{ "Description": "This stack includes the application's resources for integration testing.", "Resources": { "customsesreceivefunctionServiceRole59428503": { "Type": "AWS::IAM::Role", "Properties": { "AssumeRolePolicyDocument": { "Statement": [ { "Action": "sts:AssumeRole", "Effect": "Allow", "Principal": { "Service": "lambda.amazonaws.com" } } ], "Version": "2012-10-17" }, "ManagedPolicyArns": [ { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":iam::aws:policy/service-role/AWSLambdaBasicExecutionRole" ] ] } ] } }, "customsesreceivefunctionServiceRoleDefaultPolicyA3B235DE": { "Type": "AWS::IAM::Policy", "Properties": { "PolicyDocument": { "Statement": [ { "Action": "s3:List*", "Effect": "Allow", "Resource": "*" } ], "Version": "2012-10-17" }, "PolicyName": "customsesreceivefunctionServiceRoleDefaultPolicyA3B235DE", "Roles": [ { "Ref": "customsesreceivefunctionServiceRole59428503" } ] } }, "customsesreceivefunction5B1A9CD4": { "Type": "AWS::Lambda::Function", "Properties": { "Code": { "S3Bucket": { "Fn::Sub": "cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}" }, "S3Key": "b01091642674a865788c271ec84db9d88a8dfbe14d4d95583aca8814cfa848b9.zip" }, "Environment": { "Variables": { "EMAIL_BUCKET": { "Ref": "testRootmailEmailBucket2A470446" }, "EMAIL_BUCKET_ARN": { "Fn::GetAtt": [ "testRootmailEmailBucket2A470446", "Arn" ] } } }, "Handler": "index.handler", "Role": { "Fn::GetAtt": [ "customsesreceivefunctionServiceRole59428503", "Arn" ] }, "Runtime": "nodejs18.x", "Timeout": 30 }, "DependsOn": [ "customsesreceivefunctionServiceRoleDefaultPolicyA3B235DE", "customsesreceivefunctionServiceRole59428503" ] }, "customsesreceivefunctionLogRetention0291B225": { "Type": "Custom::LogRetention", "Properties": { "ServiceToken": { "Fn::GetAtt": [ "LogRetentionaae0aa3c5b4d4f87b02d85b201efdd8aFD4BFC8A", "Arn" ] }, "LogGroupName": { "Fn::Join": [ "", [ "/aws/lambda/", { "Ref": "customsesreceivefunction5B1A9CD4" } ] ] }, "RetentionInDays": 1 } }, "customsesreceivefunctionOpsSantaFunctionSESPermissions3D5DD310": { "Type": "AWS::Lambda::Permission", "Properties": { "Action": "lambda:InvokeFunction", "FunctionName": { "Fn::GetAtt": [ "customsesreceivefunction5B1A9CD4", "Arn" ] }, "Principal": "ses.amazonaws.com", "SourceAccount": { "Ref": "AWS::AccountId" } } }, "LogRetentionaae0aa3c5b4d4f87b02d85b201efdd8aServiceRole9741ECFB": { "Type": "AWS::IAM::Role", "Properties": { "AssumeRolePolicyDocument": { "Statement": [ { "Action": "sts:AssumeRole", "Effect": "Allow", "Principal": { "Service": "lambda.amazonaws.com" } } ], "Version": "2012-10-17" }, "ManagedPolicyArns": [ { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":iam::aws:policy/service-role/AWSLambdaBasicExecutionRole" ] ] } ] } }, "LogRetentionaae0aa3c5b4d4f87b02d85b201efdd8aServiceRoleDefaultPolicyADDA7DEB": { "Type": "AWS::IAM::Policy", "Properties": { "PolicyDocument": { "Statement": [ { "Action": [ "logs:DeleteRetentionPolicy", "logs:PutRetentionPolicy" ], "Effect": "Allow", "Resource": "*" } ], "Version": "2012-10-17" }, "PolicyName": "LogRetentionaae0aa3c5b4d4f87b02d85b201efdd8aServiceRoleDefaultPolicyADDA7DEB", "Roles": [ { "Ref": "LogRetentionaae0aa3c5b4d4f87b02d85b201efdd8aServiceRole9741ECFB" } ] } }, "LogRetentionaae0aa3c5b4d4f87b02d85b201efdd8aFD4BFC8A": { "Type": "AWS::Lambda::Function", "Properties": { "Handler": "index.handler", "Runtime": { "Fn::FindInMap": [ "LatestNodeRuntimeMap", { "Ref": "AWS::Region" }, "value" ] }, "Timeout": 900, "Code": { "S3Bucket": { "Fn::Sub": "cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}" }, "S3Key": "2819175352ad1ce0dae768e83fc328fb70fb5f10b4a8ff0ccbcb791f02b0716d.zip" }, "Role": { "Fn::GetAtt": [ "LogRetentionaae0aa3c5b4d4f87b02d85b201efdd8aServiceRole9741ECFB", "Arn" ] } }, "DependsOn": [ "LogRetentionaae0aa3c5b4d4f87b02d85b201efdd8aServiceRoleDefaultPolicyADDA7DEB", "LogRetentionaae0aa3c5b4d4f87b02d85b201efdd8aServiceRole9741ECFB" ] }, "testRootmailEmailBucket2A470446": { "Type": "AWS::S3::Bucket", "Properties": { "BucketEncryption": { "ServerSideEncryptionConfiguration": [ { "ServerSideEncryptionByDefault": { "SSEAlgorithm": "AES256" } } ] }, "PublicAccessBlockConfiguration": { "BlockPublicAcls": true, "BlockPublicPolicy": true, "IgnorePublicAcls": true, "RestrictPublicBuckets": true } }, "UpdateReplacePolicy": "Retain", "DeletionPolicy": "Retain", "Metadata": { "cdk_nag": { "rules_to_suppress": [ { "reason": "no server access logs needed", "id": "AwsSolutions-S1" }, { "reason": "no SSL access needed", "id": "AwsSolutions-S10" } ] } } }, "testRootmailEmailBucketPolicy5DA39984": { "Type": "AWS::S3::BucketPolicy", "Properties": { "Bucket": { "Ref": "testRootmailEmailBucket2A470446" }, "PolicyDocument": { "Statement": [ { "Action": [ "s3:Abort*", "s3:PutObject", "s3:PutObjectLegalHold", "s3:PutObjectRetention", "s3:PutObjectTagging", "s3:PutObjectVersionTagging" ], "Effect": "Allow", "Principal": { "Service": "ses.amazonaws.com" }, "Resource": { "Fn::Join": [ "", [ { "Fn::GetAtt": [ "testRootmailEmailBucket2A470446", "Arn" ] }, "/RootMail/*" ] ] } } ], "Version": "2012-10-17" } }, "Metadata": { "cdk_nag": { "rules_to_suppress": [ { "reason": "no SSL access needed", "id": "AwsSolutions-S10" } ] } } }, "testRootmailHostedZone6DFD3C9C": { "Type": "AWS::Route53::HostedZone", "Properties": { "Name": { "Fn::Join": [ "", [ "c23qgsa2-", { "Ref": "AWS::Region" }, ".rootmail-test.mavogel.xyz." ] ] } } }, "testRootmailHostedZoneSSMParameter574DA41C": { "Type": "AWS::SSM::Parameter", "Properties": { "Name": "/rootmail/domain_name_servers", "Type": "StringList", "Value": { "Fn::Join": [ ",", { "Fn::GetAtt": [ "testRootmailHostedZone6DFD3C9C", "NameServers" ] } ] } } }, "testRootmailHostedZoneDkimHostedZoneDKIMAndVerificationRecords3C4650B2": { "Type": "Custom::HostedZoneDKIMAndVerificationRecords", "Properties": { "ServiceToken": { "Fn::GetAtt": [ "rootmailhostedzonedkimverificationrecordsproviderframeworkonEvent801E57DE", "Arn" ] }, "Domain": { "Fn::Join": [ "", [ "c23qgsa2-", { "Ref": "AWS::Region" }, ".rootmail-test.mavogel.xyz" ] ] } }, "UpdateReplacePolicy": "Delete", "DeletionPolicy": "Delete" }, "testRootmailHostedZoneDkimHostedZoneDKIMTokenRecord07A3BA244": { "Type": "AWS::Route53::RecordSet", "Properties": { "HostedZoneId": { "Ref": "testRootmailHostedZone6DFD3C9C" }, "Name": { "Fn::Join": [ "", [ { "Fn::Select": [ 0, { "Fn::GetAtt": [ "testRootmailHostedZoneDkimHostedZoneDKIMAndVerificationRecords3C4650B2", "DkimTokens" ] } ] }, "._domainkey.c23qgsa2-", { "Ref": "AWS::Region" }, ".rootmail-test.mavogel.xyz." ] ] }, "ResourceRecords": [ { "Fn::Join": [ "", [ { "Fn::Select": [ 0, { "Fn::GetAtt": [ "testRootmailHostedZoneDkimHostedZoneDKIMAndVerificationRecords3C4650B2", "DkimTokens" ] } ] }, ".dkim.amazonses.com" ] ] } ], "TTL": "60", "Type": "CNAME" } }, "testRootmailHostedZoneDkimHostedZoneDKIMTokenRecord135221F6A": { "Type": "AWS::Route53::RecordSet", "Properties": { "HostedZoneId": { "Ref": "testRootmailHostedZone6DFD3C9C" }, "Name": { "Fn::Join": [ "", [ { "Fn::Select": [ 1, { "Fn::GetAtt": [ "testRootmailHostedZoneDkimHostedZoneDKIMAndVerificationRecords3C4650B2", "DkimTokens" ] } ] }, "._domainkey.c23qgsa2-", { "Ref": "AWS::Region" }, ".rootmail-test.mavogel.xyz." ] ] }, "ResourceRecords": [ { "Fn::Join": [ "", [ { "Fn::Select": [ 1, { "Fn::GetAtt": [ "testRootmailHostedZoneDkimHostedZoneDKIMAndVerificationRecords3C4650B2", "DkimTokens" ] } ] }, ".dkim.amazonses.com" ] ] } ], "TTL": "60", "Type": "CNAME" } }, "testRootmailHostedZoneDkimHostedZoneDKIMTokenRecord2175A1558": { "Type": "AWS::Route53::RecordSet", "Properties": { "HostedZoneId": { "Ref": "testRootmailHostedZone6DFD3C9C" }, "Name": { "Fn::Join": [ "", [ { "Fn::Select": [ 2, { "Fn::GetAtt": [ "testRootmailHostedZoneDkimHostedZoneDKIMAndVerificationRecords3C4650B2", "DkimTokens" ] } ] }, "._domainkey.c23qgsa2-", { "Ref": "AWS::Region" }, ".rootmail-test.mavogel.xyz." ] ] }, "ResourceRecords": [ { "Fn::Join": [ "", [ { "Fn::Select": [ 2, { "Fn::GetAtt": [ "testRootmailHostedZoneDkimHostedZoneDKIMAndVerificationRecords3C4650B2", "DkimTokens" ] } ] }, ".dkim.amazonses.com" ] ] } ], "TTL": "60", "Type": "CNAME" } }, "testRootmailHostedZoneDkimHostedZoneMXRecord4446D9D3": { "Type": "AWS::Route53::RecordSet", "Properties": { "HostedZoneId": { "Ref": "testRootmailHostedZone6DFD3C9C" }, "Name": { "Fn::Join": [ "", [ "c23qgsa2-", { "Ref": "AWS::Region" }, ".rootmail-test.mavogel.xyz." ] ] }, "ResourceRecords": [ { "Fn::Join": [ "", [ "10 inbound-smtp.", { "Ref": "AWS::Region" }, ".amazonaws.com" ] ] } ], "TTL": "60", "Type": "MX" } }, "testRootmailHostedZoneDkimHostedZoneVerificationTokenRecord80FAE944": { "Type": "AWS::Route53::RecordSet", "Properties": { "HostedZoneId": { "Ref": "testRootmailHostedZone6DFD3C9C" }, "Name": { "Fn::Join": [ "", [ "_amazonses.c23qgsa2-", { "Ref": "AWS::Region" }, ".rootmail-test.mavogel.xyz." ] ] }, "ResourceRecords": [ { "Fn::Join": [ "", [ "\"", { "Fn::GetAtt": [ "testRootmailHostedZoneDkimHostedZoneDKIMAndVerificationRecords3C4650B2", "VerificationToken" ] }, "\"" ] ] } ], "TTL": "60", "Type": "TXT" } }, "testRootmailHostedZoneDkimRootmailAutowireDnsAutoWireR53ChangeInfoId609129D7": { "Type": "AWS::SSM::Parameter", "Properties": { "Name": "/rootmail/auto_wire_r53_changeinfo_id", "Type": "String", "Value": "dummy" } }, "testRootmailHostedZoneDkimRootmailAutowireDnsE60E593E": { "Type": "Custom::RootmailAutowireDnsProvider", "Properties": { "ServiceToken": { "Fn::GetAtt": [ "rootmailautowirednsproviderrootmailautowirednsproviderframeworkonEventAA9D49B6", "Arn" ] }, "Domain": "rootmail-test.mavogel.xyz", "Subdomain": { "Fn::Join": [ "", [ "c23qgsa2-", { "Ref": "AWS::Region" } ] ] }, "ParentHostedZoneId": "Z01336592122MNIWKOZSV", "HostedZoneParameterName": { "Ref": "testRootmailHostedZoneSSMParameter574DA41C" }, "R53ChangeInfoIdParameterName": { "Ref": "testRootmailHostedZoneDkimRootmailAutowireDnsAutoWireR53ChangeInfoId609129D7" } }, "UpdateReplacePolicy": "Delete", "DeletionPolicy": "Delete" }, "testRootmailHostedZoneDkimHostedZoneDKIMPropagation1F03F92B": { "Type": "Custom::HostedZoneDKIMPropagation", "Properties": { "ServiceToken": { "Fn::GetAtt": [ "rootmailhostedzonedkimpropagationproviderframeworkonEvent15357119", "Arn" ] }, "Domain": { "Fn::Join": [ "", [ "c23qgsa2-", { "Ref": "AWS::Region" }, ".rootmail-test.mavogel.xyz" ] ] } }, "UpdateReplacePolicy": "Delete", "DeletionPolicy": "Delete" }, "testRootmailSESReceiveOpsSantaFunctionRole82D7297F": { "Type": "AWS::IAM::Role", "Properties": { "AssumeRolePolicyDocument": { "Statement": [ { "Action": "sts:AssumeRole", "Effect": "Allow", "Principal": { "Service": "lambda.amazonaws.com" } } ], "Version": "2012-10-17" }, "ManagedPolicyArns": [ { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":iam::aws:policy/service-role/AWSLambdaBasicExecutionRole" ] ] } ], "Policies": [ { "PolicyDocument": { "Statement": [ { "Action": "s3:GetObject", "Effect": "Allow", "Resource": { "Fn::Join": [ "", [ { "Fn::GetAtt": [ "testRootmailEmailBucket2A470446", "Arn" ] }, "/RootMail/*" ] ] } }, { "Action": "ssm:CreateOpsItem", "Effect": "Allow", "Resource": "*" }, { "Action": "ssm:PutParameter", "Effect": "Allow", "Resource": { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":ssm:", { "Ref": "AWS::Region" }, ":", { "Ref": "AWS::AccountId" }, ":parameter/rootmail/*" ] ] } } ], "Version": "2012-10-17" }, "PolicyName": "OpsSantaFunctionRolePolicy" } ] }, "Metadata": { "cdk_nag": { "rules_to_suppress": [ { "reason": "no service role restriction needed", "id": "AwsSolutions-IAM4" }, { "reason": "wildcards are ok as we allow every opsitem to be created", "id": "AwsSolutions-IAM5" } ] } } }, "testRootmailSESReceiveCustomSesReceiveFunctionPolicy193B75EC": { "Type": "AWS::IAM::Policy", "Properties": { "PolicyDocument": { "Statement": [ { "Action": "s3:GetObject", "Effect": "Allow", "Resource": { "Fn::Join": [ "", [ { "Fn::GetAtt": [ "testRootmailEmailBucket2A470446", "Arn" ] }, "/RootMail/*" ] ] } } ], "Version": "2012-10-17" }, "PolicyName": "testRootmailSESReceiveCustomSesReceiveFunctionPolicy193B75EC", "Roles": [ { "Ref": "customsesreceivefunctionServiceRole59428503" } ] } }, "testRootmailSESReceiveSESReceiptRuleSetActivation75911DB8": { "Type": "Custom::SESReceiptRuleSetActivation", "Properties": { "ServiceToken": { "Fn::GetAtt": [ "rootmailsesreceiptrulesetactivationproviderframeworkonEventC514B5CD", "Arn" ] }, "Domain": "rootmail-test.mavogel.xyz", "Subdomain": { "Fn::Join": [ "", [ "c23qgsa2-", { "Ref": "AWS::Region" } ] ] }, "EmailBucketName": { "Ref": "testRootmailEmailBucket2A470446" }, "OpsSantaFunctionArn": { "Fn::GetAtt": [ "customsesreceivefunction5B1A9CD4", "Arn" ] }, "FilteredEmailSubjects": "" }, "UpdateReplacePolicy": "Delete", "DeletionPolicy": "Delete" }, "rootmailhostedzonedkimverificationrecordsprovideroneventhandlerServiceRole83E5B139": { "Type": "AWS::IAM::Role", "Properties": { "AssumeRolePolicyDocument": { "Statement": [ { "Action": "sts:AssumeRole", "Effect": "Allow", "Principal": { "Service": "lambda.amazonaws.com" } } ], "Version": "2012-10-17" }, "ManagedPolicyArns": [ { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":iam::aws:policy/service-role/AWSLambdaBasicExecutionRole" ] ] } ] }, "Metadata": { "cdk_nag": { "rules_to_suppress": [ { "reason": "no service role restriction needed", "id": "AwsSolutions-IAM4" }, { "reason": "wildcards are ok for the provider as the function has restrictions", "id": "AwsSolutions-IAM5" } ] } } }, "rootmailhostedzonedkimverificationrecordsprovideroneventhandlerServiceRoleDefaultPolicy5C0E86C8": { "Type": "AWS::IAM::Policy", "Properties": { "PolicyDocument": { "Statement": [ { "Action": [ "ses:DeleteIdentity", "ses:VerifyDomainDkim", "ses:VerifyDomainIdentity" ], "Effect": "Allow", "Resource": "*" } ], "Version": "2012-10-17" }, "PolicyName": "rootmailhostedzonedkimverificationrecordsprovideroneventhandlerServiceRoleDefaultPolicy5C0E86C8", "Roles": [ { "Ref": "rootmailhostedzonedkimverificationrecordsprovideroneventhandlerServiceRole83E5B139" } ] }, "Metadata": { "cdk_nag": { "rules_to_suppress": [ { "reason": "no service role restriction needed", "id": "AwsSolutions-IAM4" }, { "reason": "wildcards are ok for the provider as the function has restrictions", "id": "AwsSolutions-IAM5" } ] } } }, "rootmailhostedzonedkimverificationrecordsprovideroneventhandlerADD3C0BE": { "Type": "AWS::Lambda::Function", "Properties": { "Code": { "S3Bucket": { "Fn::Sub": "cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}" }, "S3Key": "f75274dd7677b6ef41f29d2dfc2c885b4f4e069d3fb8e67636bd89efd3f0fcad.zip" }, "Handler": "index.handler", "Role": { "Fn::GetAtt": [ "rootmailhostedzonedkimverificationrecordsprovideroneventhandlerServiceRole83E5B139", "Arn" ] }, "Runtime": "nodejs18.x", "Timeout": 200 }, "DependsOn": [ "rootmailhostedzonedkimverificationrecordsprovideroneventhandlerServiceRoleDefaultPolicy5C0E86C8", "rootmailhostedzonedkimverificationrecordsprovideroneventhandlerServiceRole83E5B139" ], "Metadata": { "cdk_nag": { "rules_to_suppress": [ { "reason": "no service role restriction needed", "id": "AwsSolutions-IAM4" }, { "reason": "wildcards are ok for the provider as the function has restrictions", "id": "AwsSolutions-IAM5" } ] } } }, "rootmailhostedzonedkimverificationrecordsprovideroneventhandlerLogRetentionCA165FC4": { "Type": "Custom::LogRetention", "Properties": { "ServiceToken": { "Fn::GetAtt": [ "LogRetentionaae0aa3c5b4d4f87b02d85b201efdd8aFD4BFC8A", "Arn" ] }, "LogGroupName": { "Fn::Join": [ "", [ "/aws/lambda/", { "Ref": "rootmailhostedzonedkimverificationrecordsprovideroneventhandlerADD3C0BE" } ] ] }, "RetentionInDays": 1 }, "Metadata": { "cdk_nag": { "rules_to_suppress": [ { "reason": "no service role restriction needed", "id": "AwsSolutions-IAM4" }, { "reason": "wildcards are ok for the provider as the function has restrictions", "id": "AwsSolutions-IAM5" } ] } } }, "rootmailhostedzonedkimverificationrecordsproviderframeworkonEventServiceRoleA09812EA": { "Type": "AWS::IAM::Role", "Properties": { "AssumeRolePolicyDocument": { "Statement": [ { "Action": "sts:AssumeRole", "Effect": "Allow", "Principal": { "Service": "lambda.amazonaws.com" } } ], "Version": "2012-10-17" }, "ManagedPolicyArns": [ { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":iam::aws:policy/service-role/AWSLambdaBasicExecutionRole" ] ] } ] }, "Metadata": { "cdk_nag": { "rules_to_suppress": [ { "reason": "no service role restriction needed", "id": "AwsSolutions-IAM4" }, { "reason": "wildcards are ok for the provider as the function has restrictions", "id": "AwsSolutions-IAM5" } ] } } }, "rootmailhostedzonedkimverificationrecordsproviderframeworkonEventServiceRoleDefaultPolicy2775D1BA": { "Type": "AWS::IAM::Policy", "Properties": { "PolicyDocument": { "Statement": [ { "Action": "lambda:InvokeFunction", "Effect": "Allow", "Resource": [ { "Fn::GetAtt": [ "rootmailhostedzonedkimverificationrecordsprovideroneventhandlerADD3C0BE", "Arn" ] }, { "Fn::Join": [ "", [ { "Fn::GetAtt": [ "rootmailhostedzonedkimverificationrecordsprovideroneventhandlerADD3C0BE", "Arn" ] }, ":*" ] ] } ] } ], "Version": "2012-10-17" }, "PolicyName": "rootmailhostedzonedkimverificationrecordsproviderframeworkonEventServiceRoleDefaultPolicy2775D1BA", "Roles": [ { "Ref": "rootmailhostedzonedkimverificationrecordsproviderframeworkonEventServiceRoleA09812EA" } ] }, "Metadata": { "cdk_nag": { "rules_to_suppress": [ { "reason": "no service role restriction needed", "id": "AwsSolutions-IAM4" }, { "reason": "wildcards are ok for the provider as the function has restrictions", "id": "AwsSolutions-IAM5" } ] } } }, "rootmailhostedzonedkimverificationrecordsproviderframeworkonEvent801E57DE": { "Type": "AWS::Lambda::Function", "Properties": { "Code": { "S3Bucket": { "Fn::Sub": "cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}" }, "S3Key": "bdc104ed9cab1b5b6421713c8155f0b753380595356f710400609664d3635eca.zip" }, "Description": "AWS CDK resource provider framework - onEvent (RootmailIntegTestStack/rootmail.hosted-zone-dkim-verification-records-provider/hosted-zone-dkim-verification-records-provider)", "Environment": { "Variables": { "USER_ON_EVENT_FUNCTION_ARN": { "Fn::GetAtt": [ "rootmailhostedzonedkimverificationrecordsprovideroneventhandlerADD3C0BE", "Arn" ] } } }, "Handler": "framework.onEvent", "Role": { "Fn::GetAtt": [ "rootmailhostedzonedkimverificationrecordsproviderframeworkonEventServiceRoleA09812EA", "Arn" ] }, "Runtime": { "Fn::FindInMap": [ "LatestNodeRuntimeMap", { "Ref": "AWS::Region" }, "value" ] }, "Timeout": 900 }, "DependsOn": [ "rootmailhostedzonedkimverificationrecordsproviderframeworkonEventServiceRoleDefaultPolicy2775D1BA", "rootmailhostedzonedkimverificationrecordsproviderframeworkonEventServiceRoleA09812EA" ], "Metadata": { "cdk_nag": { "rules_to_suppress": [ { "reason": "no service role restriction needed", "id": "AwsSolutions-IAM4" }, { "reason": "wildcards are ok for the provider as the function has restrictions", "id": "AwsSolutions-IAM5" } ] } } }, "rootmailhostedzonedkimverificationrecordsproviderframeworkonEventLogRetention64AEF97C": { "Type": "Custom::LogRetention", "Properties": { "ServiceToken": { "Fn::GetAtt": [ "LogRetentionaae0aa3c5b4d4f87b02d85b201efdd8aFD4BFC8A", "Arn" ] }, "LogGroupName": { "Fn::Join": [ "", [ "/aws/lambda/", { "Ref": "rootmailhostedzonedkimverificationrecordsproviderframeworkonEvent801E57DE" } ] ] }, "RetentionInDays": 1 }, "Metadata": { "cdk_nag": { "rules_to_suppress": [ { "reason": "no service role restriction needed", "id": "AwsSolutions-IAM4" }, { "reason": "wildcards are ok for the provider as the function has restrictions", "id": "AwsSolutions-IAM5" } ] } } }, "rootmailautowirednsprovideriscompletehandlerServiceRole35CABB06": { "Type": "AWS::IAM::Role", "Properties": { "AssumeRolePolicyDocument": { "Statement": [ { "Action": "sts:AssumeRole", "Effect": "Allow", "Principal": { "Service": "lambda.amazonaws.com" } } ], "Version": "2012-10-17" }, "ManagedPolicyArns": [ { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":iam::aws:policy/service-role/AWSLambdaBasicExecutionRole" ] ] } ] }, "Metadata": { "cdk_nag": { "rules_to_suppress": [ { "reason": "no service role restriction needed", "id": "AwsSolutions-IAM4" }, { "reason": "wildcards are ok for the provider as the function has restrictions", "id": "AwsSolutions-IAM5" } ] } } }, "rootmailautowirednsprovideriscompletehandlerServiceRoleDefaultPolicy7DA8ECD2": { "Type": "AWS::IAM::Policy", "Properties": { "PolicyDocument": { "Statement": [ { "Action": [ "route53:GetChange", "route53:ListHostedZonesByName" ], "Effect": "Allow", "Resource": "*" }, { "Action": [ "ssm:DescribeParameters", "ssm:GetParameter", "ssm:GetParameterHistory", "ssm:GetParameters" ], "Effect": "Allow", "Resource": { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":ssm:", { "Ref": "AWS::Region" }, ":", { "Ref": "AWS::AccountId" }, ":parameter", { "Ref": "testRootmailHostedZoneDkimRootmailAutowireDnsAutoWireR53ChangeInfoId609129D7" } ] ] } } ], "Version": "2012-10-17" }, "PolicyName": "rootmailautowirednsprovideriscompletehandlerServiceRoleDefaultPolicy7DA8ECD2", "Roles": [ { "Ref": "rootmailautowirednsprovideriscompletehandlerServiceRole35CABB06" } ] }, "Metadata": { "cdk_nag": { "rules_to_suppress": [ { "reason": "no service role restriction needed", "id": "AwsSolutions-IAM4" }, { "reason": "wildcards are ok for the provider as the function has restrictions", "id": "AwsSolutions-IAM5" } ] } } }, "rootmailautowirednsprovideriscompletehandlerBFD3F7F5": { "Type": "AWS::Lambda::Function", "Properties": { "Code": { "S3Bucket": { "Fn::Sub": "cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}" }, "S3Key": "157ba1713f7224463b621261792d18081588ff306a9bc3f75e6c468fabbe1a60.zip" }, "Handler": "index.handler", "Role": { "Fn::GetAtt": [ "rootmailautowirednsprovideriscompletehandlerServiceRole35CABB06", "Arn" ] }, "Runtime": "nodejs18.x", "Timeout": 120 }, "DependsOn": [ "rootmailautowirednsprovideriscompletehandlerServiceRoleDefaultPolicy7DA8ECD2", "rootmailautowirednsprovideriscompletehandlerServiceRole35CABB06" ], "Metadata": { "cdk_nag": { "rules_to_suppress": [ { "reason": "no service role restriction needed", "id": "AwsSolutions-IAM4" }, { "reason": "wildcards are ok for the provider as the function has restrictions", "id": "AwsSolutions-IAM5" } ] } } }, "rootmailautowirednsprovideriscompletehandlerLogRetention304C1822": { "Type": "Custom::LogRetention", "Properties": { "ServiceToken": { "Fn::GetAtt": [ "LogRetentionaae0aa3c5b4d4f87b02d85b201efdd8aFD4BFC8A", "Arn" ] }, "LogGroupName": { "Fn::Join": [ "", [ "/aws/lambda/", { "Ref": "rootmailautowirednsprovideriscompletehandlerBFD3F7F5" } ] ] }, "RetentionInDays": 1 }, "Metadata": { "cdk_nag": { "rules_to_suppress": [ { "reason": "no service role restriction needed", "id": "AwsSolutions-IAM4" }, { "reason": "wildcards are ok for the provider as the function has restrictions", "id": "AwsSolutions-IAM5" } ] } } }, "rootmailautowirednsprovideroneventhandlerServiceRole6D9F81B0": { "Type": "AWS::IAM::Role", "Properties": { "AssumeRolePolicyDocument": { "Statement": [ { "Action": "sts:AssumeRole", "Effect": "Allow", "Principal": { "Service": "lambda.amazonaws.com" } } ], "Version": "2012-10-17" }, "ManagedPolicyArns": [ { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":iam::aws:policy/service-role/AWSLambdaBasicExecutionRole" ] ] } ] }, "Metadata": { "cdk_nag": { "rules_to_suppress": [ { "reason": "no service role restriction needed", "id": "AwsSolutions-IAM4" }, { "reason": "wildcards are ok for the provider as the function has restrictions", "id": "AwsSolutions-IAM5" } ] } } }, "rootmailautowirednsprovideroneventhandlerServiceRoleDefaultPolicy4A5BBAB1": { "Type": "AWS::IAM::Policy", "Properties": { "PolicyDocument": { "Statement": [ { "Action": [ "ssm:DescribeParameters", "ssm:GetParameter", "ssm:GetParameterHistory", "ssm:GetParameters" ], "Effect": "Allow", "Resource": { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":ssm:", { "Ref": "AWS::Region" }, ":", { "Ref": "AWS::AccountId" }, ":parameter", { "Ref": "testRootmailHostedZoneSSMParameter574DA41C" } ] ] } }, { "Action": "ssm:PutParameter", "Effect": "Allow", "Resource": { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":ssm:", { "Ref": "AWS::Region" }, ":", { "Ref": "AWS::AccountId" }, ":parameter", { "Ref": "testRootmailHostedZoneDkimRootmailAutowireDnsAutoWireR53ChangeInfoId609129D7" } ] ] } }, { "Action": [ "route53:GetChange", "route53:ListHostedZonesByName" ], "Effect": "Allow", "Resource": "*" }, { "Action": [ "route53:ChangeResourceRecordSets", "route53:ListResourceRecordSets" ], "Effect": "Allow", "Resource": "arn:aws:route53:::hostedzone/Z01336592122MNIWKOZSV" } ], "Version": "2012-10-17" }, "PolicyName": "rootmailautowirednsprovideroneventhandlerServiceRoleDefaultPolicy4A5BBAB1", "Roles": [ { "Ref": "rootmailautowirednsprovideroneventhandlerServiceRole6D9F81B0" } ] }, "Metadata": { "cdk_nag": { "rules_to_suppress": [ { "reason": "no service role restriction needed", "id": "AwsSolutions-IAM4" }, { "reason": "wildcards are ok for the provider as the function has restrictions", "id": "AwsSolutions-IAM5" } ] } } }, "rootmailautowirednsprovideroneventhandler2ADE543F": { "Type": "AWS::Lambda::Function", "Properties": { "Code": { "S3Bucket": { "Fn::Sub": "cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}" }, "S3Key": "4c079063901e6478dbb5ace19e3123641ebf0da2ab648ecf52079c5bec154196.zip" }, "Handler": "index.handler", "Role": { "Fn::GetAtt": [ "rootmailautowirednsprovideroneventhandlerServiceRole6D9F81B0", "Arn" ] }, "Runtime": "nodejs18.x", "Timeout": 160 }, "DependsOn": [ "rootmailautowirednsprovideroneventhandlerServiceRoleDefaultPolicy4A5BBAB1", "rootmailautowirednsprovideroneventhandlerServiceRole6D9F81B0" ], "Metadata": { "cdk_nag": { "rules_to_suppress": [ { "reason": "no service role restriction needed", "id": "AwsSolutions-IAM4" }, { "reason": "wildcards are ok for the provider as the function has restrictions", "id": "AwsSolutions-IAM5" } ] } } }, "rootmailautowirednsprovideroneventhandlerLogRetentionA4DB1AD5": { "Type": "Custom::LogRetention", "Properties": { "ServiceToken": { "Fn::GetAtt": [ "LogRetentionaae0aa3c5b4d4f87b02d85b201efdd8aFD4BFC8A", "Arn" ] }, "LogGroupName": { "Fn::Join": [ "", [ "/aws/lambda/", { "Ref": "rootmailautowirednsprovideroneventhandler2ADE543F" } ] ] }, "RetentionInDays": 1 }, "Metadata": { "cdk_nag": { "rules_to_suppress": [ { "reason": "no service role restriction needed", "id": "AwsSolutions-IAM4" }, { "reason": "wildcards are ok for the provider as the function has restrictions", "id": "AwsSolutions-IAM5" } ] } } }, "rootmailautowirednsproviderrootmailautowirednsproviderframeworkonEventServiceRoleECC96780": { "Type": "AWS::IAM::Role", "Properties": { "AssumeRolePolicyDocument": { "Statement": [ { "Action": "sts:AssumeRole", "Effect": "Allow", "Principal": { "Service": "lambda.amazonaws.com" } } ], "Version": "2012-10-17" }, "ManagedPolicyArns": [ { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":iam::aws:policy/service-role/AWSLambdaBasicExecutionRole" ] ] } ] }, "Metadata": { "cdk_nag": { "rules_to_suppress": [ { "reason": "no service role restriction needed", "id": "AwsSolutions-IAM4" }, { "reason": "wildcards are ok for the provider as the function has restrictions", "id": "AwsSolutions-IAM5" } ] } } }, "rootmailautowirednsproviderrootmailautowirednsproviderframeworkonEventServiceRoleDefaultPolicy16D799D5": { "Type": "AWS::IAM::Policy", "Properties": { "PolicyDocument": { "Statement": [ { "Action": "lambda:InvokeFunction", "Effect": "Allow", "Resource": [ { "Fn::GetAtt": [ "rootmailautowirednsprovideriscompletehandlerBFD3F7F5", "Arn" ] }, { "Fn::GetAtt": [ "rootmailautowirednsprovideroneventhandler2ADE543F", "Arn" ] }, { "Fn::Join": [ "", [ { "Fn::GetAtt": [ "rootmailautowirednsprovideriscompletehandlerBFD3F7F5", "Arn" ] }, ":*" ] ] }, { "Fn::Join": [ "", [ { "Fn::GetAtt": [ "rootmailautowirednsprovideroneventhandler2ADE543F", "Arn" ] }, ":*" ] ] } ] }, { "Action": "states:StartExecution", "Effect": "Allow", "Resource": { "Ref": "rootmailautowirednsproviderrootmailautowirednsproviderwaiterstatemachine81102355" } } ], "Version": "2012-10-17" }, "PolicyName": "rootmailautowirednsproviderrootmailautowirednsproviderframeworkonEventServiceRoleDefaultPolicy16D799D5", "Roles": [ { "Ref": "rootmailautowirednsproviderrootmailautowirednsproviderframeworkonEventServiceRoleECC96780" } ] }, "Metadata": { "cdk_nag": { "rules_to_suppress": [ { "reason": "no service role restriction needed", "id": "AwsSolutions-IAM4" }, { "reason": "wildcards are ok for the provider as the function has restrictions", "id": "AwsSolutions-IAM5" } ] } } }, "rootmailautowirednsproviderrootmailautowirednsproviderframeworkonEventAA9D49B6": { "Type": "AWS::Lambda::Function", "Properties": { "Code": { "S3Bucket": { "Fn::Sub": "cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}" }, "S3Key": "bdc104ed9cab1b5b6421713c8155f0b753380595356f710400609664d3635eca.zip" }, "Description": "AWS CDK resource provider framework - onEvent (RootmailIntegTestStack/rootmail.autowire-dns-provider/rootmail-autowire-dns-provider)", "Environment": { "Variables": { "USER_ON_EVENT_FUNCTION_ARN": { "Fn::GetAtt": [ "rootmailautowirednsprovideroneventhandler2ADE543F", "Arn" ] }, "USER_IS_COMPLETE_FUNCTION_ARN": { "Fn::GetAtt": [ "rootmailautowirednsprovideriscompletehandlerBFD3F7F5", "Arn" ] }, "WAITER_STATE_MACHINE_ARN": { "Ref": "rootmailautowirednsproviderrootmailautowirednsproviderwaiterstatemachine81102355" } } }, "Handler": "framework.onEvent", "Role": { "Fn::GetAtt": [ "rootmailautowirednsproviderrootmailautowirednsproviderframeworkonEventServiceRoleECC96780", "Arn" ] }, "Runtime": { "Fn::FindInMap": [ "LatestNodeRuntimeMap", { "Ref": "AWS::Region" }, "value" ] }, "Timeout": 900 }, "DependsOn": [ "rootmailautowirednsproviderrootmailautowirednsproviderframeworkonEventServiceRoleDefaultPolicy16D799D5", "rootmailautowirednsproviderrootmailautowirednsproviderframeworkonEventServiceRoleECC96780" ], "Metadata": { "cdk_nag": { "rules_to_suppress": [ { "reason": "no service role restriction needed", "id": "AwsSolutions-IAM4" }, { "reason": "wildcards are ok for the provider as the function has restrictions", "id": "AwsSolutions-IAM5" } ] } } }, "rootmailautowirednsproviderrootmailautowirednsproviderframeworkonEventLogRetention06222B6A": { "Type": "Custom::LogRetention", "Properties": { "ServiceToken": { "Fn::GetAtt": [ "LogRetentionaae0aa3c5b4d4f87b02d85b201efdd8aFD4BFC8A", "Arn" ] }, "LogGroupName": { "Fn::Join": [ "", [ "/aws/lambda/", { "Ref": "rootmailautowirednsproviderrootmailautowirednsproviderframeworkonEventAA9D49B6" } ] ] }, "RetentionInDays": 1 }, "Metadata": { "cdk_nag": { "rules_to_suppress": [ { "reason": "no service role restriction needed", "id": "AwsSolutions-IAM4" }, { "reason": "wildcards are ok for the provider as the function has restrictions", "id": "AwsSolutions-IAM5" } ] } } }, "rootmailautowirednsproviderrootmailautowirednsproviderframeworkisCompleteServiceRoleD15A96AC": { "Type": "AWS::IAM::Role", "Properties": { "AssumeRolePolicyDocument": { "Statement": [ { "Action": "sts:AssumeRole", "Effect": "Allow", "Principal": { "Service": "lambda.amazonaws.com" } } ], "Version": "2012-10-17" }, "ManagedPolicyArns": [ { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":iam::aws:policy/service-role/AWSLambdaBasicExecutionRole" ] ] } ] }, "Metadata": { "cdk_nag": { "rules_to_suppress": [ { "reason": "no service role restriction needed", "id": "AwsSolutions-IAM4" }, { "reason": "wildcards are ok for the provider as the function has restrictions", "id": "AwsSolutions-IAM5" } ] } } }, "rootmailautowirednsproviderrootmailautowirednsproviderframeworkisCompleteServiceRoleDefaultPolicy5728F288": { "Type": "AWS::IAM::Policy", "Properties": { "PolicyDocument": { "Statement": [ { "Action": "lambda:InvokeFunction", "Effect": "Allow", "Resource": [ { "Fn::GetAtt": [ "rootmailautowirednsprovideriscompletehandlerBFD3F7F5", "Arn" ] }, { "Fn::GetAtt": [ "rootmailautowirednsprovideroneventhandler2ADE543F", "Arn" ] }, { "Fn::Join": [ "", [ { "Fn::GetAtt": [ "rootmailautowirednsprovideriscompletehandlerBFD3F7F5", "Arn" ] }, ":*" ] ] }, { "Fn::Join": [ "", [ { "Fn::GetAtt": [ "rootmailautowirednsprovideroneventhandler2ADE543F", "Arn" ] }, ":*" ] ] } ] } ], "Version": "2012-10-17" }, "PolicyName": "rootmailautowirednsproviderrootmailautowirednsproviderframeworkisCompleteServiceRoleDefaultPolicy5728F288", "Roles": [ { "Ref": "rootmailautowirednsproviderrootmailautowirednsproviderframeworkisCompleteServiceRoleD15A96AC" } ] }, "Metadata": { "cdk_nag": { "rules_to_suppress": [ { "reason": "no service role restriction needed", "id": "AwsSolutions-IAM4" }, { "reason": "wildcards are ok for the provider as the function has restrictions", "id": "AwsSolutions-IAM5" } ] } } }, "rootmailautowirednsproviderrootmailautowirednsproviderframeworkisCompleteC48DABD2": { "Type": "AWS::Lambda::Function", "Properties": { "Code": { "S3Bucket": { "Fn::Sub": "cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}" }, "S3Key": "bdc104ed9cab1b5b6421713c8155f0b753380595356f710400609664d3635eca.zip" }, "Description": "AWS CDK resource provider framework - isComplete (RootmailIntegTestStack/rootmail.autowire-dns-provider/rootmail-autowire-dns-provider)", "Environment": { "Variables": { "USER_ON_EVENT_FUNCTION_ARN": { "Fn::GetAtt": [ "rootmailautowirednsprovideroneventhandler2ADE543F", "Arn" ] }, "USER_IS_COMPLETE_FUNCTION_ARN": { "Fn::GetAtt": [ "rootmailautowirednsprovideriscompletehandlerBFD3F7F5", "Arn" ] } } }, "Handler": "framework.isComplete", "Role": { "Fn::GetAtt": [ "rootmailautowirednsproviderrootmailautowirednsproviderframeworkisCompleteServiceRoleD15A96AC", "Arn" ] }, "Runtime": { "Fn::FindInMap": [ "LatestNodeRuntimeMap", { "Ref": "AWS::Region" }, "value" ] }, "Timeout": 900 }, "DependsOn": [ "rootmailautowirednsproviderrootmailautowirednsproviderframeworkisCompleteServiceRoleDefaultPolicy5728F288", "rootmailautowirednsproviderrootmailautowirednsproviderframeworkisCompleteServiceRoleD15A96AC" ], "Metadata": { "cdk_nag": { "rules_to_suppress": [ { "reason": "no service role restriction needed", "id": "AwsSolutions-IAM4" }, { "reason": "wildcards are ok for the provider as the function has restrictions", "id": "AwsSolutions-IAM5" } ] } } }, "rootmailautowirednsproviderrootmailautowirednsproviderframeworkisCompleteLogRetentionB48EA66E": { "Type": "Custom::LogRetention", "Properties": { "ServiceToken": { "Fn::GetAtt": [ "LogRetentionaae0aa3c5b4d4f87b02d85b201efdd8aFD4BFC8A", "Arn" ] }, "LogGroupName": { "Fn::Join": [ "", [ "/aws/lambda/", { "Ref": "rootmailautowirednsproviderrootmailautowirednsproviderframeworkisCompleteC48DABD2" } ] ] }, "RetentionInDays": 1 }, "Metadata": { "cdk_nag": { "rules_to_suppress": [ { "reason": "no service role restriction needed", "id": "AwsSolutions-IAM4" }, { "reason": "wildcards are ok for the provider as the function has restrictions", "id": "AwsSolutions-IAM5" } ] } } }, "rootmailautowirednsproviderrootmailautowirednsproviderframeworkonTimeoutServiceRole4383D224": { "Type": "AWS::IAM::Role", "Properties": { "AssumeRolePolicyDocument": { "Statement": [ { "Action": "sts:AssumeRole", "Effect": "Allow", "Principal": { "Service": "lambda.amazonaws.com" } } ], "Version": "2012-10-17" }, "ManagedPolicyArns": [ { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":iam::aws:policy/service-role/AWSLambdaBasicExecutionRole" ] ] } ] }, "Metadata": { "cdk_nag": { "rules_to_suppress": [ { "reason": "no service role restriction needed", "id": "AwsSolutions-IAM4" }, { "reason": "wildcards are ok for the provider as the function has restrictions", "id": "AwsSolutions-IAM5" } ] } } }, "rootmailautowirednsproviderrootmailautowirednsproviderframeworkonTimeoutServiceRoleDefaultPolicy53D3B624": { "Type": "AWS::IAM::Policy", "Properties": { "PolicyDocument": { "Statement": [ { "Action": "lambda:InvokeFunction", "Effect": "Allow", "Resource": [ { "Fn::GetAtt": [ "rootmailautowirednsprovideriscompletehandlerBFD3F7F5", "Arn" ] }, { "Fn::GetAtt": [ "rootmailautowirednsprovideroneventhandler2ADE543F", "Arn" ] }, { "Fn::Join": [ "", [ { "Fn::GetAtt": [ "rootmailautowirednsprovideriscompletehandlerBFD3F7F5", "Arn" ] }, ":*" ] ] }, { "Fn::Join": [ "", [ { "Fn::GetAtt": [ "rootmailautowirednsprovideroneventhandler2ADE543F", "Arn" ] }, ":*" ] ] } ] } ], "Version": "2012-10-17" }, "PolicyName": "rootmailautowirednsproviderrootmailautowirednsproviderframeworkonTimeoutServiceRoleDefaultPolicy53D3B624", "Roles": [ { "Ref": "rootmailautowirednsproviderrootmailautowirednsproviderframeworkonTimeoutServiceRole4383D224" } ] }, "Metadata": { "cdk_nag": { "rules_to_suppress": [ { "reason": "no service role restriction needed", "id": "AwsSolutions-IAM4" }, { "reason": "wildcards are ok for the provider as the function has restrictions", "id": "AwsSolutions-IAM5" } ] } } }, "rootmailautowirednsproviderrootmailautowirednsproviderframeworkonTimeoutC714B95F": { "Type": "AWS::Lambda::Function", "Properties": { "Code": { "S3Bucket": { "Fn::Sub": "cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}" }, "S3Key": "bdc104ed9cab1b5b6421713c8155f0b753380595356f710400609664d3635eca.zip" }, "Description": "AWS CDK resource provider framework - onTimeout (RootmailIntegTestStack/rootmail.autowire-dns-provider/rootmail-autowire-dns-provider)", "Environment": { "Variables": { "USER_ON_EVENT_FUNCTION_ARN": { "Fn::GetAtt": [ "rootmailautowirednsprovideroneventhandler2ADE543F", "Arn" ] }, "USER_IS_COMPLETE_FUNCTION_ARN": { "Fn::GetAtt": [ "rootmailautowirednsprovideriscompletehandlerBFD3F7F5", "Arn" ] } } }, "Handler": "framework.onTimeout", "Role": { "Fn::GetAtt": [ "rootmailautowirednsproviderrootmailautowirednsproviderframeworkonTimeoutServiceRole4383D224", "Arn" ] }, "Runtime": { "Fn::FindInMap": [ "LatestNodeRuntimeMap", { "Ref": "AWS::Region" }, "value" ] }, "Timeout": 900 }, "DependsOn": [ "rootmailautowirednsproviderrootmailautowirednsproviderframeworkonTimeoutServiceRoleDefaultPolicy53D3B624", "rootmailautowirednsproviderrootmailautowirednsproviderframeworkonTimeoutServiceRole4383D224" ], "Metadata": { "cdk_nag": { "rules_to_suppress": [ { "reason": "no service role restriction needed", "id": "AwsSolutions-IAM4" }, { "reason": "wildcards are ok for the provider as the function has restrictions", "id": "AwsSolutions-IAM5" } ] } } }, "rootmailautowirednsproviderrootmailautowirednsproviderframeworkonTimeoutLogRetention59C14E50": { "Type": "Custom::LogRetention", "Properties": { "ServiceToken": { "Fn::GetAtt": [ "LogRetentionaae0aa3c5b4d4f87b02d85b201efdd8aFD4BFC8A", "Arn" ] }, "LogGroupName": { "Fn::Join": [ "", [ "/aws/lambda/", { "Ref": "rootmailautowirednsproviderrootmailautowirednsproviderframeworkonTimeoutC714B95F" } ] ] }, "RetentionInDays": 1 }, "Metadata": { "cdk_nag": { "rules_to_suppress": [ { "reason": "no service role restriction needed", "id": "AwsSolutions-IAM4" }, { "reason": "wildcards are ok for the provider as the function has restrictions", "id": "AwsSolutions-IAM5" } ] } } }, "rootmailautowirednsproviderrootmailautowirednsproviderwaiterstatemachineRole258A7061": { "Type": "AWS::IAM::Role", "Properties": { "AssumeRolePolicyDocument": { "Statement": [ { "Action": "sts:AssumeRole", "Effect": "Allow", "Principal": { "Service": "states.amazonaws.com" } } ], "Version": "2012-10-17" } }, "Metadata": { "cdk_nag": { "rules_to_suppress": [ { "reason": "no service role restriction needed", "id": "AwsSolutions-IAM4" }, { "reason": "wildcards are ok for the provider as the function has restrictions", "id": "AwsSolutions-IAM5" } ] } } }, "rootmailautowirednsproviderrootmailautowirednsproviderwaiterstatemachineRoleDefaultPolicy310226B4": { "Type": "AWS::IAM::Policy", "Properties": { "PolicyDocument": { "Statement": [ { "Action": "lambda:InvokeFunction", "Effect": "Allow", "Resource": [ { "Fn::GetAtt": [ "rootmailautowirednsproviderrootmailautowirednsproviderframeworkisCompleteC48DABD2", "Arn" ] }, { "Fn::GetAtt": [ "rootmailautowirednsproviderrootmailautowirednsproviderframeworkonTimeoutC714B95F", "Arn" ] }, { "Fn::Join": [ "", [ { "Fn::GetAtt": [ "rootmailautowirednsproviderrootmailautowirednsproviderframeworkisCompleteC48DABD2", "Arn" ] }, ":*" ] ] }, { "Fn::Join": [ "", [ { "Fn::GetAtt": [ "rootmailautowirednsproviderrootmailautowirednsproviderframeworkonTimeoutC714B95F", "Arn" ] }, ":*" ] ] } ] }, { "Action": [ "logs:CreateLogDelivery", "logs:CreateLogStream", "logs:DeleteLogDelivery", "logs:DescribeLogGroups", "logs:DescribeResourcePolicies", "logs:GetLogDelivery", "logs:ListLogDeliveries", "logs:PutLogEvents", "logs:PutResourcePolicy", "logs:UpdateLogDelivery" ], "Effect": "Allow", "Resource": "*" } ], "Version": "2012-10-17" }, "PolicyName": "rootmailautowirednsproviderrootmailautowirednsproviderwaiterstatemachineRoleDefaultPolicy310226B4", "Roles": [ { "Ref": "rootmailautowirednsproviderrootmailautowirednsproviderwaiterstatemachineRole258A7061" } ] }, "Metadata": { "cdk_nag": { "rules_to_suppress": [ { "reason": "no service role restriction needed", "id": "AwsSolutions-IAM4" }, { "reason": "wildcards are ok for the provider as the function has restrictions", "id": "AwsSolutions-IAM5" } ] } } }, "rootmailautowirednsproviderrootmailautowirednsproviderwaiterstatemachineLogGroup8F234E2E": { "Type": "AWS::Logs::LogGroup", "Properties": { "LogGroupName": { "Fn::Join": [ "", [ "/aws/vendedlogs/states/waiter-state-machine-", { "Ref": "rootmailautowirednsproviderrootmailautowirednsproviderframeworkisCompleteC48DABD2" }, "-c87dd05ebab293a9aee46077d679d140dd7cde1383" ] ] }, "RetentionInDays": 731 }, "UpdateReplacePolicy": "Retain", "DeletionPolicy": "Retain", "Metadata": { "cdk_nag": { "rules_to_suppress": [ { "reason": "no service role restriction needed", "id": "AwsSolutions-IAM4" }, { "reason": "wildcards are ok for the provider as the function has restrictions", "id": "AwsSolutions-IAM5" } ] } } }, "rootmailautowirednsproviderrootmailautowirednsproviderwaiterstatemachine81102355": { "Type": "AWS::StepFunctions::StateMachine", "Properties": { "DefinitionString": { "Fn::Join": [ "", [ "{\"StartAt\":\"framework-isComplete-task\",\"States\":{\"framework-isComplete-task\":{\"End\":true,\"Retry\":[{\"ErrorEquals\":[\"States.ALL\"],\"IntervalSeconds\":5,\"MaxAttempts\":1440,\"BackoffRate\":1}],\"Catch\":[{\"ErrorEquals\":[\"States.ALL\"],\"Next\":\"framework-onTimeout-task\"}],\"Type\":\"Task\",\"Resource\":\"", { "Fn::GetAtt": [ "rootmailautowirednsproviderrootmailautowirednsproviderframeworkisCompleteC48DABD2", "Arn" ] }, "\"},\"framework-onTimeout-task\":{\"End\":true,\"Type\":\"Task\",\"Resource\":\"", { "Fn::GetAtt": [ "rootmailautowirednsproviderrootmailautowirednsproviderframeworkonTimeoutC714B95F", "Arn" ] }, "\"}}}" ] ] }, "LoggingConfiguration": { "Destinations": [ { "CloudWatchLogsLogGroup": { "LogGroupArn": { "Fn::GetAtt": [ "rootmailautowirednsproviderrootmailautowirednsproviderwaiterstatemachineLogGroup8F234E2E", "Arn" ] } } } ], "IncludeExecutionData": false, "Level": "ERROR" }, "RoleArn": { "Fn::GetAtt": [ "rootmailautowirednsproviderrootmailautowirednsproviderwaiterstatemachineRole258A7061", "Arn" ] } }, "DependsOn": [ "rootmailautowirednsproviderrootmailautowirednsproviderwaiterstatemachineRoleDefaultPolicy310226B4", "rootmailautowirednsproviderrootmailautowirednsproviderwaiterstatemachineRole258A7061" ], "Metadata": { "cdk_nag": { "rules_to_suppress": [ { "reason": "no service role restriction needed", "id": "AwsSolutions-IAM4" }, { "reason": "wildcards are ok for the provider as the function has restrictions", "id": "AwsSolutions-IAM5" } ] } } }, "rootmailhostedzonedkimpropagationprovideriscompletehandlerServiceRoleDFD2C35E": { "Type": "AWS::IAM::Role", "Properties": { "AssumeRolePolicyDocument": { "Statement": [ { "Action": "sts:AssumeRole", "Effect": "Allow", "Principal": { "Service": "lambda.amazonaws.com" } } ], "Version": "2012-10-17" }, "ManagedPolicyArns": [ { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":iam::aws:policy/service-role/AWSLambdaBasicExecutionRole" ] ] } ] }, "Metadata": { "cdk_nag": { "rules_to_suppress": [ { "reason": "no service role restriction needed", "id": "AwsSolutions-IAM4" }, { "reason": "wildcards are ok for the provider as the function has restrictions", "id": "AwsSolutions-IAM5" } ] } } }, "rootmailhostedzonedkimpropagationprovideriscompletehandlerServiceRoleDefaultPolicy57D46916": { "Type": "AWS::IAM::Policy", "Properties": { "PolicyDocument": { "Statement": [ { "Action": [ "ses:GetAccountSendingEnabled", "ses:GetIdentityDkimAttributes", "ses:GetIdentityNotificationAttributes", "ses:GetIdentityVerificationAttributes" ], "Effect": "Allow", "Resource": "*" } ], "Version": "2012-10-17" }, "PolicyName": "rootmailhostedzonedkimpropagationprovideriscompletehandlerServiceRoleDefaultPolicy57D46916", "Roles": [ { "Ref": "rootmailhostedzonedkimpropagationprovideriscompletehandlerServiceRoleDFD2C35E" } ] }, "Metadata": { "cdk_nag": { "rules_to_suppress": [ { "reason": "no service role restriction needed", "id": "AwsSolutions-IAM4" }, { "reason": "wildcards are ok for the provider as the function has restrictions", "id": "AwsSolutions-IAM5" } ] } } }, "rootmailhostedzonedkimpropagationprovideriscompletehandlerB67C8E91": { "Type": "AWS::Lambda::Function", "Properties": { "Code": { "S3Bucket": { "Fn::Sub": "cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}" }, "S3Key": "7e8a681794eff5fda1841caa360113df5488ecf944055a69b8f1e5a687e269f5.zip" }, "Handler": "index.handler", "Role": { "Fn::GetAtt": [ "rootmailhostedzonedkimpropagationprovideriscompletehandlerServiceRoleDFD2C35E", "Arn" ] }, "Runtime": "nodejs18.x", "Timeout": 30 }, "DependsOn": [ "rootmailhostedzonedkimpropagationprovideriscompletehandlerServiceRoleDefaultPolicy57D46916", "rootmailhostedzonedkimpropagationprovideriscompletehandlerServiceRoleDFD2C35E" ], "Metadata": { "cdk_nag": { "rules_to_suppress": [ { "reason": "no service role restriction needed", "id": "AwsSolutions-IAM4" }, { "reason": "wildcards are ok for the provider as the function has restrictions", "id": "AwsSolutions-IAM5" } ] } } }, "rootmailhostedzonedkimpropagationprovideriscompletehandlerLogRetentionA997105A": { "Type": "Custom::LogRetention", "Properties": { "ServiceToken": { "Fn::GetAtt": [ "LogRetentionaae0aa3c5b4d4f87b02d85b201efdd8aFD4BFC8A", "Arn" ] }, "LogGroupName": { "Fn::Join": [ "", [ "/aws/lambda/", { "Ref": "rootmailhostedzonedkimpropagationprovideriscompletehandlerB67C8E91" } ] ] }, "RetentionInDays": 1 }, "Metadata": { "cdk_nag": { "rules_to_suppress": [ { "reason": "no service role restriction needed", "id": "AwsSolutions-IAM4" }, { "reason": "wildcards are ok for the provider as the function has restrictions", "id": "AwsSolutions-IAM5" } ] } } }, "rootmailhostedzonedkimpropagationprovideroneventhandlerServiceRole02FD73CE": { "Type": "AWS::IAM::Role", "Properties": { "AssumeRolePolicyDocument": { "Statement": [ { "Action": "sts:AssumeRole", "Effect": "Allow", "Principal": { "Service": "lambda.amazonaws.com" } } ], "Version": "2012-10-17" }, "ManagedPolicyArns": [ { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":iam::aws:policy/service-role/AWSLambdaBasicExecutionRole" ] ] } ] }, "Metadata": { "cdk_nag": { "rules_to_suppress": [ { "reason": "no service role restriction needed", "id": "AwsSolutions-IAM4" }, { "reason": "wildcards are ok for the provider as the function has restrictions", "id": "AwsSolutions-IAM5" } ] } } }, "rootmailhostedzonedkimpropagationprovideroneventhandlerC59BDC16": { "Type": "AWS::Lambda::Function", "Properties": { "Code": { "S3Bucket": { "Fn::Sub": "cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}" }, "S3Key": "9572b451243318765beb576ae7528096b3879783dbaab795c02c01d7f4e83438.zip" }, "Handler": "index.handler", "Role": { "Fn::GetAtt": [ "rootmailhostedzonedkimpropagationprovideroneventhandlerServiceRole02FD73CE", "Arn" ] }, "Runtime": "nodejs18.x", "Timeout": 10 }, "DependsOn": [ "rootmailhostedzonedkimpropagationprovideroneventhandlerServiceRole02FD73CE" ], "Metadata": { "cdk_nag": { "rules_to_suppress": [ { "reason": "no service role restriction needed", "id": "AwsSolutions-IAM4" }, { "reason": "wildcards are ok for the provider as the function has restrictions", "id": "AwsSolutions-IAM5" } ] } } }, "rootmailhostedzonedkimpropagationprovideroneventhandlerLogRetentionD97E8A18": { "Type": "Custom::LogRetention", "Properties": { "ServiceToken": { "Fn::GetAtt": [ "LogRetentionaae0aa3c5b4d4f87b02d85b201efdd8aFD4BFC8A", "Arn" ] }, "LogGroupName": { "Fn::Join": [ "", [ "/aws/lambda/", { "Ref": "rootmailhostedzonedkimpropagationprovideroneventhandlerC59BDC16" } ] ] }, "RetentionInDays": 1 }, "Metadata": { "cdk_nag": { "rules_to_suppress": [ { "reason": "no service role restriction needed", "id": "AwsSolutions-IAM4" }, { "reason": "wildcards are ok for the provider as the function has restrictions", "id": "AwsSolutions-IAM5" } ] } } }, "rootmailhostedzonedkimpropagationproviderframeworkonEventServiceRole5729BE95": { "Type": "AWS::IAM::Role", "Properties": { "AssumeRolePolicyDocument": { "Statement": [ { "Action": "sts:AssumeRole", "Effect": "Allow", "Principal": { "Service": "lambda.amazonaws.com" } } ], "Version": "2012-10-17" }, "ManagedPolicyArns": [ { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":iam::aws:policy/service-role/AWSLambdaBasicExecutionRole" ] ] } ] }, "Metadata": { "cdk_nag": { "rules_to_suppress": [ { "reason": "no service role restriction needed", "id": "AwsSolutions-IAM4" }, { "reason": "wildcards are ok for the provider as the function has restrictions", "id": "AwsSolutions-IAM5" } ] } } }, "rootmailhostedzonedkimpropagationproviderframeworkonEventServiceRoleDefaultPolicy68675555": { "Type": "AWS::IAM::Policy", "Properties": { "PolicyDocument": { "Statement": [ { "Action": "lambda:InvokeFunction", "Effect": "Allow", "Resource": [ { "Fn::GetAtt": [ "rootmailhostedzonedkimpropagationprovideriscompletehandlerB67C8E91", "Arn" ] }, { "Fn::GetAtt": [ "rootmailhostedzonedkimpropagationprovideroneventhandlerC59BDC16", "Arn" ] }, { "Fn::Join": [ "", [ { "Fn::GetAtt": [ "rootmailhostedzonedkimpropagationprovideriscompletehandlerB67C8E91", "Arn" ] }, ":*" ] ] }, { "Fn::Join": [ "", [ { "Fn::GetAtt": [ "rootmailhostedzonedkimpropagationprovideroneventhandlerC59BDC16", "Arn" ] }, ":*" ] ] } ] }, { "Action": "states:StartExecution", "Effect": "Allow", "Resource": { "Ref": "rootmailhostedzonedkimpropagationproviderwaiterstatemachine2C629ADB" } } ], "Version": "2012-10-17" }, "PolicyName": "rootmailhostedzonedkimpropagationproviderframeworkonEventServiceRoleDefaultPolicy68675555", "Roles": [ { "Ref": "rootmailhostedzonedkimpropagationproviderframeworkonEventServiceRole5729BE95" } ] }, "Metadata": { "cdk_nag": { "rules_to_suppress": [ { "reason": "no service role restriction needed", "id": "AwsSolutions-IAM4" }, { "reason": "wildcards are ok for the provider as the function has restrictions", "id": "AwsSolutions-IAM5" } ] } } }, "rootmailhostedzonedkimpropagationproviderframeworkonEvent15357119": { "Type": "AWS::Lambda::Function", "Properties": { "Code": { "S3Bucket": { "Fn::Sub": "cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}" }, "S3Key": "bdc104ed9cab1b5b6421713c8155f0b753380595356f710400609664d3635eca.zip" }, "Description": "AWS CDK resource provider framework - onEvent (RootmailIntegTestStack/rootmail.hosted-zone-dkim-propagation-provider/hosted-zone-dkim-propagation-provider)", "Environment": { "Variables": { "USER_ON_EVENT_FUNCTION_ARN": { "Fn::GetAtt": [ "rootmailhostedzonedkimpropagationprovideroneventhandlerC59BDC16", "Arn" ] }, "USER_IS_COMPLETE_FUNCTION_ARN": { "Fn::GetAtt": [ "rootmailhostedzonedkimpropagationprovideriscompletehandlerB67C8E91", "Arn" ] }, "WAITER_STATE_MACHINE_ARN": { "Ref": "rootmailhostedzonedkimpropagationproviderwaiterstatemachine2C629ADB" } } }, "Handler": "framework.onEvent", "Role": { "Fn::GetAtt": [ "rootmailhostedzonedkimpropagationproviderframeworkonEventServiceRole5729BE95", "Arn" ] }, "Runtime": { "Fn::FindInMap": [ "LatestNodeRuntimeMap", { "Ref": "AWS::Region" }, "value" ] }, "Timeout": 900 }, "DependsOn": [ "rootmailhostedzonedkimpropagationproviderframeworkonEventServiceRoleDefaultPolicy68675555", "rootmailhostedzonedkimpropagationproviderframeworkonEventServiceRole5729BE95" ], "Metadata": { "cdk_nag": { "rules_to_suppress": [ { "reason": "no service role restriction needed", "id": "AwsSolutions-IAM4" }, { "reason": "wildcards are ok for the provider as the function has restrictions", "id": "AwsSolutions-IAM5" } ] } } }, "rootmailhostedzonedkimpropagationproviderframeworkonEventLogRetention39EDE52F": { "Type": "Custom::LogRetention", "Properties": { "ServiceToken": { "Fn::GetAtt": [ "LogRetentionaae0aa3c5b4d4f87b02d85b201efdd8aFD4BFC8A", "Arn" ] }, "LogGroupName": { "Fn::Join": [ "", [ "/aws/lambda/", { "Ref": "rootmailhostedzonedkimpropagationproviderframeworkonEvent15357119" } ] ] }, "RetentionInDays": 1 }, "Metadata": { "cdk_nag": { "rules_to_suppress": [ { "reason": "no service role restriction needed", "id": "AwsSolutions-IAM4" }, { "reason": "wildcards are ok for the provider as the function has restrictions", "id": "AwsSolutions-IAM5" } ] } } }, "rootmailhostedzonedkimpropagationproviderframeworkisCompleteServiceRole9BABA5E5": { "Type": "AWS::IAM::Role", "Properties": { "AssumeRolePolicyDocument": { "Statement": [ { "Action": "sts:AssumeRole", "Effect": "Allow", "Principal": { "Service": "lambda.amazonaws.com" } } ], "Version": "2012-10-17" }, "ManagedPolicyArns": [ { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":iam::aws:policy/service-role/AWSLambdaBasicExecutionRole" ] ] } ] }, "Metadata": { "cdk_nag": { "rules_to_suppress": [ { "reason": "no service role restriction needed", "id": "AwsSolutions-IAM4" }, { "reason": "wildcards are ok for the provider as the function has restrictions", "id": "AwsSolutions-IAM5" } ] } } }, "rootmailhostedzonedkimpropagationproviderframeworkisCompleteServiceRoleDefaultPolicy02D0AEA6": { "Type": "AWS::IAM::Policy", "Properties": { "PolicyDocument": { "Statement": [ { "Action": "lambda:InvokeFunction", "Effect": "Allow", "Resource": [ { "Fn::GetAtt": [ "rootmailhostedzonedkimpropagationprovideriscompletehandlerB67C8E91", "Arn" ] }, { "Fn::GetAtt": [ "rootmailhostedzonedkimpropagationprovideroneventhandlerC59BDC16", "Arn" ] }, { "Fn::Join": [ "", [ { "Fn::GetAtt": [ "rootmailhostedzonedkimpropagationprovideriscompletehandlerB67C8E91", "Arn" ] }, ":*" ] ] }, { "Fn::Join": [ "", [ { "Fn::GetAtt": [ "rootmailhostedzonedkimpropagationprovideroneventhandlerC59BDC16", "Arn" ] }, ":*" ] ] } ] } ], "Version": "2012-10-17" }, "PolicyName": "rootmailhostedzonedkimpropagationproviderframeworkisCompleteServiceRoleDefaultPolicy02D0AEA6", "Roles": [ { "Ref": "rootmailhostedzonedkimpropagationproviderframeworkisCompleteServiceRole9BABA5E5" } ] }, "Metadata": { "cdk_nag": { "rules_to_suppress": [ { "reason": "no service role restriction needed", "id": "AwsSolutions-IAM4" }, { "reason": "wildcards are ok for the provider as the function has restrictions", "id": "AwsSolutions-IAM5" } ] } } }, "rootmailhostedzonedkimpropagationproviderframeworkisComplete165FE163": { "Type": "AWS::Lambda::Function", "Properties": { "Code": { "S3Bucket": { "Fn::Sub": "cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}" }, "S3Key": "bdc104ed9cab1b5b6421713c8155f0b753380595356f710400609664d3635eca.zip" }, "Description": "AWS CDK resource provider framework - isComplete (RootmailIntegTestStack/rootmail.hosted-zone-dkim-propagation-provider/hosted-zone-dkim-propagation-provider)", "Environment": { "Variables": { "USER_ON_EVENT_FUNCTION_ARN": { "Fn::GetAtt": [ "rootmailhostedzonedkimpropagationprovideroneventhandlerC59BDC16", "Arn" ] }, "USER_IS_COMPLETE_FUNCTION_ARN": { "Fn::GetAtt": [ "rootmailhostedzonedkimpropagationprovideriscompletehandlerB67C8E91", "Arn" ] } } }, "Handler": "framework.isComplete", "Role": { "Fn::GetAtt": [ "rootmailhostedzonedkimpropagationproviderframeworkisCompleteServiceRole9BABA5E5", "Arn" ] }, "Runtime": { "Fn::FindInMap": [ "LatestNodeRuntimeMap", { "Ref": "AWS::Region" }, "value" ] }, "Timeout": 900 }, "DependsOn": [ "rootmailhostedzonedkimpropagationproviderframeworkisCompleteServiceRoleDefaultPolicy02D0AEA6", "rootmailhostedzonedkimpropagationproviderframeworkisCompleteServiceRole9BABA5E5" ], "Metadata": { "cdk_nag": { "rules_to_suppress": [ { "reason": "no service role restriction needed", "id": "AwsSolutions-IAM4" }, { "reason": "wildcards are ok for the provider as the function has restrictions", "id": "AwsSolutions-IAM5" } ] } } }, "rootmailhostedzonedkimpropagationproviderframeworkisCompleteLogRetentionF6AB8959": { "Type": "Custom::LogRetention", "Properties": { "ServiceToken": { "Fn::GetAtt": [ "LogRetentionaae0aa3c5b4d4f87b02d85b201efdd8aFD4BFC8A", "Arn" ] }, "LogGroupName": { "Fn::Join": [ "", [ "/aws/lambda/", { "Ref": "rootmailhostedzonedkimpropagationproviderframeworkisComplete165FE163" } ] ] }, "RetentionInDays": 1 }, "Metadata": { "cdk_nag": { "rules_to_suppress": [ { "reason": "no service role restriction needed", "id": "AwsSolutions-IAM4" }, { "reason": "wildcards are ok for the provider as the function has restrictions", "id": "AwsSolutions-IAM5" } ] } } }, "rootmailhostedzonedkimpropagationproviderframeworkonTimeoutServiceRoleB169BF13": { "Type": "AWS::IAM::Role", "Properties": { "AssumeRolePolicyDocument": { "Statement": [ { "Action": "sts:AssumeRole", "Effect": "Allow", "Principal": { "Service": "lambda.amazonaws.com" } } ], "Version": "2012-10-17" }, "ManagedPolicyArns": [ { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":iam::aws:policy/service-role/AWSLambdaBasicExecutionRole" ] ] } ] }, "Metadata": { "cdk_nag": { "rules_to_suppress": [ { "reason": "no service role restriction needed", "id": "AwsSolutions-IAM4" }, { "reason": "wildcards are ok for the provider as the function has restrictions", "id": "AwsSolutions-IAM5" } ] } } }, "rootmailhostedzonedkimpropagationproviderframeworkonTimeoutServiceRoleDefaultPolicy2FF6168E": { "Type": "AWS::IAM::Policy", "Properties": { "PolicyDocument": { "Statement": [ { "Action": "lambda:InvokeFunction", "Effect": "Allow", "Resource": [ { "Fn::GetAtt": [ "rootmailhostedzonedkimpropagationprovideriscompletehandlerB67C8E91", "Arn" ] }, { "Fn::GetAtt": [ "rootmailhostedzonedkimpropagationprovideroneventhandlerC59BDC16", "Arn" ] }, { "Fn::Join": [ "", [ { "Fn::GetAtt": [ "rootmailhostedzonedkimpropagationprovideriscompletehandlerB67C8E91", "Arn" ] }, ":*" ] ] }, { "Fn::Join": [ "", [ { "Fn::GetAtt": [ "rootmailhostedzonedkimpropagationprovideroneventhandlerC59BDC16", "Arn" ] }, ":*" ] ] } ] } ], "Version": "2012-10-17" }, "PolicyName": "rootmailhostedzonedkimpropagationproviderframeworkonTimeoutServiceRoleDefaultPolicy2FF6168E", "Roles": [ { "Ref": "rootmailhostedzonedkimpropagationproviderframeworkonTimeoutServiceRoleB169BF13" } ] }, "Metadata": { "cdk_nag": { "rules_to_suppress": [ { "reason": "no service role restriction needed", "id": "AwsSolutions-IAM4" }, { "reason": "wildcards are ok for the provider as the function has restrictions", "id": "AwsSolutions-IAM5" } ] } } }, "rootmailhostedzonedkimpropagationproviderframeworkonTimeout7D8A73CD": { "Type": "AWS::Lambda::Function", "Properties": { "Code": { "S3Bucket": { "Fn::Sub": "cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}" }, "S3Key": "bdc104ed9cab1b5b6421713c8155f0b753380595356f710400609664d3635eca.zip" }, "Description": "AWS CDK resource provider framework - onTimeout (RootmailIntegTestStack/rootmail.hosted-zone-dkim-propagation-provider/hosted-zone-dkim-propagation-provider)", "Environment": { "Variables": { "USER_ON_EVENT_FUNCTION_ARN": { "Fn::GetAtt": [ "rootmailhostedzonedkimpropagationprovideroneventhandlerC59BDC16", "Arn" ] }, "USER_IS_COMPLETE_FUNCTION_ARN": { "Fn::GetAtt": [ "rootmailhostedzonedkimpropagationprovideriscompletehandlerB67C8E91", "Arn" ] } } }, "Handler": "framework.onTimeout", "Role": { "Fn::GetAtt": [ "rootmailhostedzonedkimpropagationproviderframeworkonTimeoutServiceRoleB169BF13", "Arn" ] }, "Runtime": { "Fn::FindInMap": [ "LatestNodeRuntimeMap", { "Ref": "AWS::Region" }, "value" ] }, "Timeout": 900 }, "DependsOn": [ "rootmailhostedzonedkimpropagationproviderframeworkonTimeoutServiceRoleDefaultPolicy2FF6168E", "rootmailhostedzonedkimpropagationproviderframeworkonTimeoutServiceRoleB169BF13" ], "Metadata": { "cdk_nag": { "rules_to_suppress": [ { "reason": "no service role restriction needed", "id": "AwsSolutions-IAM4" }, { "reason": "wildcards are ok for the provider as the function has restrictions", "id": "AwsSolutions-IAM5" } ] } } }, "rootmailhostedzonedkimpropagationproviderframeworkonTimeoutLogRetentionB2967E04": { "Type": "Custom::LogRetention", "Properties": { "ServiceToken": { "Fn::GetAtt": [ "LogRetentionaae0aa3c5b4d4f87b02d85b201efdd8aFD4BFC8A", "Arn" ] }, "LogGroupName": { "Fn::Join": [ "", [ "/aws/lambda/", { "Ref": "rootmailhostedzonedkimpropagationproviderframeworkonTimeout7D8A73CD" } ] ] }, "RetentionInDays": 1 }, "Metadata": { "cdk_nag": { "rules_to_suppress": [ { "reason": "no service role restriction needed", "id": "AwsSolutions-IAM4" }, { "reason": "wildcards are ok for the provider as the function has restrictions", "id": "AwsSolutions-IAM5" } ] } } }, "rootmailhostedzonedkimpropagationproviderwaiterstatemachineRole40906579": { "Type": "AWS::IAM::Role", "Properties": { "AssumeRolePolicyDocument": { "Statement": [ { "Action": "sts:AssumeRole", "Effect": "Allow", "Principal": { "Service": "states.amazonaws.com" } } ], "Version": "2012-10-17" } }, "Metadata": { "cdk_nag": { "rules_to_suppress": [ { "reason": "no service role restriction needed", "id": "AwsSolutions-IAM4" }, { "reason": "wildcards are ok for the provider as the function has restrictions", "id": "AwsSolutions-IAM5" } ] } } }, "rootmailhostedzonedkimpropagationproviderwaiterstatemachineRoleDefaultPolicy70368CA0": { "Type": "AWS::IAM::Policy", "Properties": { "PolicyDocument": { "Statement": [ { "Action": "lambda:InvokeFunction", "Effect": "Allow", "Resource": [ { "Fn::GetAtt": [ "rootmailhostedzonedkimpropagationproviderframeworkisComplete165FE163", "Arn" ] }, { "Fn::GetAtt": [ "rootmailhostedzonedkimpropagationproviderframeworkonTimeout7D8A73CD", "Arn" ] }, { "Fn::Join": [ "", [ { "Fn::GetAtt": [ "rootmailhostedzonedkimpropagationproviderframeworkisComplete165FE163", "Arn" ] }, ":*" ] ] }, { "Fn::Join": [ "", [ { "Fn::GetAtt": [ "rootmailhostedzonedkimpropagationproviderframeworkonTimeout7D8A73CD", "Arn" ] }, ":*" ] ] } ] }, { "Action": [ "logs:CreateLogDelivery", "logs:CreateLogStream", "logs:DeleteLogDelivery", "logs:DescribeLogGroups", "logs:DescribeResourcePolicies", "logs:GetLogDelivery", "logs:ListLogDeliveries", "logs:PutLogEvents", "logs:PutResourcePolicy", "logs:UpdateLogDelivery" ], "Effect": "Allow", "Resource": "*" } ], "Version": "2012-10-17" }, "PolicyName": "rootmailhostedzonedkimpropagationproviderwaiterstatemachineRoleDefaultPolicy70368CA0", "Roles": [ { "Ref": "rootmailhostedzonedkimpropagationproviderwaiterstatemachineRole40906579" } ] }, "Metadata": { "cdk_nag": { "rules_to_suppress": [ { "reason": "no service role restriction needed", "id": "AwsSolutions-IAM4" }, { "reason": "wildcards are ok for the provider as the function has restrictions", "id": "AwsSolutions-IAM5" } ] } } }, "rootmailhostedzonedkimpropagationproviderwaiterstatemachineLogGroup9CDB772B": { "Type": "AWS::Logs::LogGroup", "Properties": { "LogGroupName": { "Fn::Join": [ "", [ "/aws/vendedlogs/states/waiter-state-machine-", { "Ref": "rootmailhostedzonedkimpropagationproviderframeworkisComplete165FE163" }, "-c8475ff4cfa405647403a9effa67ebd6e9b6ff1a29" ] ] }, "RetentionInDays": 731 }, "UpdateReplacePolicy": "Retain", "DeletionPolicy": "Retain", "Metadata": { "cdk_nag": { "rules_to_suppress": [ { "reason": "no service role restriction needed", "id": "AwsSolutions-IAM4" }, { "reason": "wildcards are ok for the provider as the function has restrictions", "id": "AwsSolutions-IAM5" } ] } } }, "rootmailhostedzonedkimpropagationproviderwaiterstatemachine2C629ADB": { "Type": "AWS::StepFunctions::StateMachine", "Properties": { "DefinitionString": { "Fn::Join": [ "", [ "{\"StartAt\":\"framework-isComplete-task\",\"States\":{\"framework-isComplete-task\":{\"End\":true,\"Retry\":[{\"ErrorEquals\":[\"States.ALL\"],\"IntervalSeconds\":10,\"MaxAttempts\":180,\"BackoffRate\":1}],\"Catch\":[{\"ErrorEquals\":[\"States.ALL\"],\"Next\":\"framework-onTimeout-task\"}],\"Type\":\"Task\",\"Resource\":\"", { "Fn::GetAtt": [ "rootmailhostedzonedkimpropagationproviderframeworkisComplete165FE163", "Arn" ] }, "\"},\"framework-onTimeout-task\":{\"End\":true,\"Type\":\"Task\",\"Resource\":\"", { "Fn::GetAtt": [ "rootmailhostedzonedkimpropagationproviderframeworkonTimeout7D8A73CD", "Arn" ] }, "\"}}}" ] ] }, "LoggingConfiguration": { "Destinations": [ { "CloudWatchLogsLogGroup": { "LogGroupArn": { "Fn::GetAtt": [ "rootmailhostedzonedkimpropagationproviderwaiterstatemachineLogGroup9CDB772B", "Arn" ] } } } ], "IncludeExecutionData": false, "Level": "ERROR" }, "RoleArn": { "Fn::GetAtt": [ "rootmailhostedzonedkimpropagationproviderwaiterstatemachineRole40906579", "Arn" ] } }, "DependsOn": [ "rootmailhostedzonedkimpropagationproviderwaiterstatemachineRoleDefaultPolicy70368CA0", "rootmailhostedzonedkimpropagationproviderwaiterstatemachineRole40906579" ], "Metadata": { "cdk_nag": { "rules_to_suppress": [ { "reason": "no service role restriction needed", "id": "AwsSolutions-IAM4" }, { "reason": "wildcards are ok for the provider as the function has restrictions", "id": "AwsSolutions-IAM5" } ] } } }, "rootmailsesreceiptrulesetactivationproviderSesReceiptRuleSetActivationCustomResourceRoleA5C4F5B4": { "Type": "AWS::IAM::Role", "Properties": { "AssumeRolePolicyDocument": { "Statement": [ { "Action": "sts:AssumeRole", "Effect": "Allow", "Principal": { "Service": "lambda.amazonaws.com" } } ], "Version": "2012-10-17" }, "ManagedPolicyArns": [ { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":iam::aws:policy/service-role/AWSLambdaBasicExecutionRole" ] ] } ] }, "Metadata": { "cdk_nag": { "rules_to_suppress": [ { "reason": "no service role restriction needed", "id": "AwsSolutions-IAM4" }, { "reason": "wildcards are ok for the provider as the function has restrictions", "id": "AwsSolutions-IAM5" } ] } } }, "rootmailsesreceiptrulesetactivationproviderSesReceiptRuleSetActivationCustomResourceRoleDefaultPolicy92E90A6D": { "Type": "AWS::IAM::Policy", "Properties": { "PolicyDocument": { "Statement": [ { "Action": [ "ses:CreateReceiptRule", "ses:CreateReceiptRuleSet", "ses:DeleteReceiptRule", "ses:DeleteReceiptRuleSet", "ses:SetActiveReceiptRuleSet" ], "Effect": "Allow", "Resource": "*" } ], "Version": "2012-10-17" }, "PolicyName": "rootmailsesreceiptrulesetactivationproviderSesReceiptRuleSetActivationCustomResourceRoleDefaultPolicy92E90A6D", "Roles": [ { "Ref": "rootmailsesreceiptrulesetactivationproviderSesReceiptRuleSetActivationCustomResourceRoleA5C4F5B4" } ] }, "Metadata": { "cdk_nag": { "rules_to_suppress": [ { "reason": "no service role restriction needed", "id": "AwsSolutions-IAM4" }, { "reason": "wildcards are ok for the provider as the function has restrictions", "id": "AwsSolutions-IAM5" } ] } } }, "rootmailsesreceiptrulesetactivationprovideroneventhandler8E245877": { "Type": "AWS::Lambda::Function", "Properties": { "Code": { "S3Bucket": { "Fn::Sub": "cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}" }, "S3Key": "be7d56b509650f7f97c406a745d8335992726086995e4cb4aaf50417ab40e803.zip" }, "Handler": "index.handler", "Role": { "Fn::GetAtt": [ "rootmailsesreceiptrulesetactivationproviderSesReceiptRuleSetActivationCustomResourceRoleA5C4F5B4", "Arn" ] }, "Runtime": "nodejs18.x", "Timeout": 30 }, "DependsOn": [ "rootmailsesreceiptrulesetactivationproviderSesReceiptRuleSetActivationCustomResourceRoleDefaultPolicy92E90A6D", "rootmailsesreceiptrulesetactivationproviderSesReceiptRuleSetActivationCustomResourceRoleA5C4F5B4" ], "Metadata": { "cdk_nag": { "rules_to_suppress": [ { "reason": "no service role restriction needed", "id": "AwsSolutions-IAM4" }, { "reason": "wildcards are ok for the provider as the function has restrictions", "id": "AwsSolutions-IAM5" } ] } } }, "rootmailsesreceiptrulesetactivationprovideroneventhandlerLogRetentionFD6A9185": { "Type": "Custom::LogRetention", "Properties": { "ServiceToken": { "Fn::GetAtt": [ "LogRetentionaae0aa3c5b4d4f87b02d85b201efdd8aFD4BFC8A", "Arn" ] }, "LogGroupName": { "Fn::Join": [ "", [ "/aws/lambda/", { "Ref": "rootmailsesreceiptrulesetactivationprovideroneventhandler8E245877" } ] ] }, "RetentionInDays": 1 }, "Metadata": { "cdk_nag": { "rules_to_suppress": [ { "reason": "no service role restriction needed", "id": "AwsSolutions-IAM4" }, { "reason": "wildcards are ok for the provider as the function has restrictions", "id": "AwsSolutions-IAM5" } ] } } }, "rootmailsesreceiptrulesetactivationprovideriscompletehandlerServiceRole9D6CAFC0": { "Type": "AWS::IAM::Role", "Properties": { "AssumeRolePolicyDocument": { "Statement": [ { "Action": "sts:AssumeRole", "Effect": "Allow", "Principal": { "Service": "lambda.amazonaws.com" } } ], "Version": "2012-10-17" }, "ManagedPolicyArns": [ { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":iam::aws:policy/service-role/AWSLambdaBasicExecutionRole" ] ] } ] }, "Metadata": { "cdk_nag": { "rules_to_suppress": [ { "reason": "no service role restriction needed", "id": "AwsSolutions-IAM4" }, { "reason": "wildcards are ok for the provider as the function has restrictions", "id": "AwsSolutions-IAM5" } ] } } }, "rootmailsesreceiptrulesetactivationprovideriscompletehandlerServiceRoleDefaultPolicyFB99DF60": { "Type": "AWS::IAM::Policy", "Properties": { "PolicyDocument": { "Statement": [ { "Action": [ "s3:GetBucket*", "s3:GetObject*", "s3:List*" ], "Effect": "Allow", "Resource": [ { "Fn::GetAtt": [ "testRootmailEmailBucket2A470446", "Arn" ] }, { "Fn::Join": [ "", [ { "Fn::GetAtt": [ "testRootmailEmailBucket2A470446", "Arn" ] }, "/RootMail/*" ] ] } ] } ], "Version": "2012-10-17" }, "PolicyName": "rootmailsesreceiptrulesetactivationprovideriscompletehandlerServiceRoleDefaultPolicyFB99DF60", "Roles": [ { "Ref": "rootmailsesreceiptrulesetactivationprovideriscompletehandlerServiceRole9D6CAFC0" } ] }, "Metadata": { "cdk_nag": { "rules_to_suppress": [ { "reason": "no service role restriction needed", "id": "AwsSolutions-IAM4" }, { "reason": "wildcards are ok for the provider as the function has restrictions", "id": "AwsSolutions-IAM5" } ] } } }, "rootmailsesreceiptrulesetactivationprovideriscompletehandler676C1A14": { "Type": "AWS::Lambda::Function", "Properties": { "Code": { "S3Bucket": { "Fn::Sub": "cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}" }, "S3Key": "78b64aaf9aebb4eacbdd42197be10e9d5894360a642f7dcf79aeb84bb3552377.zip" }, "Handler": "index.handler", "Role": { "Fn::GetAtt": [ "rootmailsesreceiptrulesetactivationprovideriscompletehandlerServiceRole9D6CAFC0", "Arn" ] }, "Runtime": "nodejs18.x", "Timeout": 30 }, "DependsOn": [ "rootmailsesreceiptrulesetactivationprovideriscompletehandlerServiceRoleDefaultPolicyFB99DF60", "rootmailsesreceiptrulesetactivationprovideriscompletehandlerServiceRole9D6CAFC0" ], "Metadata": { "cdk_nag": { "rules_to_suppress": [ { "reason": "no service role restriction needed", "id": "AwsSolutions-IAM4" }, { "reason": "wildcards are ok for the provider as the function has restrictions", "id": "AwsSolutions-IAM5" } ] } } }, "rootmailsesreceiptrulesetactivationprovideriscompletehandlerLogRetention03F74C63": { "Type": "Custom::LogRetention", "Properties": { "ServiceToken": { "Fn::GetAtt": [ "LogRetentionaae0aa3c5b4d4f87b02d85b201efdd8aFD4BFC8A", "Arn" ] }, "LogGroupName": { "Fn::Join": [ "", [ "/aws/lambda/", { "Ref": "rootmailsesreceiptrulesetactivationprovideriscompletehandler676C1A14" } ] ] }, "RetentionInDays": 1 }, "Metadata": { "cdk_nag": { "rules_to_suppress": [ { "reason": "no service role restriction needed", "id": "AwsSolutions-IAM4" }, { "reason": "wildcards are ok for the provider as the function has restrictions", "id": "AwsSolutions-IAM5" } ] } } }, "rootmailsesreceiptrulesetactivationproviderframeworkonEventServiceRoleB5050EE6": { "Type": "AWS::IAM::Role", "Properties": { "AssumeRolePolicyDocument": { "Statement": [ { "Action": "sts:AssumeRole", "Effect": "Allow", "Principal": { "Service": "lambda.amazonaws.com" } } ], "Version": "2012-10-17" }, "ManagedPolicyArns": [ { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":iam::aws:policy/service-role/AWSLambdaBasicExecutionRole" ] ] } ] }, "Metadata": { "cdk_nag": { "rules_to_suppress": [ { "reason": "no service role restriction needed", "id": "AwsSolutions-IAM4" }, { "reason": "wildcards are ok for the provider as the function has restrictions", "id": "AwsSolutions-IAM5" } ] } } }, "rootmailsesreceiptrulesetactivationproviderframeworkonEventServiceRoleDefaultPolicy11FA01A0": { "Type": "AWS::IAM::Policy", "Properties": { "PolicyDocument": { "Statement": [ { "Action": "lambda:InvokeFunction", "Effect": "Allow", "Resource": [ { "Fn::GetAtt": [ "rootmailsesreceiptrulesetactivationprovideriscompletehandler676C1A14", "Arn" ] }, { "Fn::GetAtt": [ "rootmailsesreceiptrulesetactivationprovideroneventhandler8E245877", "Arn" ] }, { "Fn::Join": [ "", [ { "Fn::GetAtt": [ "rootmailsesreceiptrulesetactivationprovideriscompletehandler676C1A14", "Arn" ] }, ":*" ] ] }, { "Fn::Join": [ "", [ { "Fn::GetAtt": [ "rootmailsesreceiptrulesetactivationprovideroneventhandler8E245877", "Arn" ] }, ":*" ] ] } ] }, { "Action": "states:StartExecution", "Effect": "Allow", "Resource": { "Ref": "rootmailsesreceiptrulesetactivationproviderwaiterstatemachine93794458" } } ], "Version": "2012-10-17" }, "PolicyName": "rootmailsesreceiptrulesetactivationproviderframeworkonEventServiceRoleDefaultPolicy11FA01A0", "Roles": [ { "Ref": "rootmailsesreceiptrulesetactivationproviderframeworkonEventServiceRoleB5050EE6" } ] }, "Metadata": { "cdk_nag": { "rules_to_suppress": [ { "reason": "no service role restriction needed", "id": "AwsSolutions-IAM4" }, { "reason": "wildcards are ok for the provider as the function has restrictions", "id": "AwsSolutions-IAM5" } ] } } }, "rootmailsesreceiptrulesetactivationproviderframeworkonEventC514B5CD": { "Type": "AWS::Lambda::Function", "Properties": { "Code": { "S3Bucket": { "Fn::Sub": "cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}" }, "S3Key": "bdc104ed9cab1b5b6421713c8155f0b753380595356f710400609664d3635eca.zip" }, "Description": "AWS CDK resource provider framework - onEvent (RootmailIntegTestStack/rootmail.ses-receipt-ruleset-activation-provider/ses-receipt-ruleset-activation-provider)", "Environment": { "Variables": { "USER_ON_EVENT_FUNCTION_ARN": { "Fn::GetAtt": [ "rootmailsesreceiptrulesetactivationprovideroneventhandler8E245877", "Arn" ] }, "USER_IS_COMPLETE_FUNCTION_ARN": { "Fn::GetAtt": [ "rootmailsesreceiptrulesetactivationprovideriscompletehandler676C1A14", "Arn" ] }, "WAITER_STATE_MACHINE_ARN": { "Ref": "rootmailsesreceiptrulesetactivationproviderwaiterstatemachine93794458" } } }, "Handler": "framework.onEvent", "Role": { "Fn::GetAtt": [ "rootmailsesreceiptrulesetactivationproviderframeworkonEventServiceRoleB5050EE6", "Arn" ] }, "Runtime": { "Fn::FindInMap": [ "LatestNodeRuntimeMap", { "Ref": "AWS::Region" }, "value" ] }, "Timeout": 900 }, "DependsOn": [ "rootmailsesreceiptrulesetactivationproviderframeworkonEventServiceRoleDefaultPolicy11FA01A0", "rootmailsesreceiptrulesetactivationproviderframeworkonEventServiceRoleB5050EE6" ], "Metadata": { "cdk_nag": { "rules_to_suppress": [ { "reason": "no service role restriction needed", "id": "AwsSolutions-IAM4" }, { "reason": "wildcards are ok for the provider as the function has restrictions", "id": "AwsSolutions-IAM5" } ] } } }, "rootmailsesreceiptrulesetactivationproviderframeworkonEventLogRetentionA6742D46": { "Type": "Custom::LogRetention", "Properties": { "ServiceToken": { "Fn::GetAtt": [ "LogRetentionaae0aa3c5b4d4f87b02d85b201efdd8aFD4BFC8A", "Arn" ] }, "LogGroupName": { "Fn::Join": [ "", [ "/aws/lambda/", { "Ref": "rootmailsesreceiptrulesetactivationproviderframeworkonEventC514B5CD" } ] ] }, "RetentionInDays": 1 }, "Metadata": { "cdk_nag": { "rules_to_suppress": [ { "reason": "no service role restriction needed", "id": "AwsSolutions-IAM4" }, { "reason": "wildcards are ok for the provider as the function has restrictions", "id": "AwsSolutions-IAM5" } ] } } }, "rootmailsesreceiptrulesetactivationproviderframeworkisCompleteServiceRoleCFD6EE46": { "Type": "AWS::IAM::Role", "Properties": { "AssumeRolePolicyDocument": { "Statement": [ { "Action": "sts:AssumeRole", "Effect": "Allow", "Principal": { "Service": "lambda.amazonaws.com" } } ], "Version": "2012-10-17" }, "ManagedPolicyArns": [ { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":iam::aws:policy/service-role/AWSLambdaBasicExecutionRole" ] ] } ] }, "Metadata": { "cdk_nag": { "rules_to_suppress": [ { "reason": "no service role restriction needed", "id": "AwsSolutions-IAM4" }, { "reason": "wildcards are ok for the provider as the function has restrictions", "id": "AwsSolutions-IAM5" } ] } } }, "rootmailsesreceiptrulesetactivationproviderframeworkisCompleteServiceRoleDefaultPolicy8A8828E7": { "Type": "AWS::IAM::Policy", "Properties": { "PolicyDocument": { "Statement": [ { "Action": "lambda:InvokeFunction", "Effect": "Allow", "Resource": [ { "Fn::GetAtt": [ "rootmailsesreceiptrulesetactivationprovideriscompletehandler676C1A14", "Arn" ] }, { "Fn::GetAtt": [ "rootmailsesreceiptrulesetactivationprovideroneventhandler8E245877", "Arn" ] }, { "Fn::Join": [ "", [ { "Fn::GetAtt": [ "rootmailsesreceiptrulesetactivationprovideriscompletehandler676C1A14", "Arn" ] }, ":*" ] ] }, { "Fn::Join": [ "", [ { "Fn::GetAtt": [ "rootmailsesreceiptrulesetactivationprovideroneventhandler8E245877", "Arn" ] }, ":*" ] ] } ] } ], "Version": "2012-10-17" }, "PolicyName": "rootmailsesreceiptrulesetactivationproviderframeworkisCompleteServiceRoleDefaultPolicy8A8828E7", "Roles": [ { "Ref": "rootmailsesreceiptrulesetactivationproviderframeworkisCompleteServiceRoleCFD6EE46" } ] }, "Metadata": { "cdk_nag": { "rules_to_suppress": [ { "reason": "no service role restriction needed", "id": "AwsSolutions-IAM4" }, { "reason": "wildcards are ok for the provider as the function has restrictions", "id": "AwsSolutions-IAM5" } ] } } }, "rootmailsesreceiptrulesetactivationproviderframeworkisComplete17519146": { "Type": "AWS::Lambda::Function", "Properties": { "Code": { "S3Bucket": { "Fn::Sub": "cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}" }, "S3Key": "bdc104ed9cab1b5b6421713c8155f0b753380595356f710400609664d3635eca.zip" }, "Description": "AWS CDK resource provider framework - isComplete (RootmailIntegTestStack/rootmail.ses-receipt-ruleset-activation-provider/ses-receipt-ruleset-activation-provider)", "Environment": { "Variables": { "USER_ON_EVENT_FUNCTION_ARN": { "Fn::GetAtt": [ "rootmailsesreceiptrulesetactivationprovideroneventhandler8E245877", "Arn" ] }, "USER_IS_COMPLETE_FUNCTION_ARN": { "Fn::GetAtt": [ "rootmailsesreceiptrulesetactivationprovideriscompletehandler676C1A14", "Arn" ] } } }, "Handler": "framework.isComplete", "Role": { "Fn::GetAtt": [ "rootmailsesreceiptrulesetactivationproviderframeworkisCompleteServiceRoleCFD6EE46", "Arn" ] }, "Runtime": { "Fn::FindInMap": [ "LatestNodeRuntimeMap", { "Ref": "AWS::Region" }, "value" ] }, "Timeout": 900 }, "DependsOn": [ "rootmailsesreceiptrulesetactivationproviderframeworkisCompleteServiceRoleDefaultPolicy8A8828E7", "rootmailsesreceiptrulesetactivationproviderframeworkisCompleteServiceRoleCFD6EE46" ], "Metadata": { "cdk_nag": { "rules_to_suppress": [ { "reason": "no service role restriction needed", "id": "AwsSolutions-IAM4" }, { "reason": "wildcards are ok for the provider as the function has restrictions", "id": "AwsSolutions-IAM5" } ] } } }, "rootmailsesreceiptrulesetactivationproviderframeworkisCompleteLogRetention13DDD3A2": { "Type": "Custom::LogRetention", "Properties": { "ServiceToken": { "Fn::GetAtt": [ "LogRetentionaae0aa3c5b4d4f87b02d85b201efdd8aFD4BFC8A", "Arn" ] }, "LogGroupName": { "Fn::Join": [ "", [ "/aws/lambda/", { "Ref": "rootmailsesreceiptrulesetactivationproviderframeworkisComplete17519146" } ] ] }, "RetentionInDays": 1 }, "Metadata": { "cdk_nag": { "rules_to_suppress": [ { "reason": "no service role restriction needed", "id": "AwsSolutions-IAM4" }, { "reason": "wildcards are ok for the provider as the function has restrictions", "id": "AwsSolutions-IAM5" } ] } } }, "rootmailsesreceiptrulesetactivationproviderframeworkonTimeoutServiceRole845C2519": { "Type": "AWS::IAM::Role", "Properties": { "AssumeRolePolicyDocument": { "Statement": [ { "Action": "sts:AssumeRole", "Effect": "Allow", "Principal": { "Service": "lambda.amazonaws.com" } } ], "Version": "2012-10-17" }, "ManagedPolicyArns": [ { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":iam::aws:policy/service-role/AWSLambdaBasicExecutionRole" ] ] } ] }, "Metadata": { "cdk_nag": { "rules_to_suppress": [ { "reason": "no service role restriction needed", "id": "AwsSolutions-IAM4" }, { "reason": "wildcards are ok for the provider as the function has restrictions", "id": "AwsSolutions-IAM5" } ] } } }, "rootmailsesreceiptrulesetactivationproviderframeworkonTimeoutServiceRoleDefaultPolicy8A4A1F2A": { "Type": "AWS::IAM::Policy", "Properties": { "PolicyDocument": { "Statement": [ { "Action": "lambda:InvokeFunction", "Effect": "Allow", "Resource": [ { "Fn::GetAtt": [ "rootmailsesreceiptrulesetactivationprovideriscompletehandler676C1A14", "Arn" ] }, { "Fn::GetAtt": [ "rootmailsesreceiptrulesetactivationprovideroneventhandler8E245877", "Arn" ] }, { "Fn::Join": [ "", [ { "Fn::GetAtt": [ "rootmailsesreceiptrulesetactivationprovideriscompletehandler676C1A14", "Arn" ] }, ":*" ] ] }, { "Fn::Join": [ "", [ { "Fn::GetAtt": [ "rootmailsesreceiptrulesetactivationprovideroneventhandler8E245877", "Arn" ] }, ":*" ] ] } ] } ], "Version": "2012-10-17" }, "PolicyName": "rootmailsesreceiptrulesetactivationproviderframeworkonTimeoutServiceRoleDefaultPolicy8A4A1F2A", "Roles": [ { "Ref": "rootmailsesreceiptrulesetactivationproviderframeworkonTimeoutServiceRole845C2519" } ] }, "Metadata": { "cdk_nag": { "rules_to_suppress": [ { "reason": "no service role restriction needed", "id": "AwsSolutions-IAM4" }, { "reason": "wildcards are ok for the provider as the function has restrictions", "id": "AwsSolutions-IAM5" } ] } } }, "rootmailsesreceiptrulesetactivationproviderframeworkonTimeout85CF91B9": { "Type": "AWS::Lambda::Function", "Properties": { "Code": { "S3Bucket": { "Fn::Sub": "cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}" }, "S3Key": "bdc104ed9cab1b5b6421713c8155f0b753380595356f710400609664d3635eca.zip" }, "Description": "AWS CDK resource provider framework - onTimeout (RootmailIntegTestStack/rootmail.ses-receipt-ruleset-activation-provider/ses-receipt-ruleset-activation-provider)", "Environment": { "Variables": { "USER_ON_EVENT_FUNCTION_ARN": { "Fn::GetAtt": [ "rootmailsesreceiptrulesetactivationprovideroneventhandler8E245877", "Arn" ] }, "USER_IS_COMPLETE_FUNCTION_ARN": { "Fn::GetAtt": [ "rootmailsesreceiptrulesetactivationprovideriscompletehandler676C1A14", "Arn" ] } } }, "Handler": "framework.onTimeout", "Role": { "Fn::GetAtt": [ "rootmailsesreceiptrulesetactivationproviderframeworkonTimeoutServiceRole845C2519", "Arn" ] }, "Runtime": { "Fn::FindInMap": [ "LatestNodeRuntimeMap", { "Ref": "AWS::Region" }, "value" ] }, "Timeout": 900 }, "DependsOn": [ "rootmailsesreceiptrulesetactivationproviderframeworkonTimeoutServiceRoleDefaultPolicy8A4A1F2A", "rootmailsesreceiptrulesetactivationproviderframeworkonTimeoutServiceRole845C2519" ], "Metadata": { "cdk_nag": { "rules_to_suppress": [ { "reason": "no service role restriction needed", "id": "AwsSolutions-IAM4" }, { "reason": "wildcards are ok for the provider as the function has restrictions", "id": "AwsSolutions-IAM5" } ] } } }, "rootmailsesreceiptrulesetactivationproviderframeworkonTimeoutLogRetention5763AF42": { "Type": "Custom::LogRetention", "Properties": { "ServiceToken": { "Fn::GetAtt": [ "LogRetentionaae0aa3c5b4d4f87b02d85b201efdd8aFD4BFC8A", "Arn" ] }, "LogGroupName": { "Fn::Join": [ "", [ "/aws/lambda/", { "Ref": "rootmailsesreceiptrulesetactivationproviderframeworkonTimeout85CF91B9" } ] ] }, "RetentionInDays": 1 }, "Metadata": { "cdk_nag": { "rules_to_suppress": [ { "reason": "no service role restriction needed", "id": "AwsSolutions-IAM4" }, { "reason": "wildcards are ok for the provider as the function has restrictions", "id": "AwsSolutions-IAM5" } ] } } }, "rootmailsesreceiptrulesetactivationproviderwaiterstatemachineRole069EB2EA": { "Type": "AWS::IAM::Role", "Properties": { "AssumeRolePolicyDocument": { "Statement": [ { "Action": "sts:AssumeRole", "Effect": "Allow", "Principal": { "Service": "states.amazonaws.com" } } ], "Version": "2012-10-17" } }, "Metadata": { "cdk_nag": { "rules_to_suppress": [ { "reason": "no service role restriction needed", "id": "AwsSolutions-IAM4" }, { "reason": "wildcards are ok for the provider as the function has restrictions", "id": "AwsSolutions-IAM5" } ] } } }, "rootmailsesreceiptrulesetactivationproviderwaiterstatemachineRoleDefaultPolicy64767BAC": { "Type": "AWS::IAM::Policy", "Properties": { "PolicyDocument": { "Statement": [ { "Action": "lambda:InvokeFunction", "Effect": "Allow", "Resource": [ { "Fn::GetAtt": [ "rootmailsesreceiptrulesetactivationproviderframeworkisComplete17519146", "Arn" ] }, { "Fn::GetAtt": [ "rootmailsesreceiptrulesetactivationproviderframeworkonTimeout85CF91B9", "Arn" ] }, { "Fn::Join": [ "", [ { "Fn::GetAtt": [ "rootmailsesreceiptrulesetactivationproviderframeworkisComplete17519146", "Arn" ] }, ":*" ] ] }, { "Fn::Join": [ "", [ { "Fn::GetAtt": [ "rootmailsesreceiptrulesetactivationproviderframeworkonTimeout85CF91B9", "Arn" ] }, ":*" ] ] } ] }, { "Action": [ "logs:CreateLogDelivery", "logs:CreateLogStream", "logs:DeleteLogDelivery", "logs:DescribeLogGroups", "logs:DescribeResourcePolicies", "logs:GetLogDelivery", "logs:ListLogDeliveries", "logs:PutLogEvents", "logs:PutResourcePolicy", "logs:UpdateLogDelivery" ], "Effect": "Allow", "Resource": "*" } ], "Version": "2012-10-17" }, "PolicyName": "rootmailsesreceiptrulesetactivationproviderwaiterstatemachineRoleDefaultPolicy64767BAC", "Roles": [ { "Ref": "rootmailsesreceiptrulesetactivationproviderwaiterstatemachineRole069EB2EA" } ] }, "Metadata": { "cdk_nag": { "rules_to_suppress": [ { "reason": "no service role restriction needed", "id": "AwsSolutions-IAM4" }, { "reason": "wildcards are ok for the provider as the function has restrictions", "id": "AwsSolutions-IAM5" } ] } } }, "rootmailsesreceiptrulesetactivationproviderwaiterstatemachineLogGroup91D50937": { "Type": "AWS::Logs::LogGroup", "Properties": { "LogGroupName": { "Fn::Join": [ "", [ "/aws/vendedlogs/states/waiter-state-machine-", { "Ref": "rootmailsesreceiptrulesetactivationproviderframeworkisComplete17519146" }, "-c835847d33488db0e9cc733c354fb0ac44503af5c9" ] ] }, "RetentionInDays": 731 }, "UpdateReplacePolicy": "Retain", "DeletionPolicy": "Retain", "Metadata": { "cdk_nag": { "rules_to_suppress": [ { "reason": "no service role restriction needed", "id": "AwsSolutions-IAM4" }, { "reason": "wildcards are ok for the provider as the function has restrictions", "id": "AwsSolutions-IAM5" } ] } } }, "rootmailsesreceiptrulesetactivationproviderwaiterstatemachine93794458": { "Type": "AWS::StepFunctions::StateMachine", "Properties": { "DefinitionString": { "Fn::Join": [ "", [ "{\"StartAt\":\"framework-isComplete-task\",\"States\":{\"framework-isComplete-task\":{\"End\":true,\"Retry\":[{\"ErrorEquals\":[\"States.ALL\"],\"IntervalSeconds\":10,\"MaxAttempts\":12,\"BackoffRate\":1}],\"Catch\":[{\"ErrorEquals\":[\"States.ALL\"],\"Next\":\"framework-onTimeout-task\"}],\"Type\":\"Task\",\"Resource\":\"", { "Fn::GetAtt": [ "rootmailsesreceiptrulesetactivationproviderframeworkisComplete17519146", "Arn" ] }, "\"},\"framework-onTimeout-task\":{\"End\":true,\"Type\":\"Task\",\"Resource\":\"", { "Fn::GetAtt": [ "rootmailsesreceiptrulesetactivationproviderframeworkonTimeout85CF91B9", "Arn" ] }, "\"}}}" ] ] }, "LoggingConfiguration": { "Destinations": [ { "CloudWatchLogsLogGroup": { "LogGroupArn": { "Fn::GetAtt": [ "rootmailsesreceiptrulesetactivationproviderwaiterstatemachineLogGroup91D50937", "Arn" ] } } } ], "IncludeExecutionData": false, "Level": "ERROR" }, "RoleArn": { "Fn::GetAtt": [ "rootmailsesreceiptrulesetactivationproviderwaiterstatemachineRole069EB2EA", "Arn" ] } }, "DependsOn": [ "rootmailsesreceiptrulesetactivationproviderwaiterstatemachineRoleDefaultPolicy64767BAC", "rootmailsesreceiptrulesetactivationproviderwaiterstatemachineRole069EB2EA" ], "Metadata": { "cdk_nag": { "rules_to_suppress": [ { "reason": "no service role restriction needed", "id": "AwsSolutions-IAM4" }, { "reason": "wildcards are ok for the provider as the function has restrictions", "id": "AwsSolutions-IAM5" } ] } } }, "sendemailhandlerServiceRole7A142BD3": { "Type": "AWS::IAM::Role", "Properties": { "AssumeRolePolicyDocument": { "Statement": [ { "Action": "sts:AssumeRole", "Effect": "Allow", "Principal": { "Service": "lambda.amazonaws.com" } } ], "Version": "2012-10-17" }, "ManagedPolicyArns": [ { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":iam::aws:policy/service-role/AWSLambdaBasicExecutionRole" ] ] } ] } }, "sendemailhandlerServiceRoleDefaultPolicyEB76CF3B": { "Type": "AWS::IAM::Policy", "Properties": { "PolicyDocument": { "Statement": [ { "Action": [ "ses:DescribeReceiptRule", "ses:SendEmail" ], "Effect": "Allow", "Resource": "*" } ], "Version": "2012-10-17" }, "PolicyName": "sendemailhandlerServiceRoleDefaultPolicyEB76CF3B", "Roles": [ { "Ref": "sendemailhandlerServiceRole7A142BD3" } ] } }, "sendemailhandler05B16DE5": { "Type": "AWS::Lambda::Function", "Properties": { "Code": { "S3Bucket": { "Fn::Sub": "cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}" }, "S3Key": "2b86f8b255c50c6eba274c368849bab1c7a3747c30ef5df4c96f8dea8fffa21e.zip" }, "Handler": "index.handler", "Role": { "Fn::GetAtt": [ "sendemailhandlerServiceRole7A142BD3", "Arn" ] }, "Runtime": "nodejs18.x", "Timeout": 30 }, "DependsOn": [ "sendemailhandlerServiceRoleDefaultPolicyEB76CF3B", "sendemailhandlerServiceRole7A142BD3" ] }, "sendemailhandlerLogRetentionDBC033F7": { "Type": "Custom::LogRetention", "Properties": { "ServiceToken": { "Fn::GetAtt": [ "LogRetentionaae0aa3c5b4d4f87b02d85b201efdd8aFD4BFC8A", "Arn" ] }, "LogGroupName": { "Fn::Join": [ "", [ "/aws/lambda/", { "Ref": "sendemailhandler05B16DE5" } ] ] }, "RetentionInDays": 1 } } }, "Mappings": { "LatestNodeRuntimeMap": { "af-south-1": { "value": "nodejs20.x" }, "ap-east-1": { "value": "nodejs20.x" }, "ap-northeast-1": { "value": "nodejs20.x" }, "ap-northeast-2": { "value": "nodejs20.x" }, "ap-northeast-3": { "value": "nodejs20.x" }, "ap-south-1": { "value": "nodejs20.x" }, "ap-south-2": { "value": "nodejs20.x" }, "ap-southeast-1": { "value": "nodejs20.x" }, "ap-southeast-2": { "value": "nodejs20.x" }, "ap-southeast-3": { "value": "nodejs20.x" }, "ap-southeast-4": { "value": "nodejs20.x" }, "ap-southeast-5": { "value": "nodejs20.x" }, "ap-southeast-7": { "value": "nodejs20.x" }, "ca-central-1": { "value": "nodejs20.x" }, "ca-west-1": { "value": "nodejs20.x" }, "cn-north-1": { "value": "nodejs18.x" }, "cn-northwest-1": { "value": "nodejs18.x" }, "eu-central-1": { "value": "nodejs20.x" }, "eu-central-2": { "value": "nodejs20.x" }, "eu-isoe-west-1": { "value": "nodejs18.x" }, "eu-north-1": { "value": "nodejs20.x" }, "eu-south-1": { "value": "nodejs20.x" }, "eu-south-2": { "value": "nodejs20.x" }, "eu-west-1": { "value": "nodejs20.x" }, "eu-west-2": { "value": "nodejs20.x" }, "eu-west-3": { "value": "nodejs20.x" }, "il-central-1": { "value": "nodejs20.x" }, "me-central-1": { "value": "nodejs20.x" }, "me-south-1": { "value": "nodejs20.x" }, "mx-central-1": { "value": "nodejs20.x" }, "sa-east-1": { "value": "nodejs20.x" }, "us-east-1": { "value": "nodejs20.x" }, "us-east-2": { "value": "nodejs20.x" }, "us-gov-east-1": { "value": "nodejs18.x" }, "us-gov-west-1": { "value": "nodejs18.x" }, "us-iso-east-1": { "value": "nodejs18.x" }, "us-iso-west-1": { "value": "nodejs18.x" }, "us-isob-east-1": { "value": "nodejs18.x" }, "us-west-1": { "value": "nodejs20.x" }, "us-west-2": { "value": "nodejs20.x" } } }, "Outputs": { "ExportsOutputRefsendemailhandler05B16DE5F96FA757": { "Value": { "Ref": "sendemailhandler05B16DE5" }, "Export": { "Name": "RootmailIntegTestStack:ExportsOutputRefsendemailhandler05B16DE5F96FA757" } } }, "Parameters": { "BootstrapVersion": { "Type": "AWS::SSM::Parameter::Value", "Default": "/cdk-bootstrap/hnb659fds/version", "Description": "Version of the CDK Bootstrap resources in this environment, automatically retrieved from SSM Parameter Store. [cdk:skip]" } }, "Rules": { "CheckBootstrapVersion": { "Assertions": [ { "Assert": { "Fn::Not": [ { "Fn::Contains": [ [ "1", "2", "3", "4", "5" ], { "Ref": "BootstrapVersion" } ] } ] }, "AssertDescription": "CDK bootstrap stack version 6 required. Please run 'cdk bootstrap' with a recent version of the CDK CLI." } ] } } }