6,\"BackoffRate\":2},{\"ErrorEquals\":[\"ResourcePending\"],\"IntervalSeconds\":60,\"MaxAttempts\":100,\"BackoffRate\":1.02}],\"Type\":\"Task\",\"InputPath\":\"$.campaign\",\"OutputPath\":\"$\",\"ResultPath\":\"$.campaign.serviceConfig\",\"Resource\":\"", { "Fn::GetAtt": [ "CreateCampaignSolutionStepcreatecampaignfn5F83F6AB", "Arn" ] }, "\"}}},\"ItemsPath\":\"$.solution.campaigns\"}}},{\"StartAt\":\"Check for Batch Inference Jobs\",\"States\":{\"Check for Batch Inference Jobs\":{\"Type\":\"Choice\",\"Choices\":[{\"Variable\":\"$.solution.batchInferenceJobs[0]\",\"IsPresent\":true,\"Next\":\"Create Batch Inference Jobs\"}],\"Default\":\"Batch Inference Jobs Not Provided\"},\"Batch Inference Jobs Not Provided\":{\"Type\":\"Pass\",\"End\":true},\"Create Batch Inference Jobs\":{\"Type\":\"Map\",\"End\":true,\"Parameters\":{\"solutionVersionArn.$\":\"$.solution.solutionVersion.serviceConfig.solutionVersionArn\",\"batchInferenceJob.$\":\"$$.Map.Item.Value\",\"batchInferenceJobName.$\":\"States.Format('batch_{}_{}', $.solution.serviceConfig.name, $.currentDate)\",\"bucket.$\":\"$.bucket\",\"currentDate.$\":\"$.currentDate\",\"datasetGroupName.$\":\"$.datasetGroupName\",\"datasetGroupArn.$\":\"$.datasetGroupArn\",\"solution.$\":\"$.solution\"},\"Iterator\":{\"StartAt\":\"Set Batch Inference Job Input Data - Job Name\",\"States\":{\"Set Batch Inference Job Input Data - Job Name\":{\"Type\":\"Pass\",\"ResultPath\":\"$.batchInferenceJob.serviceConfig.jobName\",\"InputPath\":\"$.batchInferenceJobName\",\"Next\":\"Set Batch Inference Job Input Data - Solution Version ARN\"},\"Set Batch Inference Job Input Data - Solution Version ARN\":{\"Type\":\"Pass\",\"ResultPath\":\"$.batchInferenceJob.serviceConfig.solutionVersionArn\",\"InputPath\":\"$.solutionVersionArn\",\"Next\":\"Set Batch Inference Job Input Data - Job Input\"},\"Set Batch Inference Job Input Data - Job Input\":{\"Type\":\"Pass\",\"ResultPath\":\"$.batchInferenceJob.serviceConfig.jobInput\",\"Parameters\":{\"s3DataSource\":{\"path.$\":\"States.Format('s3://{}/batch/{}/{}/job_config.json', $.bucket.name, $.datasetGroupName, $.solution.serviceConfig.name)\"}},\"Next\":\"Set Batch Inference Job Input Data - Job Output\"},\"Set Batch Inference Job Input Data - Job Output\":{\"Type\":\"Pass\",\"ResultPath\":\"$.batchInferenceJob.serviceConfig.jobOutput\",\"Parameters\":{\"s3DataDestination\":{\"path.$\":\"States.Format('s3://{}/batch/{}/{}/{}/', $.bucket.name, $.datasetGroupName, $.solution.serviceConfig.name, $.batchInferenceJobName)\"}},\"Next\":\"Create Batch Inference Job\"},\"Create Batch Inference Job\":{\"End\":true,\"Retry\":[{\"ErrorEquals\":[\"Lambda.ServiceException\",\"Lambda.AWSLambdaException\",\"Lambda.SdkClientException\"],\"IntervalSeconds\":2,\"MaxAttempts\":6,\"BackoffRate\":2},{\"ErrorEquals\":[\"ResourcePending\"],\"IntervalSeconds\":60,\"MaxAttempts\":100,\"BackoffRate\":1.02}],\"Type\":\"Task\",\"InputPath\":\"$.batchInferenceJob\",\"OutputPath\":\"$\",\"ResultPath\":\"$.batchInferenceJob.serviceConfig\",\"Resource\":\"", { "Fn::GetAtt": [ "CreateBatchInferenceJobSolutionStepcreatebatchinferencejobfn8B4A8B4F", "Arn" ] }, "\"}}},\"ItemsPath\":\"$.solution.batchInferenceJobs\"}}},{\"StartAt\":\"Check for Batch Segment Jobs\",\"States\":{\"Check for Batch Segment Jobs\":{\"Type\":\"Choice\",\"Choices\":[{\"Variable\":\"$.solution.batchSegmentJobs[0]\",\"IsPresent\":true,\"Next\":\"Create Batch Segment Jobs\"}],\"Default\":\"Batch Segment Jobs Not Provided\"},\"Batch Segment Jobs Not Provided\":{\"Type\":\"Pass\",\"End\":true},\"Create Batch Segment Jobs\":{\"Type\":\"Map\",\"End\":true,\"Parameters\":{\"solutionVersionArn.$\":\"$.solution.solutionVersion.serviceConfig.solutionVersionArn\",\"batchSegmentJob.$\":\"$$.Map.Item.Value\",\"batchSegmentJobName.$\":\"States.Format('batch_{}_{}', $.solution.serviceConfig.name, $.currentDate)\",\"bucket.$\":\"$.bucket\",\"currentDate.$\":\"$.currentDate\",\"datasetGroupName.$\":\"$.datasetGroupName\",\"datasetGroupArn.$\":\"$.datasetGroupArn\",\"solution.$\":\"$.solution\"},\"Iterator\":{\"StartAt\":\"Set Batch Segment Job Input Data - Job Name\",\"States\":{\"Set Batch Segment Job Input Data - Job Name\":{\"Type\":\"Pass\",\"ResultPath\":\"$.batchSegmentJob.serviceConfig.jobName\",\"InputPath\":\"$.batchSegmentJobName\",\"Next\":\"Set Batch Segment Job Input Data - Solution Version ARN\"},\"Set Batch Segment Job Input Data - Solution Version ARN\":{\"Type\":\"Pass\",\"ResultPath\":\"$.batchSegmentJob.serviceConfig.solutionVersionArn\",\"InputPath\":\"$.solutionVersionArn\",\"Next\":\"Set Batch Segment Job Input Data - Job Input\"},\"Set Batch Segment Job Input Data - Job Input\":{\"Type\":\"Pass\",\"ResultPath\":\"$.batchSegmentJob.serviceConfig.jobInput\",\"Parameters\":{\"s3DataSource\":{\"path.$\":\"States.Format('s3://{}/batch/{}/{}/job_config.json', $.bucket.name, $.datasetGroupName, $.solution.serviceConfig.name)\"}},\"Next\":\"Set Batch Segment Job Input Data - Job Output\"},\"Set Batch Segment Job Input Data - Job Output\":{\"Type\":\"Pass\",\"ResultPath\":\"$.batchSegmentJob.serviceConfig.jobOutput\",\"Parameters\":{\"s3DataDestination\":{\"path.$\":\"States.Format('s3://{}/batch/{}/{}/{}/', $.bucket.name, $.datasetGroupName, $.solution.serviceConfig.name, $.batchSegmentJobName)\"}},\"Next\":\"Create Batch Segment Job\"},\"Create Batch Segment Job\":{\"End\":true,\"Retry\":[{\"ErrorEquals\":[\"Lambda.ServiceException\",\"Lambda.AWSLambdaException\",\"Lambda.SdkClientException\"],\"IntervalSeconds\":2,\"MaxAttempts\":6,\"BackoffRate\":2},{\"ErrorEquals\":[\"ResourcePending\"],\"IntervalSeconds\":60,\"MaxAttempts\":100,\"BackoffRate\":1.02}],\"Type\":\"Task\",\"InputPath\":\"$.batchSegmentJob\",\"OutputPath\":\"$\",\"ResultPath\":\"$.batchSegmentJob.serviceConfig\",\"Resource\":\"", { "Fn::GetAtt": [ "CreateBatchSegmentJobSolutionStepcreatebatchsegmentjobfn01ACE97D", "Arn" ] }, "\"}}},\"ItemsPath\":\"$.solution.batchSegmentJobs\"}}}]}}},\"ItemsPath\":\"$.solutions\"}}},{\"StartAt\":\"Check for Recommenders\",\"States\":{\"Check for Recommenders\":{\"Type\":\"Choice\",\"Choices\":[{\"Variable\":\"$.recommenders[0]\",\"IsPresent\":true,\"Next\":\"Create Recommenders\"}],\"Default\":\"Recommenders not Provided\"},\"Recommenders not Provided\":{\"Type\":\"Pass\",\"End\":true},\"Create Recommenders\":{\"Type\":\"Map\",\"ResultPath\":null,\"End\":true,\"Parameters\":{\"datasetGroupArn.$\":\"$.datasetGroup.serviceConfig.datasetGroupArn\",\"datasetGroupName.$\":\"$.datasetGroup.serviceConfig.name\",\"recommender.$\":\"$$.Map.Item.Value\",\"bucket.$\":\"$.bucket\",\"currentDate.$\":\"$.currentDate\"},\"Iterator\":{\"StartAt\":\"Prepare Recommender Input Data\",\"States\":{\"Prepare Recommender Input Data\":{\"Type\":\"Pass\",\"ResultPath\":\"$.recommender.serviceConfig.datasetGroupArn\",\"InputPath\":\"$.datasetGroupArn\",\"Next\":\"Create Recommender\"},\"Create Recommender\":{\"End\":true,\"Retry\":[{\"ErrorEquals\":[\"Lambda.ServiceException\",\"Lambda.AWSLambdaException\",\"Lambda.SdkClientException\"],\"IntervalSeconds\":2,\"MaxAttempts\":6,\"BackoffRate\":2},{\"ErrorEquals\":[\"ResourcePending\"],\"IntervalSeconds\":60,\"MaxAttempts\":100,\"BackoffRate\":1.02}],\"Type\":\"Task\",\"InputPath\":\"$.recommender\",\"OutputPath\":\"$\",\"ResultPath\":\"$._tmp\",\"ResultSelector\":{\"recommenderArn.$\":\"$.recommenderArn\"},\"Resource\":\"", { "Fn::GetAtt": [ "CreateRecommenderSolutionStepcreaterecommenderfnF63FF7BD", "Arn" ] }, "\"}}},\"ItemsPath\":\"$.recommenders\"}}}]}}}]},\"Success\":{\"End\":true,\"Retry\":[{\"ErrorEquals\":[\"Lambda.ServiceException\",\"Lambda.AWSLambdaException\",\"Lambda.SdkClientException\"],\"IntervalSeconds\":2,\"MaxAttempts\":6,\"BackoffRate\":2},{\"ErrorEquals\":[\"ResourcePending\"],\"IntervalSeconds\":5,\"MaxAttempts\":5,\"BackoffRate\":1.05}],\"Type\":\"Task\",\"InputPath\":\"$\",\"OutputPath\":\"$\",\"ResultPath\":\"$\",\"Resource\":\"", { "Fn::GetAtt": [ "SNSNotificationSolutionStepsnsnotificationfn6973DEFB", "Arn" ] }, "\",\"Parameters\":{\"datasetGroup.$\":\"$[0].datasetGroup.serviceConfig.name\"}},\"Send Failure Message\":{\"Next\":\"Failure\",\"Retry\":[{\"ErrorEquals\":[\"Lambda.ServiceException\",\"Lambda.AWSLambdaException\",\"Lambda.SdkClientException\"],\"IntervalSeconds\":2,\"MaxAttempts\":6,\"BackoffRate\":2},{\"ErrorEquals\":[\"ResourcePending\"],\"IntervalSeconds\":5,\"MaxAttempts\":5,\"BackoffRate\":1.05}],\"Type\":\"Task\",\"InputPath\":\"$\",\"OutputPath\":\"$\",\"ResultPath\":\"$\",\"Resource\":\"", { "Fn::GetAtt": [ "SNSNotificationSolutionStepsnsnotificationfn6973DEFB", "Arn" ] }, "\",\"Parameters\":{\"datasetGroup.$\":\"$.datasetGroup.serviceConfig.name\",\"statesError.$\":\"$.statesError\"}},\"Failure\":{\"Type\":\"Fail\"}}}" ] ] }, "RoleArn": { "Fn::GetAtt": [ "ScheduledSolutionMaintenancePeriodicSolutionMaintenanceRoleBB209E6E", "Arn" ] }, "StateMachineName": { "Fn::GetAtt": [ "ScheduledSolutionMaintenanceStateMachineNameStateMachineNameNameResource93326218", "Name" ] }, "Tags": [ { "Key": "SOLUTION_ID", "Value": "SO0170" }, { "Key": "SOLUTION_NAME", "Value": "maintaining-personalized-experiences-with-machine-learning" }, { "Key": "SOLUTION_VERSION", "Value": "v1.5.0" } ], "TracingConfiguration": { "Enabled": true } }, "DependsOn": [ "ScheduledSolutionMaintenancePeriodicSolutionMaintenanceRoleDefaultPolicyAF675022", "ScheduledSolutionMaintenancePeriodicSolutionMaintenanceRoleBB209E6E" ], "UpdateReplacePolicy": "Delete", "DeletionPolicy": "Delete", "Metadata": { "cdk_nag": { "rules_to_suppress": [ { "reason": "Information required for troubleshooting is logged by state function and lambda functions", "id": "AwsSolutions-SF1" }, { "reason": "All IAM policies defined in this solutiongrant only least-privilege permissions. Wildcard for resources is used only for serviceswhich do not have a resource arn", "id": "AwsSolutions-IAM5" }, { "reason": "We use AWS managed policies and do not need tochange as the \"*\" in resource is due to circular dependency.", "id": "AwsSolutions-IAM4" } ] } } }, "SchedulerSchedulerStateMachineNameSchedulerStateMachineNameNameResource958C6532": { "Type": "Custom::ResourceName", "Properties": { "ServiceToken": { "Fn::GetAtt": [ "ResourceNameFunctiond45b185afe3444aba37517f89597d9ec4F793A21", "Arn" ] }, "Purpose": "personalize-scheduler", "StackName": { "Ref": "AWS::StackName" }, "MaxLength": 80 } }, "SchedulercreatescheduledtaskSolutionStepcreatescheduledtaskfnRole34D2C4CB": { "Type": "AWS::IAM::Role", "Properties": { "AssumeRolePolicyDocument": { "Statement": [ { "Action": "sts:AssumeRole", "Effect": "Allow", "Principal": { "Service": "lambda.amazonaws.com" } } ], "Version": "2012-10-17" }, "Policies": [ { "PolicyDocument": { "Statement": [ { "Action": [ "logs:CreateLogGroup", "logs:CreateLogStream", "logs:PutLogEvents" ], "Effect": "Allow", "Resource": { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":logs:", { "Ref": "AWS::Region" }, ":", { "Ref": "AWS::AccountId" }, ":log-group:/aws/lambda/*" ] ] } } ], "Version": "2012-10-17" }, "PolicyName": "LambdaFunctionServiceRolePolicy" } ], "Tags": [ { "Key": "SOLUTION_ID", "Value": "SO0170" }, { "Key": "SOLUTION_NAME", "Value": "maintaining-personalized-experiences-with-machine-learning" }, { "Key": "SOLUTION_VERSION", "Value": "v1.5.0" } ] }, "Metadata": { "guard": { "SuppressedRules": [ "IAM_NO_INLINE_POLICY_CHECK" ] }, "cdk_nag": { "rules_to_suppress": [ { "reason": "All IAM policies defined in this solutiongrant only least-privilege permissions. Wildcard for resources is used only for serviceswhich do not have a resource arn", "id": "AwsSolutions-IAM5" }, { "reason": "We use AWS managed policies and do not need tochange as the \"*\" in resource is due to circular dependency.", "id": "AwsSolutions-IAM4" } ] } } }, "SchedulercreatescheduledtaskSolutionStepcreatescheduledtaskfnRoleDefaultPolicyB60166B5": { "Type": "AWS::IAM::Policy", "Properties": { "PolicyDocument": { "Statement": [ { "Action": [ "xray:PutTraceSegments", "xray:PutTelemetryRecords" ], "Effect": "Allow", "Resource": "*" }, { "Action": [ "states:StartExecution", "states:ListExecutions", "states:StopExecution", "states:DescribeExecution" ], "Effect": "Allow", "Resource": [ { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":states:", { "Ref": "AWS::Region" }, ":", { "Ref": "AWS::AccountId" }, ":stateMachine:", { "Fn::GetAtt": [ "SchedulerSchedulerStateMachineNameSchedulerStateMachineNameNameResource958C6532", "Name" ] } ] ] }, { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":states:", { "Ref": "AWS::Region" }, ":", { "Ref": "AWS::AccountId" }, ":execution:", { "Fn::GetAtt": [ "SchedulerSchedulerStateMachineNameSchedulerStateMachineNameNameResource958C6532", "Name" ] }, ":*" ] ] } ] }, { "Action": [ "dynamodb:BatchGetItem", "dynamodb:GetRecords", "dynamodb:GetShardIterator", "dynamodb:Query", "dynamodb:GetItem", "dynamodb:Scan", "dynamodb:ConditionCheckItem", "dynamodb:BatchWriteItem", "dynamodb:PutItem", "dynamodb:UpdateItem", "dynamodb:DeleteItem", "dynamodb:DescribeTable" ], "Effect": "Allow", "Resource": [ { "Fn::GetAtt": [ "PersonalizeScheduledTasks", "Arn" ] }, { "Ref": "AWS::NoValue" } ] } ], "Version": "2012-10-17" }, "PolicyName": "SchedulercreatescheduledtaskSolutionStepcreatescheduledtaskfnRoleDefaultPolicyB60166B5", "Roles": [ { "Ref": "SchedulercreatescheduledtaskSolutionStepcreatescheduledtaskfnRole34D2C4CB" } ] }, "Metadata": { "cfn_nag": { "rules_to_suppress": [ { "id": "W12", "reason": "IAM policy for AWS X-Ray requires an allow on *" } ] }, "cdk_nag": { "rules_to_suppress": [ { "reason": "All IAM policies defined in this solutiongrant only least-privilege permissions. Wildcard for resources is used only for serviceswhich do not have a resource arn", "id": "AwsSolutions-IAM5" }, { "reason": "We use AWS managed policies and do not need tochange as the \"*\" in resource is due to circular dependency.", "id": "AwsSolutions-IAM4" } ] } } }, "SchedulercreatescheduledtaskSolutionStepcreatescheduledtaskfn7FCB3878": { "Type": "AWS::Lambda::Function", "Properties": { "Code": { "S3Bucket": { "Fn::Join": [ "-", [ { "Fn::FindInMap": [ "SourceCode", "General", "S3Bucket" ] }, { "Ref": "AWS::Region" } ] ] }, "S3Key": { "Fn::Join": [ "/", [ { "Fn::FindInMap": [ "SourceCode", "General", "KeyPrefix" ] }, "SchedulercreatescheduledtaskSolutionStepcreatescheduledtaskfn7FCB3878.zip" ] ] } }, "Environment": { "Variables": { "DDB_SCHEDULER_STEPFUNCTION": { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":states:", { "Ref": "AWS::Region" }, ":", { "Ref": "AWS::AccountId" }, ":stateMachine:", { "Fn::GetAtt": [ "SchedulerSchedulerStateMachineNameSchedulerStateMachineNameNameResource958C6532", "Name" ] } ] ] }, "DDB_SCHEDULES_TABLE": { "Ref": "PersonalizeScheduledTasks" }, "SOLUTION_NAME": "maintaining-personalized-experiences-with-machine-learning", "SOLUTION_ID": "SO0170", "SOLUTION_VERSION": "v1.5.0", "LOG_LEVEL": "INFO", "POWERTOOLS_SERVICE_NAME": "Workflow", "POWERTOOLS_METRICS_NAMESPACE": { "Fn::Join": [ "", [ "personalize_solution_", { "Ref": "AWS::StackName" } ] ] } } }, "Handler": "handler.create_schedule", "Layers": [ { "Ref": "PowertoolsLayer8E932F0F197D4026A35423D184C2A624D967C184" } ], "Role": { "Fn::GetAtt": [ "SchedulercreatescheduledtaskSolutionStepcreatescheduledtaskfnRole34D2C4CB", "Arn" ] }, "Runtime": "python3.11", "Tags": [ { "Key": "SOLUTION_ID", "Value": "SO0170" }, { "Key": "SOLUTION_NAME", "Value": "maintaining-personalized-experiences-with-machine-learning" }, { "Key": "SOLUTION_VERSION", "Value": "v1.5.0" } ], "Timeout": 15, "TracingConfig": { "Mode": "Active" } }, "DependsOn": [ "SchedulercreatescheduledtaskSolutionStepcreatescheduledtaskfnRoleDefaultPolicyB60166B5", "SchedulercreatescheduledtaskSolutionStepcreatescheduledtaskfnRole34D2C4CB" ], "Metadata": { "cdk_nag": { "rules_to_suppress": [ { "reason": "All IAM policies defined in this solutiongrant only least-privilege permissions. Wildcard for resources is used only for serviceswhich do not have a resource arn", "id": "AwsSolutions-IAM5" }, { "reason": "We use AWS managed policies and do not need tochange as the \"*\" in resource is due to circular dependency.", "id": "AwsSolutions-IAM4" } ] }, "cfn_nag": { "rules_to_suppress": [ { "id": "W89", "reason": "functions deployed by this solution do not require VPC access" }, { "id": "W92", "reason": "functions deployed by this solution do not require reserved concurrency" }, { "id": "W58", "reason": "functions deployed by this solution use custom policy to write to CloudWatch logs" } ] } } }, "SchedulerreadscheduledtaskSolutionStepreadscheduledtaskfnRole4CEBAB3C": { "Type": "AWS::IAM::Role", "Properties": { "AssumeRolePolicyDocument": { "Statement": [ { "Action": "sts:AssumeRole", "Effect": "Allow", "Principal": { "Service": "lambda.amazonaws.com" } } ], "Version": "2012-10-17" }, "Policies": [ { "PolicyDocument": { "Statement": [ { "Action": [ "logs:CreateLogGroup", "logs:CreateLogStream", "logs:PutLogEvents" ], "Effect": "Allow", "Resource": { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":logs:", { "Ref": "AWS::Region" }, ":", { "Ref": "AWS::AccountId" }, ":log-group:/aws/lambda/*" ] ] } } ], "Version": "2012-10-17" }, "PolicyName": "LambdaFunctionServiceRolePolicy" } ], "Tags": [ { "Key": "SOLUTION_ID", "Value": "SO0170" }, { "Key": "SOLUTION_NAME", "Value": "maintaining-personalized-experiences-with-machine-learning" }, { "Key": "SOLUTION_VERSION", "Value": "v1.5.0" } ] }, "Metadata": { "guard": { "SuppressedRules": [ "IAM_NO_INLINE_POLICY_CHECK" ] }, "cdk_nag": { "rules_to_suppress": [ { "reason": "All IAM policies defined in this solutiongrant only least-privilege permissions. Wildcard for resources is used only for serviceswhich do not have a resource arn", "id": "AwsSolutions-IAM5" }, { "reason": "We use AWS managed policies and do not need tochange as the \"*\" in resource is due to circular dependency.", "id": "AwsSolutions-IAM4" } ] } } }, "SchedulerreadscheduledtaskSolutionStepreadscheduledtaskfnRoleDefaultPolicyD3C1A045": { "Type": "AWS::IAM::Policy", "Properties": { "PolicyDocument": { "Statement": [ { "Action": [ "xray:PutTraceSegments", "xray:PutTelemetryRecords" ], "Effect": "Allow", "Resource": "*" }, { "Action": "states:StartExecution", "Effect": "Allow", "Resource": { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":states:", { "Ref": "AWS::Region" }, ":", { "Ref": "AWS::AccountId" }, ":stateMachine:", { "Fn::GetAtt": [ "SchedulerSchedulerStateMachineNameSchedulerStateMachineNameNameResource958C6532", "Name" ] } ] ] } }, { "Action": [ "dynamodb:BatchGetItem", "dynamodb:GetRecords", "dynamodb:GetShardIterator", "dynamodb:Query", "dynamodb:GetItem", "dynamodb:Scan", "dynamodb:ConditionCheckItem", "dynamodb:DescribeTable" ], "Effect": "Allow", "Resource": [ { "Fn::GetAtt": [ "PersonalizeScheduledTasks", "Arn" ] }, { "Ref": "AWS::NoValue" } ] } ], "Version": "2012-10-17" }, "PolicyName": "SchedulerreadscheduledtaskSolutionStepreadscheduledtaskfnRoleDefaultPolicyD3C1A045", "Roles": [ { "Ref": "SchedulerreadscheduledtaskSolutionStepreadscheduledtaskfnRole4CEBAB3C" } ] }, "Metadata": { "cfn_nag": { "rules_to_suppress": [ { "id": "W12", "reason": "IAM policy for AWS X-Ray requires an allow on *" } ] }, "cdk_nag": { "rules_to_suppress": [ { "reason": "All IAM policies defined in this solutiongrant only least-privilege permissions. Wildcard for resources is used only for serviceswhich do not have a resource arn", "id": "AwsSolutions-IAM5" }, { "reason": "We use AWS managed policies and do not need tochange as the \"*\" in resource is due to circular dependency.", "id": "AwsSolutions-IAM4" } ] } } }, "SchedulerreadscheduledtaskSolutionStepreadscheduledtaskfn98E8735D": { "Type": "AWS::Lambda::Function", "Properties": { "Code": { "S3Bucket": { "Fn::Join": [ "-", [ { "Fn::FindInMap": [ "SourceCode", "General", "S3Bucket" ] }, { "Ref": "AWS::Region" } ] ] }, "S3Key": { "Fn::Join": [ "/", [ { "Fn::FindInMap": [ "SourceCode", "General", "KeyPrefix" ] }, "SchedulerreadscheduledtaskSolutionStepreadscheduledtaskfn98E8735D.zip" ] ] } }, "Environment": { "Variables": { "DDB_SCHEDULER_STEPFUNCTION": { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":states:", { "Ref": "AWS::Region" }, ":", { "Ref": "AWS::AccountId" }, ":stateMachine:", { "Fn::GetAtt": [ "SchedulerSchedulerStateMachineNameSchedulerStateMachineNameNameResource958C6532", "Name" ] } ] ] }, "DDB_SCHEDULES_TABLE": { "Ref": "PersonalizeScheduledTasks" }, "SOLUTION_NAME": "maintaining-personalized-experiences-with-machine-learning", "SOLUTION_ID": "SO0170", "SOLUTION_VERSION": "v1.5.0", "LOG_LEVEL": "INFO", "POWERTOOLS_SERVICE_NAME": "Workflow", "POWERTOOLS_METRICS_NAMESPACE": { "Fn::Join": [ "", [ "personalize_solution_", { "Ref": "AWS::StackName" } ] ] } } }, "Handler": "handler.read_schedule", "Layers": [ { "Ref": "PowertoolsLayer8E932F0F197D4026A35423D184C2A624D967C184" } ], "Role": { "Fn::GetAtt": [ "SchedulerreadscheduledtaskSolutionStepreadscheduledtaskfnRole4CEBAB3C", "Arn" ] }, "Runtime": "python3.11", "Tags": [ { "Key": "SOLUTION_ID", "Value": "SO0170" }, { "Key": "SOLUTION_NAME", "Value": "maintaining-personalized-experiences-with-machine-learning" }, { "Key": "SOLUTION_VERSION", "Value": "v1.5.0" } ], "Timeout": 15, "TracingConfig": { "Mode": "Active" } }, "DependsOn": [ "SchedulerreadscheduledtaskSolutionStepreadscheduledtaskfnRoleDefaultPolicyD3C1A045", "SchedulerreadscheduledtaskSolutionStepreadscheduledtaskfnRole4CEBAB3C" ], "Metadata": { "cdk_nag": { "rules_to_suppress": [ { "reason": "All IAM policies defined in this solutiongrant only least-privilege permissions. Wildcard for resources is used only for serviceswhich do not have a resource arn", "id": "AwsSolutions-IAM5" }, { "reason": "We use AWS managed policies and do not need tochange as the \"*\" in resource is due to circular dependency.", "id": "AwsSolutions-IAM4" } ] }, "cfn_nag": { "rules_to_suppress": [ { "id": "W89", "reason": "functions deployed by this solution do not require VPC access" }, { "id": "W92", "reason": "functions deployed by this solution do not require reserved concurrency" }, { "id": "W58", "reason": "functions deployed by this solution use custom policy to write to CloudWatch logs" } ] } } }, "SchedulerupdatescheduledtaskSolutionStepupdatescheduledtaskfnRole3FA34844": { "Type": "AWS::IAM::Role", "Properties": { "AssumeRolePolicyDocument": { "Statement": [ { "Action": "sts:AssumeRole", "Effect": "Allow", "Principal": { "Service": "lambda.amazonaws.com" } } ], "Version": "2012-10-17" }, "Policies": [ { "PolicyDocument": { "Statement": [ { "Action": [ "logs:CreateLogGroup", "logs:CreateLogStream", "logs:PutLogEvents" ], "Effect": "Allow", "Resource": { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":logs:", { "Ref": "AWS::Region" }, ":", { "Ref": "AWS::AccountId" }, ":log-group:/aws/lambda/*" ] ] } } ], "Version": "2012-10-17" }, "PolicyName": "LambdaFunctionServiceRolePolicy" } ], "Tags": [ { "Key": "SOLUTION_ID", "Value": "SO0170" }, { "Key": "SOLUTION_NAME", "Value": "maintaining-personalized-experiences-with-machine-learning" }, { "Key": "SOLUTION_VERSION", "Value": "v1.5.0" } ] }, "Metadata": { "guard": { "SuppressedRules": [ "IAM_NO_INLINE_POLICY_CHECK" ] }, "cdk_nag": { "rules_to_suppress": [ { "reason": "All IAM policies defined in this solutiongrant only least-privilege permissions. Wildcard for resources is used only for serviceswhich do not have a resource arn", "id": "AwsSolutions-IAM5" }, { "reason": "We use AWS managed policies and do not need tochange as the \"*\" in resource is due to circular dependency.", "id": "AwsSolutions-IAM4" } ] } } }, "SchedulerupdatescheduledtaskSolutionStepupdatescheduledtaskfnRoleDefaultPolicy9FB6244F": { "Type": "AWS::IAM::Policy", "Properties": { "PolicyDocument": { "Statement": [ { "Action": [ "xray:PutTraceSegments", "xray:PutTelemetryRecords" ], "Effect": "Allow", "Resource": "*" }, { "Action": [ "states:StartExecution", "states:ListExecutions", "states:StopExecution", "states:DescribeExecution" ], "Effect": "Allow", "Resource": [ { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":states:", { "Ref": "AWS::Region" }, ":", { "Ref": "AWS::AccountId" }, ":stateMachine:", { "Fn::GetAtt": [ "SchedulerSchedulerStateMachineNameSchedulerStateMachineNameNameResource958C6532", "Name" ] } ] ] }, { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":states:", { "Ref": "AWS::Region" }, ":", { "Ref": "AWS::AccountId" }, ":execution:", { "Fn::GetAtt": [ "SchedulerSchedulerStateMachineNameSchedulerStateMachineNameNameResource958C6532", "Name" ] }, ":*" ] ] } ] }, { "Action": [ "dynamodb:BatchGetItem", "dynamodb:GetRecords", "dynamodb:GetShardIterator", "dynamodb:Query", "dynamodb:GetItem", "dynamodb:Scan", "dynamodb:ConditionCheckItem", "dynamodb:BatchWriteItem", "dynamodb:PutItem", "dynamodb:UpdateItem", "dynamodb:DeleteItem", "dynamodb:DescribeTable" ], "Effect": "Allow", "Resource": [ { "Fn::GetAtt": [ "PersonalizeScheduledTasks", "Arn" ] }, { "Ref": "AWS::NoValue" } ] } ], "Version": "2012-10-17" }, "PolicyName": "SchedulerupdatescheduledtaskSolutionStepupdatescheduledtaskfnRoleDefaultPolicy9FB6244F", "Roles": [ { "Ref": "SchedulerupdatescheduledtaskSolutionStepupdatescheduledtaskfnRole3FA34844" } ] }, "Metadata": { "cfn_nag": { "rules_to_suppress": [ { "id": "W12", "reason": "IAM policy for AWS X-Ray requires an allow on *" } ] }, "cdk_nag": { "rules_to_suppress": [ { "reason": "All IAM policies defined in this solutiongrant only least-privilege permissions. Wildcard for resources is used only for serviceswhich do not have a resource arn", "id": "AwsSolutions-IAM5" }, { "reason": "We use AWS managed policies and do not need tochange as the \"*\" in resource is due to circular dependency.", "id": "AwsSolutions-IAM4" } ] } } }, "SchedulerupdatescheduledtaskSolutionStepupdatescheduledtaskfnB0D5DE79": { "Type": "AWS::Lambda::Function", "Properties": { "Code": { "S3Bucket": { "Fn::Join": [ "-", [ { "Fn::FindInMap": [ "SourceCode", "General", "S3Bucket" ] }, { "Ref": "AWS::Region" } ] ] }, "S3Key": { "Fn::Join": [ "/", [ { "Fn::FindInMap": [ "SourceCode", "General", "KeyPrefix" ] }, "SchedulerupdatescheduledtaskSolutionStepupdatescheduledtaskfnB0D5DE79.zip" ] ] } }, "Environment": { "Variables": { "DDB_SCHEDULER_STEPFUNCTION": { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":states:", { "Ref": "AWS::Region" }, ":", { "Ref": "AWS::AccountId" }, ":stateMachine:", { "Fn::GetAtt": [ "SchedulerSchedulerStateMachineNameSchedulerStateMachineNameNameResource958C6532", "Name" ] } ] ] }, "DDB_SCHEDULES_TABLE": { "Ref": "PersonalizeScheduledTasks" }, "SOLUTION_NAME": "maintaining-personalized-experiences-with-machine-learning", "SOLUTION_ID": "SO0170", "SOLUTION_VERSION": "v1.5.0", "LOG_LEVEL": "INFO", "POWERTOOLS_SERVICE_NAME": "Workflow", "POWERTOOLS_METRICS_NAMESPACE": { "Fn::Join": [ "", [ "personalize_solution_", { "Ref": "AWS::StackName" } ] ] } } }, "Handler": "handler.update_schedule", "Layers": [ { "Ref": "PowertoolsLayer8E932F0F197D4026A35423D184C2A624D967C184" } ], "Role": { "Fn::GetAtt": [ "SchedulerupdatescheduledtaskSolutionStepupdatescheduledtaskfnRole3FA34844", "Arn" ] }, "Runtime": "python3.11", "Tags": [ { "Key": "SOLUTION_ID", "Value": "SO0170" }, { "Key": "SOLUTION_NAME", "Value": "maintaining-personalized-experiences-with-machine-learning" }, { "Key": "SOLUTION_VERSION", "Value": "v1.5.0" } ], "Timeout": 15, "TracingConfig": { "Mode": "Active" } }, "DependsOn": [ "SchedulerupdatescheduledtaskSolutionStepupdatescheduledtaskfnRoleDefaultPolicy9FB6244F", "SchedulerupdatescheduledtaskSolutionStepupdatescheduledtaskfnRole3FA34844" ], "Metadata": { "cdk_nag": { "rules_to_suppress": [ { "reason": "All IAM policies defined in this solutiongrant only least-privilege permissions. Wildcard for resources is used only for serviceswhich do not have a resource arn", "id": "AwsSolutions-IAM5" }, { "reason": "We use AWS managed policies and do not need tochange as the \"*\" in resource is due to circular dependency.", "id": "AwsSolutions-IAM4" } ] }, "cfn_nag": { "rules_to_suppress": [ { "id": "W89", "reason": "functions deployed by this solution do not require VPC access" }, { "id": "W92", "reason": "functions deployed by this solution do not require reserved concurrency" }, { "id": "W58", "reason": "functions deployed by this solution use custom policy to write to CloudWatch logs" } ] } } }, "SchedulerdeletescheduledtaskSolutionStepdeletescheduledtaskfnRole89540B14": { "Type": "AWS::IAM::Role", "Properties": { "AssumeRolePolicyDocument": { "Statement": [ { "Action": "sts:AssumeRole", "Effect": "Allow", "Principal": { "Service": "lambda.amazonaws.com" } } ], "Version": "2012-10-17" }, "Policies": [ { "PolicyDocument": { "Statement": [ { "Action": [ "logs:CreateLogGroup", "logs:CreateLogStream", "logs:PutLogEvents" ], "Effect": "Allow", "Resource": { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":logs:", { "Ref": "AWS::Region" }, ":", { "Ref": "AWS::AccountId" }, ":log-group:/aws/lambda/*" ] ] } } ], "Version": "2012-10-17" }, "PolicyName": "LambdaFunctionServiceRolePolicy" } ], "Tags": [ { "Key": "SOLUTION_ID", "Value": "SO0170" }, { "Key": "SOLUTION_NAME", "Value": "maintaining-personalized-experiences-with-machine-learning" }, { "Key": "SOLUTION_VERSION", "Value": "v1.5.0" } ] }, "Metadata": { "guard": { "SuppressedRules": [ "IAM_NO_INLINE_POLICY_CHECK" ] }, "cdk_nag": { "rules_to_suppress": [ { "reason": "All IAM policies defined in this solutiongrant only least-privilege permissions. Wildcard for resources is used only for serviceswhich do not have a resource arn", "id": "AwsSolutions-IAM5" }, { "reason": "We use AWS managed policies and do not need tochange as the \"*\" in resource is due to circular dependency.", "id": "AwsSolutions-IAM4" } ] } } }, "SchedulerdeletescheduledtaskSolutionStepdeletescheduledtaskfnRoleDefaultPolicy9BCCB485": { "Type": "AWS::IAM::Policy", "Properties": { "PolicyDocument": { "Statement": [ { "Action": [ "xray:PutTraceSegments", "xray:PutTelemetryRecords" ], "Effect": "Allow", "Resource": "*" }, { "Action": "states:StartExecution", "Effect": "Allow", "Resource": { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":states:", { "Ref": "AWS::Region" }, ":", { "Ref": "AWS::AccountId" }, ":stateMachine:", { "Fn::GetAtt": [ "SchedulerSchedulerStateMachineNameSchedulerStateMachineNameNameResource958C6532", "Name" ] } ] ] } }, { "Action": [ "dynamodb:BatchGetItem", "dynamodb:GetRecords", "dynamodb:GetShardIterator", "dynamodb:Query", "dynamodb:GetItem", "dynamodb:Scan", "dynamodb:ConditionCheckItem", "dynamodb:BatchWriteItem", "dynamodb:PutItem", "dynamodb:UpdateItem", "dynamodb:DeleteItem", "dynamodb:DescribeTable" ], "Effect": "Allow", "Resource": [ { "Fn::GetAtt": [ "PersonalizeScheduledTasks", "Arn" ] }, { "Ref": "AWS::NoValue" } ] } ], "Version": "2012-10-17" }, "PolicyName": "SchedulerdeletescheduledtaskSolutionStepdeletescheduledtaskfnRoleDefaultPolicy9BCCB485", "Roles": [ { "Ref": "SchedulerdeletescheduledtaskSolutionStepdeletescheduledtaskfnRole89540B14" } ] }, "Metadata": { "cfn_nag": { "rules_to_suppress": [ { "id": "W12", "reason": "IAM policy for AWS X-Ray requires an allow on *" } ] }, "cdk_nag": { "rules_to_suppress": [ { "reason": "All IAM policies defined in this solutiongrant only least-privilege permissions. Wildcard for resources is used only for serviceswhich do not have a resource arn", "id": "AwsSolutions-IAM5" }, { "reason": "We use AWS managed policies and do not need tochange as the \"*\" in resource is due to circular dependency.", "id": "AwsSolutions-IAM4" } ] } } }, "SchedulerdeletescheduledtaskSolutionStepdeletescheduledtaskfn273DB192": { "Type": "AWS::Lambda::Function", "Properties": { "Code": { "S3Bucket": { "Fn::Join": [ "-", [ { "Fn::FindInMap": [ "SourceCode", "General", "S3Bucket" ] }, { "Ref": "AWS::Region" } ] ] }, "S3Key": { "Fn::Join": [ "/", [ { "Fn::FindInMap": [ "SourceCode", "General", "KeyPrefix" ] }, "SchedulerdeletescheduledtaskSolutionStepdeletescheduledtaskfn273DB192.zip" ] ] } }, "Environment": { "Variables": { "DDB_SCHEDULER_STEPFUNCTION": { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":states:", { "Ref": "AWS::Region" }, ":", { "Ref": "AWS::AccountId" }, ":stateMachine:", { "Fn::GetAtt": [ "SchedulerSchedulerStateMachineNameSchedulerStateMachineNameNameResource958C6532", "Name" ] } ] ] }, "DDB_SCHEDULES_TABLE": { "Ref": "PersonalizeScheduledTasks" }, "SOLUTION_NAME": "maintaining-personalized-experiences-with-machine-learning", "SOLUTION_ID": "SO0170", "SOLUTION_VERSION": "v1.5.0", "LOG_LEVEL": "INFO", "POWERTOOLS_SERVICE_NAME": "Workflow", "POWERTOOLS_METRICS_NAMESPACE": { "Fn::Join": [ "", [ "personalize_solution_", { "Ref": "AWS::StackName" } ] ] } } }, "Handler": "handler.delete_schedule", "Layers": [ { "Ref": "PowertoolsLayer8E932F0F197D4026A35423D184C2A624D967C184" } ], "Role": { "Fn::GetAtt": [ "SchedulerdeletescheduledtaskSolutionStepdeletescheduledtaskfnRole89540B14", "Arn" ] }, "Runtime": "python3.11", "Tags": [ { "Key": "SOLUTION_ID", "Value": "SO0170" }, { "Key": "SOLUTION_NAME", "Value": "maintaining-personalized-experiences-with-machine-learning" }, { "Key": "SOLUTION_VERSION", "Value": "v1.5.0" } ], "Timeout": 15, "TracingConfig": { "Mode": "Active" } }, "DependsOn": [ "SchedulerdeletescheduledtaskSolutionStepdeletescheduledtaskfnRoleDefaultPolicy9BCCB485", "SchedulerdeletescheduledtaskSolutionStepdeletescheduledtaskfnRole89540B14" ], "Metadata": { "cdk_nag": { "rules_to_suppress": [ { "reason": "All IAM policies defined in this solutiongrant only least-privilege permissions. Wildcard for resources is used only for serviceswhich do not have a resource arn", "id": "AwsSolutions-IAM5" }, { "reason": "We use AWS managed policies and do not need tochange as the \"*\" in resource is due to circular dependency.", "id": "AwsSolutions-IAM4" } ] }, "cfn_nag": { "rules_to_suppress": [ { "id": "W89", "reason": "functions deployed by this solution do not require VPC access" }, { "id": "W92", "reason": "functions deployed by this solution do not require reserved concurrency" }, { "id": "W58", "reason": "functions deployed by this solution use custom policy to write to CloudWatch logs" } ] } } }, "SchedulerSchedulerStateMachineRoleEDC22AEC": { "Type": "AWS::IAM::Role", "Properties": { "AssumeRolePolicyDocument": { "Statement": [ { "Action": "sts:AssumeRole", "Effect": "Allow", "Principal": { "Service": { "Fn::FindInMap": [ "ServiceprincipalMap", { "Ref": "AWS::Region" }, "states" ] } } } ], "Version": "2012-10-17" }, "Tags": [ { "Key": "SOLUTION_ID", "Value": "SO0170" }, { "Key": "SOLUTION_NAME", "Value": "maintaining-personalized-experiences-with-machine-learning" }, { "Key": "SOLUTION_VERSION", "Value": "v1.5.0" } ] }, "Metadata": { "cdk_nag": { "rules_to_suppress": [ { "reason": "All IAM policies defined in this solutiongrant only least-privilege permissions. Wildcard for resources is used only for serviceswhich do not have a resource arn", "id": "AwsSolutions-IAM5" }, { "reason": "We use AWS managed policies and do not need tochange as the \"*\" in resource is due to circular dependency.", "id": "AwsSolutions-IAM4" } ] } } }, "SchedulerSchedulerStateMachineRoleDefaultPolicy8CC45CD8": { "Type": "AWS::IAM::Policy", "Properties": { "PolicyDocument": { "Statement": [ { "Action": [ "xray:PutTraceSegments", "xray:PutTelemetryRecords", "xray:GetSamplingRules", "xray:GetSamplingTargets" ], "Effect": "Allow", "Resource": "*" }, { "Action": "lambda:InvokeFunction", "Effect": "Allow", "Resource": [ { "Fn::GetAtt": [ "SchedulerreadscheduledtaskSolutionStepreadscheduledtaskfn98E8735D", "Arn" ] }, { "Fn::Join": [ "", [ { "Fn::GetAtt": [ "SchedulerreadscheduledtaskSolutionStepreadscheduledtaskfn98E8735D", "Arn" ] }, ":*" ] ] } ] }, { "Action": "lambda:InvokeFunction", "Effect": "Allow", "Resource": [ { "Fn::GetAtt": [ "GetNextTimestamp3AB5D155", "Arn" ] }, { "Fn::Join": [ "", [ { "Fn::GetAtt": [ "GetNextTimestamp3AB5D155", "Arn" ] }, ":*" ] ] } ] }, { "Action": "states:StartExecution", "Effect": "Allow", "Resource": { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":states:", { "Ref": "AWS::Region" }, ":", { "Ref": "AWS::AccountId" }, ":stateMachine:", { "Fn::GetAtt": [ "SchedulerSchedulerStateMachineNameSchedulerStateMachineNameNameResource958C6532", "Name" ] } ] ] } }, { "Action": [ "states:DescribeExecution", "states:StopExecution" ], "Effect": "Allow", "Resource": { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":states:", { "Ref": "AWS::Region" }, ":", { "Ref": "AWS::AccountId" }, ":execution:", { "Fn::GetAtt": [ "SchedulerSchedulerStateMachineNameSchedulerStateMachineNameNameResource958C6532", "Name" ] }, ":*" ] ] } }, { "Action": [ "events:PutTargets", "events:PutRule", "events:DescribeRule" ], "Effect": "Allow", "Resource": { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":events:", { "Ref": "AWS::Region" }, ":", { "Ref": "AWS::AccountId" }, ":rule/StepFunctionsGetEventsForStepFunctionsExecutionRule" ] ] } }, { "Action": "states:StartExecution", "Effect": "Allow", "Resource": { "Ref": "ScheduledDatasetImportPeriodicDatasetImport3830A3E8" } }, { "Action": "states:StartExecution", "Effect": "Allow", "Resource": { "Ref": "ScheduledSolutionMaintenancePeriodicSolutionMaintenance814E56C3" } } ], "Version": "2012-10-17" }, "PolicyName": "SchedulerSchedulerStateMachineRoleDefaultPolicy8CC45CD8", "Roles": [ { "Ref": "SchedulerSchedulerStateMachineRoleEDC22AEC" } ] }, "Metadata": { "cdk_nag": { "rules_to_suppress": [ { "reason": "All IAM policies defined in this solutiongrant only least-privilege permissions. Wildcard for resources is used only for serviceswhich do not have a resource arn", "id": "AwsSolutions-IAM5" }, { "reason": "We use AWS managed policies and do not need tochange as the \"*\" in resource is due to circular dependency.", "id": "AwsSolutions-IAM4" } ] }, "cfn_nag": { "rules_to_suppress": [ { "id": "W12", "reason": "IAM policy for nested synchronous invocation of step functions requires * on Describe and Stop Execution" }, { "id": "W76", "reason": "Large step functions need larger IAM roles to access all managed AWS Lambda functions" } ] } } }, "SchedulerSchedulerStateMachine2F63DF01": { "Type": "AWS::StepFunctions::StateMachine", "Properties": { "DefinitionString": { "Fn::Join": [ "", [ "{\"StartAt\":\"Load Scheduled Task\",\"States\":{\"Load Scheduled Task\":{\"Next\":\"Trigger Time Provided?\",\"Retry\":[{\"ErrorEquals\":[\"Lambda.ServiceException\",\"Lambda.AWSLambdaException\",\"Lambda.SdkClientException\"],\"IntervalSeconds\":2,\"MaxAttempts\":6,\"BackoffRate\":2},{\"ErrorEquals\":[\"ResourcePending\"],\"IntervalSeconds\":5,\"MaxAttempts\":5,\"BackoffRate\":1.05}],\"Type\":\"Task\",\"InputPath\":\"$\",\"OutputPath\":\"$\",\"ResultPath\":\"$.task\",\"Resource\":\"", { "Fn::GetAtt": [ "SchedulerreadscheduledtaskSolutionStepreadscheduledtaskfn98E8735D", "Arn" ] }, "\",\"Parameters\":{\"name.$\":\"$.name\"}},\"Trigger Time Provided?\":{\"Type\":\"Choice\",\"Choices\":[{\"Variable\":\"$.trigger_at\",\"IsPresent\":false,\"Next\":\"Get Trigger Time\"}],\"Default\":\"Wait Until Schedule Trigger\"},\"Wait Until Schedule Trigger\":{\"Type\":\"Wait\",\"TimestampPath\":\"$.trigger_at\",\"Next\":\"Invoke Step Function\"},\"Get Trigger Time\":{\"Next\":\"Wait Until Schedule Trigger\",\"Retry\":[{\"ErrorEquals\":[\"Lambda.ServiceException\",\"Lambda.AWSLambdaException\",\"Lambda.SdkClientException\"],\"IntervalSeconds\":2,\"MaxAttempts\":6,\"BackoffRate\":2}],\"Type\":\"Task\",\"ResultPath\":\"$.trigger_at\",\"Resource\":\"", { "Fn::GetAtt": [ "GetNextTimestamp3AB5D155", "Arn" ] }, "\",\"Parameters\":{\"schedule.$\":\"$.task.schedule\"}},\"Invoke Step Function\":{\"Next\":\"Get Next Trigger Time\",\"Type\":\"Task\",\"Resource\":\"arn:aws:states:::states:startExecution.sync:2\",\"Parameters\":{\"StateMachineArn.$\":\"$.task.state_machine.arn\",\"Input.$\":\"$.task.state_machine.input\",\"Name.$\":\"$.task.next_task_id\"},\"Retry\":[{\"ErrorEquals\":[\"StepFunctions.ExecutionLimitExceeded\"]}],\"ResultPath\":\"$.startExecutionResult\",\"ResultSelector\":{\"ExecutionArn.$\":\"$.ExecutionArn\"},\"Catch\":[{\"ErrorEquals\":[\"States.TaskFailed\"],\"Next\":\"Get Next Trigger Time\",\"ResultPath\":\"$.startExecutionResult\"}]},\"Get Next Trigger Time\":{\"Next\":\"Run Next Scheduled Task\",\"Retry\":[{\"ErrorEquals\":[\"Lambda.ServiceException\",\"Lambda.AWSLambdaException\",\"Lambda.SdkClientException\"],\"IntervalSeconds\":2,\"MaxAttempts\":6,\"BackoffRate\":2}],\"Type\":\"Task\",\"ResultPath\":\"$.trigger_at\",\"Resource\":\"", { "Fn::GetAtt": [ "GetNextTimestamp3AB5D155", "Arn" ] }, "\",\"Parameters\":{\"schedule.$\":\"$.task.schedule\"}},\"Run Next Scheduled Task\":{\"End\":true,\"Type\":\"Task\",\"Resource\":\"arn:aws:states:::states:startExecution\",\"Parameters\":{\"StateMachineArn\":\"arn:", { "Ref": "AWS::Partition" }, ":states:", { "Ref": "AWS::Region" }, ":", { "Ref": "AWS::AccountId" }, ":stateMachine:", { "Fn::GetAtt": [ "SchedulerSchedulerStateMachineNameSchedulerStateMachineNameNameResource958C6532", "Name" ] }, "\",\"Input\":{\"name.$\":\"$.name\",\"trigger_at.$\":\"$.trigger_at\"},\"Name.$\":\"$.task.next_task_id\"},\"Retry\":[{\"ErrorEquals\":[\"StepFunctions.ExecutionLimitExceeded\"]}],\"ResultPath\":\"$.startExecutionResult\",\"ResultSelector\":{\"ExecutionArn.$\":\"$.ExecutionArn\"}}}}" ] ] }, "RoleArn": { "Fn::GetAtt": [ "SchedulerSchedulerStateMachineRoleEDC22AEC", "Arn" ] }, "StateMachineName": { "Fn::GetAtt": [ "SchedulerSchedulerStateMachineNameSchedulerStateMachineNameNameResource958C6532", "Name" ] }, "Tags": [ { "Key": "SOLUTION_ID", "Value": "SO0170" }, { "Key": "SOLUTION_NAME", "Value": "maintaining-personalized-experiences-with-machine-learning" }, { "Key": "SOLUTION_VERSION", "Value": "v1.5.0" } ], "TracingConfiguration": { "Enabled": true } }, "DependsOn": [ "SchedulerSchedulerStateMachineRoleDefaultPolicy8CC45CD8", "SchedulerSchedulerStateMachineRoleEDC22AEC" ], "UpdateReplacePolicy": "Delete", "DeletionPolicy": "Delete", "Metadata": { "cdk_nag": { "rules_to_suppress": [ { "reason": "Information required for troubleshooting is logged by state function and lambda functions", "id": "AwsSolutions-SF1" }, { "reason": "All IAM policies defined in this solutiongrant only least-privilege permissions. Wildcard for resources is used only for serviceswhich do not have a resource arn", "id": "AwsSolutions-IAM5" }, { "reason": "We use AWS managed policies and do not need tochange as the \"*\" in resource is due to circular dependency.", "id": "AwsSolutions-IAM4" } ] } } }, "GetNextTimestampRole9D72EBF2": { "Type": "AWS::IAM::Role", "Properties": { "AssumeRolePolicyDocument": { "Statement": [ { "Action": "sts:AssumeRole", "Effect": "Allow", "Principal": { "Service": "lambda.amazonaws.com" } } ], "Version": "2012-10-17" }, "Policies": [ { "PolicyDocument": { "Statement": [ { "Action": [ "logs:CreateLogGroup", "logs:CreateLogStream", "logs:PutLogEvents" ], "Effect": "Allow", "Resource": { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":logs:", { "Ref": "AWS::Region" }, ":", { "Ref": "AWS::AccountId" }, ":log-group:/aws/lambda/*" ] ] } } ], "Version": "2012-10-17" }, "PolicyName": "LambdaFunctionServiceRolePolicy" } ], "Tags": [ { "Key": "SOLUTION_ID", "Value": "SO0170" }, { "Key": "SOLUTION_NAME", "Value": "maintaining-personalized-experiences-with-machine-learning" }, { "Key": "SOLUTION_VERSION", "Value": "v1.5.0" } ] }, "Metadata": { "guard": { "SuppressedRules": [ "IAM_NO_INLINE_POLICY_CHECK" ] }, "cdk_nag": { "rules_to_suppress": [ { "reason": "All IAM policies defined in this solutiongrant only least-privilege permissions. Wildcard for resources is used only for serviceswhich do not have a resource arn", "id": "AwsSolutions-IAM5" }, { "reason": "We use AWS managed policies and do not need tochange as the \"*\" in resource is due to circular dependency.", "id": "AwsSolutions-IAM4" } ] } } }, "GetNextTimestampRoleDefaultPolicy58578691": { "Type": "AWS::IAM::Policy", "Properties": { "PolicyDocument": { "Statement": [ { "Action": [ "xray:PutTraceSegments", "xray:PutTelemetryRecords" ], "Effect": "Allow", "Resource": "*" } ], "Version": "2012-10-17" }, "PolicyName": "GetNextTimestampRoleDefaultPolicy58578691", "Roles": [ { "Ref": "GetNextTimestampRole9D72EBF2" } ] }, "Metadata": { "cfn_nag": { "rules_to_suppress": [ { "id": "W12", "reason": "IAM policy for AWS X-Ray requires an allow on *" } ] }, "cdk_nag": { "rules_to_suppress": [ { "reason": "All IAM policies defined in this solutiongrant only least-privilege permissions. Wildcard for resources is used only for serviceswhich do not have a resource arn", "id": "AwsSolutions-IAM5" }, { "reason": "We use AWS managed policies and do not need tochange as the \"*\" in resource is due to circular dependency.", "id": "AwsSolutions-IAM4" } ] } } }, "GetNextTimestamp3AB5D155": { "Type": "AWS::Lambda::Function", "Properties": { "Code": { "S3Bucket": { "Fn::Join": [ "-", [ { "Fn::FindInMap": [ "SourceCode", "General", "S3Bucket" ] }, { "Ref": "AWS::Region" } ] ] }, "S3Key": { "Fn::Join": [ "/", [ { "Fn::FindInMap": [ "SourceCode", "General", "KeyPrefix" ] }, "GetNextTimestamp3AB5D155.zip" ] ] } }, "Environment": { "Variables": { "SOLUTION_NAME": "maintaining-personalized-experiences-with-machine-learning", "SOLUTION_ID": "SO0170", "SOLUTION_VERSION": "v1.5.0", "LOG_LEVEL": "INFO", "POWERTOOLS_SERVICE_NAME": "Workflow", "POWERTOOLS_METRICS_NAMESPACE": { "Fn::Join": [ "", [ "personalize_solution_", { "Ref": "AWS::StackName" } ] ] } } }, "Handler": "com.amazonaws.solutions.schedule_sfn_task.HandleScheduleEvent", "Role": { "Fn::GetAtt": [ "GetNextTimestampRole9D72EBF2", "Arn" ] }, "Runtime": "java11", "Tags": [ { "Key": "SOLUTION_ID", "Value": "SO0170" }, { "Key": "SOLUTION_NAME", "Value": "maintaining-personalized-experiences-with-machine-learning" }, { "Key": "SOLUTION_VERSION", "Value": "v1.5.0" } ], "TracingConfig": { "Mode": "Active" } }, "DependsOn": [ "GetNextTimestampRoleDefaultPolicy58578691", "GetNextTimestampRole9D72EBF2" ], "Metadata": { "cfn_nag": { "rules_to_suppress": [ { "id": "W89", "reason": "functions deployed by this solution do not require VPC access" }, { "id": "W92", "reason": "functions deployed by this solution do not require reserved concurrency" }, { "id": "W58", "reason": "functions deployed by this solution use custom policy to write to CloudWatch logs" } ] } } }, "PersonalizeScheduledTasks": { "Type": "AWS::DynamoDB::Table", "Properties": { "AttributeDefinitions": [ { "AttributeName": "name", "AttributeType": "S" }, { "AttributeName": "version", "AttributeType": "S" } ], "BillingMode": "PAY_PER_REQUEST", "KeySchema": [ { "AttributeName": "name", "KeyType": "HASH" }, { "AttributeName": "version", "KeyType": "RANGE" } ], "PointInTimeRecoverySpecification": { "PointInTimeRecoveryEnabled": true }, "SSESpecification": { "SSEEnabled": true }, "Tags": [ { "Key": "SOLUTION_ID", "Value": "SO0170" }, { "Key": "SOLUTION_NAME", "Value": "maintaining-personalized-experiences-with-machine-learning" }, { "Key": "SOLUTION_VERSION", "Value": "v1.5.0" } ] }, "UpdateReplacePolicy": "Retain", "DeletionPolicy": "Retain", "Metadata": { "guard": { "SuppressedRules": [ "DYNAMODB_TABLE_ENCRYPTED_KMS" ] } } }, "StateMachineNameStateMachineNameNameResource5B98B370": { "Type": "Custom::ResourceName", "Properties": { "ServiceToken": { "Fn::GetAtt": [ "ResourceNameFunctiond45b185afe3444aba37517f89597d9ec4F793A21", "Arn" ] }, "Purpose": "personalize-workflow", "StackName": { "Ref": "AWS::StackName" }, "MaxLength": 80 } }, "PersonalizeStateMachineRole801F53E1": { "Type": "AWS::IAM::Role", "Properties": { "AssumeRolePolicyDocument": { "Statement": [ { "Action": "sts:AssumeRole", "Effect": "Allow", "Principal": { "Service": { "Fn::FindInMap": [ "ServiceprincipalMap", { "Ref": "AWS::Region" }, "states" ] } } } ], "Version": "2012-10-17" }, "Tags": [ { "Key": "SOLUTION_ID", "Value": "SO0170" }, { "Key": "SOLUTION_NAME", "Value": "maintaining-personalized-experiences-with-machine-learning" }, { "Key": "SOLUTION_VERSION", "Value": "v1.5.0" } ] }, "Metadata": { "cdk_nag": { "rules_to_suppress": [ { "reason": "All IAM policies defined in this solutiongrant only least-privilege permissions. Wildcard for resources is used only for serviceswhich do not have a resource arn", "id": "AwsSolutions-IAM5" }, { "reason": "We use AWS managed policies and do not need tochange as the \"*\" in resource is due to circular dependency.", "id": "AwsSolutions-IAM4" } ] } } }, "PersonalizeStateMachineRoleDefaultPolicy849E454B": { "Type": "AWS::IAM::Policy", "Properties": { "PolicyDocument": { "Statement": [ { "Action": [ "xray:PutTraceSegments", "xray:PutTelemetryRecords", "xray:GetSamplingRules", "xray:GetSamplingTargets" ], "Effect": "Allow", "Resource": "*" }, { "Action": "lambda:InvokeFunction", "Effect": "Allow", "Resource": [ { "Fn::GetAtt": [ "SNSNotificationSolutionStepsnsnotificationfn6973DEFB", "Arn" ] }, { "Fn::Join": [ "", [ { "Fn::GetAtt": [ "SNSNotificationSolutionStepsnsnotificationfn6973DEFB", "Arn" ] }, ":*" ] ] } ] }, { "Action": "lambda:InvokeFunction", "Effect": "Allow", "Resource": [ { "Fn::GetAtt": [ "PrepareInputSolutionStepprepareinputfn2F0001F7", "Arn" ] }, { "Fn::Join": [ "", [ { "Fn::GetAtt": [ "PrepareInputSolutionStepprepareinputfn2F0001F7", "Arn" ] }, ":*" ] ] } ] }, { "Action": "lambda:InvokeFunction", "Effect": "Allow", "Resource": [ { "Fn::GetAtt": [ "CreateDatasetGroupSolutionStepcreatedatasetgroupfnA7D8C46A", "Arn" ] }, { "Fn::Join": [ "", [ { "Fn::GetAtt": [ "CreateDatasetGroupSolutionStepcreatedatasetgroupfnA7D8C46A", "Arn" ] }, ":*" ] ] } ] }, { "Action": "lambda:InvokeFunction", "Effect": "Allow", "Resource": [ { "Fn::GetAtt": [ "SchedulercreatescheduledtaskSolutionStepcreatescheduledtaskfn7FCB3878", "Arn" ] }, { "Fn::Join": [ "", [ { "Fn::GetAtt": [ "SchedulercreatescheduledtaskSolutionStepcreatescheduledtaskfn7FCB3878", "Arn" ] }, ":*" ] ] } ] }, { "Action": "lambda:InvokeFunction", "Effect": "Allow", "Resource": [ { "Fn::GetAtt": [ "CreateEventTrackerSolutionStepcreateeventtrackerfnD0E776E2", "Arn" ] }, { "Fn::Join": [ "", [ { "Fn::GetAtt": [ "CreateEventTrackerSolutionStepcreateeventtrackerfnD0E776E2", "Arn" ] }, ":*" ] ] } ] }, { "Action": "lambda:InvokeFunction", "Effect": "Allow", "Resource": [ { "Fn::GetAtt": [ "CreateFilterSolutionStepcreatefilterfnF2859FD9", "Arn" ] }, { "Fn::Join": [ "", [ { "Fn::GetAtt": [ "CreateFilterSolutionStepcreatefilterfnF2859FD9", "Arn" ] }, ":*" ] ] } ] }, { "Action": "lambda:InvokeFunction", "Effect": "Allow", "Resource": [ { "Fn::GetAtt": [ "CreateSolutionSolutionStepcreatesolutionfn1F463E79", "Arn" ] }, { "Fn::Join": [ "", [ { "Fn::GetAtt": [ "CreateSolutionSolutionStepcreatesolutionfn1F463E79", "Arn" ] }, ":*" ] ] } ] }, { "Action": "lambda:InvokeFunction", "Effect": "Allow", "Resource": [ { "Fn::GetAtt": [ "CreateSolutionVersionSolutionStepcreatesolutionversionfn0681411E", "Arn" ] }, { "Fn::Join": [ "", [ { "Fn::GetAtt": [ "CreateSolutionVersionSolutionStepcreatesolutionversionfn0681411E", "Arn" ] }, ":*" ] ] } ] }, { "Action": "lambda:InvokeFunction", "Effect": "Allow", "Resource": [ { "Fn::GetAtt": [ "CreateCampaignSolutionStepcreatecampaignfn5F83F6AB", "Arn" ] }, { "Fn::Join": [ "", [ { "Fn::GetAtt": [ "CreateCampaignSolutionStepcreatecampaignfn5F83F6AB", "Arn" ] }, ":*" ] ] } ] }, { "Action": "lambda:InvokeFunction", "Effect": "Allow", "Resource": [ { "Fn::GetAtt": [ "CreateBatchInferenceJobSolutionStepcreatebatchinferencejobfn8B4A8B4F", "Arn" ] }, { "Fn::Join": [ "", [ { "Fn::GetAtt": [ "CreateBatchInferenceJobSolutionStepcreatebatchinferencejobfn8B4A8B4F", "Arn" ] }, ":*" ] ] } ] }, { "Action": "lambda:InvokeFunction", "Effect": "Allow", "Resource": [ { "Fn::GetAtt": [ "CreateBatchSegmentJobSolutionStepcreatebatchsegmentjobfn01ACE97D", "Arn" ] }, { "Fn::Join": [ "", [ { "Fn::GetAtt": [ "CreateBatchSegmentJobSolutionStepcreatebatchsegmentjobfn01ACE97D", "Arn" ] }, ":*" ] ] } ] }, { "Action": "lambda:InvokeFunction", "Effect": "Allow", "Resource": [ { "Fn::GetAtt": [ "CreateRecommenderSolutionStepcreaterecommenderfnF63FF7BD", "Arn" ] }, { "Fn::Join": [ "", [ { "Fn::GetAtt": [ "CreateRecommenderSolutionStepcreaterecommenderfnF63FF7BD", "Arn" ] }, ":*" ] ] } ] }, { "Action": "lambda:InvokeFunction", "Effect": "Allow", "Resource": [ { "Fn::GetAtt": [ "CreateDatasetImportJobSolutionStepcreatedatasetimportjobfn4FF1A8F1", "Arn" ] }, { "Fn::Join": [ "", [ { "Fn::GetAtt": [ "CreateDatasetImportJobSolutionStepcreatedatasetimportjobfn4FF1A8F1", "Arn" ] }, ":*" ] ] } ] }, { "Action": "lambda:InvokeFunction", "Effect": "Allow", "Resource": [ { "Fn::GetAtt": [ "CreateDatasetSolutionStepcreatedatasetfn072D6427", "Arn" ] }, { "Fn::Join": [ "", [ { "Fn::GetAtt": [ "CreateDatasetSolutionStepcreatedatasetfn072D6427", "Arn" ] }, ":*" ] ] } ] }, { "Action": "lambda:InvokeFunction", "Effect": "Allow", "Resource": [ { "Fn::GetAtt": [ "CreateSchemaSolutionStepcreateschemafn2A793C8A", "Arn" ] }, { "Fn::Join": [ "", [ { "Fn::GetAtt": [ "CreateSchemaSolutionStepcreateschemafn2A793C8A", "Arn" ] }, ":*" ] ] } ] } ], "Version": "2012-10-17" }, "PolicyName": "PersonalizeStateMachineRoleDefaultPolicy849E454B", "Roles": [ { "Ref": "PersonalizeStateMachineRole801F53E1" } ] }, "Metadata": { "cfn_nag": { "rules_to_suppress": [ { "id": "W12", "reason": "IAM policy for AWS X-Ray requires an allow on *" }, { "id": "W76", "reason": "Large step functions need larger IAM roles to access all managed AWS Lambda functions" } ] }, "cdk_nag": { "rules_to_suppress": [ { "reason": "All IAM policies defined in this solutiongrant only least-privilege permissions. Wildcard for resources is used only for serviceswhich do not have a resource arn", "id": "AwsSolutions-IAM5" }, { "reason": "We use AWS managed policies and do not need tochange as the \"*\" in resource is due to circular dependency.", "id": "AwsSolutions-IAM4" } ] } } }, "PersonalizeStateMachine739DC329": { "Type": "AWS::StepFunctions::StateMachine", "Properties": { "DefinitionString": { "Fn::Join": [ "", [ "{\"StartAt\":\"Manage The Execution\",\"States\":{\"Manage The Execution\":{\"Type\":\"Parallel\",\"Next\":\"Success\",\"Catch\":[{\"ErrorEquals\":[\"States.ALL\"],\"ResultPath\":\"$.statesError\",\"Next\":\"Send Failure Message\"}],\"Branches\":[{\"StartAt\":\"Prepare Input\",\"States\":{\"Prepare Input\":{\"Next\":\"Create Dataset Group\",\"Retry\":[{\"ErrorEquals\":[\"Lambda.ServiceException\",\"Lambda.AWSLambdaException\",\"Lambda.SdkClientException\"],\"IntervalSeconds\":2,\"MaxAttempts\":6,\"BackoffRate\":2},{\"ErrorEquals\":[\"ResourcePending\"],\"IntervalSeconds\":5,\"MaxAttempts\":5,\"BackoffRate\":1.05}],\"Type\":\"Task\",\"InputPath\":\"$\",\"OutputPath\":\"$\",\"ResultPath\":\"$\",\"Resource\":\"", { "Fn::GetAtt": [ "PrepareInputSolutionStepprepareinputfn2F0001F7", "Arn" ] }, "\"},\"Create Dataset Group\":{\"Next\":\"Create and Import Datasets\",\"Retry\":[{\"ErrorEquals\":[\"Lambda.ServiceException\",\"Lambda.AWSLambdaException\",\"Lambda.SdkClientException\"],\"IntervalSeconds\":2,\"MaxAttempts\":6,\"BackoffRate\":2},{\"ErrorEquals\":[\"ResourcePending\"],\"IntervalSeconds\":5,\"MaxAttempts\":30,\"BackoffRate\":1.02}],\"Type\":\"Task\",\"InputPath\":\"$.datasetGroup\",\"OutputPath\":\"$\",\"ResultPath\":\"$.datasetGroup.serviceConfig\",\"Resource\":\"", { "Fn::GetAtt": [ "CreateDatasetGroupSolutionStepcreatedatasetgroupfnA7D8C46A", "Arn" ] }, "\"},\"Create and Import Datasets\":{\"Type\":\"Parallel\",\"ResultPath\":null,\"Next\":\"Check if Personalize Dataset Import Schedule Required\",\"Branches\":[{\"StartAt\":\"Check if Interactions Data Configuration Present\",\"States\":{\"Check if Interactions Data Configuration Present\":{\"Type\":\"Choice\",\"Choices\":[{\"Variable\":\"$.datasets.interactions\",\"IsPresent\":true,\"Next\":\"Create Interactions Schema\"}],\"Default\":\"Interactions Not Provided\"},\"Interactions Not Provided\":{\"Type\":\"Pass\",\"ResultPath\":null,\"End\":true},\"Try Interactions Dataset Import from CSV\":{\"End\":true,\"Retry\":[{\"ErrorEquals\":[\"Lambda.ServiceException\",\"Lambda.AWSLambdaException\",\"Lambda.SdkClientException\"],\"IntervalSeconds\":2,\"MaxAttempts\":6,\"BackoffRate\":2},{\"ErrorEquals\":[\"ResourcePending\"],\"IntervalSeconds\":60,\"MaxAttempts\":100,\"BackoffRate\":1.02}],\"Catch\":[{\"ErrorEquals\":[\"NoSuchKey\"],\"ResultPath\":null,\"Next\":\"Interactions Not Provided\"}],\"Type\":\"Task\",\"InputPath\":\"$\",\"OutputPath\":\"$\",\"ResultPath\":null,\"Resource\":\"", { "Fn::GetAtt": [ "CreateDatasetImportJobSolutionStepcreatedatasetimportjobfn4FF1A8F1", "Arn" ] }, "\",\"Parameters\":{\"serviceConfig\":{\"jobName.$\":\"States.Format('dataset_import_interactions_{}', $.currentDate)\",\"datasetArn.$\":\"$.datasets.interactions.dataset.serviceConfig.datasetArn\",\"dataSource\":{\"dataLocation.$\":\"States.Format('s3://{}/{}/interactions.csv', $.bucket.name, $.bucket.key)\"},\"importMode\":\"FULL\",\"publishAttributionMetricsToS3.$\":\"$.datasets.serviceConfig.publishAttributionMetricsToS3\",\"tags.$\":\"$.datasets.serviceConfig.tags\"},\"workflowConfig\":{\"maxAge.$\":\"$.datasetGroup.workflowConfig.maxAge\",\"timeStarted.$\":\"$$.State.EnteredTime\"}}},\"Try Interactions Dataset Import from Prefix\":{\"End\":true,\"Retry\":[{\"ErrorEquals\":[\"Lambda.ServiceException\",\"Lambda.AWSLambdaException\",\"Lambda.SdkClientException\"],\"IntervalSeconds\":2,\"MaxAttempts\":6,\"BackoffRate\":2},{\"ErrorEquals\":[\"ResourcePending\"],\"IntervalSeconds\":60,\"MaxAttempts\":100,\"BackoffRate\":1.02}],\"Catch\":[{\"ErrorEquals\":[\"NoSuchKey\"],\"ResultPath\":null,\"Next\":\"Try Interactions Dataset Import from CSV\"}],\"Type\":\"Task\",\"InputPath\":\"$\",\"OutputPath\":\"$\",\"ResultPath\":null,\"Resource\":\"", { "Fn::GetAtt": [ "CreateDatasetImportJobSolutionStepcreatedatasetimportjobfn4FF1A8F1", "Arn" ] }, "\",\"Parameters\":{\"serviceConfig\":{\"jobName.$\":\"States.Format('dataset_import_interactions_{}', $.currentDate)\",\"datasetArn.$\":\"$.datasets.interactions.dataset.serviceConfig.datasetArn\",\"dataSource\":{\"dataLocation.$\":\"States.Format('s3://{}/{}/interactions', $.bucket.name, $.bucket.key)\"},\"importMode\":\"FULL\",\"publishAttributionMetricsToS3.$\":\"$.datasets.serviceConfig.publishAttributionMetricsToS3\",\"tags.$\":\"$.datasets.serviceConfig.tags\"},\"workflowConfig\":{\"maxAge.$\":\"$.datasetGroup.workflowConfig.maxAge\",\"timeStarted.$\":\"$$.State.EnteredTime\"}}},\"Create Interactions Dataset\":{\"Next\":\"Try Interactions Dataset Import from Prefix\",\"Retry\":[{\"ErrorEquals\":[\"Lambda.ServiceException\",\"Lambda.AWSLambdaException\",\"Lambda.SdkClientException\"],\"IntervalSeconds\":2,\"MaxAttempts\":6,\"BackoffRate\":2},{\"ErrorEquals\":[\"ResourcePending\"],\"IntervalSeconds\":60,\"MaxAttempts\":100,\"BackoffRate\":1.02}],\"Type\":\"Task\",\"InputPath\":\"$\",\"OutputPath\":\"$\",\"ResultPath\":\"$.datasets.interactions.dataset.serviceConfig\",\"Resource\":\"", { "Fn::GetAtt": [ "CreateDatasetSolutionStepcreatedatasetfn072D6427", "Arn" ] }, "\",\"Parameters\":{\"serviceConfig\":{\"name.$\":\"$.datasets.interactions.dataset.serviceConfig.name\",\"schemaArn.$\":\"$.datasets.interactions.schema.serviceConfig.schemaArn\",\"datasetGroupArn.$\":\"$.datasetGroup.serviceConfig.datasetGroupArn\",\"datasetType\":\"interactions\",\"tags.$\":\"$.datasets.interactions.dataset.serviceConfig.tags\"},\"workflowConfig\":{\"maxAge.$\":\"$.datasetGroup.workflowConfig.maxAge\",\"timeStarted.$\":\"$$.State.EnteredTime\"}}},\"Create Interactions Schema\":{\"Next\":\"Create Interactions Dataset\",\"Retry\":[{\"ErrorEquals\":[\"Lambda.ServiceException\",\"Lambda.AWSLambdaException\",\"Lambda.SdkClientException\"],\"IntervalSeconds\":2,\"MaxAttempts\":6,\"BackoffRate\":2},{\"ErrorEquals\":[\"ResourcePending\"],\"IntervalSeconds\":5,\"MaxAttempts\":5,\"BackoffRate\":1.05}],\"Type\":\"Task\",\"InputPath\":\"$.datasets.interactions.schema\",\"OutputPath\":\"$\",\"ResultPath\":\"$.datasets.interactions.schema.serviceConfig\",\"Resource\":\"", { "Fn::GetAtt": [ "CreateSchemaSolutionStepcreateschemafn2A793C8A", "Arn" ] }, "\"}}},{\"StartAt\":\"Check if Users Data Configuration Present\",\"States\":{\"Check if Users Data Configuration Present\":{\"Type\":\"Choice\",\"Choices\":[{\"Variable\":\"$.datasets.users\",\"IsPresent\":true,\"Next\":\"Create Users Schema\"}],\"Default\":\"Users Not Provided\"},\"Users Not Provided\":{\"Type\":\"Pass\",\"ResultPath\":null,\"End\":true},\"Try Users Dataset Import from CSV\":{\"End\":true,\"Retry\":[{\"ErrorEquals\":[\"Lambda.ServiceException\",\"Lambda.AWSLambdaException\",\"Lambda.SdkClientException\"],\"IntervalSeconds\":2,\"MaxAttempts\":6,\"BackoffRate\":2},{\"ErrorEquals\":[\"ResourcePending\"],\"IntervalSeconds\":60,\"MaxAttempts\":100,\"BackoffRate\":1.02}],\"Catch\":[{\"ErrorEquals\":[\"NoSuchKey\"],\"ResultPath\":null,\"Next\":\"Users Not Provided\"}],\"Type\":\"Task\",\"InputPath\":\"$\",\"OutputPath\":\"$\",\"ResultPath\":null,\"Resource\":\"", { "Fn::GetAtt": [ "CreateDatasetImportJobSolutionStepcreatedatasetimportjobfn4FF1A8F1", "Arn" ] }, "\",\"Parameters\":{\"serviceConfig\":{\"jobName.$\":\"States.Format('dataset_import_users_{}', $.currentDate)\",\"datasetArn.$\":\"$.datasets.users.dataset.serviceConfig.datasetArn\",\"dataSource\":{\"dataLocation.$\":\"States.Format('s3://{}/{}/users.csv', $.bucket.name, $.bucket.key)\"},\"importMode\":\"FULL\",\"publishAttributionMetricsToS3.$\":\"$.datasets.serviceConfig.publishAttributionMetricsToS3\",\"tags.$\":\"$.datasets.serviceConfig.tags\"},\"workflowConfig\":{\"maxAge.$\":\"$.datasetGroup.workflowConfig.maxAge\",\"timeStarted.$\":\"$$.State.EnteredTime\"}}},\"Try Users Dataset Import from Prefix\":{\"End\":true,\"Retry\":[{\"ErrorEquals\":[\"Lambda.ServiceException\",\"Lambda.AWSLambdaException\",\"Lambda.SdkClientException\"],\"IntervalSeconds\":2,\"MaxAttempts\":6,\"BackoffRate\":2},{\"ErrorEquals\":[\"ResourcePending\"],\"IntervalSeconds\":60,\"MaxAttempts\":100,\"BackoffRate\":1.02}],\"Catch\":[{\"ErrorEquals\":[\"NoSuchKey\"],\"ResultPath\":null,\"Next\":\"Try Users Dataset Import from CSV\"}],\"Type\":\"Task\",\"InputPath\":\"$\",\"OutputPath\":\"$\",\"ResultPath\":null,\"Resource\":\"", { "Fn::GetAtt": [ "CreateDatasetImportJobSolutionStepcreatedatasetimportjobfn4FF1A8F1", "Arn" ] }, "\",\"Parameters\":{\"serviceConfig\":{\"jobName.$\":\"States.Format('dataset_import_users_{}', $.currentDate)\",\"datasetArn.$\":\"$.datasets.users.dataset.serviceConfig.datasetArn\",\"dataSource\":{\"dataLocation.$\":\"States.Format('s3://{}/{}/users', $.bucket.name, $.bucket.key)\"},\"importMode\":\"FULL\",\"publishAttributionMetricsToS3.$\":\"$.datasets.serviceConfig.publishAttributionMetricsToS3\",\"tags.$\":\"$.datasets.serviceConfig.tags\"},\"workflowConfig\":{\"maxAge.$\":\"$.datasetGroup.workflowConfig.maxAge\",\"timeStarted.$\":\"$$.State.EnteredTime\"}}},\"Create Users Dataset\":{\"Next\":\"Try Users Dataset Import from Prefix\",\"Retry\":[{\"ErrorEquals\":[\"Lambda.ServiceException\",\"Lambda.AWSLambdaException\",\"Lambda.SdkClientException\"],\"IntervalSeconds\":2,\"MaxAttempts\":6,\"BackoffRate\":2},{\"ErrorEquals\":[\"ResourcePending\"],\"IntervalSeconds\":60,\"MaxAttempts\":100,\"BackoffRate\":1.02}],\"Type\":\"Task\",\"InputPath\":\"$\",\"OutputPath\":\"$\",\"ResultPath\":\"$.datasets.users.dataset.serviceConfig\",\"Resource\":\"", { "Fn::GetAtt": [ "CreateDatasetSolutionStepcreatedatasetfn072D6427", "Arn" ] }, "\",\"Parameters\":{\"serviceConfig\":{\"name.$\":\"$.datasets.users.dataset.serviceConfig.name\",\"schemaArn.$\":\"$.datasets.users.schema.serviceConfig.schemaArn\",\"datasetGroupArn.$\":\"$.datasetGroup.serviceConfig.datasetGroupArn\",\"datasetType\":\"users\",\"tags.$\":\"$.datasets.users.dataset.serviceConfig.tags\"},\"workflowConfig\":{\"maxAge.$\":\"$.datasetGroup.workflowConfig.maxAge\",\"timeStarted.$\":\"$$.State.EnteredTime\"}}},\"Create Users Schema\":{\"Next\":\"Create Users Dataset\",\"Retry\":[{\"ErrorEquals\":[\"Lambda.ServiceException\",\"Lambda.AWSLambdaException\",\"Lambda.SdkClientException\"],\"IntervalSeconds\":2,\"MaxAttempts\":6,\"BackoffRate\":2},{\"ErrorEquals\":[\"ResourcePending\"],\"IntervalSeconds\":5,\"MaxAttempts\":5,\"BackoffRate\":1.05}],\"Type\":\"Task\",\"InputPath\":\"$.datasets.users.schema\",\"OutputPath\":\"$\",\"ResultPath\":\"$.datasets.users.schema.serviceConfig\",\"Resource\":\"", { "Fn::GetAtt": [ "CreateSchemaSolutionStepcreateschemafn2A793C8A", "Arn" ] }, "\"}}},{\"StartAt\":\"Check if Items Data Configuration Present\",\"States\":{\"Check if Items Data Configuration Present\":{\"Type\":\"Choice\",\"Choices\":[{\"Variable\":\"$.datasets.items\",\"IsPresent\":true,\"Next\":\"Create Items Schema\"}],\"Default\":\"Items Not Provided\"},\"Items Not Provided\":{\"Type\":\"Pass\",\"ResultPath\":null,\"End\":true},\"Try Items Dataset Import from CSV\":{\"End\":true,\"Retry\":[{\"ErrorEquals\":[\"Lambda.ServiceException\",\"Lambda.AWSLambdaException\",\"Lambda.SdkClientException\"],\"IntervalSeconds\":2,\"MaxAttempts\":6,\"BackoffRate\":2},{\"ErrorEquals\":[\"ResourcePending\"],\"IntervalSeconds\":60,\"MaxAttempts\":100,\"BackoffRate\":1.02}],\"Catch\":[{\"ErrorEquals\":[\"NoSuchKey\"],\"ResultPath\":null,\"Next\":\"Items Not Provided\"}],\"Type\":\"Task\",\"InputPath\":\"$\",\"OutputPath\":\"$\",\"ResultPath\":null,\"Resource\":\"", { "Fn::GetAtt": [ "CreateDatasetImportJobSolutionStepcreatedatasetimportjobfn4FF1A8F1", "Arn" ] }, "\",\"Parameters\":{\"serviceConfig\":{\"jobName.$\":\"States.Format('dataset_import_items_{}', $.currentDate)\",\"datasetArn.$\":\"$.datasets.items.dataset.serviceConfig.datasetArn\",\"dataSource\":{\"dataLocation.$\":\"States.Format('s3://{}/{}/items.csv', $.bucket.name, $.bucket.key)\"},\"importMode\":\"FULL\",\"publishAttributionMetricsToS3.$\":\"$.datasets.serviceConfig.publishAttributionMetricsToS3\",\"tags.$\":\"$.datasets.serviceConfig.tags\"},\"workflowConfig\":{\"maxAge.$\":\"$.datasetGroup.workflowConfig.maxAge\",\"timeStarted.$\":\"$$.State.EnteredTime\"}}},\"Try Items Dataset Import from Prefix\":{\"End\":true,\"Retry\":[{\"ErrorEquals\":[\"Lambda.ServiceException\",\"Lambda.AWSLambdaException\",\"Lambda.SdkClientException\"],\"IntervalSeconds\":2,\"MaxAttempts\":6,\"BackoffRate\":2},{\"ErrorEquals\":[\"ResourcePending\"],\"IntervalSeconds\":60,\"MaxAttempts\":100,\"BackoffRate\":1.02}],\"Catch\":[{\"ErrorEquals\":[\"NoSuchKey\"],\"ResultPath\":null,\"Next\":\"Try Items Dataset Import from CSV\"}],\"Type\":\"Task\",\"InputPath\":\"$\",\"OutputPath\":\"$\",\"ResultPath\":null,\"Resource\":\"", { "Fn::GetAtt": [ "CreateDatasetImportJobSolutionStepcreatedatasetimportjobfn4FF1A8F1", "Arn" ] }, "\",\"Parameters\":{\"serviceConfig\":{\"jobName.$\":\"States.Format('dataset_import_items_{}', $.currentDate)\",\"datasetArn.$\":\"$.datasets.items.dataset.serviceConfig.datasetArn\",\"dataSource\":{\"dataLocation.$\":\"States.Format('s3://{}/{}/items', $.bucket.name, $.bucket.key)\"},\"importMode\":\"FULL\",\"publishAttributionMetricsToS3.$\":\"$.datasets.serviceConfig.publishAttributionMetricsToS3\",\"tags.$\":\"$.datasets.serviceConfig.tags\"},\"workflowConfig\":{\"maxAge.$\":\"$.datasetGroup.workflowConfig.maxAge\",\"timeStarted.$\":\"$$.State.EnteredTime\"}}},\"Create Items Dataset\":{\"Next\":\"Try Items Dataset Import from Prefix\",\"Retry\":[{\"ErrorEquals\":[\"Lambda.ServiceException\",\"Lambda.AWSLambdaException\",\"Lambda.SdkClientException\"],\"IntervalSeconds\":2,\"MaxAttempts\":6,\"BackoffRate\":2},{\"ErrorEquals\":[\"ResourcePending\"],\"IntervalSeconds\":60,\"MaxAttempts\":100,\"BackoffRate\":1.02}],\"Type\":\"Task\",\"InputPath\":\"$\",\"OutputPath\":\"$\",\"ResultPath\":\"$.datasets.items.dataset.serviceConfig\",\"Resource\":\"", { "Fn::GetAtt": [ "CreateDatasetSolutionStepcreatedatasetfn072D6427", "Arn" ] }, "\",\"Parameters\":{\"serviceConfig\":{\"name.$\":\"$.datasets.items.dataset.serviceConfig.name\",\"schemaArn.$\":\"$.datasets.items.schema.serviceConfig.schemaArn\",\"datasetGroupArn.$\":\"$.datasetGroup.serviceConfig.datasetGroupArn\",\"datasetType\":\"items\",\"tags.$\":\"$.datasets.items.dataset.serviceConfig.tags\"},\"workflowConfig\":{\"maxAge.$\":\"$.datasetGroup.workflowConfig.maxAge\",\"timeStarted.$\":\"$$.State.EnteredTime\"}}},\"Create Items Schema\":{\"Next\":\"Create Items Dataset\",\"Retry\":[{\"ErrorEquals\":[\"Lambda.ServiceException\",\"Lambda.AWSLambdaException\",\"Lambda.SdkClientException\"],\"IntervalSeconds\":2,\"MaxAttempts\":6,\"BackoffRate\":2},{\"ErrorEquals\":[\"ResourcePending\"],\"IntervalSeconds\":5,\"MaxAttempts\":5,\"BackoffRate\":1.05}],\"Type\":\"Task\",\"InputPath\":\"$.datasets.items.schema\",\"OutputPath\":\"$\",\"ResultPath\":\"$.datasets.items.schema.serviceConfig\",\"Resource\":\"", { "Fn::GetAtt": [ "CreateSchemaSolutionStepcreateschemafn2A793C8A", "Arn" ] }, "\"}}}]},\"Check if Personalize Dataset Import Schedule Required\":{\"Type\":\"Choice\",\"Choices\":[{\"Variable\":\"$.datasetGroup.workflowConfig.schedules.import\",\"IsPresent\":true,\"Next\":\"Create Schedule For Personalize Dataset Import\"}],\"Default\":\"Personalize Dataset Import Schedule Not Required\"},\"Personalize Dataset Import Schedule Not Required\":{\"Type\":\"Pass\",\"Next\":\"Check if Event Tracker Required\"},\"Check if Event Tracker Required\":{\"Type\":\"Choice\",\"Choices\":[{\"Variable\":\"$.eventTracker.serviceConfig.name\",\"IsPresent\":true,\"Next\":\"Create Event Tracker\"}],\"Default\":\"Event Tracker not Required\"},\"Create Schedule For Personalize Dataset Import\":{\"Next\":\"Check if Event Tracker Required\",\"Retry\":[{\"ErrorEquals\":[\"Lambda.ServiceException\",\"Lambda.AWSLambdaException\",\"Lambda.SdkClientException\"],\"IntervalSeconds\":2,\"MaxAttempts\":6,\"BackoffRate\":2},{\"ErrorEquals\":[\"ResourcePending\"],\"IntervalSeconds\":5,\"MaxAttempts\":5,\"BackoffRate\":1.05}],\"Type\":\"Task\",\"InputPath\":\"$\",\"OutputPath\":\"$\",\"ResultPath\":null,\"Resource\":\"", { "Fn::GetAtt": [ "SchedulercreatescheduledtaskSolutionStepcreatescheduledtaskfn7FCB3878", "Arn" ] }, "\",\"Parameters\":{\"name.$\":\"States.Format('personalize-dataset-import-{}', $.datasetGroup.serviceConfig.name)\",\"schedule.$\":\"$.datasetGroup.workflowConfig.schedules.import\",\"state_machine\":{\"arn\":\"", { "Ref": "ScheduledDatasetImportPeriodicDatasetImport3830A3E8" }, "\",\"input\":{\"datasetGroup\":{\"serviceConfig.$\":\"$.datasetGroup.serviceConfig\",\"workflowConfig\":{\"maxAge\":\"1 second\"}},\"datasets.$\":\"$.datasets\",\"bucket.$\":\"$.bucket\"}}}},\"Event Tracker not Required\":{\"Type\":\"Pass\",\"Next\":\"Check if Filters Required\"},\"Check if Filters Required\":{\"Type\":\"Choice\",\"Choices\":[{\"Variable\":\"$.filters[0]\",\"IsPresent\":true,\"Next\":\"Create Filters\"}],\"Default\":\"Filters Not Required\"},\"Create Event Tracker\":{\"Next\":\"Check if Filters Required\",\"Retry\":[{\"ErrorEquals\":[\"Lambda.ServiceException\",\"Lambda.AWSLambdaException\",\"Lambda.SdkClientException\"],\"IntervalSeconds\":2,\"MaxAttempts\":6,\"BackoffRate\":2},{\"ErrorEquals\":[\"ResourcePending\"],\"IntervalSeconds\":8,\"MaxAttempts\":15,\"BackoffRate\":1.25}],\"Type\":\"Task\",\"InputPath\":\"$\",\"OutputPath\":\"$\",\"ResultPath\":\"$.eventTracker.serviceConfig\",\"Resource\":\"", { "Fn::GetAtt": [ "CreateEventTrackerSolutionStepcreateeventtrackerfnD0E776E2", "Arn" ] }, "\",\"Parameters\":{\"serviceConfig\":{\"name.$\":\"$.eventTracker.serviceConfig.name\",\"tags.$\":\"$.eventTracker.serviceConfig.tags\",\"datasetGroupArn.$\":\"$.datasetGroup.serviceConfig.datasetGroupArn\"},\"workflowConfig\":{\"timeStarted.$\":\"$$.State.EnteredTime\"}}},\"Filters Not Required\":{\"Type\":\"Pass\",\"Next\":\"Recommenders and Solutions\"},\"Recommenders and Solutions\":{\"Type\":\"Parallel\",\"ResultPath\":null,\"End\":true,\"Branches\":[{\"StartAt\":\"Check for Solutions\",\"States\":{\"Check for Solutions\":{\"Type\":\"Choice\",\"Choices\":[{\"Variable\":\"$.solutions[0]\",\"IsPresent\":true,\"Next\":\"Create Solutions\"}],\"Default\":\"Solutions not Provided\"},\"Solutions not Provided\":{\"Type\":\"Pass\",\"End\":true},\"Create Solutions\":{\"Type\":\"Map\",\"ResultPath\":null,\"End\":true,\"Parameters\":{\"datasetGroupArn.$\":\"$.datasetGroup.serviceConfig.datasetGroupArn\",\"datasetGroupName.$\":\"$.datasetGroup.serviceConfig.name\",\"solution.$\":\"$$.Map.Item.Value\",\"bucket.$\":\"$.bucket\",\"currentDate.$\":\"$.currentDate\"},\"Iterator\":{\"StartAt\":\"Prepare Solution Input Data\",\"States\":{\"Prepare Solution Input Data\":{\"Type\":\"Pass\",\"ResultPath\":\"$.solution.serviceConfig.datasetGroupArn\",\"InputPath\":\"$.datasetGroupArn\",\"Next\":\"Create Solution\"},\"Create Solution\":{\"Next\":\"Prepare Solution Output Data\",\"Retry\":[{\"ErrorEquals\":[\"Lambda.ServiceException\",\"Lambda.AWSLambdaException\",\"Lambda.SdkClientException\"],\"IntervalSeconds\":2,\"MaxAttempts\":6,\"BackoffRate\":2},{\"ErrorEquals\":[\"ResourcePending\"],\"IntervalSeconds\":5,\"MaxAttempts\":5,\"BackoffRate\":1.05}],\"Type\":\"Task\",\"InputPath\":\"$.solution\",\"OutputPath\":\"$\",\"ResultPath\":\"$._tmp\",\"ResultSelector\":{\"solutionArn.$\":\"$.solutionArn\"},\"Resource\":\"", { "Fn::GetAtt": [ "CreateSolutionSolutionStepcreatesolutionfn1F463E79", "Arn" ] }, "\"},\"Prepare Solution Output Data\":{\"Type\":\"Pass\",\"ResultPath\":\"$.solution.serviceConfig.solutionArn\",\"InputPath\":\"$._tmp.solutionArn\",\"Next\":\"Check for Solution Version\"},\"Check for Solution Version\":{\"Type\":\"Choice\",\"Choices\":[{\"Variable\":\"$.solution.solutionVersion\",\"IsPresent\":false,\"Next\":\"Prepare Solution Version Input Data\"}],\"Default\":\"Create Solution Version\"},\"Create Solution Version\":{\"Next\":\"Prepare Solution Version Output Data\",\"Retry\":[{\"ErrorEquals\":[\"Lambda.ServiceException\",\"Lambda.AWSLambdaException\",\"Lambda.SdkClientException\"],\"IntervalSeconds\":2,\"MaxAttempts\":6,\"BackoffRate\":2},{\"ErrorEquals\":[\"ResourcePending\"],\"IntervalSeconds\":60,\"MaxAttempts\":100,\"BackoffRate\":1.02}],\"Catch\":[{\"ErrorEquals\":[\"SolutionVersionPending\"],\"ResultPath\":\"$.solutionVersionPending\",\"Next\":\"Save Solution Version ID\"}],\"Type\":\"Task\",\"InputPath\":\"$.solution.solutionVersion\",\"OutputPath\":\"$\",\"ResultPath\":\"$._tmp\",\"ResultSelector\":{\"solutionVersionArn.$\":\"$.solutionVersionArn\"},\"Resource\":\"", { "Fn::GetAtt": [ "CreateSolutionVersionSolutionStepcreatesolutionversionfn0681411E", "Arn" ] }, "\"},\"Set Solution Version ID\":{\"Type\":\"Pass\",\"ResultPath\":\"$.solution.solutionVersion\",\"Parameters\":{\"serviceConfig\":{\"trainingMode.$\":\"$.solution.serviceConfig.solutionVersion.trainingMode\",\"solutionArn.$\":\"$.solution.solutionVersion.serviceConfig.solutionArn\",\"tags.$\":\"$.solution.solutionVersion.serviceConfig.tags\"},\"workflowConfig\":{\"maxAge.$\":\"$.solution.solutionVersion.workflowConfig.maxAge\",\"solutionVersionArn.$\":\"$._tmp.errorInfo.errorMessage\",\"timeStarted.$\":\"$$.State.EnteredTime\"}},\"Next\":\"Create Solution Version\"},\"Save Solution Version ID\":{\"Type\":\"Pass\",\"ResultPath\":\"$._tmp\",\"Parameters\":{\"errorInfo.$\":\"States.StringToJson($.solutionVersionPending.Cause)\"},\"Next\":\"Set Solution Version ID\"},\"Prepare Solution Version Input Data\":{\"Type\":\"Pass\",\"ResultPath\":\"$.solution.solutionVersion\",\"Parameters\":{\"serviceConfig\":{\"solutionArn.$\":\"$.solution.serviceConfig.solutionArn\",\"trainingMode\":\"FULL\",\"tags.$\":\"$.solution.serviceConfig.solutionVersion.tags\"},\"workflowConfig\":{\"maxAge\":\"365 days\",\"timeStarted.$\":\"$$.State.EnteredTime\"}},\"Next\":\"Create Solution Version\"},\"Prepare Solution Version Output Data\":{\"Type\":\"Pass\",\"ResultPath\":\"$.solution.solutionVersion.serviceConfig.solutionVersionArn\",\"InputPath\":\"$._tmp.solutionVersionArn\",\"Next\":\"Create Campaigns and Batch Inference Jobs\"},\"Create Campaigns and Batch Inference Jobs\":{\"Type\":\"Parallel\",\"ResultPath\":null,\"Next\":\"Check if Solution Maintenance Full Schedule Required\",\"Branches\":[{\"StartAt\":\"Check for Campaigns\",\"States\":{\"Check for Campaigns\":{\"Type\":\"Choice\",\"Choices\":[{\"Variable\":\"$.solution.campaigns[0]\",\"IsPresent\":true,\"Next\":\"Create Campaigns\"}],\"Default\":\"Campaigns not Provided\"},\"Campaigns not Provided\":{\"Type\":\"Pass\",\"End\":true},\"Create Campaigns\":{\"Type\":\"Map\",\"End\":true,\"Parameters\":{\"solutionVersionArn.$\":\"$.solution.solutionVersion.serviceConfig.solutionVersionArn\",\"campaign.$\":\"$$.Map.Item.Value\"},\"Iterator\":{\"StartAt\":\"Prepare Campaign Input Data\",\"States\":{\"Prepare Campaign Input Data\":{\"Type\":\"Pass\",\"ResultPath\":\"$.campaign.serviceConfig.solutionVersionArn\",\"InputPath\":\"$.solutionVersionArn\",\"Next\":\"Create Campaign\"},\"Create Campaign\":{\"End\":true,\"Retry\":[{\"ErrorEquals\":[\"Lambda.ServiceException\",\"Lambda.AWSLambdaException\",\"Lambda.SdkClientException\"],\"IntervalSeconds\":2,\"MaxAttempts\":6,\"BackoffRate\":2},{\"ErrorEquals\":[\"ResourcePending\"],\"IntervalSeconds\":60,\"MaxAttempts\":100,\"BackoffRate\":1.02}],\"Type\":\"Task\",\"InputPath\":\"$.campaign\",\"OutputPath\":\"$\",\"ResultPath\":\"$.campaign.serviceConfig\",\"Resource\":\"", { "Fn::GetAtt": [ "CreateCampaignSolutionStepcreatecampaignfn5F83F6AB", "Arn" ] }, "\"}}},\"ItemsPath\":\"$.solution.campaigns\"}}},{\"StartAt\":\"Check for Batch Inference Jobs\",\"States\":{\"Check for Batch Inference Jobs\":{\"Type\":\"Choice\",\"Choices\":[{\"Variable\":\"$.solution.batchInferenceJobs[0]\",\"IsPresent\":true,\"Next\":\"Create Batch Inference Jobs\"}],\"Default\":\"Batch Inference Jobs Not Provided\"},\"Batch Inference Jobs Not Provided\":{\"Type\":\"Pass\",\"End\":true},\"Create Batch Inference Jobs\":{\"Type\":\"Map\",\"End\":true,\"Parameters\":{\"solutionVersionArn.$\":\"$.solution.solutionVersion.serviceConfig.solutionVersionArn\",\"batchInferenceJob.$\":\"$$.Map.Item.Value\",\"batchInferenceJobName.$\":\"States.Format('batch_{}_{}', $.solution.serviceConfig.name, $.currentDate)\",\"bucket.$\":\"$.bucket\",\"currentDate.$\":\"$.currentDate\",\"datasetGroupName.$\":\"$.datasetGroupName\",\"datasetGroupArn.$\":\"$.datasetGroupArn\",\"solution.$\":\"$.solution\"},\"Iterator\":{\"StartAt\":\"Set Batch Inference Job Input Data - Job Name\",\"States\":{\"Set Batch Inference Job Input Data - Job Name\":{\"Type\":\"Pass\",\"ResultPath\":\"$.batchInferenceJob.serviceConfig.jobName\",\"InputPath\":\"$.batchInferenceJobName\",\"Next\":\"Set Batch Inference Job Input Data - Solution Version ARN\"},\"Set Batch Inference Job Input Data - Solution Version ARN\":{\"Type\":\"Pass\",\"ResultPath\":\"$.batchInferenceJob.serviceConfig.solutionVersionArn\",\"InputPath\":\"$.solutionVersionArn\",\"Next\":\"Set Batch Inference Job Input Data - Job Input\"},\"Set Batch Inference Job Input Data - Job Input\":{\"Type\":\"Pass\",\"ResultPath\":\"$.batchInferenceJob.serviceConfig.jobInput\",\"Parameters\":{\"s3DataSource\":{\"path.$\":\"States.Format('s3://{}/batch/{}/{}/job_config.json', $.bucket.name, $.datasetGroupName, $.solution.serviceConfig.name)\"}},\"Next\":\"Set Batch Inference Job Input Data - Job Output\"},\"Set Batch Inference Job Input Data - Job Output\":{\"Type\":\"Pass\",\"ResultPath\":\"$.batchInferenceJob.serviceConfig.jobOutput\",\"Parameters\":{\"s3DataDestination\":{\"path.$\":\"States.Format('s3://{}/batch/{}/{}/{}/', $.bucket.name, $.datasetGroupName, $.solution.serviceConfig.name, $.batchInferenceJobName)\"}},\"Next\":\"Create Batch Inference Job\"},\"Create Batch Inference Job\":{\"Next\":\"Check if Batch Inference Schedule Required\",\"Retry\":[{\"ErrorEquals\":[\"Lambda.ServiceException\",\"Lambda.AWSLambdaException\",\"Lambda.SdkClientException\"],\"IntervalSeconds\":2,\"MaxAttempts\":6,\"BackoffRate\":2},{\"ErrorEquals\":[\"ResourcePending\"],\"IntervalSeconds\":60,\"MaxAttempts\":100,\"BackoffRate\":1.02}],\"Type\":\"Task\",\"InputPath\":\"$.batchInferenceJob\",\"OutputPath\":\"$\",\"ResultPath\":\"$.batchInferenceJob.serviceConfig\",\"Resource\":\"", { "Fn::GetAtt": [ "CreateBatchInferenceJobSolutionStepcreatebatchinferencejobfn8B4A8B4F", "Arn" ] }, "\"},\"Check if Batch Inference Schedule Required\":{\"Type\":\"Choice\",\"Choices\":[{\"Variable\":\"$.batchInferenceJob.workflowConfig.schedule\",\"IsPresent\":true,\"Next\":\"Create Schedule For Batch Inference\"}],\"Default\":\"Batch Inference Schedule Not Required\"},\"Batch Inference Schedule Not Required\":{\"Type\":\"Pass\",\"End\":true},\"Create Schedule For Batch Inference\":{\"End\":true,\"Retry\":[{\"ErrorEquals\":[\"Lambda.ServiceException\",\"Lambda.AWSLambdaException\",\"Lambda.SdkClientException\"],\"IntervalSeconds\":2,\"MaxAttempts\":6,\"BackoffRate\":2},{\"ErrorEquals\":[\"ResourcePending\"],\"IntervalSeconds\":5,\"MaxAttempts\":5,\"BackoffRate\":1.05}],\"Type\":\"Task\",\"InputPath\":\"$\",\"OutputPath\":\"$\",\"ResultPath\":null,\"Resource\":\"", { "Fn::GetAtt": [ "SchedulercreatescheduledtaskSolutionStepcreatescheduledtaskfn7FCB3878", "Arn" ] }, "\",\"Parameters\":{\"name.$\":\"States.Format('batch-inference-{}', $.solution.serviceConfig.name)\",\"schedule.$\":\"$.batchInferenceJob.workflowConfig.schedule\",\"state_machine\":{\"arn\":\"", { "Ref": "ScheduledSolutionMaintenancePeriodicSolutionMaintenance814E56C3" }, "\",\"input\":{\"bucket.$\":\"$.bucket\",\"datasetGroup\":{\"serviceConfig\":{\"name.$\":\"$.datasetGroupName\",\"datasetGroupArn.$\":\"$.datasetGroupArn\"}},\"solutions\":[{\"serviceConfig.$\":\"$.solution.serviceConfig\",\"batchInferenceJobs\":[{\"serviceConfig.$\":\"$.batchInferenceJob.serviceConfig\",\"workflowConfig\":{\"maxAge\":\"1 second\"}}]}]}}}}}},\"ItemsPath\":\"$.solution.batchInferenceJobs\"}}},{\"StartAt\":\"Check for Batch Segment Jobs\",\"States\":{\"Check for Batch Segment Jobs\":{\"Type\":\"Choice\",\"Choices\":[{\"Variable\":\"$.solution.batchSegmentJobs[0]\",\"IsPresent\":true,\"Next\":\"Create Batch Segment Jobs\"}],\"Default\":\"Batch Segment Jobs Not Provided\"},\"Batch Segment Jobs Not Provided\":{\"Type\":\"Pass\",\"End\":true},\"Create Batch Segment Jobs\":{\"Type\":\"Map\",\"End\":true,\"Parameters\":{\"solutionVersionArn.$\":\"$.solution.solutionVersion.serviceConfig.solutionVersionArn\",\"batchSegmentJob.$\":\"$$.Map.Item.Value\",\"batchSegmentJobName.$\":\"States.Format('batch_{}_{}', $.solution.serviceConfig.name, $.currentDate)\",\"bucket.$\":\"$.bucket\",\"currentDate.$\":\"$.currentDate\",\"datasetGroupName.$\":\"$.datasetGroupName\",\"datasetGroupArn.$\":\"$.datasetGroupArn\",\"solution.$\":\"$.solution\"},\"Iterator\":{\"StartAt\":\"Set Batch Segment Job Input Data - Job Name\",\"States\":{\"Set Batch Segment Job Input Data - Job Name\":{\"Type\":\"Pass\",\"ResultPath\":\"$.batchSegmentJob.serviceConfig.jobName\",\"InputPath\":\"$.batchSegmentJobName\",\"Next\":\"Set Batch Segment Job Input Data - Solution Version ARN\"},\"Set Batch Segment Job Input Data - Solution Version ARN\":{\"Type\":\"Pass\",\"ResultPath\":\"$.batchSegmentJob.serviceConfig.solutionVersionArn\",\"InputPath\":\"$.solutionVersionArn\",\"Next\":\"Set Batch Segment Job Input Data - Job Input\"},\"Set Batch Segment Job Input Data - Job Input\":{\"Type\":\"Pass\",\"ResultPath\":\"$.batchSegmentJob.serviceConfig.jobInput\",\"Parameters\":{\"s3DataSource\":{\"path.$\":\"States.Format('s3://{}/batch/{}/{}/job_config.json', $.bucket.name, $.datasetGroupName, $.solution.serviceConfig.name)\"}},\"Next\":\"Set Batch Segment Job Input Data - Job Output\"},\"Set Batch Segment Job Input Data - Job Output\":{\"Type\":\"Pass\",\"ResultPath\":\"$.batchSegmentJob.serviceConfig.jobOutput\",\"Parameters\":{\"s3DataDestination\":{\"path.$\":\"States.Format('s3://{}/batch/{}/{}/{}/', $.bucket.name, $.datasetGroupName, $.solution.serviceConfig.name, $.batchSegmentJobName)\"}},\"Next\":\"Create Batch Segment Job\"},\"Create Batch Segment Job\":{\"Next\":\"Check if Batch Segment Schedule Required\",\"Retry\":[{\"ErrorEquals\":[\"Lambda.ServiceException\",\"Lambda.AWSLambdaException\",\"Lambda.SdkClientException\"],\"IntervalSeconds\":2,\"MaxAttempts\":6,\"BackoffRate\":2},{\"ErrorEquals\":[\"ResourcePending\"],\"IntervalSeconds\":60,\"MaxAttempts\":100,\"BackoffRate\":1.02}],\"Type\":\"Task\",\"InputPath\":\"$.batchSegmentJob\",\"OutputPath\":\"$\",\"ResultPath\":\"$.batchSegmentJob.serviceConfig\",\"Resource\":\"", { "Fn::GetAtt": [ "CreateBatchSegmentJobSolutionStepcreatebatchsegmentjobfn01ACE97D", "Arn" ] }, "\"},\"Check if Batch Segment Schedule Required\":{\"Type\":\"Choice\",\"Choices\":[{\"Variable\":\"$.batchSegmentJob.workflowConfig.schedule\",\"IsPresent\":true,\"Next\":\"Create Schedule For Batch Segment\"}],\"Default\":\"Batch Segment Schedule Not Required\"},\"Batch Segment Schedule Not Required\":{\"Type\":\"Pass\",\"End\":true},\"Create Schedule For Batch Segment\":{\"End\":true,\"Retry\":[{\"ErrorEquals\":[\"Lambda.ServiceException\",\"Lambda.AWSLambdaException\",\"Lambda.SdkClientException\"],\"IntervalSeconds\":2,\"MaxAttempts\":6,\"BackoffRate\":2},{\"ErrorEquals\":[\"ResourcePending\"],\"IntervalSeconds\":5,\"MaxAttempts\":5,\"BackoffRate\":1.05}],\"Type\":\"Task\",\"InputPath\":\"$\",\"OutputPath\":\"$\",\"ResultPath\":null,\"Resource\":\"", { "Fn::GetAtt": [ "SchedulercreatescheduledtaskSolutionStepcreatescheduledtaskfn7FCB3878", "Arn" ] }, "\",\"Parameters\":{\"name.$\":\"States.Format('batch-segment-{}', $.solution.serviceConfig.name)\",\"schedule.$\":\"$.batchSegmentJob.workflowConfig.schedule\",\"state_machine\":{\"arn\":\"", { "Ref": "ScheduledSolutionMaintenancePeriodicSolutionMaintenance814E56C3" }, "\",\"input\":{\"bucket.$\":\"$.bucket\",\"datasetGroup\":{\"serviceConfig\":{\"name.$\":\"$.datasetGroupName\",\"datasetGroupArn.$\":\"$.datasetGroupArn\"}},\"solutions\":[{\"serviceConfig.$\":\"$.solution.serviceConfig\",\"batchSegmentJobs\":[{\"serviceConfig.$\":\"$.batchSegmentJob.serviceConfig\",\"workflowConfig\":{\"maxAge\":\"1 second\"}}]}]}}}}}},\"ItemsPath\":\"$.solution.batchSegmentJobs\"}}}]},\"Check if Solution Maintenance Full Schedule Required\":{\"Type\":\"Choice\",\"Choices\":[{\"Variable\":\"$.solution.workflowConfig.schedules.full\",\"IsPresent\":true,\"Next\":\"Create Schedule For Solution Maintenance Full\"}],\"Default\":\"Solution Maintenance Full Schedule Not Required\"},\"Solution Maintenance Full Schedule Not Required\":{\"Type\":\"Pass\",\"Next\":\"Check if Solution Maintenance Update Schedule Required\"},\"Check if Solution Maintenance Update Schedule Required\":{\"Type\":\"Choice\",\"Choices\":[{\"Variable\":\"$.solution.workflowConfig.schedules.update\",\"IsPresent\":true,\"Next\":\"Create Schedule For Solution Maintenance Update\"}],\"Default\":\"Solution Maintenance Update Schedule Not Required\"},\"Create Schedule For Solution Maintenance Full\":{\"Next\":\"Check if Solution Maintenance Update Schedule Required\",\"Retry\":[{\"ErrorEquals\":[\"Lambda.ServiceException\",\"Lambda.AWSLambdaException\",\"Lambda.SdkClientException\"],\"IntervalSeconds\":2,\"MaxAttempts\":6,\"BackoffRate\":2},{\"ErrorEquals\":[\"ResourcePending\"],\"IntervalSeconds\":5,\"MaxAttempts\":5,\"BackoffRate\":1.05}],\"Type\":\"Task\",\"InputPath\":\"$\",\"OutputPath\":\"$\",\"ResultPath\":null,\"Resource\":\"", { "Fn::GetAtt": [ "SchedulercreatescheduledtaskSolutionStepcreatescheduledtaskfn7FCB3878", "Arn" ] }, "\",\"Parameters\":{\"name.$\":\"States.Format('solution-maintenance-full-{}', $.solution.serviceConfig.name)\",\"schedule.$\":\"$.solution.workflowConfig.schedules.full\",\"state_machine\":{\"arn\":\"", { "Ref": "ScheduledSolutionMaintenancePeriodicSolutionMaintenance814E56C3" }, "\",\"input\":{\"bucket.$\":\"$.bucket\",\"datasetGroup\":{\"serviceConfig\":{\"name.$\":\"$.datasetGroupName\",\"datasetGroupArn.$\":\"$.datasetGroupArn\"}},\"solutions\":[{\"serviceConfig.$\":\"$.solution.serviceConfig\",\"solutionVersion\":{\"serviceConfig\":{\"trainingMode.$\":\"$.solution.serviceConfig.solutionVersion.trainingMode\",\"solutionArn.$\":\"$.solution.solutionVersion.serviceConfig.solutionArn\",\"tags.$\":\"$.solution.solutionVersion.serviceConfig.tags\"},\"workflowConfig\":{\"maxAge\":\"1 second\"}},\"campaigns.$\":\"$.solution.campaigns\"}]}}}},\"Solution Maintenance Update Schedule Not Required\":{\"Type\":\"Pass\",\"End\":true},\"Create Schedule For Solution Maintenance Update\":{\"End\":true,\"Retry\":[{\"ErrorEquals\":[\"Lambda.ServiceException\",\"Lambda.AWSLambdaException\",\"Lambda.SdkClientException\"],\"IntervalSeconds\":2,\"MaxAttempts\":6,\"BackoffRate\":2},{\"ErrorEquals\":[\"ResourcePending\"],\"IntervalSeconds\":5,\"MaxAttempts\":5,\"BackoffRate\":1.05}],\"Type\":\"Task\",\"InputPath\":\"$\",\"OutputPath\":\"$\",\"ResultPath\":null,\"Resource\":\"", { "Fn::GetAtt": [ "SchedulercreatescheduledtaskSolutionStepcreatescheduledtaskfn7FCB3878", "Arn" ] }, "\",\"Parameters\":{\"name.$\":\"States.Format('solution-maintenance-update-{}', $.solution.serviceConfig.name)\",\"schedule.$\":\"$.solution.workflowConfig.schedules.update\",\"state_machine\":{\"arn\":\"", { "Ref": "ScheduledSolutionMaintenancePeriodicSolutionMaintenance814E56C3" }, "\",\"input\":{\"bucket.$\":\"$.bucket\",\"datasetGroup\":{\"serviceConfig\":{\"name.$\":\"$.datasetGroupName\",\"datasetGroupArn.$\":\"$.datasetGroupArn\"}},\"solutions\":[{\"serviceConfig.$\":\"$.solution.serviceConfig\",\"solutionVersion\":{\"serviceConfig\":{\"trainingMode\":\"UPDATE\",\"solutionArn.$\":\"$.solution.solutionVersion.serviceConfig.solutionArn\",\"tags.$\":\"$.solution.solutionVersion.serviceConfig.tags\"},\"workflowConfig\":{\"maxAge\":\"1 second\"}},\"campaigns.$\":\"$.solution.campaigns\"}]}}}}}},\"ItemsPath\":\"$.solutions\"}}},{\"StartAt\":\"Check for Recommenders\",\"States\":{\"Check for Recommenders\":{\"Type\":\"Choice\",\"Choices\":[{\"Variable\":\"$.recommenders[0]\",\"IsPresent\":true,\"Next\":\"Create Recommenders\"}],\"Default\":\"Recommenders not Provided\"},\"Recommenders not Provided\":{\"Type\":\"Pass\",\"End\":true},\"Create Recommenders\":{\"Type\":\"Map\",\"ResultPath\":null,\"End\":true,\"Parameters\":{\"datasetGroupArn.$\":\"$.datasetGroup.serviceConfig.datasetGroupArn\",\"datasetGroupName.$\":\"$.datasetGroup.serviceConfig.name\",\"recommender.$\":\"$$.Map.Item.Value\",\"bucket.$\":\"$.bucket\",\"currentDate.$\":\"$.currentDate\"},\"Iterator\":{\"StartAt\":\"Prepare Recommender Input Data\",\"States\":{\"Prepare Recommender Input Data\":{\"Type\":\"Pass\",\"ResultPath\":\"$.recommender.serviceConfig.datasetGroupArn\",\"InputPath\":\"$.datasetGroupArn\",\"Next\":\"Create Recommender\"},\"Create Recommender\":{\"End\":true,\"Retry\":[{\"ErrorEquals\":[\"Lambda.ServiceException\",\"Lambda.AWSLambdaException\",\"Lambda.SdkClientException\"],\"IntervalSeconds\":2,\"MaxAttempts\":6,\"BackoffRate\":2},{\"ErrorEquals\":[\"ResourcePending\"],\"IntervalSeconds\":60,\"MaxAttempts\":100,\"BackoffRate\":1.02}],\"Type\":\"Task\",\"InputPath\":\"$.recommender\",\"OutputPath\":\"$\",\"ResultPath\":\"$._tmp\",\"ResultSelector\":{\"recommenderArn.$\":\"$.recommenderArn\"},\"Resource\":\"", { "Fn::GetAtt": [ "CreateRecommenderSolutionStepcreaterecommenderfnF63FF7BD", "Arn" ] }, "\"}}},\"ItemsPath\":\"$.recommenders\"}}}]},\"Create Filters\":{\"Type\":\"Map\",\"ResultPath\":null,\"Next\":\"Recommenders and Solutions\",\"Parameters\":{\"datasetGroupArn.$\":\"$.datasetGroup.serviceConfig.datasetGroupArn\",\"filter.$\":\"$$.Map.Item.Value\"},\"Iterator\":{\"StartAt\":\"Prepare Filter Input Data\",\"States\":{\"Prepare Filter Input Data\":{\"Type\":\"Pass\",\"ResultPath\":\"$.filter.serviceConfig.datasetGroupArn\",\"InputPath\":\"$.datasetGroupArn\",\"Next\":\"Create Filter\"},\"Create Filter\":{\"End\":true,\"Retry\":[{\"ErrorEquals\":[\"Lambda.ServiceException\",\"Lambda.AWSLambdaException\",\"Lambda.SdkClientException\"],\"IntervalSeconds\":2,\"MaxAttempts\":6,\"BackoffRate\":2},{\"ErrorEquals\":[\"ResourcePending\"],\"IntervalSeconds\":8,\"MaxAttempts\":15,\"BackoffRate\":1.25}],\"Type\":\"Task\",\"InputPath\":\"$.filter\",\"OutputPath\":\"$\",\"ResultPath\":\"$\",\"Resource\":\"", { "Fn::GetAtt": [ "CreateFilterSolutionStepcreatefilterfnF2859FD9", "Arn" ] }, "\"}}},\"ItemsPath\":\"$.filters\"}}}]},\"Success\":{\"End\":true,\"Retry\":[{\"ErrorEquals\":[\"Lambda.ServiceException\",\"Lambda.AWSLambdaException\",\"Lambda.SdkClientException\"],\"IntervalSeconds\":2,\"MaxAttempts\":6,\"BackoffRate\":2},{\"ErrorEquals\":[\"ResourcePending\"],\"IntervalSeconds\":5,\"MaxAttempts\":5,\"BackoffRate\":1.05}],\"Type\":\"Task\",\"InputPath\":\"$\",\"OutputPath\":\"$\",\"ResultPath\":\"$\",\"Resource\":\"", { "Fn::GetAtt": [ "SNSNotificationSolutionStepsnsnotificationfn6973DEFB", "Arn" ] }, "\",\"Parameters\":{\"datasetGroup.$\":\"$[0].datasetGroup.serviceConfig.name\"}},\"Send Failure Message\":{\"Next\":\"Failure\",\"Retry\":[{\"ErrorEquals\":[\"Lambda.ServiceException\",\"Lambda.AWSLambdaException\",\"Lambda.SdkClientException\"],\"IntervalSeconds\":2,\"MaxAttempts\":6,\"BackoffRate\":2},{\"ErrorEquals\":[\"ResourcePending\"],\"IntervalSeconds\":5,\"MaxAttempts\":5,\"BackoffRate\":1.05}],\"Type\":\"Task\",\"InputPath\":\"$\",\"OutputPath\":\"$\",\"ResultPath\":\"$\",\"Resource\":\"", { "Fn::GetAtt": [ "SNSNotificationSolutionStepsnsnotificationfn6973DEFB", "Arn" ] }, "\",\"Parameters\":{\"datasetGroup.$\":\"$.datasetGroup.serviceConfig.name\",\"statesError.$\":\"$.statesError\"}},\"Failure\":{\"Type\":\"Fail\"}}}" ] ] }, "RoleArn": { "Fn::GetAtt": [ "PersonalizeStateMachineRole801F53E1", "Arn" ] }, "StateMachineName": { "Fn::GetAtt": [ "StateMachineNameStateMachineNameNameResource5B98B370", "Name" ] }, "Tags": [ { "Key": "SOLUTION_ID", "Value": "SO0170" }, { "Key": "SOLUTION_NAME", "Value": "maintaining-personalized-experiences-with-machine-learning" }, { "Key": "SOLUTION_VERSION", "Value": "v1.5.0" } ], "TracingConfiguration": { "Enabled": true } }, "DependsOn": [ "PersonalizeStateMachineRoleDefaultPolicy849E454B", "PersonalizeStateMachineRole801F53E1" ], "UpdateReplacePolicy": "Delete", "DeletionPolicy": "Delete", "Metadata": { "cdk_nag": { "rules_to_suppress": [ { "reason": "Information required for troubleshooting is logged by state function and lambda functions", "id": "AwsSolutions-SF1" }, { "reason": "All IAM policies defined in this solutiongrant only least-privilege permissions. Wildcard for resources is used only for serviceswhich do not have a resource arn", "id": "AwsSolutions-IAM5" }, { "reason": "We use AWS managed policies and do not need tochange as the \"*\" in resource is due to circular dependency.", "id": "AwsSolutions-IAM4" } ] } } }, "S3EventHandlerRole822B3D57": { "Type": "AWS::IAM::Role", "Properties": { "AssumeRolePolicyDocument": { "Statement": [ { "Action": "sts:AssumeRole", "Effect": "Allow", "Principal": { "Service": "lambda.amazonaws.com" } } ], "Version": "2012-10-17" }, "Policies": [ { "PolicyDocument": { "Statement": [ { "Action": [ "logs:CreateLogGroup", "logs:CreateLogStream", "logs:PutLogEvents" ], "Effect": "Allow", "Resource": { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":logs:", { "Ref": "AWS::Region" }, ":", { "Ref": "AWS::AccountId" }, ":log-group:/aws/lambda/*" ] ] } } ], "Version": "2012-10-17" }, "PolicyName": "LambdaFunctionServiceRolePolicy" } ], "Tags": [ { "Key": "SOLUTION_ID", "Value": "SO0170" }, { "Key": "SOLUTION_NAME", "Value": "maintaining-personalized-experiences-with-machine-learning" }, { "Key": "SOLUTION_VERSION", "Value": "v1.5.0" } ] }, "Metadata": { "guard": { "SuppressedRules": [ "IAM_NO_INLINE_POLICY_CHECK" ] }, "cdk_nag": { "rules_to_suppress": [ { "reason": "All IAM policies defined in this solutiongrant only least-privilege permissions. Wildcard for resources is used only for serviceswhich do not have a resource arn", "id": "AwsSolutions-IAM5" }, { "reason": "We use AWS managed policies and do not need tochange as the \"*\" in resource is due to circular dependency.", "id": "AwsSolutions-IAM4" } ] } } }, "S3EventHandlerRoleDefaultPolicy4200EF33": { "Type": "AWS::IAM::Policy", "Properties": { "PolicyDocument": { "Statement": [ { "Action": [ "xray:PutTraceSegments", "xray:PutTelemetryRecords" ], "Effect": "Allow", "Resource": "*" }, { "Action": [ "s3:GetObject*", "s3:GetBucket*", "s3:List*" ], "Effect": "Allow", "Resource": [ { "Fn::GetAtt": [ "PersonalizeBucket", "Arn" ] }, { "Fn::Join": [ "", [ { "Fn::GetAtt": [ "PersonalizeBucket", "Arn" ] }, "/train/*" ] ] } ] }, { "Action": "states:StartExecution", "Effect": "Allow", "Resource": { "Ref": "PersonalizeStateMachine739DC329" } }, { "Action": "sns:Publish", "Effect": "Allow", "Resource": { "Ref": "NotificationTopic" } } ], "Version": "2012-10-17" }, "PolicyName": "S3EventHandlerRoleDefaultPolicy4200EF33", "Roles": [ { "Ref": "S3EventHandlerRole822B3D57" } ] }, "Metadata": { "cfn_nag": { "rules_to_suppress": [ { "id": "W12", "reason": "IAM policy for AWS X-Ray requires an allow on *" } ] }, "cdk_nag": { "rules_to_suppress": [ { "reason": "All IAM policies defined in this solutiongrant only least-privilege permissions. Wildcard for resources is used only for serviceswhich do not have a resource arn", "id": "AwsSolutions-IAM5" }, { "reason": "We use AWS managed policies and do not need tochange as the \"*\" in resource is due to circular dependency.", "id": "AwsSolutions-IAM4" } ] } } }, "S3EventHandlerBAFC08A8": { "Type": "AWS::Lambda::Function", "Properties": { "Code": { "S3Bucket": { "Fn::Join": [ "-", [ { "Fn::FindInMap": [ "SourceCode", "General", "S3Bucket" ] }, { "Ref": "AWS::Region" } ] ] }, "S3Key": { "Fn::Join": [ "/", [ { "Fn::FindInMap": [ "SourceCode", "General", "KeyPrefix" ] }, "S3EventHandlerBAFC08A8.zip" ] ] } }, "Environment": { "Variables": { "SOLUTION_NAME": "maintaining-personalized-experiences-with-machine-learning", "SOLUTION_ID": "SO0170", "SOLUTION_VERSION": "v1.5.0", "LOG_LEVEL": "INFO", "POWERTOOLS_SERVICE_NAME": "Workflow", "POWERTOOLS_METRICS_NAMESPACE": { "Fn::Join": [ "", [ "personalize_solution_", { "Ref": "AWS::StackName" } ] ] }, "STATE_MACHINE_ARN": { "Ref": "PersonalizeStateMachine739DC329" }, "SNS_TOPIC_ARN": { "Ref": "NotificationTopic" } } }, "Handler": "handler.lambda_handler", "Layers": [ { "Ref": "PowertoolsLayer8E932F0F197D4026A35423D184C2A624D967C184" }, { "Ref": "SolutionsLayerDAE8E12F3DEA43FBA4AAE55AC50BD2E9B9D361F0" } ], "Role": { "Fn::GetAtt": [ "S3EventHandlerRole822B3D57", "Arn" ] }, "Runtime": "python3.11", "Tags": [ { "Key": "SOLUTION_ID", "Value": "SO0170" }, { "Key": "SOLUTION_NAME", "Value": "maintaining-personalized-experiences-with-machine-learning" }, { "Key": "SOLUTION_VERSION", "Value": "v1.5.0" } ], "Timeout": 15, "TracingConfig": { "Mode": "Active" } }, "DependsOn": [ "S3EventHandlerRoleDefaultPolicy4200EF33", "S3EventHandlerRole822B3D57" ], "Metadata": { "cfn_nag": { "rules_to_suppress": [ { "id": "W89", "reason": "functions deployed by this solution do not require VPC access" }, { "id": "W92", "reason": "functions deployed by this solution do not require reserved concurrency" }, { "id": "W58", "reason": "functions deployed by this solution use custom policy to write to CloudWatch logs" } ] } } }, "BucketNotificationsHandler050a0587b7544547bf325f094a3db834RoleB6FB88EC": { "Type": "AWS::IAM::Role", "Properties": { "AssumeRolePolicyDocument": { "Statement": [ { "Action": "sts:AssumeRole", "Effect": "Allow", "Principal": { "Service": "lambda.amazonaws.com" } } ], "Version": "2012-10-17" }, "ManagedPolicyArns": [ { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":iam::aws:policy/service-role/AWSLambdaBasicExecutionRole" ] ] } ], "Tags": [ { "Key": "SOLUTION_ID", "Value": "SO0170" }, { "Key": "SOLUTION_NAME", "Value": "maintaining-personalized-experiences-with-machine-learning" }, { "Key": "SOLUTION_VERSION", "Value": "v1.5.0" } ] }, "Metadata": { "cdk_nag": { "rules_to_suppress": [ { "reason": "All IAM policies defined in this solutiongrant only least-privilege permissions. Wildcard for resources is used only for serviceswhich do not have a resource arn", "id": "AwsSolutions-IAM5" }, { "reason": "We use AWS managed policies and do not need tochange as the \"*\" in resource is due to circular dependency.", "id": "AwsSolutions-IAM4" } ] } } }, "BucketNotificationsHandler050a0587b7544547bf325f094a3db834RoleDefaultPolicy2CF63D36": { "Type": "AWS::IAM::Policy", "Properties": { "PolicyDocument": { "Statement": [ { "Action": "s3:PutBucketNotification", "Effect": "Allow", "Resource": "*" } ], "Version": "2012-10-17" }, "PolicyName": "BucketNotificationsHandler050a0587b7544547bf325f094a3db834RoleDefaultPolicy2CF63D36", "Roles": [ { "Ref": "BucketNotificationsHandler050a0587b7544547bf325f094a3db834RoleB6FB88EC" } ] }, "Metadata": { "cfn_nag": { "rules_to_suppress": [ { "id": "W12", "reason": "bucket resource is '*' due to circular dependency with bucket and role creation at the same time" } ] }, "cdk_nag": { "rules_to_suppress": [ { "reason": "All IAM policies defined in this solutiongrant only least-privilege permissions. Wildcard for resources is used only for serviceswhich do not have a resource arn", "id": "AwsSolutions-IAM5" }, { "reason": "We use AWS managed policies and do not need tochange as the \"*\" in resource is due to circular dependency.", "id": "AwsSolutions-IAM4" } ] } } }, "BucketNotificationsHandler050a0587b7544547bf325f094a3db8347ECC3691": { "Type": "AWS::Lambda::Function", "Properties": { "Description": "AWS CloudFormation handler for \"Custom::S3BucketNotifications\" resources (@aws-cdk/aws-s3)", "Code": { "ZipFile": "import boto3 # type: ignore\nimport json\nimport logging\nimport urllib.request\n\ns3 = boto3.client(\"s3\")\n\nEVENTBRIDGE_CONFIGURATION = 'EventBridgeConfiguration'\n\nCONFIGURATION_TYPES = [\"TopicConfigurations\", \"QueueConfigurations\", \"LambdaFunctionConfigurations\"]\n\ndef handler(event: dict, context):\n response_status = \"SUCCESS\"\n error_message = \"\"\n try:\n props = event[\"ResourceProperties\"]\n bucket = props[\"BucketName\"]\n notification_configuration = props[\"NotificationConfiguration\"]\n request_type = event[\"RequestType\"]\n managed = props.get('Managed', 'true').lower() == 'true'\n stack_id = event['StackId']\n\n if managed:\n config = handle_managed(request_type, notification_configuration)\n else:\n config = handle_unmanaged(bucket, stack_id, request_type, notification_configuration)\n\n put_bucket_notification_configuration(bucket, config)\n except Exception as e:\n logging.exception(\"Failed to put bucket notification configuration\")\n response_status = \"FAILED\"\n error_message = f\"Error: {str(e)}. \"\n finally:\n submit_response(event, context, response_status, error_message)\n\ndef handle_managed(request_type, notification_configuration):\n if request_type == 'Delete':\n return {}\n return notification_configuration\n\ndef handle_unmanaged(bucket, stack_id, request_type, notification_configuration):\n external_notifications = find_external_notifications(bucket, stack_id)\n\n if request_type == 'Delete':\n return external_notifications\n\n def with_id(notification):\n notification['Id'] = f\"{stack_id}-{hash(json.dumps(notification, sort_keys=True))}\"\n return notification\n\n notifications = {}\n for t in CONFIGURATION_TYPES:\n external = external_notifications.get(t, [])\n incoming = [with_id(n) for n in notification_configuration.get(t, [])]\n notifications[t] = external + incoming\n\n if EVENTBRIDGE_CONFIGURATION in notification_configuration:\n notifications[EVENTBRIDGE_CONFIGURATION] = notification_configuration[EVENTBRIDGE_CONFIGURATION]\n elif EVENTBRIDGE_CONFIGURATION in external_notifications:\n notifications[EVENTBRIDGE_CONFIGURATION] = external_notifications[EVENTBRIDGE_CONFIGURATION]\n\n return notifications\n\ndef find_external_notifications(bucket, stack_id):\n existing_notifications = get_bucket_notification_configuration(bucket)\n external_notifications = {}\n for t in CONFIGURATION_TYPES:\n external_notifications[t] = [n for n in existing_notifications.get(t, []) if not n['Id'].startswith(f\"{stack_id}-\")]\n\n if EVENTBRIDGE_CONFIGURATION in existing_notifications:\n external_notifications[EVENTBRIDGE_CONFIGURATION] = existing_notifications[EVENTBRIDGE_CONFIGURATION]\n\n return external_notifications\n\ndef get_bucket_notification_configuration(bucket):\n return s3.get_bucket_notification_configuration(Bucket=bucket)\n\ndef put_bucket_notification_configuration(bucket, notification_configuration):\n s3.put_bucket_notification_configuration(Bucket=bucket, NotificationConfiguration=notification_configuration)\n\ndef submit_response(event: dict, context, response_status: str, error_message: str):\n response_body = json.dumps(\n {\n \"Status\": response_status,\n \"Reason\": f\"{error_message}See the details in CloudWatch Log Stream: {context.log_stream_name}\",\n \"PhysicalResourceId\": event.get(\"PhysicalResourceId\") or event[\"LogicalResourceId\"],\n \"StackId\": event[\"StackId\"],\n \"RequestId\": event[\"RequestId\"],\n \"LogicalResourceId\": event[\"LogicalResourceId\"],\n \"NoEcho\": False,\n }\n ).encode(\"utf-8\")\n headers = {\"content-type\": \"\", \"content-length\": str(len(response_body))}\n try:\n req = urllib.request.Request(url=event[\"ResponseURL\"], headers=headers, data=response_body, method=\"PUT\")\n with urllib.request.urlopen(req) as response:\n print(response.read().decode(\"utf-8\"))\n print(\"Status code: \" + response.reason)\n except Exception as e:\n print(\"send(..) failed executing request.urlopen(..): \" + str(e))\n" }, "Handler": "index.handler", "Role": { "Fn::GetAtt": [ "BucketNotificationsHandler050a0587b7544547bf325f094a3db834RoleB6FB88EC", "Arn" ] }, "Runtime": "python3.11", "Timeout": 300, "Tags": [ { "Key": "SOLUTION_ID", "Value": "SO0170" }, { "Key": "SOLUTION_NAME", "Value": "maintaining-personalized-experiences-with-machine-learning" }, { "Key": "SOLUTION_VERSION", "Value": "v1.5.0" } ] }, "DependsOn": [ "BucketNotificationsHandler050a0587b7544547bf325f094a3db834RoleDefaultPolicy2CF63D36", "BucketNotificationsHandler050a0587b7544547bf325f094a3db834RoleB6FB88EC" ], "Metadata": { "cdk_nag": { "rules_to_suppress": [ { "reason": "All IAM policies defined in this solutiongrant only least-privilege permissions. Wildcard for resources is used only for serviceswhich do not have a resource arn", "id": "AwsSolutions-IAM5" }, { "reason": "We use AWS managed policies and do not need tochange as the \"*\" in resource is due to circular dependency.", "id": "AwsSolutions-IAM4" } ] }, "cfn_nag": { "rules_to_suppress": [ { "id": "W89", "reason": "functions deployed by this solution do not require VPC access" }, { "id": "W92", "reason": "functions deployed by this solution do not require reserved concurrency" }, { "id": "W58", "reason": "functions deployed by this solution use custom policy to write to CloudWatch logs" } ] } } }, "PersonalizeDashboard8555BE0F": { "Type": "AWS::CloudWatch::Dashboard", "Properties": { "DashboardBody": { "Fn::Join": [ "", [ "{\"start\":\"-PT1D\",\"periodOverride\":\"auto\",\"widgets\":[{\"type\":\"metric\",\"width\":12,\"height\":3,\"x\":0,\"y\":0,\"properties\":{\"view\":\"singleValue\",\"title\":\"Personalization Configurations Processed\",\"region\":\"", { "Ref": "AWS::Region" }, "\",\"metrics\":[[\"personalize_solution_", { "Ref": "AWS::StackName" }, "\",\"ConfigurationsProcessed\",\"service\",\"Workflow\",{\"color\":\"#4682b4\",\"label\":\"Processed\",\"stat\":\"Sum\"}],[\"personalize_solution_", { "Ref": "AWS::StackName" }, "\",\"ConfigurationsProcessedSuccesses\",\"service\",\"Workflow\",{\"color\":\"#32cd32\",\"label\":\"Succeeded\",\"stat\":\"Sum\"}],[\"personalize_solution_", { "Ref": "AWS::StackName" }, "\",\"ConfigurationsProcessedFailures\",\"service\",\"Workflow\",{\"color\":\"#ff4500\",\"label\":\"Failures\",\"stat\":\"Sum\"}]],\"setPeriodToTimeRange\":true}},{\"type\":\"metric\",\"width\":12,\"height\":3,\"x\":0,\"y\":3,\"properties\":{\"view\":\"singleValue\",\"title\":\"Personalization Workflow Status\",\"region\":\"", { "Ref": "AWS::Region" }, "\",\"metrics\":[[\"personalize_solution_", { "Ref": "AWS::StackName" }, "\",\"JobSuccess\",\"service\",\"Workflow\",{\"color\":\"#32cd32\",\"label\":\"Workflow Jobs Succeeded\",\"stat\":\"Sum\"}],[\"personalize_solution_", { "Ref": "AWS::StackName" }, "\",\"JobFailure\",\"service\",\"Workflow\",{\"color\":\"#ff4500\",\"label\":\"Workflow Jobs Failed\",\"stat\":\"Sum\"}],[\"personalize_solution_", { "Ref": "AWS::StackName" }, "\",\"JobsCreated\",\"service\",\"Scheduler\",{\"color\":\"#32cd32\",\"label\":\"Scheduler Jobs Created\",\"stat\":\"Sum\"}],[\"personalize_solution_", { "Ref": "AWS::StackName" }, "\",\"JobsDeleted\",\"service\",\"Scheduler\",{\"color\":\"#ff4500\",\"label\":\"Scheduler Jobs Deleted\",\"stat\":\"Sum\"}]],\"setPeriodToTimeRange\":true}},{\"type\":\"metric\",\"width\":12,\"height\":9,\"x\":0,\"y\":6,\"properties\":{\"view\":\"singleValue\",\"title\":\"Amazon Personalize Resources Created\",\"region\":\"", { "Ref": "AWS::Region" }, "\",\"metrics\":[[\"personalize_solution_", { "Ref": "AWS::StackName" }, "\",\"DatasetGroupCreated\",\"service\",\"Workflow\",{\"label\":\"Dataset Groups Created\",\"stat\":\"Sum\"}],[\"personalize_solution_", { "Ref": "AWS::StackName" }, "\",\"DatasetCreated\",\"service\",\"Workflow\",{\"label\":\"Datasets Created\",\"stat\":\"Sum\"}],[\"personalize_solution_", { "Ref": "AWS::StackName" }, "\",\"EventTrackerCreated\",\"service\",\"Workflow\",{\"label\":\"Event Trackers Created\",\"stat\":\"Sum\"}],[\"personalize_solution_", { "Ref": "AWS::StackName" }, "\",\"SolutionCreated\",\"service\",\"Workflow\",{\"label\":\"Solutions Created\",\"stat\":\"Sum\"}],[\"personalize_solution_", { "Ref": "AWS::StackName" }, "\",\"SolutionVersionCreated\",\"service\",\"Workflow\",{\"label\":\"Solution Versions Created\",\"stat\":\"Sum\"}],[\"personalize_solution_", { "Ref": "AWS::StackName" }, "\",\"CampaignCreated\",\"service\",\"Workflow\",{\"label\":\"Campaigns Created\",\"stat\":\"Sum\"}],[\"personalize_solution_", { "Ref": "AWS::StackName" }, "\",\"BatchInferenceJobCreated\",\"service\",\"Workflow\",{\"label\":\"Batch Inference Jobs Created\",\"stat\":\"Sum\"}],[\"personalize_solution_", { "Ref": "AWS::StackName" }, "\",\"BatchSegmentJobCreated\",\"service\",\"Workflow\",{\"label\":\"Batch Segment Jobs Created\",\"stat\":\"Sum\"}],[\"personalize_solution_", { "Ref": "AWS::StackName" }, "\",\"RecommenderCreated\",\"service\",\"Workflow\",{\"label\":\"Recommenders Created\",\"stat\":\"Sum\"}],[\"personalize_solution_", { "Ref": "AWS::StackName" }, "\",\"FilterCreated\",\"service\",\"Workflow\",{\"label\":\"Filters Created\",\"stat\":\"Sum\"}]],\"setPeriodToTimeRange\":true}},{\"type\":\"text\",\"width\":6,\"height\":6,\"x\":12,\"y\":0,\"properties\":{\"markdown\":\"\\n# Quick Links\\n\\n| Link | Description | \\n|-|-|\\n|[button:primary:Personalize](https://console.aws.amazon.com/personalize/home?region=", { "Ref": "AWS::Region" }, "#datasetGroups)|Check the status of your managed resources in Amazon Personalize|\\n|[button:primary:S3](https://s3.console.aws.amazon.com/s3/buckets/", { "Ref": "PersonalizeBucket" }, "?region=", { "Ref": "AWS::Region" }, "&tab=objects)|Upload your workflow configuration and personalization data to S3 to trigger workflows|\\n|[button:primary:Scheduler](https://console.aws.amazon.com/states/home?region=", { "Ref": "AWS::Region" }, "#/statemachines/view/arn:", { "Ref": "AWS::Partition" }, ":states:", { "Ref": "AWS::Region" }, ":", { "Ref": "AWS::AccountId" }, ":stateMachine:", { "Fn::GetAtt": [ "SchedulerSchedulerStateMachineNameSchedulerStateMachineNameNameResource958C6532", "Name" ] }, "?statusFilter=RUNNING)|Check out the running scheduler jobs for your personalization workflow |\\n\"}}]}" ] ] }, "DashboardName": { "Fn::Join": [ "", [ "PersonalizeSolution-", { "Ref": "AWS::StackName" }, "-", { "Ref": "AWS::Region" } ] ] } } }, "MetricsMetricsFunctionRoleA9C05594": { "Type": "AWS::IAM::Role", "Properties": { "AssumeRolePolicyDocument": { "Statement": [ { "Action": "sts:AssumeRole", "Effect": "Allow", "Principal": { "Service": "lambda.amazonaws.com" } } ], "Version": "2012-10-17" }, "Policies": [ { "PolicyDocument": { "Statement": [ { "Action": [ "logs:CreateLogGroup", "logs:CreateLogStream", "logs:PutLogEvents" ], "Effect": "Allow", "Resource": { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":logs:", { "Ref": "AWS::Region" }, ":", { "Ref": "AWS::AccountId" }, ":log-group:/aws/lambda/*" ] ] } } ], "Version": "2012-10-17" }, "PolicyName": "LambdaFunctionServiceRolePolicy" } ], "Tags": [ { "Key": "SOLUTION_ID", "Value": "SO0170" }, { "Key": "SOLUTION_NAME", "Value": "maintaining-personalized-experiences-with-machine-learning" }, { "Key": "SOLUTION_VERSION", "Value": "v1.5.0" } ] }, "Metadata": { "guard": { "SuppressedRules": [ "IAM_NO_INLINE_POLICY_CHECK" ] }, "cdk_nag": { "rules_to_suppress": [ { "reason": "All IAM policies defined in this solutiongrant only least-privilege permissions. Wild card for resources is used only for services which do not have a resource arn", "id": "AwsSolutions-IAM5" } ] } } }, "MetricsMetricsFunctionD6992891": { "Type": "AWS::Lambda::Function", "Properties": { "Code": { "S3Bucket": { "Fn::Join": [ "-", [ { "Fn::FindInMap": [ "SourceCode", "General", "S3Bucket" ] }, { "Ref": "AWS::Region" } ] ] }, "S3Key": { "Fn::Join": [ "/", [ { "Fn::FindInMap": [ "SourceCode", "General", "KeyPrefix" ] }, "MetricsMetricsFunctionD6992891.zip" ] ] } }, "Handler": "metrics.handler", "Role": { "Fn::GetAtt": [ "MetricsMetricsFunctionRoleA9C05594", "Arn" ] }, "Runtime": "python3.11", "Tags": [ { "Key": "SOLUTION_ID", "Value": "SO0170" }, { "Key": "SOLUTION_NAME", "Value": "maintaining-personalized-experiences-with-machine-learning" }, { "Key": "SOLUTION_VERSION", "Value": "v1.5.0" } ] }, "DependsOn": [ "MetricsMetricsFunctionRoleA9C05594" ], "Metadata": { "cfn_nag": { "rules_to_suppress": [ { "id": "W89", "reason": "functions deployed by this solution do not require VPC access" }, { "id": "W92", "reason": "functions deployed by this solution do not require reserved concurrency" }, { "id": "W58", "reason": "functions deployed by this solution use custom policy to write to CloudWatch logs" } ] }, "cdk_nag": { "rules_to_suppress": [ { "reason": "All IAM policies defined in this solutiongrant only least-privilege permissions. Wild card for resources is used only for services which do not have a resource arn", "id": "AwsSolutions-IAM5" } ] } } }, "SolutionMetricsAnonymousData": { "Type": "Custom::AnonymousData", "Properties": { "ServiceToken": { "Fn::GetAtt": [ "MetricsMetricsFunctionD6992891", "Arn" ] }, "Solution": "SO0170", "Version": "v1.5.0", "Region": { "Ref": "AWS::Region" } }, "Metadata": { "cdk_nag": { "rules_to_suppress": [ { "reason": "All IAM policies defined in this solutiongrant only least-privilege permissions. Wild card for resources is used only for services which do not have a resource arn", "id": "AwsSolutions-IAM5" } ] } }, "Condition": "SendAnonymousUsageData" } }, "Outputs": { "PersonalizeBucketName": { "Value": { "Ref": "PersonalizeBucket" }, "Export": { "Name": { "Fn::Join": [ "", [ { "Ref": "AWS::StackName" }, "-PersonalizeBucketName" ] ] } } }, "SchedulerTableName": { "Value": { "Ref": "PersonalizeScheduledTasks" }, "Export": { "Name": { "Fn::Join": [ "", [ { "Ref": "AWS::StackName" }, "-SchedulerTableName" ] ] } } }, "SchedulerStepFunctionArn": { "Value": { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":states:", { "Ref": "AWS::Region" }, ":", { "Ref": "AWS::AccountId" }, ":stateMachine:", { "Fn::GetAtt": [ "SchedulerSchedulerStateMachineNameSchedulerStateMachineNameNameResource958C6532", "Name" ] } ] ] }, "Export": { "Name": { "Fn::Join": [ "", [ { "Ref": "AWS::StackName" }, "-SchedulerStepFunctionArn" ] ] } } }, "Dashboard": { "Value": { "Ref": "PersonalizeDashboard8555BE0F" }, "Export": { "Name": { "Fn::Join": [ "", [ { "Ref": "AWS::StackName" }, "-Dashboard" ] ] } } }, "SNSTopicArn": { "Value": { "Ref": "NotificationTopic" }, "Export": { "Name": { "Fn::Join": [ "", [ { "Ref": "AWS::StackName" }, "-SNSTopicArn" ] ] } } }, "EventBusArn": { "Value": { "Fn::GetAtt": [ "Notifications87298708", "Arn" ] }, "Export": { "Name": { "Fn::Join": [ "", [ { "Ref": "AWS::StackName" }, "-EventBusArn" ] ] } } }, "CreateConfigFunctionArn": { "Value": { "Fn::GetAtt": [ "CreateConfigF36C02E3", "Arn" ] }, "Export": { "Name": { "Fn::Join": [ "", [ { "Ref": "AWS::StackName" }, "-CreateConfigFunctionArn" ] ] } } } } }