{ "Description": "(SO0134) - The AWS CloudFormation template for deployment of the automations-for-aws-firewall-manager. Version v2.1.4", "AWSTemplateFormatVersion": "2010-09-09", "Metadata": { "AWS::CloudFormation::Interface": { "ParameterGroups": [ { "Label": { "default": "Do you want to generate compliance reports for your FMS policies?" }, "Parameters": [ "DeployComplianceGenerator" ] }, { "Label": { "default": "Do you want to receive error notifications by email?" }, "Parameters": [ "EmailAddress" ] } ], "ParameterLabels": { "DeployComplianceGenerator": { "default": "Compliance Reporting" }, "EmailAddress": { "default": "Email Address" } } } }, "Parameters": { "DeployComplianceGenerator": { "Type": "String", "Default": "Yes", "AllowedValues": [ "Yes", "No" ] }, "EmailAddress": { "Type": "String", "Default": "", "AllowedPattern": "^(?:\\S+@\\S+\\.\\S+)?$", "ConstraintDescription": "Email Address is invalid. Please ensure it is of the form example@example.com", "Description": "Email address to receive notifications regarding issues creating Firewall Manager policies.", "MaxLength": 150 } }, "Mappings": { "CommonResourceStackMap": { "Metric": { "SendAnonymizedMetric": "Yes", "MetricsEndpoint": "https://metrics.awssolutionsbuilder.com/generic" }, "Solution": { "SolutionId": "SO0134", "SolutionName": "automations-for-aws-firewall-manager", "SolutionVersion": "v2.1.4", "UserAgentPrefix": "AwsSolution" } }, "LatestNodeRuntimeMap": { "af-south-1": { "value": "nodejs22.x" }, "ap-east-1": { "value": "nodejs22.x" }, "ap-east-2": { "value": "nodejs22.x" }, "ap-northeast-1": { "value": "nodejs22.x" }, "ap-northeast-2": { "value": "nodejs22.x" }, "ap-northeast-3": { "value": "nodejs22.x" }, "ap-south-1": { "value": "nodejs22.x" }, "ap-south-2": { "value": "nodejs22.x" }, "ap-southeast-1": { "value": "nodejs22.x" }, "ap-southeast-2": { "value": "nodejs22.x" }, "ap-southeast-3": { "value": "nodejs22.x" }, "ap-southeast-4": { "value": "nodejs22.x" }, "ap-southeast-5": { "value": "nodejs22.x" }, "ap-southeast-6": { "value": "nodejs22.x" }, "ap-southeast-7": { "value": "nodejs22.x" }, "ca-central-1": { "value": "nodejs22.x" }, "ca-west-1": { "value": "nodejs22.x" }, "cn-north-1": { "value": "nodejs22.x" }, "cn-northwest-1": { "value": "nodejs22.x" }, "eu-central-1": { "value": "nodejs22.x" }, "eu-central-2": { "value": "nodejs22.x" }, "eu-isoe-west-1": { "value": "nodejs22.x" }, "eu-north-1": { "value": "nodejs22.x" }, "eu-south-1": { "value": "nodejs22.x" }, "eu-south-2": { "value": "nodejs22.x" }, "eu-west-1": { "value": "nodejs22.x" }, "eu-west-2": { "value": "nodejs22.x" }, "eu-west-3": { "value": "nodejs22.x" }, "eusc-de-east-1": { "value": "nodejs22.x" }, "il-central-1": { "value": "nodejs22.x" }, "me-central-1": { "value": "nodejs22.x" }, "me-south-1": { "value": "nodejs22.x" }, "mx-central-1": { "value": "nodejs22.x" }, "sa-east-1": { "value": "nodejs22.x" }, "us-east-1": { "value": "nodejs22.x" }, "us-east-2": { "value": "nodejs22.x" }, "us-gov-east-1": { "value": "nodejs22.x" }, "us-gov-west-1": { "value": "nodejs22.x" }, "us-iso-east-1": { "value": "nodejs22.x" }, "us-iso-west-1": { "value": "nodejs22.x" }, "us-isob-east-1": { "value": "nodejs18.x" }, "us-isob-west-1": { "value": "nodejs18.x" }, "us-isof-east-1": { "value": "nodejs22.x" }, "us-isof-south-1": { "value": "nodejs22.x" }, "us-west-1": { "value": "nodejs22.x" }, "us-west-2": { "value": "nodejs22.x" } } }, "Conditions": { "reportingCheck": { "Fn::Equals": [ { "Ref": "DeployComplianceGenerator" }, "Yes" ] } }, "Resources": { "AFMUtilsLayerAFMUtilsLayerLayerB9CC38B4": { "Type": "AWS::Lambda::LayerVersion", "Properties": { "CompatibleRuntimes": [ "nodejs22.x" ], "Content": { "S3Bucket": { "Fn::Sub": "solutions-${AWS::Region}" }, "S3Key": "automations-for-aws-firewall-manager/v2.1.4/asset7be93b6c0ec014c96d856a4450cde0aa9740ecb359bc80295f9c57410cc0dc5c.zip" }, "LayerName": "AFM-UtilsLayer" }, "Metadata": { "aws:cdk:path": "CommonResourceStack/AFM-UtilsLayer/AFM-UtilsLayer-Layer/Resource", "aws:asset:path": "asset.7be93b6c0ec014c96d856a4450cde0aa9740ecb359bc80295f9c57410cc0dc5c.zip", "aws:asset:is-bundled": false, "aws:asset:property": "Content" } }, "HelperFunctionServiceRole6B43B152": { "Type": "AWS::IAM::Role", "Properties": { "AssumeRolePolicyDocument": { "Statement": [ { "Action": "sts:AssumeRole", "Effect": "Allow", "Principal": { "Service": "lambda.amazonaws.com" } } ], "Version": "2012-10-17" }, "ManagedPolicyArns": [ { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":iam::aws:policy/service-role/AWSLambdaBasicExecutionRole" ] ] } ] }, "Metadata": { "aws:cdk:path": "CommonResourceStack/HelperFunction/ServiceRole/Resource" } }, "HelperFunctionAD0CEB0C": { "Type": "AWS::Lambda::Function", "Properties": { "Code": { "S3Bucket": { "Fn::Sub": "solutions-${AWS::Region}" }, "S3Key": "automations-for-aws-firewall-manager/v2.1.4/asset852fd50470d347d6a7b8e31621ee885a742066ca057398823cc5f0f4c3566120.zip" }, "Description": { "Fn::Join": [ "", [ { "Fn::FindInMap": [ "CommonResourceStackMap", "Solution", "SolutionId" ] }, " - Function to help with FMS solution installation (DO NOT DELETE)" ] ] }, "Environment": { "Variables": { "METRICS_ENDPOINT": { "Fn::FindInMap": [ "CommonResourceStackMap", "Metric", "MetricsEndpoint" ] }, "SEND_METRIC": { "Fn::FindInMap": [ "CommonResourceStackMap", "Metric", "SendAnonymizedMetric" ] }, "LOG_LEVEL": "info", "USER_AGENT_PREFIX": { "Fn::FindInMap": [ "CommonResourceStackMap", "Solution", "UserAgentPrefix" ] }, "SOLUTION_NAME": { "Fn::FindInMap": [ "CommonResourceStackMap", "Solution", "SolutionName" ] }, "SOLUTION_VERSION": { "Fn::FindInMap": [ "CommonResourceStackMap", "Solution", "SolutionVersion" ] }, "SOLUTION_ID": { "Fn::FindInMap": [ "CommonResourceStackMap", "Solution", "SolutionId" ] }, "SERVICE_NAME": { "Fn::FindInMap": [ "CommonResourceStackMap", "Solution", "SolutionName" ] } } }, "Handler": "index.handler", "Layers": [ { "Ref": "AFMUtilsLayerAFMUtilsLayerLayerB9CC38B4" } ], "MemorySize": 512, "Role": { "Fn::GetAtt": [ "HelperFunctionServiceRole6B43B152", "Arn" ] }, "Runtime": "nodejs22.x" }, "DependsOn": [ "HelperFunctionServiceRole6B43B152" ], "Metadata": { "cfn_nag": { "rules_to_suppress": [ { "id": "W58", "reason": "CloudWatch logs write permissions added with managed role AWSLambdaBasicExecutionRole" }, { "id": "W89", "reason": "Not a valid use case for Lambda functions to be deployed inside a VPC" }, { "id": "W92", "reason": "Lambda ReservedConcurrentExecutions not needed" } ] } } }, "HelperProviderframeworkonEventServiceRole1962DD43": { "Type": "AWS::IAM::Role", "Properties": { "AssumeRolePolicyDocument": { "Statement": [ { "Action": "sts:AssumeRole", "Effect": "Allow", "Principal": { "Service": "lambda.amazonaws.com" } } ], "Version": "2012-10-17" }, "ManagedPolicyArns": [ { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":iam::aws:policy/service-role/AWSLambdaBasicExecutionRole" ] ] } ] }, "Metadata": { "aws:cdk:path": "CommonResourceStack/HelperProvider/framework-onEvent/ServiceRole/Resource" } }, "HelperProviderframeworkonEventServiceRoleDefaultPolicy7C54367B": { "Type": "AWS::IAM::Policy", "Properties": { "PolicyDocument": { "Statement": [ { "Action": "lambda:InvokeFunction", "Effect": "Allow", "Resource": [ { "Fn::GetAtt": [ "HelperFunctionAD0CEB0C", "Arn" ] }, { "Fn::Join": [ "", [ { "Fn::GetAtt": [ "HelperFunctionAD0CEB0C", "Arn" ] }, ":*" ] ] } ] }, { "Action": "lambda:GetFunction", "Effect": "Allow", "Resource": { "Fn::GetAtt": [ "HelperFunctionAD0CEB0C", "Arn" ] } } ], "Version": "2012-10-17" }, "PolicyName": "HelperProviderframeworkonEventServiceRoleDefaultPolicy7C54367B", "Roles": [ { "Ref": "HelperProviderframeworkonEventServiceRole1962DD43" } ] }, "Metadata": { "aws:cdk:path": "CommonResourceStack/HelperProvider/framework-onEvent/ServiceRole/DefaultPolicy/Resource" } }, "HelperProviderframeworkonEvent1079DE9D": { "Type": "AWS::Lambda::Function", "Properties": { "Code": { "S3Bucket": { "Fn::Sub": "solutions-${AWS::Region}" }, "S3Key": "automations-for-aws-firewall-manager/v2.1.4/assetbdc104ed9cab1b5b6421713c8155f0b753380595356f710400609664d3635eca.zip" }, "Description": "AWS CDK resource provider framework - onEvent (CommonResourceStack/HelperProvider)", "Environment": { "Variables": { "USER_ON_EVENT_FUNCTION_ARN": { "Fn::GetAtt": [ "HelperFunctionAD0CEB0C", "Arn" ] } } }, "Handler": "framework.onEvent", "LoggingConfig": { "ApplicationLogLevel": "FATAL", "LogFormat": "JSON" }, "Role": { "Fn::GetAtt": [ "HelperProviderframeworkonEventServiceRole1962DD43", "Arn" ] }, "Runtime": { "Fn::FindInMap": [ "LatestNodeRuntimeMap", { "Ref": "AWS::Region" }, "value" ] }, "Timeout": 900 }, "DependsOn": [ "HelperProviderframeworkonEventServiceRoleDefaultPolicy7C54367B", "HelperProviderframeworkonEventServiceRole1962DD43" ], "Metadata": { "cfn_nag": { "rules_to_suppress": [ { "id": "W58", "reason": "CloudWatch logs write permissions added with managed role AWSLambdaBasicExecutionRole" }, { "id": "W89", "reason": "Not a valid use case for Lambda functions to be deployed inside a VPC" }, { "id": "W92", "reason": "Lambda ReservedConcurrentExecutions not needed" } ] } } }, "CreateUUID": { "Type": "Custom::CreateUUID", "Properties": { "ServiceToken": { "Fn::GetAtt": [ "HelperProviderframeworkonEvent1079DE9D", "Arn" ] } }, "UpdateReplacePolicy": "Delete", "DeletionPolicy": "Delete", "Metadata": { "aws:cdk:path": "CommonResourceStack/CreateUUID/Default" } }, "FMSAdminCheck": { "Type": "Custom::FMSAdminCheck", "Properties": { "ServiceToken": { "Fn::GetAtt": [ "HelperProviderframeworkonEvent1079DE9D", "Arn" ] }, "Stack": "FMSStack", "Account": { "Ref": "AWS::AccountId" }, "Region": { "Ref": "AWS::Region" } }, "UpdateReplacePolicy": "Delete", "DeletionPolicy": "Delete", "Metadata": { "aws:cdk:path": "CommonResourceStack/FMSAdminCheck/Default" } }, "FMSTable84B8646C": { "Type": "AWS::DynamoDB::Table", "Properties": { "AttributeDefinitions": [ { "AttributeName": "PolicyName", "AttributeType": "S" }, { "AttributeName": "Region", "AttributeType": "S" } ], "BillingMode": "PAY_PER_REQUEST", "KeySchema": [ { "AttributeName": "PolicyName", "KeyType": "HASH" }, { "AttributeName": "Region", "KeyType": "RANGE" } ], "PointInTimeRecoverySpecification": { "PointInTimeRecoveryEnabled": true }, "SSESpecification": { "SSEEnabled": true } }, "UpdateReplacePolicy": "Delete", "DeletionPolicy": "Delete", "Metadata": { "guard": { "SuppressedRules": [ "DYNAMODB_TABLE_ENCRYPTED_KMS" ], "Reason": "DynamoDB Table encrypted using AWS Managed encryption" } } }, "HelperPolicy0FF3AEE0": { "Type": "AWS::IAM::Policy", "Properties": { "PolicyDocument": { "Statement": [ { "Action": "fms:GetAdminAccount", "Effect": "Allow", "Resource": "*", "Sid": "FMSRead" } ], "Version": "2012-10-17" }, "PolicyName": "FMS-Helper-Policy", "Roles": [ { "Ref": "HelperFunctionServiceRole6B43B152" } ] }, "Metadata": { "cfn_nag": { "rules_to_suppress": [ { "id": "W12", "reason": "Resource * is required for IAM actions that do not support resource level permissions" } ] } } }, "ComplianceStack": { "Type": "AWS::CloudFormation::Stack", "Properties": { "Parameters": { "UUID": { "Fn::GetAtt": [ "CreateUUID", "UUID" ] } }, "TemplateURL": "https://solutions-reference.s3.amazonaws.com/automations-for-aws-firewall-manager/v2.1.4/aws-fms-compliance.template" }, "UpdateReplacePolicy": "Delete", "DeletionPolicy": "Delete", "Metadata": { "aws:cdk:path": "CommonResourceStack/ComplianceGeneratorStack.NestedStack/ComplianceGeneratorStack.NestedStackResource", "aws:asset:path": "CommonResourceStackComplianceGeneratorStack932DA860.nested.template.json", "aws:asset:property": "TemplateURL" }, "Condition": "reportingCheck" }, "PolicyStack": { "Type": "AWS::CloudFormation::Stack", "Properties": { "Parameters": { "PolicyTable": { "Ref": "FMSTable84B8646C" }, "UUID": { "Fn::GetAtt": [ "CreateUUID", "UUID" ] }, "PolicyIdentifier": "DefaultPolicy", "EmailAddress": { "Ref": "EmailAddress" } }, "TemplateURL": "https://solutions-reference.s3.amazonaws.com/automations-for-aws-firewall-manager/v2.1.4/aws-fms-policy.template" }, "UpdateReplacePolicy": "Delete", "DeletionPolicy": "Delete", "Metadata": { "aws:cdk:path": "CommonResourceStack/PolicyStack-DefaultPolicy.NestedStack/PolicyStack-DefaultPolicy.NestedStackResource", "aws:asset:path": "CommonResourceStackPolicyStackDefaultPolicyD16A0B88.nested.template.json", "aws:asset:property": "TemplateURL" } } }, "Outputs": { "UUID": { "Description": "UUID for deployment", "Value": { "Fn::GetAtt": [ "CreateUUID", "UUID" ] } }, "PolicyTable": { "Description": "Table for FMS policies metadata", "Value": { "Ref": "FMSTable84B8646C" } }, "ComplianceReporting": { "Description": "Generate compliance reports on FMS policies", "Value": { "Ref": "DeployComplianceGenerator" } } } }