{"Description":"(SO0111M) Automated Security Response on AWS Member Account Stack, v4.1.0","AWSTemplateFormatVersion":"2010-09-09","Metadata":{"AWS::CloudFormation::Interface":{"ParameterGroups":[{"Label":{"default":"LogGroup Configuration"},"Parameters":["LogGroupName"]},{"Label":{"default":"Consolidated control finding Playbook"},"Parameters":["LoadSCMemberStack"]},{"Label":{"default":"Security Standard Playbooks"},"Parameters":["LoadAFSBPMemberStack","LoadCIS120MemberStack","LoadCIS140MemberStack","LoadCIS300MemberStack","LoadNIST80053MemberStack","LoadPCI321MemberStack"]},{"Label":{"default":"Configuration"},"Parameters":["CreateS3BucketForRedshiftAuditLogging","SecHubAdminAccount","Namespace"]}],"ParameterLabels":{"LogGroupName":{"default":"Provide the name of the LogGroup to be used to create Metric Filters and Alarms"}}}},"Parameters":{"SecHubAdminAccount":{"Type":"String","AllowedPattern":"^\\d{12}$","Description":"Admin account number"},"Namespace":{"Type":"String","AllowedPattern":"(?!(^xn--|^sthree-|^sthree-configurator|^amzn-s3-demo-|.+-s3alias|.+--ol-s3|.+.mrap|.+--x-s3$))^[a-z0-9][a-z0-9-]{1,7}[a-z0-9]$","ConstraintDescription":"The Namespace parameter must follow naming restrictions for S3 buckets and have a minimum length of 3 and a maximum length of 9. https://docs.aws.amazon.com/AmazonS3/latest/userguide/bucketnamingrules.html","Description":"Choose a unique namespace to be added as a suffix to remediation IAM role names. The same namespace should be used in the Member Roles and Member stacks. This string should be unique for each solution deployment, but does not need to be changed during stack updates.","MaxLength":9,"MinLength":3},"EnableCloudTrailForASRActionLog":{"Type":"String","Default":"no","AllowedValues":["yes","no"],"Description":"Create a CloudTrail to monitor ASR actions in this account on the ASR CloudWatch Dashboard. "},"CreateS3BucketForRedshiftAuditLogging":{"Type":"String","Default":"no","AllowedValues":["yes","no"],"Description":"Create S3 Bucket For Redshift Cluster Audit Logging."},"LogGroupName":{"Type":"String","Description":"Name of the log group to be used to create metric filters and cloudwatch alarms. You must use a Log Group that is the the logging destination of a multi-region CloudTrail. Mandatory to use certain CloudWatch controls (e.g. PCI.CW.1).","MinLength":1},"LoadAFSBPMemberStack":{"Type":"String","Default":"no","AllowedValues":["yes","no"],"Description":"Install the member components for automated remediation of AFSBP controls?"},"LoadCIS120MemberStack":{"Type":"String","Default":"no","AllowedValues":["yes","no"],"Description":"Install the member components for automated remediation of CIS120 controls?"},"LoadCIS140MemberStack":{"Type":"String","Default":"no","AllowedValues":["yes","no"],"Description":"Install the member components for automated remediation of CIS140 controls?"},"LoadNIST80053MemberStack":{"Type":"String","Default":"no","AllowedValues":["yes","no"],"Description":"Install the member components for automated remediation of NIST80053 controls?"},"LoadPCI321MemberStack":{"Type":"String","Default":"no","AllowedValues":["yes","no"],"Description":"Install the member components for automated remediation of PCI321 controls?"},"LoadCIS300MemberStack":{"Type":"String","Default":"no","AllowedValues":["yes","no"],"Description":"Install the member components for automated remediation of CIS300 controls?"},"LoadSCMemberStack":{"Type":"String","Default":"yes","AllowedValues":["yes","no"],"Description":"If the consolidated control findings feature is turned on in Security Hub, only enable the Security Control (SC) playbook. If the feature is not turned on, enable the playbooks for the security standards that are enabled in Security Hub. Enabling additional playbooks can result in reaching the quota for EventBridge Rules."}},"Conditions":{"CloudTrailCondition":{"Fn::Equals":[{"Ref":"EnableCloudTrailForASRActionLog"},"yes"]},"EnableS3BucketForRedShift4":{"Fn::Equals":[{"Ref":"CreateS3BucketForRedshiftAuditLogging"},"yes"]},"loadAFSBPCond":{"Fn::Equals":[{"Ref":"LoadAFSBPMemberStack"},"yes"]},"loadAFSBP1Cond":{"Fn::Equals":[{"Ref":"LoadAFSBPMemberStack"},"yes"]},"loadCIS120Cond":{"Fn::Equals":[{"Ref":"LoadCIS120MemberStack"},"yes"]},"loadCIS140Cond":{"Fn::Equals":[{"Ref":"LoadCIS140MemberStack"},"yes"]},"loadNIST80053Cond":{"Fn::Equals":[{"Ref":"LoadNIST80053MemberStack"},"yes"]},"loadNIST800531Cond":{"Fn::Equals":[{"Ref":"LoadNIST80053MemberStack"},"yes"]},"loadPCI321Cond":{"Fn::Equals":[{"Ref":"LoadPCI321MemberStack"},"yes"]},"loadCIS300Cond":{"Fn::Equals":[{"Ref":"LoadCIS300MemberStack"},"yes"]},"loadSCCond":{"Fn::Equals":[{"Ref":"LoadSCMemberStack"},"yes"]},"loadSC1Cond":{"Fn::Equals":[{"Ref":"LoadSCMemberStack"},"yes"]},"IsCommercialPartition":{"Fn::Equals":[{"Ref":"AWS::Partition"},"aws"]}},"Resources":{"S3BucketForRedShiftAuditLogging652E7355":{"Type":"AWS::S3::Bucket","Properties":{"BucketEncryption":{"ServerSideEncryptionConfiguration":[{"ServerSideEncryptionByDefault":{"SSEAlgorithm":"AES256"}}]},"PublicAccessBlockConfiguration":{"BlockPublicAcls":true,"BlockPublicPolicy":true,"IgnorePublicAcls":true,"RestrictPublicBuckets":true},"Tags":[{"Key":"Solutions:SolutionID","Value":"SO0111"},{"Key":"Solutions:SolutionName","Value":"automated-security-response-on-aws"},{"Key":"Solutions:SolutionVersion","Value":"v4.1.0"}],"VersioningConfiguration":{"Status":"Enabled"}},"UpdateReplacePolicy":"Retain","DeletionPolicy":"Retain","Metadata":{"guard":{"SuppressedRules":["S3_BUCKET_LOGGING_ENABLED"]}},"Condition":"EnableS3BucketForRedShift4"},"S3BucketForRedShiftAuditLoggingBucketPolicyAB8BAA40":{"Type":"AWS::S3::BucketPolicy","Properties":{"Bucket":{"Ref":"S3BucketForRedShiftAuditLogging652E7355"},"PolicyDocument":{"Statement":[{"Action":["s3:GetBucketAcl","s3:PutObject"],"Effect":"Allow","Principal":{"Service":"redshift.amazonaws.com"},"Resource":[{"Fn::GetAtt":["S3BucketForRedShiftAuditLogging652E7355","Arn"]},{"Fn::Sub":["arn:${AWS::Partition}:s3:::${BucketName}/*",{"BucketName":{"Ref":"S3BucketForRedShiftAuditLogging652E7355"}}]}],"Sid":"Put bucket policy needed for audit logging"},{"Action":"s3:*","Condition":{"Bool":{"aws:SecureTransport":"false"}},"Effect":"Deny","Principal":"*","Resource":[{"Fn::GetAtt":["S3BucketForRedShiftAuditLogging652E7355","Arn"]},{"Fn::Join":["",[{"Fn::GetAtt":["S3BucketForRedShiftAuditLogging652E7355","Arn"]},"/*"]]}],"Sid":"EnforceSSL"}],"Version":"2012-10-17"}},"DependsOn":["S3BucketForRedShiftAuditLogging652E7355"],"UpdateReplacePolicy":"Retain","DeletionPolicy":"Retain","Condition":"EnableS3BucketForRedShift4"},"SSMParameterForS3BucketNameForREDSHIFT441DD36B1":{"Type":"AWS::SSM::Parameter","Properties":{"Description":"Parameter to store the S3 bucket name for the remediation FSBP.REDSHIFT.4, the default value is bucket-name which has to be updated by the user before using the remediation.","Name":"/Solutions/SO0111/afsbp/1.0.0/REDSHIFT.4/S3BucketNameForAuditLogging","Tags":{"Solutions:SolutionID":"SO0111","Solutions:SolutionName":"automated-security-response-on-aws","Solutions:SolutionVersion":"v4.1.0"},"Type":"String","Value":{"Ref":"S3BucketForRedShiftAuditLogging652E7355"}},"DependsOn":["S3BucketForRedShiftAuditLogging652E7355"],"Condition":"EnableS3BucketForRedShift4"},"SHARRRemediationKeyE744743D":{"Type":"AWS::KMS::Key","Properties":{"EnableKeyRotation":true,"KeyPolicy":{"Statement":[{"Action":["kms:GenerateDataKey","kms:GenerateDataKeyPair","kms:GenerateDataKeyPairWithoutPlaintext","kms:GenerateDataKeyWithoutPlaintext","kms:Decrypt","kms:Encrypt","kms:ReEncryptFrom","kms:ReEncryptTo","kms:DescribeKey","kms:DescribeCustomKeyStores"],"Effect":"Allow","Principal":{"Service":["sns.amazonaws.com","s3.amazonaws.com",{"Fn::Join":["",["logs.",{"Ref":"AWS::URLSuffix"}]]},{"Fn::Join":["",["logs.",{"Ref":"AWS::Region"},".",{"Ref":"AWS::URLSuffix"}]]},{"Fn::Join":["",["cloudtrail.",{"Ref":"AWS::URLSuffix"}]]},"cloudwatch.amazonaws.com"]},"Resource":"*"},{"Action":"kms:*","Effect":"Allow","Principal":{"AWS":{"Fn::Join":["",["arn:",{"Ref":"AWS::Partition"},":iam::",{"Ref":"AWS::AccountId"},":root"]]}},"Resource":"*"}],"Version":"2012-10-17"},"Tags":[{"Key":"Solutions:SolutionID","Value":"SO0111"},{"Key":"Solutions:SolutionName","Value":"automated-security-response-on-aws"},{"Key":"Solutions:SolutionVersion","Value":"v4.1.0"}]},"UpdateReplacePolicy":"Retain","DeletionPolicy":"Retain"},"SHARRRemediationKeyAlias5531874D":{"Type":"AWS::KMS::Alias","Properties":{"AliasName":"alias/SO0111-SHARR-Remediation-Key","TargetKeyId":{"Fn::GetAtt":["SHARRRemediationKeyE744743D","Arn"]}}},"SHARRKeyAliasEBF509D8":{"Type":"AWS::SSM::Parameter","Properties":{"Description":"KMS Customer Managed Key that will encrypt data for remediations","Name":"/Solutions/SO0111/CMK_REMEDIATION_ARN","Tags":{"Solutions:SolutionID":"SO0111","Solutions:SolutionName":"automated-security-response-on-aws","Solutions:SolutionVersion":"v4.1.0"},"Type":"String","Value":{"Fn::GetAtt":["SHARRRemediationKeyE744743D","Arn"]}}},"SHARRMemberVersionEDAB5C42":{"Type":"AWS::SSM::Parameter","Properties":{"Description":"Version of the AWS Security Hub Automated Response and Remediation solution","Name":"/Solutions/SO0111/member-version","Tags":{"Solutions:SolutionID":"SO0111","Solutions:SolutionName":"automated-security-response-on-aws","Solutions:SolutionVersion":"v4.1.0"},"Type":"String","Value":"v4.1.0"}},"SSMParameterLogGroupName47918519":{"Type":"AWS::SSM::Parameter","Properties":{"Description":"Parameter to store log group name","Name":"/Solutions/SO0111/Metrics_LogGroupName","Tags":{"Solutions:SolutionID":"SO0111","Solutions:SolutionName":"automated-security-response-on-aws","Solutions:SolutionVersion":"v4.1.0"},"Type":"String","Value":{"Ref":"LogGroupName"}}},"SSMParameterForS34EncryptionKeyAlias73DD8A98":{"Type":"AWS::SSM::Parameter","Properties":{"Description":"Parameter to store encryption key alias for the PCI.S3.4/FSBP.S3.4, replace the default value with the KMS Key Alias, other wise the remediation will enable the default AES256 encryption for the bucket.","Name":"/Solutions/SO0111/afsbp/1.0.0/S3.4/KmsKeyAlias","Tags":{"Solutions:SolutionID":"SO0111","Solutions:SolutionName":"automated-security-response-on-aws","Solutions:SolutionVersion":"v4.1.0"},"Type":"String","Value":"default-s3-encryption"}},"RemediationConfigAccessLogs08FBABE2":{"Type":"AWS::S3::Bucket","Properties":{"AccessControl":"LogDeliveryWrite","BucketEncryption":{"ServerSideEncryptionConfiguration":[{"ServerSideEncryptionByDefault":{"SSEAlgorithm":"AES256"}}]},"LifecycleConfiguration":{"Rules":[{"ExpirationInDays":90,"Id":"ExpireAccessLogs","Status":"Enabled"}]},"OwnershipControls":{"Rules":[{"ObjectOwnership":"ObjectWriter"}]},"PublicAccessBlockConfiguration":{"BlockPublicAcls":true,"BlockPublicPolicy":true,"IgnorePublicAcls":true,"RestrictPublicBuckets":true},"Tags":[{"Key":"Solutions:SolutionID","Value":"SO0111"},{"Key":"Solutions:SolutionName","Value":"automated-security-response-on-aws"},{"Key":"Solutions:SolutionVersion","Value":"v4.1.0"}],"VersioningConfiguration":{"Status":"Enabled"}},"UpdateReplacePolicy":"Retain","DeletionPolicy":"Retain","Metadata":{"guard":{"SuppressedRules":["S3_BUCKET_LOGGING_ENABLED"]}}},"RemediationConfigAccessLogsPolicy24BAACEC":{"Type":"AWS::S3::BucketPolicy","Properties":{"Bucket":{"Ref":"RemediationConfigAccessLogs08FBABE2"},"PolicyDocument":{"Statement":[{"Action":"s3:*","Condition":{"Bool":{"aws:SecureTransport":"false"}},"Effect":"Deny","Principal":{"AWS":"*"},"Resource":[{"Fn::GetAtt":["RemediationConfigAccessLogs08FBABE2","Arn"]},{"Fn::Join":["",[{"Fn::GetAtt":["RemediationConfigAccessLogs08FBABE2","Arn"]},"/*"]]}]}],"Version":"2012-10-17"}}},"RemediationConfigurationBucketF5FA3D12":{"Type":"AWS::S3::Bucket","Properties":{"BucketEncryption":{"ServerSideEncryptionConfiguration":[{"ServerSideEncryptionByDefault":{"SSEAlgorithm":"AES256"}}]},"BucketName":{"Fn::Join":["",["so0111-asr-remediation-",{"Ref":"AWS::Region"},"-",{"Ref":"AWS::AccountId"}]]},"LifecycleConfiguration":{"Rules":[{"ExpirationInDays":90,"Id":"GuardDutyBackupRetention","Prefix":"guardduty-backups/","Status":"Enabled"},{"ExpirationInDays":7,"Id":"InstallOverrideListExpiration","Prefix":"install-overrides/","Status":"Enabled"},{"ExpirationInDays":365,"Id":"RollbackSnapshotRetention","Prefix":"snapshots/","Status":"Enabled"}]},"LoggingConfiguration":{"DestinationBucketName":{"Ref":"RemediationConfigAccessLogs08FBABE2"},"LogFilePrefix":"remediation-config-access-logs/"},"PublicAccessBlockConfiguration":{"BlockPublicAcls":true,"BlockPublicPolicy":true,"IgnorePublicAcls":true,"RestrictPublicBuckets":true},"Tags":[{"Key":"Solutions:SolutionID","Value":"SO0111"},{"Key":"Solutions:SolutionName","Value":"automated-security-response-on-aws"},{"Key":"Solutions:SolutionVersion","Value":"v4.1.0"}],"VersioningConfiguration":{"Status":"Enabled"}},"UpdateReplacePolicy":"Retain","DeletionPolicy":"RetainExceptOnCreate"},"RemediationConfigurationBucketPolicyE889843F":{"Type":"AWS::S3::BucketPolicy","Properties":{"Bucket":{"Ref":"RemediationConfigurationBucketF5FA3D12"},"PolicyDocument":{"Statement":[{"Action":"s3:*","Condition":{"Bool":{"aws:SecureTransport":"false"}},"Effect":"Deny","Principal":{"AWS":"*"},"Resource":[{"Fn::GetAtt":["RemediationConfigurationBucketF5FA3D12","Arn"]},{"Fn::Join":["",[{"Fn::GetAtt":["RemediationConfigurationBucketF5FA3D12","Arn"]},"/*"]]}]},{"Action":"s3:GetObject","Condition":{"StringEquals":{"aws:PrincipalAccount":{"Ref":"AWS::AccountId"}}},"Effect":"Allow","Principal":{"AWS":{"Fn::Join":["",["arn:",{"Ref":"AWS::Partition"},":iam::",{"Ref":"AWS::AccountId"},":root"]]}},"Resource":[{"Fn::Join":["",[{"Fn::GetAtt":["RemediationConfigurationBucketF5FA3D12","Arn"]},"/install-overrides/*"]]},{"Fn::Join":["",[{"Fn::GetAtt":["RemediationConfigurationBucketF5FA3D12","Arn"]},"/baseline-overrides/*"]]}],"Sid":"AllowEC2ReadForPatching"},{"Action":"s3:ListBucket","Condition":{"StringLike":{"s3:prefix":["install-overrides/*","baseline-overrides/*"]}},"Effect":"Allow","Principal":{"AWS":{"Fn::Join":["",["arn:",{"Ref":"AWS::Partition"},":iam::",{"Ref":"AWS::AccountId"},":root"]]}},"Resource":{"Fn::GetAtt":["RemediationConfigurationBucketF5FA3D12","Arn"]},"Sid":"AllowListBucket"}],"Version":"2012-10-17"}}},"RemediationConfigurationBucketNotificationsHandlerPolicy465AD009":{"Type":"AWS::IAM::Policy","Properties":{"PolicyDocument":{"Statement":[{"Action":"s3:PutBucketNotification","Effect":"Allow","Resource":{"Fn::GetAtt":["RemediationConfigurationBucketF5FA3D12","Arn"]}}],"Version":"2012-10-17"},"PolicyName":"RemediationConfigurationBucketNotificationsHandlerPolicy465AD009","Roles":[{"Ref":"BucketNotificationsHandler050a0587b7544547bf325f094a3db834RoleB6FB88EC"}]}},"RemediationConfigurationBucketNotificationsE3D136AD":{"Type":"Custom::S3BucketNotifications","Properties":{"ServiceToken":{"Fn::GetAtt":["BucketNotificationsHandler050a0587b7544547bf325f094a3db8347ECC3691","Arn"]},"BucketName":{"Ref":"RemediationConfigurationBucketF5FA3D12"},"NotificationConfiguration":{"TopicConfigurations":[{"Events":["s3:ObjectCreated:*"],"Filter":{"Key":{"FilterRules":[{"Name":"prefix","Value":"guardduty-backups/"}]}},"TopicArn":{"Ref":"RemediationConfigMonitoringTopicC62EFF45"}},{"Events":["s3:ObjectRemoved:*"],"Filter":{"Key":{"FilterRules":[{"Name":"prefix","Value":"guardduty-backups/"}]}},"TopicArn":{"Ref":"RemediationConfigMonitoringTopicC62EFF45"}},{"Events":["s3:ObjectCreated:*"],"Filter":{"Key":{"FilterRules":[{"Name":"prefix","Value":"install-overrides/"}]}},"TopicArn":{"Ref":"RemediationConfigMonitoringTopicC62EFF45"}},{"Events":["s3:ObjectRemoved:*"],"Filter":{"Key":{"FilterRules":[{"Name":"prefix","Value":"install-overrides/"}]}},"TopicArn":{"Ref":"RemediationConfigMonitoringTopicC62EFF45"}},{"Events":["s3:ObjectCreated:*"],"Filter":{"Key":{"FilterRules":[{"Name":"prefix","Value":"baseline-overrides/"}]}},"TopicArn":{"Ref":"RemediationConfigMonitoringTopicC62EFF45"}},{"Events":["s3:ObjectRemoved:*"],"Filter":{"Key":{"FilterRules":[{"Name":"prefix","Value":"baseline-overrides/"}]}},"TopicArn":{"Ref":"RemediationConfigMonitoringTopicC62EFF45"}}]},"Managed":true,"SkipDestinationValidation":false},"DependsOn":["RemediationConfigMonitoringTopicPolicyA3412541","RemediationConfigMonitoringTopicC62EFF45","RemediationConfigurationBucketNotificationsHandlerPolicy465AD009","RemediationConfigurationBucketPolicyE889843F"]},"RemediationConfigMonitoringTopicC62EFF45":{"Type":"AWS::SNS::Topic","Properties":{"DisplayName":"ASR Remediation Config Bucket Monitoring","KmsMasterKeyId":{"Fn::GetAtt":["SHARRRemediationKeyE744743D","Arn"]},"Tags":[{"Key":"Solutions:SolutionID","Value":"SO0111"},{"Key":"Solutions:SolutionName","Value":"automated-security-response-on-aws"},{"Key":"Solutions:SolutionVersion","Value":"v4.1.0"}]}},"RemediationConfigMonitoringTopicPolicyA3412541":{"Type":"AWS::SNS::TopicPolicy","Properties":{"PolicyDocument":{"Statement":[{"Action":"sns:Publish","Condition":{"ArnLike":{"aws:SourceArn":{"Fn::GetAtt":["RemediationConfigurationBucketF5FA3D12","Arn"]}}},"Effect":"Allow","Principal":{"Service":"s3.amazonaws.com"},"Resource":{"Ref":"RemediationConfigMonitoringTopicC62EFF45"},"Sid":"0"}],"Version":"2012-10-17"},"Topics":[{"Ref":"RemediationConfigMonitoringTopicC62EFF45"}]}},"BucketNotificationsHandler050a0587b7544547bf325f094a3db834RoleB6FB88EC":{"Type":"AWS::IAM::Role","Properties":{"AssumeRolePolicyDocument":{"Statement":[{"Action":"sts:AssumeRole","Effect":"Allow","Principal":{"Service":"lambda.amazonaws.com"}}],"Version":"2012-10-17"},"ManagedPolicyArns":[{"Fn::Join":["",["arn:",{"Ref":"AWS::Partition"},":iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"]]}],"Tags":[{"Key":"Solutions:SolutionID","Value":"SO0111"},{"Key":"Solutions:SolutionName","Value":"automated-security-response-on-aws"},{"Key":"Solutions:SolutionVersion","Value":"v4.1.0"}]}},"BucketNotificationsHandler050a0587b7544547bf325f094a3db8347ECC3691":{"Type":"AWS::Lambda::Function","Properties":{"Description":"AWS CloudFormation handler for \"Custom::S3BucketNotifications\" resources (@aws-cdk/aws-s3)","Code":{"ZipFile":"import boto3  # type: ignore\nimport json\nimport logging\nimport urllib.request\n\ns3 = boto3.client(\"s3\")\n\nEVENTBRIDGE_CONFIGURATION = 'EventBridgeConfiguration'\nCONFIGURATION_TYPES = [\"TopicConfigurations\", \"QueueConfigurations\", \"LambdaFunctionConfigurations\"]\n\ndef handler(event: dict, context):\n  response_status = \"SUCCESS\"\n  error_message = \"\"\n  try:\n    props = event[\"ResourceProperties\"]\n    notification_configuration = props[\"NotificationConfiguration\"]\n    managed = props.get('Managed', 'true').lower() == 'true'\n    skipDestinationValidation = props.get('SkipDestinationValidation', 'false').lower() == 'true'\n    stack_id = event['StackId']\n    old = event.get(\"OldResourceProperties\", {}).get(\"NotificationConfiguration\", {})\n    if managed:\n      config = handle_managed(event[\"RequestType\"], notification_configuration)\n    else:\n      config = handle_unmanaged(props[\"BucketName\"], stack_id, event[\"RequestType\"], notification_configuration, old)\n    s3.put_bucket_notification_configuration(Bucket=props[\"BucketName\"], NotificationConfiguration=config, SkipDestinationValidation=skipDestinationValidation)\n  except Exception as e:\n    logging.exception(\"Failed to put bucket notification configuration\")\n    response_status = \"FAILED\"\n    error_message = f\"Error: {str(e)}. \"\n  finally:\n    submit_response(event, context, response_status, error_message)\n\ndef handle_managed(request_type, notification_configuration):\n  if request_type == 'Delete':\n    return {}\n  return notification_configuration\n\ndef handle_unmanaged(bucket, stack_id, request_type, notification_configuration, old):\n  def get_id(n):\n    n['Id'] = ''\n    sorted_notifications = sort_filter_rules(n)\n    strToHash=json.dumps(sorted_notifications, sort_keys=True).replace('\"Name\": \"prefix\"', '\"Name\": \"Prefix\"').replace('\"Name\": \"suffix\"', '\"Name\": \"Suffix\"')\n    return f\"{stack_id}-{hash(strToHash)}\"\n  def with_id(n):\n    n['Id'] = get_id(n)\n    return n\n\n  external_notifications = {}\n  existing_notifications = s3.get_bucket_notification_configuration(Bucket=bucket)\n  for t in CONFIGURATION_TYPES:\n    if request_type == 'Update':\n        old_incoming_ids = [get_id(n) for n in old.get(t, [])]\n        external_notifications[t] = [n for n in existing_notifications.get(t, []) if not get_id(n) in old_incoming_ids]      \n    elif request_type == 'Delete':\n        external_notifications[t] = [n for n in existing_notifications.get(t, []) if not n['Id'].startswith(f\"{stack_id}-\")]\n    elif request_type == 'Create':\n        external_notifications[t] = [n for n in existing_notifications.get(t, [])]\n  if EVENTBRIDGE_CONFIGURATION in existing_notifications:\n    external_notifications[EVENTBRIDGE_CONFIGURATION] = existing_notifications[EVENTBRIDGE_CONFIGURATION]\n\n  if request_type == 'Delete':\n    return external_notifications\n\n  notifications = {}\n  for t in CONFIGURATION_TYPES:\n    external = external_notifications.get(t, [])\n    incoming = [with_id(n) for n in notification_configuration.get(t, [])]\n    notifications[t] = external + incoming\n\n  if EVENTBRIDGE_CONFIGURATION in notification_configuration:\n    notifications[EVENTBRIDGE_CONFIGURATION] = notification_configuration[EVENTBRIDGE_CONFIGURATION]\n  elif EVENTBRIDGE_CONFIGURATION in external_notifications:\n    notifications[EVENTBRIDGE_CONFIGURATION] = external_notifications[EVENTBRIDGE_CONFIGURATION]\n\n  return notifications\n\ndef submit_response(event: dict, context, response_status: str, error_message: str):\n  response_body = json.dumps(\n    {\n      \"Status\": response_status,\n      \"Reason\": f\"{error_message}See the details in CloudWatch Log Stream: {context.log_stream_name}\",\n      \"PhysicalResourceId\": event.get(\"PhysicalResourceId\") or event[\"LogicalResourceId\"],\n      \"StackId\": event[\"StackId\"],\n      \"RequestId\": event[\"RequestId\"],\n      \"LogicalResourceId\": event[\"LogicalResourceId\"],\n      \"NoEcho\": False,\n    }\n  ).encode(\"utf-8\")\n  headers = {\"content-type\": \"\", \"content-length\": str(len(response_body))}\n  try:\n    req = urllib.request.Request(url=event[\"ResponseURL\"], headers=headers, data=response_body, method=\"PUT\")\n    with urllib.request.urlopen(req) as response:\n      print(response.read().decode(\"utf-8\"))\n    print(\"Status code: \" + response.reason)\n  except Exception as e:\n      print(\"send(..) failed executing request.urlopen(..): \" + str(e))\n\ndef sort_filter_rules(json_obj):\n  if not isinstance(json_obj, dict):\n      return json_obj\n  for key, value in json_obj.items():\n      if isinstance(value, dict):\n          json_obj[key] = sort_filter_rules(value)\n      elif isinstance(value, list):\n          json_obj[key] = [sort_filter_rules(item) for item in value]\n  if \"Filter\" in json_obj and \"Key\" in json_obj[\"Filter\"] and \"FilterRules\" in json_obj[\"Filter\"][\"Key\"]:\n      filter_rules = json_obj[\"Filter\"][\"Key\"][\"FilterRules\"]\n      sorted_filter_rules = sorted(filter_rules, key=lambda x: x[\"Name\"])\n      json_obj[\"Filter\"][\"Key\"][\"FilterRules\"] = sorted_filter_rules\n  return json_obj"},"Handler":"index.handler","Role":{"Fn::GetAtt":["BucketNotificationsHandler050a0587b7544547bf325f094a3db834RoleB6FB88EC","Arn"]},"Runtime":"python3.13","Timeout":300,"Tags":[{"Key":"Solutions:SolutionID","Value":"SO0111"},{"Key":"Solutions:SolutionName","Value":"automated-security-response-on-aws"},{"Key":"Solutions:SolutionVersion","Value":"v4.1.0"}]},"DependsOn":["BucketNotificationsHandler050a0587b7544547bf325f094a3db834RoleB6FB88EC"],"Metadata":{"guard":{"SuppressedRules":["LAMBDA_INSIDE_VPC","LAMBDA_CONCURRENCY_CHECK"]}}},"RemediationConfigBucketAccessPolicyF4D04687":{"Type":"AWS::IAM::ManagedPolicy","Properties":{"Description":{"Fn::Join":["",["Read-only access to the ASR remediation configuration bucket (patch and baseline overrides) in ",{"Ref":"AWS::Region"},". Attached by the Inspector.InstanceVulnerability remediation to the target EC2 instance role."]]},"ManagedPolicyName":{"Fn::Join":["",["ASR-RemediationConfigBucketAccess-",{"Ref":"AWS::Region"}]]},"Path":"/","PolicyDocument":{"Statement":[{"Action":"s3:GetObject","Effect":"Allow","Resource":[{"Fn::Join":["",[{"Fn::GetAtt":["RemediationConfigurationBucketF5FA3D12","Arn"]},"/install-overrides/*"]]},{"Fn::Join":["",[{"Fn::GetAtt":["RemediationConfigurationBucketF5FA3D12","Arn"]},"/baseline-overrides/*"]]}]},{"Action":"s3:ListBucket","Effect":"Allow","Resource":{"Fn::GetAtt":["RemediationConfigurationBucketF5FA3D12","Arn"]}}],"Version":"2012-10-17"}},"UpdateReplacePolicy":"Retain","DeletionPolicy":"RetainExceptOnCreate","Metadata":{"guard":{"SuppressedRules":["IAM_POLICYDOCUMENT_NO_WILDCARD_RESOURCE","CFN_NO_EXPLICIT_RESOURCE_NAMES"]}}},"RemediationConfigurationBucketNameParam450ACC24":{"Type":"AWS::SSM::Parameter","Properties":{"Description":"S3 bucket name for ASR remediation configuration files (patch overrides, GuardDuty backups)","Name":"/Solutions/SO0111/RemediationConfigurationBucket","Tags":{"Solutions:SolutionID":"SO0111","Solutions:SolutionName":"automated-security-response-on-aws","Solutions:SolutionVersion":"v4.1.0"},"Type":"String","Value":{"Ref":"RemediationConfigurationBucketF5FA3D12"}}},"BaselineConfigRoleEF7E1107":{"Type":"AWS::IAM::Role","Properties":{"AssumeRolePolicyDocument":{"Statement":[{"Action":"sts:AssumeRole","Effect":"Allow","Principal":{"Service":"lambda.amazonaws.com"}}],"Version":"2012-10-17"},"Policies":[{"PolicyDocument":{"Statement":[{"Action":"s3:PutObject","Effect":"Allow","Resource":{"Fn::Join":["",[{"Fn::GetAtt":["RemediationConfigurationBucketF5FA3D12","Arn"]},"/baseline-overrides/*"]]}},{"Action":["logs:CreateLogGroup","logs:CreateLogStream","logs:PutLogEvents"],"Effect":"Allow","Resource":"*"}],"Version":"2012-10-17"},"PolicyName":"BaselineConfigPolicy"}],"Tags":[{"Key":"Solutions:SolutionID","Value":"SO0111"},{"Key":"Solutions:SolutionName","Value":"automated-security-response-on-aws"},{"Key":"Solutions:SolutionVersion","Value":"v4.1.0"}]},"Metadata":{"guard":{"SuppressedRules":["IAM_NO_INLINE_POLICY_CHECK","IAM_POLICYDOCUMENT_NO_WILDCARD_RESOURCE"]}}},"BaselineConfigFunctionLogGroup5BCE9DC0":{"Type":"AWS::Logs::LogGroup","Properties":{"RetentionInDays":3653,"Tags":[{"Key":"Solutions:SolutionID","Value":"SO0111"},{"Key":"Solutions:SolutionName","Value":"automated-security-response-on-aws"},{"Key":"Solutions:SolutionVersion","Value":"v4.1.0"}]},"UpdateReplacePolicy":"Retain","DeletionPolicy":"Retain","Metadata":{"guard":{"SuppressedRules":["CLOUDWATCH_LOG_GROUP_ENCRYPTED"]}}},"BaselineConfigFunctionAA6B05B6":{"Type":"AWS::Lambda::Function","Properties":{"Code":{"S3Bucket":{"Fn::Join":["",["solutions-",{"Ref":"AWS::Region"}]]},"S3Key":"automated-security-response-on-aws/v4.1.0/lambda/asr_lambdas-c8b90e4c.zip"},"Description":"Uploads Windows security baseline configuration to the Remediation Configuration bucket","Environment":{"Variables":{"LOG_LEVEL":"INFO","SOLUTION_TRADEMARKEDNAME":"automated-security-response-on-aws"}},"Handler":"baseline-configuration/baselineConfigurationHandler.handler","LoggingConfig":{"LogGroup":{"Ref":"BaselineConfigFunctionLogGroup5BCE9DC0"}},"Role":{"Fn::GetAtt":["BaselineConfigRoleEF7E1107","Arn"]},"Runtime":"nodejs22.x","Tags":[{"Key":"Solutions:SolutionID","Value":"SO0111"},{"Key":"Solutions:SolutionName","Value":"automated-security-response-on-aws"},{"Key":"Solutions:SolutionVersion","Value":"v4.1.0"}],"Timeout":300},"DependsOn":["BaselineConfigRoleEF7E1107"],"Metadata":{"guard":{"SuppressedRules":["LAMBDA_CONCURRENCY_CHECK","LAMBDA_INSIDE_VPC"]}}},"BaselineConfigurationResource":{"Type":"Custom::BaselineConfiguration","Properties":{"ServiceToken":{"Fn::GetAtt":["BaselineConfigFunctionAA6B05B6","Arn"]},"BucketName":{"Ref":"RemediationConfigurationBucketF5FA3D12"},"DeploymentTimestamp":"2026-10-13T10:14:57.636Z"},"UpdateReplacePolicy":"Delete","DeletionPolicy":"Delete"},"NestedStackFactoryGatePlaybookMemberStackAFSBP137036A57":{"Type":"AWS::CloudFormation::WaitConditionHandle","Metadata":{"PlaybookMemberStackAFSBPReady":{"Fn::If":["loadAFSBPCond",{"Ref":"PlaybookMemberStackAFSBP"},""]}}},"NestedStackFactoryGatePlaybookMemberStackCIS120E08EFB8B":{"Type":"AWS::CloudFormation::WaitConditionHandle","Metadata":{"PlaybookMemberStackAFSBPReady":{"Fn::If":["loadAFSBPCond",{"Ref":"PlaybookMemberStackAFSBP"},""]},"PlaybookMemberStackAFSBP1Ready":{"Fn::If":["loadAFSBP1Cond",{"Ref":"PlaybookMemberStackAFSBP1"},""]}}},"NestedStackFactoryGatePlaybookMemberStackCIS1402A4735A6":{"Type":"AWS::CloudFormation::WaitConditionHandle","Metadata":{"PlaybookMemberStackAFSBPReady":{"Fn::If":["loadAFSBPCond",{"Ref":"PlaybookMemberStackAFSBP"},""]},"PlaybookMemberStackAFSBP1Ready":{"Fn::If":["loadAFSBP1Cond",{"Ref":"PlaybookMemberStackAFSBP1"},""]},"PlaybookMemberStackCIS120Ready":{"Fn::If":["loadCIS120Cond",{"Ref":"PlaybookMemberStackCIS120"},""]}}},"NestedStackFactoryGatePlaybookMemberStackNIST80053C3D22DE7":{"Type":"AWS::CloudFormation::WaitConditionHandle","Metadata":{"PlaybookMemberStackAFSBPReady":{"Fn::If":["loadAFSBPCond",{"Ref":"PlaybookMemberStackAFSBP"},""]},"PlaybookMemberStackAFSBP1Ready":{"Fn::If":["loadAFSBP1Cond",{"Ref":"PlaybookMemberStackAFSBP1"},""]},"PlaybookMemberStackCIS120Ready":{"Fn::If":["loadCIS120Cond",{"Ref":"PlaybookMemberStackCIS120"},""]},"PlaybookMemberStackCIS140Ready":{"Fn::If":["loadCIS140Cond",{"Ref":"PlaybookMemberStackCIS140"},""]}}},"NestedStackFactoryGatePlaybookMemberStackNIST8005311D6A30FD":{"Type":"AWS::CloudFormation::WaitConditionHandle","Metadata":{"PlaybookMemberStackAFSBPReady":{"Fn::If":["loadAFSBPCond",{"Ref":"PlaybookMemberStackAFSBP"},""]},"PlaybookMemberStackAFSBP1Ready":{"Fn::If":["loadAFSBP1Cond",{"Ref":"PlaybookMemberStackAFSBP1"},""]},"PlaybookMemberStackCIS120Ready":{"Fn::If":["loadCIS120Cond",{"Ref":"PlaybookMemberStackCIS120"},""]},"PlaybookMemberStackCIS140Ready":{"Fn::If":["loadCIS140Cond",{"Ref":"PlaybookMemberStackCIS140"},""]},"PlaybookMemberStackNIST80053Ready":{"Fn::If":["loadNIST80053Cond",{"Ref":"PlaybookMemberStackNIST80053"},""]}}},"NestedStackFactoryGatePlaybookMemberStackPCI3214A12B906":{"Type":"AWS::CloudFormation::WaitConditionHandle","Metadata":{"PlaybookMemberStackAFSBPReady":{"Fn::If":["loadAFSBPCond",{"Ref":"PlaybookMemberStackAFSBP"},""]},"PlaybookMemberStackAFSBP1Ready":{"Fn::If":["loadAFSBP1Cond",{"Ref":"PlaybookMemberStackAFSBP1"},""]},"PlaybookMemberStackCIS120Ready":{"Fn::If":["loadCIS120Cond",{"Ref":"PlaybookMemberStackCIS120"},""]},"PlaybookMemberStackCIS140Ready":{"Fn::If":["loadCIS140Cond",{"Ref":"PlaybookMemberStackCIS140"},""]},"PlaybookMemberStackNIST80053Ready":{"Fn::If":["loadNIST80053Cond",{"Ref":"PlaybookMemberStackNIST80053"},""]},"PlaybookMemberStackNIST800531Ready":{"Fn::If":["loadNIST800531Cond",{"Ref":"PlaybookMemberStackNIST800531"},""]}}},"NestedStackFactoryGatePlaybookMemberStackCIS300FA804242":{"Type":"AWS::CloudFormation::WaitConditionHandle","Metadata":{"PlaybookMemberStackAFSBPReady":{"Fn::If":["loadAFSBPCond",{"Ref":"PlaybookMemberStackAFSBP"},""]},"PlaybookMemberStackAFSBP1Ready":{"Fn::If":["loadAFSBP1Cond",{"Ref":"PlaybookMemberStackAFSBP1"},""]},"PlaybookMemberStackCIS120Ready":{"Fn::If":["loadCIS120Cond",{"Ref":"PlaybookMemberStackCIS120"},""]},"PlaybookMemberStackCIS140Ready":{"Fn::If":["loadCIS140Cond",{"Ref":"PlaybookMemberStackCIS140"},""]},"PlaybookMemberStackNIST80053Ready":{"Fn::If":["loadNIST80053Cond",{"Ref":"PlaybookMemberStackNIST80053"},""]},"PlaybookMemberStackNIST800531Ready":{"Fn::If":["loadNIST800531Cond",{"Ref":"PlaybookMemberStackNIST800531"},""]},"PlaybookMemberStackPCI321Ready":{"Fn::If":["loadPCI321Cond",{"Ref":"PlaybookMemberStackPCI321"},""]}}},"NestedStackFactoryGatePlaybookMemberStackSC0515DB36":{"Type":"AWS::CloudFormation::WaitConditionHandle","Metadata":{"PlaybookMemberStackAFSBPReady":{"Fn::If":["loadAFSBPCond",{"Ref":"PlaybookMemberStackAFSBP"},""]},"PlaybookMemberStackAFSBP1Ready":{"Fn::If":["loadAFSBP1Cond",{"Ref":"PlaybookMemberStackAFSBP1"},""]},"PlaybookMemberStackCIS120Ready":{"Fn::If":["loadCIS120Cond",{"Ref":"PlaybookMemberStackCIS120"},""]},"PlaybookMemberStackCIS140Ready":{"Fn::If":["loadCIS140Cond",{"Ref":"PlaybookMemberStackCIS140"},""]},"PlaybookMemberStackNIST80053Ready":{"Fn::If":["loadNIST80053Cond",{"Ref":"PlaybookMemberStackNIST80053"},""]},"PlaybookMemberStackNIST800531Ready":{"Fn::If":["loadNIST800531Cond",{"Ref":"PlaybookMemberStackNIST800531"},""]},"PlaybookMemberStackPCI321Ready":{"Fn::If":["loadPCI321Cond",{"Ref":"PlaybookMemberStackPCI321"},""]},"PlaybookMemberStackCIS300Ready":{"Fn::If":["loadCIS300Cond",{"Ref":"PlaybookMemberStackCIS300"},""]}}},"NestedStackFactoryGatePlaybookMemberStackSC1042EDDD9":{"Type":"AWS::CloudFormation::WaitConditionHandle","Metadata":{"PlaybookMemberStackAFSBPReady":{"Fn::If":["loadAFSBPCond",{"Ref":"PlaybookMemberStackAFSBP"},""]},"PlaybookMemberStackAFSBP1Ready":{"Fn::If":["loadAFSBP1Cond",{"Ref":"PlaybookMemberStackAFSBP1"},""]},"PlaybookMemberStackCIS120Ready":{"Fn::If":["loadCIS120Cond",{"Ref":"PlaybookMemberStackCIS120"},""]},"PlaybookMemberStackCIS140Ready":{"Fn::If":["loadCIS140Cond",{"Ref":"PlaybookMemberStackCIS140"},""]},"PlaybookMemberStackNIST80053Ready":{"Fn::If":["loadNIST80053Cond",{"Ref":"PlaybookMemberStackNIST80053"},""]},"PlaybookMemberStackNIST800531Ready":{"Fn::If":["loadNIST800531Cond",{"Ref":"PlaybookMemberStackNIST800531"},""]},"PlaybookMemberStackPCI321Ready":{"Fn::If":["loadPCI321Cond",{"Ref":"PlaybookMemberStackPCI321"},""]},"PlaybookMemberStackCIS300Ready":{"Fn::If":["loadCIS300Cond",{"Ref":"PlaybookMemberStackCIS300"},""]},"PlaybookMemberStackSCReady":{"Fn::If":["loadSCCond",{"Ref":"PlaybookMemberStackSC"},""]}}},"NestedStackFactoryGateMemberCloudTrailStackD769B835":{"Type":"AWS::CloudFormation::WaitConditionHandle","Metadata":{"PlaybookMemberStackAFSBPReady":{"Fn::If":["loadAFSBPCond",{"Ref":"PlaybookMemberStackAFSBP"},""]},"PlaybookMemberStackAFSBP1Ready":{"Fn::If":["loadAFSBP1Cond",{"Ref":"PlaybookMemberStackAFSBP1"},""]},"PlaybookMemberStackCIS120Ready":{"Fn::If":["loadCIS120Cond",{"Ref":"PlaybookMemberStackCIS120"},""]},"PlaybookMemberStackCIS140Ready":{"Fn::If":["loadCIS140Cond",{"Ref":"PlaybookMemberStackCIS140"},""]},"PlaybookMemberStackNIST80053Ready":{"Fn::If":["loadNIST80053Cond",{"Ref":"PlaybookMemberStackNIST80053"},""]},"PlaybookMemberStackNIST800531Ready":{"Fn::If":["loadNIST800531Cond",{"Ref":"PlaybookMemberStackNIST800531"},""]},"PlaybookMemberStackPCI321Ready":{"Fn::If":["loadPCI321Cond",{"Ref":"PlaybookMemberStackPCI321"},""]},"PlaybookMemberStackCIS300Ready":{"Fn::If":["loadCIS300Cond",{"Ref":"PlaybookMemberStackCIS300"},""]},"PlaybookMemberStackSCReady":{"Fn::If":["loadSCCond",{"Ref":"PlaybookMemberStackSC"},""]},"PlaybookMemberStackSC1Ready":{"Fn::If":["loadSC1Cond",{"Ref":"PlaybookMemberStackSC1"},""]}}},"WaitProviderRole83B0295F":{"Type":"AWS::IAM::Role","Properties":{"AssumeRolePolicyDocument":{"Statement":[{"Action":"sts:AssumeRole","Effect":"Allow","Principal":{"Service":"lambda.amazonaws.com"}}],"Version":"2012-10-17"},"Policies":[{"PolicyDocument":{"Statement":[{"Action":"cloudwatch:PutMetricData","Effect":"Allow","Resource":"*"},{"Action":["logs:CreateLogGroup","logs:CreateLogStream","logs:PutLogEvents"],"Effect":"Allow","Resource":"*"}],"Version":"2012-10-17"},"PolicyName":"LambdaPolicy"}],"Tags":[{"Key":"Solutions:SolutionID","Value":"SO0111"},{"Key":"Solutions:SolutionName","Value":"automated-security-response-on-aws"},{"Key":"Solutions:SolutionVersion","Value":"v4.1.0"}]},"Metadata":{"guard":{"SuppressedRules":["IAM_NO_INLINE_POLICY_CHECK","IAM_POLICYDOCUMENT_NO_WILDCARD_RESOURCE"]}}},"WaitProviderFunctionLogGroup521DCE00":{"Type":"AWS::Logs::LogGroup","Properties":{"RetentionInDays":3653,"Tags":[{"Key":"Solutions:SolutionID","Value":"SO0111"},{"Key":"Solutions:SolutionName","Value":"automated-security-response-on-aws"},{"Key":"Solutions:SolutionVersion","Value":"v4.1.0"}]},"UpdateReplacePolicy":"Retain","DeletionPolicy":"Retain","Metadata":{"guard":{"SuppressedRules":["CLOUDWATCH_LOG_GROUP_ENCRYPTED"]}}},"WaitProviderFunction3D90ED36":{"Type":"AWS::Lambda::Function","Properties":{"Code":{"S3Bucket":{"Fn::Join":["",["solutions-",{"Ref":"AWS::Region"}]]},"S3Key":"automated-security-response-on-aws/v4.1.0/lambda/wait_provider-539d41f0.zip"},"Environment":{"Variables":{"LOG_LEVEL":"INFO"}},"Handler":"wait_provider.lambda_handler","LoggingConfig":{"LogGroup":{"Ref":"WaitProviderFunctionLogGroup521DCE00"}},"Role":{"Fn::GetAtt":["WaitProviderRole83B0295F","Arn"]},"Runtime":"python3.11","Tags":[{"Key":"Solutions:SolutionID","Value":"SO0111"},{"Key":"Solutions:SolutionName","Value":"automated-security-response-on-aws"},{"Key":"Solutions:SolutionVersion","Value":"v4.1.0"}],"Timeout":900},"DependsOn":["WaitProviderRole83B0295F"],"Metadata":{"guard":{"SuppressedRules":["LAMBDA_CONCURRENCY_CHECK","LAMBDA_INSIDE_VPC"]}}},"RunbookStackNoRoles":{"Type":"AWS::CloudFormation::Stack","Properties":{"Parameters":{"WaitProviderServiceToken":{"Fn::GetAtt":["WaitProviderFunction3D90ED36","Arn"]},"Namespace":{"Ref":"Namespace"}},"Tags":[{"Key":"Solutions:SolutionID","Value":"SO0111"},{"Key":"Solutions:SolutionName","Value":"automated-security-response-on-aws"},{"Key":"Solutions:SolutionVersion","Value":"v4.1.0"}],"TemplateURL":{"Fn::Join":["",["https://",{"Fn::FindInMap":["NestedStackFactorySourceCodeA11A36A7","General","S3Bucket"]},"-reference.s3.amazonaws.com/",{"Fn::FindInMap":["NestedStackFactorySourceCodeA11A36A7","General","KeyPrefix"]},"/automated-security-response-remediation-runbooks.template"]]}},"UpdateReplacePolicy":"Delete","DeletionPolicy":"Delete"},"PlaybookMemberStackAFSBP":{"Type":"AWS::CloudFormation::Stack","Properties":{"Parameters":{"SecHubAdminAccount":{"Ref":"SecHubAdminAccount"},"WaitProviderServiceToken":{"Fn::GetAtt":["WaitProviderFunction3D90ED36","Arn"]},"Namespace":{"Ref":"Namespace"}},"Tags":[{"Key":"Solutions:SolutionID","Value":"SO0111"},{"Key":"Solutions:SolutionName","Value":"automated-security-response-on-aws"},{"Key":"Solutions:SolutionVersion","Value":"v4.1.0"}],"TemplateURL":{"Fn::Join":["",["https://",{"Fn::FindInMap":["NestedStackFactorySourceCodeA11A36A7","General","S3Bucket"]},"-reference.s3.amazonaws.com/",{"Fn::FindInMap":["NestedStackFactorySourceCodeA11A36A7","General","KeyPrefix"]},"/playbooks/AFSBPMemberStack.template"]]}},"DependsOn":["RunbookStackNoRoles"],"UpdateReplacePolicy":"Delete","DeletionPolicy":"Delete","Condition":"loadAFSBPCond"},"PlaybookMemberStackAFSBP1":{"Type":"AWS::CloudFormation::Stack","Properties":{"Parameters":{"SecHubAdminAccount":{"Ref":"SecHubAdminAccount"},"WaitProviderServiceToken":{"Fn::GetAtt":["WaitProviderFunction3D90ED36","Arn"]},"Namespace":{"Ref":"Namespace"}},"Tags":[{"Key":"Solutions:SolutionID","Value":"SO0111"},{"Key":"Solutions:SolutionName","Value":"automated-security-response-on-aws"},{"Key":"Solutions:SolutionVersion","Value":"v4.1.0"}],"TemplateURL":{"Fn::Join":["",["https://",{"Fn::FindInMap":["NestedStackFactorySourceCodeA11A36A7","General","S3Bucket"]},"-reference.s3.amazonaws.com/",{"Fn::FindInMap":["NestedStackFactorySourceCodeA11A36A7","General","KeyPrefix"]},"/playbooks/AFSBPMemberStack1.template"]]}},"DependsOn":["NestedStackFactoryGatePlaybookMemberStackAFSBP137036A57","RunbookStackNoRoles"],"UpdateReplacePolicy":"Delete","DeletionPolicy":"Delete","Condition":"loadAFSBP1Cond"},"PlaybookMemberStackCIS120":{"Type":"AWS::CloudFormation::Stack","Properties":{"Parameters":{"SecHubAdminAccount":{"Ref":"SecHubAdminAccount"},"WaitProviderServiceToken":{"Fn::GetAtt":["WaitProviderFunction3D90ED36","Arn"]},"Namespace":{"Ref":"Namespace"}},"Tags":[{"Key":"Solutions:SolutionID","Value":"SO0111"},{"Key":"Solutions:SolutionName","Value":"automated-security-response-on-aws"},{"Key":"Solutions:SolutionVersion","Value":"v4.1.0"}],"TemplateURL":{"Fn::Join":["",["https://",{"Fn::FindInMap":["NestedStackFactorySourceCodeA11A36A7","General","S3Bucket"]},"-reference.s3.amazonaws.com/",{"Fn::FindInMap":["NestedStackFactorySourceCodeA11A36A7","General","KeyPrefix"]},"/playbooks/CIS120MemberStack.template"]]}},"DependsOn":["NestedStackFactoryGatePlaybookMemberStackCIS120E08EFB8B","RunbookStackNoRoles"],"UpdateReplacePolicy":"Delete","DeletionPolicy":"Delete","Condition":"loadCIS120Cond"},"PlaybookMemberStackCIS140":{"Type":"AWS::CloudFormation::Stack","Properties":{"Parameters":{"SecHubAdminAccount":{"Ref":"SecHubAdminAccount"},"WaitProviderServiceToken":{"Fn::GetAtt":["WaitProviderFunction3D90ED36","Arn"]},"Namespace":{"Ref":"Namespace"}},"Tags":[{"Key":"Solutions:SolutionID","Value":"SO0111"},{"Key":"Solutions:SolutionName","Value":"automated-security-response-on-aws"},{"Key":"Solutions:SolutionVersion","Value":"v4.1.0"}],"TemplateURL":{"Fn::Join":["",["https://",{"Fn::FindInMap":["NestedStackFactorySourceCodeA11A36A7","General","S3Bucket"]},"-reference.s3.amazonaws.com/",{"Fn::FindInMap":["NestedStackFactorySourceCodeA11A36A7","General","KeyPrefix"]},"/playbooks/CIS140MemberStack.template"]]}},"DependsOn":["NestedStackFactoryGatePlaybookMemberStackCIS1402A4735A6","RunbookStackNoRoles"],"UpdateReplacePolicy":"Delete","DeletionPolicy":"Delete","Condition":"loadCIS140Cond"},"PlaybookMemberStackNIST80053":{"Type":"AWS::CloudFormation::Stack","Properties":{"Parameters":{"SecHubAdminAccount":{"Ref":"SecHubAdminAccount"},"WaitProviderServiceToken":{"Fn::GetAtt":["WaitProviderFunction3D90ED36","Arn"]},"Namespace":{"Ref":"Namespace"}},"Tags":[{"Key":"Solutions:SolutionID","Value":"SO0111"},{"Key":"Solutions:SolutionName","Value":"automated-security-response-on-aws"},{"Key":"Solutions:SolutionVersion","Value":"v4.1.0"}],"TemplateURL":{"Fn::Join":["",["https://",{"Fn::FindInMap":["NestedStackFactorySourceCodeA11A36A7","General","S3Bucket"]},"-reference.s3.amazonaws.com/",{"Fn::FindInMap":["NestedStackFactorySourceCodeA11A36A7","General","KeyPrefix"]},"/playbooks/NIST80053MemberStack.template"]]}},"DependsOn":["NestedStackFactoryGatePlaybookMemberStackNIST80053C3D22DE7","RunbookStackNoRoles"],"UpdateReplacePolicy":"Delete","DeletionPolicy":"Delete","Condition":"loadNIST80053Cond"},"PlaybookMemberStackNIST800531":{"Type":"AWS::CloudFormation::Stack","Properties":{"Parameters":{"SecHubAdminAccount":{"Ref":"SecHubAdminAccount"},"WaitProviderServiceToken":{"Fn::GetAtt":["WaitProviderFunction3D90ED36","Arn"]},"Namespace":{"Ref":"Namespace"}},"Tags":[{"Key":"Solutions:SolutionID","Value":"SO0111"},{"Key":"Solutions:SolutionName","Value":"automated-security-response-on-aws"},{"Key":"Solutions:SolutionVersion","Value":"v4.1.0"}],"TemplateURL":{"Fn::Join":["",["https://",{"Fn::FindInMap":["NestedStackFactorySourceCodeA11A36A7","General","S3Bucket"]},"-reference.s3.amazonaws.com/",{"Fn::FindInMap":["NestedStackFactorySourceCodeA11A36A7","General","KeyPrefix"]},"/playbooks/NIST80053MemberStack1.template"]]}},"DependsOn":["NestedStackFactoryGatePlaybookMemberStackNIST8005311D6A30FD","RunbookStackNoRoles"],"UpdateReplacePolicy":"Delete","DeletionPolicy":"Delete","Condition":"loadNIST800531Cond"},"PlaybookMemberStackPCI321":{"Type":"AWS::CloudFormation::Stack","Properties":{"Parameters":{"SecHubAdminAccount":{"Ref":"SecHubAdminAccount"},"WaitProviderServiceToken":{"Fn::GetAtt":["WaitProviderFunction3D90ED36","Arn"]},"Namespace":{"Ref":"Namespace"}},"Tags":[{"Key":"Solutions:SolutionID","Value":"SO0111"},{"Key":"Solutions:SolutionName","Value":"automated-security-response-on-aws"},{"Key":"Solutions:SolutionVersion","Value":"v4.1.0"}],"TemplateURL":{"Fn::Join":["",["https://",{"Fn::FindInMap":["NestedStackFactorySourceCodeA11A36A7","General","S3Bucket"]},"-reference.s3.amazonaws.com/",{"Fn::FindInMap":["NestedStackFactorySourceCodeA11A36A7","General","KeyPrefix"]},"/playbooks/PCI321MemberStack.template"]]}},"DependsOn":["NestedStackFactoryGatePlaybookMemberStackPCI3214A12B906","RunbookStackNoRoles"],"UpdateReplacePolicy":"Delete","DeletionPolicy":"Delete","Condition":"loadPCI321Cond"},"PlaybookMemberStackCIS300":{"Type":"AWS::CloudFormation::Stack","Properties":{"Parameters":{"SecHubAdminAccount":{"Ref":"SecHubAdminAccount"},"WaitProviderServiceToken":{"Fn::GetAtt":["WaitProviderFunction3D90ED36","Arn"]},"Namespace":{"Ref":"Namespace"}},"Tags":[{"Key":"Solutions:SolutionID","Value":"SO0111"},{"Key":"Solutions:SolutionName","Value":"automated-security-response-on-aws"},{"Key":"Solutions:SolutionVersion","Value":"v4.1.0"}],"TemplateURL":{"Fn::Join":["",["https://",{"Fn::FindInMap":["NestedStackFactorySourceCodeA11A36A7","General","S3Bucket"]},"-reference.s3.amazonaws.com/",{"Fn::FindInMap":["NestedStackFactorySourceCodeA11A36A7","General","KeyPrefix"]},"/playbooks/CIS300MemberStack.template"]]}},"DependsOn":["NestedStackFactoryGatePlaybookMemberStackCIS300FA804242","RunbookStackNoRoles"],"UpdateReplacePolicy":"Delete","DeletionPolicy":"Delete","Condition":"loadCIS300Cond"},"PlaybookMemberStackSC":{"Type":"AWS::CloudFormation::Stack","Properties":{"Parameters":{"SecHubAdminAccount":{"Ref":"SecHubAdminAccount"},"WaitProviderServiceToken":{"Fn::GetAtt":["WaitProviderFunction3D90ED36","Arn"]},"Namespace":{"Ref":"Namespace"}},"Tags":[{"Key":"Solutions:SolutionID","Value":"SO0111"},{"Key":"Solutions:SolutionName","Value":"automated-security-response-on-aws"},{"Key":"Solutions:SolutionVersion","Value":"v4.1.0"}],"TemplateURL":{"Fn::Join":["",["https://",{"Fn::FindInMap":["NestedStackFactorySourceCodeA11A36A7","General","S3Bucket"]},"-reference.s3.amazonaws.com/",{"Fn::FindInMap":["NestedStackFactorySourceCodeA11A36A7","General","KeyPrefix"]},"/playbooks/SCMemberStack.template"]]}},"DependsOn":["NestedStackFactoryGatePlaybookMemberStackSC0515DB36","RunbookStackNoRoles"],"UpdateReplacePolicy":"Delete","DeletionPolicy":"Delete","Condition":"loadSCCond"},"PlaybookMemberStackSC1":{"Type":"AWS::CloudFormation::Stack","Properties":{"Parameters":{"SecHubAdminAccount":{"Ref":"SecHubAdminAccount"},"WaitProviderServiceToken":{"Fn::GetAtt":["WaitProviderFunction3D90ED36","Arn"]},"Namespace":{"Ref":"Namespace"}},"Tags":[{"Key":"Solutions:SolutionID","Value":"SO0111"},{"Key":"Solutions:SolutionName","Value":"automated-security-response-on-aws"},{"Key":"Solutions:SolutionVersion","Value":"v4.1.0"}],"TemplateURL":{"Fn::Join":["",["https://",{"Fn::FindInMap":["NestedStackFactorySourceCodeA11A36A7","General","S3Bucket"]},"-reference.s3.amazonaws.com/",{"Fn::FindInMap":["NestedStackFactorySourceCodeA11A36A7","General","KeyPrefix"]},"/playbooks/SCMemberStack1.template"]]}},"DependsOn":["NestedStackFactoryGatePlaybookMemberStackSC1042EDDD9","RunbookStackNoRoles"],"UpdateReplacePolicy":"Delete","DeletionPolicy":"Delete","Condition":"loadSC1Cond"},"MemberCloudTrailNestedStackMemberCloudTrailNestedStackResource2ED3A9F6":{"Type":"AWS::CloudFormation::Stack","Properties":{"Parameters":{"CloudTrailLogGroupName":"/aws/lambda/SO0111-ASR-CloudTrailEvents","Namespace":{"Ref":"Namespace"},"LogWriterRoleArn":{"Fn::Join":["",["arn:",{"Ref":"AWS::Partition"},":iam::",{"Ref":"SecHubAdminAccount"},":role/CrossAccountLogWriterRole"]]}},"Tags":[{"Key":"Solutions:SolutionID","Value":"SO0111"},{"Key":"Solutions:SolutionName","Value":"automated-security-response-on-aws"},{"Key":"Solutions:SolutionVersion","Value":"v4.1.0"}],"TemplateURL":{"Fn::Join":["",["https://",{"Fn::FindInMap":["NestedStackFactorySourceCodeA11A36A7","General","S3Bucket"]},"-reference.s3.amazonaws.com/",{"Fn::FindInMap":["NestedStackFactorySourceCodeA11A36A7","General","KeyPrefix"]},"/automated-security-response-member-cloudtrail.template"]]}},"DependsOn":["NestedStackFactoryGateMemberCloudTrailStackD769B835","RunbookStackNoRoles"],"UpdateReplacePolicy":"Delete","DeletionPolicy":"Delete","Condition":"CloudTrailCondition"},"ASRLambdaLayerDAD507E4":{"Type":"AWS::Lambda::LayerVersion","Properties":{"CompatibleRuntimes":["python3.11"],"Content":{"S3Bucket":{"Fn::Join":["",["solutions-",{"Ref":"AWS::Region"}]]},"S3Key":"automated-security-response-on-aws/v4.1.0/lambda/layer-9a8994c7.zip"},"Description":"SO0111 ASR Common functions used by the solution","LicenseInfo":"https://www.apache.org/licenses/LICENSE-2.0"}},"MetricResourcesMetricResourcesRoleC49ABA6D":{"Type":"AWS::IAM::Role","Properties":{"AssumeRolePolicyDocument":{"Statement":[{"Action":"sts:AssumeRole","Effect":"Allow","Principal":{"Service":"lambda.amazonaws.com"}}],"Version":"2012-10-17"},"Policies":[{"PolicyDocument":{"Statement":[{"Action":"cloudwatch:PutMetricData","Effect":"Allow","Resource":"*"},{"Action":["logs:CreateLogStream","logs:PutLogEvents"],"Effect":"Allow","Resource":{"Fn::Join":["",["arn:",{"Ref":"AWS::Partition"},":logs:*:",{"Ref":"AWS::AccountId"},":log-group:*:log-stream:*"]]}},{"Action":"logs:CreateLogGroup","Effect":"Allow","Resource":{"Fn::Join":["",["arn:",{"Ref":"AWS::Partition"},":logs:*:",{"Ref":"AWS::AccountId"},":log-group:*"]]}},{"Action":["ssm:GetParameter","ssm:GetParameters","ssm:PutParameter","ssm:DeleteParameter"],"Effect":"Allow","Resource":{"Fn::Join":["",["arn:",{"Ref":"AWS::Partition"},":ssm:*:",{"Ref":"AWS::AccountId"},":parameter/Solutions/SO0111/*"]]}}],"Version":"2012-10-17"},"PolicyName":"LambdaPolicy"}],"Tags":[{"Key":"Solutions:SolutionID","Value":"SO0111"},{"Key":"Solutions:SolutionName","Value":"automated-security-response-on-aws"},{"Key":"Solutions:SolutionVersion","Value":"v4.1.0"}]},"Metadata":{"guard":{"SuppressedRules":["IAM_NO_INLINE_POLICY_CHECK","IAM_POLICYDOCUMENT_NO_WILDCARD_RESOURCE"]}}},"MetricResourcesMetricResourcesSecurityHubV2PolicyEF1A676B":{"Type":"AWS::IAM::Policy","Properties":{"PolicyDocument":{"Statement":[{"Action":"securityhub:DescribeSecurityHubV2","Effect":"Allow","Resource":"*"}],"Version":"2012-10-17"},"PolicyName":"MetricResourcesMetricResourcesSecurityHubV2PolicyEF1A676B","Roles":[{"Ref":"MetricResourcesMetricResourcesRoleC49ABA6D"}]},"Condition":"IsCommercialPartition"},"MetricResourcesASRDeploymentCustomResourceLambdaLogGroup9FC7DFE7":{"Type":"AWS::Logs::LogGroup","Properties":{"RetentionInDays":3653,"Tags":[{"Key":"Solutions:SolutionID","Value":"SO0111"},{"Key":"Solutions:SolutionName","Value":"automated-security-response-on-aws"},{"Key":"Solutions:SolutionVersion","Value":"v4.1.0"}]},"UpdateReplacePolicy":"Retain","DeletionPolicy":"Retain","Metadata":{"guard":{"SuppressedRules":["CLOUDWATCH_LOG_GROUP_ENCRYPTED"]}}},"MetricResourcesASRDeploymentCustomResourceLambda02CE6550":{"Type":"AWS::Lambda::Function","Properties":{"Code":{"S3Bucket":{"Fn::Join":["",["solutions-",{"Ref":"AWS::Region"}]]},"S3Key":"automated-security-response-on-aws/v4.1.0/lambda/deployment_metrics_custom_resource-c2b3b413.zip"},"Description":"ASR - Handles deployment related custom actions","Environment":{"Variables":{"LOG_LEVEL":"INFO","AWS_PARTITION":{"Ref":"AWS::Partition"},"SOLUTION_ID":"SO0111","SOLUTION_VERSION":"v4.1.0","POWERTOOLS_SERVICE_NAME":"deployment_metrics_custom_resource","POWERTOOLS_LOG_LEVEL":"INFO","POWERTOOLS_LOGGER_LOG_EVENT":"false","POWERTOOLS_TRACER_CAPTURE_RESPONSE":"true","POWERTOOLS_TRACER_CAPTURE_ERROR":"true","AWS_ACCOUNT_ID":{"Ref":"AWS::AccountId"},"STACK_ID":{"Ref":"AWS::StackId"}}},"Handler":"deployment_metrics_custom_resource.lambda_handler","Layers":[{"Ref":"ASRLambdaLayerDAD507E4"}],"LoggingConfig":{"LogGroup":{"Ref":"MetricResourcesASRDeploymentCustomResourceLambdaLogGroup9FC7DFE7"}},"MemorySize":256,"Role":{"Fn::GetAtt":["MetricResourcesMetricResourcesRoleC49ABA6D","Arn"]},"Runtime":"python3.11","Tags":[{"Key":"Solutions:SolutionID","Value":"SO0111"},{"Key":"Solutions:SolutionName","Value":"automated-security-response-on-aws"},{"Key":"Solutions:SolutionVersion","Value":"v4.1.0"}],"Timeout":5},"DependsOn":["MetricResourcesMetricResourcesRoleC49ABA6D"],"Metadata":{"guard":{"SuppressedRules":["LAMBDA_INSIDE_VPC","LAMBDA_CONCURRENCY_CHECK"]}}},"MetricResourcesASRDeploymentMetricsCustomResource0940D9B2":{"Type":"Custom::DeploymentMetrics","Properties":{"ServiceToken":{"Fn::GetAtt":["MetricResourcesASRDeploymentCustomResourceLambda02CE6550","Arn"]},"StackParameters":{"SecHubAdminAccount":{"Ref":"SecHubAdminAccount"},"Namespace":{"Ref":"Namespace"},"EnableCloudTrailForASRActionLog":{"Ref":"EnableCloudTrailForASRActionLog"},"CreateS3BucketForRedshiftAuditLogging":{"Ref":"CreateS3BucketForRedshiftAuditLogging"},"LogGroupName":{"Ref":"LogGroupName"},"LoadAFSBPMemberStack":{"Ref":"LoadAFSBPMemberStack"},"LoadCIS120MemberStack":{"Ref":"LoadCIS120MemberStack"},"LoadCIS140MemberStack":{"Ref":"LoadCIS140MemberStack"},"LoadNIST80053MemberStack":{"Ref":"LoadNIST80053MemberStack"},"LoadPCI321MemberStack":{"Ref":"LoadPCI321MemberStack"},"LoadCIS300MemberStack":{"Ref":"LoadCIS300MemberStack"},"LoadSCMemberStack":{"Ref":"LoadSCMemberStack"}},"Timestamp":"1791886497647","SecurityHubV2PolicyDependency":{"Fn::If":["IsCommercialPartition",{"Ref":"MetricResourcesMetricResourcesSecurityHubV2PolicyEF1A676B"},{"Ref":"AWS::NoValue"}]}},"UpdateReplacePolicy":"Delete","DeletionPolicy":"Delete"}},"Mappings":{"NestedStackFactorySourceCodeA11A36A7":{"General":{"S3Bucket":"solutions","KeyPrefix":"automated-security-response-on-aws/v4.1.0"}},"SourceCode":{"General":{"S3Bucket":"solutions","KeyPrefix":"automated-security-response-on-aws/v4.1.0"}}}}