{ "Resources": { "evtfhss3customlogbucketKinesisFirehoseToS3S3LoggingBucketAA70EACF": { "Type": "AWS::S3::Bucket", "Properties": { "BucketEncryption": { "ServerSideEncryptionConfiguration": [ { "ServerSideEncryptionByDefault": { "SSEAlgorithm": "AES256" } } ] }, "LifecycleConfiguration": { "Rules": [ { "Status": "Enabled", "Transitions": [ { "StorageClass": "GLACIER", "TransitionInDays": 7 } ] } ] }, "PublicAccessBlockConfiguration": { "BlockPublicAcls": true, "BlockPublicPolicy": true, "IgnorePublicAcls": true, "RestrictPublicBuckets": true }, "Tags": [ { "Key": "aws-cdk:auto-delete-objects", "Value": "true" } ], "VersioningConfiguration": { "Status": "Enabled" } }, "UpdateReplacePolicy": "Delete", "DeletionPolicy": "Delete", "Metadata": { "cfn_nag": { "rules_to_suppress": [ { "id": "W35", "reason": "This S3 bucket is used as the access logging bucket for another bucket" } ] } } }, "evtfhss3customlogbucketKinesisFirehoseToS3S3LoggingBucketPolicy4452CB71": { "Type": "AWS::S3::BucketPolicy", "Properties": { "Bucket": { "Ref": "evtfhss3customlogbucketKinesisFirehoseToS3S3LoggingBucketAA70EACF" }, "PolicyDocument": { "Statement": [ { "Action": "s3:*", "Condition": { "Bool": { "aws:SecureTransport": "false" } }, "Effect": "Deny", "Principal": { "AWS": "*" }, "Resource": [ { "Fn::GetAtt": [ "evtfhss3customlogbucketKinesisFirehoseToS3S3LoggingBucketAA70EACF", "Arn" ] }, { "Fn::Join": [ "", [ { "Fn::GetAtt": [ "evtfhss3customlogbucketKinesisFirehoseToS3S3LoggingBucketAA70EACF", "Arn" ] }, "/*" ] ] } ] }, { "Action": [ "s3:DeleteObject*", "s3:GetBucket*", "s3:List*", "s3:PutBucketPolicy" ], "Effect": "Allow", "Principal": { "AWS": { "Fn::GetAtt": [ "CustomS3AutoDeleteObjectsCustomResourceProviderRole3B1BD092", "Arn" ] } }, "Resource": [ { "Fn::GetAtt": [ "evtfhss3customlogbucketKinesisFirehoseToS3S3LoggingBucketAA70EACF", "Arn" ] }, { "Fn::Join": [ "", [ { "Fn::GetAtt": [ "evtfhss3customlogbucketKinesisFirehoseToS3S3LoggingBucketAA70EACF", "Arn" ] }, "/*" ] ] } ] }, { "Action": "s3:PutObject", "Condition": { "ArnLike": { "aws:SourceArn": { "Fn::GetAtt": [ "evtfhss3customlogbucketKinesisFirehoseToS3S3Bucket4B282A91", "Arn" ] } }, "StringEquals": { "aws:SourceAccount": { "Ref": "AWS::AccountId" } } }, "Effect": "Allow", "Principal": { "Service": "logging.s3.amazonaws.com" }, "Resource": { "Fn::Join": [ "", [ { "Fn::GetAtt": [ "evtfhss3customlogbucketKinesisFirehoseToS3S3LoggingBucketAA70EACF", "Arn" ] }, "/*" ] ] } } ], "Version": "2012-10-17" } } }, "evtfhss3customlogbucketKinesisFirehoseToS3S3LoggingBucketAutoDeleteObjectsCustomResource555FE86B": { "Type": "Custom::S3AutoDeleteObjects", "Properties": { "ServiceToken": { "Fn::GetAtt": [ "CustomS3AutoDeleteObjectsCustomResourceProviderHandler9D90184F", "Arn" ] }, "BucketName": { "Ref": "evtfhss3customlogbucketKinesisFirehoseToS3S3LoggingBucketAA70EACF" } }, "DependsOn": [ "evtfhss3customlogbucketKinesisFirehoseToS3S3LoggingBucketPolicy4452CB71" ], "UpdateReplacePolicy": "Delete", "DeletionPolicy": "Delete" }, "evtfhss3customlogbucketKinesisFirehoseToS3S3Bucket4B282A91": { "Type": "AWS::S3::Bucket", "Properties": { "BucketEncryption": { "ServerSideEncryptionConfiguration": [ { "ServerSideEncryptionByDefault": { "SSEAlgorithm": "AES256" } } ] }, "LifecycleConfiguration": { "Rules": [ { "NoncurrentVersionTransitions": [ { "StorageClass": "GLACIER", "TransitionInDays": 90 } ], "Status": "Enabled" } ] }, "LoggingConfiguration": { "DestinationBucketName": { "Ref": "evtfhss3customlogbucketKinesisFirehoseToS3S3LoggingBucketAA70EACF" } }, "PublicAccessBlockConfiguration": { "BlockPublicAcls": true, "BlockPublicPolicy": true, "IgnorePublicAcls": true, "RestrictPublicBuckets": true }, "Tags": [ { "Key": "aws-cdk:auto-delete-objects", "Value": "true" } ], "VersioningConfiguration": { "Status": "Enabled" } }, "UpdateReplacePolicy": "Delete", "DeletionPolicy": "Delete" }, "evtfhss3customlogbucketKinesisFirehoseToS3S3BucketPolicyAD917756": { "Type": "AWS::S3::BucketPolicy", "Properties": { "Bucket": { "Ref": "evtfhss3customlogbucketKinesisFirehoseToS3S3Bucket4B282A91" }, "PolicyDocument": { "Statement": [ { "Action": "s3:*", "Condition": { "Bool": { "aws:SecureTransport": "false" } }, "Effect": "Deny", "Principal": { "AWS": "*" }, "Resource": [ { "Fn::GetAtt": [ "evtfhss3customlogbucketKinesisFirehoseToS3S3Bucket4B282A91", "Arn" ] }, { "Fn::Join": [ "", [ { "Fn::GetAtt": [ "evtfhss3customlogbucketKinesisFirehoseToS3S3Bucket4B282A91", "Arn" ] }, "/*" ] ] } ] }, { "Action": [ "s3:DeleteObject*", "s3:GetBucket*", "s3:List*", "s3:PutBucketPolicy" ], "Effect": "Allow", "Principal": { "AWS": { "Fn::GetAtt": [ "CustomS3AutoDeleteObjectsCustomResourceProviderRole3B1BD092", "Arn" ] } }, "Resource": [ { "Fn::GetAtt": [ "evtfhss3customlogbucketKinesisFirehoseToS3S3Bucket4B282A91", "Arn" ] }, { "Fn::Join": [ "", [ { "Fn::GetAtt": [ "evtfhss3customlogbucketKinesisFirehoseToS3S3Bucket4B282A91", "Arn" ] }, "/*" ] ] } ] } ], "Version": "2012-10-17" } } }, "evtfhss3customlogbucketKinesisFirehoseToS3S3BucketAutoDeleteObjectsCustomResource53718158": { "Type": "Custom::S3AutoDeleteObjects", "Properties": { "ServiceToken": { "Fn::GetAtt": [ "CustomS3AutoDeleteObjectsCustomResourceProviderHandler9D90184F", "Arn" ] }, "BucketName": { "Ref": "evtfhss3customlogbucketKinesisFirehoseToS3S3Bucket4B282A91" } }, "DependsOn": [ "evtfhss3customlogbucketKinesisFirehoseToS3S3BucketPolicyAD917756" ], "UpdateReplacePolicy": "Delete", "DeletionPolicy": "Delete" }, "evtfhss3customlogbucketKinesisFirehoseToS3firehoseloggroupE047892B": { "Type": "AWS::Logs::LogGroup", "UpdateReplacePolicy": "Delete", "DeletionPolicy": "Delete", "Metadata": { "cfn_nag": { "rules_to_suppress": [ { "id": "W86", "reason": "Retention period for CloudWatchLogs LogGroups are set to 'Never Expire' to preserve customer data indefinitely" }, { "id": "W84", "reason": "By default CloudWatchLogs LogGroups data is encrypted using the CloudWatch server-side encryption keys (AWS Managed Keys)" } ] } } }, "evtfhss3customlogbucketKinesisFirehoseToS3firehoseloggroupfirehoselogstream1353170F": { "Type": "AWS::Logs::LogStream", "Properties": { "LogGroupName": { "Ref": "evtfhss3customlogbucketKinesisFirehoseToS3firehoseloggroupE047892B" } }, "UpdateReplacePolicy": "Retain", "DeletionPolicy": "Retain" }, "evtfhss3customlogbucketKinesisFirehoseToS3KinesisFirehoseRoleAC109402": { "Type": "AWS::IAM::Role", "Properties": { "AssumeRolePolicyDocument": { "Statement": [ { "Action": "sts:AssumeRole", "Effect": "Allow", "Principal": { "Service": "firehose.amazonaws.com" } } ], "Version": "2012-10-17" } }, "Metadata": { "guard": { "SuppressedRules": [ "IAM_NO_INLINE_POLICY_CHECK" ] } } }, "evtfhss3customlogbucketKinesisFirehoseToS3KinesisFirehosePolicy56683A68": { "Type": "AWS::IAM::Policy", "Properties": { "PolicyDocument": { "Statement": [ { "Action": [ "s3:AbortMultipartUpload", "s3:GetBucketLocation", "s3:GetObject", "s3:ListBucket", "s3:ListBucketMultipartUploads", "s3:PutObject" ], "Effect": "Allow", "Resource": [ { "Fn::GetAtt": [ "evtfhss3customlogbucketKinesisFirehoseToS3S3Bucket4B282A91", "Arn" ] }, { "Fn::Join": [ "", [ { "Fn::GetAtt": [ "evtfhss3customlogbucketKinesisFirehoseToS3S3Bucket4B282A91", "Arn" ] }, "/*" ] ] } ] }, { "Action": "logs:PutLogEvents", "Effect": "Allow", "Resource": { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":logs:", { "Ref": "AWS::Region" }, ":", { "Ref": "AWS::AccountId" }, ":log-group:", { "Ref": "evtfhss3customlogbucketKinesisFirehoseToS3firehoseloggroupE047892B" }, ":log-stream:", { "Ref": "evtfhss3customlogbucketKinesisFirehoseToS3firehoseloggroupfirehoselogstream1353170F" } ] ] } } ], "Version": "2012-10-17" }, "PolicyName": "evtfhss3customlogbucketKinesisFirehoseToS3KinesisFirehosePolicy56683A68", "Roles": [ { "Ref": "evtfhss3customlogbucketKinesisFirehoseToS3KinesisFirehoseRoleAC109402" } ] } }, "evtfhss3customlogbucketKinesisFirehoseToS3KinesisFirehoseE058C963": { "Type": "AWS::KinesisFirehose::DeliveryStream", "Properties": { "DeliveryStreamEncryptionConfigurationInput": { "KeyType": "AWS_OWNED_CMK" }, "DeliveryStreamName": "KinesisFirehoseevtfhss3customLogucketKinesisFirehoseToS340915E28", "ExtendedS3DestinationConfiguration": { "BucketARN": { "Fn::GetAtt": [ "evtfhss3customlogbucketKinesisFirehoseToS3S3Bucket4B282A91", "Arn" ] }, "BufferingHints": { "IntervalInSeconds": 300, "SizeInMBs": 5 }, "CloudWatchLoggingOptions": { "Enabled": true, "LogGroupName": { "Ref": "evtfhss3customlogbucketKinesisFirehoseToS3firehoseloggroupE047892B" }, "LogStreamName": { "Ref": "evtfhss3customlogbucketKinesisFirehoseToS3firehoseloggroupfirehoselogstream1353170F" } }, "CompressionFormat": "GZIP", "EncryptionConfiguration": { "KMSEncryptionConfig": { "AWSKMSKeyARN": { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":kms:", { "Ref": "AWS::Region" }, ":", { "Ref": "AWS::AccountId" }, ":alias/aws/s3" ] ] } } }, "RoleARN": { "Fn::GetAtt": [ "evtfhss3customlogbucketKinesisFirehoseToS3KinesisFirehoseRoleAC109402", "Arn" ] } } }, "Metadata": { "guard": { "SuppressedRules": [ "KINESIS_FIREHOSE_REDSHIFT_DESTINATION_CONFIGURATION_NO_PLAINTEXT_PASSWORD", "KINESIS_FIREHOSE_SPLUNK_DESTINATION_CONFIGURATION_NO_PLAINTEXT_PASSWORD" ] } } }, "evtfhss3customlogbucketEventsRuleInvokeKinesisFirehoseRole8084E579": { "Type": "AWS::IAM::Role", "Properties": { "AssumeRolePolicyDocument": { "Statement": [ { "Action": "sts:AssumeRole", "Effect": "Allow", "Principal": { "Service": "events.amazonaws.com" } } ], "Version": "2012-10-17" }, "Description": "Events Rule To Kinesis Firehose Role" } }, "evtfhss3customlogbucketEventsRuleInvokeKinesisFirehosePolicy0A1C994F": { "Type": "AWS::IAM::Policy", "Properties": { "PolicyDocument": { "Statement": [ { "Action": [ "firehose:PutRecord", "firehose:PutRecordBatch" ], "Effect": "Allow", "Resource": { "Fn::GetAtt": [ "evtfhss3customlogbucketKinesisFirehoseToS3KinesisFirehoseE058C963", "Arn" ] } } ], "Version": "2012-10-17" }, "PolicyName": "evtfhss3customlogbucketEventsRuleInvokeKinesisFirehosePolicy0A1C994F", "Roles": [ { "Ref": "evtfhss3customlogbucketEventsRuleInvokeKinesisFirehoseRole8084E579" } ] } }, "evtfhss3customlogbucketEventsRuleA7736706": { "Type": "AWS::Events::Rule", "Properties": { "ScheduleExpression": "rate(5 minutes)", "State": "ENABLED", "Targets": [ { "Arn": { "Fn::GetAtt": [ "evtfhss3customlogbucketKinesisFirehoseToS3KinesisFirehoseE058C963", "Arn" ] }, "Id": "Target0", "RoleArn": { "Fn::GetAtt": [ "evtfhss3customlogbucketEventsRuleInvokeKinesisFirehoseRole8084E579", "Arn" ] } } ] } }, "CustomS3AutoDeleteObjectsCustomResourceProviderRole3B1BD092": { "Type": "AWS::IAM::Role", "Properties": { "AssumeRolePolicyDocument": { "Version": "2012-10-17", "Statement": [ { "Action": "sts:AssumeRole", "Effect": "Allow", "Principal": { "Service": "lambda.amazonaws.com" } } ] }, "ManagedPolicyArns": [ { "Fn::Sub": "arn:${AWS::Partition}:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole" } ] } }, "CustomS3AutoDeleteObjectsCustomResourceProviderHandler9D90184F": { "Type": "AWS::Lambda::Function", "Properties": { "Code": { "S3Bucket": { "Fn::Sub": "cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}" }, "S3Key": "faa95a81ae7d7373f3e1f242268f904eb748d8d0fdd306e8a6fe515a1905a7d6.zip" }, "Timeout": 900, "MemorySize": 128, "Handler": "index.handler", "Role": { "Fn::GetAtt": [ "CustomS3AutoDeleteObjectsCustomResourceProviderRole3B1BD092", "Arn" ] }, "Runtime": "nodejs24.x", "Description": { "Fn::Join": [ "", [ "Lambda function for auto-deleting objects in ", { "Ref": "evtfhss3customlogbucketKinesisFirehoseToS3S3LoggingBucketAA70EACF" }, " S3 bucket." ] ] } }, "DependsOn": [ "CustomS3AutoDeleteObjectsCustomResourceProviderRole3B1BD092" ], "Metadata": { "cfn_nag": { "rules_to_suppress": [ { "id": "W58", "reason": "CDK generated custom resource" }, { "id": "W89", "reason": "CDK generated custom resource" }, { "id": "W92", "reason": "CDK generated custom resource" } ] } } } }, "Parameters": { "BootstrapVersion": { "Type": "AWS::SSM::Parameter::Value", "Default": "/cdk-bootstrap/hnb659fds/version", "Description": "Version of the CDK Bootstrap resources in this environment, automatically retrieved from SSM Parameter Store. [cdk:skip]" } }, "Rules": { "CheckBootstrapVersion": { "Assertions": [ { "Assert": { "Fn::Not": [ { "Fn::Contains": [ [ "1", "2", "3", "4", "5" ], { "Ref": "BootstrapVersion" } ] } ] }, "AssertDescription": "CDK bootstrap stack version 6 required. Please run 'cdk bootstrap' with a recent version of the CDK CLI." } ] } } }