{ "Description": "(SO8027) quantum-computing-exploration-for-drug-discovery-on-aws Version 1.1.0", "Metadata": { "AWS::CloudFormation::Interface": { "ParameterGroups": [ { "Label": { "default": "" }, "Parameters": [ "snsEmail" ] } ], "ParameterLabels": { "snsEmail": { "default": "SNS email - Optional" } } }, "cdk_nag": { "rules_to_suppress": [ { "reason": "these policies is used by CDK Customer Resource lambda", "id": "AwsSolutions-IAM4" }, { "reason": "Some roles and policies need to get dynamic resources", "id": "AwsSolutions-IAM5" }, { "reason": "The custom resource runtime version is not latest", "id": "AwsSolutions-L1" }, { "reason": "The latest version is no need to use VPC", "id": "AwsSolutions-SM1" }, { "reason": "The custom resource need to access directly", "id": "AwsSolutions-SM3" } ] } }, "Parameters": { "snsEmail": { "Type": "String", "AllowedPattern": "^(\\w[-\\w.+]*@([A-Za-z0-9][-A-Za-z0-9]+\\.)+[A-Za-z]{2,14})?$", "Description": "Email address for SNS subscription about Braket Hybrid job status change" } }, "Conditions": { "ConditionSnsEmail": { "Fn::Not": [ { "Fn::Equals": [ { "Ref": "snsEmail" }, "" ] } ] }, "CDKMetadataAvailable": { "Fn::Or": [ { "Fn::Or": [ { "Fn::Equals": [ { "Ref": "AWS::Region" }, "af-south-1" ] }, { "Fn::Equals": [ { "Ref": "AWS::Region" }, "ap-east-1" ] }, { "Fn::Equals": [ { "Ref": "AWS::Region" }, "ap-northeast-1" ] }, { "Fn::Equals": [ { "Ref": "AWS::Region" }, "ap-northeast-2" ] }, { "Fn::Equals": [ { "Ref": "AWS::Region" }, "ap-south-1" ] }, { "Fn::Equals": [ { "Ref": "AWS::Region" }, "ap-southeast-1" ] }, { "Fn::Equals": [ { "Ref": "AWS::Region" }, "ap-southeast-2" ] }, { "Fn::Equals": [ { "Ref": "AWS::Region" }, "ca-central-1" ] }, { "Fn::Equals": [ { "Ref": "AWS::Region" }, "cn-north-1" ] }, { "Fn::Equals": [ { "Ref": "AWS::Region" }, "cn-northwest-1" ] } ] }, { "Fn::Or": [ { "Fn::Equals": [ { "Ref": "AWS::Region" }, "eu-central-1" ] }, { "Fn::Equals": [ { "Ref": "AWS::Region" }, "eu-north-1" ] }, { "Fn::Equals": [ { "Ref": "AWS::Region" }, "eu-south-1" ] }, { "Fn::Equals": [ { "Ref": "AWS::Region" }, "eu-west-1" ] }, { "Fn::Equals": [ { "Ref": "AWS::Region" }, "eu-west-2" ] }, { "Fn::Equals": [ { "Ref": "AWS::Region" }, "eu-west-3" ] }, { "Fn::Equals": [ { "Ref": "AWS::Region" }, "me-south-1" ] }, { "Fn::Equals": [ { "Ref": "AWS::Region" }, "sa-east-1" ] }, { "Fn::Equals": [ { "Ref": "AWS::Region" }, "us-east-1" ] }, { "Fn::Equals": [ { "Ref": "AWS::Region" }, "us-east-2" ] } ] }, { "Fn::Or": [ { "Fn::Equals": [ { "Ref": "AWS::Region" }, "us-west-1" ] }, { "Fn::Equals": [ { "Ref": "AWS::Region" }, "us-west-2" ] } ] } ] } }, "Rules": { "SupportedRegionsRule": { "Assertions": [ { "Assert": { "Fn::Contains": [ [ "us-west-1", "us-west-2", "us-east-1", "eu-west-2" ], { "Ref": "AWS::Region" } ] }, "AssertDescription": "supported regions are us-west-1, us-west-2, us-east-1, eu-west-2" } ] } }, "Resources": { "SNSKeyECBE01F8": { "Type": "AWS::KMS::Key", "Properties": { "KeyPolicy": { "Statement": [ { "Action": "kms:*", "Effect": "Allow", "Principal": { "AWS": { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":iam::", { "Ref": "AWS::AccountId" }, ":root" ] ] } }, "Resource": "*" }, { "Action": [ "kms:Decrypt", "kms:GenerateDataKey" ], "Effect": "Allow", "Principal": { "Service": "events.amazonaws.com" }, "Resource": "*" }, { "Action": [ "kms:Decrypt", "kms:GenerateDataKey*", "kms:CreateGrant", "kms:ListGrants", "kms:DescribeKey" ], "Condition": { "StringEquals": { "kms:ViaService": { "Fn::Join": [ "", [ "sns.", { "Ref": "AWS::Region" }, ".amazonaws.com" ] ] }, "kms:CallerAccount": { "Ref": "AWS::AccountId" } } }, "Effect": "Allow", "Principal": { "AWS": "*" }, "Resource": "*" } ], "Version": "2012-10-17" }, "EnableKeyRotation": true }, "UpdateReplacePolicy": "Retain", "DeletionPolicy": "Retain", "Metadata": { "aws:cdk:path": "QCEDDStack/SNSKey/Resource", "cfn_nag": { "rules_to_suppress": [ { "id": "F76", "reason": "Key for SNS, add constraint in conditions" } ] } } }, "SubscriptionsTopicA82535A1": { "Type": "AWS::SNS::Topic", "Properties": { "KmsMasterKeyId": { "Fn::GetAtt": [ "SNSKeyECBE01F8", "Arn" ] } }, "Metadata": { "aws:cdk:path": "QCEDDStack/SubscriptionsTopic/Resource" } }, "eventRuleCB6E2EC3": { "Type": "AWS::Events::Rule", "Properties": { "EventPattern": { "detail": { "status": [ "COMPLETED", "FAILED" ] }, "source": [ "aws.braket" ], "detail-type": [ "Braket Job State Change" ] }, "State": "ENABLED", "Targets": [ { "Arn": { "Fn::GetAtt": [ "checkHybridExperimentStatus01E7AF53", "Arn" ] }, "Id": "Target0" } ] }, "Metadata": { "aws:cdk:path": "QCEDDStack/eventRule/Resource" } }, "eventRuleAllowEventRuleQCEDDStackcheckHybridExperimentStatusE3F6AC178DFD1DCC": { "Type": "AWS::Lambda::Permission", "Properties": { "Action": "lambda:InvokeFunction", "FunctionName": { "Fn::GetAtt": [ "checkHybridExperimentStatus01E7AF53", "Arn" ] }, "Principal": "events.amazonaws.com", "SourceArn": { "Fn::GetAtt": [ "eventRuleCB6E2EC3", "Arn" ] } }, "Metadata": { "aws:cdk:path": "QCEDDStack/eventRule/AllowEventRuleQCEDDStackcheckHybridExperimentStatusE3F6AC17" } }, "emailSubcription": { "Type": "AWS::SNS::Subscription", "Properties": { "Protocol": "email", "TopicArn": { "Ref": "SubscriptionsTopicA82535A1" }, "Endpoint": { "Ref": "snsEmail" } }, "Metadata": { "aws:cdk:path": "QCEDDStack/emailSubcription" }, "Condition": "ConditionSnsEmail" }, "checkHybridExperimentStatusServiceRoleFB218858": { "Type": "AWS::IAM::Role", "Properties": { "AssumeRolePolicyDocument": { "Statement": [ { "Action": "sts:AssumeRole", "Effect": "Allow", "Principal": { "Service": "lambda.amazonaws.com" } } ], "Version": "2012-10-17" }, "ManagedPolicyArns": [ { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":iam::aws:policy/service-role/AWSLambdaBasicExecutionRole" ] ] } ] }, "Metadata": { "aws:cdk:path": "QCEDDStack/checkHybridExperimentStatus/ServiceRole/Resource" } }, "checkHybridExperimentStatusServiceRoleDefaultPolicyF32F48AD": { "Type": "AWS::IAM::Policy", "Properties": { "PolicyDocument": { "Statement": [ { "Action": "sns:Publish", "Effect": "Allow", "Resource": { "Ref": "SubscriptionsTopicA82535A1" } }, { "Action": [ "braket:GetJob", "braket:SearchJobs" ], "Effect": "Allow", "Resource": "*" } ], "Version": "2012-10-17" }, "PolicyName": "checkHybridExperimentStatusServiceRoleDefaultPolicyF32F48AD", "Roles": [ { "Ref": "checkHybridExperimentStatusServiceRoleFB218858" } ] }, "Metadata": { "aws:cdk:path": "QCEDDStack/checkHybridExperimentStatus/ServiceRole/DefaultPolicy/Resource", "cfn_nag": { "rules_to_suppress": [ { "id": "W12", "reason": "some permissions are not resource-level permissions" } ] } } }, "checkHybridExperimentStatus01E7AF53": { "Type": "AWS::Lambda::Function", "Properties": { "Code": { "S3Bucket": { "Fn::Sub": "solutions-${AWS::Region}" }, "S3Key": "quantum-computing-exploration-for-drug-discovery-on-aws/v1.1.0/ce9ba7e9552182ae725256eaf2bf5a5c85b10b05a4a8e9e5cb6af72512c12cc9.zip" }, "Role": { "Fn::GetAtt": [ "checkHybridExperimentStatusServiceRoleFB218858", "Arn" ] }, "Environment": { "Variables": { "topic_arn": { "Ref": "SubscriptionsTopicA82535A1" } } }, "FunctionName": { "Fn::Join": [ "", [ "checkHybridExperimentStatus-", { "Fn::Select": [ 0, { "Fn::Split": [ "-", { "Fn::Select": [ 2, { "Fn::Split": [ "/", { "Ref": "AWS::StackId" } ] } ] } ] } ] } ] ] }, "Handler": "checkHybridExperimentStatus.lambda_handler", "Runtime": "python3.9", "Timeout": 120 }, "DependsOn": [ "checkHybridExperimentStatusServiceRoleDefaultPolicyF32F48AD", "checkHybridExperimentStatusServiceRoleFB218858" ], "Metadata": { "aws:cdk:path": "QCEDDStack/checkHybridExperimentStatus/Resource", "aws:asset:path": "asset.ce9ba7e9552182ae725256eaf2bf5a5c85b10b05a4a8e9e5cb6af72512c12cc9", "aws:asset:is-bundled": false, "aws:asset:property": "Code", "cfn_nag": { "rules_to_suppress": [ { "id": "W89", "reason": "The version to be released does not need to have a VPC" } ] } } }, "accessLogs751B1465": { "Type": "AWS::S3::Bucket", "Properties": { "BucketEncryption": { "ServerSideEncryptionConfiguration": [ { "ServerSideEncryptionByDefault": { "SSEAlgorithm": "AES256" } } ] } }, "UpdateReplacePolicy": "Retain", "DeletionPolicy": "Retain", "Metadata": { "aws:cdk:path": "QCEDDStack/accessLogs/Resource", "cfn_nag": { "rules_to_suppress": [ { "id": "W35", "reason": "This resource does not need to have accessLogs" } ] } } }, "accessLogsPolicy8C9988FF": { "Type": "AWS::S3::BucketPolicy", "Properties": { "Bucket": { "Ref": "accessLogs751B1465" }, "PolicyDocument": { "Statement": [ { "Action": "s3:*", "Condition": { "Bool": { "aws:SecureTransport": "false" } }, "Effect": "Deny", "Principal": { "AWS": "*" }, "Resource": [ { "Fn::GetAtt": [ "accessLogs751B1465", "Arn" ] }, { "Fn::Join": [ "", [ { "Fn::GetAtt": [ "accessLogs751B1465", "Arn" ] }, "/*" ] ] } ] }, { "Action": "s3:PutObject", "Condition": { "ArnLike": { "aws:SourceArn": { "Fn::GetAtt": [ "amazonbraketC6E30921", "Arn" ] } }, "StringEquals": { "aws:SourceAccount": { "Ref": "AWS::AccountId" } } }, "Effect": "Allow", "Principal": { "Service": "logging.s3.amazonaws.com" }, "Resource": { "Fn::Join": [ "", [ { "Fn::GetAtt": [ "accessLogs751B1465", "Arn" ] }, "/accessLogs/*" ] ] } } ], "Version": "2012-10-17" } }, "Metadata": { "aws:cdk:path": "QCEDDStack/accessLogs/Policy/Resource" } }, "amazonbraketC6E30921": { "Type": "AWS::S3::Bucket", "Properties": { "BucketEncryption": { "ServerSideEncryptionConfiguration": [ { "ServerSideEncryptionByDefault": { "SSEAlgorithm": "AES256" } } ] }, "BucketName": { "Fn::Join": [ "", [ "amazon-braket-qc-", { "Fn::Select": [ 0, { "Fn::Split": [ "-", { "Fn::Select": [ 2, { "Fn::Split": [ "/", { "Ref": "AWS::StackId" } ] } ] } ] } ] } ] ] }, "LoggingConfiguration": { "DestinationBucketName": { "Ref": "accessLogs751B1465" }, "LogFilePrefix": "accessLogs/" } }, "UpdateReplacePolicy": "Retain", "DeletionPolicy": "Retain", "Metadata": { "aws:cdk:path": "QCEDDStack/amazon-braket/Resource" } }, "amazonbraketPolicyA997C6D2": { "Type": "AWS::S3::BucketPolicy", "Properties": { "Bucket": { "Ref": "amazonbraketC6E30921" }, "PolicyDocument": { "Statement": [ { "Action": "s3:*", "Condition": { "Bool": { "aws:SecureTransport": "false" } }, "Effect": "Deny", "Principal": { "AWS": "*" }, "Resource": [ { "Fn::GetAtt": [ "amazonbraketC6E30921", "Arn" ] }, { "Fn::Join": [ "", [ { "Fn::GetAtt": [ "amazonbraketC6E30921", "Arn" ] }, "/*" ] ] } ] } ], "Version": "2012-10-17" } }, "Metadata": { "aws:cdk:path": "QCEDDStack/amazon-braket/Policy/Resource" } }, "NotebookNotebookRole192DAF6F": { "Type": "AWS::IAM::Role", "Properties": { "AssumeRolePolicyDocument": { "Statement": [ { "Action": "sts:AssumeRole", "Effect": "Allow", "Principal": { "Service": "sagemaker.amazonaws.com" } } ], "Version": "2012-10-17" }, "ManagedPolicyArns": [ { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":iam::aws:policy/AmazonBraketFullAccess" ] ] } ] }, "DependsOn": [ "amazonbraketPolicyA997C6D2", "amazonbraketC6E30921" ], "Metadata": { "aws:cdk:path": "QCEDDStack/Notebook/NotebookRole/Resource" } }, "NotebookNotebookRoleDefaultPolicy56D3D0E9": { "Type": "AWS::IAM::Policy", "Properties": { "PolicyDocument": { "Statement": [ { "Action": [ "braket:GetJob", "braket:GetQuantumTask", "braket:CancelQuantumTask", "braket:CancelJob", "braket:ListTagsForResource" ], "Effect": "Allow", "Resource": [ { "Fn::Join": [ "", [ "arn:aws:braket:*:", { "Ref": "AWS::AccountId" }, ":quantum-task/*" ] ] }, { "Fn::Join": [ "", [ "arn:aws:braket:*:", { "Ref": "AWS::AccountId" }, ":job/*" ] ] } ] }, { "Action": [ "braket:CancelJob", "braket:CancelQuantumTask", "braket:CreateJob", "braket:CreateQuantumTask", "braket:GetDevice", "braket:GetJob", "braket:GetQuantumTask", "braket:SearchDevices", "braket:SearchJobs", "braket:SearchQuantumTasks", "braket:ListTagsForResource", "braket:TagResource", "braket:UntagResource" ], "Effect": "Allow", "Resource": "*" }, { "Action": [ "s3:PutObject", "s3:GetObject", "s3:ListBucket", "s3:CreateBucket", "s3:PutBucketPublicAccessBlock", "s3:PutBucketPolicy" ], "Effect": "Allow", "Resource": [ "arn:aws:s3:::braket-*/*", "arn:aws:s3:::cdk-*/*", "arn:aws:s3:::amazon-braket-*/*", "arn:aws:s3:::braketnotebookcdk-**" ] }, { "Action": "iam:ListRoles", "Effect": "Allow", "Resource": "arn:aws:iam::*:role/*" }, { "Action": "iam:PassRole", "Effect": "Allow", "Resource": "arn:aws:iam::*:role/service-role/AmazonBraketJobsExecutionRole*" }, { "Action": [ "ecr:UploadLayerPart", "ecr:BatchDeleteImage", "ecr:DeleteRepository", "ecr:CompleteLayerUpload", "ecr:DescribeRepositories", "ecr:BatchCheckLayerAvailability", "ecr:CreateRepository", "ecr:GetDownloadUrlForLayer", "ecr:PutImage", "ecr:BatchGetImage", "ecr:InitiateLayerUpload" ], "Effect": "Allow", "Resource": { "Fn::Join": [ "", [ "arn:aws:ecr:", { "Ref": "AWS::Region" }, ":", { "Ref": "AWS::AccountId" }, ":repository/*" ] ] } }, { "Action": [ "logs:CreateLogStream", "logs:DescribeLogStreams", "logs:PutLogEvents", "logs:CreateLogGroup" ], "Effect": "Allow", "Resource": { "Fn::Join": [ "", [ "arn:aws:logs:*:", { "Ref": "AWS::AccountId" }, ":log-group:/aws/sagemaker/*" ] ] } }, { "Action": [ "s3:GetObject*", "s3:GetBucket*", "s3:List*" ], "Effect": "Allow", "Resource": [ { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":s3:::", { "Fn::Sub": "solutions-${AWS::Region}" } ] ] }, { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":s3:::", { "Fn::Sub": "solutions-${AWS::Region}" }, "/*" ] ] } ] } ], "Version": "2012-10-17" }, "PolicyName": "NotebookNotebookRoleDefaultPolicy56D3D0E9", "Roles": [ { "Ref": "NotebookNotebookRole192DAF6F" } ] }, "DependsOn": [ "amazonbraketPolicyA997C6D2", "amazonbraketC6E30921" ], "Metadata": { "aws:cdk:path": "QCEDDStack/Notebook/NotebookRole/DefaultPolicy/Resource", "cfn_nag": { "rules_to_suppress": [ { "id": "W12", "reason": "some permissions are not resource-level permissions" } ] } } }, "Notebookinstallbraketsdk651BC8FB": { "Type": "AWS::SageMaker::NotebookInstanceLifecycleConfig", "Properties": { "OnStart": [ { "Content": { "Fn::Base64": { "Fn::Join": [ "", [ "#!/usr/bin/env bash\n\nsudo -u ec2-user -i <> .default-setting\ncd ..\n\nconda deactivate\n\nEOS\n\nexit 0\n" ] ] } } } ] }, "DependsOn": [ "amazonbraketPolicyA997C6D2", "amazonbraketC6E30921" ], "Metadata": { "aws:cdk:path": "QCEDDStack/Notebook/install-braket-sdk" } }, "NotebookqcNotebookKeyB1F817BA": { "Type": "AWS::KMS::Key", "Properties": { "KeyPolicy": { "Statement": [ { "Action": "kms:*", "Effect": "Allow", "Principal": { "AWS": { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":iam::", { "Ref": "AWS::AccountId" }, ":root" ] ] } }, "Resource": "*" } ], "Version": "2012-10-17" }, "EnableKeyRotation": true }, "DependsOn": [ "amazonbraketPolicyA997C6D2", "amazonbraketC6E30921" ], "UpdateReplacePolicy": "Retain", "DeletionPolicy": "Retain", "Metadata": { "aws:cdk:path": "QCEDDStack/Notebook/qcNotebookKey/Resource" } }, "Notebook324A0977": { "Type": "AWS::SageMaker::NotebookInstance", "Properties": { "InstanceType": "ml.c5.2xlarge", "RoleArn": { "Fn::GetAtt": [ "NotebookNotebookRole192DAF6F", "Arn" ] }, "DirectInternetAccess": "Enabled", "KmsKeyId": { "Ref": "NotebookqcNotebookKeyB1F817BA" }, "LifecycleConfigName": { "Fn::GetAtt": [ "Notebookinstallbraketsdk651BC8FB", "NotebookInstanceLifecycleConfigName" ] }, "NotebookInstanceName": { "Fn::Join": [ "", [ "amazon-braket-qc-", { "Fn::Select": [ 0, { "Fn::Split": [ "-", { "Fn::Select": [ 2, { "Fn::Split": [ "/", { "Ref": "AWS::StackId" } ] } ] } ] } ] } ] ] }, "RootAccess": "Enabled", "VolumeSizeInGB": 50 }, "DependsOn": [ "amazonbraketPolicyA997C6D2", "amazonbraketC6E30921" ], "Metadata": { "aws:cdk:path": "QCEDDStack/Notebook/Notebook" } }, "CDKMetadata": { "Type": "AWS::CDK::Metadata", "Properties": { "Analytics": "v2:deflate64:H4sIAAAAAAAA/21RQU7DMBB8C3fXUBCoV1qpEgJBlXKvHGcTbR3bkdcuqiL/HdtJgAOnmV3Nzozse7555Hc34otWslGrHms+Hr2Qiu1acxBOaPDg8rCzpkGP1uShCj2wdHQalSY+vsI1bxNERiYtPu2AMq9+yDHUJB0O2SEyuIDxSVd8Zr/IeqHrRvAxR4PTSJTj9sHIJXfhkaHQ6dzO5xkPtkdZekwsVXk4CSJIQc8Z0szHbZAK/FYQsInmg5lN8Ovzd05uogMtFLhS8N16qK1VL4a8MBLesAV5lT2kd2qxY/9IYmQVkA1OAiuF0kN3aIr2I/ghlC6LJDJjG+Bnur2sN3z9lH7pTIgrF4xHDbya8BsjNNHLwQEAAA==" }, "Metadata": { "aws:cdk:path": "QCEDDStack/CDKMetadata/Default" }, "Condition": "CDKMetadataAvailable" } }, "Outputs": { "SNSTopic": { "Description": "SNS Topic Name(quantum-computing-exploration-for-drug-discovery-on-aws)", "Value": { "Fn::GetAtt": [ "SubscriptionsTopicA82535A1", "TopicName" ] } }, "NotebookURL": { "Description": "Notebook URL", "Value": { "Fn::Join": [ "", [ "https://console.aws.amazon.com/sagemaker/home?region=", { "Ref": "AWS::Region" }, "#/notebook-instances/openNotebook/", { "Fn::GetAtt": [ "Notebook324A0977", "NotebookInstanceName" ] }, "?view=classic" ] ] } } } }