{ "Description": "(SO0134-po) - The AWS CloudFormation template for deployment of the automations-for-aws-firewall-manager. Version v2.1.4", "AWSTemplateFormatVersion": "2010-09-09", "Metadata": { "AWS::CloudFormation::Interface": { "ParameterGroups": [ { "Label": { "default": "Policy Configuration" }, "Parameters": [ "PolicyIdentifier", "EmailAddress" ] }, { "Label": { "default": "Shared Resource Configurations" }, "Parameters": [ "PolicyTable", "UUID" ] } ], "ParameterLabels": { "PolicyTable": { "default": "Policy Table" }, "UUID": { "default": "UUID" }, "PolicyIdentifier": { "default": "Policy Identifier" }, "EmailAddress": { "default": "SNS Topic Email Address" } } } }, "Parameters": { "PolicyTable": { "Type": "String", "Description": "DynamoDB table for policy metadata" }, "UUID": { "Type": "String", "Description": "UUID for primary stack deployment" }, "PolicyIdentifier": { "Type": "String", "Description": "A unique string identifier for the policies" }, "EmailAddress": { "Type": "String", "Description": "Email address to receive notifications regarding problems deploying Firewall Manager policies." } }, "Mappings": { "PolicyStackMap": { "Metric": { "SendAnonymizedMetric": "Yes", "MetricsEndpoint": "https://metrics.awssolutionsbuilder.com/generic" }, "Solution": { "SolutionId": "SO0134", "SolutionVersion": "v2.1.4", "UserAgentPrefix": "AwsSolution" }, "PolicyManager": { "ServiceName": "FMS-PolicyManager", "SNSTopicName": "FMS-PolicyManager-Notifications" } }, "LatestNodeRuntimeMap": { "af-south-1": { "value": "nodejs22.x" }, "ap-east-1": { "value": "nodejs22.x" }, "ap-east-2": { "value": "nodejs22.x" }, "ap-northeast-1": { "value": "nodejs22.x" }, "ap-northeast-2": { "value": "nodejs22.x" }, "ap-northeast-3": { "value": "nodejs22.x" }, "ap-south-1": { "value": "nodejs22.x" }, "ap-south-2": { "value": "nodejs22.x" }, "ap-southeast-1": { "value": "nodejs22.x" }, "ap-southeast-2": { "value": "nodejs22.x" }, "ap-southeast-3": { "value": "nodejs22.x" }, "ap-southeast-4": { "value": "nodejs22.x" }, "ap-southeast-5": { "value": "nodejs22.x" }, "ap-southeast-6": { "value": "nodejs22.x" }, "ap-southeast-7": { "value": "nodejs22.x" }, "ca-central-1": { "value": "nodejs22.x" }, "ca-west-1": { "value": "nodejs22.x" }, "cn-north-1": { "value": "nodejs22.x" }, "cn-northwest-1": { "value": "nodejs22.x" }, "eu-central-1": { "value": "nodejs22.x" }, "eu-central-2": { "value": "nodejs22.x" }, "eu-isoe-west-1": { "value": "nodejs22.x" }, "eu-north-1": { "value": "nodejs22.x" }, "eu-south-1": { "value": "nodejs22.x" }, "eu-south-2": { "value": "nodejs22.x" }, "eu-west-1": { "value": "nodejs22.x" }, "eu-west-2": { "value": "nodejs22.x" }, "eu-west-3": { "value": "nodejs22.x" }, "eusc-de-east-1": { "value": "nodejs22.x" }, "il-central-1": { "value": "nodejs22.x" }, "me-central-1": { "value": "nodejs22.x" }, "me-south-1": { "value": "nodejs22.x" }, "mx-central-1": { "value": "nodejs22.x" }, "sa-east-1": { "value": "nodejs22.x" }, "us-east-1": { "value": "nodejs22.x" }, "us-east-2": { "value": "nodejs22.x" }, "us-gov-east-1": { "value": "nodejs22.x" }, "us-gov-west-1": { "value": "nodejs22.x" }, "us-iso-east-1": { "value": "nodejs22.x" }, "us-iso-west-1": { "value": "nodejs22.x" }, "us-isob-east-1": { "value": "nodejs18.x" }, "us-isob-west-1": { "value": "nodejs18.x" }, "us-isof-east-1": { "value": "nodejs22.x" }, "us-isof-south-1": { "value": "nodejs22.x" }, "us-west-1": { "value": "nodejs22.x" }, "us-west-2": { "value": "nodejs22.x" } } }, "Conditions": { "emailAddressExists": { "Fn::Not": [ { "Fn::Equals": [ { "Ref": "EmailAddress" }, "" ] } ] }, "CDKMetadataAvailable": { "Fn::Or": [ { "Fn::Or": [ { "Fn::Equals": [ { "Ref": "AWS::Region" }, "af-south-1" ] }, { "Fn::Equals": [ { "Ref": "AWS::Region" }, "ap-east-1" ] }, { "Fn::Equals": [ { "Ref": "AWS::Region" }, "ap-northeast-1" ] }, { "Fn::Equals": [ { "Ref": "AWS::Region" }, "ap-northeast-2" ] }, { "Fn::Equals": [ { "Ref": "AWS::Region" }, "ap-northeast-3" ] }, { "Fn::Equals": [ { "Ref": "AWS::Region" }, "ap-south-1" ] }, { "Fn::Equals": [ { "Ref": "AWS::Region" }, "ap-south-2" ] }, { "Fn::Equals": [ { "Ref": "AWS::Region" }, "ap-southeast-1" ] }, { "Fn::Equals": [ { "Ref": "AWS::Region" }, "ap-southeast-2" ] }, { "Fn::Equals": [ { "Ref": "AWS::Region" }, "ap-southeast-3" ] } ] }, { "Fn::Or": [ { "Fn::Equals": [ { "Ref": "AWS::Region" }, "ap-southeast-4" ] }, { "Fn::Equals": [ { "Ref": "AWS::Region" }, "ca-central-1" ] }, { "Fn::Equals": [ { "Ref": "AWS::Region" }, "ca-west-1" ] }, { "Fn::Equals": [ { "Ref": "AWS::Region" }, "cn-north-1" ] }, { "Fn::Equals": [ { "Ref": "AWS::Region" }, "cn-northwest-1" ] }, { "Fn::Equals": [ { "Ref": "AWS::Region" }, "eu-central-1" ] }, { "Fn::Equals": [ { "Ref": "AWS::Region" }, "eu-central-2" ] }, { "Fn::Equals": [ { "Ref": "AWS::Region" }, "eu-north-1" ] }, { "Fn::Equals": [ { "Ref": "AWS::Region" }, "eu-south-1" ] }, { "Fn::Equals": [ { "Ref": "AWS::Region" }, "eu-south-2" ] } ] }, { "Fn::Or": [ { "Fn::Equals": [ { "Ref": "AWS::Region" }, "eu-west-1" ] }, { "Fn::Equals": [ { "Ref": "AWS::Region" }, "eu-west-2" ] }, { "Fn::Equals": [ { "Ref": "AWS::Region" }, "eu-west-3" ] }, { "Fn::Equals": [ { "Ref": "AWS::Region" }, "il-central-1" ] }, { "Fn::Equals": [ { "Ref": "AWS::Region" }, "me-central-1" ] }, { "Fn::Equals": [ { "Ref": "AWS::Region" }, "me-south-1" ] }, { "Fn::Equals": [ { "Ref": "AWS::Region" }, "sa-east-1" ] }, { "Fn::Equals": [ { "Ref": "AWS::Region" }, "us-east-1" ] }, { "Fn::Equals": [ { "Ref": "AWS::Region" }, "us-east-2" ] }, { "Fn::Equals": [ { "Ref": "AWS::Region" }, "us-west-1" ] } ] }, { "Fn::Equals": [ { "Ref": "AWS::Region" }, "us-west-2" ] } ] } }, "Resources": { "AFMUtilsLayerAFMUtilsLayerLayerB9CC38B4": { "Type": "AWS::Lambda::LayerVersion", "Properties": { "CompatibleRuntimes": [ "nodejs22.x" ], "Content": { "S3Bucket": { "Fn::Sub": "solutions-${AWS::Region}" }, "S3Key": "automations-for-aws-firewall-manager/v2.1.4/asset7be93b6c0ec014c96d856a4450cde0aa9740ecb359bc80295f9c57410cc0dc5c.zip" }, "LayerName": "AFM-UtilsLayer" }, "Metadata": { "aws:cdk:path": "CommonResourceStack/PolicyStack-DefaultPolicy/AFM-UtilsLayer/AFM-UtilsLayer-Layer/Resource", "aws:asset:path": "asset.7be93b6c0ec014c96d856a4450cde0aa9740ecb359bc80295f9c57410cc0dc5c.zip", "aws:asset:is-bundled": false, "aws:asset:property": "Content" } }, "FMSOUs9CEEEC1C": { "Type": "AWS::SSM::Parameter", "Properties": { "Description": "FMS parameter store for OUs", "Name": { "Fn::Join": [ "", [ "/FMS/", { "Ref": "PolicyIdentifier" }, "/OUs" ] ] }, "Type": "StringList", "Value": "NOP" }, "Metadata": { "aws:cdk:path": "CommonResourceStack/PolicyStack-DefaultPolicy/FMSOUs/Resource" } }, "FMSTags216E0D22": { "Type": "AWS::SSM::Parameter", "Properties": { "Description": "fms parameter for fms tags", "Name": { "Fn::Join": [ "", [ "/FMS/", { "Ref": "PolicyIdentifier" }, "/Tags" ] ] }, "Type": "String", "Value": "NOP" }, "Metadata": { "aws:cdk:path": "CommonResourceStack/PolicyStack-DefaultPolicy/FMSTags/Resource" } }, "FMSRegions39DF213B": { "Type": "AWS::SSM::Parameter", "Properties": { "Description": "fms parameter for fms regions", "Name": { "Fn::Join": [ "", [ "/FMS/", { "Ref": "PolicyIdentifier" }, "/Regions" ] ] }, "Type": "StringList", "Value": "NOP" }, "Metadata": { "aws:cdk:path": "CommonResourceStack/PolicyStack-DefaultPolicy/FMSRegions/Resource" } }, "AccessLogsBucket83982689": { "Type": "AWS::S3::Bucket", "Properties": { "BucketEncryption": { "ServerSideEncryptionConfiguration": [ { "ServerSideEncryptionByDefault": { "SSEAlgorithm": "AES256" } } ] }, "LifecycleConfiguration": { "Rules": [ { "ExpirationInDays": 730, "Status": "Enabled", "Transitions": [ { "StorageClass": "STANDARD_IA", "TransitionInDays": 30 }, { "StorageClass": "GLACIER", "TransitionInDays": 90 } ] } ] }, "PublicAccessBlockConfiguration": { "BlockPublicAcls": true, "BlockPublicPolicy": true, "IgnorePublicAcls": true, "RestrictPublicBuckets": true }, "VersioningConfiguration": { "Status": "Enabled" } }, "UpdateReplacePolicy": "Retain", "DeletionPolicy": "Retain", "Metadata": { "cfn_nag": { "rules_to_suppress": [ { "id": "W35", "reason": "access logging disabled, its a logging bucket" }, { "id": "W51", "reason": "permission given for log delivery" } ] }, "guard": { "SuppressedRules": [ "S3_BUCKET_NO_PUBLIC_RW_ACL" ], "Reason": "Public RW access is disabled by default" } } }, "AccessLogsBucketPolicy7F77476F": { "Type": "AWS::S3::BucketPolicy", "Properties": { "Bucket": { "Ref": "AccessLogsBucket83982689" }, "PolicyDocument": { "Statement": [ { "Action": "s3:*", "Condition": { "Bool": { "aws:SecureTransport": "false" } }, "Effect": "Deny", "Principal": { "AWS": "*" }, "Resource": [ { "Fn::GetAtt": [ "AccessLogsBucket83982689", "Arn" ] }, { "Fn::Join": [ "", [ { "Fn::GetAtt": [ "AccessLogsBucket83982689", "Arn" ] }, "/*" ] ] } ] }, { "Action": "s3:PutObject", "Condition": { "ArnLike": { "aws:SourceArn": { "Fn::GetAtt": [ "ManifestBucket46C412A5", "Arn" ] } }, "StringEquals": { "aws:SourceAccount": { "Ref": "AWS::AccountId" } } }, "Effect": "Allow", "Principal": { "Service": "logging.s3.amazonaws.com" }, "Resource": { "Fn::Join": [ "", [ { "Fn::GetAtt": [ "AccessLogsBucket83982689", "Arn" ] }, "/*" ] ] } } ], "Version": "2012-10-17" } }, "Metadata": { "aws:cdk:path": "CommonResourceStack/PolicyStack-DefaultPolicy/AccessLogsBucket/Policy/Resource" } }, "ManifestBucket46C412A5": { "Type": "AWS::S3::Bucket", "Properties": { "BucketEncryption": { "ServerSideEncryptionConfiguration": [ { "ServerSideEncryptionByDefault": { "SSEAlgorithm": "AES256" } } ] }, "LoggingConfiguration": { "DestinationBucketName": { "Ref": "AccessLogsBucket83982689" } }, "PublicAccessBlockConfiguration": { "BlockPublicAcls": true, "BlockPublicPolicy": true, "IgnorePublicAcls": true, "RestrictPublicBuckets": true }, "VersioningConfiguration": { "Status": "Enabled" } }, "UpdateReplacePolicy": "Retain", "DeletionPolicy": "Retain", "Metadata": { "cfn_nag": { "rules_to_suppress": [ { "id": "W51", "reason": "permission given to lambda to get policy manifest" } ] }, "guard": { "SuppressedRules": [ "S3_BUCKET_NO_PUBLIC_RW_ACL" ], "Reason": "Public RW access is disabled by default" } } }, "ManifestBucketPolicy82948026": { "Type": "AWS::S3::BucketPolicy", "Properties": { "Bucket": { "Ref": "ManifestBucket46C412A5" }, "PolicyDocument": { "Statement": [ { "Action": "s3:*", "Condition": { "Bool": { "aws:SecureTransport": "false" } }, "Effect": "Deny", "Principal": { "AWS": "*" }, "Resource": [ { "Fn::GetAtt": [ "ManifestBucket46C412A5", "Arn" ] }, { "Fn::Join": [ "", [ { "Fn::GetAtt": [ "ManifestBucket46C412A5", "Arn" ] }, "/*" ] ] } ] } ], "Version": "2012-10-17" } }, "Metadata": { "aws:cdk:path": "CommonResourceStack/PolicyStack-DefaultPolicy/ManifestBucket/Policy/Resource" } }, "ManifestBucketNotifications10E973BE": { "Type": "Custom::S3BucketNotifications", "Properties": { "ServiceToken": { "Fn::GetAtt": [ "BucketNotificationsHandler050a0587b7544547bf325f094a3db8347ECC3691", "Arn" ] }, "BucketName": { "Ref": "ManifestBucket46C412A5" }, "NotificationConfiguration": { "EventBridgeConfiguration": {} }, "Managed": true, "SkipDestinationValidation": false }, "DependsOn": [ "ManifestBucketPolicy82948026" ], "Metadata": { "aws:cdk:path": "CommonResourceStack/PolicyStack-DefaultPolicy/ManifestBucket/Notifications/Resource" } }, "BucketNotificationsHandler050a0587b7544547bf325f094a3db834RoleB6FB88EC": { "Type": "AWS::IAM::Role", "Properties": { "AssumeRolePolicyDocument": { "Statement": [ { "Action": "sts:AssumeRole", "Effect": "Allow", "Principal": { "Service": "lambda.amazonaws.com" } } ], "Version": "2012-10-17" }, "ManagedPolicyArns": [ { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":iam::aws:policy/service-role/AWSLambdaBasicExecutionRole" ] ] } ] }, "Metadata": { "aws:cdk:path": "CommonResourceStack/PolicyStack-DefaultPolicy/BucketNotificationsHandler050a0587b7544547bf325f094a3db834/Role/Resource" } }, "BucketNotificationsHandler050a0587b7544547bf325f094a3db834RoleDefaultPolicy2CF63D36": { "Type": "AWS::IAM::Policy", "Properties": { "PolicyDocument": { "Statement": [ { "Action": "s3:PutBucketNotification", "Effect": "Allow", "Resource": { "Fn::GetAtt": [ "ManifestBucket46C412A5", "Arn" ] } } ], "Version": "2012-10-17" }, "PolicyName": "BucketNotificationsHandler050a0587b7544547bf325f094a3db834RoleDefaultPolicy2CF63D36", "Roles": [ { "Ref": "BucketNotificationsHandler050a0587b7544547bf325f094a3db834RoleB6FB88EC" } ] }, "Metadata": { "aws:cdk:path": "CommonResourceStack/PolicyStack-DefaultPolicy/BucketNotificationsHandler050a0587b7544547bf325f094a3db834/Role/DefaultPolicy/Resource" } }, "BucketNotificationsHandler050a0587b7544547bf325f094a3db8347ECC3691": { "Type": "AWS::Lambda::Function", "Properties": { "Description": "AWS CloudFormation handler for \"Custom::S3BucketNotifications\" resources (@aws-cdk/aws-s3)", "Code": { "ZipFile": "import boto3 # type: ignore\nimport json\nimport logging\nimport urllib.request\n\ns3 = boto3.client(\"s3\")\n\nEVENTBRIDGE_CONFIGURATION = 'EventBridgeConfiguration'\nCONFIGURATION_TYPES = [\"TopicConfigurations\", \"QueueConfigurations\", \"LambdaFunctionConfigurations\"]\n\ndef handler(event: dict, context):\n response_status = \"SUCCESS\"\n error_message = \"\"\n try:\n props = event[\"ResourceProperties\"]\n notification_configuration = props[\"NotificationConfiguration\"]\n managed = props.get('Managed', 'true').lower() == 'true'\n skipDestinationValidation = props.get('SkipDestinationValidation', 'false').lower() == 'true'\n stack_id = event['StackId']\n old = event.get(\"OldResourceProperties\", {}).get(\"NotificationConfiguration\", {})\n if managed:\n config = handle_managed(event[\"RequestType\"], notification_configuration)\n else:\n config = handle_unmanaged(props[\"BucketName\"], stack_id, event[\"RequestType\"], notification_configuration, old)\n s3.put_bucket_notification_configuration(Bucket=props[\"BucketName\"], NotificationConfiguration=config, SkipDestinationValidation=skipDestinationValidation)\n except Exception as e:\n logging.exception(\"Failed to put bucket notification configuration\")\n response_status = \"FAILED\"\n error_message = f\"Error: {str(e)}. \"\n finally:\n submit_response(event, context, response_status, error_message)\n\ndef handle_managed(request_type, notification_configuration):\n if request_type == 'Delete':\n return {}\n return notification_configuration\n\ndef handle_unmanaged(bucket, stack_id, request_type, notification_configuration, old):\n def get_id(n):\n n['Id'] = ''\n sorted_notifications = sort_filter_rules(n)\n strToHash=json.dumps(sorted_notifications, sort_keys=True).replace('\"Name\": \"prefix\"', '\"Name\": \"Prefix\"').replace('\"Name\": \"suffix\"', '\"Name\": \"Suffix\"')\n return f\"{stack_id}-{hash(strToHash)}\"\n def with_id(n):\n n['Id'] = get_id(n)\n return n\n\n external_notifications = {}\n existing_notifications = s3.get_bucket_notification_configuration(Bucket=bucket)\n for t in CONFIGURATION_TYPES:\n if request_type == 'Update':\n old_incoming_ids = [get_id(n) for n in old.get(t, [])]\n external_notifications[t] = [n for n in existing_notifications.get(t, []) if not get_id(n) in old_incoming_ids] \n elif request_type == 'Delete':\n external_notifications[t] = [n for n in existing_notifications.get(t, []) if not n['Id'].startswith(f\"{stack_id}-\")]\n elif request_type == 'Create':\n external_notifications[t] = [n for n in existing_notifications.get(t, [])]\n if EVENTBRIDGE_CONFIGURATION in existing_notifications:\n external_notifications[EVENTBRIDGE_CONFIGURATION] = existing_notifications[EVENTBRIDGE_CONFIGURATION]\n\n if request_type == 'Delete':\n return external_notifications\n\n notifications = {}\n for t in CONFIGURATION_TYPES:\n external = external_notifications.get(t, [])\n incoming = [with_id(n) for n in notification_configuration.get(t, [])]\n notifications[t] = external + incoming\n\n if EVENTBRIDGE_CONFIGURATION in notification_configuration:\n notifications[EVENTBRIDGE_CONFIGURATION] = notification_configuration[EVENTBRIDGE_CONFIGURATION]\n elif EVENTBRIDGE_CONFIGURATION in external_notifications:\n notifications[EVENTBRIDGE_CONFIGURATION] = external_notifications[EVENTBRIDGE_CONFIGURATION]\n\n return notifications\n\ndef submit_response(event: dict, context, response_status: str, error_message: str):\n response_body = json.dumps(\n {\n \"Status\": response_status,\n \"Reason\": f\"{error_message}See the details in CloudWatch Log Stream: {context.log_stream_name}\",\n \"PhysicalResourceId\": event.get(\"PhysicalResourceId\") or event[\"LogicalResourceId\"],\n \"StackId\": event[\"StackId\"],\n \"RequestId\": event[\"RequestId\"],\n \"LogicalResourceId\": event[\"LogicalResourceId\"],\n \"NoEcho\": False,\n }\n ).encode(\"utf-8\")\n headers = {\"content-type\": \"\", \"content-length\": str(len(response_body))}\n try:\n req = urllib.request.Request(url=event[\"ResponseURL\"], headers=headers, data=response_body, method=\"PUT\")\n with urllib.request.urlopen(req) as response:\n print(response.read().decode(\"utf-8\"))\n print(\"Status code: \" + response.reason)\n except Exception as e:\n print(\"send(..) failed executing request.urlopen(..): \" + str(e))\n\ndef sort_filter_rules(json_obj):\n if not isinstance(json_obj, dict):\n return json_obj\n for key, value in json_obj.items():\n if isinstance(value, dict):\n json_obj[key] = sort_filter_rules(value)\n elif isinstance(value, list):\n json_obj[key] = [sort_filter_rules(item) for item in value]\n if \"Filter\" in json_obj and \"Key\" in json_obj[\"Filter\"] and \"FilterRules\" in json_obj[\"Filter\"][\"Key\"]:\n filter_rules = json_obj[\"Filter\"][\"Key\"][\"FilterRules\"]\n sorted_filter_rules = sorted(filter_rules, key=lambda x: x[\"Name\"])\n json_obj[\"Filter\"][\"Key\"][\"FilterRules\"] = sorted_filter_rules\n return json_obj" }, "Handler": "index.handler", "Role": { "Fn::GetAtt": [ "BucketNotificationsHandler050a0587b7544547bf325f094a3db834RoleB6FB88EC", "Arn" ] }, "Runtime": "python3.13", "Timeout": 300 }, "DependsOn": [ "BucketNotificationsHandler050a0587b7544547bf325f094a3db834RoleDefaultPolicy2CF63D36", "BucketNotificationsHandler050a0587b7544547bf325f094a3db834RoleB6FB88EC" ], "Metadata": { "aws:cdk:path": "CommonResourceStack/PolicyStack-DefaultPolicy/BucketNotificationsHandler050a0587b7544547bf325f094a3db834/Resource", "guard": { "SuppressedRules": [ "LAMBDA_INSIDE_VPC", "LAMBDA_CONCURRENCY_CHECK" ] } } }, "CopyManifest652A9A13": { "Type": "Custom::AWS", "Properties": { "ServiceToken": { "Fn::GetAtt": [ "AWS679f53fac002430cb0da5b7982bd22872D164C4C", "Arn" ] }, "Create": { "Fn::Join": [ "", [ "{\"service\":\"S3\",\"action\":\"copyObject\",\"parameters\":{\"Bucket\":\"", { "Ref": "ManifestBucket46C412A5" }, "\",\"CopySource\":\"solutions-", { "Ref": "AWS::Region" }, "/automations-for-aws-firewall-manager/v2.1.4/policy_manifest.json\",\"Key\":\"policy_manifest.json\"},\"physicalResourceId\":{\"id\":\"1759142476889\"}}" ] ] }, "InstallLatestAwsSdk": false }, "DependsOn": [ "CopyManifestCustomResourcePolicy37D7914D" ], "UpdateReplacePolicy": "Delete", "DeletionPolicy": "Delete", "Metadata": { "aws:cdk:path": "CommonResourceStack/PolicyStack-DefaultPolicy/CopyManifest/Resource/Default" } }, "CopyManifestCustomResourcePolicy37D7914D": { "Type": "AWS::IAM::Policy", "Properties": { "PolicyDocument": { "Statement": [ { "Action": "s3:GetObject", "Effect": "Allow", "Resource": { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":s3:::solutions-", { "Ref": "AWS::Region" }, "/*" ] ] }, "Sid": "S3Get" }, { "Action": "s3:PutObject", "Effect": "Allow", "Resource": { "Fn::Join": [ "", [ { "Fn::GetAtt": [ "ManifestBucket46C412A5", "Arn" ] }, "/*" ] ] }, "Sid": "S3Put" } ], "Version": "2012-10-17" }, "PolicyName": "CopyManifestCustomResourcePolicy37D7914D", "Roles": [ { "Ref": "AWS679f53fac002430cb0da5b7982bd2287ServiceRoleC1EA0FF2" } ] }, "Metadata": { "aws:cdk:path": "CommonResourceStack/PolicyStack-DefaultPolicy/CopyManifest/CustomResourcePolicy/Resource" } }, "AWS679f53fac002430cb0da5b7982bd2287ServiceRoleC1EA0FF2": { "Type": "AWS::IAM::Role", "Properties": { "AssumeRolePolicyDocument": { "Statement": [ { "Action": "sts:AssumeRole", "Effect": "Allow", "Principal": { "Service": "lambda.amazonaws.com" } } ], "Version": "2012-10-17" }, "ManagedPolicyArns": [ { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":iam::aws:policy/service-role/AWSLambdaBasicExecutionRole" ] ] } ] }, "Metadata": { "aws:cdk:path": "CommonResourceStack/PolicyStack-DefaultPolicy/AWS679f53fac002430cb0da5b7982bd2287/ServiceRole/Resource" } }, "AWS679f53fac002430cb0da5b7982bd22872D164C4C": { "Type": "AWS::Lambda::Function", "Properties": { "Code": { "S3Bucket": { "Fn::Sub": "solutions-${AWS::Region}" }, "S3Key": "automations-for-aws-firewall-manager/v2.1.4/asset34a66902956b031404ef497526f619b900363fe7fd65ff02b1de4c30fe10c034.zip" }, "Handler": "index.handler", "Role": { "Fn::GetAtt": [ "AWS679f53fac002430cb0da5b7982bd2287ServiceRoleC1EA0FF2", "Arn" ] }, "Runtime": { "Fn::FindInMap": [ "LatestNodeRuntimeMap", { "Ref": "AWS::Region" }, "value" ] }, "Timeout": 120 }, "DependsOn": [ "AWS679f53fac002430cb0da5b7982bd2287ServiceRoleC1EA0FF2" ], "Metadata": { "aws:cdk:path": "CommonResourceStack/PolicyStack-DefaultPolicy/AWS679f53fac002430cb0da5b7982bd2287/Resource", "aws:asset:path": "asset.34a66902956b031404ef497526f619b900363fe7fd65ff02b1de4c30fe10c034", "aws:asset:is-bundled": false, "aws:asset:property": "Code", "guard": { "SuppressedRules": [ "LAMBDA_INSIDE_VPC", "LAMBDA_CONCURRENCY_CHECK" ] } } }, "DLQ581697C4": { "Type": "AWS::SQS::Queue", "Properties": { "KmsMasterKeyId": "alias/aws/sqs" }, "UpdateReplacePolicy": "Delete", "DeletionPolicy": "Delete", "Metadata": { "aws:cdk:path": "CommonResourceStack/PolicyStack-DefaultPolicy/DLQConstruct/DLQ/Resource" } }, "DLQConstructQueuePolicyD24D92D7": { "Type": "AWS::SQS::QueuePolicy", "Properties": { "PolicyDocument": { "Statement": [ { "Action": "sqs:*", "Condition": { "Bool": { "aws:SecureTransport": "false" } }, "Effect": "Deny", "Principal": { "AWS": "*" }, "Resource": { "Fn::GetAtt": [ "DLQ581697C4", "Arn" ] }, "Sid": "AllowPublishThroughSSLOnly" } ], "Version": "2012-10-17" }, "Queues": [ { "Ref": "DLQ581697C4" } ] }, "Metadata": { "aws:cdk:path": "CommonResourceStack/PolicyStack-DefaultPolicy/DLQConstruct/QueuePolicy/Resource" } }, "PolicyManagerTopicF9775E18": { "Type": "AWS::SNS::Topic", "Properties": { "DisplayName": "FMS Policy Manager Topic", "KmsMasterKeyId": { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":kms:", { "Ref": "AWS::Region" }, ":", { "Ref": "AWS::AccountId" }, ":alias/aws/sns" ] ] }, "TopicName": { "Fn::FindInMap": [ "PolicyStackMap", "PolicyManager", "SNSTopicName" ] }, "TracingConfig": "Active" }, "Metadata": { "aws:cdk:path": "CommonResourceStack/PolicyStack-DefaultPolicy/PolicyManagerTopic/Resource" } }, "PolicyManagerTopicPolicyF0149DF3": { "Type": "AWS::SNS::TopicPolicy", "Properties": { "PolicyDocument": { "Statement": [ { "Action": "sns:Publish", "Condition": { "Bool": { "aws:SecureTransport": "false" } }, "Effect": "Deny", "Principal": "*", "Resource": { "Ref": "PolicyManagerTopicF9775E18" }, "Sid": "AllowPublishThroughSSLOnly" } ], "Version": "2012-10-17" }, "Topics": [ { "Ref": "PolicyManagerTopicF9775E18" } ] }, "Metadata": { "aws:cdk:path": "CommonResourceStack/PolicyStack-DefaultPolicy/PolicyManagerTopic/Policy/Resource" } }, "PolicyManagerTopicTokenSubscription15601D352": { "Type": "AWS::SNS::Subscription", "Properties": { "Endpoint": { "Ref": "EmailAddress" }, "Protocol": "email", "TopicArn": { "Ref": "PolicyManagerTopicF9775E18" } }, "Metadata": { "aws:cdk:path": "CommonResourceStack/PolicyStack-DefaultPolicy/PolicyManagerTopic/TokenSubscription:1/Resource" }, "Condition": "emailAddressExists" }, "PolicyManagerServiceRoleC35CBD54": { "Type": "AWS::IAM::Role", "Properties": { "AssumeRolePolicyDocument": { "Statement": [ { "Action": "sts:AssumeRole", "Effect": "Allow", "Principal": { "Service": "lambda.amazonaws.com" } } ], "Version": "2012-10-17" }, "ManagedPolicyArns": [ { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":iam::aws:policy/service-role/AWSLambdaBasicExecutionRole" ] ] } ] }, "Metadata": { "aws:cdk:path": "CommonResourceStack/PolicyStack-DefaultPolicy/PolicyManager/ServiceRole/Resource" } }, "PolicyManagerServiceRoleDefaultPolicy373BF1EC": { "Type": "AWS::IAM::Policy", "Properties": { "PolicyDocument": { "Statement": [ { "Action": "sqs:SendMessage", "Effect": "Allow", "Resource": { "Fn::GetAtt": [ "DLQ581697C4", "Arn" ] } }, { "Action": [ "xray:PutTraceSegments", "xray:PutTelemetryRecords" ], "Effect": "Allow", "Resource": "*" } ], "Version": "2012-10-17" }, "PolicyName": "PolicyManagerServiceRoleDefaultPolicy373BF1EC", "Roles": [ { "Ref": "PolicyManagerServiceRoleC35CBD54" } ] }, "Metadata": { "aws:cdk:path": "CommonResourceStack/PolicyStack-DefaultPolicy/PolicyManager/ServiceRole/DefaultPolicy/Resource" } }, "PolicyManager16647975": { "Type": "AWS::Lambda::Function", "Properties": { "Code": { "S3Bucket": { "Fn::Sub": "solutions-${AWS::Region}" }, "S3Key": "automations-for-aws-firewall-manager/v2.1.4/asset1bba5c5df1d0bc450e43784b0b31cffecb5b423032fac3ea1cdf9773d381a812.zip" }, "DeadLetterConfig": { "TargetArn": { "Fn::GetAtt": [ "DLQ581697C4", "Arn" ] } }, "Description": { "Fn::Join": [ "", [ { "Fn::FindInMap": [ "PolicyStackMap", "Solution", "SolutionId" ] }, " - Function to create/update/delete FMS security policies" ] ] }, "Environment": { "Variables": { "FMS_OU": { "Ref": "FMSOUs9CEEEC1C" }, "FMS_TAG": { "Ref": "FMSTags216E0D22" }, "FMS_REGION": { "Ref": "FMSRegions39DF213B" }, "SSM_PARAM_PREFIX": { "Fn::Join": [ "", [ "/FMS/", { "Ref": "PolicyIdentifier" } ] ] }, "FMS_TABLE": { "Ref": "PolicyTable" }, "POLICY_MANIFEST": { "Fn::Join": [ "", [ { "Ref": "ManifestBucket46C412A5" }, "|policy_manifest.json" ] ] }, "POLICY_IDENTIFIER": { "Ref": "PolicyIdentifier" }, "SEND_METRIC": { "Fn::FindInMap": [ "PolicyStackMap", "Metric", "SendAnonymizedMetric" ] }, "LOG_LEVEL": "info", "SOLUTION_ID": { "Fn::FindInMap": [ "PolicyStackMap", "Solution", "SolutionId" ] }, "SOLUTION_VERSION": { "Fn::FindInMap": [ "PolicyStackMap", "Solution", "SolutionVersion" ] }, "SERVICE_NAME": { "Fn::FindInMap": [ "PolicyStackMap", "PolicyManager", "ServiceName" ] }, "MAX_ATTEMPTS": "10", "UUID": { "Ref": "UUID" }, "METRICS_ENDPOINT": { "Fn::FindInMap": [ "PolicyStackMap", "Metric", "MetricsEndpoint" ] }, "USER_AGENT_PREFIX": { "Fn::FindInMap": [ "PolicyStackMap", "Solution", "UserAgentPrefix" ] }, "PARTITION": { "Ref": "AWS::Partition" }, "TOPIC_ARN": { "Ref": "PolicyManagerTopicF9775E18" } } }, "Handler": "index.handler", "Layers": [ { "Ref": "AFMUtilsLayerAFMUtilsLayerLayerB9CC38B4" } ], "MemorySize": 512, "Role": { "Fn::GetAtt": [ "PolicyManagerServiceRoleC35CBD54", "Arn" ] }, "Runtime": "nodejs22.x", "Timeout": 900, "TracingConfig": { "Mode": "Active" } }, "DependsOn": [ "PolicyManagerServiceRoleDefaultPolicy373BF1EC", "PolicyManagerServiceRoleC35CBD54" ], "Metadata": { "cfn_nag": { "rules_to_suppress": [ { "id": "W58", "reason": "CloudWatch logs write permissions added with managed role AWSLambdaBasicExecutionRole" }, { "id": "W89", "reason": "Not a valid use case for Lambda functions to be deployed inside a VPC" }, { "id": "W92", "reason": "Lambda ReservedConcurrentExecutions not needed" } ] } } }, "PolicyManagerEventInvokeConfig535D4AF9": { "Type": "AWS::Lambda::EventInvokeConfig", "Properties": { "FunctionName": { "Ref": "PolicyManager16647975" }, "MaximumEventAgeInSeconds": 900, "MaximumRetryAttempts": 0, "Qualifier": "$LATEST" }, "Metadata": { "aws:cdk:path": "CommonResourceStack/PolicyStack-DefaultPolicy/PolicyManager/EventInvokeConfig/Resource" } }, "PolicyManagerAwsEventsLambdaInvokePermission14D2321A4": { "Type": "AWS::Lambda::Permission", "Properties": { "Action": "lambda:InvokeFunction", "FunctionName": { "Fn::GetAtt": [ "PolicyManager16647975", "Arn" ] }, "Principal": "events.amazonaws.com", "SourceArn": { "Fn::GetAtt": [ "EventsRuleLambdaEventsRule0A996B52", "Arn" ] } }, "Metadata": { "aws:cdk:path": "CommonResourceStack/PolicyStack-DefaultPolicy/PolicyManager/AwsEventsLambdaInvokePermission-1" } }, "PolicyManagerAwsEventsLambdaInvokePermission2686B3168": { "Type": "AWS::Lambda::Permission", "Properties": { "Action": "lambda:InvokeFunction", "FunctionName": { "Fn::GetAtt": [ "PolicyManager16647975", "Arn" ] }, "Principal": "events.amazonaws.com", "SourceArn": { "Fn::GetAtt": [ "EventsRuleS3LambdaEventsRuleA05C21B8", "Arn" ] } }, "Metadata": { "aws:cdk:path": "CommonResourceStack/PolicyStack-DefaultPolicy/PolicyManager/AwsEventsLambdaInvokePermission-2" } }, "EventsRuleLambdaEventsRule0A996B52": { "Type": "AWS::Events::Rule", "Properties": { "EventPattern": { "source": [ "aws.ssm" ], "detail-type": [ "Parameter Store Change" ], "resources": [ { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":ssm:", { "Ref": "AWS::Region" }, ":", { "Ref": "AWS::AccountId" }, ":parameter", { "Ref": "FMSOUs9CEEEC1C" } ] ] }, { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":ssm:", { "Ref": "AWS::Region" }, ":", { "Ref": "AWS::AccountId" }, ":parameter", { "Ref": "FMSTags216E0D22" } ] ] }, { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":ssm:", { "Ref": "AWS::Region" }, ":", { "Ref": "AWS::AccountId" }, ":parameter", { "Ref": "FMSRegions39DF213B" } ] ] } ] }, "State": "ENABLED", "Targets": [ { "Arn": { "Fn::GetAtt": [ "PolicyManager16647975", "Arn" ] }, "Id": "Target0" } ] }, "Metadata": { "aws:cdk:path": "CommonResourceStack/PolicyStack-DefaultPolicy/EventsRuleLambda/EventsRule/Resource" } }, "EventsRuleS3LambdaEventsRuleA05C21B8": { "Type": "AWS::Events::Rule", "Properties": { "EventPattern": { "detail-type": [ "Object Created" ], "source": [ "aws.s3" ], "resources": [ { "Fn::GetAtt": [ "ManifestBucket46C412A5", "Arn" ] } ], "detail": { "bucket": { "name": [ { "Ref": "ManifestBucket46C412A5" } ] }, "object": { "key": [ "policy_manifest.json" ] } } }, "State": "ENABLED", "Targets": [ { "Arn": { "Fn::GetAtt": [ "PolicyManager16647975", "Arn" ] }, "Id": "Target0" } ] }, "Metadata": { "aws:cdk:path": "CommonResourceStack/PolicyStack-DefaultPolicy/EventsRuleS3Lambda/EventsRule/Resource" } }, "PolicyMangerLogGroupE410035C": { "Type": "AWS::Logs::LogGroup", "Properties": { "LogGroupName": { "Fn::Join": [ "", [ "/aws/lambda/", { "Ref": "PolicyManager16647975" } ] ] }, "RetentionInDays": 3653 }, "UpdateReplacePolicy": "Delete", "DeletionPolicy": "Delete", "Metadata": { "cfn_nag": { "rules_to_suppress": [ { "id": "W84", "reason": "Using service default encryption https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/data-protection.html" } ] } } }, "LambdaIAMFMSPolicyRead3CBC9BF1": { "Type": "AWS::IAM::Policy", "Properties": { "PolicyDocument": { "Statement": [ { "Action": "ec2:DescribeRegions", "Effect": "Allow", "Resource": "*", "Sid": "EC2Read0" }, { "Action": "ssm:GetParametersByPath", "Effect": "Allow", "Resource": { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":ssm:", { "Ref": "AWS::Region" }, ":", { "Ref": "AWS::AccountId" }, ":parameter/FMS/", { "Ref": "PolicyIdentifier" }, "*" ] ] }, "Sid": "SSMRead05" }, { "Action": "s3:GetObject", "Effect": "Allow", "Resource": [ { "Fn::GetAtt": [ "ManifestBucket46C412A5", "Arn" ] }, { "Fn::Join": [ "", [ { "Fn::GetAtt": [ "ManifestBucket46C412A5", "Arn" ] }, "/*" ] ] } ], "Sid": "S3Read06" }, { "Action": [ "route53resolver:ListFirewallDomainLists", "route53resolver:ListFirewallRuleGroups", "ram:ListResources" ], "Effect": "Allow", "Resource": "*", "Sid": "DNSRAMRead10" } ], "Version": "2012-10-17" }, "PolicyName": "LambdaIAMFMSPolicyRead3CBC9BF1", "Roles": [ { "Ref": "PolicyManagerServiceRoleC35CBD54" } ] }, "Metadata": { "cfn_nag": { "rules_to_suppress": [ { "id": "W12", "reason": "* needed for [ec2:DescribeRegions, route53resolver:ListFirewallDomainLists, route53resolver:ListFirewallRuleGroups, ram:ListResources], does no support resource level permissions" } ] } } }, "LambdaIAMFMSPolicyWrite3D1AAE35": { "Type": "AWS::IAM::Policy", "Properties": { "PolicyDocument": { "Statement": [ { "Action": [ "dynamodb:GetItem", "dynamodb:UpdateItem", "dynamodb:DeleteItem" ], "Effect": "Allow", "Resource": { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":dynamodb:", { "Ref": "AWS::Region" }, ":", { "Ref": "AWS::AccountId" }, ":table/", { "Ref": "PolicyTable" } ] ] }, "Sid": "DDBWrite01" }, { "Action": [ "fms:PutPolicy", "fms:GetPolicy", "fms:DeletePolicy" ], "Effect": "Allow", "Resource": { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":fms:*:*:policy/*" ] ] }, "Sid": "FMSWrite021" }, { "Action": [ "logs:CreateLogStream", "logs:PutLogEvents", "logs:CreateLogGroup" ], "Effect": "Allow", "Resource": { "Fn::GetAtt": [ "PolicyMangerLogGroupE410035C", "Arn" ] }, "Sid": "CloudWatchLogsWrite03" }, { "Action": [ "wafv2:*", "shield:GetSubscriptionState" ], "Effect": "Allow", "Resource": "*", "Sid": "WAFWrite07" }, { "Action": "route53resolver:ListFirewallRules", "Effect": "Allow", "Resource": "*", "Sid": "DNSList08" }, { "Action": "ram:DeleteResourceShare", "Condition": { "StringEquals": { "aws:ResourceTag/FMManaged": "true" } }, "Effect": "Allow", "Resource": "*", "Sid": "RAMWrite09" }, { "Action": [ "route53resolver:CreateFirewallRule", "route53resolver:CreateFirewallRuleGroup", "route53resolver:DeleteFirewallRuleGroup", "route53resolver:DeleteFirewallRule", "route53resolver:GetFirewallRuleGroup" ], "Effect": "Allow", "Resource": [ { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":route53resolver:*:", { "Ref": "AWS::AccountId" }, ":firewall-domain-list/*" ] ] }, { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":route53resolver:*:", { "Ref": "AWS::AccountId" }, ":firewall-rule-group/*" ] ] } ], "Sid": "DNSWFirewall11" } ], "Version": "2012-10-17" }, "PolicyName": "LambdaIAMFMSPolicyWrite3D1AAE35", "Roles": [ { "Ref": "PolicyManagerServiceRoleC35CBD54" } ] }, "Metadata": { "cfn_nag": { "rules_to_suppress": [ { "id": "W12", "reason": "* resource used for fms and route53resolver actions, resources are created/deleted as part of solution" }, { "id": "F4", "reason": "Read & Write permissions needed to create WAFv2 policies" } ] }, "guard": { "SuppressedRules": [ "IAM_POLICY_NON_COMPLIANT_ARN" ], "Reason": "DTAS guard rule incorrectly marks ARNs with wildcard (*) in region/account section as invalid" } } }, "PolicyManagerIAMPolicy5EC075C6": { "Type": "AWS::IAM::Policy", "Properties": { "PolicyDocument": { "Statement": [ { "Action": [ "xray:PutTraceSegments", "xray:PutTelemetryRecords", "xray:GetSamplingRules", "xray:GetSamplingTargets", "xray:GetSamplingStatisticSummaries" ], "Effect": "Allow", "Resource": "*", "Sid": "XRayWriteAccess" }, { "Action": "sns:Publish", "Effect": "Allow", "Resource": { "Ref": "PolicyManagerTopicF9775E18" }, "Sid": "SNSWrite" } ], "Version": "2012-10-17" }, "PolicyName": "PolicyManagerIAMPolicy5EC075C6", "Roles": [ { "Ref": "PolicyManagerServiceRoleC35CBD54" } ] }, "Metadata": { "cfn_nag": { "rules_to_suppress": [ { "id": "W12", "reason": "Resource * is required for function to write traces to X-Ray" } ] } } }, "PolicyManagerErrorQueryFEAE9494": { "Type": "AWS::Logs::QueryDefinition", "Properties": { "LogGroupNames": [ { "Ref": "PolicyMangerLogGroupE410035C" } ], "Name": "FMS-Policy_Manager_Errors", "QueryString": "fields @timestamp, @level\n| filter level = \"ERROR\"\n| sort @timestamp desc" }, "Metadata": { "aws:cdk:path": "CommonResourceStack/PolicyStack-DefaultPolicy/PolicyManagerErrorQuery/Resource" } }, "PolicyManagerSuccessQuery253C9857": { "Type": "AWS::Logs::QueryDefinition", "Properties": { "LogGroupNames": [ { "Ref": "PolicyMangerLogGroupE410035C" } ], "Name": "FMS-Policy_Manager_Success", "QueryString": "fields @timestamp, @message\n| filter message like \"successfully put policy\"\n| sort @timestamp desc" }, "Metadata": { "aws:cdk:path": "CommonResourceStack/PolicyStack-DefaultPolicy/PolicyManagerSuccessQuery/Resource" } }, "PolicyManagerCreateFailureQuery8ED1B6AA": { "Type": "AWS::Logs::QueryDefinition", "Properties": { "LogGroupNames": [ { "Ref": "PolicyMangerLogGroupE410035C" } ], "Name": "FMS-Policy_Manager_Create_Failure", "QueryString": "fields @timestamp, @message\n| filter message like \"encountered error putting policy\"\n| sort @timestamp desc" }, "Metadata": { "aws:cdk:path": "CommonResourceStack/PolicyStack-DefaultPolicy/PolicyManagerCreateFailureQuery/Resource" } }, "CDKMetadata": { "Type": "AWS::CDK::Metadata", "Properties": { "Analytics": "v2:deflate64:H4sIAAAAAAAA/21SwU7jMBD9lt4dU9oDcAOygJC6UBq018p1JtHQxM567FaV5X9f2UmTgvbiee/N84wzmQX3i+sbPp+JI2Wy3GcN7rh/A7JQFlbIPcsrtRZGtGDBRPJbdB2qOsJcqxItasXEkba+Ee2uFNyvxAnMHzAUM3mlvvECVd2A1erZKZnujiCvJvHpAMq+qoPeQ65Vhanff8U1mBYp1g6MlltBBJb4QwyMltw/OrkH+ygIWA/jpQH1Ya0blKdJ7nlgRC33hTWo6hWS/TaFifSGkQeGouV+oxuIvhSnBmPpv8T9hwOXTD1I52S9oIGRIu4/dYcypnqQzsl/SQu3I2mwO4/1kgcGcYzE/cYNb3QNBNbomrhf6frFaNel/3bGHw7M6RdUqPBc8YcUAksTL6yoh+XYAGlnJLARSEdWt1szcOIPR8qTNlp+0kq9O9s5G9jyjs9n93FLSTcu9qRMakXWOGnpKibSd+0MljVkwy4+TdKnXiUtMKVL4F90dbi+5Ys5v519EWJmnLLYAt/08R9HU7I0GQMAAA==" }, "Metadata": { "aws:cdk:path": "CommonResourceStack/PolicyStack-DefaultPolicy/CDKMetadata/Default" }, "Condition": "CDKMetadataAvailable" } }, "Outputs": { "PolicyManifestBucket": { "Description": "S3 Bucket with policy manifest file", "Value": { "Fn::Join": [ "", [ "s3://", { "Ref": "ManifestBucket46C412A5" } ] ] } }, "PolicyManagerSNSTopic": { "Description": "SNS Topic for Policy Manager notifications", "Value": { "Fn::GetAtt": [ "PolicyManagerTopicF9775E18", "TopicName" ] } }, "PolicyManagerErrorQuery": { "Description": "Log Insights query for policy manager function errors", "Value": { "Fn::GetAtt": [ "PolicyManagerErrorQueryFEAE9494", "QueryDefinitionId" ] } }, "PolicyManagerSuccessQuery": { "Description": "Log Insights query for policy create successes", "Value": { "Fn::GetAtt": [ "PolicyManagerSuccessQuery253C9857", "QueryDefinitionId" ] } }, "PolicyManagerFailureQuery": { "Description": "Log Insights query for policy create failures", "Value": { "Fn::GetAtt": [ "PolicyManagerCreateFailureQuery8ED1B6AA", "QueryDefinitionId" ] } } } }