{ "Description": "(SO0134N) - The AWS CloudFormation template for deployment of the automations-for-aws-firewall-manager. Version v2.1.4", "AWSTemplateFormatVersion": "2010-09-09", "Metadata": { "AWS::CloudFormation::Interface": { "ParameterGroups": [ { "Label": { "default": "Pre-Requisite Configuration" }, "Parameters": [ "FMSAdmin", "EnableConfig" ] } ], "ParameterLabels": { "FMSAdmin": { "default": "FMS Admin Account" }, "EnableConfig": { "default": "Enable Config" } } } }, "Parameters": { "FMSAdmin": { "Type": "String", "AllowedPattern": "^[0-9]{1}\\d{11}$", "Description": "AWS Account Id for Firewall Manager admin account" }, "EnableConfig": { "Type": "String", "Default": "Yes", "AllowedValues": [ "Yes", "No" ], "Description": "Do you want to enable AWS Config across your AWS Organization? You may chose 'No' if you are already using Config" } }, "Mappings": { "FMSMap": { "Metric": { "SendAnonymizedMetric": "Yes", "MetricsEndpoint": "https://metrics.awssolutionsbuilder.com/generic" }, "Solution": { "SolutionId": "SO0134N", "SolutionName": "automations-for-aws-firewall-manager", "SolutionVersion": "v2.1.4", "GlobalStackSetName": "FMS-EnableConfig-Global", "RegionalStackSetName": "FMS-EnableConfig-Regional", "UserAgentPrefix": "AwsSolution" } }, "LatestNodeRuntimeMap": { "af-south-1": { "value": "nodejs22.x" }, "ap-east-1": { "value": "nodejs22.x" }, "ap-east-2": { "value": "nodejs22.x" }, "ap-northeast-1": { "value": "nodejs22.x" }, "ap-northeast-2": { "value": "nodejs22.x" }, "ap-northeast-3": { "value": "nodejs22.x" }, "ap-south-1": { "value": "nodejs22.x" }, "ap-south-2": { "value": "nodejs22.x" }, "ap-southeast-1": { "value": "nodejs22.x" }, "ap-southeast-2": { "value": "nodejs22.x" }, "ap-southeast-3": { "value": "nodejs22.x" }, "ap-southeast-4": { "value": "nodejs22.x" }, "ap-southeast-5": { "value": "nodejs22.x" }, "ap-southeast-6": { "value": "nodejs22.x" }, "ap-southeast-7": { "value": "nodejs22.x" }, "ca-central-1": { "value": "nodejs22.x" }, "ca-west-1": { "value": "nodejs22.x" }, "cn-north-1": { "value": "nodejs22.x" }, "cn-northwest-1": { "value": "nodejs22.x" }, "eu-central-1": { "value": "nodejs22.x" }, "eu-central-2": { "value": "nodejs22.x" }, "eu-isoe-west-1": { "value": "nodejs22.x" }, "eu-north-1": { "value": "nodejs22.x" }, "eu-south-1": { "value": "nodejs22.x" }, "eu-south-2": { "value": "nodejs22.x" }, "eu-west-1": { "value": "nodejs22.x" }, "eu-west-2": { "value": "nodejs22.x" }, "eu-west-3": { "value": "nodejs22.x" }, "eusc-de-east-1": { "value": "nodejs22.x" }, "il-central-1": { "value": "nodejs22.x" }, "me-central-1": { "value": "nodejs22.x" }, "me-south-1": { "value": "nodejs22.x" }, "mx-central-1": { "value": "nodejs22.x" }, "sa-east-1": { "value": "nodejs22.x" }, "us-east-1": { "value": "nodejs22.x" }, "us-east-2": { "value": "nodejs22.x" }, "us-gov-east-1": { "value": "nodejs22.x" }, "us-gov-west-1": { "value": "nodejs22.x" }, "us-iso-east-1": { "value": "nodejs22.x" }, "us-iso-west-1": { "value": "nodejs22.x" }, "us-isob-east-1": { "value": "nodejs18.x" }, "us-isob-west-1": { "value": "nodejs18.x" }, "us-isof-east-1": { "value": "nodejs22.x" }, "us-isof-south-1": { "value": "nodejs22.x" }, "us-west-1": { "value": "nodejs22.x" }, "us-west-2": { "value": "nodejs22.x" } } }, "Resources": { "AFMUtilsLayerAFMUtilsLayerLayerB9CC38B4": { "Type": "AWS::Lambda::LayerVersion", "Properties": { "CompatibleRuntimes": [ "nodejs22.x" ], "Content": { "S3Bucket": { "Fn::Sub": "solutions-${AWS::Region}" }, "S3Key": "automations-for-aws-firewall-manager/v2.1.4/asset7be93b6c0ec014c96d856a4450cde0aa9740ecb359bc80295f9c57410cc0dc5c.zip" }, "LayerName": "AFM-UtilsLayer" }, "Metadata": { "aws:cdk:path": "PreReqStack/AFM-UtilsLayer/AFM-UtilsLayer-Layer/Resource", "aws:asset:path": "asset.7be93b6c0ec014c96d856a4450cde0aa9740ecb359bc80295f9c57410cc0dc5c.zip", "aws:asset:is-bundled": false, "aws:asset:property": "Content" } }, "FMSHelperFunctionServiceRoleA51F4DD9": { "Type": "AWS::IAM::Role", "Properties": { "AssumeRolePolicyDocument": { "Statement": [ { "Action": "sts:AssumeRole", "Effect": "Allow", "Principal": { "Service": "lambda.amazonaws.com" } } ], "Version": "2012-10-17" }, "ManagedPolicyArns": [ { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":iam::aws:policy/service-role/AWSLambdaBasicExecutionRole" ] ] } ] }, "Metadata": { "aws:cdk:path": "PreReqStack/FMSHelperFunction/ServiceRole/Resource" } }, "FMSHelperFunction59933F0A": { "Type": "AWS::Lambda::Function", "Properties": { "Code": { "S3Bucket": { "Fn::Sub": "solutions-${AWS::Region}" }, "S3Key": "automations-for-aws-firewall-manager/v2.1.4/asset852fd50470d347d6a7b8e31621ee885a742066ca057398823cc5f0f4c3566120.zip" }, "Description": "DO NOT DELETE - FMS helper function", "Environment": { "Variables": { "METRICS_ENDPOINT": { "Fn::FindInMap": [ "FMSMap", "Metric", "MetricsEndpoint" ] }, "SEND_METRIC": { "Fn::FindInMap": [ "FMSMap", "Metric", "SendAnonymizedMetric" ] }, "LOG_LEVEL": "info", "USER_AGENT_PREFIX": { "Fn::FindInMap": [ "FMSMap", "Solution", "UserAgentPrefix" ] }, "SOLUTION_NAME": { "Fn::FindInMap": [ "FMSMap", "Solution", "SolutionName" ] }, "SOLUTION_VERSION": { "Fn::FindInMap": [ "FMSMap", "Solution", "SolutionVersion" ] }, "SOLUTION_ID": { "Fn::FindInMap": [ "FMSMap", "Solution", "SolutionId" ] }, "SERVICE_NAME": { "Fn::FindInMap": [ "FMSMap", "Solution", "SolutionName" ] } } }, "Handler": "index.handler", "Layers": [ { "Ref": "AFMUtilsLayerAFMUtilsLayerLayerB9CC38B4" } ], "MemorySize": 128, "Role": { "Fn::GetAtt": [ "FMSHelperFunctionServiceRoleA51F4DD9", "Arn" ] }, "Runtime": "nodejs22.x", "Timeout": 30 }, "DependsOn": [ "FMSHelperFunctionServiceRoleA51F4DD9" ], "Metadata": { "cfn_nag": { "rules_to_suppress": [ { "id": "W58", "reason": "CloudWatch logs write permissions added with managed role AWSLambdaBasicExecutionRole" }, { "id": "W89", "reason": "Not a valid use case for Lambda functions to be deployed inside a VPC" }, { "id": "W92", "reason": "Lambda ReservedConcurrentExecutions not needed" } ] } } }, "HelperProviderframeworkonEventServiceRole1962DD43": { "Type": "AWS::IAM::Role", "Properties": { "AssumeRolePolicyDocument": { "Statement": [ { "Action": "sts:AssumeRole", "Effect": "Allow", "Principal": { "Service": "lambda.amazonaws.com" } } ], "Version": "2012-10-17" }, "ManagedPolicyArns": [ { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":iam::aws:policy/service-role/AWSLambdaBasicExecutionRole" ] ] } ] }, "Metadata": { "aws:cdk:path": "PreReqStack/HelperProvider/framework-onEvent/ServiceRole/Resource" } }, "HelperProviderframeworkonEventServiceRoleDefaultPolicy7C54367B": { "Type": "AWS::IAM::Policy", "Properties": { "PolicyDocument": { "Statement": [ { "Action": "lambda:InvokeFunction", "Effect": "Allow", "Resource": [ { "Fn::GetAtt": [ "FMSHelperFunction59933F0A", "Arn" ] }, { "Fn::Join": [ "", [ { "Fn::GetAtt": [ "FMSHelperFunction59933F0A", "Arn" ] }, ":*" ] ] } ] }, { "Action": "lambda:GetFunction", "Effect": "Allow", "Resource": { "Fn::GetAtt": [ "FMSHelperFunction59933F0A", "Arn" ] } } ], "Version": "2012-10-17" }, "PolicyName": "HelperProviderframeworkonEventServiceRoleDefaultPolicy7C54367B", "Roles": [ { "Ref": "HelperProviderframeworkonEventServiceRole1962DD43" } ] }, "Metadata": { "aws:cdk:path": "PreReqStack/HelperProvider/framework-onEvent/ServiceRole/DefaultPolicy/Resource" } }, "HelperProviderframeworkonEvent1079DE9D": { "Type": "AWS::Lambda::Function", "Properties": { "Code": { "S3Bucket": { "Fn::Sub": "solutions-${AWS::Region}" }, "S3Key": "automations-for-aws-firewall-manager/v2.1.4/assetbdc104ed9cab1b5b6421713c8155f0b753380595356f710400609664d3635eca.zip" }, "Description": "AWS CDK resource provider framework - onEvent (PreReqStack/HelperProvider)", "Environment": { "Variables": { "USER_ON_EVENT_FUNCTION_ARN": { "Fn::GetAtt": [ "FMSHelperFunction59933F0A", "Arn" ] } } }, "Handler": "framework.onEvent", "LoggingConfig": { "ApplicationLogLevel": "FATAL", "LogFormat": "JSON" }, "Role": { "Fn::GetAtt": [ "HelperProviderframeworkonEventServiceRole1962DD43", "Arn" ] }, "Runtime": { "Fn::FindInMap": [ "LatestNodeRuntimeMap", { "Ref": "AWS::Region" }, "value" ] }, "Timeout": 900 }, "DependsOn": [ "HelperProviderframeworkonEventServiceRoleDefaultPolicy7C54367B", "HelperProviderframeworkonEventServiceRole1962DD43" ], "Metadata": { "cfn_nag": { "rules_to_suppress": [ { "id": "W58", "reason": "CloudWatch logs write permissions added with managed role AWSLambdaBasicExecutionRole" }, { "id": "W89", "reason": "Not a valid use case for Lambda functions to be deployed inside a VPC" }, { "id": "W92", "reason": "Lambda ReservedConcurrentExecutions not needed" } ] } } }, "PreReqManagerFunctionServiceRole3E2704D1": { "Type": "AWS::IAM::Role", "Properties": { "AssumeRolePolicyDocument": { "Statement": [ { "Action": "sts:AssumeRole", "Effect": "Allow", "Principal": { "Service": "lambda.amazonaws.com" } } ], "Version": "2012-10-17" }, "ManagedPolicyArns": [ { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":iam::aws:policy/service-role/AWSLambdaBasicExecutionRole" ] ] } ] }, "Metadata": { "aws:cdk:path": "PreReqStack/PreReqManagerFunction/ServiceRole/Resource" } }, "PreReqManagerFunctionServiceRoleDefaultPolicy45CD6122": { "Type": "AWS::IAM::Policy", "Properties": { "PolicyDocument": { "Statement": [ { "Action": [ "xray:PutTraceSegments", "xray:PutTelemetryRecords" ], "Effect": "Allow", "Resource": "*" } ], "Version": "2012-10-17" }, "PolicyName": "PreReqManagerFunctionServiceRoleDefaultPolicy45CD6122", "Roles": [ { "Ref": "PreReqManagerFunctionServiceRole3E2704D1" } ] }, "Metadata": { "cfn_nag": { "rules_to_suppress": [ { "id": "W12", "reason": "Resource * is required for xray permissions" } ] } } }, "PreReqManagerFunction80D2ED4C": { "Type": "AWS::Lambda::Function", "Properties": { "Code": { "S3Bucket": { "Fn::Sub": "solutions-${AWS::Region}" }, "S3Key": "automations-for-aws-firewall-manager/v2.1.4/asset8baa83a163ec564cb7fd00877e8e45edf85a2e35418b40b2a0618d8f47dc08e8.zip" }, "Description": "Function to validate and install pre-requisites for the FMS solution", "Environment": { "Variables": { "METRICS_ENDPOINT": { "Fn::FindInMap": [ "FMSMap", "Metric", "MetricsEndpoint" ] }, "SEND_METRIC": { "Fn::FindInMap": [ "FMSMap", "Metric", "SendAnonymizedMetric" ] }, "LOG_LEVEL": "info", "USER_AGENT_PREFIX": { "Fn::FindInMap": [ "FMSMap", "Solution", "UserAgentPrefix" ] }, "PARTITION": { "Ref": "AWS::Partition" }, "SERVICE_NAME": { "Fn::FindInMap": [ "FMSMap", "Solution", "SolutionName" ] } } }, "Handler": "index.handler", "Layers": [ { "Ref": "AFMUtilsLayerAFMUtilsLayerLayerB9CC38B4" } ], "MemorySize": 256, "Role": { "Fn::GetAtt": [ "PreReqManagerFunctionServiceRole3E2704D1", "Arn" ] }, "Runtime": "nodejs22.x", "Timeout": 300, "TracingConfig": { "Mode": "Active" } }, "DependsOn": [ "PreReqManagerFunctionServiceRoleDefaultPolicy45CD6122", "PreReqManagerFunctionServiceRole3E2704D1" ], "Metadata": { "cfn_nag": { "rules_to_suppress": [ { "id": "W58", "reason": "CloudWatch logs write permissions added with managed role AWSLambdaBasicExecutionRole" }, { "id": "W89", "reason": "Not a valid use case for Lambda functions to be deployed inside a VPC" }, { "id": "W92", "reason": "Lambda ReservedConcurrentExecutions not needed" } ] } } }, "PreReqManagerPolicyF4EDD602": { "Type": "AWS::IAM::Policy", "Properties": { "PolicyDocument": { "Statement": [ { "Action": [ "cloudformation:CreateStackInstances", "cloudformation:DeleteStackInstances" ], "Effect": "Allow", "Resource": [ { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":cloudformation:*:*:*/", { "Fn::FindInMap": [ "FMSMap", "Solution", "GlobalStackSetName" ] }, ":*" ] ] }, { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":cloudformation:*:*:*/", { "Fn::FindInMap": [ "FMSMap", "Solution", "RegionalStackSetName" ] }, ":*" ] ] }, { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":cloudformation:*::type/resource/AWS-IAM-Role" ] ] }, { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":cloudformation:*::type/resource/AWS-SNS-Topic" ] ] }, { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":cloudformation:*::type/resource/AWS-S3-Bucket" ] ] }, { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":cloudformation:*::type/resource/AWS-SNS-TopicPolicy" ] ] }, { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":cloudformation:*::type/resource/AWS-SNS-Subscription" ] ] }, { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":cloudformation:*::type/resource/AWS-S3-BucketPolicy" ] ] }, { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":cloudformation:*::type/resource/AWS-Config-ConfigurationRecorder" ] ] }, { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":cloudformation:*::type/resource/AWS-Config-DeliveryChannel" ] ] } ], "Sid": "CloudFormationWrite" }, { "Action": "iam:GetRole", "Effect": "Allow", "Resource": { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":iam::", { "Ref": "AWS::AccountId" }, ":role/aws-service-role/stacksets.cloudformation.amazonaws.com/AWSServiceRoleForCloudFormationStackSetsOrgAdmin" ] ] }, "Sid": "GetOrgAdminRole" }, { "Action": "iam:GetRole", "Effect": "Allow", "Resource": { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":iam::", { "Ref": "AWS::AccountId" }, ":role/AWSServiceRoleForCloudFormationStackSetsOrgAdmin*" ] ] }, "Sid": "GetCfnStackSetsServiceRolePolicy" }, { "Action": [ "fms:GetAdminAccount", "fms:AssociateAdminAccount" ], "Effect": "Allow", "Resource": "*", "Sid": "FMSAdmin" }, { "Action": [ "organizations:ListRoots", "organizations:DescribeOrganization", "organizations:DescribeAccount" ], "Effect": "Allow", "Resource": "*", "Sid": "OrganizationsRead" }, { "Action": [ "organizations:EnableAWSServiceAccess", "organizations:RegisterDelegatedAdministrator" ], "Effect": "Allow", "Resource": "*", "Sid": "OrganizationsWrite" }, { "Action": "ec2:DescribeRegions", "Effect": "Allow", "Resource": "*", "Sid": "PreReqRead0" }, { "Action": [ "iam:CreateServiceLinkedRole", "cloudformation:CreateStackSet", "ram:EnableSharingWithAwsOrganization", "cloudformation:ActivateOrganizationsAccess" ], "Effect": "Allow", "Resource": "*", "Sid": "PreReqWrite0" }, { "Action": [ "xray:PutTraceSegments", "xray:PutTelemetryRecords", "xray:GetSamplingRules", "xray:GetSamplingTargets", "xray:GetSamplingStatisticSummaries" ], "Effect": "Allow", "Resource": "*", "Sid": "XRayWriteAccess" } ], "Version": "2012-10-17" }, "PolicyName": "FMS-PreReqManager-Policy", "Roles": [ { "Ref": "PreReqManagerFunctionServiceRole3E2704D1" } ] }, "Metadata": { "cfn_nag": { "rules_to_suppress": [ { "id": "W12", "reason": "Resource * is required for IAM actions that do not support resource level permissions" } ] } } }, "PreReqProviderframeworkonEventServiceRoleF7D67BDC": { "Type": "AWS::IAM::Role", "Properties": { "AssumeRolePolicyDocument": { "Statement": [ { "Action": "sts:AssumeRole", "Effect": "Allow", "Principal": { "Service": "lambda.amazonaws.com" } } ], "Version": "2012-10-17" }, "ManagedPolicyArns": [ { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":iam::aws:policy/service-role/AWSLambdaBasicExecutionRole" ] ] } ] }, "Metadata": { "aws:cdk:path": "PreReqStack/PreReqProvider/framework-onEvent/ServiceRole/Resource" } }, "PreReqProviderframeworkonEventServiceRoleDefaultPolicy28F45022": { "Type": "AWS::IAM::Policy", "Properties": { "PolicyDocument": { "Statement": [ { "Action": "lambda:InvokeFunction", "Effect": "Allow", "Resource": [ { "Fn::GetAtt": [ "PreReqManagerFunction80D2ED4C", "Arn" ] }, { "Fn::Join": [ "", [ { "Fn::GetAtt": [ "PreReqManagerFunction80D2ED4C", "Arn" ] }, ":*" ] ] } ] }, { "Action": "lambda:GetFunction", "Effect": "Allow", "Resource": { "Fn::GetAtt": [ "PreReqManagerFunction80D2ED4C", "Arn" ] } } ], "Version": "2012-10-17" }, "PolicyName": "PreReqProviderframeworkonEventServiceRoleDefaultPolicy28F45022", "Roles": [ { "Ref": "PreReqProviderframeworkonEventServiceRoleF7D67BDC" } ] }, "Metadata": { "aws:cdk:path": "PreReqStack/PreReqProvider/framework-onEvent/ServiceRole/DefaultPolicy/Resource" } }, "PreReqProviderframeworkonEvent743144DE": { "Type": "AWS::Lambda::Function", "Properties": { "Code": { "S3Bucket": { "Fn::Sub": "solutions-${AWS::Region}" }, "S3Key": "automations-for-aws-firewall-manager/v2.1.4/assetbdc104ed9cab1b5b6421713c8155f0b753380595356f710400609664d3635eca.zip" }, "Description": "AWS CDK resource provider framework - onEvent (PreReqStack/PreReqProvider)", "Environment": { "Variables": { "USER_ON_EVENT_FUNCTION_ARN": { "Fn::GetAtt": [ "PreReqManagerFunction80D2ED4C", "Arn" ] } } }, "Handler": "framework.onEvent", "LoggingConfig": { "ApplicationLogLevel": "FATAL", "LogFormat": "JSON" }, "Role": { "Fn::GetAtt": [ "PreReqProviderframeworkonEventServiceRoleF7D67BDC", "Arn" ] }, "Runtime": { "Fn::FindInMap": [ "LatestNodeRuntimeMap", { "Ref": "AWS::Region" }, "value" ] }, "Timeout": 900 }, "DependsOn": [ "PreReqProviderframeworkonEventServiceRoleDefaultPolicy28F45022", "PreReqProviderframeworkonEventServiceRoleF7D67BDC" ], "Metadata": { "cfn_nag": { "rules_to_suppress": [ { "id": "W58", "reason": "CloudWatch logs write permissions added with managed role AWSLambdaBasicExecutionRole" }, { "id": "W89", "reason": "Not a valid use case for Lambda functions to be deployed inside a VPC" }, { "id": "W92", "reason": "Lambda ReservedConcurrentExecutions not needed" } ] } } }, "PreReqManagerCR": { "Type": "Custom::PreReqChecker", "Properties": { "ServiceToken": { "Fn::GetAtt": [ "PreReqProviderframeworkonEvent743144DE", "Arn" ] }, "FMSAdmin": { "Ref": "FMSAdmin" }, "EnableConfig": { "Ref": "EnableConfig" }, "AccountId": { "Ref": "AWS::AccountId" }, "Region": { "Ref": "AWS::Region" }, "GlobalStackSetName": { "Fn::FindInMap": [ "FMSMap", "Solution", "GlobalStackSetName" ] }, "RegionalStackSetName": { "Fn::FindInMap": [ "FMSMap", "Solution", "RegionalStackSetName" ] }, "SolutionId": { "Fn::FindInMap": [ "FMSMap", "Solution", "SolutionId" ] }, "SolutionVersion": { "Fn::FindInMap": [ "FMSMap", "Solution", "SolutionVersion" ] } }, "UpdateReplacePolicy": "Delete", "DeletionPolicy": "Delete", "Metadata": { "aws:cdk:path": "PreReqStack/PreReqManagerCR/Default" } } } }