{
 "Description": "Integration Test for Template Writer Resource",
 "Resources": {
  "LambdaFunctionServiceRole0C4CDE0B": {
   "Type": "AWS::IAM::Role",
   "Properties": {
    "AssumeRolePolicyDocument": {
     "Statement": [
      {
       "Action": "sts:AssumeRole",
       "Effect": "Allow",
       "Principal": {
        "Service": "lambda.amazonaws.com"
       }
      }
     ],
     "Version": "2012-10-17"
    },
    "Policies": [
     {
      "PolicyDocument": {
       "Statement": [
        {
         "Action": [
          "logs:CreateLogGroup",
          "logs:CreateLogStream",
          "logs:PutLogEvents"
         ],
         "Effect": "Allow",
         "Resource": {
          "Fn::Join": [
           "",
           [
            "arn:",
            {
             "Ref": "AWS::Partition"
            },
            ":logs:",
            {
             "Ref": "AWS::Region"
            },
            ":",
            {
             "Ref": "AWS::AccountId"
            },
            ":log-group:/aws/lambda/*"
           ]
          ]
         }
        }
       ],
       "Version": "2012-10-17"
      },
      "PolicyName": "LambdaFunctionServiceRolePolicy"
     }
    ]
   },
   "Metadata": {
    "guard": {
     "SuppressedRules": [
      "IAM_NO_INLINE_POLICY_CHECK"
     ]
    }
   }
  },
  "LambdaFunctionBF21E41F": {
   "Type": "AWS::Lambda::Function",
   "Properties": {
    "Code": {
     "S3Bucket": {
      "Fn::Sub": "cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}"
     },
     "S3Key": "b670072ae403f5d0f7c4ac0413a63bb9f093a32fd1620d0908d53ce809c7575d.zip"
    },
    "Environment": {
     "Variables": {
      "AWS_NODEJS_CONNECTION_REUSE_ENABLED": "1"
     }
    },
    "Handler": "index.handler",
    "Role": {
     "Fn::GetAtt": [
      "LambdaFunctionServiceRole0C4CDE0B",
      "Arn"
     ]
    },
    "Runtime": "nodejs22.x",
    "TracingConfig": {
     "Mode": "Active"
    }
   },
   "DependsOn": [
    "LambdaFunctionServiceRole0C4CDE0B"
   ],
   "Metadata": {
    "cfn_nag": {
     "rules_to_suppress": [
      {
       "id": "W58",
       "reason": "Lambda functions has the required permission to write CloudWatch Logs. It uses custom policy instead of arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole with tighter permissions."
      },
      {
       "id": "W89",
       "reason": "This is not a rule for the general case, just for specific use cases/industries"
      },
      {
       "id": "W92",
       "reason": "Impossible for us to define the correct concurrency for clients"
      }
     ]
    }
   }
  },
  "LambdaFunctioninlinePolicyAddedToExecutionRole007875684": {
   "Type": "AWS::IAM::Policy",
   "Properties": {
    "PolicyDocument": {
     "Statement": [
      {
       "Action": [
        "xray:PutTelemetryRecords",
        "xray:PutTraceSegments"
       ],
       "Effect": "Allow",
       "Resource": "*"
      }
     ],
     "Version": "2012-10-17"
    },
    "PolicyName": "LambdaFunctioninlinePolicyAddedToExecutionRole007875684",
    "Roles": [
     {
      "Ref": "LambdaFunctionServiceRole0C4CDE0B"
     }
    ]
   }
  },
  "TestTemplateWriterPolicy8177DE02": {
   "Type": "AWS::IAM::Policy",
   "Properties": {
    "PolicyDocument": {
     "Statement": [
      {
       "Action": "s3:GetObject",
       "Effect": "Allow",
       "Resource": {
        "Fn::Join": [
         "",
         [
          "arn:",
          {
           "Ref": "AWS::Partition"
          },
          ":s3:::",
          {
           "Fn::Sub": "cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}"
          },
          "/97cd237b0ae069fe0711bcc6a711e213fdaf0956421de5b964de9ccd0d2b23a1.97cd237b0ae069fe0711bcc6a711e213fdaf0956421de5b964de9ccd0d2b23a1"
         ]
        ]
       }
      },
      {
       "Action": "s3:PutObject",
       "Effect": "Allow",
       "Resource": {
        "Fn::Join": [
         "",
         [
          "arn:",
          {
           "Ref": "AWS::Partition"
          },
          ":s3:::",
          {
           "Fn::Sub": "cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}"
          },
          "/*"
         ]
        ]
       }
      }
     ],
     "Version": "2012-10-17"
    },
    "PolicyName": "TestTemplateWriterPolicy8177DE02",
    "Roles": [
     {
      "Ref": "LambdaFunctionServiceRole0C4CDE0B"
     }
    ]
   }
  },
  "TestTemplateWriterProviderframeworkonEventServiceRoleED11CF9A": {
   "Type": "AWS::IAM::Role",
   "Properties": {
    "AssumeRolePolicyDocument": {
     "Statement": [
      {
       "Action": "sts:AssumeRole",
       "Effect": "Allow",
       "Principal": {
        "Service": "lambda.amazonaws.com"
       }
      }
     ],
     "Version": "2012-10-17"
    },
    "ManagedPolicyArns": [
     {
      "Fn::Join": [
       "",
       [
        "arn:",
        {
         "Ref": "AWS::Partition"
        },
        ":iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"
       ]
      ]
     }
    ]
   }
  },
  "TestTemplateWriterProviderframeworkonEventServiceRoleDefaultPolicy08B90D53": {
   "Type": "AWS::IAM::Policy",
   "Properties": {
    "PolicyDocument": {
     "Statement": [
      {
       "Action": "lambda:InvokeFunction",
       "Effect": "Allow",
       "Resource": [
        {
         "Fn::GetAtt": [
          "LambdaFunctionBF21E41F",
          "Arn"
         ]
        },
        {
         "Fn::Join": [
          "",
          [
           {
            "Fn::GetAtt": [
             "LambdaFunctionBF21E41F",
             "Arn"
            ]
           },
           ":*"
          ]
         ]
        }
       ]
      }
     ],
     "Version": "2012-10-17"
    },
    "PolicyName": "TestTemplateWriterProviderframeworkonEventServiceRoleDefaultPolicy08B90D53",
    "Roles": [
     {
      "Ref": "TestTemplateWriterProviderframeworkonEventServiceRoleED11CF9A"
     }
    ]
   }
  },
  "TestTemplateWriterProviderframeworkonEvent7FDD3553": {
   "Type": "AWS::Lambda::Function",
   "Properties": {
    "Code": {
     "S3Bucket": {
      "Fn::Sub": "cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}"
     },
     "S3Key": "e16ffb3b34af185b8b30c88fdb19faa13b6c42bb38580485c4e84b384ee48b63.zip"
    },
    "Description": "AWS CDK resource provider framework - onEvent (template-writer-from-asset/TestTemplateWriterProvider)",
    "Environment": {
     "Variables": {
      "USER_ON_EVENT_FUNCTION_ARN": {
       "Fn::GetAtt": [
        "LambdaFunctionBF21E41F",
        "Arn"
       ]
      }
     }
    },
    "Handler": "framework.onEvent",
    "LoggingConfig": {
     "ApplicationLogLevel": "FATAL",
     "LogFormat": "JSON"
    },
    "Role": {
     "Fn::GetAtt": [
      "TestTemplateWriterProviderframeworkonEventServiceRoleED11CF9A",
      "Arn"
     ]
    },
    "Runtime": "nodejs24.x",
    "Timeout": 900
   },
   "DependsOn": [
    "TestTemplateWriterProviderframeworkonEventServiceRoleDefaultPolicy08B90D53",
    "TestTemplateWriterProviderframeworkonEventServiceRoleED11CF9A"
   ],
   "Metadata": {
    "cfn_nag": {
     "rules_to_suppress": [
      {
       "id": "W58",
       "reason": "The CDK-provided lambda function that backs their Custom Resource Provider framework has an IAM role with the arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole Managed Policy attached, which grants permission to write to CloudWatch Logs"
      },
      {
       "id": "W89",
       "reason": "The CDK-provided lambda function that backs their Custom Resource Provider framework does not access VPC resources"
      },
      {
       "id": "W92",
       "reason": "The CDK-provided lambda function that backs their Custom Resource Provider framework does not define ReservedConcurrentExecutions"
      }
     ]
    }
   }
  },
  "TestTemplateWriterProviderframeworkonEventinlinePolicyAddedToExecutionRole08CC44E87": {
   "Type": "AWS::IAM::Policy",
   "Properties": {
    "PolicyDocument": {
     "Statement": [
      {
       "Action": "lambda:GetFunction",
       "Effect": "Allow",
       "Resource": {
        "Fn::GetAtt": [
         "LambdaFunctionBF21E41F",
         "Arn"
        ]
       }
      }
     ],
     "Version": "2012-10-17"
    },
    "PolicyName": "TestTemplateWriterProviderframeworkonEventinlinePolicyAddedToExecutionRole08CC44E87",
    "Roles": [
     {
      "Ref": "TestTemplateWriterProviderframeworkonEventServiceRoleED11CF9A"
     }
    ]
   }
  },
  "TestTemplateWriterCustomResource": {
   "Type": "Custom::TemplateWriter",
   "Properties": {
    "ServiceToken": {
     "Fn::GetAtt": [
      "TestTemplateWriterProviderframeworkonEvent7FDD3553",
      "Arn"
     ]
    },
    "TemplateValues": "{\"templateValues\":[{\"id\":\"placeholder\",\"value\":\"resolved_value\"}]}",
    "TemplateInputBucket": {
     "Fn::Sub": "cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}"
    },
    "TemplateInputKey": "97cd237b0ae069fe0711bcc6a711e213fdaf0956421de5b964de9ccd0d2b23a1.97cd237b0ae069fe0711bcc6a711e213fdaf0956421de5b964de9ccd0d2b23a1",
    "TemplateOutputBucket": {
     "Fn::Sub": "cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}"
    }
   },
   "DependsOn": [
    "TestTemplateWriterPolicy8177DE02"
   ],
   "UpdateReplacePolicy": "Delete",
   "DeletionPolicy": "Delete"
  }
 },
 "Parameters": {
  "BootstrapVersion": {
   "Type": "AWS::SSM::Parameter::Value<String>",
   "Default": "/cdk-bootstrap/hnb659fds/version",
   "Description": "Version of the CDK Bootstrap resources in this environment, automatically retrieved from SSM Parameter Store. [cdk:skip]"
  }
 },
 "Rules": {
  "CheckBootstrapVersion": {
   "Assertions": [
    {
     "Assert": {
      "Fn::Not": [
       {
        "Fn::Contains": [
         [
          "1",
          "2",
          "3",
          "4",
          "5"
         ],
         {
          "Ref": "BootstrapVersion"
         }
        ]
       }
      ]
     },
     "AssertDescription": "CDK bootstrap stack version 6 required. Please run 'cdk bootstrap' with a recent version of the CDK CLI."
    }
   ]
  }
 }
}