{"Description":"(SO0284) innovation-sandbox-on-aws v1.3.6","Metadata":{"AWS::CloudFormation::Interface":{"ParameterLabels":{"Namespace":{"default":"Namespace"},"HubAccountId":{"default":"Hub Account Id"},"ParentOuId":{"default":"Parent OU Id"},"IsbManagedRegions":{"default":"ISB Managed Regions"},"AdditionalAllowedServices":{"default":"Additional Allowed Services"},"AdditionalPrincipalExceptions":{"default":"Additional Principal Exceptions"},"BedrockInferenceProfilePatterns":{"default":"Bedrock Inference Profile Patterns"}},"ParameterGroups":[{"Label":{"default":"AccountPool Stack Configuration"},"Parameters":["Namespace","HubAccountId","ParentOuId","IsbManagedRegions","AdditionalAllowedServices","AdditionalPrincipalExceptions","BedrockInferenceProfilePatterns"]}]}},"Parameters":{"Namespace":{"Type":"String","Default":"myisb","AllowedPattern":"^[0-9a-zA-Z]{3,8}$","Description":"The namespace for this deployment of Innovation Sandbox (must be the same for all member stacks). Alphanumeric characters of length between 3 and 8"},"HubAccountId":{"Type":"String","AllowedPattern":"^[0-9]{12}$","Description":"The AWS Account Id where the Innovation Sandbox hub application is (to be) deployed"},"ParentOuId":{"Type":"String","AllowedPattern":"^(r-[0-9a-z]{4,32})|(ou-[0-9a-z]{4,32}-[a-z0-9]{8,32})$","Description":"Provide Root id or organization unit id where Innovation Sandbox OUs will be created"},"IsbManagedRegions":{"Type":"CommaDelimitedList","AllowedPattern":"^[a-z]{2}(-[a-z]+-\\d{1})(,[ ]*[a-z]{2}(-[a-z]+-\\d{1}))*$","ConstraintDescription":"Must be a comma-separated list of valid AWS Region codes, e.g., us-east-1,eu-west-1","Description":"Provide list of AWS Regions to limit the use to specific regions."},"AdditionalAllowedServices":{"Type":"CommaDelimitedList","Default":"","AllowedPattern":"^$|^[a-zA-Z0-9-]+:[a-zA-Z0-9*]+(,\\s*[a-zA-Z0-9-]+:[a-zA-Z0-9*]+)*$","ConstraintDescription":"Must be empty or a comma-separated list of service:action patterns (e.g., sts:*,bedrock:*). Each entry must follow service:action format. Bare wildcards like *:* are not allowed.","Description":"Optional comma-separated list of additional AWS service actions to allow in sandbox accounts. Actions that already exist in the default allowed list will appear as duplicates in the SCP, which has no effect. Refer to the Implementation Guide for the default list of supported services."},"AdditionalPrincipalExceptions":{"Type":"CommaDelimitedList","Default":"","AllowedPattern":"^$|^arn:aws:iam::[0-9*]+:role/[a-zA-Z0-9_+=,.@/-]*[a-zA-Z0-9_+=,.@-]+\\*?$","ConstraintDescription":"Must be empty or a valid IAM role ARN (e.g., arn:aws:iam::123456789012:role/MyRole,arn:aws:iam::*:role/ServiceRole*). A bare wildcard role name (arn:aws:iam::*:role/*) is not allowed. Do not use trailing or consecutive commas.","Description":"Optional comma-separated list of IAM role ARNs to exclude from SCP restrictions in sandbox accounts. Supports wildcard (*) at the end of role names. Do not use trailing commas, consecutive commas, or bare wildcards (arn:aws:iam::*:role/*)."},"BedrockInferenceProfilePatterns":{"Type":"CommaDelimitedList","Default":"","AllowedPattern":"^$|^arn:aws:bedrock:[a-z0-9*-]+:[0-9*]+:inference-profile/[a-zA-Z0-9.*:_-]+$","ConstraintDescription":"Must be empty or a comma-separated list of Bedrock inference profile ARN patterns (e.g., arn:aws:bedrock:*:*:inference-profile/*). Each entry must include the inference-profile/ segment. Overly broad patterns like arn:aws:bedrock:*:*:* are not allowed.","Description":"Allow Bedrock cross-region inference by specifying inference profile ARN patterns that are exempt from the region deny SCP. When empty, all cross-region Bedrock calls are blocked by the region restriction SCP. Example patterns: arn:aws:bedrock:*:*:inference-profile/* (all profiles), arn:aws:bedrock:*:*:inference-profile/us.* (US profiles only)."}},"Conditions":{"HasAdditionalAllowedServices":{"Fn::Not":[{"Fn::Equals":[{"Fn::Join":["",{"Ref":"AdditionalAllowedServices"}]},""]}]},"HasAdditionalPrincipalExceptions":{"Fn::Not":[{"Fn::Equals":[{"Fn::Join":["",{"Ref":"AdditionalPrincipalExceptions"}]},""]}]},"HasBedrockInferenceProfilePatterns":{"Fn::Not":[{"Fn::Equals":[{"Fn::Join":["",{"Ref":"BedrockInferenceProfilePatterns"}]},""]}]},"CDKMetadataAvailable":{"Fn::Or":[{"Fn::Or":[{"Fn::Equals":[{"Ref":"AWS::Region"},"af-south-1"]},{"Fn::Equals":[{"Ref":"AWS::Region"},"ap-east-1"]},{"Fn::Equals":[{"Ref":"AWS::Region"},"ap-northeast-1"]},{"Fn::Equals":[{"Ref":"AWS::Region"},"ap-northeast-2"]},{"Fn::Equals":[{"Ref":"AWS::Region"},"ap-northeast-3"]},{"Fn::Equals":[{"Ref":"AWS::Region"},"ap-south-1"]},{"Fn::Equals":[{"Ref":"AWS::Region"},"ap-south-2"]},{"Fn::Equals":[{"Ref":"AWS::Region"},"ap-southeast-1"]},{"Fn::Equals":[{"Ref":"AWS::Region"},"ap-southeast-2"]},{"Fn::Equals":[{"Ref":"AWS::Region"},"ap-southeast-3"]}]},{"Fn::Or":[{"Fn::Equals":[{"Ref":"AWS::Region"},"ap-southeast-4"]},{"Fn::Equals":[{"Ref":"AWS::Region"},"ca-central-1"]},{"Fn::Equals":[{"Ref":"AWS::Region"},"ca-west-1"]},{"Fn::Equals":[{"Ref":"AWS::Region"},"cn-north-1"]},{"Fn::Equals":[{"Ref":"AWS::Region"},"cn-northwest-1"]},{"Fn::Equals":[{"Ref":"AWS::Region"},"eu-central-1"]},{"Fn::Equals":[{"Ref":"AWS::Region"},"eu-central-2"]},{"Fn::Equals":[{"Ref":"AWS::Region"},"eu-north-1"]},{"Fn::Equals":[{"Ref":"AWS::Region"},"eu-south-1"]},{"Fn::Equals":[{"Ref":"AWS::Region"},"eu-south-2"]}]},{"Fn::Or":[{"Fn::Equals":[{"Ref":"AWS::Region"},"eu-west-1"]},{"Fn::Equals":[{"Ref":"AWS::Region"},"eu-west-2"]},{"Fn::Equals":[{"Ref":"AWS::Region"},"eu-west-3"]},{"Fn::Equals":[{"Ref":"AWS::Region"},"il-central-1"]},{"Fn::Equals":[{"Ref":"AWS::Region"},"me-central-1"]},{"Fn::Equals":[{"Ref":"AWS::Region"},"me-south-1"]},{"Fn::Equals":[{"Ref":"AWS::Region"},"sa-east-1"]},{"Fn::Equals":[{"Ref":"AWS::Region"},"us-east-1"]},{"Fn::Equals":[{"Ref":"AWS::Region"},"us-east-2"]},{"Fn::Equals":[{"Ref":"AWS::Region"},"us-west-1"]}]},{"Fn::Equals":[{"Ref":"AWS::Region"},"us-west-2"]}]}},"Resources":{"InnovationSandboxAccountPoolOu":{"Type":"AWS::Organizations::OrganizationalUnit","Properties":{"Name":{"Fn::Join":["",[{"Ref":"Namespace"},"_InnovationSandboxAccountPool"]]},"ParentId":{"Ref":"ParentOuId"},"Tags":[{"Key":"aws-solutions:isb-id","Value":{"Fn::Join":["",[{"Ref":"Namespace"},"_isb"]]}}]},"Metadata":{"aws:cdk:path":"InnovationSandbox-AccountPool/InnovationSandboxAccountPoolOu"}},"AvailableOu":{"Type":"AWS::Organizations::OrganizationalUnit","Properties":{"Name":"Available","ParentId":{"Fn::GetAtt":["InnovationSandboxAccountPoolOu","Id"]},"Tags":[{"Key":"aws-solutions:isb-id","Value":{"Fn::Join":["",[{"Ref":"Namespace"},"_isb"]]}}]},"Metadata":{"aws:cdk:path":"InnovationSandbox-AccountPool/AvailableOu"}},"ActiveOu":{"Type":"AWS::Organizations::OrganizationalUnit","Properties":{"Name":"Active","ParentId":{"Fn::GetAtt":["InnovationSandboxAccountPoolOu","Id"]},"Tags":[{"Key":"aws-solutions:isb-id","Value":{"Fn::Join":["",[{"Ref":"Namespace"},"_isb"]]}}]},"Metadata":{"aws:cdk:path":"InnovationSandbox-AccountPool/ActiveOu"}},"CleanUpOu":{"Type":"AWS::Organizations::OrganizationalUnit","Properties":{"Name":"CleanUp","ParentId":{"Fn::GetAtt":["InnovationSandboxAccountPoolOu","Id"]},"Tags":[{"Key":"aws-solutions:isb-id","Value":{"Fn::Join":["",[{"Ref":"Namespace"},"_isb"]]}}]},"Metadata":{"aws:cdk:path":"InnovationSandbox-AccountPool/CleanUpOu"}},"QuarantineOu":{"Type":"AWS::Organizations::OrganizationalUnit","Properties":{"Name":"Quarantine","ParentId":{"Fn::GetAtt":["InnovationSandboxAccountPoolOu","Id"]},"Tags":[{"Key":"aws-solutions:isb-id","Value":{"Fn::Join":["",[{"Ref":"Namespace"},"_isb"]]}}]},"Metadata":{"aws:cdk:path":"InnovationSandbox-AccountPool/QuarantineOu"}},"EntryOu":{"Type":"AWS::Organizations::OrganizationalUnit","Properties":{"Name":"Entry","ParentId":{"Fn::GetAtt":["InnovationSandboxAccountPoolOu","Id"]},"Tags":[{"Key":"aws-solutions:isb-id","Value":{"Fn::Join":["",[{"Ref":"Namespace"},"_isb"]]}}]},"Metadata":{"aws:cdk:path":"InnovationSandbox-AccountPool/EntryOu"}},"ExitOu":{"Type":"AWS::Organizations::OrganizationalUnit","Properties":{"Name":"Exit","ParentId":{"Fn::GetAtt":["InnovationSandboxAccountPoolOu","Id"]},"Tags":[{"Key":"aws-solutions:isb-id","Value":{"Fn::Join":["",[{"Ref":"Namespace"},"_isb"]]}}]},"Metadata":{"aws:cdk:path":"InnovationSandbox-AccountPool/ExitOu"}},"FrozenOu":{"Type":"AWS::Organizations::OrganizationalUnit","Properties":{"Name":"Frozen","ParentId":{"Fn::GetAtt":["InnovationSandboxAccountPoolOu","Id"]},"Tags":[{"Key":"aws-solutions:isb-id","Value":{"Fn::Join":["",[{"Ref":"Namespace"},"_isb"]]}}]},"Metadata":{"aws:cdk:path":"InnovationSandbox-AccountPool/FrozenOu"}},"InnovationSandboxAwsNukeSupportedServicesScp":{"Type":"AWS::Organizations::Policy","Properties":{"Content":{"Fn::Join":["",["{\"Version\":\"2012-10-17\",\"Statement\":[{\"Sid\":\"DenyAllExceptAwsNukeSupportedServices\",\"Effect\":\"Deny\",\"NotAction\":[","\"access-analyzer:*\",\"acm:*\",\"acm-pca:*\",\"amplify:*\",\"aoss:*\",\"apigateway:*\",\"appconfig:*\",\"application-autoscaling:*\",\"applicationinsights:*\",\"appmesh:*\",\"apprunner:*\",\"appstream:*\",\"appsync:*\",\"aps:*\",\"athena:*\",\"autoscaling:*\",\"autoscaling-plans:*\",\"backup:*\",\"batch:*\",\"bedrock:*\",\"bedrock-agentcore:*\",\"budgets:*\",\"cloud9:*\",\"clouddirectory:*\",\"cloudformation:*\",\"cloudfront:*\",\"cloudhsm:*\",\"cloudsearch:*\",\"cloudshell:*\",\"cloudtrail:*\",\"cloudwatch:*\",\"codeartifact:*\",\"codebuild:*\",\"codecommit:*\",\"codedeploy:*\",\"codeguru-profiler:*\",\"codeguru-reviewer:*\",\"codepipeline:*\",\"codestar:*\",\"cognito-identity:*\",\"cognito-idp:*\",\"comprehend:*\",\"config:*\",\"dms:*\",\"datapipeline:*\",\"dax:*\",\"databrew:*\",\"devicefarm:*\",\"docdb-elastic:*\",\"ds:*\",\"dsql:*\",\"dynamodb:*\",\"ec2:*\",\"ec2messages:*\",\"ecr:*\",\"ecr-public:*\",\"ecs:*\",\"elasticfilesystem:*\",\"eks:*\",\"eks-auth:*\",\"elasticache:*\",\"elasticbeanstalk:*\",\"es:*\",\"elastictranscoder:*\",\"elasticloadbalancing:*\",\"elasticmapreduce:*\",\"events:*\",\"execute-api:*\",\"firehose:*\",\"fms:*\",\"fsx:*\",\"gamelift:*\",\"globalaccelerator:*\",\"glue:*\",\"grafana:*\",\"guardduty:*\",\"iam:*\",\"imagebuilder:*\",\"inspector:*\",\"inspector2:*\",\"iot:*\",\"iotsitewise:*\",\"iottwinmaker:*\",\"kendra:*\",\"kinesis:*\",\"kinesisanalytics:*\",\"kinesisvideo:*\",\"kms:*\",\"lakeformation:*\",\"lambda:*\",\"lightsail:*\",\"logs:*\",\"machinelearning:*\",\"macie2:*\",\"managedblockchain:*\",\"mediaconvert:*\",\"medialive:*\",\"mediapackage:*\",\"mediastore:*\",\"mediatailor:*\",\"memorydb:*\",\"mgn:*\",\"mq:*\",\"kafka:*\",\"neptune-db:*\",\"networkmanager:*\",\"opensearch:*\",\"opsworks:*\",\"opsworks-cm:*\",\"sms-voice:*\",\"q:*\",\"pipes:*\",\"polly:*\",\"qldb:*\",\"quicksight:*\",\"rds:*\",\"redshift:*\",\"redshift-serverless:*\",\"rekognition:*\",\"resource-explorer-2:*\",\"resource-groups:*\",\"robomaker:*\",\"route53:*\",\"route53resolver:*\",\"s3:*\",\"s3files:*\",\"s3tables:*\",\"s3vectors:*\",\"sagemaker:*\",\"scheduler:*\",\"secretsmanager:*\",\"securityhub:*\",\"servicecatalog:*\",\"servicediscovery:*\",\"ses:*\",\"states:*\",\"signer:*\",\"sdb:*\",\"sns:*\",\"sqs:*\",\"ssm:*\",\"ssm-guiconnect:*\",\"ssmmessages:*\",\"storagegateway:*\",\"sts:*\",\"tag:*\",\"textract:*\",\"timestream:*\",\"transcribe:*\",\"transfer:*\",\"waf:*\",\"wafv2:*\",\"workspaces:*\",\"xray:*\"",{"Fn::If":["HasAdditionalAllowedServices",{"Fn::Join":["",[",\"",{"Fn::Join":["\",\"",{"Ref":"AdditionalAllowedServices"}]},"\""]]},""]},"],\"Resource\":[\"*\"],\"Condition\":","{\"ArnNotLike\":{\"aws:PrincipalARN\":[",{"Fn::Join":["",["\"arn:aws:iam::*:role/InnovationSandbox-",{"Ref":"Namespace"},"*\",\"arn:aws:iam::*:role/aws-reserved/sso.amazonaws.com/*AWSReservedSSO_",{"Ref":"Namespace"},"_IsbAdmins*\",\"arn:aws:iam::*:role/stacksets-exec-*\",\"arn:aws:iam::*:role/AWSControlTowerExecution\""]]},{"Fn::If":["HasAdditionalPrincipalExceptions",{"Fn::Join":["",[",\"",{"Fn::Join":["\",\"",{"Ref":"AdditionalPrincipalExceptions"}]},"\""]]},""]},"]}}","}]}"]]},"Description":"Service Control Policy (SCP) to allow only services supported by AWS Nuke clean workflow. ","Name":{"Fn::Join":["",[{"Ref":"Namespace"},"-InnovationSandboxAwsNukeSupportedServicesScp"]]},"Tags":[{"Key":"aws-solutions:isb-id","Value":{"Fn::Join":["",[{"Ref":"Namespace"},"_isb"]]}}],"TargetIds":[{"Fn::GetAtt":["InnovationSandboxAccountPoolOu","Id"]}],"Type":"SERVICE_CONTROL_POLICY"},"Metadata":{"aws:cdk:path":"InnovationSandbox-AccountPool/InnovationSandboxAwsNukeSupportedServicesScp"}},"InnovationSandboxRestrictionsScp":{"Type":"AWS::Organizations::Policy","Properties":{"Content":{"Statement":[{"Action":["aws-portal:ModifyAccount","aws-portal:ViewAccount","cloudtrail:CreateServiceLinkedChannel","cloudtrail:UpdateServiceLinkedChannel","iam:CreateUser","networkmanager:AssociateTransitGatewayConnectPeer","networkmanager:DisassociateTransitGatewayConnectPeer","networkmanager:StartOrganizationServiceAccessUpdate","ram:CreateResourceShare","ram:EnableSharingWithAwsOrganization","ssm:ModifyDocumentPermission","wafv2:DisassociateFirewallManager","wafv2:PutFirewallManagerRuleGroups","cloudtrail:LookupEvents"],"Condition":{"ArnNotLike":{"aws:PrincipalARN":{"Fn::If":["HasAdditionalPrincipalExceptions",{"Fn::Split":["|",{"Fn::Join":["|",[{"Fn::Join":["",["arn:aws:iam::*:role/InnovationSandbox-",{"Ref":"Namespace"},"*"]]},{"Fn::Join":["",["arn:aws:iam::*:role/aws-reserved/sso.amazonaws.com/*AWSReservedSSO_",{"Ref":"Namespace"},"_IsbAdmins*"]]},"arn:aws:iam::*:role/stacksets-exec-*","arn:aws:iam::*:role/AWSControlTowerExecution",{"Fn::Join":["|",{"Ref":"AdditionalPrincipalExceptions"}]}]]}]},[{"Fn::Join":["",["arn:aws:iam::*:role/InnovationSandbox-",{"Ref":"Namespace"},"*"]]},{"Fn::Join":["",["arn:aws:iam::*:role/aws-reserved/sso.amazonaws.com/*AWSReservedSSO_",{"Ref":"Namespace"},"_IsbAdmins*"]]},"arn:aws:iam::*:role/stacksets-exec-*","arn:aws:iam::*:role/AWSControlTowerExecution"]]}}},"Effect":"Deny","Resource":"*","Sid":"SecurityAndIsolationRestrictions"},{"Action":["aws-portal:ModifyBilling","aws-portal:ModifyPaymentMethods","ce:CreateAnomalyMonitor","ce:CreateAnomalySubscription","ce:CreateCostCategoryDefinition","ce:CreateNotificationSubscription","ce:CreateReport","ce:UpdatePreferences","devicefarm:Purchase*","devicefarm:RenewOffering","dynamodb:Purchase*","ec2:AcceptReservedInstancesExchangeQuote","ec2:EnableIpamOrganizationAdminAccount","ec2:ModifyReservedInstances","ec2:Purchase*","elasticache:Purchase*","es:Purchase*","glacier:Purchase*","mediaconnect:Purchase*","medialive:Purchase*","rds:Purchase*","redshift:Purchase*","shield:AssociateDRTRole","shield:CreateProtection","shield:CreateSubscription","shield:UpdateEmergencyContactSettings"],"Condition":{"ArnNotLike":{"aws:PrincipalARN":{"Fn::If":["HasAdditionalPrincipalExceptions",{"Fn::Split":["|",{"Fn::Join":["|",[{"Fn::Join":["",["arn:aws:iam::*:role/InnovationSandbox-",{"Ref":"Namespace"},"*"]]},{"Fn::Join":["",["arn:aws:iam::*:role/aws-reserved/sso.amazonaws.com/*AWSReservedSSO_",{"Ref":"Namespace"},"_IsbAdmins*"]]},"arn:aws:iam::*:role/stacksets-exec-*","arn:aws:iam::*:role/AWSControlTowerExecution",{"Fn::Join":["|",{"Ref":"AdditionalPrincipalExceptions"}]}]]}]},[{"Fn::Join":["",["arn:aws:iam::*:role/InnovationSandbox-",{"Ref":"Namespace"},"*"]]},{"Fn::Join":["",["arn:aws:iam::*:role/aws-reserved/sso.amazonaws.com/*AWSReservedSSO_",{"Ref":"Namespace"},"_IsbAdmins*"]]},"arn:aws:iam::*:role/stacksets-exec-*","arn:aws:iam::*:role/AWSControlTowerExecution"]]}}},"Effect":"Deny","Resource":"*","Sid":"CostImplicationRestrictions"},{"Action":["account:EnableRegion","auditmanager:DeregisterOrganizationAdminAccount","auditmanager:RegisterOrganizationAdminAccount","backup:PutBackupVaultLockConfiguration","bedrock-agentcore:*Registry*","cassandra:UpdatePartitioner","chime:*","cloudhsm:*","deepcomposer:AssociateCoupon","directconnect:AllocateConnectionOnInterconnect","directconnect:AllocateHostedConnection","directconnect:AssociateHostedConnection","directconnect:CreateInterconnect","drs:CreateExtendedSourceServer","elasticache:PurchaseReservedCacheNodesOffering","events:CreatePartnerEventSource","glacier:AbortVaultLock","glacier:CompleteVaultLock","glacier:InitiateVaultLock","glacier:SetVaultAccessPolicy","iotevents:PutLoggingOptions","iotsitewise:CreateBulkImportJob","lambda:CreateCodeSigningConfig","license-manager:CreateLicenseConversionTaskForResource","macie2:UpdateOrganizationConfiguration","mediaConvert:CreateQueue","medialive:ClaimDevice","mgn:*","robomaker:CreateDeploymentJob","robomaker:CreateFleet","robomaker:CreateRobot","robomaker:DeregisterRobot","robomaker:RegisterRobot","robomaker:SyncDeploymentJob","robomaker:UpdateRobotDeployment","route53domains:*","s3-object-lambda:PutObjectLegalHold","s3-object-lambda:PutObjectRetention","s3:PutObjectLegalHold","ses:PutDeliverabilityDashboardOption","storagegateway:*","wam:*","wellarchitected:UpdateGlobalSettings","workmail:AssumeImpersonationRole","workmail:CreateImpersonationRole","workmail:UpdateImpersonationRole","workspaces:ModifyAccount"],"Condition":{"ArnNotLike":{"aws:PrincipalARN":{"Fn::If":["HasAdditionalPrincipalExceptions",{"Fn::Split":["|",{"Fn::Join":["|",[{"Fn::Join":["",["arn:aws:iam::*:role/InnovationSandbox-",{"Ref":"Namespace"},"*"]]},{"Fn::Join":["",["arn:aws:iam::*:role/aws-reserved/sso.amazonaws.com/*AWSReservedSSO_",{"Ref":"Namespace"},"_IsbAdmins*"]]},"arn:aws:iam::*:role/stacksets-exec-*","arn:aws:iam::*:role/AWSControlTowerExecution",{"Fn::Join":["|",{"Ref":"AdditionalPrincipalExceptions"}]}]]}]},[{"Fn::Join":["",["arn:aws:iam::*:role/InnovationSandbox-",{"Ref":"Namespace"},"*"]]},{"Fn::Join":["",["arn:aws:iam::*:role/aws-reserved/sso.amazonaws.com/*AWSReservedSSO_",{"Ref":"Namespace"},"_IsbAdmins*"]]},"arn:aws:iam::*:role/stacksets-exec-*","arn:aws:iam::*:role/AWSControlTowerExecution"]]}}},"Effect":"Deny","Resource":"*","Sid":"OperationalRestrictions"},{"Action":"events:PutRule","Effect":"Deny","Resource":["arn:aws:events:*:*:rule/SIRGuardDutyRule","arn:aws:events:*:*:rule/SIRSecurityHubRule"],"Sid":"ProtectSIREventBridgeRules"}],"Version":"2012-10-17"},"Description":"Service Control Policy (SCP) to add restrictions for security, isolation, cost and operations related resources.","Name":{"Fn::Join":["",[{"Ref":"Namespace"},"-InnovationSandboxRestrictionsScp"]]},"Tags":[{"Key":"aws-solutions:isb-id","Value":{"Fn::Join":["",[{"Ref":"Namespace"},"_isb"]]}}],"TargetIds":[{"Fn::GetAtt":["InnovationSandboxAccountPoolOu","Id"]}],"Type":"SERVICE_CONTROL_POLICY"},"Metadata":{"aws:cdk:path":"InnovationSandbox-AccountPool/InnovationSandboxRestrictionsScp"}},"InnovationSandboxProtectISBScp":{"Type":"AWS::Organizations::Policy","Properties":{"Content":{"Statement":[{"Action":"*","Condition":{"ArnNotLike":{"aws:PrincipalARN":[{"Fn::Join":["",["arn:aws:iam::*:role/InnovationSandbox-",{"Ref":"Namespace"},"*"]]},{"Fn::Join":["",["arn:aws:iam::*:role/aws-reserved/sso.amazonaws.com/*AWSReservedSSO_",{"Ref":"Namespace"},"_IsbAdmins*"]]},"arn:aws:iam::*:role/stacksets-exec-*","arn:aws:iam::*:role/AWSControlTowerExecution"]}},"Effect":"Deny","Resource":[{"Fn::Join":["",["arn:aws:iam::*:role/InnovationSandbox-",{"Ref":"Namespace"},"*"]]},"arn:aws:iam::*:role/AWSReservedSSO*",{"Fn::Join":["",["arn:aws:*:*:*:*Isb-",{"Ref":"Namespace"},"*"]]},"arn:aws:iam::*:role/stacksets-exec-*","arn:aws:iam::*:saml-provider/*AWSSSO*"],"Sid":"ProtectIsbControlPlaneResources"},{"Action":["resource-explorer-2:DeleteIndex","resource-explorer-2:UpdateIndexType","resource-explorer-2:AssociateDefaultView","resource-explorer-2:DisassociateDefaultView"],"Condition":{"ArnNotLike":{"aws:PrincipalARN":[{"Fn::Join":["",["arn:aws:iam::*:role/InnovationSandbox-",{"Ref":"Namespace"},"*"]]},{"Fn::Join":["",["arn:aws:iam::*:role/aws-reserved/sso.amazonaws.com/*AWSReservedSSO_",{"Ref":"Namespace"},"_IsbAdmins*"]]},"arn:aws:iam::*:role/stacksets-exec-*","arn:aws:iam::*:role/AWSControlTowerExecution"]}},"Effect":"Deny","Resource":"*","Sid":"ProtectIsbResourceExplorerIndex"},{"Action":["resource-explorer-2:DeleteView","resource-explorer-2:UpdateView"],"Condition":{"ArnNotLike":{"aws:PrincipalARN":[{"Fn::Join":["",["arn:aws:iam::*:role/InnovationSandbox-",{"Ref":"Namespace"},"*"]]},{"Fn::Join":["",["arn:aws:iam::*:role/aws-reserved/sso.amazonaws.com/*AWSReservedSSO_",{"Ref":"Namespace"},"_IsbAdmins*"]]},"arn:aws:iam::*:role/stacksets-exec-*","arn:aws:iam::*:role/AWSControlTowerExecution"]}},"Effect":"Deny","Resource":"arn:aws:resource-explorer-2:*:*:view/isb-post-cleanup-validator/*","Sid":"ProtectIsbResourceExplorerValidatorView"},{"Action":"*","Condition":{"ArnNotLike":{"aws:PrincipalARN":["arn:aws:iam::*:role/AWSControlTowerExecution","arn:aws:iam::*:role/stacksets-exec-*"]}},"Effect":"Deny","Resource":["arn:aws:cloudtrail:*:*:trail/aws-controltower-*","arn:aws:events:*:*:rule/aws-controltower-*","arn:aws:events:*:*:rule/*AWSControlTower*","arn:aws:lambda:*:*:function:aws-controltower-*","arn:aws:logs:*:*:log-group:*aws-controltower*","arn:aws:sns:*:*:aws-controltower-*","arn:aws:iam::*:role/aws-controltower-*","arn:aws:iam::*:role/*AWSControlTower*"],"Sid":"ProtectControlTowerResources"},{"Action":["config:DeleteConfigurationRecorder","config:DeleteDeliveryChannel","config:DeleteRetentionConfiguration","config:PutConfigurationRecorder","config:PutDeliveryChannel","config:PutRetentionConfiguration","config:StopConfigurationRecorder"],"Condition":{"ArnNotLike":{"aws:PrincipalARN":"arn:aws:iam::*:role/AWSControlTowerExecution"}},"Effect":"Deny","Resource":"*","Sid":"DenyConfigActions"},{"Action":"config:*","Condition":{"StringEquals":{"aws:ResourceTag/aws-control-tower":"managed-by-control-tower"},"ArnNotLike":{"aws:PrincipalARN":"arn:aws:iam::*:role/AWSControlTowerExecution"}},"Effect":"Deny","Resource":"*","Sid":"ProtectControlTowerTaggedConfigResources"},{"Action":["config:TagResource","config:UntagResource"],"Condition":{"ForAnyValue:StringEqualsIgnoreCase":{"aws:TagKeys":"aws-control-tower"},"ArnNotLike":{"aws:PrincipalARN":"arn:aws:iam::*:role/AWSControlTowerExecution"}},"Effect":"Deny","Resource":"*","Sid":"DenyControlTowerConfigTagActions"}],"Version":"2012-10-17"},"Description":"Service Control Policy (SCP) for Innovation Sandbox to protect ISB control plane resources.","Name":{"Fn::Join":["",[{"Ref":"Namespace"},"-InnovationSandboxProtectISBResourcesScp"]]},"Tags":[{"Key":"aws-solutions:isb-id","Value":{"Fn::Join":["",[{"Ref":"Namespace"},"_isb"]]}}],"TargetIds":[{"Fn::GetAtt":["InnovationSandboxAccountPoolOu","Id"]}],"Type":"SERVICE_CONTROL_POLICY"},"Metadata":{"aws:cdk:path":"InnovationSandbox-AccountPool/InnovationSandboxProtectISBScp"}},"InnovationSandboxLimitRegionsScp":{"Type":"AWS::Organizations::Policy","Properties":{"Content":{"Statement":[{"Action":"*","Condition":{"StringNotEquals":{"aws:RequestedRegion":{"Ref":"IsbManagedRegions"}},"ArnNotLike":{"Fn::If":["HasBedrockInferenceProfilePatterns",{"aws:PrincipalARN":{"Fn::If":["HasAdditionalPrincipalExceptions",{"Fn::Split":["|",{"Fn::Join":["|",[{"Fn::Join":["",["arn:aws:iam::*:role/InnovationSandbox-",{"Ref":"Namespace"},"*"]]},{"Fn::Join":["",["arn:aws:iam::*:role/aws-reserved/sso.amazonaws.com/*AWSReservedSSO_",{"Ref":"Namespace"},"_IsbAdmins*"]]},"arn:aws:iam::*:role/stacksets-exec-*","arn:aws:iam::*:role/AWSControlTowerExecution",{"Fn::Join":["|",{"Ref":"AdditionalPrincipalExceptions"}]}]]}]},[{"Fn::Join":["",["arn:aws:iam::*:role/InnovationSandbox-",{"Ref":"Namespace"},"*"]]},{"Fn::Join":["",["arn:aws:iam::*:role/aws-reserved/sso.amazonaws.com/*AWSReservedSSO_",{"Ref":"Namespace"},"_IsbAdmins*"]]},"arn:aws:iam::*:role/stacksets-exec-*","arn:aws:iam::*:role/AWSControlTowerExecution"]]},"bedrock:InferenceProfileArn":{"Ref":"BedrockInferenceProfilePatterns"}},{"aws:PrincipalARN":{"Fn::If":["HasAdditionalPrincipalExceptions",{"Fn::Split":["|",{"Fn::Join":["|",[{"Fn::Join":["",["arn:aws:iam::*:role/InnovationSandbox-",{"Ref":"Namespace"},"*"]]},{"Fn::Join":["",["arn:aws:iam::*:role/aws-reserved/sso.amazonaws.com/*AWSReservedSSO_",{"Ref":"Namespace"},"_IsbAdmins*"]]},"arn:aws:iam::*:role/stacksets-exec-*","arn:aws:iam::*:role/AWSControlTowerExecution",{"Fn::Join":["|",{"Ref":"AdditionalPrincipalExceptions"}]}]]}]},[{"Fn::Join":["",["arn:aws:iam::*:role/InnovationSandbox-",{"Ref":"Namespace"},"*"]]},{"Fn::Join":["",["arn:aws:iam::*:role/aws-reserved/sso.amazonaws.com/*AWSReservedSSO_",{"Ref":"Namespace"},"_IsbAdmins*"]]},"arn:aws:iam::*:role/stacksets-exec-*","arn:aws:iam::*:role/AWSControlTowerExecution"]]}}]}},"Effect":"Deny","Resource":"*","Sid":"DenyRegionAccess"}],"Version":"2012-10-17"},"Description":"Service Control Policy (SCP) for Innovation Sandbox to limit use of AWS Regions.","Name":{"Fn::Join":["",[{"Ref":"Namespace"},"-InnovationSandboxLimitRegionsScp"]]},"Tags":[{"Key":"aws-solutions:isb-id","Value":{"Fn::Join":["",[{"Ref":"Namespace"},"_isb"]]}}],"TargetIds":[{"Fn::GetAtt":["InnovationSandboxAccountPoolOu","Id"]}],"Type":"SERVICE_CONTROL_POLICY"},"Metadata":{"aws:cdk:path":"InnovationSandbox-AccountPool/InnovationSandboxLimitRegionsScp"}},"InnovationSandboxWriteProtectionScp":{"Type":"AWS::Organizations::Policy","Properties":{"Content":{"Statement":[{"Action":"*","Condition":{"ArnNotLike":{"aws:PrincipalARN":{"Fn::If":["HasAdditionalPrincipalExceptions",{"Fn::Split":["|",{"Fn::Join":["|",[{"Fn::Join":["",["arn:aws:iam::*:role/InnovationSandbox-",{"Ref":"Namespace"},"*"]]},{"Fn::Join":["",["arn:aws:iam::*:role/aws-reserved/sso.amazonaws.com/*AWSReservedSSO_",{"Ref":"Namespace"},"_IsbAdmins*"]]},"arn:aws:iam::*:role/stacksets-exec-*","arn:aws:iam::*:role/AWSControlTowerExecution",{"Fn::Join":["|",{"Ref":"AdditionalPrincipalExceptions"}]}]]}]},[{"Fn::Join":["",["arn:aws:iam::*:role/InnovationSandbox-",{"Ref":"Namespace"},"*"]]},{"Fn::Join":["",["arn:aws:iam::*:role/aws-reserved/sso.amazonaws.com/*AWSReservedSSO_",{"Ref":"Namespace"},"_IsbAdmins*"]]},"arn:aws:iam::*:role/stacksets-exec-*","arn:aws:iam::*:role/AWSControlTowerExecution"]]}}},"Effect":"Deny","Resource":"*","Sid":"DenyAllExceptIsbRoles"}],"Version":"2012-10-17"},"Description":"Service Control Policy (SCP) for Innovation Sandbox to restrict all resource to create or modify actions.","Name":{"Fn::Join":["",[{"Ref":"Namespace"},"-InnovationSandboxWriteProtectionScp"]]},"Tags":[{"Key":"aws-solutions:isb-id","Value":{"Fn::Join":["",[{"Ref":"Namespace"},"_isb"]]}}],"TargetIds":[{"Fn::GetAtt":["AvailableOu","Id"]},{"Fn::GetAtt":["CleanUpOu","Id"]},{"Fn::GetAtt":["QuarantineOu","Id"]},{"Fn::GetAtt":["EntryOu","Id"]},{"Fn::GetAtt":["ExitOu","Id"]}],"Type":"SERVICE_CONTROL_POLICY"},"Metadata":{"aws:cdk:path":"InnovationSandbox-AccountPool/InnovationSandboxWriteProtectionScp"}},"OrgMgtRoleADB4C27C":{"Type":"AWS::IAM::Role","Properties":{"AssumeRolePolicyDocument":{"Statement":[{"Action":"sts:AssumeRole","Condition":{"ArnEquals":{"aws:PrincipalArn":{"Fn::Join":["",["arn:",{"Ref":"AWS::Partition"},":iam::",{"Ref":"HubAccountId"},":role/InnovationSandbox-",{"Ref":"Namespace"},"-IntermediateRole"]]}}},"Effect":"Allow","Principal":{"AWS":{"Fn::Join":["",["arn:",{"Ref":"AWS::Partition"},":iam::",{"Ref":"HubAccountId"},":root"]]}}}],"Version":"2012-10-17"},"Description":"Role to be assumed for operations on the org management account","RoleName":{"Fn::Join":["",["InnovationSandbox-",{"Ref":"Namespace"},"-OrgMgtRole"]]},"Tags":[{"Key":"aws-solutions:isb-id","Value":{"Fn::Join":["",[{"Ref":"Namespace"},"_isb"]]}}]},"Metadata":{"aws:cdk:path":"InnovationSandbox-AccountPool/OrgMgtRole/Resource","guard":{"SuppressedRules":["CFN_NO_EXPLICIT_RESOURCE_NAMES"]}}},"OrganizationsPolicyFD65B3A6":{"Type":"AWS::IAM::Policy","Properties":{"PolicyDocument":{"Statement":[{"Action":["organizations:ListOrganizationalUnitsForParent","organizations:ListAccountsForParent"],"Effect":"Allow","Resource":[{"Fn::GetAtt":["InnovationSandboxAccountPoolOu","Arn"]},{"Fn::GetAtt":["AvailableOu","Arn"]},{"Fn::GetAtt":["ActiveOu","Arn"]},{"Fn::GetAtt":["CleanUpOu","Arn"]},{"Fn::GetAtt":["QuarantineOu","Arn"]},{"Fn::GetAtt":["EntryOu","Arn"]},{"Fn::GetAtt":["ExitOu","Arn"]},{"Fn::GetAtt":["FrozenOu","Arn"]}]},{"Action":"organizations:MoveAccount","Effect":"Allow","Resource":[{"Fn::GetAtt":["AvailableOu","Arn"]},{"Fn::GetAtt":["ActiveOu","Arn"]},{"Fn::GetAtt":["CleanUpOu","Arn"]},{"Fn::GetAtt":["QuarantineOu","Arn"]},{"Fn::GetAtt":["EntryOu","Arn"]},{"Fn::GetAtt":["ExitOu","Arn"]},{"Fn::GetAtt":["FrozenOu","Arn"]},{"Fn::Join":["",["arn:",{"Ref":"AWS::Partition"},":organizations::",{"Ref":"AWS::AccountId"},":account/",{"Fn::Select":[1,{"Fn::Split":["/",{"Fn::GetAtt":["InnovationSandboxAccountPoolOu","Arn"]}]}]},"/*"]]},{"Fn::Join":["",["arn:",{"Ref":"AWS::Partition"},":organizations::",{"Ref":"AWS::AccountId"},":root/",{"Fn::Select":[1,{"Fn::Split":["/",{"Fn::GetAtt":["InnovationSandboxAccountPoolOu","Arn"]}]}]},"/*"]]}]},{"Action":"organizations:DescribeAccount","Effect":"Allow","Resource":{"Fn::Join":["",["arn:",{"Ref":"AWS::Partition"},":organizations::",{"Ref":"AWS::AccountId"},":account/",{"Fn::Select":[1,{"Fn::Split":["/",{"Fn::GetAtt":["InnovationSandboxAccountPoolOu","Arn"]}]}]},"/*"]]}},{"Action":["organizations:TagResource","organizations:UntagResource"],"Condition":{"ForAllValues:StringEquals":{"aws:TagKeys":[{"Fn::Join":["",["ISB-",{"Ref":"Namespace"},":LeaseId"]]},{"Fn::Join":["",["ISB-",{"Ref":"Namespace"},":CostReportGroup"]]},{"Fn::Join":["",["ISB-",{"Ref":"Namespace"},":LeaseTemplate"]]},{"Fn::Join":["",["ISB-",{"Ref":"Namespace"},":User"]]},{"Fn::Join":["",["ISB-",{"Ref":"Namespace"},":Status"]]}]}},"Effect":"Allow","Resource":{"Fn::Join":["",["arn:",{"Ref":"AWS::Partition"},":organizations::",{"Ref":"AWS::AccountId"},":account/",{"Fn::Select":[1,{"Fn::Split":["/",{"Fn::GetAtt":["InnovationSandboxAccountPoolOu","Arn"]}]}]},"/*"]]}}],"Version":"2012-10-17"},"PolicyName":"OrganizationsPolicyFD65B3A6","Roles":[{"Ref":"OrgMgtRoleADB4C27C"}]},"Metadata":{"aws:cdk:path":"InnovationSandbox-AccountPool/OrganizationsPolicy/Resource"}},"CostExplorerPolicy2242901C":{"Type":"AWS::IAM::Policy","Properties":{"PolicyDocument":{"Statement":[{"Action":["ce:GetCostAndUsage","ce:UpdateCostAllocationTagsStatus","ce:ListCostAllocationTags"],"Effect":"Allow","Resource":"*"}],"Version":"2012-10-17"},"PolicyName":"CostExplorerPolicy2242901C","Roles":[{"Ref":"OrgMgtRoleADB4C27C"}]},"Metadata":{"aws:cdk:path":"InnovationSandbox-AccountPool/CostExplorerPolicy/Resource"}},"AccountPoolConfigurationCF37E5E0":{"Type":"AWS::SSM::Parameter","Properties":{"Description":"The Account pool configuration for Innovation Sandbox","Name":{"Fn::Join":["",["InnovationSandbox_",{"Ref":"Namespace"},"_AccountPool_Configuration"]]},"Tags":{"aws-solutions:isb-id":{"Fn::Join":["",[{"Ref":"Namespace"},"_isb"]]}},"Tier":"Advanced","Type":"String","Value":{"Fn::Join":["",["{\"sandboxOuId\":\"",{"Fn::GetAtt":["InnovationSandboxAccountPoolOu","Id"]},"\",\"availableOuId\":\"",{"Fn::GetAtt":["AvailableOu","Id"]},"\",\"activeOuId\":\"",{"Fn::GetAtt":["ActiveOu","Id"]},"\",\"frozenOuId\":\"",{"Fn::GetAtt":["FrozenOu","Id"]},"\",\"cleanupOuId\":\"",{"Fn::GetAtt":["CleanUpOu","Id"]},"\",\"quarantineOuId\":\"",{"Fn::GetAtt":["QuarantineOu","Id"]},"\",\"entryOuId\":\"",{"Fn::GetAtt":["EntryOu","Id"]},"\",\"exitOuId\":\"",{"Fn::GetAtt":["ExitOu","Id"]},"\",\"solutionVersion\":\"",{"Fn::FindInMap":["Mapping","context","version",{"DefaultValue":""}]},"\",\"supportedSchemas\":\"[\\\"1\\\"]\",\"isbManagedRegions\":\"",{"Fn::Join":[",",{"Ref":"IsbManagedRegions"}]},"\",\"additionalAllowedServices\":\"",{"Fn::Join":[",",{"Ref":"AdditionalAllowedServices"}]},"\",\"bedrockInferenceProfilePatterns\":\"",{"Fn::Join":[",",{"Ref":"BedrockInferenceProfilePatterns"}]},"\"}"]]}},"Metadata":{"aws:cdk:path":"InnovationSandbox-AccountPool/AccountPoolConfiguration/Resource"}},"AccountPoolConfigParameterShare":{"Type":"AWS::RAM::ResourceShare","Properties":{"AllowExternalPrincipals":false,"Name":{"Fn::Join":["",["Isb-",{"Ref":"Namespace"},"-AccountPoolConfigShare"]]},"PermissionArns":["arn:aws:ram::aws:permission/AWSRAMDefaultPermissionSSMParameterReadOnly"],"Principals":[{"Ref":"HubAccountId"}],"ResourceArns":[{"Fn::Join":["",["arn:",{"Ref":"AWS::Partition"},":ssm:",{"Ref":"AWS::Region"},":",{"Ref":"AWS::AccountId"},":parameter/",{"Ref":"AccountPoolConfigurationCF37E5E0"}]]}],"Tags":[{"Key":"aws-solutions:isb-id","Value":{"Fn::Join":["",[{"Ref":"Namespace"},"_isb"]]}}]},"Metadata":{"aws:cdk:path":"InnovationSandbox-AccountPool/AccountPoolConfigParameterShare"}},"IsbStackSet":{"Type":"AWS::CloudFormation::StackSet","Properties":{"AutoDeployment":{"Enabled":true,"RetainStacksOnAccountRemoval":false},"Capabilities":["CAPABILITY_NAMED_IAM"],"Description":"StackSet for Innovation Sandbox","ManagedExecution":{"Active":true},"OperationPreferences":{"ConcurrencyMode":"SOFT_FAILURE_TOLERANCE","FailureTolerancePercentage":100,"MaxConcurrentPercentage":100,"RegionConcurrencyType":"PARALLEL"},"Parameters":[{"ParameterKey":"Namespace","ParameterValue":{"Ref":"Namespace"}},{"ParameterKey":"HubAccountId","ParameterValue":{"Ref":"HubAccountId"}}],"PermissionModel":"SERVICE_MANAGED","StackInstancesGroup":[{"DeploymentTargets":{"OrganizationalUnitIds":[{"Fn::GetAtt":["InnovationSandboxAccountPoolOu","Id"]}]},"Regions":[{"Ref":"AWS::Region"}]}],"StackSetName":{"Fn::Join":["",["Isb-",{"Ref":"Namespace"},"-SandboxAccountResources"]]},"Tags":[{"Key":"aws-solutions:isb-id","Value":{"Fn::Join":["",[{"Ref":"Namespace"},"_isb"]]}}],"TemplateURL":{"Fn::Sub":"https://s3.${AWS::Region}.${AWS::URLSuffix}/solutions-${AWS::Region}/innovation-sandbox-on-aws/v1.3.6/asset.7627b00ac0802560e6a07e89d14567778336c12db86e3d56ab5116b7ffe264fc.json"}},"Metadata":{"aws:cdk:path":"InnovationSandbox-AccountPool/IsbStackSet"}},"CostAllocationTagActivatorFunctionRole1DE7A39F":{"Type":"AWS::IAM::Role","Properties":{"AssumeRolePolicyDocument":{"Statement":[{"Action":"sts:AssumeRole","Effect":"Allow","Principal":{"Service":"lambda.amazonaws.com"}}],"Version":"2012-10-17"},"Tags":[{"Key":"aws-solutions:isb-id","Value":{"Fn::Join":["",[{"Ref":"Namespace"},"_isb"]]}}]},"Metadata":{"aws:cdk:path":"InnovationSandbox-AccountPool/CostAllocationTagActivator/CostAllocationTagActivator/FunctionRole/Resource"}},"CostAllocationTagActivatorFunctionRoleDefaultPolicy6801705B":{"Type":"AWS::IAM::Policy","Properties":{"PolicyDocument":{"Statement":[{"Action":["xray:PutTraceSegments","xray:PutTelemetryRecords"],"Effect":"Allow","Resource":"*"},{"Action":["logs:CreateLogStream","logs:PutLogEvents"],"Effect":"Allow","Resource":{"Fn::GetAtt":["ISBLogGroupCustomResources63629E09","Arn"]}},{"Action":"ce:UpdateCostAllocationTagsStatus","Effect":"Allow","Resource":"*"}],"Version":"2012-10-17"},"PolicyName":"CostAllocationTagActivatorFunctionRoleDefaultPolicy6801705B","Roles":[{"Ref":"CostAllocationTagActivatorFunctionRole1DE7A39F"}]},"Metadata":{"aws:cdk:path":"InnovationSandbox-AccountPool/CostAllocationTagActivator/CostAllocationTagActivator/FunctionRole/DefaultPolicy/Resource"}},"CostAllocationTagActivatorFunctionBF9E923D":{"Type":"AWS::Lambda::Function","Properties":{"Architectures":["arm64"],"Code":{"S3Bucket":{"Fn::Sub":"solutions-${AWS::Region}"},"S3Key":"innovation-sandbox-on-aws/v1.3.6/asset.11033f24b19b7562917710b3c983dab341fcf81a74ef357b8d60af672c3c2989.zip"},"Description":"Custom resource lambda that activates the cost allocation tag","Environment":{"Variables":{"NODE_OPTIONS":"--enable-source-maps","USER_AGENT_EXTRA":"AwsSolution/SO0284/v1.3.6","POWERTOOLS_SERVICE_NAME":"innovation-sandbox","AWS_XRAY_CONTEXT_MISSING":"IGNORE_ERROR","ISB_TAG_NAME":"aws-solutions:isb-id"}},"FunctionName":{"Fn::Join":["",["ISB-CostAllocationTagActivator-",{"Ref":"Namespace"}]]},"Handler":"index.handler","Layers":[{"Ref":"CostAllocationTagActivatorISBLambdaLayerInnovationSandboxAccountPoolDependenciesLayerVersion6803FFB4"},{"Ref":"CostAllocationTagActivatorISBLambdaLayerInnovationSandboxAccountPoolCommonLayerVersion50519BCF"}],"LoggingConfig":{"ApplicationLogLevel":"INFO","LogFormat":"JSON","LogGroup":{"Ref":"ISBLogGroupCustomResources63629E09"},"SystemLogLevel":"INFO"},"MemorySize":1024,"Role":{"Fn::GetAtt":["CostAllocationTagActivatorFunctionRole1DE7A39F","Arn"]},"Runtime":"nodejs24.x","Tags":[{"Key":"aws-solutions:isb-id","Value":{"Fn::Join":["",[{"Ref":"Namespace"},"_isb"]]}}],"Timeout":60,"TracingConfig":{"Mode":"Active"}},"DependsOn":["CostAllocationTagActivatorFunctionRoleDefaultPolicy6801705B","CostAllocationTagActivatorFunctionRole1DE7A39F"],"Metadata":{"aws:cdk:path":"InnovationSandbox-AccountPool/CostAllocationTagActivator/CostAllocationTagActivator/Function/Resource","aws:asset:path":"asset.11033f24b19b7562917710b3c983dab341fcf81a74ef357b8d60af672c3c2989","aws:asset:is-bundled":true,"aws:asset:property":"Code","guard":{"SuppressedRules":["LAMBDA_INSIDE_VPC","LAMBDA_CONCURRENCY_CHECK"]}}},"CostAllocationTagActivatorIsbProviderframeworkonEventServiceRoleBB4B75CD":{"Type":"AWS::IAM::Role","Properties":{"AssumeRolePolicyDocument":{"Statement":[{"Action":"sts:AssumeRole","Effect":"Allow","Principal":{"Service":"lambda.amazonaws.com"}}],"Version":"2012-10-17"},"ManagedPolicyArns":[{"Fn::Join":["",["arn:",{"Ref":"AWS::Partition"},":iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"]]}],"Tags":[{"Key":"aws-solutions:isb-id","Value":{"Fn::Join":["",[{"Ref":"Namespace"},"_isb"]]}}]},"Metadata":{"aws:cdk:path":"InnovationSandbox-AccountPool/CostAllocationTagActivator/CostAllocationTagActivator/IsbProvider/framework-onEvent/ServiceRole/Resource"}},"CostAllocationTagActivatorIsbProviderframeworkonEventServiceRoleDefaultPolicyF20A12B0":{"Type":"AWS::IAM::Policy","Properties":{"PolicyDocument":{"Statement":[{"Action":"lambda:InvokeFunction","Effect":"Allow","Resource":[{"Fn::GetAtt":["CostAllocationTagActivatorFunctionBF9E923D","Arn"]},{"Fn::Join":["",[{"Fn::GetAtt":["CostAllocationTagActivatorFunctionBF9E923D","Arn"]},":*"]]}]},{"Action":"lambda:GetFunction","Effect":"Allow","Resource":{"Fn::GetAtt":["CostAllocationTagActivatorFunctionBF9E923D","Arn"]}}],"Version":"2012-10-17"},"PolicyName":"CostAllocationTagActivatorIsbProviderframeworkonEventServiceRoleDefaultPolicyF20A12B0","Roles":[{"Ref":"CostAllocationTagActivatorIsbProviderframeworkonEventServiceRoleBB4B75CD"}]},"Metadata":{"aws:cdk:path":"InnovationSandbox-AccountPool/CostAllocationTagActivator/CostAllocationTagActivator/IsbProvider/framework-onEvent/ServiceRole/DefaultPolicy/Resource"}},"CostAllocationTagActivatorIsbProviderframeworkonEvent12245C05":{"Type":"AWS::Lambda::Function","Properties":{"Code":{"S3Bucket":{"Fn::Sub":"solutions-${AWS::Region}"},"S3Key":"innovation-sandbox-on-aws/v1.3.6/asset.e16ffb3b34af185b8b30c88fdb19faa13b6c42bb38580485c4e84b384ee48b63.zip"},"Description":"AWS CDK resource provider framework - onEvent (InnovationSandbox-AccountPool/CostAllocationTagActivator/CostAllocationTagActivator/IsbProvider)","Environment":{"Variables":{"USER_ON_EVENT_FUNCTION_ARN":{"Fn::GetAtt":["CostAllocationTagActivatorFunctionBF9E923D","Arn"]}}},"Handler":"framework.onEvent","LoggingConfig":{"ApplicationLogLevel":"FATAL","LogFormat":"JSON","LogGroup":{"Ref":"ISBLogGroupCustomResources63629E09"}},"Role":{"Fn::GetAtt":["CostAllocationTagActivatorIsbProviderframeworkonEventServiceRoleBB4B75CD","Arn"]},"Runtime":"nodejs24.x","Tags":[{"Key":"aws-solutions:isb-id","Value":{"Fn::Join":["",[{"Ref":"Namespace"},"_isb"]]}}],"Timeout":900},"DependsOn":["CostAllocationTagActivatorIsbProviderframeworkonEventServiceRoleDefaultPolicyF20A12B0","CostAllocationTagActivatorIsbProviderframeworkonEventServiceRoleBB4B75CD"],"Metadata":{"aws:cdk:path":"InnovationSandbox-AccountPool/CostAllocationTagActivator/CostAllocationTagActivator/IsbProvider/framework-onEvent/Resource","aws:asset:path":"asset.e16ffb3b34af185b8b30c88fdb19faa13b6c42bb38580485c4e84b384ee48b63","aws:asset:is-bundled":false,"aws:asset:property":"Code","guard":{"SuppressedRules":["LAMBDA_INSIDE_VPC","LAMBDA_CONCURRENCY_CHECK"]}}},"CostAllocationTagActivatorIsbCustomResourceDADB260C":{"Type":"Custom::CostAllocationTag","Properties":{"ServiceToken":{"Fn::GetAtt":["CostAllocationTagActivatorIsbProviderframeworkonEvent12245C05","Arn"]}},"UpdateReplacePolicy":"Delete","DeletionPolicy":"Delete","Metadata":{"aws:cdk:path":"InnovationSandbox-AccountPool/CostAllocationTagActivator/CostAllocationTagActivator/IsbCustomResource/Default"}},"CostAllocationTagActivatorISBLambdaLayerInnovationSandboxAccountPoolCommonLayerVersion50519BCF":{"Type":"AWS::Lambda::LayerVersion","Properties":{"CompatibleArchitectures":["arm64"],"CompatibleRuntimes":["nodejs24.x"],"Content":{"S3Bucket":{"Fn::Sub":"solutions-${AWS::Region}"},"S3Key":"innovation-sandbox-on-aws/v1.3.6/asset.cce4db5db44112d95af95399b83ad329b8380b112a1d7fe48254ad477d6d1e5d.zip"},"Description":"Common lib for Innovation Sandbox on AWS"},"Metadata":{"aws:cdk:path":"InnovationSandbox-AccountPool/CostAllocationTagActivator/ISB-Lambda-Layer-InnovationSandbox-AccountPool/CommonLayerVersion/Resource","aws:asset:path":"asset.cce4db5db44112d95af95399b83ad329b8380b112a1d7fe48254ad477d6d1e5d","aws:asset:is-bundled":false,"aws:asset:property":"Content"}},"CostAllocationTagActivatorISBLambdaLayerInnovationSandboxAccountPoolDependenciesLayerVersion6803FFB4":{"Type":"AWS::Lambda::LayerVersion","Properties":{"CompatibleArchitectures":["arm64"],"CompatibleRuntimes":["nodejs24.x"],"Content":{"S3Bucket":{"Fn::Sub":"solutions-${AWS::Region}"},"S3Key":"innovation-sandbox-on-aws/v1.3.6/asset.219ee76f4d36e68f1c01dc280277114505cd047b90c912cc57329fcce5c0da1a.zip"},"Description":"Third party runtime dependencies for Innovation Sandbox on AWS"},"Metadata":{"aws:cdk:path":"InnovationSandbox-AccountPool/CostAllocationTagActivator/ISB-Lambda-Layer-InnovationSandbox-AccountPool/DependenciesLayerVersion/Resource","aws:asset:path":"asset.219ee76f4d36e68f1c01dc280277114505cd047b90c912cc57329fcce5c0da1a","aws:asset:is-bundled":false,"aws:asset:property":"Content"}},"IsbKmsKeyInnovationSandboxAccountPool0065BC85":{"Type":"AWS::KMS::Key","Properties":{"Description":"Encryption Key for Innovation Sandbox: InnovationSandbox-AccountPool","EnableKeyRotation":true,"KeyPolicy":{"Statement":[{"Action":"kms:*","Effect":"Allow","Principal":{"AWS":{"Fn::Join":["",["arn:",{"Ref":"AWS::Partition"},":iam::",{"Ref":"AWS::AccountId"},":root"]]}},"Resource":"*"},{"Action":["kms:Decrypt","kms:Encrypt","kms:ReEncrypt*","kms:GenerateDataKey*"],"Effect":"Allow","Principal":{"Service":"logs.amazonaws.com"},"Resource":"*"}],"Version":"2012-10-17"},"Tags":[{"Key":"aws-solutions:isb-id","Value":{"Fn::Join":["",[{"Ref":"Namespace"},"_isb"]]}}]},"UpdateReplacePolicy":"Retain","DeletionPolicy":"Retain","Metadata":{"aws:cdk:path":"InnovationSandbox-AccountPool/IsbKmsKey-InnovationSandbox-AccountPool/Resource"}},"IsbKmsKeyInnovationSandboxAccountPoolAliasB9DAB86A":{"Type":"AWS::KMS::Alias","Properties":{"AliasName":{"Fn::Join":["",["alias/AwsSolutions/InnovationSandbox/",{"Ref":"Namespace"},"/InnovationSandbox-AccountPool"]]},"TargetKeyId":{"Fn::GetAtt":["IsbKmsKeyInnovationSandboxAccountPool0065BC85","Arn"]}},"Metadata":{"aws:cdk:path":"InnovationSandbox-AccountPool/IsbKmsKey-InnovationSandbox-AccountPool/Alias/Resource"}},"ISBLogGroupCustomResources63629E09":{"Type":"AWS::Logs::LogGroup","Properties":{"KmsKeyId":{"Fn::GetAtt":["IsbKmsKeyInnovationSandboxAccountPool0065BC85","Arn"]},"RetentionInDays":{"Fn::FindInMap":["Mapping","context","cloudWatchLogRetentionInDays",{"DefaultValue":""}]},"Tags":[{"Key":"aws-solutions:isb-id","Value":{"Fn::Join":["",[{"Ref":"Namespace"},"_isb"]]}}]},"UpdateReplacePolicy":"Retain","DeletionPolicy":"Retain","Metadata":{"aws:cdk:path":"InnovationSandbox-AccountPool/ISBLogGroup-CustomResources/Resource","guard":{"SuppressedRules":["CW_LOGGROUP_RETENTION_PERIOD_CHECK"]}}},"CDKMetadata":{"Type":"AWS::CDK::Metadata","Properties":{"Analytics":"v2:deflate64:H4sIAAAAAAAA/1VQTU/DMAz9LdwzMzokzlslODBgWgXXykvdkjUfU5xsGlX/O0o2pnJ6fu/Fdp4LKJ4WML/DE89k08+02sFQBZS9KFu7QY+GAvlESmcbFZSzAk9cD853aNUPJoVhKFv7MVFQf1oV8gynlTyPQqGBYes0JTHjxZm+YTZpu1e2+7f6Rkbh0UAaQOyil1R9oyfBixqZKTAsEwhewCrKnsIKmYTULjat8yb/LHXngBUFodHsGqyta2jP8J7hOVqZY17MHO2m3Yo1nsl/kedEytZO+Sh6wzC8Ug6XYKkVciK5GIV2HcOwdt2Ld/GQ+6/1OCb2hoeDsp3IcaqAXSIycnCm9tfoDBvvjqpJJ8rO303E5D6jSNlgz/fH4hGKB5jf7VmpmY82KEOwveAvUOcHxAcCAAA="},"Metadata":{"aws:cdk:path":"InnovationSandbox-AccountPool/CDKMetadata/Default"},"Condition":"CDKMetadataAvailable"}},"Mappings":{"Mapping":{"context":{"solutionName":"innovation-sandbox-on-aws","solutionId":"SO0284","version":"v1.3.6","distOutputBucket":"solutions","publicEcrRegistry":"public.ecr.aws/aws-solutions","publicEcrTag":"v1.3.6","deploymentMode":"prod","stackPrefix":"InnovationSandbox","cloudWatchLogRetentionInDays":90,"s3LogsArchiveRetentionInDays":365,"s3LogsGlacierRetentionInDays":2555,"apiThrottlingRateLimit":100,"apiThrottlingBurstLimit":200,"cognitoAccessTokenValidityMinutes":60,"cognitoIdTokenValidityMinutes":60,"cognitoRefreshTokenValidityDays":7,"bucketPrefix":"innovation-sandbox-on-aws/v1.3.6/asset."}}}}