{ "Description": "(SO0134S) - The AWS CloudFormation template for deployment of the automations-for-aws-firewall-manager. Version v2.1.4", "AWSTemplateFormatVersion": "2010-09-09", "Mappings": { "ShieldAutomationsPrereqStackMap": { "Metric": { "SendAnonymizedMetric": "Yes", "MetricsEndpoint": "https://metrics.awssolutionsbuilder.com/generic" }, "Solution": { "SolutionId": "SO0134N", "SolutionName": "automations-for-aws-firewall-manager", "SolutionVersion": "v2.1.4", "UserAgentPrefix": "AwsSolution" }, "ShieldAutomationsPrereq": { "ConfigRuleEvalCrossAccountRole": "FMS-Shield-ConfigRuleEvalCrossAccount-Role", "ConfigRuleEvalExecutionRole": "FMS-Shield-ConfigRuleEvalExecution-Role", "ConfigRuleEvalCrossAccountPolicy": "FMS-Shield-ConfigRuleEvalCrossAccount-Policy", "ConfigRuleRemediateCrossAccountRole": "FMS-Shield-ConfigRuleRemediateCrossAccount-Role", "ConfigRuleRemediateExecutionRole": "FMS-Shield-ConfigRuleRemediateExecution-Role", "ConfigRuleRemediateCrossAccountPolicy": "FMS-Shield-ConfigRuleRemediateCrossAccount-Policy" } }, "LatestNodeRuntimeMap": { "af-south-1": { "value": "nodejs22.x" }, "ap-east-1": { "value": "nodejs22.x" }, "ap-east-2": { "value": "nodejs22.x" }, "ap-northeast-1": { "value": "nodejs22.x" }, "ap-northeast-2": { "value": "nodejs22.x" }, "ap-northeast-3": { "value": "nodejs22.x" }, "ap-south-1": { "value": "nodejs22.x" }, "ap-south-2": { "value": "nodejs22.x" }, "ap-southeast-1": { "value": "nodejs22.x" }, "ap-southeast-2": { "value": "nodejs22.x" }, "ap-southeast-3": { "value": "nodejs22.x" }, "ap-southeast-4": { "value": "nodejs22.x" }, "ap-southeast-5": { "value": "nodejs22.x" }, "ap-southeast-6": { "value": "nodejs22.x" }, "ap-southeast-7": { "value": "nodejs22.x" }, "ca-central-1": { "value": "nodejs22.x" }, "ca-west-1": { "value": "nodejs22.x" }, "cn-north-1": { "value": "nodejs22.x" }, "cn-northwest-1": { "value": "nodejs22.x" }, "eu-central-1": { "value": "nodejs22.x" }, "eu-central-2": { "value": "nodejs22.x" }, "eu-isoe-west-1": { "value": "nodejs22.x" }, "eu-north-1": { "value": "nodejs22.x" }, "eu-south-1": { "value": "nodejs22.x" }, "eu-south-2": { "value": "nodejs22.x" }, "eu-west-1": { "value": "nodejs22.x" }, "eu-west-2": { "value": "nodejs22.x" }, "eu-west-3": { "value": "nodejs22.x" }, "eusc-de-east-1": { "value": "nodejs22.x" }, "il-central-1": { "value": "nodejs22.x" }, "me-central-1": { "value": "nodejs22.x" }, "me-south-1": { "value": "nodejs22.x" }, "mx-central-1": { "value": "nodejs22.x" }, "sa-east-1": { "value": "nodejs22.x" }, "us-east-1": { "value": "nodejs22.x" }, "us-east-2": { "value": "nodejs22.x" }, "us-gov-east-1": { "value": "nodejs22.x" }, "us-gov-west-1": { "value": "nodejs22.x" }, "us-iso-east-1": { "value": "nodejs22.x" }, "us-iso-west-1": { "value": "nodejs22.x" }, "us-isob-east-1": { "value": "nodejs18.x" }, "us-isob-west-1": { "value": "nodejs18.x" }, "us-isof-east-1": { "value": "nodejs22.x" }, "us-isof-south-1": { "value": "nodejs22.x" }, "us-west-1": { "value": "nodejs22.x" }, "us-west-2": { "value": "nodejs22.x" } } }, "Resources": { "AFMUtilsLayerAFMUtilsLayerLayerB9CC38B4": { "Type": "AWS::Lambda::LayerVersion", "Properties": { "CompatibleRuntimes": [ "nodejs22.x" ], "Content": { "S3Bucket": { "Fn::Sub": "solutions-${AWS::Region}" }, "S3Key": "automations-for-aws-firewall-manager/v2.1.4/asset7be93b6c0ec014c96d856a4450cde0aa9740ecb359bc80295f9c57410cc0dc5c.zip" }, "LayerName": "AFM-UtilsLayer" }, "Metadata": { "aws:cdk:path": "ShieldAutomationsPrereqStack/AFM-UtilsLayer/AFM-UtilsLayer-Layer/Resource", "aws:asset:path": "asset.7be93b6c0ec014c96d856a4450cde0aa9740ecb359bc80295f9c57410cc0dc5c.zip", "aws:asset:is-bundled": false, "aws:asset:property": "Content" } }, "ShieldAutomationsPrereqHelperServiceRoleE69B390A": { "Type": "AWS::IAM::Role", "Properties": { "AssumeRolePolicyDocument": { "Statement": [ { "Action": "sts:AssumeRole", "Effect": "Allow", "Principal": { "Service": "lambda.amazonaws.com" } } ], "Version": "2012-10-17" }, "ManagedPolicyArns": [ { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":iam::aws:policy/service-role/AWSLambdaBasicExecutionRole" ] ] } ] }, "Metadata": { "aws:cdk:path": "ShieldAutomationsPrereqStack/ShieldAutomationsPrereqHelper/ServiceRole/Resource" } }, "ShieldAutomationsPrereqHelperF6FDCA53": { "Type": "AWS::Lambda::Function", "Properties": { "Code": { "S3Bucket": { "Fn::Sub": "solutions-${AWS::Region}" }, "S3Key": "automations-for-aws-firewall-manager/v2.1.4/asset852fd50470d347d6a7b8e31621ee885a742066ca057398823cc5f0f4c3566120.zip" }, "Description": { "Fn::Join": [ "", [ { "Fn::FindInMap": [ "ShieldAutomationsPrereqStackMap", "Solution", "SolutionId" ] }, " - Function to help with ShieldAutomationsPrereq installation (DO NOT DELETE)" ] ] }, "Environment": { "Variables": { "METRICS_ENDPOINT": { "Fn::FindInMap": [ "ShieldAutomationsPrereqStackMap", "Metric", "MetricsEndpoint" ] }, "SEND_METRIC": { "Fn::FindInMap": [ "ShieldAutomationsPrereqStackMap", "Metric", "SendAnonymizedMetric" ] }, "LOG_LEVEL": "info", "USER_AGENT_PREFIX": { "Fn::FindInMap": [ "ShieldAutomationsPrereqStackMap", "Solution", "UserAgentPrefix" ] }, "SOLUTION_NAME": { "Fn::FindInMap": [ "ShieldAutomationsPrereqStackMap", "Solution", "SolutionName" ] }, "SOLUTION_VERSION": { "Fn::FindInMap": [ "ShieldAutomationsPrereqStackMap", "Solution", "SolutionVersion" ] }, "SOLUTION_ID": { "Fn::FindInMap": [ "ShieldAutomationsPrereqStackMap", "Solution", "SolutionId" ] }, "SERVICE_NAME": { "Fn::FindInMap": [ "ShieldAutomationsPrereqStackMap", "Solution", "SolutionName" ] } } }, "Handler": "index.handler", "Layers": [ { "Ref": "AFMUtilsLayerAFMUtilsLayerLayerB9CC38B4" } ], "MemorySize": 128, "Role": { "Fn::GetAtt": [ "ShieldAutomationsPrereqHelperServiceRoleE69B390A", "Arn" ] }, "Runtime": "nodejs22.x", "Timeout": 30 }, "DependsOn": [ "ShieldAutomationsPrereqHelperServiceRoleE69B390A" ], "Metadata": { "cfn_nag": { "rules_to_suppress": [ { "id": "W58", "reason": "CloudWatch logs write permissions added with managed role AWSLambdaBasicExecutionRole" }, { "id": "W89", "reason": "Not a valid use case for Lambda functions to be deployed inside a VPC" }, { "id": "W92", "reason": "Lambda ReservedConcurrentExecutions not needed" } ] } } }, "HelperPolicy0FF3AEE0": { "Type": "AWS::IAM::Policy", "Properties": { "PolicyDocument": { "Statement": [ { "Action": "organizations:DescribeOrganization", "Effect": "Allow", "Resource": "*", "Sid": "OrgRead" } ], "Version": "2012-10-17" }, "PolicyName": "FMS-Shield-Prereq-Helper-Policy", "Roles": [ { "Ref": "ShieldAutomationsPrereqHelperServiceRoleE69B390A" } ] }, "Metadata": { "cfn_nag": { "rules_to_suppress": [ { "id": "W12", "reason": "Resource * is required for IAM actions that do not support resource level permissions" } ] } } }, "HelperProviderframeworkonEventServiceRole1962DD43": { "Type": "AWS::IAM::Role", "Properties": { "AssumeRolePolicyDocument": { "Statement": [ { "Action": "sts:AssumeRole", "Effect": "Allow", "Principal": { "Service": "lambda.amazonaws.com" } } ], "Version": "2012-10-17" }, "ManagedPolicyArns": [ { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":iam::aws:policy/service-role/AWSLambdaBasicExecutionRole" ] ] } ] }, "Metadata": { "aws:cdk:path": "ShieldAutomationsPrereqStack/HelperProvider/framework-onEvent/ServiceRole/Resource" } }, "HelperProviderframeworkonEventServiceRoleDefaultPolicy7C54367B": { "Type": "AWS::IAM::Policy", "Properties": { "PolicyDocument": { "Statement": [ { "Action": "lambda:InvokeFunction", "Effect": "Allow", "Resource": [ { "Fn::GetAtt": [ "ShieldAutomationsPrereqHelperF6FDCA53", "Arn" ] }, { "Fn::Join": [ "", [ { "Fn::GetAtt": [ "ShieldAutomationsPrereqHelperF6FDCA53", "Arn" ] }, ":*" ] ] } ] }, { "Action": "lambda:GetFunction", "Effect": "Allow", "Resource": { "Fn::GetAtt": [ "ShieldAutomationsPrereqHelperF6FDCA53", "Arn" ] } } ], "Version": "2012-10-17" }, "PolicyName": "HelperProviderframeworkonEventServiceRoleDefaultPolicy7C54367B", "Roles": [ { "Ref": "HelperProviderframeworkonEventServiceRole1962DD43" } ] }, "Metadata": { "aws:cdk:path": "ShieldAutomationsPrereqStack/HelperProvider/framework-onEvent/ServiceRole/DefaultPolicy/Resource" } }, "HelperProviderframeworkonEvent1079DE9D": { "Type": "AWS::Lambda::Function", "Properties": { "Code": { "S3Bucket": { "Fn::Sub": "solutions-${AWS::Region}" }, "S3Key": "automations-for-aws-firewall-manager/v2.1.4/assetbdc104ed9cab1b5b6421713c8155f0b753380595356f710400609664d3635eca.zip" }, "Description": "AWS CDK resource provider framework - onEvent (ShieldAutomationsPrereqStack/HelperProvider)", "Environment": { "Variables": { "USER_ON_EVENT_FUNCTION_ARN": { "Fn::GetAtt": [ "ShieldAutomationsPrereqHelperF6FDCA53", "Arn" ] } } }, "Handler": "framework.onEvent", "LoggingConfig": { "ApplicationLogLevel": "FATAL", "LogFormat": "JSON" }, "Role": { "Fn::GetAtt": [ "HelperProviderframeworkonEventServiceRole1962DD43", "Arn" ] }, "Runtime": { "Fn::FindInMap": [ "LatestNodeRuntimeMap", { "Ref": "AWS::Region" }, "value" ] }, "Timeout": 900 }, "DependsOn": [ "HelperProviderframeworkonEventServiceRoleDefaultPolicy7C54367B", "HelperProviderframeworkonEventServiceRole1962DD43" ], "Metadata": { "cfn_nag": { "rules_to_suppress": [ { "id": "W58", "reason": "CloudWatch logs write permissions added with managed role AWSLambdaBasicExecutionRole" }, { "id": "W89", "reason": "Not a valid use case for Lambda functions to be deployed inside a VPC" }, { "id": "W92", "reason": "Lambda ReservedConcurrentExecutions not needed" } ] } } }, "DescribeOrganization": { "Type": "Custom::DescribeOrganization", "Properties": { "ServiceToken": { "Fn::GetAtt": [ "HelperProviderframeworkonEvent1079DE9D", "Arn" ] } }, "UpdateReplacePolicy": "Delete", "DeletionPolicy": "Delete", "Metadata": { "aws:cdk:path": "ShieldAutomationsPrereqStack/DescribeOrganization/Default" } }, "FMSShieldConfigRuleEvalCrossAccountRoleE78EF1B3": { "Type": "AWS::IAM::Role", "Properties": { "AssumeRolePolicyDocument": { "Statement": [ { "Action": "sts:AssumeRole", "Condition": { "StringEquals": { "aws:PrincipalOrgID": { "Fn::GetAtt": [ "DescribeOrganization", "organizationId" ] } } }, "Effect": "Allow", "Principal": { "AWS": "*" } } ], "Version": "2012-10-17" }, "Description": "IAM Role to be assumed by the ConfigRuleEval lambda created by ShieldAutomations stack.", "ManagedPolicyArns": [ { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":iam::aws:policy/service-role/AWSConfigRulesExecutionRole" ] ] } ], "RoleName": { "Fn::FindInMap": [ "ShieldAutomationsPrereqStackMap", "ShieldAutomationsPrereq", "ConfigRuleEvalCrossAccountRole" ] } }, "Metadata": { "cfn_nag": { "rules_to_suppress": [ { "id": "W28", "reason": "Role name is required for cross-account role assumption" } ] }, "guard": { "SuppressedRules": [ "CFN_NO_EXPLICIT_RESOURCE_NAMES" ] } } }, "FMSShieldConfigRuleEvalCrossAccountPolicy346B953B": { "Type": "AWS::IAM::Policy", "Properties": { "PolicyDocument": { "Statement": [ { "Action": [ "config:DescribeConfigRuleEvaluationStatus", "config:DescribeComplianceByResource" ], "Effect": "Allow", "Resource": "*", "Sid": "ConfigRead" }, { "Action": "shield:DescribeProtection", "Effect": "Allow", "Resource": { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":shield::", { "Ref": "AWS::AccountId" }, ":protection/*" ] ] }, "Sid": "ShieldRead" }, { "Action": [ "ec2:DescribeAddresses", "ec2:DescribeNetworkInterfaces" ], "Effect": "Allow", "Resource": "*", "Sid": "EC2Read" } ], "Version": "2012-10-17" }, "PolicyName": { "Fn::FindInMap": [ "ShieldAutomationsPrereqStackMap", "ShieldAutomationsPrereq", "ConfigRuleEvalCrossAccountPolicy" ] }, "Roles": [ { "Ref": "FMSShieldConfigRuleEvalCrossAccountRoleE78EF1B3" } ] }, "Metadata": { "cfn_nag": { "rules_to_suppress": [ { "id": "W12", "reason": "Resource * is required for IAM actions that do not support resource level permissions" } ] } } }, "FMSShieldConfigRuleRemediateCrossAccountRoleAA795E1D": { "Type": "AWS::IAM::Role", "Properties": { "AssumeRolePolicyDocument": { "Statement": [ { "Action": "sts:AssumeRole", "Condition": { "StringEquals": { "aws:PrincipalOrgID": { "Fn::GetAtt": [ "DescribeOrganization", "organizationId" ] } } }, "Effect": "Allow", "Principal": { "AWS": "*" } } ], "Version": "2012-10-17" }, "Description": "IAM Role to be assumed by the ConfigRuleRemediate lambda created by ShieldAutomations stack.", "RoleName": { "Fn::FindInMap": [ "ShieldAutomationsPrereqStackMap", "ShieldAutomationsPrereq", "ConfigRuleRemediateCrossAccountRole" ] } }, "Metadata": { "cfn_nag": { "rules_to_suppress": [ { "id": "W28", "reason": "Role name is required for cross-account role assumption" } ] }, "guard": { "SuppressedRules": [ "CFN_NO_EXPLICIT_RESOURCE_NAMES" ] } } }, "FMSShieldConfigRuleRemediateCrossAccountPolicy309D63FE": { "Type": "AWS::IAM::Policy", "Properties": { "PolicyDocument": { "Statement": [ { "Action": "shield:AssociateHealthCheck", "Effect": "Allow", "Resource": { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":shield::", { "Ref": "AWS::AccountId" }, ":protection/*" ] ] }, "Sid": "ShieldWrite" }, { "Action": "route53:CreateHealthCheck", "Effect": "Allow", "Resource": "*", "Sid": "Route53Create" }, { "Action": "elasticloadbalancing:DescribeLoadBalancers", "Effect": "Allow", "Resource": "*", "Sid": "ELBRead" }, { "Action": "cloudfront:GetDistribution", "Effect": "Allow", "Resource": { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":cloudfront::", { "Ref": "AWS::AccountId" }, ":distribution/*" ] ] }, "Sid": "CFRead" }, { "Action": [ "cloudwatch:PutMetricAlarm", "cloudwatch:DeleteAlarms" ], "Effect": "Allow", "Resource": { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":cloudwatch:*:", { "Ref": "AWS::AccountId" }, ":alarm:*" ] ] }, "Sid": "CloudWatchWrite" }, { "Action": "route53:GetHealthCheck", "Effect": "Allow", "Resource": { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":route53:::healthcheck/*" ] ] }, "Sid": "Route53Read" }, { "Action": [ "route53:UpdateHealthCheck", "route53:DeleteHealthCheck" ], "Effect": "Allow", "Resource": { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":route53:::healthcheck/*" ] ] }, "Sid": "Route53Write" }, { "Action": "cloudwatch:DescribeAlarms", "Effect": "Allow", "Resource": { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":cloudwatch:*:", { "Ref": "AWS::AccountId" }, ":alarm:*" ] ] }, "Sid": "CloudWatchRead" }, { "Action": "shield:DescribeProtection", "Effect": "Allow", "Resource": { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":shield::", { "Ref": "AWS::AccountId" }, ":protection/*" ] ] }, "Sid": "ShieldRead" }, { "Action": [ "ec2:DescribeAddresses", "ec2:DescribeNetworkInterfaces" ], "Effect": "Allow", "Resource": "*", "Sid": "EC2Read" } ], "Version": "2012-10-17" }, "PolicyName": { "Fn::FindInMap": [ "ShieldAutomationsPrereqStackMap", "ShieldAutomationsPrereq", "ConfigRuleRemediateCrossAccountPolicy" ] }, "Roles": [ { "Ref": "FMSShieldConfigRuleRemediateCrossAccountRoleAA795E1D" } ] }, "Metadata": { "cfn_nag": { "rules_to_suppress": [ { "id": "W12", "reason": "Resource * is required for IAM actions that do not support resource level permissions" }, { "id": "W76", "reason": "All permissions required for lambda execution" } ] } } } } }