{ "Description": "(SO0023) - Dynamic Image Transformation for Amazon CloudFront. Version v8.0.5", "Metadata": { "AWS::CloudFormation::Interface": { "ParameterGroups": [ { "Label": { "default": "S3 Object Lambda" }, "Parameters": [ "EnableS3ObjectLambdaParameter" ] }, { "Label": { "default": "CORS Options" }, "Parameters": [ "CorsEnabledParameter", "CorsOriginParameter" ] }, { "Label": { "default": "Image Sources" }, "Parameters": [ "SourceBucketsParameter" ] }, { "Label": { "default": "Demo UI" }, "Parameters": [ "DeployDemoUIParameter" ] }, { "Label": { "default": "Event Logging" }, "Parameters": [ "LogRetentionPeriodParameter" ] }, { "Label": { "default": "Image URL Signature (Note: Enabling signature is not compatible with previous image URLs, which could result in broken image links. Please refer to the implementation guide for details: https://docs.aws.amazon.com/solutions/latest/serverless-image-handler/architecture-details.html#image-url-signature)" }, "Parameters": [ "EnableSignatureParameter", "SecretsManagerSecretParameter", "SecretsManagerKeyParameter" ] }, { "Label": { "default": "Default Fallback Image (Note: Enabling default fallback image returns the default fallback image instead of JSON object when error happens. Please refer to the implementation guide for details: https://docs.aws.amazon.com/solutions/latest/serverless-image-handler/architecture-details.html#default-fallback-image)" }, "Parameters": [ "EnableDefaultFallbackImageParameter", "FallbackImageS3BucketParameter", "FallbackImageS3KeyParameter" ] }, { "Label": { "default": "Auto WebP" }, "Parameters": [ "AutoWebPParameter" ] }, { "Label": { "default": "CloudFront" }, "Parameters": [ "OriginShieldRegionParameter", "CloudFrontPriceClassParameter", "UseExistingCloudFrontDistributionParameter", "ExistingCloudFrontDistributionIdParameter" ] } ], "ParameterLabels": { "EnableS3ObjectLambdaParameter": { "default": "Enable S3 Object Lambda (DEPRECATED)" }, "CorsEnabledParameter": { "default": "CORS Enabled" }, "CorsOriginParameter": { "default": "CORS Origin" }, "SourceBucketsParameter": { "default": "Source Buckets" }, "DeployDemoUIParameter": { "default": "Deploy Demo UI" }, "LogRetentionPeriodParameter": { "default": "Log Retention Period" }, "AutoWebPParameter": { "default": "AutoWebP" }, "EnableSignatureParameter": { "default": "Enable Signature" }, "SecretsManagerSecretParameter": { "default": "SecretsManager Secret" }, "SecretsManagerKeyParameter": { "default": "SecretsManager Key" }, "EnableDefaultFallbackImageParameter": { "default": "Enable Default Fallback Image" }, "FallbackImageS3BucketParameter": { "default": "Fallback Image S3 Bucket" }, "FallbackImageS3KeyParameter": { "default": "Fallback Image S3 Key" }, "CloudFrontPriceClassParameter": { "default": "CloudFront PriceClass" }, "OriginShieldRegionParameter": { "default": "Origin Shield Region" }, "UseExistingCloudFrontDistributionParameter": { "default": "Use Existing CloudFront Distribution" }, "ExistingCloudFrontDistributionIdParameter": { "default": "Existing CloudFront Distribution Id" } } } }, "Parameters": { "CorsEnabledParameter": { "Type": "String", "Default": "No", "AllowedValues": [ "Yes", "No" ], "Description": "Would you like to enable Cross-Origin Resource Sharing (CORS) for the image handler API? Select 'Yes' if so." }, "CorsOriginParameter": { "Type": "String", "Default": "*", "Description": "If you selected 'Yes' above, please specify an origin value here. A wildcard (*) value will support any origin. We recommend specifying an origin (i.e. https://example.domain) to restrict cross-site access to your API." }, "SourceBucketsParameter": { "Type": "String", "AllowedPattern": "^[a-z0-9][a-z0-9.-]{1,61}[a-z0-9](?:\\s*,\\s*[a-z0-9][a-z0-9.-]{1,61}[a-z0-9])*$", "ConstraintDescription": "Source bucket is required. Please provide at least one valid S3 bucket name that is present in your account.", "Description": "(Required) List the buckets (comma-separated) within your account that contain original image files. If you plan to use Thumbor or Custom image requests with this solution, the source bucket for those requests will default to the first bucket listed in this field. e.g. (defaultBucket,bucketNo2,bucketNo3,...)" }, "DeployDemoUIParameter": { "Type": "String", "Default": "Yes", "AllowedValues": [ "Yes", "No" ], "Description": "Would you like to deploy a demo UI to explore the features and capabilities of this solution? This will create an additional Amazon S3 bucket and Amazon CloudFront distribution in your account." }, "LogRetentionPeriodParameter": { "Type": "String", "Default": "180", "AllowedValues": [ "1", "3", "5", "7", "14", "30", "60", "90", "120", "150", "180", "365", "400", "545", "731", "1827", "3653", "Infinite" ], "Description": "This solution automatically logs events to Amazon CloudWatch. Select the amount of time for CloudWatch logs from this solution to be retained (in days)." }, "AutoWebPParameter": { "Type": "String", "Default": "No", "AllowedValues": [ "Yes", "No" ], "Description": "Would you like to enable automatic formatting to WebP images when accept headers include \"image/webp\"? Select 'Yes' if so." }, "EnableSignatureParameter": { "Type": "String", "Default": "No", "AllowedValues": [ "Yes", "No" ], "Description": "Would you like to enable the signature? If so, select 'Yes' and provide SecretsManagerSecret and SecretsManagerKey values." }, "SecretsManagerSecretParameter": { "Type": "String", "Default": "", "Description": "The name of AWS Secrets Manager secret. You need to create your secret under this name." }, "SecretsManagerKeyParameter": { "Type": "String", "Default": "", "Description": "The name of AWS Secrets Manager secret key. You need to create secret key with this key name. The secret value would be used to check signature." }, "EnableDefaultFallbackImageParameter": { "Type": "String", "Default": "No", "AllowedValues": [ "Yes", "No" ], "Description": "Would you like to enable the default fallback image? If so, select 'Yes' and provide FallbackImageS3Bucket and FallbackImageS3Key values." }, "FallbackImageS3BucketParameter": { "Type": "String", "Default": "", "Description": "The name of the Amazon S3 bucket which contains the default fallback image. e.g. my-fallback-image-bucket" }, "FallbackImageS3KeyParameter": { "Type": "String", "Default": "", "Description": "The name of the default fallback image object key including prefix. e.g. prefix/image.jpg" }, "CloudFrontPriceClassParameter": { "Type": "String", "Default": "PriceClass_All", "AllowedValues": [ "PriceClass_All", "PriceClass_200", "PriceClass_100" ], "Description": "The AWS CloudFront price class to use. Lower price classes will avoid high cost edge locations, reducing cost at the expense of possibly increasing request latency. For more information see: https://docs.aws.amazon.com/cdk/api/v2/python/aws_cdk.aws_cloudfront/PriceClass.html" }, "OriginShieldRegionParameter": { "Type": "String", "Default": "Disabled", "AllowedValues": [ "Disabled", "us-east-1", "us-east-2", "us-west-2", "ap-south-1", "ap-northeast-1", "ap-southeast-1", "ap-southeast-2", "ap-northeast-1", "eu-central-1", "eu-west-1", "eu-west-2", "sa-east-1" ], "Description": "Enabling Origin Shield may see reduced latency and increased cache hit ratios if your requests often come from many regions. If a region is selected, Origin Shield will be enabled and the Origin Shield caching layer will be set up in that region. For information on choosing a region, see https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/origin-shield.html#choose-origin-shield-region" }, "EnableS3ObjectLambdaParameter": { "Type": "String", "Default": "No", "AllowedValues": [ "Yes", "No" ], "Description": "Deprecated: This option has been deprecated. Amazon S3 Object Lambda will no longer be open to new customers starting on November 7, 2025. If you were not an existing user of S3 Object Lambda before November 7, 2025, select 'No'. For more information, please visit https://docs.aws.amazon.com/AmazonS3/latest/userguide/amazons3-ol-change.html. **Important: Modifying this value after initial template deployment will delete the existing CloudFront Distribution and create a new one, providing a new domain name and clearing the cache**." }, "UseExistingCloudFrontDistributionParameter": { "Type": "String", "Default": "No", "AllowedValues": [ "Yes", "No" ], "Description": "If you would like to use an existing CloudFront distribution, select 'Yes'. Otherwise, select 'No' to create a new CloudFront distribution. This option will require additional manual setup after deployment. Please refer to the implementation guide for details: https://docs.aws.amazon.com/solutions/latest/serverless-image-handler/attaching-existing-distribution.html" }, "ExistingCloudFrontDistributionIdParameter": { "Type": "String", "Default": "", "AllowedPattern": "^$|^E[A-Z0-9]{8,}$", "Description": "The ID of the existing CloudFront distribution. This parameter is required if 'Use Existing CloudFront Distribution' is set to 'Yes'." } }, "Rules": { "ExistingDistributionIdRequiredRule": { "RuleCondition": { "Fn::Equals": [ { "Ref": "UseExistingCloudFrontDistributionParameter" }, "Yes" ] }, "Assertions": [ { "Assert": { "Fn::Not": [ { "Fn::Equals": [ { "Ref": "ExistingCloudFrontDistributionIdParameter" }, "" ] } ] }, "AssertDescription": "If 'UseExistingCloudFrontDistribution' is set to 'Yes', 'ExistingCloudFrontDistributionId' must be provided." } ] } }, "Mappings": { "Solution": { "Config": { "AnonymousUsage": "Yes", "DeployCloudWatchDashboard": "Yes", "SolutionId": "SO0023", "Version": "v8.0.5", "SharpSizeLimit": "" } } }, "Conditions": { "SendAnonymousStatistics": { "Fn::Equals": [ { "Fn::FindInMap": [ "Solution", "Config", "AnonymousUsage" ] }, "Yes" ] }, "DeployCloudWatchDashboard": { "Fn::Equals": [ { "Fn::FindInMap": [ "Solution", "Config", "DeployCloudWatchDashboard" ] }, "Yes" ] }, "CommonResourcesDeployDemoUICondition308D3B09": { "Fn::Equals": [ { "Ref": "DeployDemoUIParameter" }, "Yes" ] }, "CommonResourcesEnableSignatureCondition909DC7A1": { "Fn::Equals": [ { "Ref": "EnableSignatureParameter" }, "Yes" ] }, "CommonResourcesEnableDefaultFallbackImageConditionD1A10983": { "Fn::Equals": [ { "Ref": "EnableDefaultFallbackImageParameter" }, "Yes" ] }, "CommonResourcesEnableCorsConditionA0615348": { "Fn::Equals": [ { "Ref": "CorsEnabledParameter" }, "Yes" ] }, "CommonResourcesAutoWebPCondition7119C768": { "Fn::Equals": [ { "Ref": "AutoWebPParameter" }, "Yes" ] }, "CommonResourcesEnableOriginShieldConditionCEE94847": { "Fn::Not": [ { "Fn::Equals": [ { "Ref": "OriginShieldRegionParameter" }, "Disabled" ] } ] }, "CommonResourcesEnableS3ObjectLambdaConditionF2C07DCD": { "Fn::Equals": [ { "Ref": "EnableS3ObjectLambdaParameter" }, "Yes" ] }, "CommonResourcesDisableS3ObjectLambdaCondition017AC33C": { "Fn::Not": [ { "Fn::Equals": [ { "Ref": "EnableS3ObjectLambdaParameter" }, "Yes" ] } ] }, "CommonResourcesIsLogRetentionPeriodInfinite129C8A82": { "Fn::Equals": [ { "Ref": "LogRetentionPeriodParameter" }, "Infinite" ] }, "CommonResourcesUseExistingCloudFrontDistributionConditionEBC48184": { "Fn::Equals": [ { "Ref": "UseExistingCloudFrontDistributionParameter" }, "Yes" ] }, "BackEndDeployAPIGDistributionF4E75280": { "Fn::And": [ { "Condition": "CommonResourcesDisableS3ObjectLambdaCondition017AC33C" }, { "Fn::Not": [ { "Condition": "CommonResourcesUseExistingCloudFrontDistributionConditionEBC48184" } ] } ] }, "BackEndDeployS3OLDistribution869FCC7C": { "Fn::And": [ { "Condition": "CommonResourcesEnableS3ObjectLambdaConditionF2C07DCD" }, { "Fn::Not": [ { "Condition": "CommonResourcesUseExistingCloudFrontDistributionConditionEBC48184" } ] } ] }, "BackEndShortLogRetentionCondition72EA1A33": { "Fn::Or": [ { "Fn::Equals": [ { "Ref": "LogRetentionPeriodParameter" }, "1" ] }, { "Fn::Equals": [ { "Ref": "LogRetentionPeriodParameter" }, "3" ] }, { "Fn::Equals": [ { "Ref": "LogRetentionPeriodParameter" }, "5" ] } ] }, "CDKMetadataAvailable": { "Fn::Or": [ { "Fn::Or": [ { "Fn::Equals": [ { "Ref": "AWS::Region" }, "af-south-1" ] }, { "Fn::Equals": [ { "Ref": "AWS::Region" }, "ap-east-1" ] }, { "Fn::Equals": [ { "Ref": "AWS::Region" }, "ap-northeast-1" ] }, { "Fn::Equals": [ { "Ref": "AWS::Region" }, "ap-northeast-2" ] }, { "Fn::Equals": [ { "Ref": "AWS::Region" }, "ap-northeast-3" ] }, { "Fn::Equals": [ { "Ref": "AWS::Region" }, "ap-south-1" ] }, { "Fn::Equals": [ { "Ref": "AWS::Region" }, "ap-south-2" ] }, { "Fn::Equals": [ { "Ref": "AWS::Region" }, "ap-southeast-1" ] }, { "Fn::Equals": [ { "Ref": "AWS::Region" }, "ap-southeast-2" ] }, { "Fn::Equals": [ { "Ref": "AWS::Region" }, "ap-southeast-3" ] } ] }, { "Fn::Or": [ { "Fn::Equals": [ { "Ref": "AWS::Region" }, "ap-southeast-4" ] }, { "Fn::Equals": [ { "Ref": "AWS::Region" }, "ca-central-1" ] }, { "Fn::Equals": [ { "Ref": "AWS::Region" }, "ca-west-1" ] }, { "Fn::Equals": [ { "Ref": "AWS::Region" }, "cn-north-1" ] }, { "Fn::Equals": [ { "Ref": "AWS::Region" }, "cn-northwest-1" ] }, { "Fn::Equals": [ { "Ref": "AWS::Region" }, "eu-central-1" ] }, { "Fn::Equals": [ { "Ref": "AWS::Region" }, "eu-central-2" ] }, { "Fn::Equals": [ { "Ref": "AWS::Region" }, "eu-north-1" ] }, { "Fn::Equals": [ { "Ref": "AWS::Region" }, "eu-south-1" ] }, { "Fn::Equals": [ { "Ref": "AWS::Region" }, "eu-south-2" ] } ] }, { "Fn::Or": [ { "Fn::Equals": [ { "Ref": "AWS::Region" }, "eu-west-1" ] }, { "Fn::Equals": [ { "Ref": "AWS::Region" }, "eu-west-2" ] }, { "Fn::Equals": [ { "Ref": "AWS::Region" }, "eu-west-3" ] }, { "Fn::Equals": [ { "Ref": "AWS::Region" }, "il-central-1" ] }, { "Fn::Equals": [ { "Ref": "AWS::Region" }, "me-central-1" ] }, { "Fn::Equals": [ { "Ref": "AWS::Region" }, "me-south-1" ] }, { "Fn::Equals": [ { "Ref": "AWS::Region" }, "sa-east-1" ] }, { "Fn::Equals": [ { "Ref": "AWS::Region" }, "us-east-1" ] }, { "Fn::Equals": [ { "Ref": "AWS::Region" }, "us-east-2" ] }, { "Fn::Equals": [ { "Ref": "AWS::Region" }, "us-west-1" ] } ] }, { "Fn::Equals": [ { "Ref": "AWS::Region" }, "us-west-2" ] } ] } }, "Resources": { "CommonResourcesSecretsManagerPolicy45FE005E": { "Type": "AWS::IAM::Policy", "Properties": { "PolicyDocument": { "Statement": [ { "Action": "secretsmanager:GetSecretValue", "Effect": "Allow", "Resource": { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":secretsmanager:", { "Ref": "AWS::Region" }, ":", { "Ref": "AWS::AccountId" }, ":secret:", { "Ref": "SecretsManagerSecretParameter" }, "*" ] ] } } ], "Version": "2012-10-17" }, "PolicyName": "CommonResourcesSecretsManagerPolicy45FE005E", "Roles": [ { "Ref": "CommonResourcesCustomResourcesCustomResourceRole8958A1ED" }, { "Ref": "BackEndImageHandlerFunctionRoleABF81E5C" } ] }, "Metadata": { "aws:cdk:path": "v7-Stack/CommonResources/SecretsManagerPolicy/Resource" }, "Condition": "CommonResourcesEnableSignatureCondition909DC7A1" }, "CommonResourcesCustomResourcesCustomResourceRole8958A1ED": { "Type": "AWS::IAM::Role", "Properties": { "AssumeRolePolicyDocument": { "Statement": [ { "Action": "sts:AssumeRole", "Effect": "Allow", "Principal": { "Service": "lambda.amazonaws.com" } } ], "Version": "2012-10-17" }, "Path": "/", "Policies": [ { "PolicyDocument": { "Statement": [ { "Action": [ "logs:CreateLogGroup", "logs:CreateLogStream", "logs:PutLogEvents" ], "Effect": "Allow", "Resource": { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":logs:", { "Ref": "AWS::Region" }, ":", { "Ref": "AWS::AccountId" }, ":log-group:/aws/lambda/*" ] ] } } ], "Version": "2012-10-17" }, "PolicyName": "CloudWatchLogsPolicy" }, { "PolicyDocument": { "Statement": [ { "Action": [ "s3:ListBucket", "s3:GetBucketLocation" ], "Effect": "Allow", "Resource": { "Fn::Split": [ ",", { "Fn::Sub": [ "arn:aws:s3:::${rest}", { "rest": { "Fn::Join": [ ",arn:aws:s3:::", { "Fn::Split": [ ",", { "Fn::Join": [ "", { "Fn::Split": [ " ", { "Ref": "SourceBucketsParameter" } ] } ] } ] } ] } } ] } ] } }, { "Action": "s3:GetObject", "Effect": "Allow", "Resource": { "Fn::Join": [ "", [ "arn:aws:s3:::", { "Ref": "FallbackImageS3BucketParameter" }, "/", { "Ref": "FallbackImageS3KeyParameter" } ] ] } }, { "Action": [ "s3:putBucketAcl", "s3:putEncryptionConfiguration", "s3:putBucketPolicy", "s3:CreateBucket", "s3:PutBucketOwnershipControls", "s3:PutBucketTagging", "s3:PutBucketVersioning" ], "Effect": "Allow", "Resource": { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":s3:::*" ] ] } }, { "Action": "s3:ListBucket", "Effect": "Allow", "Resource": "arn:aws:s3:::sih-dummy-*" } ], "Version": "2012-10-17" }, "PolicyName": "S3AccessPolicy" }, { "PolicyDocument": { "Statement": [ { "Action": "ec2:DescribeRegions", "Effect": "Allow", "Resource": "*" } ], "Version": "2012-10-17" }, "PolicyName": "EC2Policy" }, { "PolicyDocument": { "Statement": [ { "Action": "cloudfront:GetDistribution", "Effect": "Allow", "Resource": { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":cloudfront::", { "Ref": "AWS::AccountId" }, ":distribution/", { "Ref": "ExistingCloudFrontDistributionIdParameter" } ] ] } } ], "Version": "2012-10-17" }, "PolicyName": "ExistingDistributionPolicy" } ], "Tags": [ { "Key": "SolutionId", "Value": "SO0023" } ] }, "Metadata": { "aws:cdk:path": "v7-Stack/CommonResources/CustomResources/CustomResourceRole/Resource", "cfn_nag": { "rules_to_suppress": [ { "id": "W11", "reason": "Allow '*' because it is required for making DescribeRegions API call as it doesn't support resource-level permissions and require to choose all resources." }, { "id": "F10", "reason": "Using inline policy" } ] } } }, "CommonResourcesCustomResourcesCustomResourceFunction0D924235": { "Type": "AWS::Lambda::Function", "Properties": { "Code": { "S3Bucket": { "Fn::Sub": "solutions-${AWS::Region}" }, "S3Key": "dynamic-image-transformation-for-amazon-cloudfront/v8.0.5/039a30ad7b3fed8705eeb18faad3378979ecbec917ca33725f60626bfa5a23a2.zip" }, "Description": "dynamic-image-transformation-for-amazon-cloudfront (v8.0.5): Custom resource", "Environment": { "Variables": { "SOLUTION_ID": "SO0023", "RETRY_SECONDS": "5", "SOLUTION_VERSION": "v8.0.5" } }, "Handler": "index.handler", "MemorySize": 128, "Role": { "Fn::GetAtt": [ "CommonResourcesCustomResourcesCustomResourceRole8958A1ED", "Arn" ] }, "Runtime": "nodejs22.x", "Tags": [ { "Key": "SolutionId", "Value": "SO0023" } ], "Timeout": 60 }, "DependsOn": [ "CommonResourcesCustomResourcesCustomResourceRole8958A1ED" ], "Metadata": { "aws:cdk:path": "v7-Stack/CommonResources/CustomResources/CustomResourceFunction/Resource", "cfn_nag": { "rules_to_suppress": [ { "id": "W58", "reason": "The function does have permission to write CloudWatch Logs." }, { "id": "W89", "reason": "The Lambda function does not require any VPC connection at all." }, { "id": "W92", "reason": "The Lambda function does not require ReservedConcurrentExecutions." } ] } } }, "CommonResourcesCustomResourcesCustomResourceUuid64E7CCAD": { "Type": "AWS::CloudFormation::CustomResource", "Properties": { "ServiceToken": { "Fn::GetAtt": [ "CommonResourcesCustomResourcesCustomResourceFunction0D924235", "Arn" ] }, "Region": { "Ref": "AWS::Region" }, "CustomAction": "createUuid" }, "UpdateReplacePolicy": "Delete", "DeletionPolicy": "Delete", "Metadata": { "aws:cdk:path": "v7-Stack/CommonResources/CustomResources/CustomResourceUuid/Default" } }, "CommonResourcesCustomResourcesLogBucketCustomResource2445A3AB": { "Type": "AWS::CloudFormation::CustomResource", "Properties": { "ServiceToken": { "Fn::GetAtt": [ "CommonResourcesCustomResourcesCustomResourceFunction0D924235", "Arn" ] }, "CustomAction": "createCloudFrontLoggingBucket", "BucketSuffix": { "Fn::Join": [ "", [ { "Ref": "AWS::StackName" }, "-", { "Ref": "AWS::Region" }, "-", { "Ref": "AWS::AccountId" } ] ] } }, "UpdateReplacePolicy": "Delete", "DeletionPolicy": "Delete", "Metadata": { "aws:cdk:path": "v7-Stack/CommonResources/CustomResources/LogBucketCustomResource/Default" } }, "CommonResourcesCustomResourcesCustomResourceCheckSourceBucketsA313C9B7": { "Type": "AWS::CloudFormation::CustomResource", "Properties": { "ServiceToken": { "Fn::GetAtt": [ "CommonResourcesCustomResourcesCustomResourceFunction0D924235", "Arn" ] }, "CustomAction": "checkSourceBuckets", "Region": { "Ref": "AWS::Region" }, "SourceBuckets": { "Ref": "SourceBucketsParameter" } }, "UpdateReplacePolicy": "Delete", "DeletionPolicy": "Delete", "Metadata": { "aws:cdk:path": "v7-Stack/CommonResources/CustomResources/CustomResourceCheckSourceBuckets/Default" } }, "CommonResourcesCustomResourcesCustomResourceCheckFirstBucketRegionE663CC31": { "Type": "AWS::CloudFormation::CustomResource", "Properties": { "ServiceToken": { "Fn::GetAtt": [ "CommonResourcesCustomResourcesCustomResourceFunction0D924235", "Arn" ] }, "CustomAction": "checkFirstBucketRegion", "Region": { "Ref": "AWS::Region" }, "SourceBuckets": { "Fn::Select": [ 0, { "Fn::Split": [ ",", { "Ref": "SourceBucketsParameter" } ] } ] }, "UUID": { "Fn::GetAtt": [ "CommonResourcesCustomResourcesCustomResourceUuid64E7CCAD", "UUID" ] }, "S3ObjectLambda": { "Ref": "EnableS3ObjectLambdaParameter" } }, "UpdateReplacePolicy": "Delete", "DeletionPolicy": "Delete", "Metadata": { "aws:cdk:path": "v7-Stack/CommonResources/CustomResources/CustomResourceCheckFirstBucketRegion/Default" } }, "CommonResourcesCustomResourcesCustomResourceCheckFallbackImage6CE45571": { "Type": "AWS::CloudFormation::CustomResource", "Properties": { "ServiceToken": { "Fn::GetAtt": [ "CommonResourcesCustomResourcesCustomResourceFunction0D924235", "Arn" ] }, "CustomAction": "checkFallbackImage", "FallbackImageS3Bucket": { "Ref": "FallbackImageS3BucketParameter" }, "FallbackImageS3Key": { "Ref": "FallbackImageS3KeyParameter" } }, "UpdateReplacePolicy": "Delete", "DeletionPolicy": "Delete", "Metadata": { "aws:cdk:path": "v7-Stack/CommonResources/CustomResources/CustomResourceCheckFallbackImage/Default" }, "Condition": "CommonResourcesEnableDefaultFallbackImageConditionD1A10983" }, "CommonResourcesCustomResourcesWebsiteHostingBucketPolicy3C526944": { "Type": "AWS::IAM::Policy", "Properties": { "PolicyDocument": { "Statement": [ { "Action": [ "s3:GetObject", "s3:PutObject" ], "Effect": "Allow", "Resource": { "Fn::Join": [ "", [ { "Fn::GetAtt": [ "FrontEndDistributionToS3S3Bucket3A171D78", "Arn" ] }, "/*" ] ] } } ], "Version": "2012-10-17" }, "PolicyName": "CommonResourcesCustomResourcesWebsiteHostingBucketPolicy3C526944", "Roles": [ { "Ref": "CommonResourcesCustomResourcesCustomResourceRole8958A1ED" } ] }, "Metadata": { "aws:cdk:path": "v7-Stack/CommonResources/CustomResources/WebsiteHostingBucketPolicy/Resource" }, "Condition": "CommonResourcesDeployDemoUICondition308D3B09" }, "CommonResourcesCustomResourcesCustomResourceAnonymousMetric51363F57": { "Type": "AWS::CloudFormation::CustomResource", "Properties": { "ServiceToken": { "Fn::GetAtt": [ "CommonResourcesCustomResourcesCustomResourceFunction0D924235", "Arn" ] }, "CustomAction": "sendMetric", "Region": { "Ref": "AWS::Region" }, "UUID": { "Fn::GetAtt": [ "CommonResourcesCustomResourcesCustomResourceUuid64E7CCAD", "UUID" ] }, "AnonymousData": { "Fn::FindInMap": [ "Solution", "Config", "AnonymousUsage" ] }, "CorsEnabled": { "Ref": "CorsEnabledParameter" }, "SourceBuckets": { "Ref": "SourceBucketsParameter" }, "DeployDemoUi": { "Ref": "DeployDemoUIParameter" }, "LogRetentionPeriod": { "Ref": "LogRetentionPeriodParameter" }, "AutoWebP": { "Ref": "AutoWebPParameter" }, "EnableSignature": { "Ref": "EnableSignatureParameter" }, "EnableDefaultFallbackImage": { "Ref": "EnableDefaultFallbackImageParameter" }, "EnableS3ObjectLambda": { "Ref": "EnableS3ObjectLambdaParameter" }, "OriginShieldRegion": { "Ref": "OriginShieldRegionParameter" }, "UseExistingCloudFrontDistribution": { "Ref": "UseExistingCloudFrontDistributionParameter" } }, "UpdateReplacePolicy": "Delete", "DeletionPolicy": "Delete", "Metadata": { "aws:cdk:path": "v7-Stack/CommonResources/CustomResources/CustomResourceAnonymousMetric/Default" } }, "CommonResourcesCustomResourcesCustomResourceCheckSecretsManagerAEEEC776": { "Type": "AWS::CloudFormation::CustomResource", "Properties": { "ServiceToken": { "Fn::GetAtt": [ "CommonResourcesCustomResourcesCustomResourceFunction0D924235", "Arn" ] }, "CustomAction": "checkSecretsManager", "SecretsManagerName": { "Ref": "SecretsManagerSecretParameter" }, "SecretsManagerKey": { "Ref": "SecretsManagerKeyParameter" } }, "UpdateReplacePolicy": "Delete", "DeletionPolicy": "Delete", "Metadata": { "aws:cdk:path": "v7-Stack/CommonResources/CustomResources/CustomResourceCheckSecretsManager/Default" }, "Condition": "CommonResourcesEnableSignatureCondition909DC7A1" }, "CommonResourcesCustomResourcesCustomResourceValidateExistingDistribution34A6673C": { "Type": "AWS::CloudFormation::CustomResource", "Properties": { "ServiceToken": { "Fn::GetAtt": [ "CommonResourcesCustomResourcesCustomResourceFunction0D924235", "Arn" ] }, "CustomAction": "validateExistingDistribution", "Region": { "Ref": "AWS::Region" }, "ExistingDistributionID": { "Ref": "ExistingCloudFrontDistributionIdParameter" } }, "UpdateReplacePolicy": "Delete", "DeletionPolicy": "Delete", "Metadata": { "aws:cdk:path": "v7-Stack/CommonResources/CustomResources/CustomResourceValidateExistingDistribution/Default" }, "Condition": "CommonResourcesUseExistingCloudFrontDistributionConditionEBC48184" }, "CommonResourcesCustomResourcesDeployWebsiteAwsCliLayerBC025F39": { "Type": "AWS::Lambda::LayerVersion", "Properties": { "Content": { "S3Bucket": { "Fn::Sub": "solutions-${AWS::Region}" }, "S3Key": "dynamic-image-transformation-for-amazon-cloudfront/v8.0.5/e2659170a0721541efa761a8d5d04d5e36cbbf691c4b15a9053002b7c825055d.zip" }, "Description": "/opt/awscli/aws" }, "Metadata": { "aws:cdk:path": "v7-Stack/CommonResources/CustomResources/DeployWebsite/AwsCliLayer/Resource" }, "Condition": "CommonResourcesDeployDemoUICondition308D3B09" }, "CommonResourcesCustomResourcesDeployWebsiteCustomResourceECB9B136": { "Type": "Custom::CDKBucketDeployment", "Properties": { "ServiceToken": { "Fn::GetAtt": [ "CustomCDKBucketDeployment8693BB64968944B69AAFB0CC9EB8756C81C01536", "Arn" ] }, "SourceBucketNames": [ { "Fn::Sub": "solutions-${AWS::Region}" } ], "SourceObjectKeys": [ "dynamic-image-transformation-for-amazon-cloudfront/v8.0.5/600239bcd16ac6ef7c798055a1561a808b92e2fe3c7ef74b2fc122aa9d110a14.zip" ], "DestinationBucketName": { "Ref": "FrontEndDistributionToS3S3Bucket3A171D78" }, "WaitForDistributionInvalidation": true, "Prune": true, "Exclude": [ "demo-ui-config.js" ], "OutputObjectKeys": true }, "UpdateReplacePolicy": "Delete", "DeletionPolicy": "Delete", "Metadata": { "aws:cdk:path": "v7-Stack/CommonResources/CustomResources/DeployWebsite/CustomResource/Default" }, "Condition": "CommonResourcesDeployDemoUICondition308D3B09" }, "CommonResourcesCustomResourcesPutWebsiteConfigC4E435F3": { "Type": "AWS::CloudFormation::CustomResource", "Properties": { "ServiceToken": { "Fn::GetAtt": [ "CommonResourcesCustomResourcesCustomResourceFunction0D924235", "Arn" ] }, "CustomAction": "putConfigFile", "Region": { "Ref": "AWS::Region" }, "ConfigItem": { "apiEndpoint": { "Fn::If": [ "CommonResourcesUseExistingCloudFrontDistributionConditionEBC48184", { "Fn::Join": [ "", [ "https://", { "Fn::GetAtt": [ "CommonResourcesCustomResourcesCustomResourceValidateExistingDistribution34A6673C", "DistributionDomainName" ] } ] ] }, { "Fn::If": [ "CommonResourcesDisableS3ObjectLambdaCondition017AC33C", { "Fn::Join": [ "", [ "https://", { "Fn::If": [ "CommonResourcesUseExistingCloudFrontDistributionConditionEBC48184", "", { "Fn::GetAtt": [ "BackEndImageHandlerCloudFrontApiGatewayLambdaCloudFrontToApiGatewayCloudFrontDistribution03AA31B2", "DomainName" ] } ] } ] ] }, { "Fn::Join": [ "", [ "https://", { "Fn::If": [ "CommonResourcesUseExistingCloudFrontDistributionConditionEBC48184", "", { "Fn::GetAtt": [ "BackEndImageHandlerCloudFrontDistributionB5464C90", "DomainName" ] } ] } ] ] } ] } ] } }, "DestS3Bucket": { "Ref": "FrontEndDistributionToS3S3Bucket3A171D78" }, "DestS3key": "demo-ui-config.js" }, "UpdateReplacePolicy": "Delete", "DeletionPolicy": "Delete", "Metadata": { "aws:cdk:path": "v7-Stack/CommonResources/CustomResources/PutWebsiteConfig/Default" }, "Condition": "CommonResourcesDeployDemoUICondition308D3B09" }, "FrontEndDistributionToS3S3Bucket3A171D78": { "Type": "AWS::S3::Bucket", "Properties": { "BucketEncryption": { "ServerSideEncryptionConfiguration": [ { "ServerSideEncryptionByDefault": { "SSEAlgorithm": "AES256" } } ] }, "LifecycleConfiguration": { "Rules": [ { "NoncurrentVersionTransitions": [ { "StorageClass": "GLACIER", "TransitionInDays": 90 } ], "Status": "Enabled" } ] }, "PublicAccessBlockConfiguration": { "BlockPublicAcls": true, "BlockPublicPolicy": true, "IgnorePublicAcls": true, "RestrictPublicBuckets": true }, "Tags": [ { "Key": "aws-cdk:cr-owned:05a8ffc1", "Value": "true" }, { "Key": "SolutionId", "Value": "SO0023" } ], "VersioningConfiguration": { "Status": "Enabled" } }, "UpdateReplacePolicy": "Retain", "DeletionPolicy": "Retain", "Metadata": { "aws:cdk:path": "v7-Stack/FrontEnd/DistributionToS3/S3Bucket/Resource", "cfn_nag": { "rules_to_suppress": [ { "id": "W35", "reason": "This S3 bucket does not require access logging." } ] } }, "Condition": "CommonResourcesDeployDemoUICondition308D3B09" }, "FrontEndDistributionToS3S3BucketPolicyF3A0315A": { "Type": "AWS::S3::BucketPolicy", "Properties": { "Bucket": { "Ref": "FrontEndDistributionToS3S3Bucket3A171D78" }, "PolicyDocument": { "Statement": [ { "Action": "s3:*", "Condition": { "Bool": { "aws:SecureTransport": "false" } }, "Effect": "Deny", "Principal": { "AWS": "*" }, "Resource": [ { "Fn::GetAtt": [ "FrontEndDistributionToS3S3Bucket3A171D78", "Arn" ] }, { "Fn::Join": [ "", [ { "Fn::GetAtt": [ "FrontEndDistributionToS3S3Bucket3A171D78", "Arn" ] }, "/*" ] ] } ] }, { "Action": "s3:GetObject", "Condition": { "StringEquals": { "AWS:SourceArn": { "Fn::Join": [ "", [ "arn:aws:cloudfront::", { "Ref": "AWS::AccountId" }, ":distribution/", { "Ref": "FrontEndDistributionToS3CloudFrontDistribution15FE13D0" } ] ] } } }, "Effect": "Allow", "Principal": { "Service": "cloudfront.amazonaws.com" }, "Resource": { "Fn::Join": [ "", [ { "Fn::GetAtt": [ "FrontEndDistributionToS3S3Bucket3A171D78", "Arn" ] }, "/*" ] ] } } ], "Version": "2012-10-17" } }, "Metadata": { "aws:cdk:path": "v7-Stack/FrontEnd/DistributionToS3/S3Bucket/Policy/Resource", "cfn_nag": { "rules_to_suppress": [ { "id": "F16", "reason": "Public website bucket policy requires a wildcard principal" } ] } }, "Condition": "CommonResourcesDeployDemoUICondition308D3B09" }, "FrontEndDistributionToS3CloudFrontOac2BE9C90D": { "Type": "AWS::CloudFront::OriginAccessControl", "Properties": { "OriginAccessControlConfig": { "Description": "Origin access control provisioned by aws-cloudfront-s3", "Name": { "Fn::Join": [ "", [ "aws-cloudfront-s3-DistnToS3-", { "Fn::Select": [ 2, { "Fn::Split": [ "/", { "Ref": "AWS::StackId" } ] } ] } ] ] }, "OriginAccessControlOriginType": "s3", "SigningBehavior": "always", "SigningProtocol": "sigv4" } }, "Metadata": { "aws:cdk:path": "v7-Stack/FrontEnd/DistributionToS3/CloudFrontOac" }, "Condition": "CommonResourcesDeployDemoUICondition308D3B09" }, "FrontEndDistributionToS3CloudFrontDistribution15FE13D0": { "Type": "AWS::CloudFront::Distribution", "Properties": { "DistributionConfig": { "Comment": "Demo UI Distribution for Dynamic Image Transformation for Amazon CloudFront", "CustomErrorResponses": [ { "ErrorCode": 403, "ResponseCode": 200, "ResponsePagePath": "/index.html" }, { "ErrorCode": 404, "ResponseCode": 200, "ResponsePagePath": "/index.html" } ], "DefaultCacheBehavior": { "CachePolicyId": "658327ea-f89d-4fab-a63d-7e88639e58f6", "Compress": true, "TargetOriginId": "v7StackFrontEndDistributionToS3CloudFrontDistributionOrigin1B31526F3", "ViewerProtocolPolicy": "redirect-to-https" }, "DefaultRootObject": "index.html", "Enabled": true, "HttpVersion": "http2", "IPV6Enabled": true, "Logging": { "Bucket": { "Fn::Join": [ "", [ { "Fn::GetAtt": [ "CommonResourcesCustomResourcesLogBucketCustomResource2445A3AB", "BucketName" ] }, ".s3.", { "Fn::GetAtt": [ "CommonResourcesCustomResourcesLogBucketCustomResource2445A3AB", "Region" ] }, ".", { "Ref": "AWS::URLSuffix" } ] ] }, "Prefix": "ui-cloudfront/" }, "Origins": [ { "DomainName": { "Fn::GetAtt": [ "FrontEndDistributionToS3S3Bucket3A171D78", "RegionalDomainName" ] }, "Id": "v7StackFrontEndDistributionToS3CloudFrontDistributionOrigin1B31526F3", "OriginAccessControlId": { "Fn::GetAtt": [ "FrontEndDistributionToS3CloudFrontOac2BE9C90D", "Id" ] }, "S3OriginConfig": { "OriginAccessIdentity": "" } } ] }, "Tags": [ { "Key": "SolutionId", "Value": "SO0023" } ] }, "Metadata": { "aws:cdk:path": "v7-Stack/FrontEnd/DistributionToS3/CloudFrontDistribution/Resource", "cfn_nag": { "rules_to_suppress": [ { "id": "W70", "reason": "Since the distribution uses the CloudFront domain name, CloudFront automatically sets the security policy to TLSv1 regardless of the value of MinimumProtocolVersion" } ] } }, "Condition": "CommonResourcesDeployDemoUICondition308D3B09" }, "BackEndImageHandlerFunctionRoleABF81E5C": { "Type": "AWS::IAM::Role", "Properties": { "AssumeRolePolicyDocument": { "Statement": [ { "Action": "sts:AssumeRole", "Effect": "Allow", "Principal": { "Service": "lambda.amazonaws.com" } } ], "Version": "2012-10-17" }, "Path": "/", "Tags": [ { "Key": "SolutionId", "Value": "SO0023" } ] }, "Metadata": { "aws:cdk:path": "v7-Stack/BackEnd/ImageHandlerFunctionRole/Resource" } }, "BackEndImageHandlerFunctionPolicy437940B5": { "Type": "AWS::IAM::Policy", "Properties": { "PolicyDocument": { "Statement": [ { "Action": [ "logs:CreateLogGroup", "logs:CreateLogStream", "logs:PutLogEvents" ], "Effect": "Allow", "Resource": { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":logs:", { "Ref": "AWS::Region" }, ":", { "Ref": "AWS::AccountId" }, ":log-group:/aws/lambda/*" ] ] } }, { "Action": "s3:GetObject", "Effect": "Allow", "Resource": { "Fn::Split": [ ",", { "Fn::Sub": [ "arn:aws:s3:::${rest}/*", { "rest": { "Fn::Join": [ "/*,arn:aws:s3:::", { "Fn::Split": [ ",", { "Fn::Join": [ "", { "Fn::Split": [ " ", { "Ref": "SourceBucketsParameter" } ] } ] } ] } ] } } ] } ] } }, { "Action": "s3:ListBucket", "Effect": "Allow", "Resource": { "Fn::Split": [ ",", { "Fn::Sub": [ "arn:aws:s3:::${rest}", { "rest": { "Fn::Join": [ ",arn:aws:s3:::", { "Fn::Split": [ ",", { "Fn::Join": [ "", { "Fn::Split": [ " ", { "Ref": "SourceBucketsParameter" } ] } ] } ] } ] } } ] } ] } }, { "Action": "s3:GetObject", "Effect": "Allow", "Resource": { "Fn::Join": [ "", [ "arn:aws:s3:::", { "Ref": "FallbackImageS3BucketParameter" }, "/", { "Ref": "FallbackImageS3KeyParameter" } ] ] } }, { "Action": [ "rekognition:DetectFaces", "rekognition:DetectModerationLabels" ], "Effect": "Allow", "Resource": "*" } ], "Version": "2012-10-17" }, "PolicyName": "BackEndImageHandlerFunctionPolicy437940B5", "Roles": [ { "Ref": "BackEndImageHandlerFunctionRoleABF81E5C" } ] }, "Metadata": { "aws:cdk:path": "v7-Stack/BackEnd/ImageHandlerFunctionPolicy/Resource", "cfn_nag": { "rules_to_suppress": [ { "id": "W12", "reason": "rekognition:DetectFaces requires '*' resources." } ] } } }, "BackEndImageHandlerLambdaFunctionADEF7FF2": { "Type": "AWS::Lambda::Function", "Properties": { "Code": { "S3Bucket": { "Fn::Sub": "solutions-${AWS::Region}" }, "S3Key": "dynamic-image-transformation-for-amazon-cloudfront/v8.0.5/fc7ee4c9c3ab20126354bf2f2c24246e65f2158ebfc301bcb29637e63cdcd2f2.zip" }, "Description": "dynamic-image-transformation-for-amazon-cloudfront (v8.0.5): Performs image edits and manipulations", "Environment": { "Variables": { "AUTO_WEBP": { "Ref": "AutoWebPParameter" }, "CORS_ENABLED": { "Ref": "CorsEnabledParameter" }, "CORS_ORIGIN": { "Ref": "CorsOriginParameter" }, "SOURCE_BUCKETS": { "Ref": "SourceBucketsParameter" }, "REWRITE_MATCH_PATTERN": "", "REWRITE_SUBSTITUTION": "", "ENABLE_SIGNATURE": { "Ref": "EnableSignatureParameter" }, "SECRETS_MANAGER": { "Ref": "SecretsManagerSecretParameter" }, "SECRET_KEY": { "Ref": "SecretsManagerKeyParameter" }, "ENABLE_DEFAULT_FALLBACK_IMAGE": { "Ref": "EnableDefaultFallbackImageParameter" }, "DEFAULT_FALLBACK_IMAGE_BUCKET": { "Ref": "FallbackImageS3BucketParameter" }, "DEFAULT_FALLBACK_IMAGE_KEY": { "Ref": "FallbackImageS3KeyParameter" }, "ENABLE_S3_OBJECT_LAMBDA": { "Ref": "EnableS3ObjectLambdaParameter" }, "SOLUTION_VERSION": "v8.0.5", "SOLUTION_ID": "SO0023", "SHARP_SIZE_LIMIT": { "Fn::FindInMap": [ "Solution", "Config", "SharpSizeLimit" ] } } }, "Handler": "index.handler", "MemorySize": 1024, "Role": { "Fn::GetAtt": [ "BackEndImageHandlerFunctionRoleABF81E5C", "Arn" ] }, "Runtime": "nodejs22.x", "Tags": [ { "Key": "SolutionId", "Value": "SO0023" } ], "Timeout": 29 }, "DependsOn": [ "BackEndImageHandlerFunctionRoleABF81E5C" ], "Metadata": { "aws:cdk:path": "v7-Stack/BackEnd/ImageHandlerLambdaFunction/Resource", "cfn_nag": { "rules_to_suppress": [ { "id": "W58", "reason": "The function does have permission to write CloudWatch Logs." }, { "id": "W89", "reason": "The Lambda function does not require any VPC connection at all." }, { "id": "W92", "reason": "The Lambda function does not require ReservedConcurrentExecutions." } ] } } }, "BackEndImageHandlerLambdaFunctionInvokeOmXtXvfmnVyX0ul6SNprKOdkal6YvZiIw5QCpGsJFo09B7B011": { "Type": "AWS::Lambda::Permission", "Properties": { "Action": "lambda:InvokeFunction", "FunctionName": { "Fn::GetAtt": [ "BackEndImageHandlerLambdaFunctionADEF7FF2", "Arn" ] }, "Principal": "cloudfront.amazonaws.com" }, "Metadata": { "aws:cdk:path": "v7-Stack/BackEnd/ImageHandlerLambdaFunction/InvokeOmXtXvfmnVyX0ul6SNprKOdkal6YvZiIw5QCpG--sJFo=" } }, "BackEndImageHandlerLogGroupA0941EEC": { "Type": "AWS::Logs::LogGroup", "Properties": { "LogGroupName": { "Fn::Join": [ "", [ "/aws/lambda/", { "Ref": "BackEndImageHandlerLambdaFunctionADEF7FF2" } ] ] }, "RetentionInDays": { "Fn::If": [ "CommonResourcesIsLogRetentionPeriodInfinite129C8A82", { "Ref": "AWS::NoValue" }, { "Ref": "LogRetentionPeriodParameter" } ] }, "Tags": [ { "Key": "SolutionId", "Value": "SO0023" } ] }, "UpdateReplacePolicy": "Retain", "DeletionPolicy": "Retain", "Metadata": { "aws:cdk:path": "v7-Stack/BackEnd/ImageHandlerLogGroup/Resource", "cfn_nag": { "rules_to_suppress": [ { "id": "W84", "reason": "CloudWatch log group is always encrypted by default." }, { "id": "W86", "reason": "Retention days are configured with property override" } ] } } }, "BackEndCachePolicy1DCE9B1B": { "Type": "AWS::CloudFront::CachePolicy", "Properties": { "CachePolicyConfig": { "DefaultTTL": 86400, "MaxTTL": 31536000, "MinTTL": 1, "Name": { "Fn::Join": [ "", [ "ServerlessImageHandler-", { "Fn::GetAtt": [ "CommonResourcesCustomResourcesCustomResourceUuid64E7CCAD", "UUID" ] } ] ] }, "ParametersInCacheKeyAndForwardedToOrigin": { "CookiesConfig": { "CookieBehavior": "none" }, "EnableAcceptEncodingBrotli": false, "EnableAcceptEncodingGzip": false, "HeadersConfig": { "HeaderBehavior": "whitelist", "Headers": { "Fn::If": [ "CommonResourcesAutoWebPCondition7119C768", [ "origin", "accept" ], [ "origin" ] ] } }, "QueryStringsConfig": { "QueryStringBehavior": "all" } } } }, "Metadata": { "aws:cdk:path": "v7-Stack/BackEnd/CachePolicy/Resource" } }, "BackEndOriginRequestPolicy771345D7": { "Type": "AWS::CloudFront::OriginRequestPolicy", "Properties": { "OriginRequestPolicyConfig": { "CookiesConfig": { "CookieBehavior": "none" }, "HeadersConfig": { "HeaderBehavior": "whitelist", "Headers": [ "origin", "accept" ] }, "Name": { "Fn::Join": [ "", [ "ServerlessImageHandler-", { "Fn::GetAtt": [ "CommonResourcesCustomResourcesCustomResourceUuid64E7CCAD", "UUID" ] } ] ] }, "QueryStringsConfig": { "QueryStringBehavior": "all" } } }, "Metadata": { "aws:cdk:path": "v7-Stack/BackEnd/OriginRequestPolicy/Resource" } }, "BackEndApigRequestModifierFunction400C4F08": { "Type": "AWS::CloudFront::Function", "Properties": { "AutoPublish": true, "FunctionCode": "// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n// SPDX-License-Identifier: Apache-2.0\n\n\nfunction handler(event) {\n // Normalize accept header to only include values used on the backend\n if(event.request.headers && event.request.headers.accept && event.request.headers.accept.value) {\n event.request.headers.accept.value = event.request.headers.accept.value.indexOf(\"image/webp\") > -1 ? \"image/webp\" : \"\"\n }\n event.request.querystring = processQueryParams(event.request.querystring).join('&')\n return event.request;\n}\n\nfunction processQueryParams(querystring) {\n if (querystring == null) {\n return [];\n }\n\n const ALLOWED_PARAMS = ['signature', 'expires', 'format', 'fit', 'width', 'height', 'rotate', 'flip', 'flop', 'grayscale'];\n \n let qs = [];\n for (const key in querystring) {\n if (!ALLOWED_PARAMS.includes(key)) {\n continue;\n }\n const value = querystring[key];\n qs.push(\n value.multiValue\n ? `${key}=${value.multiValue[value.multiValue.length - 1].value}`\n : `${key}=${value.value}`\n )\n }\n\n return qs.sort();\n}", "FunctionConfig": { "Comment": { "Fn::Join": [ "", [ "sih-apig-request-modifier-", { "Fn::GetAtt": [ "CommonResourcesCustomResourcesCustomResourceUuid64E7CCAD", "UUID" ] } ] ] }, "Runtime": "cloudfront-js-2.0" }, "Name": { "Fn::Join": [ "", [ "sih-apig-request-modifier-", { "Fn::GetAtt": [ "CommonResourcesCustomResourcesCustomResourceUuid64E7CCAD", "UUID" ] } ] ] } }, "Metadata": { "aws:cdk:path": "v7-Stack/BackEnd/ApigRequestModifierFunction/Resource" }, "Condition": "CommonResourcesDisableS3ObjectLambdaCondition017AC33C" }, "BackEndImageHandlerCloudFrontApiGatewayLambdaApiAccessLogGroup9B786692": { "Type": "AWS::Logs::LogGroup", "Properties": { "RetentionInDays": { "Fn::If": [ "CommonResourcesIsLogRetentionPeriodInfinite129C8A82", { "Ref": "AWS::NoValue" }, { "Ref": "LogRetentionPeriodParameter" } ] }, "Tags": [ { "Key": "SolutionId", "Value": "SO0023" } ] }, "UpdateReplacePolicy": "Retain", "DeletionPolicy": "Retain", "Metadata": { "aws:cdk:path": "v7-Stack/BackEnd/ImageHandlerCloudFrontApiGatewayLambda/ApiAccessLogGroup/Resource", "cfn_nag": { "rules_to_suppress": [ { "id": "W86", "reason": "Retention period for CloudWatchLogs LogGroups are set to 'Never Expire' to preserve customer data indefinitely" }, { "id": "W84", "reason": "By default CloudWatchLogs LogGroups data is encrypted using the CloudWatch server-side encryption keys (AWS Managed Keys)" } ] } }, "Condition": "CommonResourcesDisableS3ObjectLambdaCondition017AC33C" }, "BackEndImageHandlerCloudFrontApiGatewayLambdaLambdaRestApi5A77D109": { "Type": "AWS::ApiGateway::RestApi", "Properties": { "BinaryMediaTypes": [ "*/*" ], "EndpointConfiguration": { "Types": [ "REGIONAL" ] }, "Name": "LambdaRestApi", "Tags": [ { "Key": "SolutionId", "Value": "SO0023" } ] }, "Metadata": { "aws:cdk:path": "v7-Stack/BackEnd/ImageHandlerCloudFrontApiGatewayLambda/LambdaRestApi/Resource", "cfn_nag": { "rules_to_suppress": [ { "id": "W59", "reason": "AWS::ApiGateway::Method AuthorizationType is set to 'NONE' because API Gateway behind CloudFront does not support AWS_IAM authentication" } ] } }, "Condition": "CommonResourcesDisableS3ObjectLambdaCondition017AC33C" }, "BackEndImageHandlerCloudFrontApiGatewayLambdaLambdaRestApiDeployment663240D6d71daf0d778515aeab060e5ecae23cfc": { "Type": "AWS::ApiGateway::Deployment", "Properties": { "Description": "Automatically created by the RestApi construct", "RestApiId": { "Ref": "BackEndImageHandlerCloudFrontApiGatewayLambdaLambdaRestApi5A77D109" } }, "DependsOn": [ "BackEndImageHandlerCloudFrontApiGatewayLambdaLambdaRestApiproxyANY8F9763E1", "BackEndImageHandlerCloudFrontApiGatewayLambdaLambdaRestApiproxyBDF0A131", "BackEndImageHandlerCloudFrontApiGatewayLambdaLambdaRestApiANYE4494B31" ], "Metadata": { "aws:cdk:path": "v7-Stack/BackEnd/ImageHandlerCloudFrontApiGatewayLambda/LambdaRestApi/Deployment/Resource", "aws:cdk:do-not-refactor": true, "cfn_nag": { "rules_to_suppress": [ { "id": "W45", "reason": "ApiGateway has AccessLogging enabled in AWS::ApiGateway::Stage resource, but cfn_nag checks for it in AWS::ApiGateway::Deployment resource" } ] } }, "Condition": "CommonResourcesDisableS3ObjectLambdaCondition017AC33C" }, "BackEndImageHandlerCloudFrontApiGatewayLambdaLambdaRestApiDeploymentStageimageB55D20E3": { "Type": "AWS::ApiGateway::Stage", "Properties": { "AccessLogSetting": { "DestinationArn": { "Fn::GetAtt": [ "BackEndImageHandlerCloudFrontApiGatewayLambdaApiAccessLogGroup9B786692", "Arn" ] }, "Format": "{\"requestId\":\"$context.requestId\",\"ip\":\"$context.identity.sourceIp\",\"user\":\"$context.identity.user\",\"caller\":\"$context.identity.caller\",\"requestTime\":\"$context.requestTime\",\"httpMethod\":\"$context.httpMethod\",\"resourcePath\":\"$context.resourcePath\",\"status\":\"$context.status\",\"protocol\":\"$context.protocol\",\"responseLength\":\"$context.responseLength\"}" }, "DeploymentId": { "Ref": "BackEndImageHandlerCloudFrontApiGatewayLambdaLambdaRestApiDeployment663240D6d71daf0d778515aeab060e5ecae23cfc" }, "MethodSettings": [ { "DataTraceEnabled": false, "HttpMethod": "*", "LoggingLevel": "INFO", "ResourcePath": "/*" } ], "RestApiId": { "Ref": "BackEndImageHandlerCloudFrontApiGatewayLambdaLambdaRestApi5A77D109" }, "StageName": "image", "Tags": [ { "Key": "SolutionId", "Value": "SO0023" } ], "TracingEnabled": true }, "Metadata": { "aws:cdk:path": "v7-Stack/BackEnd/ImageHandlerCloudFrontApiGatewayLambda/LambdaRestApi/DeploymentStage.image/Resource", "cfn_nag": { "rules_to_suppress": [ { "id": "W87", "reason": "Cache not enabled, using CloudFront for caching viewer response" } ] } }, "Condition": "CommonResourcesDisableS3ObjectLambdaCondition017AC33C" }, "BackEndImageHandlerCloudFrontApiGatewayLambdaLambdaRestApiproxyBDF0A131": { "Type": "AWS::ApiGateway::Resource", "Properties": { "ParentId": { "Fn::GetAtt": [ "BackEndImageHandlerCloudFrontApiGatewayLambdaLambdaRestApi5A77D109", "RootResourceId" ] }, "PathPart": "{proxy+}", "RestApiId": { "Ref": "BackEndImageHandlerCloudFrontApiGatewayLambdaLambdaRestApi5A77D109" } }, "Metadata": { "aws:cdk:path": "v7-Stack/BackEnd/ImageHandlerCloudFrontApiGatewayLambda/LambdaRestApi/Default/{proxy+}/Resource" }, "Condition": "CommonResourcesDisableS3ObjectLambdaCondition017AC33C" }, "BackEndImageHandlerCloudFrontApiGatewayLambdaLambdaRestApiproxyANYApiPermissionv7StackBackEndImageHandlerCloudFrontApiGatewayLambdaLambdaRestApiF2541CF7ANYproxy97EF8864": { "Type": "AWS::Lambda::Permission", "Properties": { "Action": "lambda:InvokeFunction", "FunctionName": { "Fn::GetAtt": [ "BackEndImageHandlerLambdaFunctionADEF7FF2", "Arn" ] }, "Principal": "apigateway.amazonaws.com", "SourceArn": { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":execute-api:", { "Ref": "AWS::Region" }, ":", { "Ref": "AWS::AccountId" }, ":", { "Ref": "BackEndImageHandlerCloudFrontApiGatewayLambdaLambdaRestApi5A77D109" }, "/", { "Ref": "BackEndImageHandlerCloudFrontApiGatewayLambdaLambdaRestApiDeploymentStageimageB55D20E3" }, "/*/*" ] ] } }, "Metadata": { "aws:cdk:path": "v7-Stack/BackEnd/ImageHandlerCloudFrontApiGatewayLambda/LambdaRestApi/Default/{proxy+}/ANY/ApiPermission.v7StackBackEndImageHandlerCloudFrontApiGatewayLambdaLambdaRestApiF2541CF7.ANY..{proxy+}" }, "Condition": "CommonResourcesDisableS3ObjectLambdaCondition017AC33C" }, "BackEndImageHandlerCloudFrontApiGatewayLambdaLambdaRestApiproxyANYApiPermissionTestv7StackBackEndImageHandlerCloudFrontApiGatewayLambdaLambdaRestApiF2541CF7ANYproxyCE42CE9C": { "Type": "AWS::Lambda::Permission", "Properties": { "Action": "lambda:InvokeFunction", "FunctionName": { "Fn::GetAtt": [ "BackEndImageHandlerLambdaFunctionADEF7FF2", "Arn" ] }, "Principal": "apigateway.amazonaws.com", "SourceArn": { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":execute-api:", { "Ref": "AWS::Region" }, ":", { "Ref": "AWS::AccountId" }, ":", { "Ref": "BackEndImageHandlerCloudFrontApiGatewayLambdaLambdaRestApi5A77D109" }, "/test-invoke-stage/*/*" ] ] } }, "Metadata": { "aws:cdk:path": "v7-Stack/BackEnd/ImageHandlerCloudFrontApiGatewayLambda/LambdaRestApi/Default/{proxy+}/ANY/ApiPermission.Test.v7StackBackEndImageHandlerCloudFrontApiGatewayLambdaLambdaRestApiF2541CF7.ANY..{proxy+}" }, "Condition": "CommonResourcesDisableS3ObjectLambdaCondition017AC33C" }, "BackEndImageHandlerCloudFrontApiGatewayLambdaLambdaRestApiproxyANY8F9763E1": { "Type": "AWS::ApiGateway::Method", "Properties": { "AuthorizationType": "NONE", "HttpMethod": "ANY", "Integration": { "IntegrationHttpMethod": "POST", "Type": "AWS_PROXY", "Uri": { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":apigateway:", { "Ref": "AWS::Region" }, ":lambda:path/2015-03-31/functions/", { "Fn::GetAtt": [ "BackEndImageHandlerLambdaFunctionADEF7FF2", "Arn" ] }, "/invocations" ] ] } }, "ResourceId": { "Ref": "BackEndImageHandlerCloudFrontApiGatewayLambdaLambdaRestApiproxyBDF0A131" }, "RestApiId": { "Ref": "BackEndImageHandlerCloudFrontApiGatewayLambdaLambdaRestApi5A77D109" } }, "Metadata": { "aws:cdk:path": "v7-Stack/BackEnd/ImageHandlerCloudFrontApiGatewayLambda/LambdaRestApi/Default/{proxy+}/ANY/Resource", "cfn_nag": { "rules_to_suppress": [ { "id": "W59", "reason": "No authorization currently on the API Gateway" } ] } }, "Condition": "CommonResourcesDisableS3ObjectLambdaCondition017AC33C" }, "BackEndImageHandlerCloudFrontApiGatewayLambdaLambdaRestApiANYApiPermissionv7StackBackEndImageHandlerCloudFrontApiGatewayLambdaLambdaRestApiF2541CF7ANY78AB222D": { "Type": "AWS::Lambda::Permission", "Properties": { "Action": "lambda:InvokeFunction", "FunctionName": { "Fn::GetAtt": [ "BackEndImageHandlerLambdaFunctionADEF7FF2", "Arn" ] }, "Principal": "apigateway.amazonaws.com", "SourceArn": { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":execute-api:", { "Ref": "AWS::Region" }, ":", { "Ref": "AWS::AccountId" }, ":", { "Ref": "BackEndImageHandlerCloudFrontApiGatewayLambdaLambdaRestApi5A77D109" }, "/", { "Ref": "BackEndImageHandlerCloudFrontApiGatewayLambdaLambdaRestApiDeploymentStageimageB55D20E3" }, "/*/" ] ] } }, "Metadata": { "aws:cdk:path": "v7-Stack/BackEnd/ImageHandlerCloudFrontApiGatewayLambda/LambdaRestApi/Default/ANY/ApiPermission.v7StackBackEndImageHandlerCloudFrontApiGatewayLambdaLambdaRestApiF2541CF7.ANY.." }, "Condition": "CommonResourcesDisableS3ObjectLambdaCondition017AC33C" }, "BackEndImageHandlerCloudFrontApiGatewayLambdaLambdaRestApiANYApiPermissionTestv7StackBackEndImageHandlerCloudFrontApiGatewayLambdaLambdaRestApiF2541CF7ANY8941F6A3": { "Type": "AWS::Lambda::Permission", "Properties": { "Action": "lambda:InvokeFunction", "FunctionName": { "Fn::GetAtt": [ "BackEndImageHandlerLambdaFunctionADEF7FF2", "Arn" ] }, "Principal": "apigateway.amazonaws.com", "SourceArn": { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":execute-api:", { "Ref": "AWS::Region" }, ":", { "Ref": "AWS::AccountId" }, ":", { "Ref": "BackEndImageHandlerCloudFrontApiGatewayLambdaLambdaRestApi5A77D109" }, "/test-invoke-stage/*/" ] ] } }, "Metadata": { "aws:cdk:path": "v7-Stack/BackEnd/ImageHandlerCloudFrontApiGatewayLambda/LambdaRestApi/Default/ANY/ApiPermission.Test.v7StackBackEndImageHandlerCloudFrontApiGatewayLambdaLambdaRestApiF2541CF7.ANY.." }, "Condition": "CommonResourcesDisableS3ObjectLambdaCondition017AC33C" }, "BackEndImageHandlerCloudFrontApiGatewayLambdaLambdaRestApiANYE4494B31": { "Type": "AWS::ApiGateway::Method", "Properties": { "AuthorizationType": "NONE", "HttpMethod": "ANY", "Integration": { "IntegrationHttpMethod": "POST", "Type": "AWS_PROXY", "Uri": { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":apigateway:", { "Ref": "AWS::Region" }, ":lambda:path/2015-03-31/functions/", { "Fn::GetAtt": [ "BackEndImageHandlerLambdaFunctionADEF7FF2", "Arn" ] }, "/invocations" ] ] } }, "ResourceId": { "Fn::GetAtt": [ "BackEndImageHandlerCloudFrontApiGatewayLambdaLambdaRestApi5A77D109", "RootResourceId" ] }, "RestApiId": { "Ref": "BackEndImageHandlerCloudFrontApiGatewayLambdaLambdaRestApi5A77D109" } }, "Metadata": { "aws:cdk:path": "v7-Stack/BackEnd/ImageHandlerCloudFrontApiGatewayLambda/LambdaRestApi/Default/ANY/Resource", "cfn_nag": { "rules_to_suppress": [ { "id": "W59", "reason": "No authorization currently on the API Gateway" } ] } }, "Condition": "CommonResourcesDisableS3ObjectLambdaCondition017AC33C" }, "BackEndImageHandlerCloudFrontApiGatewayLambdaLambdaRestApiUsagePlan76CA1E70": { "Type": "AWS::ApiGateway::UsagePlan", "Properties": { "ApiStages": [ { "ApiId": { "Ref": "BackEndImageHandlerCloudFrontApiGatewayLambdaLambdaRestApi5A77D109" }, "Stage": { "Ref": "BackEndImageHandlerCloudFrontApiGatewayLambdaLambdaRestApiDeploymentStageimageB55D20E3" }, "Throttle": {} } ], "Tags": [ { "Key": "SolutionId", "Value": "SO0023" } ] }, "Metadata": { "aws:cdk:path": "v7-Stack/BackEnd/ImageHandlerCloudFrontApiGatewayLambda/LambdaRestApi/UsagePlan/Resource" }, "Condition": "CommonResourcesDisableS3ObjectLambdaCondition017AC33C" }, "BackEndImageHandlerCloudFrontApiGatewayLambdaLambdaRestApiCloudWatchRole12575C4D": { "Type": "AWS::IAM::Role", "Properties": { "AssumeRolePolicyDocument": { "Statement": [ { "Action": "sts:AssumeRole", "Effect": "Allow", "Principal": { "Service": "apigateway.amazonaws.com" } } ], "Version": "2012-10-17" }, "Policies": [ { "PolicyDocument": { "Statement": [ { "Action": [ "logs:CreateLogGroup", "logs:CreateLogStream", "logs:DescribeLogGroups", "logs:DescribeLogStreams", "logs:PutLogEvents", "logs:GetLogEvents", "logs:FilterLogEvents" ], "Effect": "Allow", "Resource": { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":logs:", { "Ref": "AWS::Region" }, ":", { "Ref": "AWS::AccountId" }, ":*" ] ] } } ], "Version": "2012-10-17" }, "PolicyName": "LambdaRestApiCloudWatchRolePolicy" } ], "Tags": [ { "Key": "SolutionId", "Value": "SO0023" } ] }, "Metadata": { "aws:cdk:path": "v7-Stack/BackEnd/ImageHandlerCloudFrontApiGatewayLambda/LambdaRestApiCloudWatchRole/Resource", "cfn_nag": { "rules_to_suppress": [ { "id": "F10", "reason": "Inline policy used in solutions construct" } ] } }, "Condition": "CommonResourcesDisableS3ObjectLambdaCondition017AC33C" }, "BackEndImageHandlerCloudFrontApiGatewayLambdaLambdaRestApiAccountE5522E5D": { "Type": "AWS::ApiGateway::Account", "Properties": { "CloudWatchRoleArn": { "Fn::GetAtt": [ "BackEndImageHandlerCloudFrontApiGatewayLambdaLambdaRestApiCloudWatchRole12575C4D", "Arn" ] } }, "DependsOn": [ "BackEndImageHandlerCloudFrontApiGatewayLambdaLambdaRestApi5A77D109" ], "Metadata": { "aws:cdk:path": "v7-Stack/BackEnd/ImageHandlerCloudFrontApiGatewayLambda/LambdaRestApiAccount" }, "Condition": "CommonResourcesDisableS3ObjectLambdaCondition017AC33C" }, "BackEndImageHandlerCloudFrontApiGatewayLambdaCloudFrontToApiGatewayCloudFrontDistribution03AA31B2": { "Type": "AWS::CloudFront::Distribution", "Properties": { "DistributionConfig": { "Comment": "Image Handler Distribution for Dynamic Image Transformation for Amazon CloudFront", "CustomErrorResponses": [ { "ErrorCachingMinTTL": 600, "ErrorCode": 500 }, { "ErrorCachingMinTTL": 600, "ErrorCode": 501 }, { "ErrorCachingMinTTL": 600, "ErrorCode": 502 }, { "ErrorCachingMinTTL": 600, "ErrorCode": 503 }, { "ErrorCachingMinTTL": 600, "ErrorCode": 504 } ], "DefaultCacheBehavior": { "AllowedMethods": [ "GET", "HEAD" ], "CachePolicyId": { "Ref": "BackEndCachePolicy1DCE9B1B" }, "Compress": true, "FunctionAssociations": [ { "EventType": "viewer-request", "FunctionARN": { "Fn::GetAtt": [ "BackEndApigRequestModifierFunction400C4F08", "FunctionARN" ] } } ], "OriginRequestPolicyId": { "Ref": "BackEndOriginRequestPolicy771345D7" }, "TargetOriginId": "v7StackBackEndImageHandlerCloudFrontApiGatewayLambdaCloudFrontToApiGatewayCloudFrontDistributionOrigin1E79079A2", "ViewerProtocolPolicy": "redirect-to-https" }, "Enabled": true, "HttpVersion": "http2", "IPV6Enabled": true, "Logging": { "Bucket": { "Fn::Join": [ "", [ { "Fn::GetAtt": [ "CommonResourcesCustomResourcesLogBucketCustomResource2445A3AB", "BucketName" ] }, ".s3.", { "Fn::GetAtt": [ "CommonResourcesCustomResourcesLogBucketCustomResource2445A3AB", "Region" ] }, ".", { "Ref": "AWS::URLSuffix" } ] ] }, "Prefix": "api-cloudfront/" }, "Origins": [ { "CustomOriginConfig": { "OriginProtocolPolicy": "https-only", "OriginSSLProtocols": [ "TLSv1.1", "TLSv1.2" ] }, "DomainName": { "Fn::Join": [ "", [ { "Ref": "BackEndImageHandlerCloudFrontApiGatewayLambdaLambdaRestApi5A77D109" }, ".execute-api.", { "Ref": "AWS::Region" }, ".amazonaws.com" ] ] }, "Id": "v7StackBackEndImageHandlerCloudFrontApiGatewayLambdaCloudFrontToApiGatewayCloudFrontDistributionOrigin1E79079A2", "OriginPath": "/image", "OriginShield": { "Fn::If": [ "CommonResourcesEnableOriginShieldConditionCEE94847", { "Enabled": true, "OriginShieldRegion": { "Ref": "OriginShieldRegionParameter" } }, { "Enabled": false } ] } } ], "PriceClass": { "Ref": "CloudFrontPriceClassParameter" } }, "Tags": [ { "Key": "SolutionId", "Value": "SO0023" } ] }, "Metadata": { "aws:cdk:path": "v7-Stack/BackEnd/ImageHandlerCloudFrontApiGatewayLambda/CloudFrontToApiGateway/CloudFrontDistribution/Resource", "cfn_nag": { "rules_to_suppress": [ { "id": "W70", "reason": "Since the distribution uses the CloudFront domain name, CloudFront automatically sets the security policy to TLSv1 regardless of the value of MinimumProtocolVersion" } ] } }, "Condition": "BackEndDeployAPIGDistributionF4E75280" }, "BackEndAccessPoint6DA9B104": { "Type": "AWS::S3::AccessPoint", "Properties": { "Bucket": { "Fn::GetAtt": [ "CommonResourcesCustomResourcesCustomResourceCheckFirstBucketRegionE663CC31", "BucketName" ] }, "Name": { "Fn::Join": [ "", [ "sih-ap-", { "Fn::GetAtt": [ "CommonResourcesCustomResourcesCustomResourceUuid64E7CCAD", "UUID" ] }, "-", { "Fn::GetAtt": [ "CommonResourcesCustomResourcesCustomResourceCheckFirstBucketRegionE663CC31", "BucketHash" ] } ] ] }, "Policy": { "Statement": { "Action": "s3:*", "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": "s3-object-lambda.amazonaws.com" } }, "Effect": "Allow", "Principal": { "Service": "cloudfront.amazonaws.com" }, "Resource": [ { "Fn::Join": [ "", [ "arn:aws:s3:", { "Ref": "AWS::Region" }, ":", { "Ref": "AWS::AccountId" }, ":accesspoint/sih-ap-", { "Fn::GetAtt": [ "CommonResourcesCustomResourcesCustomResourceUuid64E7CCAD", "UUID" ] }, "-", { "Fn::GetAtt": [ "CommonResourcesCustomResourcesCustomResourceCheckFirstBucketRegionE663CC31", "BucketHash" ] } ] ] }, { "Fn::Join": [ "", [ "arn:aws:s3:", { "Ref": "AWS::Region" }, ":", { "Ref": "AWS::AccountId" }, ":accesspoint/sih-ap-", { "Fn::GetAtt": [ "CommonResourcesCustomResourcesCustomResourceUuid64E7CCAD", "UUID" ] }, "-", { "Fn::GetAtt": [ "CommonResourcesCustomResourcesCustomResourceCheckFirstBucketRegionE663CC31", "BucketHash" ] }, "/object/*" ] ] } ] } }, "Tags": [ { "Key": "SolutionId", "Value": "SO0023" } ] }, "Metadata": { "aws:cdk:path": "v7-Stack/BackEnd/AccessPoint" }, "Condition": "CommonResourcesEnableS3ObjectLambdaConditionF2C07DCD" }, "BackEndOlResponseModifierFunctionB47B3834": { "Type": "AWS::CloudFront::Function", "Properties": { "AutoPublish": true, "FunctionCode": "// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n// SPDX-License-Identifier: Apache-2.0\n\n\nfunction handler(event) {\n const response = event.response;\n\n try {\n Object.keys(response.headers).forEach(key => {\n if (key.startsWith(\"x-amz-meta-\") && key !== \"x-amz-meta-statuscode\") {\n const headerName = key.replace(\"x-amz-meta-\", \"\");\n response.headers[headerName] = response.headers[key];\n delete response.headers[key];\n }\n });\n\n const statusCodeHeader = response.headers[\"x-amz-meta-statuscode\"];\n if (statusCodeHeader) {\n const status = parseInt(statusCodeHeader.value);\n if (status >= 400 && status <= 599) {\n response.statusCode = status;\n }\n\n delete response.headers[\"x-amz-meta-statuscode\"];\n }\n } catch (e) {\n console.log(\"Error: \", e);\n }\n return response;\n}\n", "FunctionConfig": { "Comment": { "Fn::Join": [ "", [ "sih-ol-response-modifier-", { "Fn::GetAtt": [ "CommonResourcesCustomResourcesCustomResourceUuid64E7CCAD", "UUID" ] } ] ] }, "Runtime": "cloudfront-js-2.0" }, "Name": { "Fn::Join": [ "", [ "sih-ol-response-modifier-", { "Fn::GetAtt": [ "CommonResourcesCustomResourcesCustomResourceUuid64E7CCAD", "UUID" ] } ] ] } }, "Metadata": { "aws:cdk:path": "v7-Stack/BackEnd/OlResponseModifierFunction/Resource" }, "Condition": "CommonResourcesEnableS3ObjectLambdaConditionF2C07DCD" }, "BackEndOlRequestModifierFunction7E5192E3": { "Type": "AWS::CloudFront::Function", "Properties": { "AutoPublish": true, "FunctionCode": "// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n// SPDX-License-Identifier: Apache-2.0\n\nfunction handler(event) {\n // Normalize accept header to only include values used on the backend\n if(event.request.headers && event.request.headers.accept && event.request.headers.accept.value) {\n event.request.headers.accept.value = event.request.headers.accept.value.indexOf(\"image/webp\") > -1 ? \"image/webp\" : \"\"\n }\n event.request.querystring = processQueryParams(event.request.querystring).join('&')\n return event.request;\n}\n\nfunction processQueryParams(querystring) {\n if (querystring == null) {\n return [];\n }\n\n const ALLOWED_PARAMS = ['signature', 'expires', 'format', 'fit', 'width', 'height', 'rotate', 'flip', 'flop', 'grayscale'];\n const OL_PARAMS = {'signature': 'ol-signature', 'expires': 'ol-expires'};\n \n let qs = [];\n for (const key in querystring) {\n if (!ALLOWED_PARAMS.includes(key)) {\n continue;\n }\n const value = querystring[key];\n const mappedKey = OL_PARAMS[key] || key;\n qs.push(\n value.multiValue\n ? `${mappedKey}=${value.multiValue[value.multiValue.length - 1].value}`\n : `${mappedKey}=${value.value}`\n )\n }\n\n return qs.sort();\n}", "FunctionConfig": { "Comment": { "Fn::Join": [ "", [ "sih-ol-request-modifier-", { "Fn::GetAtt": [ "CommonResourcesCustomResourcesCustomResourceUuid64E7CCAD", "UUID" ] } ] ] }, "Runtime": "cloudfront-js-2.0" }, "Name": { "Fn::Join": [ "", [ "sih-ol-request-modifier-", { "Fn::GetAtt": [ "CommonResourcesCustomResourcesCustomResourceUuid64E7CCAD", "UUID" ] } ] ] } }, "Metadata": { "aws:cdk:path": "v7-Stack/BackEnd/OlRequestModifierFunction/Resource" }, "Condition": "CommonResourcesEnableS3ObjectLambdaConditionF2C07DCD" }, "BackEndObjectLambdaAccessPointBEE6B960": { "Type": "AWS::S3ObjectLambda::AccessPoint", "Properties": { "Name": { "Fn::Join": [ "", [ "sih-olap-", { "Fn::GetAtt": [ "CommonResourcesCustomResourcesCustomResourceUuid64E7CCAD", "UUID" ] } ] ] }, "ObjectLambdaConfiguration": { "SupportingAccessPoint": { "Fn::GetAtt": [ "BackEndAccessPoint6DA9B104", "Arn" ] }, "TransformationConfigurations": [ { "Actions": [ "GetObject", "HeadObject" ], "ContentTransformation": { "AwsLambda": { "FunctionArn": { "Fn::GetAtt": [ "BackEndImageHandlerLambdaFunctionADEF7FF2", "Arn" ] } } } } ] } }, "Metadata": { "aws:cdk:path": "v7-Stack/BackEnd/ObjectLambdaAccessPoint" }, "Condition": "CommonResourcesEnableS3ObjectLambdaConditionF2C07DCD" }, "BackEndWriteGetObjectResponsePolicyF3008955": { "Type": "AWS::IAM::Policy", "Properties": { "PolicyDocument": { "Statement": [ { "Action": "s3-object-lambda:WriteGetObjectResponse", "Effect": "Allow", "Resource": { "Fn::GetAtt": [ "BackEndObjectLambdaAccessPointBEE6B960", "Arn" ] } } ], "Version": "2012-10-17" }, "PolicyName": "BackEndWriteGetObjectResponsePolicyF3008955", "Roles": [ { "Ref": "BackEndImageHandlerFunctionRoleABF81E5C" } ] }, "Metadata": { "aws:cdk:path": "v7-Stack/BackEnd/WriteGetObjectResponsePolicy/Resource" }, "Condition": "CommonResourcesEnableS3ObjectLambdaConditionF2C07DCD" }, "BackEndImageHandlerCloudFrontDistributionB5464C90": { "Type": "AWS::CloudFront::Distribution", "Properties": { "DistributionConfig": { "Comment": "Image Handler Distribution for Dynamic Image Transformation for Amazon CloudFront", "CustomErrorResponses": [ { "ErrorCachingMinTTL": 600, "ErrorCode": 500 }, { "ErrorCachingMinTTL": 600, "ErrorCode": 501 }, { "ErrorCachingMinTTL": 600, "ErrorCode": 502 }, { "ErrorCachingMinTTL": 600, "ErrorCode": 503 }, { "ErrorCachingMinTTL": 600, "ErrorCode": 504 } ], "DefaultCacheBehavior": { "AllowedMethods": [ "GET", "HEAD" ], "CachePolicyId": { "Ref": "BackEndCachePolicy1DCE9B1B" }, "Compress": true, "FunctionAssociations": [ { "EventType": "viewer-response", "FunctionARN": { "Fn::GetAtt": [ "BackEndOlResponseModifierFunctionB47B3834", "FunctionARN" ] } }, { "EventType": "viewer-request", "FunctionARN": { "Fn::GetAtt": [ "BackEndOlRequestModifierFunction7E5192E3", "FunctionARN" ] } } ], "OriginRequestPolicyId": { "Ref": "BackEndOriginRequestPolicy771345D7" }, "TargetOriginId": "v7StackBackEndImageHandlerCloudFrontDistributionOrigin1BA139366", "ViewerProtocolPolicy": "redirect-to-https" }, "Enabled": true, "HttpVersion": "http2", "IPV6Enabled": true, "Logging": { "Bucket": { "Fn::Join": [ "", [ { "Fn::GetAtt": [ "CommonResourcesCustomResourcesLogBucketCustomResource2445A3AB", "BucketName" ] }, ".s3.", { "Fn::GetAtt": [ "CommonResourcesCustomResourcesLogBucketCustomResource2445A3AB", "Region" ] }, ".", { "Ref": "AWS::URLSuffix" } ] ] }, "Prefix": "api-cloudfront/" }, "Origins": [ { "ConnectionAttempts": 1, "DomainName": { "Fn::Join": [ "", [ { "Fn::GetAtt": [ "BackEndObjectLambdaAccessPointBEE6B960", "Alias.Value" ] }, ".s3.", { "Ref": "AWS::Region" }, ".amazonaws.com" ] ] }, "Id": "v7StackBackEndImageHandlerCloudFrontDistributionOrigin1BA139366", "OriginAccessControlId": { "Fn::GetAtt": [ "BackEndSIHoriginaccesscontrolAFC8496A", "Id" ] }, "OriginPath": "/image", "OriginShield": { "Fn::If": [ "CommonResourcesEnableOriginShieldConditionCEE94847", { "Enabled": true, "OriginShieldRegion": { "Ref": "OriginShieldRegionParameter" } }, { "Enabled": false } ] }, "S3OriginConfig": {} } ], "PriceClass": { "Ref": "CloudFrontPriceClassParameter" } }, "Tags": [ { "Key": "SolutionId", "Value": "SO0023" } ] }, "Metadata": { "aws:cdk:path": "v7-Stack/BackEnd/ImageHandlerCloudFrontDistribution/Resource", "cfn_nag": { "rules_to_suppress": [ { "id": "W70", "reason": "Since the distribution uses the CloudFront domain name, CloudFront automatically sets the security policy to TLSv1 regardless of the value of MinimumProtocolVersion" } ] } }, "Condition": "BackEndDeployS3OLDistribution869FCC7C" }, "BackEndObjectLambdaAccessPointPolicy1FC842E3": { "Type": "AWS::S3ObjectLambda::AccessPointPolicy", "Properties": { "ObjectLambdaAccessPoint": { "Ref": "BackEndObjectLambdaAccessPointBEE6B960" }, "PolicyDocument": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Principal": { "Service": "cloudfront.amazonaws.com" }, "Action": "s3-object-lambda:Get*", "Resource": { "Fn::GetAtt": [ "BackEndObjectLambdaAccessPointBEE6B960", "Arn" ] }, "Condition": { "StringEquals": { "aws:SourceArn": { "Fn::Join": [ "", [ "arn:aws:cloudfront::", { "Ref": "AWS::AccountId" }, ":distribution/", { "Fn::If": [ "CommonResourcesUseExistingCloudFrontDistributionConditionEBC48184", { "Ref": "ExistingCloudFrontDistributionIdParameter" }, { "Ref": "BackEndImageHandlerCloudFrontDistributionB5464C90" } ] } ] ] } } } } ] } }, "Metadata": { "aws:cdk:path": "v7-Stack/BackEnd/ObjectLambdaAccessPointPolicy" }, "Condition": "CommonResourcesEnableS3ObjectLambdaConditionF2C07DCD" }, "BackEndSIHoriginaccesscontrolAFC8496A": { "Type": "AWS::CloudFront::OriginAccessControl", "Properties": { "OriginAccessControlConfig": { "Name": { "Fn::Join": [ "", [ "SIH-origin-access-control-", { "Fn::GetAtt": [ "CommonResourcesCustomResourcesCustomResourceUuid64E7CCAD", "UUID" ] } ] ] }, "OriginAccessControlOriginType": "s3", "SigningBehavior": "always", "SigningProtocol": "sigv4" } }, "Metadata": { "aws:cdk:path": "v7-Stack/BackEnd/SIH-origin-access-control" }, "Condition": "CommonResourcesEnableS3ObjectLambdaConditionF2C07DCD" }, "BackEndSolutionMetricsMetricsLambdaLogGroup7A09CAFB": { "Type": "AWS::Logs::LogGroup", "Properties": { "RetentionInDays": 3653, "Tags": [ { "Key": "SolutionId", "Value": "SO0023" } ] }, "UpdateReplacePolicy": "Retain", "DeletionPolicy": "Retain", "Metadata": { "aws:cdk:path": "v7-Stack/BackEnd/SolutionMetrics/MetricsLambdaLogGroup/Resource", "guard": { "SuppressedRules": [ "CLOUDWATCH_LOG_GROUP_ENCRYPTED" ] } }, "Condition": "SendAnonymousStatistics" }, "BackEndSolutionMetricsMetricsLambdaServiceRoleF4BC77CD": { "Type": "AWS::IAM::Role", "Properties": { "AssumeRolePolicyDocument": { "Statement": [ { "Action": "sts:AssumeRole", "Effect": "Allow", "Principal": { "Service": "lambda.amazonaws.com" } } ], "Version": "2012-10-17" }, "ManagedPolicyArns": [ { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":iam::aws:policy/service-role/AWSLambdaBasicExecutionRole" ] ] } ], "Tags": [ { "Key": "SolutionId", "Value": "SO0023" } ] }, "Metadata": { "aws:cdk:path": "v7-Stack/BackEnd/SolutionMetrics/MetricsLambda/ServiceRole/Resource" }, "Condition": "SendAnonymousStatistics" }, "BackEndSolutionMetricsMetricsLambdaServiceRoleDefaultPolicyEBDDA47A": { "Type": "AWS::IAM::Policy", "Properties": { "PolicyDocument": { "Statement": [ { "Action": [ "sqs:SendMessage", "sqs:GetQueueAttributes", "sqs:GetQueueUrl" ], "Effect": "Allow", "Resource": { "Fn::GetAtt": [ "BackEndSolutionMetricsLambdaToSqsToLambdalambdatosqsqueue60A92083", "Arn" ] } }, { "Action": [ "sqs:ReceiveMessage", "sqs:ChangeMessageVisibility", "sqs:GetQueueUrl", "sqs:DeleteMessage", "sqs:GetQueueAttributes" ], "Effect": "Allow", "Resource": { "Fn::GetAtt": [ "BackEndSolutionMetricsLambdaToSqsToLambdalambdatosqsqueue60A92083", "Arn" ] } }, { "Action": "cloudwatch:GetMetricData", "Effect": "Allow", "Resource": "*" }, { "Action": [ "logs:StartQuery", "logs:GetQueryResults" ], "Effect": "Allow", "Resource": { "Fn::GetAtt": [ "BackEndImageHandlerLogGroupA0941EEC", "Arn" ] } }, { "Action": "logs:DescribeQueryDefinitions", "Effect": "Allow", "Resource": "*" } ], "Version": "2012-10-17" }, "PolicyName": "BackEndSolutionMetricsMetricsLambdaServiceRoleDefaultPolicyEBDDA47A", "Roles": [ { "Ref": "BackEndSolutionMetricsMetricsLambdaServiceRoleF4BC77CD" } ] }, "Metadata": { "aws:cdk:path": "v7-Stack/BackEnd/SolutionMetrics/MetricsLambda/ServiceRole/DefaultPolicy/Resource" }, "Condition": "SendAnonymousStatistics" }, "BackEndSolutionMetricsMetricsLambdaF4FA4AF7": { "Type": "AWS::Lambda::Function", "Properties": { "Code": { "S3Bucket": { "Fn::Sub": "solutions-${AWS::Region}" }, "S3Key": "dynamic-image-transformation-for-amazon-cloudfront/v8.0.5/3225c76e5b52a0237c91fdbe1071aea660e5d519db0d0aa0dcf3154f6dcc329e.zip" }, "Description": "Metrics util", "Environment": { "Variables": { "SOLUTION_ID": "SO0023", "SOLUTION_VERSION": "v8.0.5", "QUERY_PREFIX": { "Fn::Join": [ "", [ { "Ref": "AWS::StackName" }, "-" ] ] }, "SOLUTION_NAME": "dynamic-image-transformation-for-amazon-cloudfront", "UUID": { "Fn::GetAtt": [ "CommonResourcesCustomResourcesCustomResourceUuid64E7CCAD", "UUID" ] }, "EXECUTION_DAY": { "Fn::If": [ "BackEndShortLogRetentionCondition72EA1A33", "*", "MON" ] }, "AWS_ACCOUNT_ID": { "Ref": "AWS::AccountId" }, "AWS_STACK_ID": { "Ref": "AWS::StackId" }, "SQS_QUEUE_URL": { "Ref": "BackEndSolutionMetricsLambdaToSqsToLambdalambdatosqsqueue60A92083" } } }, "Handler": "index.handler", "LoggingConfig": { "LogGroup": { "Ref": "BackEndSolutionMetricsMetricsLambdaLogGroup7A09CAFB" } }, "MemorySize": 128, "Role": { "Fn::GetAtt": [ "BackEndSolutionMetricsMetricsLambdaServiceRoleF4BC77CD", "Arn" ] }, "Runtime": "nodejs22.x", "Tags": [ { "Key": "SolutionId", "Value": "SO0023" } ], "Timeout": 60 }, "DependsOn": [ "BackEndSolutionMetricsMetricsLambdaServiceRoleDefaultPolicyEBDDA47A", "BackEndSolutionMetricsMetricsLambdaServiceRoleF4BC77CD" ], "Metadata": { "aws:cdk:path": "v7-Stack/BackEnd/SolutionMetrics/MetricsLambda/Resource", "cfn_nag": { "rules_to_suppress": [ { "id": "W89", "reason": "Not in vpc" }, { "id": "W92", "reason": "No need for ReservedConcurrentExecutions, does not support any application functional logic" }, { "id": "W58", "reason": "The function does have permission to write CloudWatch Logs." }, { "id": "W89", "reason": "The Lambda function does not require any VPC connection at all." }, { "id": "W92", "reason": "The Lambda function does not require ReservedConcurrentExecutions." } ] } }, "Condition": "SendAnonymousStatistics" }, "BackEndSolutionMetricsMetricsLambdaAwsEventsLambdaInvokePermission1328BC090": { "Type": "AWS::Lambda::Permission", "Properties": { "Action": "lambda:InvokeFunction", "FunctionName": { "Fn::GetAtt": [ "BackEndSolutionMetricsMetricsLambdaF4FA4AF7", "Arn" ] }, "Principal": "events.amazonaws.com", "SourceArn": { "Fn::GetAtt": [ "BackEndSolutionMetricsEventbridgeRuleToLambdaEventsRule05009025", "Arn" ] } }, "Metadata": { "aws:cdk:path": "v7-Stack/BackEnd/SolutionMetrics/MetricsLambda/AwsEventsLambdaInvokePermission-1" }, "Condition": "SendAnonymousStatistics" }, "BackEndSolutionMetricsMetricsLambdaSqsEventSourcev7StackBackEndSolutionMetricsLambdaToSqsToLambdalambdatosqsqueue818578DC98195555": { "Type": "AWS::Lambda::EventSourceMapping", "Properties": { "EventSourceArn": { "Fn::GetAtt": [ "BackEndSolutionMetricsLambdaToSqsToLambdalambdatosqsqueue60A92083", "Arn" ] }, "FunctionName": { "Ref": "BackEndSolutionMetricsMetricsLambdaF4FA4AF7" }, "Tags": [ { "Key": "SolutionId", "Value": "SO0023" } ] }, "DependsOn": [ "BackEndEventSourceMappingResolver0ACBB140" ], "Metadata": { "aws:cdk:path": "v7-Stack/BackEnd/SolutionMetrics/MetricsLambda/SqsEventSource:v7StackBackEndSolutionMetricsLambdaToSqsToLambdalambdatosqsqueue818578DC/Resource" }, "Condition": "SendAnonymousStatistics" }, "BackEndSolutionMetricsEventbridgeRuleToLambdaEventsRule05009025": { "Type": "AWS::Events::Rule", "Properties": { "ScheduleExpression": { "Fn::Join": [ "", [ "cron(0 23 ? * ", { "Fn::If": [ "BackEndShortLogRetentionCondition72EA1A33", "*", "MON" ] }, " *)" ] ] }, "State": "ENABLED", "Tags": [ { "Key": "SolutionId", "Value": "SO0023" } ], "Targets": [ { "Arn": { "Fn::GetAtt": [ "BackEndSolutionMetricsMetricsLambdaF4FA4AF7", "Arn" ] }, "Id": "Target0", "InputTransformer": { "InputPathsMap": { "time": "$.time", "detail-type": "$.detail-type" }, "InputTemplate": { "Fn::Join": [ "", [ "{\"detail-type\": , \"time\":