{ "Description": "(SO0163) - media-insights-on-aws. This is the base AWS CloudFormation template that provisions Media Insights on AWS services and provides parameters for user configurable settings. Version v5.1.11", "AWSTemplateFormatVersion": "2010-09-09", "Metadata": { "AWS::CloudFormation::Interface": { "ParameterGroups": [ { "Label": { "default": "System Configuration" }, "Parameters": [ "MaxConcurrentWorkflows" ] } ] } }, "Parameters": { "DeployTestResources": { "Type": "String", "Default": "No", "AllowedValues": [ "Yes", "No" ], "Description": "Deploy test resources which contains lambdas required for integration and e2e testing" }, "DeployAnalyticsPipeline": { "Type": "String", "Default": "Yes", "AllowedValues": [ "Yes", "No" ], "Description": "Deploy a metadata streaming pipeline that can be consumed by downstream analytics plaforms" }, "MaxConcurrentWorkflows": { "Type": "Number", "Default": 5, "Description": "Maximum number of workflows to run concurrently. When the maximum is reached, additional workflows are added to a wait queue.", "MinValue": 1 }, "EnableXrayTrace": { "Type": "String", "Default": "No", "AllowedValues": [ "Yes", "No" ], "Description": "Turn on Xray tracing on all entry points to the stack" }, "ExternalBucketArn": { "Type": "String", "Default": "", "Description": "(Optional) If you intend to input media files from a bucket outside the stack into the workflows, then specify the Amazon S3 ARN for those files here." }, "SolutionId": { "Type": "String", "Default": "SO0163", "Description": "(Optional) AWS Solution Id used for reporting purposes" }, "SolutionVersion": { "Type": "String", "Default": "v5.1.11", "Description": "(Optional) AWS Solution version used for reporting purposes" } }, "Mappings": { "AnonymizedData": { "SendAnonymizedData": { "Data": "Yes" } }, "SourceCode": { "General": { "RegionalS3Bucket": "solutions", "CodeKeyPrefix": "media-insights-on-aws/v5.1.11", "GlobalS3Bucket": "solutions-reference", "TemplateKeyPrefix": "media-insights-on-aws/v5.1.11", "FrameworkVersion": "v5.1.11" } } }, "Conditions": { "DeployTestResourcesCondition": { "Fn::Equals": [ { "Ref": "DeployTestResources" }, "Yes" ] }, "DeployAnalyticsPipelineCondition": { "Fn::Equals": [ { "Ref": "DeployAnalyticsPipeline" }, "Yes" ] }, "EnableTraceOnEntryPoints": { "Fn::Equals": [ { "Ref": "EnableXrayTrace" }, "Yes" ] }, "EnableAnonymizedData": { "Fn::Equals": [ { "Fn::FindInMap": [ "AnonymizedData", "SendAnonymizedData", "Data" ] }, "Yes" ] } }, "Resources": { "MieKey": { "Type": "AWS::KMS::Key", "Properties": { "Description": "Media Insights on AWS provided KMS key for encryption", "EnableKeyRotation": true, "KeyPolicy": { "Statement": [ { "Action": "kms:*", "Effect": "Allow", "Principal": { "AWS": { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":iam::", { "Ref": "AWS::AccountId" }, ":root" ] ] } }, "Resource": "*" }, { "Action": [ "kms:Decrypt", "kms:GenerateDataKey*" ], "Condition": { "StringEquals": { "aws:SourceAccount": { "Ref": "AWS::AccountId" } } }, "Effect": "Allow", "Principal": { "Service": [ "s3.amazonaws.com", "sns.amazonaws.com", "sqs.amazonaws.com" ] }, "Resource": "*" }, { "Action": [ "kms:Encrypt", "kms:Decrypt", "kms:ReEncrypt*", "kms:GenerateDataKey*", "kms:DescribeKey", "kms:CreateGrant" ], "Condition": { "StringEquals": { "aws:SourceAccount": { "Ref": "AWS::AccountId" } } }, "Effect": "Allow", "Principal": { "Service": "dynamodb.amazonaws.com" }, "Resource": "*" }, { "Action": [ "kms:Encrypt", "kms:Decrypt", "kms:ReEncrypt*", "kms:GenerateDataKey*", "kms:DescribeKey" ], "Condition": { "StringEquals": { "aws:SourceAccount": { "Ref": "AWS::AccountId" } } }, "Effect": "Allow", "Principal": { "Service": "rekognition.amazonaws.com" }, "Resource": "*" }, { "Action": [ "kms:Decrypt", "kms:GenerateDataKey" ], "Effect": "Allow", "Principal": { "Service": "sns.amazonaws.com" }, "Resource": "*" } ], "Version": "2012-10-17" } }, "UpdateReplacePolicy": "Retain", "DeletionPolicy": "Retain" }, "MieKeyAlias": { "Type": "AWS::KMS::Alias", "Properties": { "AliasName": { "Fn::Join": [ "", [ "alias/", { "Ref": "AWS::StackName" } ] ] }, "TargetKeyId": { "Fn::GetAtt": [ "MieKey", "Arn" ] } } }, "SystemTable": { "Type": "AWS::DynamoDB::Table", "Properties": { "AttributeDefinitions": [ { "AttributeName": "Name", "AttributeType": "S" } ], "BillingMode": "PAY_PER_REQUEST", "KeySchema": [ { "AttributeName": "Name", "KeyType": "HASH" } ], "PointInTimeRecoverySpecification": { "PointInTimeRecoveryEnabled": true }, "SSESpecification": { "KMSMasterKeyId": { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":kms:", { "Ref": "AWS::Region" }, ":", { "Ref": "AWS::AccountId" }, ":alias/", { "Ref": "AWS::StackName" } ] ] }, "SSEEnabled": true, "SSEType": "KMS" }, "TableName": { "Fn::Join": [ "", [ { "Ref": "AWS::StackName" }, "System" ] ] }, "Tags": [ { "Key": "environment", "Value": "mie" } ] }, "DependsOn": [ "MieKeyAlias" ], "UpdateReplacePolicy": "Delete", "DeletionPolicy": "Delete", "Metadata": { "cfn_nag": { "rules_to_suppress": [ { "id": "W28", "reason": "Table name is constructed with stack name. On update, we need to keep the existing table name." } ] } } }, "WorkflowTable": { "Type": "AWS::DynamoDB::Table", "Properties": { "AttributeDefinitions": [ { "AttributeName": "Name", "AttributeType": "S" } ], "BillingMode": "PAY_PER_REQUEST", "KeySchema": [ { "AttributeName": "Name", "KeyType": "HASH" } ], "PointInTimeRecoverySpecification": { "PointInTimeRecoveryEnabled": true }, "SSESpecification": { "KMSMasterKeyId": { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":kms:", { "Ref": "AWS::Region" }, ":", { "Ref": "AWS::AccountId" }, ":alias/", { "Ref": "AWS::StackName" } ] ] }, "SSEEnabled": true, "SSEType": "KMS" }, "TableName": { "Fn::Join": [ "", [ { "Ref": "AWS::StackName" }, "Workflow" ] ] }, "Tags": [ { "Key": "environment", "Value": "mie" } ] }, "DependsOn": [ "MieKeyAlias" ], "UpdateReplacePolicy": "Delete", "DeletionPolicy": "Delete", "Metadata": { "cfn_nag": { "rules_to_suppress": [ { "id": "W28", "reason": "Table name is constructed with stack name. On update, we need to keep the existing table name." } ] } } }, "StageTable": { "Type": "AWS::DynamoDB::Table", "Properties": { "AttributeDefinitions": [ { "AttributeName": "Name", "AttributeType": "S" } ], "BillingMode": "PAY_PER_REQUEST", "KeySchema": [ { "AttributeName": "Name", "KeyType": "HASH" } ], "PointInTimeRecoverySpecification": { "PointInTimeRecoveryEnabled": true }, "SSESpecification": { "KMSMasterKeyId": { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":kms:", { "Ref": "AWS::Region" }, ":", { "Ref": "AWS::AccountId" }, ":alias/", { "Ref": "AWS::StackName" } ] ] }, "SSEEnabled": true, "SSEType": "KMS" }, "TableName": { "Fn::Join": [ "", [ { "Ref": "AWS::StackName" }, "Stage" ] ] }, "Tags": [ { "Key": "environment", "Value": "mie" } ] }, "DependsOn": [ "MieKeyAlias" ], "UpdateReplacePolicy": "Delete", "DeletionPolicy": "Delete", "Metadata": { "cfn_nag": { "rules_to_suppress": [ { "id": "W28", "reason": "Table name is constructed with stack name. On update, we need to keep the existing table name." } ] } } }, "OperationTable": { "Type": "AWS::DynamoDB::Table", "Properties": { "AttributeDefinitions": [ { "AttributeName": "Name", "AttributeType": "S" } ], "BillingMode": "PAY_PER_REQUEST", "KeySchema": [ { "AttributeName": "Name", "KeyType": "HASH" } ], "PointInTimeRecoverySpecification": { "PointInTimeRecoveryEnabled": true }, "SSESpecification": { "KMSMasterKeyId": { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":kms:", { "Ref": "AWS::Region" }, ":", { "Ref": "AWS::AccountId" }, ":alias/", { "Ref": "AWS::StackName" } ] ] }, "SSEEnabled": true, "SSEType": "KMS" }, "TableName": { "Fn::Join": [ "", [ { "Ref": "AWS::StackName" }, "Operation" ] ] }, "Tags": [ { "Key": "environment", "Value": "mie" } ] }, "DependsOn": [ "MieKeyAlias" ], "UpdateReplacePolicy": "Delete", "DeletionPolicy": "Delete", "Metadata": { "cfn_nag": { "rules_to_suppress": [ { "id": "W28", "reason": "Table name is constructed with stack name. On update, we need to keep the existing table name." } ] } } }, "HistoryTable": { "Type": "AWS::DynamoDB::Table", "Properties": { "AttributeDefinitions": [ { "AttributeName": "Id", "AttributeType": "S" }, { "AttributeName": "Version", "AttributeType": "S" } ], "BillingMode": "PAY_PER_REQUEST", "KeySchema": [ { "AttributeName": "Id", "KeyType": "HASH" }, { "AttributeName": "Version", "KeyType": "RANGE" } ], "PointInTimeRecoverySpecification": { "PointInTimeRecoveryEnabled": true }, "SSESpecification": { "KMSMasterKeyId": { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":kms:", { "Ref": "AWS::Region" }, ":", { "Ref": "AWS::AccountId" }, ":alias/", { "Ref": "AWS::StackName" } ] ] }, "SSEEnabled": true, "SSEType": "KMS" }, "TableName": { "Fn::Join": [ "", [ { "Ref": "AWS::StackName" }, "History" ] ] }, "Tags": [ { "Key": "environment", "Value": "mie" } ] }, "DependsOn": [ "MieKeyAlias" ], "UpdateReplacePolicy": "Delete", "DeletionPolicy": "Delete", "Metadata": { "cfn_nag": { "rules_to_suppress": [ { "id": "W28", "reason": "Table name is constructed with stack name. On update, we need to keep the existing table name." } ] } } }, "WorkflowExecutionTable": { "Type": "AWS::DynamoDB::Table", "Properties": { "AttributeDefinitions": [ { "AttributeName": "Id", "AttributeType": "S" }, { "AttributeName": "Status", "AttributeType": "S" }, { "AttributeName": "AssetId", "AttributeType": "S" } ], "BillingMode": "PAY_PER_REQUEST", "GlobalSecondaryIndexes": [ { "IndexName": "WorkflowExecutionStatus", "KeySchema": [ { "AttributeName": "Status", "KeyType": "HASH" } ], "Projection": { "ProjectionType": "ALL" } }, { "IndexName": "WorkflowExecutionAssetId", "KeySchema": [ { "AttributeName": "AssetId", "KeyType": "HASH" } ], "Projection": { "ProjectionType": "ALL" } } ], "KeySchema": [ { "AttributeName": "Id", "KeyType": "HASH" } ], "PointInTimeRecoverySpecification": { "PointInTimeRecoveryEnabled": true }, "SSESpecification": { "KMSMasterKeyId": { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":kms:", { "Ref": "AWS::Region" }, ":", { "Ref": "AWS::AccountId" }, ":alias/", { "Ref": "AWS::StackName" } ] ] }, "SSEEnabled": true, "SSEType": "KMS" }, "StreamSpecification": { "StreamViewType": "NEW_AND_OLD_IMAGES" }, "TableName": { "Fn::Join": [ "", [ { "Ref": "AWS::StackName" }, "WorkflowExecution" ] ] }, "Tags": [ { "Key": "environment", "Value": "mie" } ] }, "DependsOn": [ "MieKeyAlias" ], "UpdateReplacePolicy": "Delete", "DeletionPolicy": "Delete", "Metadata": { "cfn_nag": { "rules_to_suppress": [ { "id": "W28", "reason": "Table name is constructed with stack name. On update, we need to keep the existing table name." } ] } } }, "DataplaneTable": { "Type": "AWS::DynamoDB::Table", "Properties": { "AttributeDefinitions": [ { "AttributeName": "AssetId", "AttributeType": "S" }, { "AttributeName": "Locked", "AttributeType": "S" }, { "AttributeName": "LockedAt", "AttributeType": "N" } ], "BillingMode": "PAY_PER_REQUEST", "GlobalSecondaryIndexes": [ { "IndexName": "LockIndex", "KeySchema": [ { "AttributeName": "Locked", "KeyType": "HASH" }, { "AttributeName": "LockedAt", "KeyType": "RANGE" } ], "Projection": { "NonKeyAttributes": [ "LockedBy" ], "ProjectionType": "INCLUDE" } } ], "KeySchema": [ { "AttributeName": "AssetId", "KeyType": "HASH" } ], "PointInTimeRecoverySpecification": { "PointInTimeRecoveryEnabled": true }, "SSESpecification": { "KMSMasterKeyId": { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":kms:", { "Ref": "AWS::Region" }, ":", { "Ref": "AWS::AccountId" }, ":alias/", { "Ref": "AWS::StackName" } ] ] }, "SSEEnabled": true, "SSEType": "KMS" }, "StreamSpecification": { "StreamViewType": "NEW_AND_OLD_IMAGES" }, "TableName": { "Fn::Join": [ "", [ { "Ref": "AWS::StackName" }, "DataplaneTable" ] ] }, "Tags": [ { "Key": "environment", "Value": "mie" } ] }, "DependsOn": [ "MieKeyAlias" ], "UpdateReplacePolicy": "Delete", "DeletionPolicy": "Delete", "Metadata": { "cfn_nag": { "rules_to_suppress": [ { "id": "W28", "reason": "Table name is constructed with stack name. On update, we need to keep the existing table name." } ] } } }, "DataplaneLogsBucket": { "Type": "AWS::S3::Bucket", "Properties": { "BucketEncryption": { "ServerSideEncryptionConfiguration": [ { "ServerSideEncryptionByDefault": { "SSEAlgorithm": "AES256" } } ] }, "PublicAccessBlockConfiguration": { "BlockPublicAcls": true, "BlockPublicPolicy": true, "IgnorePublicAcls": true, "RestrictPublicBuckets": true }, "Tags": [ { "Key": "environment", "Value": "mie" } ], "VersioningConfiguration": { "Status": "Enabled" } }, "UpdateReplacePolicy": "Retain", "DeletionPolicy": "Retain", "Metadata": { "cfn_nag": { "rules_to_suppress": [ { "id": "W35", "reason": "Used to store access logs for other buckets" }, { "id": "W51", "reason": "Bucket is private and does not need a bucket policy" } ] }, "cdk_nag": { "rules_to_suppress": [ { "reason": "Used to store access logs for other buckets", "id": "AwsSolutions-S1" } ] } } }, "DataplaneLogsBucketPolicy": { "Type": "AWS::S3::BucketPolicy", "Properties": { "Bucket": { "Ref": "DataplaneLogsBucket" }, "PolicyDocument": { "Statement": [ { "Action": "s3:*", "Condition": { "Bool": { "aws:SecureTransport": "false" } }, "Effect": "Deny", "Principal": { "AWS": "*" }, "Resource": [ { "Fn::GetAtt": [ "DataplaneLogsBucket", "Arn" ] }, { "Fn::Join": [ "", [ { "Fn::GetAtt": [ "DataplaneLogsBucket", "Arn" ] }, "/*" ] ] } ] }, { "Action": "s3:PutObject", "Condition": { "ArnLike": { "aws:SourceArn": { "Fn::GetAtt": [ "Dataplane", "Arn" ] } }, "StringEquals": { "aws:SourceAccount": { "Ref": "AWS::AccountId" } } }, "Effect": "Allow", "Principal": { "Service": "logging.s3.amazonaws.com" }, "Resource": { "Fn::Join": [ "", [ { "Fn::GetAtt": [ "DataplaneLogsBucket", "Arn" ] }, "/access_logs/*" ] ] } } ], "Version": "2012-10-17" } }, "Metadata": { "cdk_nag": { "rules_to_suppress": [ { "reason": "Used to store access logs for other buckets", "id": "AwsSolutions-S1" } ] } } }, "Dataplane": { "Type": "AWS::S3::Bucket", "Properties": { "BucketEncryption": { "ServerSideEncryptionConfiguration": [ { "ServerSideEncryptionByDefault": { "KMSMasterKeyID": { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":kms:", { "Ref": "AWS::Region" }, ":", { "Ref": "AWS::AccountId" }, ":alias/", { "Ref": "AWS::StackName" } ] ] }, "SSEAlgorithm": "aws:kms" } } ] }, "CorsConfiguration": { "CorsRules": [ { "AllowedHeaders": [ "*" ], "AllowedMethods": [ "HEAD", "GET", "POST", "DELETE", "PUT" ], "AllowedOrigins": [ "*" ], "ExposedHeaders": [ "x-amz-server-side-encryption", "x-amz-request-id", "x-amz-id-2", "ETag" ], "Id": "AllowUploadsFromWebApp", "MaxAge": 3000 } ] }, "LifecycleConfiguration": { "Rules": [ { "AbortIncompleteMultipartUpload": { "DaysAfterInitiation": 1 }, "ExpirationInDays": 10, "Id": "Keep access log for 10 days", "Prefix": "access_logs/", "Status": "Enabled" }, { "AbortIncompleteMultipartUpload": { "DaysAfterInitiation": 1 }, "ExpirationInDays": 10, "Id": "Keep cloudfront log for 10 days", "Prefix": "cf_logs/", "Status": "Enabled" } ] }, "LoggingConfiguration": { "DestinationBucketName": { "Ref": "DataplaneLogsBucket" }, "LogFilePrefix": "access_logs/" }, "PublicAccessBlockConfiguration": { "BlockPublicAcls": true, "BlockPublicPolicy": true, "IgnorePublicAcls": true, "RestrictPublicBuckets": true }, "Tags": [ { "Key": "environment", "Value": "mie" } ], "VersioningConfiguration": { "Status": "Enabled" } }, "UpdateReplacePolicy": "Retain", "DeletionPolicy": "Retain" }, "DataplanePolicy": { "Type": "AWS::S3::BucketPolicy", "Properties": { "Bucket": { "Ref": "Dataplane" }, "PolicyDocument": { "Statement": [ { "Action": "s3:*", "Condition": { "Bool": { "aws:SecureTransport": "false" } }, "Effect": "Deny", "Principal": { "AWS": "*" }, "Resource": [ { "Fn::GetAtt": [ "Dataplane", "Arn" ] }, { "Fn::Join": [ "", [ { "Fn::GetAtt": [ "Dataplane", "Arn" ] }, "/*" ] ] } ] } ], "Version": "2012-10-17" } } }, "WorkflowExecutionEventTopic": { "Type": "AWS::SNS::Topic", "Properties": { "KmsMasterKeyId": { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":kms:", { "Ref": "AWS::Region" }, ":", { "Ref": "AWS::AccountId" }, ":alias/", { "Ref": "AWS::StackName" } ] ] } } }, "WorkflowExecutionEventTopicPolicy": { "Type": "AWS::SNS::TopicPolicy", "Properties": { "PolicyDocument": { "Statement": [ { "Action": [ "SNS:Subscribe", "SNS:Receive" ], "Condition": { "StringEquals": { "AWS:SourceOwner": { "Ref": "AWS::AccountId" } } }, "Effect": "Allow", "Principal": { "AWS": { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":iam::", { "Ref": "AWS::AccountId" }, ":root" ] ] } }, "Resource": { "Ref": "WorkflowExecutionEventTopic" } } ], "Version": "2012-10-17" }, "Topics": [ { "Ref": "WorkflowExecutionEventTopic" } ] }, "Metadata": { "cfn_nag": { "rules_to_suppress": [ { "id": "W11", "reason": "The topic permissions are scoped to the account using the condition" } ] } } }, "WorkflowExecutionLambdaDeadLetterQueue": { "Type": "AWS::SQS::Queue", "Properties": { "KmsMasterKeyId": { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":kms:", { "Ref": "AWS::Region" }, ":", { "Ref": "AWS::AccountId" }, ":alias/", { "Ref": "AWS::StackName" } ] ] }, "MessageRetentionPeriod": 43200, "QueueName": { "Fn::Join": [ "", [ { "Ref": "AWS::StackName" }, "-WorkflowExecLambdaDLQ" ] ] }, "Tags": [ { "Key": "environment", "Value": "mie" } ] }, "UpdateReplacePolicy": "Delete", "DeletionPolicy": "Delete", "Metadata": { "cdk_nag": { "rules_to_suppress": [ { "reason": "The SQS queue is a dead-letter queue (DLQ)", "id": "AwsSolutions-SQS3" } ] } } }, "WorkflowExecutionLambdaDeadLetterQueuePolicy": { "Type": "AWS::SQS::QueuePolicy", "Properties": { "PolicyDocument": { "Statement": [ { "Action": "sqs:*", "Condition": { "Bool": { "aws:SecureTransport": "false" } }, "Effect": "Deny", "Principal": { "AWS": "*" }, "Resource": { "Fn::GetAtt": [ "WorkflowExecutionLambdaDeadLetterQueue", "Arn" ] } } ], "Version": "2012-10-17" }, "Queues": [ { "Ref": "WorkflowExecutionLambdaDeadLetterQueue" } ] } }, "StageExecutionDeadLetterQueue": { "Type": "AWS::SQS::Queue", "Properties": { "KmsMasterKeyId": { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":kms:", { "Ref": "AWS::Region" }, ":", { "Ref": "AWS::AccountId" }, ":alias/", { "Ref": "AWS::StackName" } ] ] }, "MessageRetentionPeriod": 43200, "QueueName": { "Fn::Join": [ "", [ { "Ref": "AWS::StackName" }, "-StageExecDLQ" ] ] }, "Tags": [ { "Key": "environment", "Value": "mie" } ] }, "UpdateReplacePolicy": "Delete", "DeletionPolicy": "Delete", "Metadata": { "cdk_nag": { "rules_to_suppress": [ { "reason": "The SQS queue is a dead-letter queue (DLQ)", "id": "AwsSolutions-SQS3" } ] } } }, "StageExecutionDeadLetterQueuePolicy": { "Type": "AWS::SQS::QueuePolicy", "Properties": { "PolicyDocument": { "Statement": [ { "Action": "sqs:*", "Condition": { "Bool": { "aws:SecureTransport": "false" } }, "Effect": "Deny", "Principal": { "AWS": "*" }, "Resource": { "Fn::GetAtt": [ "StageExecutionDeadLetterQueue", "Arn" ] } } ], "Version": "2012-10-17" }, "Queues": [ { "Ref": "StageExecutionDeadLetterQueue" } ] } }, "WorkflowExecutionEventQueue": { "Type": "AWS::SQS::Queue", "Properties": { "KmsMasterKeyId": { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":kms:", { "Ref": "AWS::Region" }, ":", { "Ref": "AWS::AccountId" }, ":alias/", { "Ref": "AWS::StackName" } ] ] }, "RedrivePolicy": { "deadLetterTargetArn": { "Fn::GetAtt": [ "WorkflowExecutionLambdaDeadLetterQueue", "Arn" ] }, "maxReceiveCount": 1 } }, "UpdateReplacePolicy": "Delete", "DeletionPolicy": "Delete" }, "WorkflowExecutionEventQueuePolicy": { "Type": "AWS::SQS::QueuePolicy", "Properties": { "PolicyDocument": { "Statement": [ { "Action": "sqs:*", "Condition": { "Bool": { "aws:SecureTransport": "false" } }, "Effect": "Deny", "Principal": { "AWS": "*" }, "Resource": { "Fn::GetAtt": [ "WorkflowExecutionEventQueue", "Arn" ] } }, { "Action": "sqs:SendMessage", "Condition": { "ArnEquals": { "aws:SourceArn": { "Ref": "WorkflowExecutionEventTopic" } } }, "Effect": "Allow", "Principal": { "Service": "sns.amazonaws.com" }, "Resource": { "Fn::GetAtt": [ "WorkflowExecutionEventQueue", "Arn" ] } } ], "Version": "2012-10-17" }, "Queues": [ { "Ref": "WorkflowExecutionEventQueue" } ] } }, "WorkflowExecutionEventQueuemediainsightsonawsWorkflowExecutionEventTopic0F8EA393": { "Type": "AWS::SNS::Subscription", "Properties": { "Endpoint": { "Fn::GetAtt": [ "WorkflowExecutionEventQueue", "Arn" ] }, "Protocol": "sqs", "TopicArn": { "Ref": "WorkflowExecutionEventTopic" } }, "DependsOn": [ "WorkflowExecutionEventQueuePolicy" ] }, "StageExecutionQueue": { "Type": "AWS::SQS::Queue", "Properties": { "KmsMasterKeyId": { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":kms:", { "Ref": "AWS::Region" }, ":", { "Ref": "AWS::AccountId" }, ":alias/", { "Ref": "AWS::StackName" } ] ] }, "QueueName": { "Fn::Join": [ "", [ { "Ref": "AWS::StackName" }, "-StageExec" ] ] }, "ReceiveMessageWaitTimeSeconds": 20, "RedrivePolicy": { "deadLetterTargetArn": { "Fn::GetAtt": [ "StageExecutionDeadLetterQueue", "Arn" ] }, "maxReceiveCount": 1 }, "Tags": [ { "Key": "environment", "Value": "mie" } ], "VisibilityTimeout": 43200 }, "UpdateReplacePolicy": "Delete", "DeletionPolicy": "Delete" }, "StageExecutionQueuePolicy": { "Type": "AWS::SQS::QueuePolicy", "Properties": { "PolicyDocument": { "Statement": [ { "Action": "sqs:*", "Condition": { "Bool": { "aws:SecureTransport": "false" } }, "Effect": "Deny", "Principal": { "AWS": "*" }, "Resource": { "Fn::GetAtt": [ "StageExecutionQueue", "Arn" ] } } ], "Version": "2012-10-17" }, "Queues": [ { "Ref": "StageExecutionQueue" } ] } }, "MieHelperExecutionRole": { "Type": "AWS::IAM::Role", "Properties": { "AssumeRolePolicyDocument": { "Statement": [ { "Action": "sts:AssumeRole", "Effect": "Allow", "Principal": { "Service": "lambda.amazonaws.com" } } ], "Version": "2012-10-17" }, "Path": "/", "Policies": [ { "PolicyDocument": { "Statement": [ { "Action": [ "logs:CreateLogGroup", "logs:CreateLogStream", "logs:PutLogEvents" ], "Effect": "Allow", "Resource": { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":logs:", { "Ref": "AWS::Region" }, ":", { "Ref": "AWS::AccountId" }, ":log-group:/aws/lambda/*" ] ] } }, { "Action": "dynamodb:PutItem", "Effect": "Allow", "Resource": { "Fn::GetAtt": [ "SystemTable", "Arn" ] } }, { "Action": "mediaconvert:DescribeEndpoints", "Effect": "Allow", "Resource": { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":mediaconvert:", { "Ref": "AWS::Region" }, ":", { "Ref": "AWS::AccountId" }, ":endpoints/*" ] ] } }, { "Action": [ "kms:GenerateDataKey", "kms:Decrypt" ], "Effect": "Allow", "Resource": { "Fn::GetAtt": [ "MieKey", "Arn" ] } } ], "Version": "2012-10-17" }, "PolicyName": "root" } ], "Tags": [ { "Key": "environment", "Value": "mie" } ] }, "Metadata": { "cdk_nag": { "rules_to_suppress": [ { "reason": "Resource ARNs are not generated at the time of policy creation", "id": "AwsSolutions-IAM5" } ] } } }, "StageExecutionRole": { "Type": "AWS::IAM::Role", "Properties": { "AssumeRolePolicyDocument": { "Statement": [ { "Action": "sts:AssumeRole", "Effect": "Allow", "Principal": { "Service": "lambda.amazonaws.com" } } ], "Version": "2012-10-17" }, "Policies": [ { "PolicyDocument": { "Statement": [ { "Action": "states:StartExecution", "Condition": { "StringEquals": { "aws:ResourceTag/environment": "mie" } }, "Effect": "Allow", "Resource": { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":states:", { "Ref": "AWS::Region" }, ":", { "Ref": "AWS::AccountId" }, ":stateMachine:*" ] ] } }, { "Action": [ "dynamodb:GetItem", "dynamodb:Query", "dynamodb:Scan", "dynamodb:DescribeTable", "dynamodb:BatchGetItem", "dynamodb:GetRecords", "dynamodb:DescribeLimits", "dynamodb:PutItem", "dynamodb:UpdateItem", "dynamodb:DeleteItem", "dynamodb:BatchWriteItem" ], "Effect": "Allow", "Resource": [ { "Fn::GetAtt": [ "WorkflowTable", "Arn" ] }, { "Fn::GetAtt": [ "WorkflowExecutionTable", "Arn" ] }, { "Fn::Join": [ "", [ { "Fn::GetAtt": [ "WorkflowExecutionTable", "Arn" ] }, "/index/*" ] ] }, { "Fn::GetAtt": [ "SystemTable", "Arn" ] } ] }, { "Action": [ "logs:CreateLogGroup", "logs:CreateLogStream", "logs:PutLogEvents" ], "Effect": "Allow", "Resource": { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":logs:", { "Ref": "AWS::Region" }, ":", { "Ref": "AWS::AccountId" }, ":log-group:/aws/lambda/*" ] ] } }, { "Action": [ "sqs:DeleteMessage", "sqs:ListQueues", "sqs:ChangeMessageVisibility", "sqs:ReceiveMessage", "sqs:SendMessage" ], "Effect": "Allow", "Resource": [ { "Fn::GetAtt": [ "StageExecutionQueue", "Arn" ] }, { "Fn::GetAtt": [ "WorkflowExecutionLambdaDeadLetterQueue", "Arn" ] } ] }, { "Action": [ "xray:PutTraceSegments", "xray:PutTelemetryRecords" ], "Effect": "Allow", "Resource": "*" }, { "Action": "kms:Decrypt", "Effect": "Allow", "Resource": { "Fn::GetAtt": [ "MieKey", "Arn" ] } } ], "Version": "2012-10-17" }, "PolicyName": { "Fn::Join": [ "", [ { "Ref": "AWS::StackName" }, "-stage-execution-lambda" ] ] } } ], "Tags": [ { "Key": "environment", "Value": "mie" } ] }, "Metadata": { "cfn_nag": { "rules_to_suppress": [ { "id": "W11", "reason": "The X-Ray policy uses actions that must be applied to all resources. See https://docs.aws.amazon.com/xray/latest/devguide/security_iam_id-based-policy-examples.html#xray-permissions-resources" } ] }, "cdk_nag": { "rules_to_suppress": [ { "reason": "The X-Ray policy uses actions that must be applied to all resources. See https://docs.aws.amazon.com/xray/latest/devguide/security_iam_id-based-policy-examples.html#xray-permissions-resources", "id": "AwsSolutions-IAM5" } ] } } }, "StepFunctionRole": { "Type": "AWS::IAM::Role", "Properties": { "AssumeRolePolicyDocument": { "Statement": [ { "Action": "sts:AssumeRole", "Effect": "Allow", "Principal": { "Service": "states.amazonaws.com" } } ], "Version": "2012-10-17" }, "Policies": [ { "PolicyDocument": { "Statement": [ { "Action": "lambda:InvokeFunction", "Effect": "Allow", "Resource": [ "arn:aws:lambda:*:*:function:*OperatorLibrary*", "arn:aws:lambda:*:*:function:*start-wait-operation", "arn:aws:lambda:*:*:function:*check-wait-operation", "arn:aws:lambda:*:*:function:*CompleteStageLambda*", "arn:aws:lambda:*:*:function:*OperatorFailedLambda*", "arn:aws:lambda:*:*:function:*FilterOperationLambda*" ] }, { "Action": [ "xray:PutTraceSegments", "xray:PutTelemetryRecords", "xray:GetSamplingRules", "xray:GetSamplingTargets" ], "Effect": "Allow", "Resource": "*" }, { "Action": [ "logs:CreateLogDelivery", "logs:GetLogDelivery", "logs:UpdateLogDelivery", "logs:DeleteLogDelivery", "logs:ListLogDeliveries", "logs:PutResourcePolicy", "logs:DescribeResourcePolicies", "logs:DescribeLogGroups" ], "Effect": "Allow", "Resource": "*" } ], "Version": "2012-10-17" }, "PolicyName": { "Fn::Join": [ "", [ { "Ref": "AWS::StackName" }, "-sfn-lambda-exec" ] ] } } ], "Tags": [ { "Key": "environment", "Value": "mie" } ] }, "Metadata": { "cfn_nag": { "rules_to_suppress": [ { "id": "W11", "reason": "The X-Ray and Cloudwatch policies use actions that must be applied to all resources. See https://docs.aws.amazon.com/xray/latest/devguide/security_iam_id-based-policy-examples.html#xray-permissions-resources and https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazoncloudwatchlogs.html" } ] }, "cdk_nag": { "rules_to_suppress": [ { "reason": "The X-Ray and Cloudwatch policies use actions that must be applied to all resources. See https://docs.aws.amazon.com/xray/latest/devguide/security_iam_id-based-policy-examples.html#xray-permissions-resources and https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazoncloudwatchlogs.html", "id": "AwsSolutions-IAM5" } ] } } }, "operatorFailedRole": { "Type": "AWS::IAM::Role", "Properties": { "AssumeRolePolicyDocument": { "Statement": [ { "Action": "sts:AssumeRole", "Effect": "Allow", "Principal": { "Service": "lambda.amazonaws.com" } } ], "Version": "2012-10-17" }, "Policies": [ { "PolicyDocument": { "Statement": [ { "Action": [ "logs:CreateLogGroup", "logs:CreateLogStream", "logs:PutLogEvents" ], "Effect": "Allow", "Resource": { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":logs:*:*:*:*" ] ] } }, { "Action": [ "xray:PutTraceSegments", "xray:PutTelemetryRecords" ], "Effect": "Allow", "Resource": "*" } ], "Version": "2012-10-17" }, "PolicyName": { "Fn::Join": [ "", [ { "Ref": "AWS::StackName" }, "-operator-failed" ] ] } } ], "Tags": [ { "Key": "environment", "Value": "mie" } ] }, "Metadata": { "cfn_nag": { "rules_to_suppress": [ { "id": "W11", "reason": "The X-Ray policy uses actions that must be applied to all resources. See https://docs.aws.amazon.com/xray/latest/devguide/security_iam_id-based-policy-examples.html#xray-permissions-resources" } ] }, "cdk_nag": { "rules_to_suppress": [ { "reason": "The X-Ray policy uses actions that must be applied to all resources. See https://docs.aws.amazon.com/xray/latest/devguide/security_iam_id-based-policy-examples.html#xray-permissions-resources", "id": "AwsSolutions-IAM5" } ] } } }, "WorkflowExecutionStreamLambdaRole": { "Type": "AWS::IAM::Role", "Properties": { "AssumeRolePolicyDocument": { "Statement": [ { "Action": "sts:AssumeRole", "Effect": "Allow", "Principal": { "Service": "lambda.amazonaws.com" } } ], "Version": "2012-10-17" }, "Policies": [ { "PolicyDocument": { "Statement": [ { "Action": [ "dynamodb:DescribeStream", "dynamodb:GetRecords", "dynamodb:GetShardIterator", "dynamodb:ListStreams" ], "Effect": "Allow", "Resource": { "Fn::GetAtt": [ "WorkflowExecutionTable", "StreamArn" ] } }, { "Action": "sns:Publish", "Effect": "Allow", "Resource": { "Ref": "WorkflowExecutionEventTopic" } }, { "Action": [ "logs:CreateLogGroup", "logs:CreateLogStream", "logs:PutLogEvents" ], "Effect": "Allow", "Resource": { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":logs:", { "Ref": "AWS::Region" }, ":", { "Ref": "AWS::AccountId" }, ":log-group:/aws/lambda/*" ] ] } }, { "Action": [ "kms:GenerateDataKey", "kms:Decrypt" ], "Effect": "Allow", "Resource": { "Fn::GetAtt": [ "MieKey", "Arn" ] } } ], "Version": "2012-10-17" }, "PolicyName": { "Fn::Join": [ "", [ { "Ref": "AWS::StackName" }, "-WorkflowExecutionLambdaStreamAccessPolicy" ] ] } } ] }, "Metadata": { "cfn_nag": { "rules_to_suppress": [ { "id": "W11", "reason": "Lambda requires ability to write to cloudwatch *, as configured in the default AWS lambda execution role." } ] }, "cdk_nag": { "rules_to_suppress": [ { "reason": "Lambda requires ability to write to cloudwatch *, as configured in the default AWS lambda execution role.", "id": "AwsSolutions-IAM5" } ] } } }, "AnonymizedDataCustomResourceRole": { "Type": "AWS::IAM::Role", "Properties": { "AssumeRolePolicyDocument": { "Statement": [ { "Action": "sts:AssumeRole", "Effect": "Allow", "Principal": { "Service": "lambda.amazonaws.com" } } ], "Version": "2012-10-17" }, "Path": "/", "Policies": [ { "PolicyDocument": { "Statement": [ { "Action": [ "logs:CreateLogGroup", "logs:CreateLogStream", "logs:PutLogEvents" ], "Effect": "Allow", "Resource": { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":logs:", { "Ref": "AWS::Region" }, ":", { "Ref": "AWS::AccountId" }, ":log-group:/aws/lambda/*" ] ] } }, { "Action": "ssm:PutParameter", "Effect": "Allow", "Resource": { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":ssm:", { "Ref": "AWS::Region" }, ":", { "Ref": "AWS::AccountId" }, ":parameter/*" ] ] } } ], "Version": "2012-10-17" }, "PolicyName": { "Fn::Join": [ "", [ { "Ref": "AWS::StackName" }, "-anonymized-data-logger" ] ] } } ] }, "Metadata": { "cdk_nag": { "rules_to_suppress": [ { "reason": "Resource ARNs are not generated at the time of policy creation", "id": "AwsSolutions-IAM5" } ] } } }, "MediaInsightsOnAwsPython39Layer": { "Type": "AWS::Lambda::LayerVersion", "Properties": { "CompatibleRuntimes": [ "python3.9" ], "Content": { "S3Bucket": { "Fn::Join": [ "-", [ { "Fn::FindInMap": [ "SourceCode", "General", "RegionalS3Bucket" ] }, { "Ref": "AWS::Region" } ] ] }, "S3Key": { "Fn::Join": [ "/", [ { "Fn::FindInMap": [ "SourceCode", "General", "CodeKeyPrefix" ] }, "media_insights_on_aws_lambda_layer_python3.9-v5.1.11.zip" ] ] } }, "Description": "Boto3 and MediaInsightsOnAwsLambdaHelper packages for Python 3.9", "LayerName": "media-insights-on-aws-python39", "LicenseInfo": "Apache-2.0" }, "UpdateReplacePolicy": "Retain", "DeletionPolicy": "Retain" }, "MediaInsightsOnAwsPython310Layer": { "Type": "AWS::Lambda::LayerVersion", "Properties": { "CompatibleRuntimes": [ "python3.10" ], "Content": { "S3Bucket": { "Fn::Join": [ "-", [ { "Fn::FindInMap": [ "SourceCode", "General", "RegionalS3Bucket" ] }, { "Ref": "AWS::Region" } ] ] }, "S3Key": { "Fn::Join": [ "/", [ { "Fn::FindInMap": [ "SourceCode", "General", "CodeKeyPrefix" ] }, "media_insights_on_aws_lambda_layer_python3.10-v5.1.11.zip" ] ] } }, "Description": "Boto3 and MediaInsightsOnAwsLambdaHelper packages for Python 3.10", "LayerName": "media-insights-on-aws-python310", "LicenseInfo": "Apache-2.0" }, "UpdateReplacePolicy": "Retain", "DeletionPolicy": "Retain" }, "MediaInsightsOnAwsPython311Layer": { "Type": "AWS::Lambda::LayerVersion", "Properties": { "CompatibleRuntimes": [ "python3.11" ], "Content": { "S3Bucket": { "Fn::Join": [ "-", [ { "Fn::FindInMap": [ "SourceCode", "General", "RegionalS3Bucket" ] }, { "Ref": "AWS::Region" } ] ] }, "S3Key": { "Fn::Join": [ "/", [ { "Fn::FindInMap": [ "SourceCode", "General", "CodeKeyPrefix" ] }, "media_insights_on_aws_lambda_layer_python3.11-v5.1.11.zip" ] ] } }, "Description": "Boto3 and MediaInsightsOnAwsLambdaHelper packages for Python 3.11", "LayerName": "media-insights-on-aws-python311", "LicenseInfo": "Apache-2.0" }, "UpdateReplacePolicy": "Retain", "DeletionPolicy": "Retain" }, "MieHelperFunction": { "Type": "AWS::Lambda::Function", "Properties": { "Code": { "ZipFile": "import string\nimport cfnresponse\nimport random\nimport boto3\nimport os\ndef id_generator(size=6, chars=string.ascii_lowercase + string.digits):\n return \"\".join(random.choices(chars, k=size))\ndef get_mediaconvert_endpoint():\n mediaconvert_client = boto3.client(\"mediaconvert\", region_name=os.environ['AWS_REGION'])\n response = mediaconvert_client.describe_endpoints()\n mediaconvert_endpoint = response[\"Endpoints\"][0][\"Url\"]\n response_data = {'Data': mediaconvert_endpoint}\n return response_data\ndef init_system_table():\n dynamodb_client = boto3.resource(\"dynamodb\")\n SYSTEM_TABLE_NAME = os.environ[\"SYSTEM_TABLE_NAME\"]\n DEFAULT_MAX_CONCURRENT_WORKFLOWS = int(os.environ[\"DEFAULT_MAX_CONCURRENT_WORKFLOWS\"])\n system_table = dynamodb_client.Table(SYSTEM_TABLE_NAME)\n config={\"Name\":\"MaxConcurrentWorkflows\", \"Value\":DEFAULT_MAX_CONCURRENT_WORKFLOWS}\n return system_table.put_item(Item=config)\ndef handler(event, context):\n print(\"We got the following event:\\n\", event)\n if event['ResourceProperties']['FunctionKey'] == 'get_short_uuid':\n response_data = {'Data': id_generator()}\n cfnresponse.send(event, context, cfnresponse.SUCCESS, response_data, \"CustomResourcePhysicalID\")\n elif event['ResourceProperties']['FunctionKey'] == 'init_system_table':\n response_data = init_system_table()\n cfnresponse.send(event, context, cfnresponse.SUCCESS, response_data, \"CustomResourcePhysicalID\")\n elif event['ResourceProperties']['FunctionKey'] == 'get_mediaconvert_endpoint':\n response_data = get_mediaconvert_endpoint()\n cfnresponse.send(event, context, cfnresponse.SUCCESS, response_data, \"CustomResourcePhysicalID\")\n" }, "Environment": { "Variables": { "SYSTEM_TABLE_NAME": { "Ref": "SystemTable" }, "DEFAULT_MAX_CONCURRENT_WORKFLOWS": { "Ref": "MaxConcurrentWorkflows" } } }, "Handler": "index.handler", "Role": { "Fn::GetAtt": [ "MieHelperExecutionRole", "Arn" ] }, "Runtime": "python3.11", "Tags": [ { "Key": "environment", "Value": "mie" } ] }, "DependsOn": [ "MieHelperExecutionRole" ], "Metadata": { "cfn_nag": { "rules_to_suppress": [ { "id": "W89", "reason": "This Lambda function does not need to access any resource provisioned within a VPC." }, { "id": "W92", "reason": "This function does not require performance optimization, so the default concurrency limits suffice." } ] }, "cdk_nag": { "rules_to_suppress": [ { "reason": "Latest lambda version not supported at this time.", "id": "AwsSolutions-L1" } ] } } }, "MieHelperFunctionPermissions": { "Type": "AWS::Lambda::Permission", "Properties": { "Action": "lambda:InvokeFunction", "FunctionName": { "Fn::GetAtt": [ "MieHelperFunction", "Arn" ] }, "Principal": "cloudformation.amazonaws.com" }, "Metadata": { "cdk_nag": { "rules_to_suppress": [ { "reason": "Latest lambda version not supported at this time.", "id": "AwsSolutions-L1" } ] } } }, "GetShortUUID": { "Type": "Custom::CustomResource", "Properties": { "ServiceToken": { "Fn::GetAtt": [ "MieHelperFunction", "Arn" ] }, "FunctionKey": "get_short_uuid" }, "UpdateReplacePolicy": "Delete", "DeletionPolicy": "Delete" }, "InitSystemTable": { "Type": "Custom::CustomResource", "Properties": { "ServiceToken": { "Fn::GetAtt": [ "MieHelperFunction", "Arn" ] }, "FunctionKey": "init_system_table" }, "DependsOn": [ "MediaInsightsDataplaneApiStack" ], "UpdateReplacePolicy": "Delete", "DeletionPolicy": "Delete" }, "GetMediaConvertEndpoint": { "Type": "Custom::CustomResource", "Properties": { "ServiceToken": { "Fn::GetAtt": [ "MieHelperFunction", "Arn" ] }, "FunctionKey": "get_mediaconvert_endpoint" }, "UpdateReplacePolicy": "Delete", "DeletionPolicy": "Delete" }, "WorkflowSchedulerLambda": { "Type": "AWS::Lambda::Function", "Properties": { "Code": { "S3Bucket": { "Fn::Join": [ "-", [ { "Fn::FindInMap": [ "SourceCode", "General", "RegionalS3Bucket" ] }, { "Ref": "AWS::Region" } ] ] }, "S3Key": { "Fn::Join": [ "/", [ { "Fn::FindInMap": [ "SourceCode", "General", "CodeKeyPrefix" ] }, "workflow.zip" ] ] } }, "DeadLetterConfig": { "TargetArn": { "Fn::GetAtt": [ "WorkflowExecutionLambdaDeadLetterQueue", "Arn" ] } }, "Environment": { "Variables": { "STAGE_EXECUTION_QUEUE_URL": { "Ref": "StageExecutionQueue" }, "STAGE_TABLE_NAME": { "Ref": "StageTable" }, "OPERATION_TABLE_NAME": { "Ref": "OperationTable" }, "WORKFLOW_EXECUTION_TABLE_NAME": { "Ref": "WorkflowExecutionTable" }, "WORKFLOW_TABLE_NAME": { "Ref": "WorkflowTable" }, "SYSTEM_TABLE_NAME": { "Ref": "SystemTable" }, "DEFAULT_MAX_CONCURRENT_WORKFLOWS": { "Ref": "MaxConcurrentWorkflows" }, "botoConfig": { "Fn::Join": [ "", [ "{\"user_agent_extra\": \"AwsSolution/", { "Ref": "SolutionId" }, "/", { "Ref": "SolutionVersion" }, "\"}" ] ] } } }, "Handler": "app.workflow_scheduler_lambda", "Layers": [ { "Ref": "MediaInsightsOnAwsPython311Layer" } ], "MemorySize": 256, "ReservedConcurrentExecutions": 1, "Role": { "Fn::GetAtt": [ "StageExecutionRole", "Arn" ] }, "Runtime": "python3.11", "Tags": [ { "Key": "environment", "Value": "mie" } ], "Timeout": 900, "TracingConfig": { "Mode": { "Fn::If": [ "EnableTraceOnEntryPoints", "Active", "PassThrough" ] } } }, "DependsOn": [ "StageExecutionRole" ], "Metadata": { "cfn_nag": { "rules_to_suppress": [ { "id": "W89", "reason": "This Lambda function does not need to access any resource provisioned within a VPC." }, { "id": "W92", "reason": "This function does not require performance optimization, so the default concurrency limits suffice." } ] }, "cdk_nag": { "rules_to_suppress": [ { "reason": "Latest lambda version not supported at this time.", "id": "AwsSolutions-L1" } ] } } }, "LambdaSchedule": { "Type": "AWS::Events::Rule", "Properties": { "Description": "A schedule for the Lambda function..", "ScheduleExpression": "rate(1 minute)", "State": "ENABLED", "Targets": [ { "Arn": { "Fn::GetAtt": [ "WorkflowSchedulerLambda", "Arn" ] }, "Id": "Target0" } ] }, "DependsOn": [ "WorkflowSchedulerLambda" ] }, "LambdaScheduleAllowEventRulemediainsightsonawsWorkflowSchedulerLambda1A127ACE": { "Type": "AWS::Lambda::Permission", "Properties": { "Action": "lambda:InvokeFunction", "FunctionName": { "Fn::GetAtt": [ "WorkflowSchedulerLambda", "Arn" ] }, "Principal": "events.amazonaws.com", "SourceArn": { "Fn::GetAtt": [ "LambdaSchedule", "Arn" ] } }, "DependsOn": [ "WorkflowSchedulerLambda" ] }, "OperationLambdaExecutionRole": { "Type": "AWS::IAM::Role", "Properties": { "AssumeRolePolicyDocument": { "Statement": [ { "Action": "sts:AssumeRole", "Effect": "Allow", "Principal": { "Service": "lambda.amazonaws.com" } } ], "Version": "2012-10-17" }, "Policies": [ { "PolicyDocument": { "Statement": [ { "Action": [ "states:DescribeExecution", "states:GetExecutionHistory", "states:StopExecution" ], "Effect": "Allow", "Resource": { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":states:", { "Ref": "AWS::Region" }, ":", { "Ref": "AWS::AccountId" }, ":execution:*:*" ] ] } }, { "Action": "lambda:InvokeFunction", "Effect": "Allow", "Resource": { "Fn::GetAtt": [ "WorkflowSchedulerLambda", "Arn" ] } }, { "Action": "states:StartExecution", "Condition": { "StringEquals": { "aws:ResourceTag/environment": "mie" } }, "Effect": "Allow", "Resource": { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":states:", { "Ref": "AWS::Region" }, ":", { "Ref": "AWS::AccountId" }, ":stateMachine:*" ] ] } }, { "Action": [ "dynamodb:GetItem", "dynamodb:Query", "dynamodb:Scan", "dynamodb:DescribeTable", "dynamodb:BatchGetItem", "dynamodb:GetRecords", "dynamodb:DescribeLimits", "dynamodb:PutItem", "dynamodb:UpdateItem", "dynamodb:DeleteItem", "dynamodb:BatchWriteItem" ], "Effect": "Allow", "Resource": [ { "Fn::GetAtt": [ "WorkflowTable", "Arn" ] }, { "Fn::GetAtt": [ "WorkflowExecutionTable", "Arn" ] }, { "Fn::Join": [ "", [ { "Fn::GetAtt": [ "WorkflowExecutionTable", "Arn" ] }, "/index/*" ] ] }, { "Fn::GetAtt": [ "SystemTable", "Arn" ] } ] }, { "Action": [ "logs:CreateLogGroup", "logs:CreateLogStream", "logs:PutLogEvents" ], "Effect": "Allow", "Resource": { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":logs:", { "Ref": "AWS::Region" }, ":", { "Ref": "AWS::AccountId" }, ":log-group:/aws/lambda/*" ] ] } }, { "Action": [ "sqs:DeleteMessage", "sqs:ListQueues", "sqs:ChangeMessageVisibility", "sqs:ReceiveMessage", "sqs:SendMessage" ], "Effect": "Allow", "Resource": [ { "Fn::GetAtt": [ "StageExecutionQueue", "Arn" ] }, { "Fn::GetAtt": [ "WorkflowExecutionLambdaDeadLetterQueue", "Arn" ] } ] }, { "Action": [ "xray:PutTraceSegments", "xray:PutTelemetryRecords" ], "Effect": "Allow", "Resource": "*" }, { "Action": "kms:Decrypt", "Effect": "Allow", "Resource": { "Fn::GetAtt": [ "MieKey", "Arn" ] } } ], "Version": "2012-10-17" }, "PolicyName": { "Fn::Join": [ "", [ { "Ref": "AWS::StackName" }, "-operation-lambda" ] ] } } ], "Tags": [ { "Key": "environment", "Value": "mie" } ] }, "Metadata": { "cfn_nag": { "rules_to_suppress": [ { "id": "W11", "reason": "The X-Ray policy uses actions that must be applied to all resources. See https://docs.aws.amazon.com/xray/latest/devguide/security_iam_id-based-policy-examples.html#xray-permissions-resources" } ] }, "cdk_nag": { "rules_to_suppress": [ { "reason": "The X-Ray policy uses actions that must be applied to all resources. See https://docs.aws.amazon.com/xray/latest/devguide/security_iam_id-based-policy-examples.html#xray-permissions-resources", "id": "AwsSolutions-IAM5" } ] } } }, "WorkflowErrorHandlerLambda": { "Type": "AWS::Lambda::Function", "Properties": { "Code": { "S3Bucket": { "Fn::Join": [ "-", [ { "Fn::FindInMap": [ "SourceCode", "General", "RegionalS3Bucket" ] }, { "Ref": "AWS::Region" } ] ] }, "S3Key": { "Fn::Join": [ "/", [ { "Fn::FindInMap": [ "SourceCode", "General", "CodeKeyPrefix" ] }, "workflow.zip" ] ] } }, "DeadLetterConfig": { "TargetArn": { "Fn::GetAtt": [ "WorkflowExecutionLambdaDeadLetterQueue", "Arn" ] } }, "Environment": { "Variables": { "STAGE_EXECUTION_QUEUE_URL": { "Ref": "StageExecutionQueue" }, "STAGE_TABLE_NAME": { "Ref": "StageTable" }, "OPERATION_TABLE_NAME": { "Ref": "OperationTable" }, "WORKFLOW_EXECUTION_TABLE_NAME": { "Ref": "WorkflowExecutionTable" }, "WORKFLOW_TABLE_NAME": { "Ref": "WorkflowTable" }, "SYSTEM_TABLE_NAME": { "Ref": "SystemTable" }, "DEFAULT_MAX_CONCURRENT_WORKFLOWS": { "Ref": "MaxConcurrentWorkflows" }, "ShortUUID": { "Fn::GetAtt": [ "GetShortUUID", "Data" ] }, "WORKFLOW_SCHEDULER_LAMBDA_ARN": { "Fn::GetAtt": [ "WorkflowSchedulerLambda", "Arn" ] } } }, "Handler": "app.workflow_error_handler_lambda", "Layers": [ { "Ref": "MediaInsightsOnAwsPython311Layer" } ], "MemorySize": 256, "ReservedConcurrentExecutions": 1, "Role": { "Fn::GetAtt": [ "OperationLambdaExecutionRole", "Arn" ] }, "Runtime": "python3.11", "Tags": [ { "Key": "environment", "Value": "mie" } ], "Timeout": 900, "TracingConfig": { "Mode": { "Fn::If": [ "EnableTraceOnEntryPoints", "Active", "PassThrough" ] } } }, "DependsOn": [ "OperationLambdaExecutionRole" ], "Metadata": { "cfn_nag": { "rules_to_suppress": [ { "id": "W89", "reason": "This Lambda function does not need to access any resource provisioned within a VPC." }, { "id": "W92", "reason": "This function does not require performance optimization, so the default concurrency limits suffice." } ] }, "cdk_nag": { "rules_to_suppress": [ { "reason": "Latest lambda version not supported at this time.", "id": "AwsSolutions-L1" } ] } } }, "StateMachineErrorCloudWatchEvent": { "Type": "AWS::Events::Rule", "Properties": { "Description": "state machine error handler", "EventPattern": { "source": [ "aws.states" ], "detail-type": [ "Step Functions Execution Status Change" ], "detail": { "status": [ "FAILED", "ABORTED", "TIMED_OUT" ] } }, "Name": { "Fn::Join": [ "", [ { "Ref": "AWS::StackName" }, "-state-error-handler" ] ] }, "State": "ENABLED", "Targets": [ { "Arn": { "Fn::GetAtt": [ "WorkflowErrorHandlerLambda", "Arn" ] }, "Id": "Target0" } ] }, "DependsOn": [ "WorkflowErrorHandlerLambda" ] }, "StateMachineErrorCloudWatchEventAllowEventRulemediainsightsonawsWorkflowErrorHandlerLambda698DD047": { "Type": "AWS::Lambda::Permission", "Properties": { "Action": "lambda:InvokeFunction", "FunctionName": { "Fn::GetAtt": [ "WorkflowErrorHandlerLambda", "Arn" ] }, "Principal": "events.amazonaws.com", "SourceArn": { "Fn::GetAtt": [ "StateMachineErrorCloudWatchEvent", "Arn" ] } }, "DependsOn": [ "WorkflowErrorHandlerLambda" ] }, "CompleteStageLambda": { "Type": "AWS::Lambda::Function", "Properties": { "Code": { "S3Bucket": { "Fn::Join": [ "-", [ { "Fn::FindInMap": [ "SourceCode", "General", "RegionalS3Bucket" ] }, { "Ref": "AWS::Region" } ] ] }, "S3Key": { "Fn::Join": [ "/", [ { "Fn::FindInMap": [ "SourceCode", "General", "CodeKeyPrefix" ] }, "workflow.zip" ] ] } }, "Environment": { "Variables": { "botoConfig": { "Fn::Join": [ "", [ "{\"user_agent_extra\": \"AwsSolution/", { "Ref": "SolutionId" }, "/", { "Ref": "SolutionVersion" }, "\"}" ] ] }, "STAGE_EXECUTION_QUEUE_URL": { "Ref": "StageExecutionQueue" }, "STAGE_TABLE_NAME": { "Ref": "StageTable" }, "OPERATION_TABLE_NAME": { "Ref": "OperationTable" }, "WORKFLOW_EXECUTION_TABLE_NAME": { "Ref": "WorkflowExecutionTable" }, "WORKFLOW_TABLE_NAME": { "Ref": "WorkflowTable" }, "SYSTEM_TABLE_NAME": { "Ref": "SystemTable" }, "WORKFLOW_SCHEDULER_LAMBDA_ARN": { "Fn::GetAtt": [ "WorkflowSchedulerLambda", "Arn" ] } } }, "Handler": "app.complete_stage_execution_lambda", "Layers": [ { "Ref": "MediaInsightsOnAwsPython311Layer" } ], "MemorySize": 256, "Role": { "Fn::GetAtt": [ "OperationLambdaExecutionRole", "Arn" ] }, "Runtime": "python3.11", "Tags": [ { "Key": "environment", "Value": "mie" } ], "Timeout": 900, "TracingConfig": { "Mode": "PassThrough" } }, "DependsOn": [ "OperationLambdaExecutionRole", "WorkflowSchedulerLambda" ], "Metadata": { "cfn_nag": { "rules_to_suppress": [ { "id": "W89", "reason": "This Lambda function does not need to access any resource provisioned within a VPC." }, { "id": "W92", "reason": "This function does not require performance optimization, so the default concurrency limits suffice." } ] }, "cdk_nag": { "rules_to_suppress": [ { "reason": "Latest lambda version not supported at this time.", "id": "AwsSolutions-L1" } ] } } }, "FilterOperationLambda": { "Type": "AWS::Lambda::Function", "Properties": { "Code": { "S3Bucket": { "Fn::Join": [ "-", [ { "Fn::FindInMap": [ "SourceCode", "General", "RegionalS3Bucket" ] }, { "Ref": "AWS::Region" } ] ] }, "S3Key": { "Fn::Join": [ "/", [ { "Fn::FindInMap": [ "SourceCode", "General", "CodeKeyPrefix" ] }, "workflow.zip" ] ] } }, "Environment": { "Variables": { "botoConfig": { "Fn::Join": [ "", [ "{\"user_agent_extra\": \"AwsSolution/", { "Ref": "SolutionId" }, "/", { "Ref": "SolutionVersion" }, "\"}" ] ] }, "STAGE_EXECUTION_QUEUE_URL": { "Ref": "StageExecutionQueue" }, "STAGE_TABLE_NAME": { "Ref": "StageTable" }, "OPERATION_TABLE_NAME": { "Ref": "OperationTable" }, "WORKFLOW_EXECUTION_TABLE_NAME": { "Ref": "WorkflowExecutionTable" }, "WORKFLOW_TABLE_NAME": { "Ref": "WorkflowTable" } } }, "Handler": "app.filter_operation_lambda", "Layers": [ { "Ref": "MediaInsightsOnAwsPython311Layer" } ], "MemorySize": 256, "Role": { "Fn::GetAtt": [ "OperationLambdaExecutionRole", "Arn" ] }, "Runtime": "python3.11", "Tags": [ { "Key": "environment", "Value": "mie" } ], "Timeout": 900, "TracingConfig": { "Mode": "PassThrough" } }, "DependsOn": [ "OperationLambdaExecutionRole" ], "Metadata": { "cfn_nag": { "rules_to_suppress": [ { "id": "W89", "reason": "This Lambda function does not need to access any resource provisioned within a VPC." }, { "id": "W92", "reason": "This function does not require performance optimization, so the default concurrency limits suffice." } ] }, "cdk_nag": { "rules_to_suppress": [ { "reason": "Latest lambda version not supported at this time.", "id": "AwsSolutions-L1" } ] } } }, "OperatorFailedLambda": { "Type": "AWS::Lambda::Function", "Properties": { "Code": { "S3Bucket": { "Fn::Join": [ "-", [ { "Fn::FindInMap": [ "SourceCode", "General", "RegionalS3Bucket" ] }, { "Ref": "AWS::Region" } ] ] }, "S3Key": { "Fn::Join": [ "/", [ { "Fn::FindInMap": [ "SourceCode", "General", "CodeKeyPrefix" ] }, "operator_failed.zip" ] ] } }, "Handler": "operator_failed.lambda_handler", "Layers": [ { "Ref": "MediaInsightsOnAwsPython311Layer" } ], "Role": { "Fn::GetAtt": [ "operatorFailedRole", "Arn" ] }, "Runtime": "python3.11", "Tags": [ { "Key": "environment", "Value": "mie" } ], "TracingConfig": { "Mode": "PassThrough" } }, "DependsOn": [ "operatorFailedRole" ], "Metadata": { "cfn_nag": { "rules_to_suppress": [ { "id": "W89", "reason": "This Lambda function does not need to access any resource provisioned within a VPC." }, { "id": "W92", "reason": "This function does not require performance optimization, so the default concurrency limits suffice." } ] }, "cdk_nag": { "rules_to_suppress": [ { "reason": "Latest lambda version not supported at this time.", "id": "AwsSolutions-L1" } ] } } }, "StartWaitOperationLambda": { "Type": "AWS::Lambda::Function", "Properties": { "Code": { "S3Bucket": { "Fn::Join": [ "-", [ { "Fn::FindInMap": [ "SourceCode", "General", "RegionalS3Bucket" ] }, { "Ref": "AWS::Region" } ] ] }, "S3Key": { "Fn::Join": [ "/", [ { "Fn::FindInMap": [ "SourceCode", "General", "CodeKeyPrefix" ] }, "workflow.zip" ] ] } }, "Environment": { "Variables": { "botoConfig": { "Fn::Join": [ "", [ "{\"user_agent_extra\": \"AwsSolution/", { "Ref": "SolutionId" }, "/", { "Ref": "SolutionVersion" }, "\"}" ] ] }, "STAGE_EXECUTION_QUEUE_URL": { "Ref": "StageExecutionQueue" }, "STAGE_TABLE_NAME": { "Ref": "StageTable" }, "OPERATION_TABLE_NAME": { "Ref": "OperationTable" }, "WORKFLOW_EXECUTION_TABLE_NAME": { "Ref": "WorkflowExecutionTable" }, "WORKFLOW_TABLE_NAME": { "Ref": "WorkflowTable" } } }, "FunctionName": { "Fn::Join": [ "", [ { "Ref": "AWS::StackName" }, "-start-wait-operation" ] ] }, "Handler": "app.start_wait_operation_lambda", "Layers": [ { "Ref": "MediaInsightsOnAwsPython311Layer" } ], "MemorySize": 256, "Role": { "Fn::GetAtt": [ "OperationLambdaExecutionRole", "Arn" ] }, "Runtime": "python3.11", "Tags": [ { "Key": "environment", "Value": "mie" } ], "Timeout": 900 }, "DependsOn": [ "OperationLambdaExecutionRole" ], "Metadata": { "cfn_nag": { "rules_to_suppress": [ { "id": "W89", "reason": "This Lambda function does not need to access any resource provisioned within a VPC." }, { "id": "W92", "reason": "This function does not require performance optimization, so the default concurrency limits suffice." } ] }, "cdk_nag": { "rules_to_suppress": [ { "reason": "Latest lambda version not supported at this time.", "id": "AwsSolutions-L1" } ] } } }, "CheckWaitOperationLambda": { "Type": "AWS::Lambda::Function", "Properties": { "Code": { "S3Bucket": { "Fn::Join": [ "-", [ { "Fn::FindInMap": [ "SourceCode", "General", "RegionalS3Bucket" ] }, { "Ref": "AWS::Region" } ] ] }, "S3Key": { "Fn::Join": [ "/", [ { "Fn::FindInMap": [ "SourceCode", "General", "CodeKeyPrefix" ] }, "workflow.zip" ] ] } }, "Environment": { "Variables": { "botoConfig": { "Fn::Join": [ "", [ "{\"user_agent_extra\": \"AwsSolution/", { "Ref": "SolutionId" }, "/", { "Ref": "SolutionVersion" }, "\"}" ] ] }, "STAGE_EXECUTION_QUEUE_URL": { "Ref": "StageExecutionQueue" }, "STAGE_TABLE_NAME": { "Ref": "StageTable" }, "OPERATION_TABLE_NAME": { "Ref": "OperationTable" }, "WORKFLOW_EXECUTION_TABLE_NAME": { "Ref": "WorkflowExecutionTable" }, "WORKFLOW_TABLE_NAME": { "Ref": "WorkflowTable" } } }, "FunctionName": { "Fn::Join": [ "", [ { "Ref": "AWS::StackName" }, "-check-wait-operation" ] ] }, "Handler": "app.check_wait_operation_lambda", "Layers": [ { "Ref": "MediaInsightsOnAwsPython311Layer" } ], "MemorySize": 256, "Role": { "Fn::GetAtt": [ "OperationLambdaExecutionRole", "Arn" ] }, "Runtime": "python3.11", "Tags": [ { "Key": "environment", "Value": "mie" } ], "Timeout": 900 }, "DependsOn": [ "OperationLambdaExecutionRole" ], "Metadata": { "cfn_nag": { "rules_to_suppress": [ { "id": "W89", "reason": "This Lambda function does not need to access any resource provisioned within a VPC." }, { "id": "W92", "reason": "This function does not require performance optimization, so the default concurrency limits suffice." } ] }, "cdk_nag": { "rules_to_suppress": [ { "reason": "Latest lambda version not supported at this time.", "id": "AwsSolutions-L1" } ] } } }, "WorkflowExecutionStreamingFunction": { "Type": "AWS::Lambda::Function", "Properties": { "Code": { "S3Bucket": { "Fn::Join": [ "-", [ { "Fn::FindInMap": [ "SourceCode", "General", "RegionalS3Bucket" ] }, { "Ref": "AWS::Region" } ] ] }, "S3Key": { "Fn::Join": [ "/", [ { "Fn::FindInMap": [ "SourceCode", "General", "CodeKeyPrefix" ] }, "workflowstream.zip" ] ] } }, "Environment": { "Variables": { "botoConfig": { "Fn::Join": [ "", [ "{\"user_agent_extra\": \"AwsSolution/", { "Ref": "SolutionId" }, "/", { "Ref": "SolutionVersion" }, "\"}" ] ] }, "TOPIC_ARN": { "Ref": "WorkflowExecutionEventTopic" } } }, "Handler": "workflowstream.lambda_handler", "Role": { "Fn::GetAtt": [ "WorkflowExecutionStreamLambdaRole", "Arn" ] }, "Runtime": "python3.11", "Tags": [ { "Key": "environment", "Value": "mie" } ] }, "DependsOn": [ "WorkflowExecutionStreamLambdaRole" ], "Metadata": { "cfn_nag": { "rules_to_suppress": [ { "id": "W89", "reason": "This Lambda function does not need to access any resource provisioned within a VPC." }, { "id": "W92", "reason": "This function does not require performance optimization, so the default concurrency limits suffice." } ] }, "cdk_nag": { "rules_to_suppress": [ { "reason": "Latest lambda version not supported at this time.", "id": "AwsSolutions-L1" } ] } } }, "WorkflowExecutionStreamingFunctionEventMapping": { "Type": "AWS::Lambda::EventSourceMapping", "Properties": { "EventSourceArn": { "Fn::GetAtt": [ "WorkflowExecutionTable", "StreamArn" ] }, "FunctionName": { "Ref": "WorkflowExecutionStreamingFunction" }, "StartingPosition": "LATEST", "Tags": [ { "Key": "environment", "Value": "mie" } ] } }, "AnonymizedDataCustomResource": { "Type": "AWS::Lambda::Function", "Properties": { "Code": { "S3Bucket": { "Fn::Join": [ "-", [ { "Fn::FindInMap": [ "SourceCode", "General", "RegionalS3Bucket" ] }, { "Ref": "AWS::Region" } ] ] }, "S3Key": { "Fn::Join": [ "/", [ { "Fn::FindInMap": [ "SourceCode", "General", "CodeKeyPrefix" ] }, "anonymized-data-logger.zip" ] ] } }, "Description": "Used to send anonymized data", "FunctionName": { "Fn::Join": [ "", [ { "Ref": "AWS::StackName" }, "-anonymized-data" ] ] }, "Handler": "anonymized-data-logger.handler", "Role": { "Fn::GetAtt": [ "AnonymizedDataCustomResourceRole", "Arn" ] }, "Runtime": "python3.11", "Timeout": 180 }, "DependsOn": [ "AnonymizedDataCustomResourceRole" ], "Metadata": { "cfn_nag": { "rules_to_suppress": [ { "id": "W89", "reason": "This Lambda function does not need to access any resource provisioned within a VPC." }, { "id": "W92", "reason": "This function does not require performance optimization, so the default concurrency limits suffice." } ] }, "cdk_nag": { "rules_to_suppress": [ { "reason": "Latest lambda version not supported at this time.", "id": "AwsSolutions-L1" } ] } } }, "StepFunctionLogGroup": { "Type": "AWS::Logs::LogGroup", "Properties": { "LogGroupName": { "Fn::Join": [ "", [ "/aws/vendedlogs/states/", { "Ref": "AWS::StackName" }, "-StepFunctionLogGroup-", { "Fn::GetAtt": [ "GetShortUUID", "Data" ] } ] ] }, "RetentionInDays": 14, "Tags": [ { "Key": "environment", "Value": "mie" } ] }, "UpdateReplacePolicy": "Retain", "DeletionPolicy": "Retain", "Metadata": { "cfn_nag": { "rules_to_suppress": [ { "id": "W84", "reason": "Log group data is encrypted by default in CloudWatch" } ] } } }, "MediaInsightsDataplaneApiStack": { "Type": "AWS::CloudFormation::Stack", "Properties": { "Parameters": { "botoConfig": { "Fn::Join": [ "", [ "{\"user_agent_extra\": \"AwsSolution/", { "Ref": "SolutionId" }, "/", { "Ref": "SolutionVersion" }, "\"}" ] ] }, "DataplaneTableName": { "Ref": "DataplaneTable" }, "ExternalBucketArn": { "Ref": "ExternalBucketArn" }, "DataplaneBucketName": { "Ref": "Dataplane" }, "DeploymentPackageBucket": { "Fn::Join": [ "-", [ { "Fn::FindInMap": [ "SourceCode", "General", "RegionalS3Bucket" ] }, { "Ref": "AWS::Region" } ] ] }, "TracingConfigMode": { "Fn::If": [ "EnableTraceOnEntryPoints", "Active", "PassThrough" ] }, "DeploymentPackageKey": { "Fn::Join": [ "/", [ { "Fn::FindInMap": [ "SourceCode", "General", "CodeKeyPrefix" ] }, "dataplaneapi.zip" ] ] }, "MediaInsightsOnAwsPython311Layer": { "Ref": "MediaInsightsOnAwsPython311Layer" }, "FrameworkVersion": { "Fn::FindInMap": [ "SourceCode", "General", "FrameworkVersion" ] }, "KmsKeyId": { "Ref": "MieKey" } }, "TemplateURL": { "Fn::Join": [ "", [ "https://", { "Fn::FindInMap": [ "SourceCode", "General", "GlobalS3Bucket" ] }, ".s3.", { "Ref": "AWS::URLSuffix" }, "/", { "Fn::FindInMap": [ "SourceCode", "General", "TemplateKeyPrefix" ] }, "/media-insights-on-aws-dataplane-api-stack.template" ] ] } }, "UpdateReplacePolicy": "Delete", "DeletionPolicy": "Delete" }, "MediaInsightsWorkflowApi": { "Type": "AWS::CloudFormation::Stack", "Properties": { "Parameters": { "botoConfig": { "Fn::Join": [ "", [ "{\"user_agent_extra\": \"AwsSolution/", { "Ref": "SolutionId" }, "/", { "Ref": "SolutionVersion" }, "\"}" ] ] }, "ShortUUID": { "Fn::GetAtt": [ "GetShortUUID", "Data" ] }, "StageExecutionQueueUrl": { "Ref": "StageExecutionQueue" }, "StageExecutionRole": { "Fn::GetAtt": [ "StepFunctionRole", "Arn" ] }, "StepFunctionLogGroupArn": { "Fn::GetAtt": [ "StepFunctionLogGroup", "Arn" ] }, "OperationTableName": { "Ref": "OperationTable" }, "StageTableName": { "Ref": "StageTable" }, "WorkflowExecutionTableName": { "Ref": "WorkflowExecutionTable" }, "WorkflowTableName": { "Ref": "WorkflowTable" }, "HistoryTableName": { "Ref": "HistoryTable" }, "SystemTableName": { "Ref": "SystemTable" }, "SqsQueueArn": { "Fn::GetAtt": [ "StageExecutionQueue", "Arn" ] }, "MediaInsightsOnAwsPython311Layer": { "Ref": "MediaInsightsOnAwsPython311Layer" }, "TracingConfigMode": { "Fn::If": [ "EnableTraceOnEntryPoints", "Active", "PassThrough" ] }, "CompleteStageLambdaArn": { "Fn::GetAtt": [ "CompleteStageLambda", "Arn" ] }, "FilterOperationLambdaArn": { "Fn::GetAtt": [ "FilterOperationLambda", "Arn" ] }, "WorkflowSchedulerLambdaArn": { "Fn::GetAtt": [ "WorkflowSchedulerLambda", "Arn" ] }, "DataplaneEndpoint": { "Fn::GetAtt": [ "MediaInsightsDataplaneApiStack", "Outputs.APIHandlerName" ] }, "DataplaneHandlerArn": { "Fn::GetAtt": [ "MediaInsightsDataplaneApiStack", "Outputs.APIHandlerArn" ] }, "DataPlaneBucket": { "Ref": "Dataplane" }, "OperatorFailedHandlerLambdaArn": { "Fn::GetAtt": [ "OperatorFailedLambda", "Arn" ] }, "DeploymentPackageBucket": { "Fn::Join": [ "-", [ { "Fn::FindInMap": [ "SourceCode", "General", "RegionalS3Bucket" ] }, { "Ref": "AWS::Region" } ] ] }, "DeploymentPackageKey": { "Fn::Join": [ "/", [ { "Fn::FindInMap": [ "SourceCode", "General", "CodeKeyPrefix" ] }, "workflowapi.zip" ] ] }, "FrameworkVersion": { "Fn::FindInMap": [ "SourceCode", "General", "FrameworkVersion" ] }, "KmsKeyId": { "Ref": "MieKey" } }, "TemplateURL": { "Fn::Join": [ "", [ "https://", { "Fn::FindInMap": [ "SourceCode", "General", "GlobalS3Bucket" ] }, ".s3.", { "Ref": "AWS::URLSuffix" }, "/", { "Fn::FindInMap": [ "SourceCode", "General", "TemplateKeyPrefix" ] }, "/media-insights-on-aws-workflow-api-stack.template" ] ] } }, "UpdateReplacePolicy": "Delete", "DeletionPolicy": "Delete" }, "Analytics": { "Type": "AWS::CloudFormation::Stack", "Properties": { "Parameters": { "botoConfig": { "Fn::Join": [ "", [ "{\"user_agent_extra\": \"AwsSolution/", { "Ref": "SolutionId" }, "/", { "Ref": "SolutionVersion" }, "\"}" ] ] }, "onawsMieKeyArn": { "Fn::GetAtt": [ "MieKey", "Arn" ] }, "onawsDataplaneTable71483436StreamArn": { "Fn::GetAtt": [ "DataplaneTable", "StreamArn" ] } }, "TemplateURL": { "Fn::Join": [ "", [ "https://", { "Fn::FindInMap": [ "SourceCode", "General", "GlobalS3Bucket" ] }, ".s3.", { "Ref": "AWS::URLSuffix" }, "/", { "Fn::FindInMap": [ "SourceCode", "General", "TemplateKeyPrefix" ] }, "/media-insights-on-aws-dataplane-streaming-stack.template" ] ] } }, "DependsOn": [ "MediaInsightsDataplaneApiStack", "MediaInsightsWorkflowApi" ], "UpdateReplacePolicy": "Delete", "DeletionPolicy": "Delete", "Condition": "DeployAnalyticsPipelineCondition" }, "OperatorLibrary": { "Type": "AWS::CloudFormation::Stack", "Properties": { "Parameters": { "DataPlaneBucket": { "Ref": "Dataplane" }, "ExternalBucketArn": { "Ref": "ExternalBucketArn" }, "DataPlaneEndpoint": { "Fn::GetAtt": [ "MediaInsightsDataplaneApiStack", "Outputs.APIHandlerName" ] }, "DataPlaneHandlerArn": { "Fn::GetAtt": [ "MediaInsightsDataplaneApiStack", "Outputs.APIHandlerArn" ] }, "WorkflowCustomResourceArn": { "Fn::GetAtt": [ "MediaInsightsWorkflowApi", "Outputs.WorkflowCustomResourceArn" ] }, "StartWaitOperationLambda": { "Fn::GetAtt": [ "StartWaitOperationLambda", "Arn" ] }, "CheckWaitOperationLambda": { "Fn::GetAtt": [ "CheckWaitOperationLambda", "Arn" ] }, "MediaConvertEndpoint": { "Fn::GetAtt": [ "GetMediaConvertEndpoint", "Data" ] }, "Boto3UserAgent": { "Fn::Join": [ "", [ "{\"user_agent_extra\": \"AwsSolution/", { "Ref": "SolutionId" }, "/", { "Ref": "SolutionVersion" }, "\"}" ] ] }, "onawsMieKeyArn": { "Fn::GetAtt": [ "MieKey", "Arn" ] }, "onawsMediaInsightsOnAwsPython311Layer": { "Ref": "MediaInsightsOnAwsPython311Layer" }, "onawsMieKey": { "Ref": "MieKey" } }, "TemplateURL": { "Fn::Join": [ "", [ "https://", { "Fn::FindInMap": [ "SourceCode", "General", "GlobalS3Bucket" ] }, ".s3.", { "Ref": "AWS::URLSuffix" }, "/", { "Fn::FindInMap": [ "SourceCode", "General", "TemplateKeyPrefix" ] }, "/media-insights-on-aws-operator-library.template" ] ] } }, "DependsOn": [ "MediaInsightsDataplaneApiStack", "MediaInsightsWorkflowApi" ], "UpdateReplacePolicy": "Delete", "DeletionPolicy": "Delete" }, "TestResources": { "Type": "AWS::CloudFormation::Stack", "Properties": { "Parameters": { "DataplaneEndpoint": { "Fn::GetAtt": [ "MediaInsightsDataplaneApiStack", "Outputs.APIHandlerName" ] }, "DataPlaneBucket": { "Ref": "Dataplane" }, "onawsMediaInsightsOnAwsPython311Layer": { "Ref": "MediaInsightsOnAwsPython311Layer" } }, "TemplateURL": { "Fn::Join": [ "", [ "https://", { "Fn::FindInMap": [ "SourceCode", "General", "GlobalS3Bucket" ] }, ".s3.", { "Ref": "AWS::URLSuffix" }, "/", { "Fn::FindInMap": [ "SourceCode", "General", "TemplateKeyPrefix" ] }, "/media-insights-on-aws-test-operations-stack.template" ] ] } }, "DependsOn": [ "MediaInsightsDataplaneApiStack", "MediaInsightsWorkflowApi", "OperatorLibrary" ], "UpdateReplacePolicy": "Delete", "DeletionPolicy": "Delete", "Condition": "DeployTestResourcesCondition" }, "Application": { "Type": "AWS::ServiceCatalogAppRegistry::Application", "Properties": { "Description": "Service Catalog application to track and manage all your resources for the solution Media Insights on AWS", "Name": { "Fn::Join": [ "-", [ "media-insights-on-aws", { "Ref": "AWS::Region" }, { "Ref": "AWS::AccountId" }, { "Ref": "AWS::StackName" } ] ] }, "Tags": { "Solutions:ApplicationType": "AWS-Solutions", "Solutions:SolutionID": "SO0163", "Solutions:SolutionName": "Media Insights on AWS", "Solutions:SolutionVersion": "v5.1.11" } } }, "AppRegistryApplicationStackAssociation": { "Type": "AWS::ServiceCatalogAppRegistry::ResourceAssociation", "Properties": { "Application": { "Fn::GetAtt": [ "Application", "Id" ] }, "Resource": { "Ref": "AWS::StackId" }, "ResourceType": "CFN_STACK" } }, "AppRegistryApplicationStackAssociationNestedStackDataplane": { "Type": "AWS::ServiceCatalogAppRegistry::ResourceAssociation", "Properties": { "Application": { "Fn::GetAtt": [ "Application", "Id" ] }, "Resource": { "Ref": "MediaInsightsDataplaneApiStack" }, "ResourceType": "CFN_STACK" } }, "AppRegistryApplicationStackAssociationNestedStackAnalytics": { "Type": "AWS::ServiceCatalogAppRegistry::ResourceAssociation", "Properties": { "Application": { "Fn::GetAtt": [ "Application", "Id" ] }, "Resource": { "Ref": "Analytics" }, "ResourceType": "CFN_STACK" }, "Condition": "DeployAnalyticsPipelineCondition" }, "AppRegistryApplicationStackAssociationNestedStackWorkflow": { "Type": "AWS::ServiceCatalogAppRegistry::ResourceAssociation", "Properties": { "Application": { "Fn::GetAtt": [ "Application", "Id" ] }, "Resource": { "Ref": "MediaInsightsWorkflowApi" }, "ResourceType": "CFN_STACK" } }, "AppRegistryApplicationStackAssociationNestedStackOperator": { "Type": "AWS::ServiceCatalogAppRegistry::ResourceAssociation", "Properties": { "Application": { "Fn::GetAtt": [ "Application", "Id" ] }, "Resource": { "Ref": "OperatorLibrary" }, "ResourceType": "CFN_STACK" } }, "AppRegistryApplicationStackAssociationNestedStackTestResources": { "Type": "AWS::ServiceCatalogAppRegistry::ResourceAssociation", "Properties": { "Application": { "Fn::GetAtt": [ "Application", "Id" ] }, "Resource": { "Ref": "TestResources" }, "ResourceType": "CFN_STACK" }, "Condition": "DeployTestResourcesCondition" }, "DefaultApplicationAttributes": { "Type": "AWS::ServiceCatalogAppRegistry::AttributeGroup", "Properties": { "Attributes": { "ApplicationType": "AWS-Solutions", "Version": "v5.1.11", "SolutionID": "SO0163", "SolutionName": "Media Insights on AWS" }, "Description": "Attribute group for solution information", "Name": { "Fn::Join": [ "-", [ { "Ref": "AWS::Region" }, { "Ref": "AWS::StackName" } ] ] } } }, "AppRegistryApplicationAttributeAssociation": { "Type": "AWS::ServiceCatalogAppRegistry::AttributeGroupAssociation", "Properties": { "Application": { "Fn::GetAtt": [ "Application", "Id" ] }, "AttributeGroup": { "Fn::GetAtt": [ "DefaultApplicationAttributes", "Id" ] } } }, "AnonymizedDataUuid": { "Type": "Custom::UUID", "Properties": { "ServiceToken": { "Fn::GetAtt": [ "AnonymizedDataCustomResource", "Arn" ] }, "Resource": "UUID" }, "UpdateReplacePolicy": "Delete", "DeletionPolicy": "Delete", "Condition": "EnableAnonymizedData" }, "AnonymizedMetric": { "Type": "Custom::AnonymizedMetric", "Properties": { "ServiceToken": { "Fn::GetAtt": [ "AnonymizedDataCustomResource", "Arn" ] }, "Resource": "AnonymizedMetric", "SolutionId": "SO0163", "UUID": { "Fn::GetAtt": [ "AnonymizedDataUuid", "UUID" ] }, "Version": { "Fn::FindInMap": [ "SourceCode", "General", "FrameworkVersion" ] } }, "UpdateReplacePolicy": "Delete", "DeletionPolicy": "Delete", "Condition": "EnableAnonymizedData" } }, "Outputs": { "OperatorLibraryStack": { "Description": "Nested cloudformation stack that contains the Media Insights on AWS operator library", "Value": { "Fn::Select": [ 1, { "Fn::Split": [ "/", { "Ref": "OperatorLibrary" } ] } ] }, "Export": { "Name": { "Fn::Join": [ ":", [ { "Ref": "AWS::StackName" }, "OperatorLibraryStack" ] ] } } }, "DataplaneBucket": { "Description": "Bucket used to store transfomred media object from workflow execution", "Value": { "Ref": "Dataplane" }, "Export": { "Name": { "Fn::Join": [ ":", [ { "Ref": "AWS::StackName" }, "DataplaneBucket" ] ] } } }, "DataplaneApiEndpoint": { "Description": "Endpoint for data persistence API", "Value": { "Fn::GetAtt": [ "MediaInsightsDataplaneApiStack", "Outputs.EndpointURL" ] }, "Export": { "Name": { "Fn::Join": [ ":", [ { "Ref": "AWS::StackName" }, "DataplaneApiEndpoint" ] ] } } }, "DataPlaneHandlerArn": { "Description": "API Handler Lambda ARN for dataplane.", "Value": { "Fn::GetAtt": [ "MediaInsightsDataplaneApiStack", "Outputs.APIHandlerArn" ] }, "Export": { "Name": { "Fn::Join": [ ":", [ { "Ref": "AWS::StackName" }, "DataPlaneHandlerArn" ] ] } } }, "DataplaneApiRestID": { "Description": "REST API ID for dataplane API", "Value": { "Fn::GetAtt": [ "MediaInsightsDataplaneApiStack", "Outputs.RestAPIId" ] }, "Export": { "Name": { "Fn::Join": [ ":", [ { "Ref": "AWS::StackName" }, "DataplaneApiId" ] ] } } }, "WorkflowCustomResourceArn": { "Description": "Custom resource for creating operations, stages and workflows using CloudFormation", "Value": { "Fn::GetAtt": [ "MediaInsightsWorkflowApi", "Outputs.WorkflowCustomResourceArn" ] }, "Export": { "Name": { "Fn::Join": [ ":", [ { "Ref": "AWS::StackName" }, "WorkflowCustomResourceArn" ] ] } } }, "WorkflowApiEndpoint": { "Description": "Endpoint for workflow Creation, Execution and Monitoring API", "Value": { "Fn::GetAtt": [ "MediaInsightsWorkflowApi", "Outputs.EndpointURL" ] }, "Export": { "Name": { "Fn::Join": [ ":", [ { "Ref": "AWS::StackName" }, "WorkflowApiEndpoint" ] ] } } }, "WorkflowApiRestID": { "Description": "REST API ID for workflow API", "Value": { "Fn::GetAtt": [ "MediaInsightsWorkflowApi", "Outputs.RestAPIId" ] }, "Export": { "Name": { "Fn::Join": [ ":", [ { "Ref": "AWS::StackName" }, "WorkflowApiId" ] ] } } }, "MediaInsightsOnAwsPython39LayerArn": { "Description": "Lambda layer for Python 3.9 libraries", "Value": { "Ref": "MediaInsightsOnAwsPython39Layer" }, "Export": { "Name": { "Fn::Join": [ ":", [ { "Ref": "AWS::StackName" }, "MediaInsightsOnAwsPython39Layer" ] ] } } }, "MediaInsightsOnAwsPython310LayerArn": { "Description": "Lambda layer for Python 3.10 libraries", "Value": { "Ref": "MediaInsightsOnAwsPython310Layer" }, "Export": { "Name": { "Fn::Join": [ ":", [ { "Ref": "AWS::StackName" }, "MediaInsightsOnAwsPython310Layer" ] ] } } }, "MediaInsightsOnAwsPython311LayerArn": { "Description": "Lambda layer for Python 3.11 libraries", "Value": { "Ref": "MediaInsightsOnAwsPython311Layer" }, "Export": { "Name": { "Fn::Join": [ ":", [ { "Ref": "AWS::StackName" }, "MediaInsightsOnAwsPython311Layer" ] ] } } }, "AnalyticsStreamArn": { "Description": "Arn of the dataplane pipeline", "Value": { "Fn::GetAtt": [ "Analytics", "Outputs.mediainsightsonawsAnalyticsAnalyticsStreamArn" ] }, "Export": { "Name": { "Fn::Join": [ ":", [ { "Ref": "AWS::StackName" }, "AnalyticsStreamArn" ] ] } }, "Condition": "DeployAnalyticsPipelineCondition" }, "TestStack": { "Value": { "Ref": "TestResources" }, "Condition": "DeployTestResourcesCondition" }, "Version": { "Description": "Media Insights on AWS Version", "Value": { "Fn::FindInMap": [ "SourceCode", "General", "FrameworkVersion" ] }, "Export": { "Name": { "Fn::Join": [ ":", [ { "Ref": "AWS::StackName" }, "Version" ] ] } } }, "MieKMSArn": { "Description": "ARN of the Media Insights on AWS KMS Key", "Value": { "Fn::GetAtt": [ "MieKey", "Arn" ] }, "Export": { "Name": { "Fn::Join": [ ":", [ { "Ref": "AWS::StackName" }, "MieKMSArn" ] ] } } }, "MieKMSId": { "Description": "ID of the Media Insights on AWS KMS Key", "Value": { "Ref": "MieKey" }, "Export": { "Name": { "Fn::Join": [ ":", [ { "Ref": "AWS::StackName" }, "MieKMSId" ] ] } } }, "MieKMSAlias": { "Description": "Alias of the Media Insights on AWS KMS Key", "Value": { "Fn::Join": [ "", [ "alias/", { "Ref": "AWS::StackName" } ] ] }, "Export": { "Name": { "Fn::Join": [ ":", [ { "Ref": "AWS::StackName" }, "MieKMSAlias" ] ] } } }, "MieSNSTopic": { "Description": "ARN of the Media Insights on AWS SNS Workflow Execution Topic", "Value": { "Ref": "WorkflowExecutionEventTopic" }, "Export": { "Name": { "Fn::Join": [ ":", [ { "Ref": "AWS::StackName" }, "MieSNSTopic" ] ] } } }, "MieSQSQueue": { "Description": "ARN of the Media Insights on AWS Workflow Execution Queue", "Value": { "Fn::GetAtt": [ "WorkflowExecutionEventQueue", "Arn" ] }, "Export": { "Name": { "Fn::Join": [ ":", [ { "Ref": "AWS::StackName" }, "MieSQSQueue" ] ] } } } } }