{ "Description": "(SO0134P) - The AWS CloudFormation template for deployment of the automations-for-aws-firewall-manager. Version v2.1.4", "AWSTemplateFormatVersion": "2010-09-09", "Metadata": { "AWS::CloudFormation::Interface": { "ParameterGroups": [ { "Label": { "default": "Proactive Engagement Configuration" }, "Parameters": [ "EmergencyContactPhone", "EmergencyContactEmail" ] }, { "Label": { "default": "Do you want to grant Shield Response Team (SRT) access?" }, "Parameters": [ "EnableSRT" ] } ], "ParameterLabels": { "EmergencyContactPhone": { "default": "Emergency Contact Phone Number" }, "EmergencyContactEmail": { "default": "Emergency Contact Email Address" }, "EnableSRT": { "default": "Grant SRT (Shield Response Team) Account Access" } } } }, "Parameters": { "EnableSRT": { "Type": "String", "Default": "No", "AllowedValues": [ "Yes", "No" ], "Description": "Option to grant SRT access to accounts where this stack is deployed. This allows the SRT to make AWS Shield Advanced and AWS WAF API calls on your behalf and to access your AWS WAF logs." }, "EmergencyContactPhone": { "Type": "String", "AllowedPattern": "^\\+[1-9]\\d{1,14}$", "ConstraintDescription": "Emergency Contact Phone number is invalid. Please ensure it is in E.164 format, e.g. +11111111111", "Description": "Emergency Contact Phone Number for Proactive Engagement in E.164 format, e.g. +11111111111. Additional contacts can be added later in the AWS Shield console.", "MaxLength": 16, "MinLength": 1 }, "EmergencyContactEmail": { "Type": "String", "AllowedPattern": "^\\S+@\\S+\\.\\S+$", "ConstraintDescription": "Emergency Contact Email is invalid. Please ensure it is of the form example@example.com", "Description": "Emergency Contact Email Address for Proactive Engagement. Additional contacts can be added later in the AWS Shield console.", "MaxLength": 150, "MinLength": 1 } }, "Mappings": { "ProactiveEventResponseStackMap": { "Metric": { "SendAnonymizedMetric": "Yes", "MetricsEndpoint": "https://metrics.awssolutionsbuilder.com/generic" }, "Solution": { "SolutionId": "SO0134P", "SolutionName": "automations-for-aws-firewall-manager", "SolutionVersion": "v2.1.4", "UserAgentPrefix": "AwsSolution" } }, "LatestNodeRuntimeMap": { "af-south-1": { "value": "nodejs22.x" }, "ap-east-1": { "value": "nodejs22.x" }, "ap-east-2": { "value": "nodejs22.x" }, "ap-northeast-1": { "value": "nodejs22.x" }, "ap-northeast-2": { "value": "nodejs22.x" }, "ap-northeast-3": { "value": "nodejs22.x" }, "ap-south-1": { "value": "nodejs22.x" }, "ap-south-2": { "value": "nodejs22.x" }, "ap-southeast-1": { "value": "nodejs22.x" }, "ap-southeast-2": { "value": "nodejs22.x" }, "ap-southeast-3": { "value": "nodejs22.x" }, "ap-southeast-4": { "value": "nodejs22.x" }, "ap-southeast-5": { "value": "nodejs22.x" }, "ap-southeast-6": { "value": "nodejs22.x" }, "ap-southeast-7": { "value": "nodejs22.x" }, "ca-central-1": { "value": "nodejs22.x" }, "ca-west-1": { "value": "nodejs22.x" }, "cn-north-1": { "value": "nodejs22.x" }, "cn-northwest-1": { "value": "nodejs22.x" }, "eu-central-1": { "value": "nodejs22.x" }, "eu-central-2": { "value": "nodejs22.x" }, "eu-isoe-west-1": { "value": "nodejs22.x" }, "eu-north-1": { "value": "nodejs22.x" }, "eu-south-1": { "value": "nodejs22.x" }, "eu-south-2": { "value": "nodejs22.x" }, "eu-west-1": { "value": "nodejs22.x" }, "eu-west-2": { "value": "nodejs22.x" }, "eu-west-3": { "value": "nodejs22.x" }, "eusc-de-east-1": { "value": "nodejs22.x" }, "il-central-1": { "value": "nodejs22.x" }, "me-central-1": { "value": "nodejs22.x" }, "me-south-1": { "value": "nodejs22.x" }, "mx-central-1": { "value": "nodejs22.x" }, "sa-east-1": { "value": "nodejs22.x" }, "us-east-1": { "value": "nodejs22.x" }, "us-east-2": { "value": "nodejs22.x" }, "us-gov-east-1": { "value": "nodejs22.x" }, "us-gov-west-1": { "value": "nodejs22.x" }, "us-iso-east-1": { "value": "nodejs22.x" }, "us-iso-west-1": { "value": "nodejs22.x" }, "us-isob-east-1": { "value": "nodejs18.x" }, "us-isob-west-1": { "value": "nodejs18.x" }, "us-isof-east-1": { "value": "nodejs22.x" }, "us-isof-south-1": { "value": "nodejs22.x" }, "us-west-1": { "value": "nodejs22.x" }, "us-west-2": { "value": "nodejs22.x" } } }, "Conditions": { "enableSRTCheck": { "Fn::Equals": [ { "Ref": "EnableSRT" }, "Yes" ] } }, "Resources": { "AFMUtilsLayerAFMUtilsLayerLayerB9CC38B4": { "Type": "AWS::Lambda::LayerVersion", "Properties": { "CompatibleRuntimes": [ "nodejs22.x" ], "Content": { "S3Bucket": { "Fn::Sub": "solutions-${AWS::Region}" }, "S3Key": "automations-for-aws-firewall-manager/v2.1.4/asset7be93b6c0ec014c96d856a4450cde0aa9740ecb359bc80295f9c57410cc0dc5c.zip" }, "LayerName": "AFM-UtilsLayer" }, "Metadata": { "aws:cdk:path": "ProactiveEventResponseStack/AFM-UtilsLayer/AFM-UtilsLayer-Layer/Resource", "aws:asset:path": "asset.7be93b6c0ec014c96d856a4450cde0aa9740ecb359bc80295f9c57410cc0dc5c.zip", "aws:asset:is-bundled": false, "aws:asset:property": "Content" } }, "ProactiveEventResponseHelperServiceRole83AF8B7A": { "Type": "AWS::IAM::Role", "Properties": { "AssumeRolePolicyDocument": { "Statement": [ { "Action": "sts:AssumeRole", "Effect": "Allow", "Principal": { "Service": "lambda.amazonaws.com" } } ], "Version": "2012-10-17" }, "ManagedPolicyArns": [ { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":iam::aws:policy/service-role/AWSLambdaBasicExecutionRole" ] ] } ] }, "Metadata": { "aws:cdk:path": "ProactiveEventResponseStack/ProactiveEventResponseHelper/ServiceRole/Resource" } }, "ProactiveEventResponseHelper832C2385": { "Type": "AWS::Lambda::Function", "Properties": { "Code": { "S3Bucket": { "Fn::Sub": "solutions-${AWS::Region}" }, "S3Key": "automations-for-aws-firewall-manager/v2.1.4/asset852fd50470d347d6a7b8e31621ee885a742066ca057398823cc5f0f4c3566120.zip" }, "Description": { "Fn::Join": [ "", [ { "Fn::FindInMap": [ "ProactiveEventResponseStackMap", "Solution", "SolutionId" ] }, " - Function to help with Proactive Event Response installation (DO NOT DELETE)" ] ] }, "Environment": { "Variables": { "METRICS_ENDPOINT": { "Fn::FindInMap": [ "ProactiveEventResponseStackMap", "Metric", "MetricsEndpoint" ] }, "SEND_METRIC": { "Fn::FindInMap": [ "ProactiveEventResponseStackMap", "Metric", "SendAnonymizedMetric" ] }, "LOG_LEVEL": "info", "USER_AGENT_PREFIX": { "Fn::FindInMap": [ "ProactiveEventResponseStackMap", "Solution", "UserAgentPrefix" ] }, "SOLUTION_NAME": { "Fn::FindInMap": [ "ProactiveEventResponseStackMap", "Solution", "SolutionName" ] }, "SOLUTION_VERSION": { "Fn::FindInMap": [ "ProactiveEventResponseStackMap", "Solution", "SolutionVersion" ] }, "SOLUTION_ID": { "Fn::FindInMap": [ "ProactiveEventResponseStackMap", "Solution", "SolutionId" ] }, "SERVICE_NAME": { "Fn::FindInMap": [ "ProactiveEventResponseStackMap", "Solution", "SolutionName" ] } } }, "Handler": "index.handler", "Layers": [ { "Ref": "AFMUtilsLayerAFMUtilsLayerLayerB9CC38B4" } ], "MemorySize": 128, "Role": { "Fn::GetAtt": [ "ProactiveEventResponseHelperServiceRole83AF8B7A", "Arn" ] }, "Runtime": "nodejs22.x", "Timeout": 30 }, "DependsOn": [ "ProactiveEventResponseHelperServiceRole83AF8B7A" ], "Metadata": { "cfn_nag": { "rules_to_suppress": [ { "id": "W58", "reason": "CloudWatch logs write permissions added with managed role AWSLambdaBasicExecutionRole" }, { "id": "W89", "reason": "Not a valid use case for Lambda functions to be deployed inside a VPC" }, { "id": "W92", "reason": "Lambda ReservedConcurrentExecutions not needed" } ] } } }, "HelperPolicy0FF3AEE0": { "Type": "AWS::IAM::Policy", "Properties": { "PolicyDocument": { "Statement": [ { "Action": "shield:GetSubscriptionState", "Effect": "Allow", "Resource": "*", "Sid": "ShieldRead" }, { "Action": "support:DescribeSeverityLevels", "Effect": "Allow", "Resource": "*", "Sid": "SupportRead" } ], "Version": "2012-10-17" }, "PolicyName": "FMS-Shield-ProactiveEventResponse-Helper-Policy", "Roles": [ { "Ref": "ProactiveEventResponseHelperServiceRole83AF8B7A" } ] }, "Metadata": { "cfn_nag": { "rules_to_suppress": [ { "id": "W12", "reason": "Resource * is required for IAM actions that do not support resource level permissions" } ] } } }, "HelperProviderframeworkonEventServiceRole1962DD43": { "Type": "AWS::IAM::Role", "Properties": { "AssumeRolePolicyDocument": { "Statement": [ { "Action": "sts:AssumeRole", "Effect": "Allow", "Principal": { "Service": "lambda.amazonaws.com" } } ], "Version": "2012-10-17" }, "ManagedPolicyArns": [ { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":iam::aws:policy/service-role/AWSLambdaBasicExecutionRole" ] ] } ] }, "Metadata": { "aws:cdk:path": "ProactiveEventResponseStack/HelperProvider/framework-onEvent/ServiceRole/Resource" } }, "HelperProviderframeworkonEventServiceRoleDefaultPolicy7C54367B": { "Type": "AWS::IAM::Policy", "Properties": { "PolicyDocument": { "Statement": [ { "Action": "lambda:InvokeFunction", "Effect": "Allow", "Resource": [ { "Fn::GetAtt": [ "ProactiveEventResponseHelper832C2385", "Arn" ] }, { "Fn::Join": [ "", [ { "Fn::GetAtt": [ "ProactiveEventResponseHelper832C2385", "Arn" ] }, ":*" ] ] } ] }, { "Action": "lambda:GetFunction", "Effect": "Allow", "Resource": { "Fn::GetAtt": [ "ProactiveEventResponseHelper832C2385", "Arn" ] } } ], "Version": "2012-10-17" }, "PolicyName": "HelperProviderframeworkonEventServiceRoleDefaultPolicy7C54367B", "Roles": [ { "Ref": "HelperProviderframeworkonEventServiceRole1962DD43" } ] }, "Metadata": { "aws:cdk:path": "ProactiveEventResponseStack/HelperProvider/framework-onEvent/ServiceRole/DefaultPolicy/Resource" } }, "HelperProviderframeworkonEvent1079DE9D": { "Type": "AWS::Lambda::Function", "Properties": { "Code": { "S3Bucket": { "Fn::Sub": "solutions-${AWS::Region}" }, "S3Key": "automations-for-aws-firewall-manager/v2.1.4/assetbdc104ed9cab1b5b6421713c8155f0b753380595356f710400609664d3635eca.zip" }, "Description": "AWS CDK resource provider framework - onEvent (ProactiveEventResponseStack/HelperProvider)", "Environment": { "Variables": { "USER_ON_EVENT_FUNCTION_ARN": { "Fn::GetAtt": [ "ProactiveEventResponseHelper832C2385", "Arn" ] } } }, "Handler": "framework.onEvent", "LoggingConfig": { "ApplicationLogLevel": "FATAL", "LogFormat": "JSON" }, "Role": { "Fn::GetAtt": [ "HelperProviderframeworkonEventServiceRole1962DD43", "Arn" ] }, "Runtime": { "Fn::FindInMap": [ "LatestNodeRuntimeMap", { "Ref": "AWS::Region" }, "value" ] }, "Timeout": 900 }, "DependsOn": [ "HelperProviderframeworkonEventServiceRoleDefaultPolicy7C54367B", "HelperProviderframeworkonEventServiceRole1962DD43" ], "Metadata": { "cfn_nag": { "rules_to_suppress": [ { "id": "W58", "reason": "CloudWatch logs write permissions added with managed role AWSLambdaBasicExecutionRole" }, { "id": "W89", "reason": "Not a valid use case for Lambda functions to be deployed inside a VPC" }, { "id": "W92", "reason": "Lambda ReservedConcurrentExecutions not needed" } ] } } }, "ShieldSubscriptionCheck": { "Type": "Custom::ShieldSubscriptionCheck", "Properties": { "ServiceToken": { "Fn::GetAtt": [ "HelperProviderframeworkonEvent1079DE9D", "Arn" ] }, "Stack": "ProactiveEventResponseStack", "Account": { "Ref": "AWS::AccountId" }, "Region": { "Ref": "AWS::Region" } }, "UpdateReplacePolicy": "Delete", "DeletionPolicy": "Delete", "Metadata": { "aws:cdk:path": "ProactiveEventResponseStack/ShieldSubscriptionCheck/Default" } }, "SupportPlanCheck": { "Type": "Custom::SupportPlanCheck", "Properties": { "ServiceToken": { "Fn::GetAtt": [ "HelperProviderframeworkonEvent1079DE9D", "Arn" ] }, "Stack": "ProactiveEventResponseStack", "Account": { "Ref": "AWS::AccountId" }, "Region": { "Ref": "AWS::Region" } }, "UpdateReplacePolicy": "Delete", "DeletionPolicy": "Delete", "Metadata": { "aws:cdk:path": "ProactiveEventResponseStack/SupportPlanCheck/Default" } }, "ShieldProactiveEngagement": { "Type": "AWS::Shield::ProactiveEngagement", "Properties": { "EmergencyContactList": [ { "EmailAddress": { "Ref": "EmergencyContactEmail" }, "PhoneNumber": { "Ref": "EmergencyContactPhone" } } ], "ProactiveEngagementStatus": "ENABLED" }, "Metadata": { "aws:cdk:path": "ProactiveEventResponseStack/ShieldProactiveEngagement" } }, "srtRole3B7495C0": { "Type": "AWS::IAM::Role", "Properties": { "AssumeRolePolicyDocument": { "Statement": [ { "Action": "sts:AssumeRole", "Effect": "Allow", "Principal": { "Service": "drt.shield.amazonaws.com" } } ], "Version": "2012-10-17" }, "ManagedPolicyArns": [ { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":iam::aws:policy/service-role/AWSShieldDRTAccessPolicy" ] ] } ] }, "Metadata": { "aws:cdk:path": "ProactiveEventResponseStack/srtRole/Resource" }, "Condition": "enableSRTCheck" }, "ShieldGrantSRTAccess": { "Type": "AWS::Shield::DRTAccess", "Properties": { "RoleArn": { "Fn::GetAtt": [ "srtRole3B7495C0", "Arn" ] } }, "DependsOn": [ "srtRole3B7495C0" ], "Metadata": { "aws:cdk:path": "ProactiveEventResponseStack/ShieldGrantSRTAccess" }, "Condition": "enableSRTCheck" } } }