{ "Description": "(SO0005) - quota-monitor-for-aws - Hub Template. Version v6.3.12", "AWSTemplateFormatVersion": "2010-09-09", "Metadata": { "AWS::CloudFormation::Interface": { "ParameterGroups": [ { "Label": { "default": "Deployment Configuration" }, "Parameters": [ "DeploymentModel", "RegionsList", "SnsSpokeRegion", "ManagementAccountId" ] }, { "Label": { "default": "Stackset Deployment Options" }, "Parameters": [ "RegionConcurrency", "MaxConcurrentPercentage", "FailureTolerancePercentage" ] }, { "Label": { "default": "Notification Configuration" }, "Parameters": [ "SNSEmail", "SlackNotification" ] }, { "Label": { "default": "Stackset Stack Configuration Parameters" }, "Parameters": [ "SQNotificationThreshold", "SQMonitoringFrequency", "ReportOKNotifications", "SageMakerMonitoring", "ConnectMonitoring" ] } ], "ParameterLabels": { "DeploymentModel": { "default": "Do you want to monitor quotas across Organizational Units, Accounts or both?" }, "SNSEmail": { "default": "Email address for notifications" }, "SlackNotification": { "default": "Do you want slack notifications?" }, "ManagementAccountId": { "default": "Organization's management Id to scope permissions down for Stackset creation" }, "RegionsList": { "default": "List of regions to deploy resources to monitor service quotas" }, "SnsSpokeRegion": { "default": "Region in which to launch the SNS stack in the spoke accounts." }, "RegionConcurrencyType": { "default": "Region Concurrency" }, "MaxConcurrentPercentage": { "default": "Percentage Maximum concurrent accounts" }, "FailureTolerancePercentage": { "default": "Percentage Failure tolerance" }, "SQNotificationThreshold": { "default": "At what quota utilization do you want notifications?" }, "SQMonitoringFrequency": { "default": "Frequency to monitor quota utilization" }, "ReportOKNotifications": { "default": "Report OK Notifications" }, "SageMakerMonitoring": { "default": "Enable monitoring for SageMaker quotas" }, "ConnectMonitoring": { "default": "Enable monitoring for Connect quotas" } } } }, "Parameters": { "SNSEmail": { "Type": "String", "Default": "", "Description": "To disable email notifications, leave this blank." }, "SlackNotification": { "Type": "String", "Default": "No", "AllowedValues": [ "Yes", "No" ] }, "DeploymentModel": { "Type": "String", "Default": "Organizations", "AllowedValues": [ "Organizations", "Hybrid" ] }, "ManagementAccountId": { "Type": "String", "Default": "*", "AllowedPattern": "^([0-9]{1}\\d{11})|\\*$", "Description": "AWS Account Id for the organization's management account or *" }, "RegionsList": { "Type": "String", "Default": "ALL", "Description": "Comma separated list of regions like us-east-1,us-east-2 or ALL or leave it blank for ALL" }, "SnsSpokeRegion": { "Type": "String", "Default": "", "Description": "The region in which to launch the SNS stack in each spoke account. Leave blank if the spoke SNS is not needed" }, "RegionConcurrency": { "Type": "String", "Default": "PARALLEL", "AllowedValues": [ "PARALLEL", "SEQUENTIAL" ], "Description": "Choose to deploy StackSets into regions sequentially or in parallel" }, "MaxConcurrentPercentage": { "Type": "Number", "Default": 100, "Description": "Percentage of accounts per region to which you can deploy stacks at one time. The higher the number, the faster the operation", "MaxValue": 100, "MinValue": 1 }, "FailureTolerancePercentage": { "Type": "Number", "Default": 0, "Description": "Percentage of account, per region, for which stacks can fail before CloudFormation stops the operation in that region. If the operation is stopped in one region, it does not continue in other regions. The lower the number the safer the operation", "MaxValue": 100, "MinValue": 0 }, "SQNotificationThreshold": { "Type": "String", "Default": "80", "AllowedPattern": "^([1-9]|[1-9][0-9])$", "ConstraintDescription": "Threshold must be a whole number between 0 and 100", "Description": "Threshold percentage for quota utilization alerts (0-100)" }, "SQMonitoringFrequency": { "Type": "String", "Default": "rate(12 hours)", "AllowedValues": [ "rate(6 hours)", "rate(12 hours)", "rate(1 day)" ] }, "ReportOKNotifications": { "Type": "String", "Default": "No", "AllowedValues": [ "Yes", "No" ] }, "SageMakerMonitoring": { "Type": "String", "Default": "Yes", "AllowedValues": [ "Yes", "No" ], "Description": "Enable monitoring for SageMaker quotas. NOTE: (1) SageMaker monitoring consumes a high number of quotas, potentially resulting in higher usage cost. (2) Changing this value during a stack update will affect all spoke accounts but if left unchanged, it preserves existing spoke accounts customizations." }, "ConnectMonitoring": { "Type": "String", "Default": "Yes", "AllowedValues": [ "Yes", "No" ], "Description": "Enable monitoring for Connect quotas. NOTE: (1) Connect monitoring consumes a high number of quotas, potentially resulting in higher usage cost. (2) Changing this value during a stack update will affect all spoke accounts but if left unchanged, it preserves existing spoke accounts customizations." } }, "Mappings": { "QuotaMonitorMap": { "Metrics": { "SendAnonymizedData": "Yes", "MetricsEndpoint": "https://metrics.awssolutionsbuilder.com/generic" }, "SSMParameters": { "SlackHook": "/QuotaMonitor/SlackHook", "Accounts": "/QuotaMonitor/Accounts", "OrganizationalUnits": "/QuotaMonitor/OUs", "NotificationMutingConfig": "/QuotaMonitor/NotificationConfiguration", "RegionsList": "/QuotaMonitor/RegionsToDeploy" } } }, "Conditions": { "EmailTrueCondition": { "Fn::Not": [ { "Fn::Equals": [ { "Ref": "SNSEmail" }, "" ] } ] }, "SlackTrueCondition": { "Fn::Equals": [ { "Ref": "SlackNotification" }, "Yes" ] }, "ReportOKNotificationsCondition": { "Fn::Equals": [ { "Ref": "ReportOKNotifications" }, "Yes" ] }, "AccountDeployCondition": { "Fn::Equals": [ { "Ref": "DeploymentModel" }, "Hybrid" ] }, "IsChinaPartition": { "Fn::Equals": [ { "Ref": "AWS::Partition" }, "aws-cn" ] }, "CDKMetadataAvailable": { "Fn::Or": [ { "Fn::Or": [ { "Fn::Equals": [ { "Ref": "AWS::Region" }, "af-south-1" ] }, { "Fn::Equals": [ { "Ref": "AWS::Region" }, "ap-east-1" ] }, { "Fn::Equals": [ { "Ref": "AWS::Region" }, "ap-northeast-1" ] }, { "Fn::Equals": [ { "Ref": "AWS::Region" }, "ap-northeast-2" ] }, { "Fn::Equals": [ { "Ref": "AWS::Region" }, "ap-northeast-3" ] }, { "Fn::Equals": [ { "Ref": "AWS::Region" }, "ap-south-1" ] }, { "Fn::Equals": [ { "Ref": "AWS::Region" }, "ap-south-2" ] }, { "Fn::Equals": [ { "Ref": "AWS::Region" }, "ap-southeast-1" ] }, { "Fn::Equals": [ { "Ref": "AWS::Region" }, "ap-southeast-2" ] }, { "Fn::Equals": [ { "Ref": "AWS::Region" }, "ap-southeast-3" ] } ] }, { "Fn::Or": [ { "Fn::Equals": [ { "Ref": "AWS::Region" }, "ap-southeast-4" ] }, { "Fn::Equals": [ { "Ref": "AWS::Region" }, "ca-central-1" ] }, { "Fn::Equals": [ { "Ref": "AWS::Region" }, "ca-west-1" ] }, { "Fn::Equals": [ { "Ref": "AWS::Region" }, "cn-north-1" ] }, { "Fn::Equals": [ { "Ref": "AWS::Region" }, "cn-northwest-1" ] }, { "Fn::Equals": [ { "Ref": "AWS::Region" }, "eu-central-1" ] }, { "Fn::Equals": [ { "Ref": "AWS::Region" }, "eu-central-2" ] }, { "Fn::Equals": [ { "Ref": "AWS::Region" }, "eu-north-1" ] }, { "Fn::Equals": [ { "Ref": "AWS::Region" }, "eu-south-1" ] }, { "Fn::Equals": [ { "Ref": "AWS::Region" }, "eu-south-2" ] } ] }, { "Fn::Or": [ { "Fn::Equals": [ { "Ref": "AWS::Region" }, "eu-west-1" ] }, { "Fn::Equals": [ { "Ref": "AWS::Region" }, "eu-west-2" ] }, { "Fn::Equals": [ { "Ref": "AWS::Region" }, "eu-west-3" ] }, { "Fn::Equals": [ { "Ref": "AWS::Region" }, "il-central-1" ] }, { "Fn::Equals": [ { "Ref": "AWS::Region" }, "me-central-1" ] }, { "Fn::Equals": [ { "Ref": "AWS::Region" }, "me-south-1" ] }, { "Fn::Equals": [ { "Ref": "AWS::Region" }, "sa-east-1" ] }, { "Fn::Equals": [ { "Ref": "AWS::Region" }, "us-east-1" ] }, { "Fn::Equals": [ { "Ref": "AWS::Region" }, "us-east-2" ] }, { "Fn::Equals": [ { "Ref": "AWS::Region" }, "us-west-1" ] } ] }, { "Fn::Equals": [ { "Ref": "AWS::Region" }, "us-west-2" ] } ] } }, "Resources": { "QMBusFF5C6C0C": { "Type": "AWS::Events::EventBus", "Properties": { "Name": "QuotaMonitorBus" }, "Metadata": { "aws:cdk:path": "quota-monitor-hub/QM-Bus/Resource" } }, "KMSHubQMEncryptionKeyA80F8C05": { "Type": "AWS::KMS::Key", "Properties": { "Description": "CMK for AWS resources provisioned by Quota Monitor in this account", "EnableKeyRotation": true, "Enabled": true, "KeyPolicy": { "Statement": [ { "Action": "kms:*", "Effect": "Allow", "Principal": { "AWS": { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":iam::", { "Ref": "AWS::AccountId" }, ":root" ] ] } }, "Resource": "*" }, { "Action": [ "kms:Decrypt", "kms:Encrypt", "kms:ReEncrypt*", "kms:GenerateDataKey*" ], "Effect": "Allow", "Principal": { "Service": "events.amazonaws.com" }, "Resource": "*" } ], "Version": "2012-10-17" } }, "UpdateReplacePolicy": "Retain", "DeletionPolicy": "Retain", "Metadata": { "aws:cdk:path": "quota-monitor-hub/KMS-Hub/QM-EncryptionKey/Resource" } }, "KMSHubQMEncryptionKeyAlias6C248240": { "Type": "AWS::KMS::Alias", "Properties": { "AliasName": "alias/CMK-KMS-Hub", "TargetKeyId": { "Fn::GetAtt": [ "KMSHubQMEncryptionKeyA80F8C05", "Arn" ] } }, "Metadata": { "aws:cdk:path": "quota-monitor-hub/KMS-Hub/QM-EncryptionKey/Alias/Resource" } }, "QMSlackHook4F1AD495": { "Type": "AWS::SSM::Parameter", "Properties": { "Description": "Slack Hook URL to send Quota Monitor events", "Name": { "Fn::FindInMap": [ "QuotaMonitorMap", "SSMParameters", "SlackHook" ] }, "Type": "String", "Value": "NOP" }, "Metadata": { "aws:cdk:path": "quota-monitor-hub/QM-SlackHook/Resource" }, "Condition": "SlackTrueCondition" }, "QMOUs122D8EB4": { "Type": "AWS::SSM::Parameter", "Properties": { "Description": "List of target Organizational Units", "Name": { "Fn::FindInMap": [ "QuotaMonitorMap", "SSMParameters", "OrganizationalUnits" ] }, "Type": "StringList", "Value": "NOP" }, "Metadata": { "aws:cdk:path": "quota-monitor-hub/QM-OUs/Resource" } }, "QMAccounts3D743F6B": { "Type": "AWS::SSM::Parameter", "Properties": { "Description": "List of target Accounts", "Name": { "Fn::FindInMap": [ "QuotaMonitorMap", "SSMParameters", "Accounts" ] }, "Type": "StringList", "Value": "NOP" }, "Metadata": { "aws:cdk:path": "quota-monitor-hub/QM-Accounts/Resource" }, "Condition": "AccountDeployCondition" }, "QMNotificationMutingConfig3B7948BA": { "Type": "AWS::SSM::Parameter", "Properties": { "Description": "Muting configuration for services, limits e.g. ec2:L-1216C47A,ec2:Running On-Demand Standard (A, C, D, H, I, M, R, T, Z) instances,dynamodb,logs:*,geo:L-05EFD12D", "Name": { "Fn::FindInMap": [ "QuotaMonitorMap", "SSMParameters", "NotificationMutingConfig" ] }, "Type": "StringList", "Value": "NOP" }, "Metadata": { "aws:cdk:path": "quota-monitor-hub/QM-NotificationMutingConfig/Resource" } }, "QMRegionsList17794003": { "Type": "AWS::SSM::Parameter", "Properties": { "Description": "list of regions to deploy spoke resources (eg. us-east-1,us-west-2)", "Name": { "Fn::FindInMap": [ "QuotaMonitorMap", "SSMParameters", "RegionsList" ] }, "Type": "StringList", "Value": { "Ref": "RegionsList" } }, "Metadata": { "aws:cdk:path": "quota-monitor-hub/QM-RegionsList/Resource" } }, "QMUtilsLayerQMUtilsLayerLayer80D5D993": { "Type": "AWS::Lambda::LayerVersion", "Properties": { "CompatibleRuntimes": [ "nodejs24.x" ], "Content": { "S3Bucket": { "Fn::Sub": "solutions-${AWS::Region}" }, "S3Key": "quota-monitor-for-aws/v6.3.12/assetf6d5c2680d83968bf87c1f718a7cfbbcdc2e873a467dbf89f7c96750a7fd677a.zip" }, "LayerName": "QM-UtilsLayer" }, "Metadata": { "aws:cdk:path": "quota-monitor-hub/QM-UtilsLayer/QM-UtilsLayer-Layer/Resource", "aws:asset:path": "asset.f6d5c2680d83968bf87c1f718a7cfbbcdc2e873a467dbf89f7c96750a7fd677a.zip", "aws:asset:is-bundled": false, "aws:asset:property": "Content" } }, "QMHelperQMHelperFunctionServiceRole0506622D": { "Type": "AWS::IAM::Role", "Properties": { "AssumeRolePolicyDocument": { "Statement": [ { "Action": "sts:AssumeRole", "Effect": "Allow", "Principal": { "Service": "lambda.amazonaws.com" } } ], "Version": "2012-10-17" }, "ManagedPolicyArns": [ { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":iam::aws:policy/service-role/AWSLambdaBasicExecutionRole" ] ] } ] }, "Metadata": { "aws:cdk:path": "quota-monitor-hub/QM-Helper/QM-Helper-Function/ServiceRole/Resource", "cdk_nag": { "rules_to_suppress": [ { "reason": "AWSLambdaBasicExecutionRole added by cdk only gives write permissions for CW logs", "id": "AwsSolutions-IAM4" }, { "reason": "Actions restricted on kms key ARN. Only actions that do not support resource-level permissions have * in resource", "id": "AwsSolutions-IAM5" }, { "reason": "GovCloud regions support only up to nodejs 16, risk is tolerable", "id": "AwsSolutions-L1" } ] } } }, "QMHelperQMHelperFunction91954E97": { "Type": "AWS::Lambda::Function", "Properties": { "Code": { "S3Bucket": { "Fn::Sub": "solutions-${AWS::Region}" }, "S3Key": "quota-monitor-for-aws/v6.3.12/assetf4a71cf5f6eb6a013d81ac5b06f1b70ae1466891491df5f8f5467ef69aae793b.zip" }, "Description": "SO0005 quota-monitor-for-aws - QM-Helper-Function", "Environment": { "Variables": { "METRICS_ENDPOINT": { "Fn::FindInMap": [ "QuotaMonitorMap", "Metrics", "MetricsEndpoint" ] }, "SEND_METRIC": { "Fn::FindInMap": [ "QuotaMonitorMap", "Metrics", "SendAnonymizedData" ] }, "QM_STACK_ID": "quota-monitor-hub", "QM_SLACK_NOTIFICATION": { "Ref": "SlackNotification" }, "QM_EMAIL_NOTIFICATION": { "Fn::If": [ "EmailTrueCondition", "Yes", "No" ] }, "SAGEMAKER_MONITORING": { "Ref": "SageMakerMonitoring" }, "CONNECT_MONITORING": { "Ref": "ConnectMonitoring" }, "LOG_LEVEL": "info", "CUSTOM_SDK_USER_AGENT": "AwsSolution/SO0005/v6.3.12", "VERSION": "v6.3.12", "SOLUTION_ID": "SO0005" } }, "Handler": "index.handler", "Layers": [ { "Ref": "QMUtilsLayerQMUtilsLayerLayer80D5D993" } ], "MemorySize": 128, "Role": { "Fn::GetAtt": [ "QMHelperQMHelperFunctionServiceRole0506622D", "Arn" ] }, "Runtime": "nodejs24.x", "Timeout": 5 }, "DependsOn": [ "QMHelperQMHelperFunctionServiceRole0506622D" ], "Metadata": { "aws:cdk:path": "quota-monitor-hub/QM-Helper/QM-Helper-Function/Resource", "aws:asset:path": "asset.f4a71cf5f6eb6a013d81ac5b06f1b70ae1466891491df5f8f5467ef69aae793b.zip", "aws:asset:is-bundled": false, "aws:asset:property": "Code", "cdk_nag": { "rules_to_suppress": [ { "reason": "GovCloud regions support only up to nodejs 16, risk is tolerable", "id": "AwsSolutions-L1" } ] }, "guard": { "SuppressedRules": [ "LAMBDA_INSIDE_VPC", "LAMBDA_CONCURRENCY_CHECK", "LAMBDA_INSIDE_VPC", "LAMBDA_CONCURRENCY_CHECK" ] } } }, "QMHelperQMHelperFunctionEventInvokeConfig580F9F5F": { "Type": "AWS::Lambda::EventInvokeConfig", "Properties": { "FunctionName": { "Ref": "QMHelperQMHelperFunction91954E97" }, "MaximumEventAgeInSeconds": 14400, "Qualifier": "$LATEST" }, "Metadata": { "aws:cdk:path": "quota-monitor-hub/QM-Helper/QM-Helper-Function/EventInvokeConfig/Resource", "cdk_nag": { "rules_to_suppress": [ { "reason": "GovCloud regions support only up to nodejs 16, risk is tolerable", "id": "AwsSolutions-L1" } ] } } }, "QMHelperQMHelperProviderframeworkonEventServiceRole4A1EBBAB": { "Type": "AWS::IAM::Role", "Properties": { "AssumeRolePolicyDocument": { "Statement": [ { "Action": "sts:AssumeRole", "Effect": "Allow", "Principal": { "Service": "lambda.amazonaws.com" } } ], "Version": "2012-10-17" }, "ManagedPolicyArns": [ { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":iam::aws:policy/service-role/AWSLambdaBasicExecutionRole" ] ] } ] }, "Metadata": { "aws:cdk:path": "quota-monitor-hub/QM-Helper/QM-Helper-Provider/framework-onEvent/ServiceRole/Resource", "cdk_nag": { "rules_to_suppress": [ { "reason": "AWSLambdaBasicExecutionRole added by cdk only gives write permissions for CW logs", "id": "AwsSolutions-IAM4" }, { "reason": "IAM policy is appropriated scoped, ARN is provided in policy resource, false warning", "id": "AwsSolutions-IAM5" }, { "reason": "Lambda function created by Provider L2 construct uses nodejs 14, risk is tolerable", "id": "AwsSolutions-L1" } ] } } }, "QMHelperQMHelperProviderframeworkonEventServiceRoleDefaultPolicy86C1FCC1": { "Type": "AWS::IAM::Policy", "Properties": { "PolicyDocument": { "Statement": [ { "Action": "lambda:InvokeFunction", "Effect": "Allow", "Resource": [ { "Fn::GetAtt": [ "QMHelperQMHelperFunction91954E97", "Arn" ] }, { "Fn::Join": [ "", [ { "Fn::GetAtt": [ "QMHelperQMHelperFunction91954E97", "Arn" ] }, ":*" ] ] } ] }, { "Action": "lambda:GetFunction", "Effect": "Allow", "Resource": { "Fn::GetAtt": [ "QMHelperQMHelperFunction91954E97", "Arn" ] } } ], "Version": "2012-10-17" }, "PolicyName": "QMHelperQMHelperProviderframeworkonEventServiceRoleDefaultPolicy86C1FCC1", "Roles": [ { "Ref": "QMHelperQMHelperProviderframeworkonEventServiceRole4A1EBBAB" } ] }, "Metadata": { "aws:cdk:path": "quota-monitor-hub/QM-Helper/QM-Helper-Provider/framework-onEvent/ServiceRole/DefaultPolicy/Resource", "cdk_nag": { "rules_to_suppress": [ { "reason": "AWSLambdaBasicExecutionRole added by cdk only gives write permissions for CW logs", "id": "AwsSolutions-IAM4" }, { "reason": "IAM policy is appropriated scoped, ARN is provided in policy resource, false warning", "id": "AwsSolutions-IAM5" }, { "reason": "Lambda function created by Provider L2 construct uses nodejs 14, risk is tolerable", "id": "AwsSolutions-L1" } ] } } }, "QMHelperQMHelperProviderframeworkonEventB1DF6D3F": { "Type": "AWS::Lambda::Function", "Properties": { "Code": { "S3Bucket": { "Fn::Sub": "solutions-${AWS::Region}" }, "S3Key": "quota-monitor-for-aws/v6.3.12/asset07a90cc3efdfc34da22208dcd9d211f06f5b0e01b21e778edc7c3966b1f61d57.zip" }, "Description": "AWS CDK resource provider framework - onEvent (quota-monitor-hub/QM-Helper/QM-Helper-Provider)", "Environment": { "Variables": { "USER_ON_EVENT_FUNCTION_ARN": { "Fn::GetAtt": [ "QMHelperQMHelperFunction91954E97", "Arn" ] } } }, "Handler": "framework.onEvent", "LoggingConfig": { "ApplicationLogLevel": "FATAL", "LogFormat": "JSON" }, "Role": { "Fn::GetAtt": [ "QMHelperQMHelperProviderframeworkonEventServiceRole4A1EBBAB", "Arn" ] }, "Runtime": "nodejs22.x", "Timeout": 900 }, "DependsOn": [ "QMHelperQMHelperProviderframeworkonEventServiceRoleDefaultPolicy86C1FCC1", "QMHelperQMHelperProviderframeworkonEventServiceRole4A1EBBAB" ], "Metadata": { "aws:cdk:path": "quota-monitor-hub/QM-Helper/QM-Helper-Provider/framework-onEvent/Resource", "aws:asset:path": "asset.07a90cc3efdfc34da22208dcd9d211f06f5b0e01b21e778edc7c3966b1f61d57", "aws:asset:is-bundled": false, "aws:asset:property": "Code", "cdk_nag": { "rules_to_suppress": [ { "reason": "AWSLambdaBasicExecutionRole added by cdk only gives write permissions for CW logs", "id": "AwsSolutions-IAM4" }, { "reason": "IAM policy is appropriated scoped, ARN is provided in policy resource, false warning", "id": "AwsSolutions-IAM5" }, { "reason": "Lambda function created by Provider L2 construct uses nodejs 14, risk is tolerable", "id": "AwsSolutions-L1" } ] }, "guard": { "SuppressedRules": [ "LAMBDA_INSIDE_VPC", "LAMBDA_CONCURRENCY_CHECK" ] } } }, "QMHelperCreateUUIDE0D423E6": { "Type": "Custom::CreateUUID", "Properties": { "ServiceToken": { "Fn::GetAtt": [ "QMHelperQMHelperProviderframeworkonEventB1DF6D3F", "Arn" ] } }, "UpdateReplacePolicy": "Delete", "DeletionPolicy": "Delete", "Metadata": { "aws:cdk:path": "quota-monitor-hub/QM-Helper/CreateUUID/Default" } }, "QMHelperLaunchData6F23B2C3": { "Type": "Custom::LaunchData", "Properties": { "ServiceToken": { "Fn::GetAtt": [ "QMHelperQMHelperProviderframeworkonEventB1DF6D3F", "Arn" ] }, "SOLUTION_UUID": { "Fn::GetAtt": [ "QMHelperCreateUUIDE0D423E6", "UUID" ] } }, "UpdateReplacePolicy": "Delete", "DeletionPolicy": "Delete", "Metadata": { "aws:cdk:path": "quota-monitor-hub/QM-Helper/LaunchData/Default" } }, "QMSlackNotifierQMSlackNotifierEventsRuleC3528E53": { "Type": "AWS::Events::Rule", "Properties": { "Description": "SO0005 quota-monitor-for-aws - QM-SlackNotifier-EventsRule", "EventBusName": { "Ref": "QMBusFF5C6C0C" }, "EventPattern": { "detail": { "status": [ "WARN", "ERROR" ] }, "detail-type": [ "Trusted Advisor Check Item Refresh Notification", "Service Quotas Utilization Notification" ], "source": [ "aws.trustedadvisor", "aws-solutions.quota-monitor" ] }, "State": "ENABLED", "Targets": [ { "Arn": { "Fn::GetAtt": [ "QMSlackNotifierQMSlackNotifierLambda95713661", "Arn" ] }, "Id": "Target0" } ] }, "Metadata": { "aws:cdk:path": "quota-monitor-hub/QM-SlackNotifier/QM-SlackNotifier-EventsRule/Resource" }, "Condition": "SlackTrueCondition" }, "QMSlackNotifierQMSlackNotifierEventsRuleAllowEventRulequotamonitorhubQMSlackNotifierQMSlackNotifierLambdaA984BF97821BEA4A": { "Type": "AWS::Lambda::Permission", "Properties": { "Action": "lambda:InvokeFunction", "FunctionName": { "Fn::GetAtt": [ "QMSlackNotifierQMSlackNotifierLambda95713661", "Arn" ] }, "Principal": "events.amazonaws.com", "SourceArn": { "Fn::GetAtt": [ "QMSlackNotifierQMSlackNotifierEventsRuleC3528E53", "Arn" ] } }, "Metadata": { "aws:cdk:path": "quota-monitor-hub/QM-SlackNotifier/QM-SlackNotifier-EventsRule/AllowEventRulequotamonitorhubQMSlackNotifierQMSlackNotifierLambdaA984BF97" }, "Condition": "SlackTrueCondition" }, "QMSlackNotifierQMSlackNotifierLambdaDeadLetterQueue74B865F7": { "Type": "AWS::SQS::Queue", "Properties": { "KmsMasterKeyId": { "Fn::GetAtt": [ "KMSHubQMEncryptionKeyA80F8C05", "Arn" ] } }, "UpdateReplacePolicy": "Delete", "DeletionPolicy": "Delete", "Metadata": { "aws:cdk:path": "quota-monitor-hub/QM-SlackNotifier/QM-SlackNotifier-Lambda-Dead-Letter-Queue/Resource", "cdk_nag": { "rules_to_suppress": [ { "reason": "Queue itself is dead-letter queue", "id": "AwsSolutions-SQS3" } ] } }, "Condition": "SlackTrueCondition" }, "QMSlackNotifierQMSlackNotifierLambdaDeadLetterQueuePolicy719E4C6A": { "Type": "AWS::SQS::QueuePolicy", "Properties": { "PolicyDocument": { "Statement": [ { "Action": "sqs:*", "Condition": { "Bool": { "aws:SecureTransport": "false" } }, "Effect": "Deny", "Principal": { "AWS": "*" }, "Resource": { "Fn::GetAtt": [ "QMSlackNotifierQMSlackNotifierLambdaDeadLetterQueue74B865F7", "Arn" ] } } ], "Version": "2012-10-17" }, "Queues": [ { "Ref": "QMSlackNotifierQMSlackNotifierLambdaDeadLetterQueue74B865F7" } ] }, "Metadata": { "aws:cdk:path": "quota-monitor-hub/QM-SlackNotifier/QM-SlackNotifier-Lambda-Dead-Letter-Queue/Policy/Resource" }, "Condition": "SlackTrueCondition" }, "QMSlackNotifierQMSlackNotifierLambdaServiceRole6342FD1D": { "Type": "AWS::IAM::Role", "Properties": { "AssumeRolePolicyDocument": { "Statement": [ { "Action": "sts:AssumeRole", "Effect": "Allow", "Principal": { "Service": "lambda.amazonaws.com" } } ], "Version": "2012-10-17" }, "ManagedPolicyArns": [ { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":iam::aws:policy/service-role/AWSLambdaBasicExecutionRole" ] ] } ] }, "Metadata": { "aws:cdk:path": "quota-monitor-hub/QM-SlackNotifier/QM-SlackNotifier-Lambda/ServiceRole/Resource", "cdk_nag": { "rules_to_suppress": [ { "reason": "AWSLambdaBasicExecutionRole added by cdk only gives write permissions for CW logs", "id": "AwsSolutions-IAM4" }, { "reason": "Actions restricted on kms key ARN. Only actions that do not support resource-level permissions have * in resource", "id": "AwsSolutions-IAM5" }, { "reason": "GovCloud regions support only up to nodejs 16, risk is tolerable", "id": "AwsSolutions-L1" } ] } }, "Condition": "SlackTrueCondition" }, "QMSlackNotifierQMSlackNotifierLambdaServiceRoleDefaultPolicy4C4D219B": { "Type": "AWS::IAM::Policy", "Properties": { "PolicyDocument": { "Statement": [ { "Action": "sqs:SendMessage", "Effect": "Allow", "Resource": { "Fn::GetAtt": [ "QMSlackNotifierQMSlackNotifierLambdaDeadLetterQueue74B865F7", "Arn" ] } }, { "Action": [ "kms:Encrypt", "kms:Decrypt", "kms:CreateGrant" ], "Effect": "Allow", "Resource": { "Fn::GetAtt": [ "KMSHubQMEncryptionKeyA80F8C05", "Arn" ] } }, { "Action": "kms:ListAliases", "Effect": "Allow", "Resource": "*" }, { "Action": "ssm:GetParameter", "Effect": "Allow", "Resource": [ { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":ssm:", { "Ref": "AWS::Region" }, ":", { "Ref": "AWS::AccountId" }, ":parameter", { "Ref": "QMSlackHook4F1AD495" } ] ] }, { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":ssm:", { "Ref": "AWS::Region" }, ":", { "Ref": "AWS::AccountId" }, ":parameter", { "Ref": "QMNotificationMutingConfig3B7948BA" } ] ] } ] } ], "Version": "2012-10-17" }, "PolicyName": "QMSlackNotifierQMSlackNotifierLambdaServiceRoleDefaultPolicy4C4D219B", "Roles": [ { "Ref": "QMSlackNotifierQMSlackNotifierLambdaServiceRole6342FD1D" } ] }, "Metadata": { "aws:cdk:path": "quota-monitor-hub/QM-SlackNotifier/QM-SlackNotifier-Lambda/ServiceRole/DefaultPolicy/Resource", "cdk_nag": { "rules_to_suppress": [ { "reason": "AWSLambdaBasicExecutionRole added by cdk only gives write permissions for CW logs", "id": "AwsSolutions-IAM4" }, { "reason": "Actions restricted on kms key ARN. Only actions that do not support resource-level permissions have * in resource", "id": "AwsSolutions-IAM5" }, { "reason": "GovCloud regions support only up to nodejs 16, risk is tolerable", "id": "AwsSolutions-L1" } ] } }, "Condition": "SlackTrueCondition" }, "QMSlackNotifierQMSlackNotifierLambda95713661": { "Type": "AWS::Lambda::Function", "Properties": { "Code": { "S3Bucket": { "Fn::Sub": "solutions-${AWS::Region}" }, "S3Key": "quota-monitor-for-aws/v6.3.12/assetdb14c4d763c7d4c55f6f616e349ffc9404c2adca62e782049cc14f47030a0c1a.zip" }, "DeadLetterConfig": { "TargetArn": { "Fn::GetAtt": [ "QMSlackNotifierQMSlackNotifierLambdaDeadLetterQueue74B865F7", "Arn" ] } }, "Description": "SO0005 quota-monitor-for-aws - QM-SlackNotifier-Lambda", "Environment": { "Variables": { "SLACK_HOOK": { "Fn::FindInMap": [ "QuotaMonitorMap", "SSMParameters", "SlackHook" ] }, "QM_NOTIFICATION_MUTING_CONFIG_PARAMETER": { "Ref": "QMNotificationMutingConfig3B7948BA" }, "LOG_LEVEL": "info", "CUSTOM_SDK_USER_AGENT": "AwsSolution/SO0005/v6.3.12", "VERSION": "v6.3.12", "SOLUTION_ID": "SO0005" } }, "Handler": "index.handler", "KmsKeyArn": { "Fn::GetAtt": [ "KMSHubQMEncryptionKeyA80F8C05", "Arn" ] }, "Layers": [ { "Ref": "QMUtilsLayerQMUtilsLayerLayer80D5D993" } ], "MemorySize": 128, "Role": { "Fn::GetAtt": [ "QMSlackNotifierQMSlackNotifierLambdaServiceRole6342FD1D", "Arn" ] }, "Runtime": "nodejs24.x", "Timeout": 60 }, "DependsOn": [ "QMSlackNotifierQMSlackNotifierLambdaServiceRoleDefaultPolicy4C4D219B", "QMSlackNotifierQMSlackNotifierLambdaServiceRole6342FD1D" ], "Metadata": { "aws:cdk:path": "quota-monitor-hub/QM-SlackNotifier/QM-SlackNotifier-Lambda/Resource", "aws:asset:path": "asset.db14c4d763c7d4c55f6f616e349ffc9404c2adca62e782049cc14f47030a0c1a.zip", "aws:asset:is-bundled": false, "aws:asset:property": "Code", "cdk_nag": { "rules_to_suppress": [ { "reason": "GovCloud regions support only up to nodejs 16, risk is tolerable", "id": "AwsSolutions-L1" } ] }, "guard": { "SuppressedRules": [ "LAMBDA_INSIDE_VPC", "LAMBDA_CONCURRENCY_CHECK" ] } }, "Condition": "SlackTrueCondition" }, "QMSlackNotifierQMSlackNotifierLambdaEventInvokeConfig5340A982": { "Type": "AWS::Lambda::EventInvokeConfig", "Properties": { "FunctionName": { "Ref": "QMSlackNotifierQMSlackNotifierLambda95713661" }, "MaximumEventAgeInSeconds": 14400, "Qualifier": "$LATEST" }, "Metadata": { "aws:cdk:path": "quota-monitor-hub/QM-SlackNotifier/QM-SlackNotifier-Lambda/EventInvokeConfig/Resource", "cdk_nag": { "rules_to_suppress": [ { "reason": "GovCloud regions support only up to nodejs 16, risk is tolerable", "id": "AwsSolutions-L1" } ] } }, "Condition": "SlackTrueCondition" }, "QMSNSPublisherQMSNSPublisherSNSTopic7EE2EBF4": { "Type": "AWS::SNS::Topic", "Properties": { "KmsMasterKeyId": { "Fn::GetAtt": [ "KMSHubQMEncryptionKeyA80F8C05", "Arn" ] } }, "Metadata": { "aws:cdk:path": "quota-monitor-hub/QM-SNSPublisher/QM-SNSPublisher-SNSTopic/Resource" } }, "QMSNSPublisherFunctionQMSNSPublisherFunctionEventsRule5BDCD4FD": { "Type": "AWS::Events::Rule", "Properties": { "Description": "SO0005 quota-monitor-for-aws - QM-SNSPublisherFunction-EventsRule", "EventBusName": { "Ref": "QMBusFF5C6C0C" }, "EventPattern": { "detail": { "status": [ "WARN", "ERROR" ] }, "detail-type": [ "Trusted Advisor Check Item Refresh Notification", "Service Quotas Utilization Notification" ], "source": [ "aws.trustedadvisor", "aws-solutions.quota-monitor" ] }, "State": "ENABLED", "Targets": [ { "Arn": { "Fn::GetAtt": [ "QMSNSPublisherFunctionQMSNSPublisherFunctionLambda8BD2DBC1", "Arn" ] }, "Id": "Target0" } ] }, "Metadata": { "aws:cdk:path": "quota-monitor-hub/QM-SNSPublisherFunction/QM-SNSPublisherFunction-EventsRule/Resource" } }, "QMSNSPublisherFunctionQMSNSPublisherFunctionEventsRuleAllowEventRulequotamonitorhubQMSNSPublisherFunctionQMSNSPublisherFunctionLambda63811E436D38C90C": { "Type": "AWS::Lambda::Permission", "Properties": { "Action": "lambda:InvokeFunction", "FunctionName": { "Fn::GetAtt": [ "QMSNSPublisherFunctionQMSNSPublisherFunctionLambda8BD2DBC1", "Arn" ] }, "Principal": "events.amazonaws.com", "SourceArn": { "Fn::GetAtt": [ "QMSNSPublisherFunctionQMSNSPublisherFunctionEventsRule5BDCD4FD", "Arn" ] } }, "Metadata": { "aws:cdk:path": "quota-monitor-hub/QM-SNSPublisherFunction/QM-SNSPublisherFunction-EventsRule/AllowEventRulequotamonitorhubQMSNSPublisherFunctionQMSNSPublisherFunctionLambda63811E43" } }, "QMSNSPublisherFunctionQMSNSPublisherFunctionLambdaDeadLetterQueue72FF519A": { "Type": "AWS::SQS::Queue", "Properties": { "KmsMasterKeyId": { "Fn::GetAtt": [ "KMSHubQMEncryptionKeyA80F8C05", "Arn" ] } }, "UpdateReplacePolicy": "Delete", "DeletionPolicy": "Delete", "Metadata": { "aws:cdk:path": "quota-monitor-hub/QM-SNSPublisherFunction/QM-SNSPublisherFunction-Lambda-Dead-Letter-Queue/Resource", "cdk_nag": { "rules_to_suppress": [ { "reason": "Queue itself is dead-letter queue", "id": "AwsSolutions-SQS3" } ] } } }, "QMSNSPublisherFunctionQMSNSPublisherFunctionLambdaDeadLetterQueuePolicyBA6A8707": { "Type": "AWS::SQS::QueuePolicy", "Properties": { "PolicyDocument": { "Statement": [ { "Action": "sqs:*", "Condition": { "Bool": { "aws:SecureTransport": "false" } }, "Effect": "Deny", "Principal": { "AWS": "*" }, "Resource": { "Fn::GetAtt": [ "QMSNSPublisherFunctionQMSNSPublisherFunctionLambdaDeadLetterQueue72FF519A", "Arn" ] } } ], "Version": "2012-10-17" }, "Queues": [ { "Ref": "QMSNSPublisherFunctionQMSNSPublisherFunctionLambdaDeadLetterQueue72FF519A" } ] }, "Metadata": { "aws:cdk:path": "quota-monitor-hub/QM-SNSPublisherFunction/QM-SNSPublisherFunction-Lambda-Dead-Letter-Queue/Policy/Resource" } }, "QMSNSPublisherFunctionQMSNSPublisherFunctionLambdaServiceRoleA2F00B10": { "Type": "AWS::IAM::Role", "Properties": { "AssumeRolePolicyDocument": { "Statement": [ { "Action": "sts:AssumeRole", "Effect": "Allow", "Principal": { "Service": "lambda.amazonaws.com" } } ], "Version": "2012-10-17" }, "ManagedPolicyArns": [ { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":iam::aws:policy/service-role/AWSLambdaBasicExecutionRole" ] ] } ] }, "Metadata": { "aws:cdk:path": "quota-monitor-hub/QM-SNSPublisherFunction/QM-SNSPublisherFunction-Lambda/ServiceRole/Resource", "cdk_nag": { "rules_to_suppress": [ { "reason": "AWSLambdaBasicExecutionRole added by cdk only gives write permissions for CW logs", "id": "AwsSolutions-IAM4" }, { "reason": "Actions restricted on kms key ARN. Only actions that do not support resource-level permissions have * in resource", "id": "AwsSolutions-IAM5" }, { "reason": "GovCloud regions support only up to nodejs 16, risk is tolerable", "id": "AwsSolutions-L1" } ] } } }, "QMSNSPublisherFunctionQMSNSPublisherFunctionLambdaServiceRoleDefaultPolicy1E6E152C": { "Type": "AWS::IAM::Policy", "Properties": { "PolicyDocument": { "Statement": [ { "Action": "sqs:SendMessage", "Effect": "Allow", "Resource": { "Fn::GetAtt": [ "QMSNSPublisherFunctionQMSNSPublisherFunctionLambdaDeadLetterQueue72FF519A", "Arn" ] } }, { "Action": [ "kms:Encrypt", "kms:Decrypt", "kms:CreateGrant" ], "Effect": "Allow", "Resource": { "Fn::GetAtt": [ "KMSHubQMEncryptionKeyA80F8C05", "Arn" ] } }, { "Action": "kms:ListAliases", "Effect": "Allow", "Resource": "*" }, { "Action": "SNS:Publish", "Effect": "Allow", "Resource": { "Ref": "QMSNSPublisherQMSNSPublisherSNSTopic7EE2EBF4" } }, { "Action": "kms:GenerateDataKey", "Effect": "Allow", "Resource": { "Fn::GetAtt": [ "KMSHubQMEncryptionKeyA80F8C05", "Arn" ] } }, { "Action": "ssm:GetParameter", "Effect": "Allow", "Resource": { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":ssm:", { "Ref": "AWS::Region" }, ":", { "Ref": "AWS::AccountId" }, ":parameter", { "Ref": "QMNotificationMutingConfig3B7948BA" } ] ] } } ], "Version": "2012-10-17" }, "PolicyName": "QMSNSPublisherFunctionQMSNSPublisherFunctionLambdaServiceRoleDefaultPolicy1E6E152C", "Roles": [ { "Ref": "QMSNSPublisherFunctionQMSNSPublisherFunctionLambdaServiceRoleA2F00B10" } ] }, "Metadata": { "aws:cdk:path": "quota-monitor-hub/QM-SNSPublisherFunction/QM-SNSPublisherFunction-Lambda/ServiceRole/DefaultPolicy/Resource", "cdk_nag": { "rules_to_suppress": [ { "reason": "AWSLambdaBasicExecutionRole added by cdk only gives write permissions for CW logs", "id": "AwsSolutions-IAM4" }, { "reason": "Actions restricted on kms key ARN. Only actions that do not support resource-level permissions have * in resource", "id": "AwsSolutions-IAM5" }, { "reason": "GovCloud regions support only up to nodejs 16, risk is tolerable", "id": "AwsSolutions-L1" } ] } } }, "QMSNSPublisherFunctionQMSNSPublisherFunctionLambda8BD2DBC1": { "Type": "AWS::Lambda::Function", "Properties": { "Code": { "S3Bucket": { "Fn::Sub": "solutions-${AWS::Region}" }, "S3Key": "quota-monitor-for-aws/v6.3.12/assetd4299c95f6e090811d3222e76b330a86b52fbc19298d3ac0da26ae0746fd2624.zip" }, "DeadLetterConfig": { "TargetArn": { "Fn::GetAtt": [ "QMSNSPublisherFunctionQMSNSPublisherFunctionLambdaDeadLetterQueue72FF519A", "Arn" ] } }, "Description": "SO0005 quota-monitor-for-aws - QM-SNSPublisherFunction-Lambda", "Environment": { "Variables": { "QM_NOTIFICATION_MUTING_CONFIG_PARAMETER": { "Ref": "QMNotificationMutingConfig3B7948BA" }, "SOLUTION_UUID": { "Fn::GetAtt": [ "QMHelperCreateUUIDE0D423E6", "UUID" ] }, "METRICS_ENDPOINT": { "Fn::FindInMap": [ "QuotaMonitorMap", "Metrics", "MetricsEndpoint" ] }, "SEND_METRIC": { "Fn::FindInMap": [ "QuotaMonitorMap", "Metrics", "SendAnonymizedData" ] }, "TOPIC_ARN": { "Ref": "QMSNSPublisherQMSNSPublisherSNSTopic7EE2EBF4" }, "LOG_LEVEL": "info", "CUSTOM_SDK_USER_AGENT": "AwsSolution/SO0005/v6.3.12", "VERSION": "v6.3.12", "SOLUTION_ID": "SO0005" } }, "Handler": "index.handler", "KmsKeyArn": { "Fn::GetAtt": [ "KMSHubQMEncryptionKeyA80F8C05", "Arn" ] }, "Layers": [ { "Ref": "QMUtilsLayerQMUtilsLayerLayer80D5D993" } ], "MemorySize": 128, "Role": { "Fn::GetAtt": [ "QMSNSPublisherFunctionQMSNSPublisherFunctionLambdaServiceRoleA2F00B10", "Arn" ] }, "Runtime": "nodejs24.x", "Timeout": 60 }, "DependsOn": [ "QMSNSPublisherFunctionQMSNSPublisherFunctionLambdaServiceRoleDefaultPolicy1E6E152C", "QMSNSPublisherFunctionQMSNSPublisherFunctionLambdaServiceRoleA2F00B10" ], "Metadata": { "aws:cdk:path": "quota-monitor-hub/QM-SNSPublisherFunction/QM-SNSPublisherFunction-Lambda/Resource", "aws:asset:path": "asset.d4299c95f6e090811d3222e76b330a86b52fbc19298d3ac0da26ae0746fd2624.zip", "aws:asset:is-bundled": false, "aws:asset:property": "Code", "cdk_nag": { "rules_to_suppress": [ { "reason": "GovCloud regions support only up to nodejs 16, risk is tolerable", "id": "AwsSolutions-L1" } ] }, "guard": { "SuppressedRules": [ "LAMBDA_INSIDE_VPC", "LAMBDA_CONCURRENCY_CHECK" ] } } }, "QMSNSPublisherFunctionQMSNSPublisherFunctionLambdaEventInvokeConfig7A963AA0": { "Type": "AWS::Lambda::EventInvokeConfig", "Properties": { "FunctionName": { "Ref": "QMSNSPublisherFunctionQMSNSPublisherFunctionLambda8BD2DBC1" }, "MaximumEventAgeInSeconds": 14400, "Qualifier": "$LATEST" }, "Metadata": { "aws:cdk:path": "quota-monitor-hub/QM-SNSPublisherFunction/QM-SNSPublisherFunction-Lambda/EventInvokeConfig/Resource", "cdk_nag": { "rules_to_suppress": [ { "reason": "GovCloud regions support only up to nodejs 16, risk is tolerable", "id": "AwsSolutions-L1" } ] } } }, "QMEmailSubscription32E71F90": { "Type": "AWS::SNS::Subscription", "Properties": { "Endpoint": { "Ref": "SNSEmail" }, "Protocol": "email", "TopicArn": { "Ref": "QMSNSPublisherQMSNSPublisherSNSTopic7EE2EBF4" } }, "Metadata": { "aws:cdk:path": "quota-monitor-hub/QM-EmailSubscription/Resource" }, "Condition": "EmailTrueCondition" }, "QMSummarizerEventQueueQMSummarizerEventQueueEventsRuleE50B8D7C": { "Type": "AWS::Events::Rule", "Properties": { "Description": "SO0005 quota-monitor-for-aws - QM-Summarizer-EventQueue-EventsRule", "EventBusName": { "Ref": "QMBusFF5C6C0C" }, "EventPattern": { "detail": { "status": { "Fn::If": [ "ReportOKNotificationsCondition", [ "OK", "WARN", "ERROR" ], [ "WARN", "ERROR" ] ] } }, "detail-type": [ "Trusted Advisor Check Item Refresh Notification", "Service Quotas Utilization Notification" ], "source": [ "aws.trustedadvisor", "aws-solutions.quota-monitor" ] }, "State": "ENABLED", "Targets": [ { "Arn": { "Fn::GetAtt": [ "QMSummarizerEventQueueQMSummarizerEventQueueQueue95FCCD2A", "Arn" ] }, "Id": "Target0" } ] }, "Metadata": { "aws:cdk:path": "quota-monitor-hub/QM-Summarizer-EventQueue/QM-Summarizer-EventQueue-EventsRule/Resource" } }, "QMSummarizerEventQueueQMSummarizerEventQueueQueue95FCCD2A": { "Type": "AWS::SQS::Queue", "Properties": { "KmsMasterKeyId": { "Fn::GetAtt": [ "KMSHubQMEncryptionKeyA80F8C05", "Arn" ] }, "VisibilityTimeout": 60 }, "UpdateReplacePolicy": "Delete", "DeletionPolicy": "Delete", "Metadata": { "aws:cdk:path": "quota-monitor-hub/QM-Summarizer-EventQueue/QM-Summarizer-EventQueue-Queue/Resource", "cdk_nag": { "rules_to_suppress": [ { "reason": "dlq not implemented on sqs, will evaluate in future if there is need", "id": "AwsSolutions-SQS3" } ] } } }, "QMSummarizerEventQueueQMSummarizerEventQueueQueuePolicyE7E1F6D8": { "Type": "AWS::SQS::QueuePolicy", "Properties": { "PolicyDocument": { "Statement": [ { "Action": "sqs:*", "Condition": { "Bool": { "aws:SecureTransport": "false" } }, "Effect": "Deny", "Principal": { "AWS": "*" }, "Resource": { "Fn::GetAtt": [ "QMSummarizerEventQueueQMSummarizerEventQueueQueue95FCCD2A", "Arn" ] } }, { "Action": [ "sqs:SendMessage", "sqs:GetQueueAttributes", "sqs:GetQueueUrl" ], "Effect": "Allow", "Principal": { "Service": "events.amazonaws.com" }, "Resource": { "Fn::GetAtt": [ "QMSummarizerEventQueueQMSummarizerEventQueueQueue95FCCD2A", "Arn" ] } } ], "Version": "2012-10-17" }, "Queues": [ { "Ref": "QMSummarizerEventQueueQMSummarizerEventQueueQueue95FCCD2A" } ] }, "Metadata": { "aws:cdk:path": "quota-monitor-hub/QM-Summarizer-EventQueue/QM-Summarizer-EventQueue-Queue/Policy/Resource" } }, "QMTable336670B0": { "Type": "AWS::DynamoDB::Table", "Properties": { "AttributeDefinitions": [ { "AttributeName": "MessageId", "AttributeType": "S" }, { "AttributeName": "TimeStamp", "AttributeType": "S" } ], "BillingMode": "PAY_PER_REQUEST", "KeySchema": [ { "AttributeName": "MessageId", "KeyType": "HASH" }, { "AttributeName": "TimeStamp", "KeyType": "RANGE" } ], "PointInTimeRecoverySpecification": { "PointInTimeRecoveryEnabled": true }, "SSESpecification": { "KMSMasterKeyId": { "Fn::GetAtt": [ "KMSHubQMEncryptionKeyA80F8C05", "Arn" ] }, "SSEEnabled": true, "SSEType": "KMS" }, "TimeToLiveSpecification": { "AttributeName": "ExpiryTime", "Enabled": true } }, "UpdateReplacePolicy": "Retain", "DeletionPolicy": "Retain", "Metadata": { "aws:cdk:path": "quota-monitor-hub/QM-Table/Resource" } }, "QMReporterQMReporterEventsRule0BF77282": { "Type": "AWS::Events::Rule", "Properties": { "Description": "SO0005 quota-monitor-for-aws - QM-Reporter-EventsRule", "ScheduleExpression": "rate(5 minutes)", "State": "ENABLED", "Targets": [ { "Arn": { "Fn::GetAtt": [ "QMReporterQMReporterLambda7D98A6E4", "Arn" ] }, "Id": "Target0" } ] }, "Metadata": { "aws:cdk:path": "quota-monitor-hub/QM-Reporter/QM-Reporter-EventsRule/Resource" } }, "QMReporterQMReporterEventsRuleAllowEventRulequotamonitorhubQMReporterQMReporterLambda676D2E786A3BE915": { "Type": "AWS::Lambda::Permission", "Properties": { "Action": "lambda:InvokeFunction", "FunctionName": { "Fn::GetAtt": [ "QMReporterQMReporterLambda7D98A6E4", "Arn" ] }, "Principal": "events.amazonaws.com", "SourceArn": { "Fn::GetAtt": [ "QMReporterQMReporterEventsRule0BF77282", "Arn" ] } }, "Metadata": { "aws:cdk:path": "quota-monitor-hub/QM-Reporter/QM-Reporter-EventsRule/AllowEventRulequotamonitorhubQMReporterQMReporterLambda676D2E78" } }, "QMReporterQMReporterLambdaDeadLetterQueueA0C464BC": { "Type": "AWS::SQS::Queue", "Properties": { "KmsMasterKeyId": { "Fn::GetAtt": [ "KMSHubQMEncryptionKeyA80F8C05", "Arn" ] } }, "UpdateReplacePolicy": "Delete", "DeletionPolicy": "Delete", "Metadata": { "aws:cdk:path": "quota-monitor-hub/QM-Reporter/QM-Reporter-Lambda-Dead-Letter-Queue/Resource", "cdk_nag": { "rules_to_suppress": [ { "reason": "Queue itself is dead-letter queue", "id": "AwsSolutions-SQS3" } ] } } }, "QMReporterQMReporterLambdaDeadLetterQueuePolicyE714847D": { "Type": "AWS::SQS::QueuePolicy", "Properties": { "PolicyDocument": { "Statement": [ { "Action": "sqs:*", "Condition": { "Bool": { "aws:SecureTransport": "false" } }, "Effect": "Deny", "Principal": { "AWS": "*" }, "Resource": { "Fn::GetAtt": [ "QMReporterQMReporterLambdaDeadLetterQueueA0C464BC", "Arn" ] } } ], "Version": "2012-10-17" }, "Queues": [ { "Ref": "QMReporterQMReporterLambdaDeadLetterQueueA0C464BC" } ] }, "Metadata": { "aws:cdk:path": "quota-monitor-hub/QM-Reporter/QM-Reporter-Lambda-Dead-Letter-Queue/Policy/Resource" } }, "QMReporterQMReporterLambdaServiceRoleBA4CED84": { "Type": "AWS::IAM::Role", "Properties": { "AssumeRolePolicyDocument": { "Statement": [ { "Action": "sts:AssumeRole", "Effect": "Allow", "Principal": { "Service": "lambda.amazonaws.com" } } ], "Version": "2012-10-17" }, "ManagedPolicyArns": [ { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":iam::aws:policy/service-role/AWSLambdaBasicExecutionRole" ] ] } ] }, "Metadata": { "aws:cdk:path": "quota-monitor-hub/QM-Reporter/QM-Reporter-Lambda/ServiceRole/Resource", "cdk_nag": { "rules_to_suppress": [ { "reason": "AWSLambdaBasicExecutionRole added by cdk only gives write permissions for CW logs", "id": "AwsSolutions-IAM4" }, { "reason": "Actions restricted on kms key ARN. Only actions that do not support resource-level permissions have * in resource", "id": "AwsSolutions-IAM5" }, { "reason": "GovCloud regions support only up to nodejs 16, risk is tolerable", "id": "AwsSolutions-L1" } ] } } }, "QMReporterQMReporterLambdaServiceRoleDefaultPolicyC6B87A76": { "Type": "AWS::IAM::Policy", "Properties": { "PolicyDocument": { "Statement": [ { "Action": "sqs:SendMessage", "Effect": "Allow", "Resource": { "Fn::GetAtt": [ "QMReporterQMReporterLambdaDeadLetterQueueA0C464BC", "Arn" ] } }, { "Action": [ "kms:Encrypt", "kms:Decrypt", "kms:CreateGrant" ], "Effect": "Allow", "Resource": { "Fn::GetAtt": [ "KMSHubQMEncryptionKeyA80F8C05", "Arn" ] } }, { "Action": "kms:ListAliases", "Effect": "Allow", "Resource": "*" }, { "Action": [ "sqs:DeleteMessage", "sqs:ReceiveMessage" ], "Effect": "Allow", "Resource": { "Fn::GetAtt": [ "QMSummarizerEventQueueQMSummarizerEventQueueQueue95FCCD2A", "Arn" ] } }, { "Action": [ "dynamodb:GetItem", "dynamodb:PutItem" ], "Effect": "Allow", "Resource": { "Fn::GetAtt": [ "QMTable336670B0", "Arn" ] } } ], "Version": "2012-10-17" }, "PolicyName": "QMReporterQMReporterLambdaServiceRoleDefaultPolicyC6B87A76", "Roles": [ { "Ref": "QMReporterQMReporterLambdaServiceRoleBA4CED84" } ] }, "Metadata": { "aws:cdk:path": "quota-monitor-hub/QM-Reporter/QM-Reporter-Lambda/ServiceRole/DefaultPolicy/Resource", "cdk_nag": { "rules_to_suppress": [ { "reason": "AWSLambdaBasicExecutionRole added by cdk only gives write permissions for CW logs", "id": "AwsSolutions-IAM4" }, { "reason": "Actions restricted on kms key ARN. Only actions that do not support resource-level permissions have * in resource", "id": "AwsSolutions-IAM5" }, { "reason": "GovCloud regions support only up to nodejs 16, risk is tolerable", "id": "AwsSolutions-L1" } ] } } }, "QMReporterQMReporterLambda7D98A6E4": { "Type": "AWS::Lambda::Function", "Properties": { "Code": { "S3Bucket": { "Fn::Sub": "solutions-${AWS::Region}" }, "S3Key": "quota-monitor-for-aws/v6.3.12/asset21c393b2981e4ec2149684927f55b05c60bbbef0c5c55e2604bfd0ba4c16d3e3.zip" }, "DeadLetterConfig": { "TargetArn": { "Fn::GetAtt": [ "QMReporterQMReporterLambdaDeadLetterQueueA0C464BC", "Arn" ] } }, "Description": "SO0005 quota-monitor-for-aws - QM-Reporter-Lambda", "Environment": { "Variables": { "QUOTA_TABLE": { "Ref": "QMTable336670B0" }, "SQS_URL": { "Ref": "QMSummarizerEventQueueQMSummarizerEventQueueQueue95FCCD2A" }, "MAX_MESSAGES": "10", "MAX_LOOPS": "10", "LOG_LEVEL": "info", "CUSTOM_SDK_USER_AGENT": "AwsSolution/SO0005/v6.3.12", "VERSION": "v6.3.12", "SOLUTION_ID": "SO0005" } }, "Handler": "index.handler", "KmsKeyArn": { "Fn::GetAtt": [ "KMSHubQMEncryptionKeyA80F8C05", "Arn" ] }, "Layers": [ { "Ref": "QMUtilsLayerQMUtilsLayerLayer80D5D993" } ], "MemorySize": 512, "Role": { "Fn::GetAtt": [ "QMReporterQMReporterLambdaServiceRoleBA4CED84", "Arn" ] }, "Runtime": "nodejs24.x", "Timeout": 10 }, "DependsOn": [ "QMReporterQMReporterLambdaServiceRoleDefaultPolicyC6B87A76", "QMReporterQMReporterLambdaServiceRoleBA4CED84" ], "Metadata": { "aws:cdk:path": "quota-monitor-hub/QM-Reporter/QM-Reporter-Lambda/Resource", "aws:asset:path": "asset.21c393b2981e4ec2149684927f55b05c60bbbef0c5c55e2604bfd0ba4c16d3e3.zip", "aws:asset:is-bundled": false, "aws:asset:property": "Code", "cdk_nag": { "rules_to_suppress": [ { "reason": "GovCloud regions support only up to nodejs 16, risk is tolerable", "id": "AwsSolutions-L1" } ] }, "guard": { "SuppressedRules": [ "LAMBDA_INSIDE_VPC", "LAMBDA_CONCURRENCY_CHECK" ] } } }, "QMReporterQMReporterLambdaEventInvokeConfig07548BFA": { "Type": "AWS::Lambda::EventInvokeConfig", "Properties": { "FunctionName": { "Ref": "QMReporterQMReporterLambda7D98A6E4" }, "MaximumEventAgeInSeconds": 14400, "Qualifier": "$LATEST" }, "Metadata": { "aws:cdk:path": "quota-monitor-hub/QM-Reporter/QM-Reporter-Lambda/EventInvokeConfig/Resource", "cdk_nag": { "rules_to_suppress": [ { "reason": "GovCloud regions support only up to nodejs 16, risk is tolerable", "id": "AwsSolutions-L1" } ] } } }, "QMTAStackSet": { "Type": "AWS::CloudFormation::StackSet", "Properties": { "AutoDeployment": { "Enabled": true, "RetainStacksOnAccountRemoval": false }, "CallAs": "DELEGATED_ADMIN", "Capabilities": [ "CAPABILITY_IAM" ], "Description": "StackSet for deploying Quota Monitor Trusted Advisor spokes in Organization", "ManagedExecution": { "Active": true }, "OperationPreferences": { "FailureTolerancePercentage": { "Ref": "FailureTolerancePercentage" }, "MaxConcurrentPercentage": { "Ref": "MaxConcurrentPercentage" }, "RegionConcurrencyType": { "Ref": "RegionConcurrency" } }, "Parameters": [ { "ParameterKey": "EventBusArn", "ParameterValue": { "Fn::GetAtt": [ "QMBusFF5C6C0C", "Arn" ] } } ], "PermissionModel": "SERVICE_MANAGED", "StackSetName": "QM-TA-Spoke-StackSet", "TemplateURL": { "Fn::Join": [ "", [ "https://solutions-", { "Ref": "AWS::Region" }, ".s3.", { "Ref": "AWS::Region" }, ".amazonaws.com", { "Fn::If": [ "IsChinaPartition", ".cn", "" ] }, "/quota-monitor-for-aws/v6.3.12/", { "Fn::If": [ "IsChinaPartition", "quota-monitor-ta-spoke-cn.template", "quota-monitor-ta-spoke.template" ] } ] ] } }, "Metadata": { "aws:cdk:path": "quota-monitor-hub/QM-TA-StackSet" } }, "QMSQStackSet": { "Type": "AWS::CloudFormation::StackSet", "Properties": { "AutoDeployment": { "Enabled": true, "RetainStacksOnAccountRemoval": false }, "CallAs": "DELEGATED_ADMIN", "Capabilities": [ "CAPABILITY_IAM" ], "Description": "StackSet for deploying Quota Monitor Service Quota spokes in Organization", "ManagedExecution": { "Active": true }, "OperationPreferences": { "FailureTolerancePercentage": { "Ref": "FailureTolerancePercentage" }, "MaxConcurrentPercentage": { "Ref": "MaxConcurrentPercentage" }, "RegionConcurrencyType": { "Ref": "RegionConcurrency" } }, "Parameters": [ { "ParameterKey": "EventBusArn", "ParameterValue": { "Fn::GetAtt": [ "QMBusFF5C6C0C", "Arn" ] } }, { "ParameterKey": "SpokeSnsRegion", "ParameterValue": { "Ref": "SnsSpokeRegion" } }, { "ParameterKey": "SageMakerMonitoring", "ParameterValue": { "Ref": "SageMakerMonitoring" } }, { "ParameterKey": "ConnectMonitoring", "ParameterValue": { "Ref": "ConnectMonitoring" } } ], "PermissionModel": "SERVICE_MANAGED", "StackSetName": "QM-SQ-Spoke-StackSet", "TemplateURL": { "Fn::Join": [ "", [ "https://solutions-", { "Ref": "AWS::Region" }, ".s3.", { "Ref": "AWS::Region" }, ".amazonaws.com", { "Fn::If": [ "IsChinaPartition", ".cn", "" ] }, "/quota-monitor-for-aws/v6.3.12/", { "Fn::If": [ "IsChinaPartition", "quota-monitor-sq-spoke-cn.template", "quota-monitor-sq-spoke.template" ] } ] ] } }, "Metadata": { "aws:cdk:path": "quota-monitor-hub/QM-SQ-StackSet" } }, "QMSNSStackSet": { "Type": "AWS::CloudFormation::StackSet", "Properties": { "AutoDeployment": { "Enabled": true, "RetainStacksOnAccountRemoval": false }, "CallAs": "DELEGATED_ADMIN", "Capabilities": [ "CAPABILITY_IAM" ], "Description": "StackSet for deploying Quota Monitor notification spokes in Organization", "ManagedExecution": { "Active": true }, "Parameters": [], "PermissionModel": "SERVICE_MANAGED", "StackSetName": "QM-SNS-Spoke-StackSet", "TemplateURL": { "Fn::Join": [ "", [ "https://solutions-", { "Ref": "AWS::Region" }, ".s3.", { "Ref": "AWS::Region" }, ".amazonaws.com", { "Fn::If": [ "IsChinaPartition", ".cn", "" ] }, "/quota-monitor-for-aws/v6.3.12/", { "Fn::If": [ "IsChinaPartition", "quota-monitor-sns-spoke-cn.template", "quota-monitor-sns-spoke.template" ] } ] ] } }, "Metadata": { "aws:cdk:path": "quota-monitor-hub/QM-SNS-StackSet" } }, "QMDeploymentManagerQMDeploymentManagerEventsRule53DB2DA9": { "Type": "AWS::Events::Rule", "Properties": { "Description": "SO0005 quota-monitor-for-aws - QM-Deployment-Manager-EventsRule", "EventPattern": { "detail-type": [ "Parameter Store Change" ], "source": [ "aws.ssm" ], "resources": [ { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":ssm:", { "Ref": "AWS::Region" }, ":", { "Ref": "AWS::AccountId" }, ":parameter", { "Ref": "QMOUs122D8EB4" } ] ] }, { "Fn::If": [ "AccountDeployCondition", { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":ssm:", { "Ref": "AWS::Region" }, ":", { "Ref": "AWS::AccountId" }, ":parameter", { "Ref": "QMAccounts3D743F6B" } ] ] }, { "Ref": "AWS::NoValue" } ] }, { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":ssm:", { "Ref": "AWS::Region" }, ":", { "Ref": "AWS::AccountId" }, ":parameter", { "Ref": "QMRegionsList17794003" } ] ] } ] }, "State": "ENABLED", "Targets": [ { "Arn": { "Fn::GetAtt": [ "QMDeploymentManagerQMDeploymentManagerLambdaB36F1B21", "Arn" ] }, "Id": "Target0" } ] }, "Metadata": { "aws:cdk:path": "quota-monitor-hub/QM-Deployment-Manager/QM-Deployment-Manager-EventsRule/Resource" } }, "QMDeploymentManagerQMDeploymentManagerEventsRuleAllowEventRulequotamonitorhubQMDeploymentManagerQMDeploymentManagerLambda8FAD8D8E9E4893B8": { "Type": "AWS::Lambda::Permission", "Properties": { "Action": "lambda:InvokeFunction", "FunctionName": { "Fn::GetAtt": [ "QMDeploymentManagerQMDeploymentManagerLambdaB36F1B21", "Arn" ] }, "Principal": "events.amazonaws.com", "SourceArn": { "Fn::GetAtt": [ "QMDeploymentManagerQMDeploymentManagerEventsRule53DB2DA9", "Arn" ] } }, "Metadata": { "aws:cdk:path": "quota-monitor-hub/QM-Deployment-Manager/QM-Deployment-Manager-EventsRule/AllowEventRulequotamonitorhubQMDeploymentManagerQMDeploymentManagerLambda8FAD8D8E" } }, "QMDeploymentManagerQMDeploymentManagerLambdaDeadLetterQueue9B4636C2": { "Type": "AWS::SQS::Queue", "Properties": { "KmsMasterKeyId": { "Fn::GetAtt": [ "KMSHubQMEncryptionKeyA80F8C05", "Arn" ] } }, "UpdateReplacePolicy": "Delete", "DeletionPolicy": "Delete", "Metadata": { "aws:cdk:path": "quota-monitor-hub/QM-Deployment-Manager/QM-Deployment-Manager-Lambda-Dead-Letter-Queue/Resource", "cdk_nag": { "rules_to_suppress": [ { "reason": "Queue itself is dead-letter queue", "id": "AwsSolutions-SQS3" } ] } } }, "QMDeploymentManagerQMDeploymentManagerLambdaDeadLetterQueuePolicy6B59E185": { "Type": "AWS::SQS::QueuePolicy", "Properties": { "PolicyDocument": { "Statement": [ { "Action": "sqs:*", "Condition": { "Bool": { "aws:SecureTransport": "false" } }, "Effect": "Deny", "Principal": { "AWS": "*" }, "Resource": { "Fn::GetAtt": [ "QMDeploymentManagerQMDeploymentManagerLambdaDeadLetterQueue9B4636C2", "Arn" ] } } ], "Version": "2012-10-17" }, "Queues": [ { "Ref": "QMDeploymentManagerQMDeploymentManagerLambdaDeadLetterQueue9B4636C2" } ] }, "Metadata": { "aws:cdk:path": "quota-monitor-hub/QM-Deployment-Manager/QM-Deployment-Manager-Lambda-Dead-Letter-Queue/Policy/Resource" } }, "QMDeploymentManagerQMDeploymentManagerLambdaServiceRole84304F72": { "Type": "AWS::IAM::Role", "Properties": { "AssumeRolePolicyDocument": { "Statement": [ { "Action": "sts:AssumeRole", "Effect": "Allow", "Principal": { "Service": "lambda.amazonaws.com" } } ], "Version": "2012-10-17" }, "ManagedPolicyArns": [ { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":iam::aws:policy/service-role/AWSLambdaBasicExecutionRole" ] ] } ] }, "Metadata": { "aws:cdk:path": "quota-monitor-hub/QM-Deployment-Manager/QM-Deployment-Manager-Lambda/ServiceRole/Resource", "cdk_nag": { "rules_to_suppress": [ { "reason": "AWSLambdaBasicExecutionRole added by cdk only gives write permissions for CW logs", "id": "AwsSolutions-IAM4" }, { "reason": "Actions restricted on kms key ARN. Only actions that do not support resource-level permissions have * in resource", "id": "AwsSolutions-IAM5" }, { "reason": "GovCloud regions support only up to nodejs 16, risk is tolerable", "id": "AwsSolutions-L1" } ] } } }, "QMDeploymentManagerQMDeploymentManagerLambdaServiceRoleDefaultPolicy7E3D0777": { "Type": "AWS::IAM::Policy", "Properties": { "PolicyDocument": { "Statement": [ { "Action": "sqs:SendMessage", "Effect": "Allow", "Resource": { "Fn::GetAtt": [ "QMDeploymentManagerQMDeploymentManagerLambdaDeadLetterQueue9B4636C2", "Arn" ] } }, { "Action": [ "kms:Encrypt", "kms:Decrypt", "kms:CreateGrant" ], "Effect": "Allow", "Resource": { "Fn::GetAtt": [ "KMSHubQMEncryptionKeyA80F8C05", "Arn" ] } }, { "Action": "kms:ListAliases", "Effect": "Allow", "Resource": "*" }, { "Action": [ "events:PutPermission", "events:RemovePermission" ], "Effect": "Allow", "Resource": "*" }, { "Action": "events:DescribeEventBus", "Effect": "Allow", "Resource": { "Fn::GetAtt": [ "QMBusFF5C6C0C", "Arn" ] } }, { "Action": "ssm:GetParameter", "Effect": "Allow", "Resource": [ { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":ssm:", { "Ref": "AWS::Region" }, ":", { "Ref": "AWS::AccountId" }, ":parameter", { "Ref": "QMOUs122D8EB4" } ] ] }, { "Fn::If": [ "AccountDeployCondition", { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":ssm:", { "Ref": "AWS::Region" }, ":", { "Ref": "AWS::AccountId" }, ":parameter", { "Ref": "QMAccounts3D743F6B" } ] ] }, { "Ref": "AWS::NoValue" } ] }, { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":ssm:", { "Ref": "AWS::Region" }, ":", { "Ref": "AWS::AccountId" }, ":parameter", { "Ref": "QMRegionsList17794003" } ] ] } ] }, { "Action": [ "organizations:DescribeOrganization", "organizations:ListRoots", "organizations:ListAccounts" ], "Effect": "Allow", "Resource": "*" }, { "Action": [ "organizations:ListDelegatedAdministrators", "organizations:ListAccountsForParent" ], "Effect": "Allow", "Resource": "*" }, { "Action": "cloudformation:DescribeStackSet", "Effect": "Allow", "Resource": [ { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":cloudformation:*:", { "Ref": "ManagementAccountId" }, ":stackset/QM-TA-Spoke-StackSet:*" ] ] }, { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":cloudformation:*:", { "Ref": "ManagementAccountId" }, ":stackset/QM-SQ-Spoke-StackSet:*" ] ] }, { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":cloudformation:*:", { "Ref": "ManagementAccountId" }, ":stackset/QM-SNS-Spoke-StackSet:*" ] ] } ] }, { "Action": [ "cloudformation:CreateStackInstances", "cloudformation:DeleteStackInstances", "cloudformation:ListStackInstances" ], "Effect": "Allow", "Resource": [ { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":cloudformation:*:", { "Ref": "ManagementAccountId" }, ":stackset/QM-TA-Spoke-StackSet:*" ] ] }, { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":cloudformation:*:", { "Ref": "ManagementAccountId" }, ":stackset/QM-SQ-Spoke-StackSet:*" ] ] }, { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":cloudformation:*:", { "Ref": "ManagementAccountId" }, ":stackset/QM-SNS-Spoke-StackSet:*" ] ] }, { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":cloudformation:*:", { "Ref": "ManagementAccountId" }, ":stackset-target/QM-SNS-Spoke-StackSet:*/*" ] ] }, { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":cloudformation:*:", { "Ref": "ManagementAccountId" }, ":stackset-target/QM-TA-Spoke-StackSet:*/*" ] ] }, { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":cloudformation:*:", { "Ref": "ManagementAccountId" }, ":stackset-target/QM-SQ-Spoke-StackSet:*/*" ] ] }, { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":cloudformation:*::type/resource/*" ] ] } ] }, { "Action": "ec2:DescribeRegions", "Effect": "Allow", "Resource": "*" }, { "Action": "support:DescribeTrustedAdvisorChecks", "Effect": "Allow", "Resource": "*" } ], "Version": "2012-10-17" }, "PolicyName": "QMDeploymentManagerQMDeploymentManagerLambdaServiceRoleDefaultPolicy7E3D0777", "Roles": [ { "Ref": "QMDeploymentManagerQMDeploymentManagerLambdaServiceRole84304F72" } ] }, "Metadata": { "aws:cdk:path": "quota-monitor-hub/QM-Deployment-Manager/QM-Deployment-Manager-Lambda/ServiceRole/DefaultPolicy/Resource", "cdk_nag": { "rules_to_suppress": [ { "reason": "AWSLambdaBasicExecutionRole added by cdk only gives write permissions for CW logs", "id": "AwsSolutions-IAM4" }, { "reason": "Actions restricted on kms key ARN. Only actions that do not support resource-level permissions have * in resource", "id": "AwsSolutions-IAM5" }, { "reason": "GovCloud regions support only up to nodejs 16, risk is tolerable", "id": "AwsSolutions-L1" } ] } } }, "QMDeploymentManagerQMDeploymentManagerLambdaB36F1B21": { "Type": "AWS::Lambda::Function", "Properties": { "Code": { "S3Bucket": { "Fn::Sub": "solutions-${AWS::Region}" }, "S3Key": "quota-monitor-for-aws/v6.3.12/asset83e84c195cad8f17f3b60910869fa324d161c7fcf99194ec415fc3f64685f88c.zip" }, "DeadLetterConfig": { "TargetArn": { "Fn::GetAtt": [ "QMDeploymentManagerQMDeploymentManagerLambdaDeadLetterQueue9B4636C2", "Arn" ] } }, "Description": "SO0005 quota-monitor-for-aws - QM-Deployment-Manager-Lambda", "Environment": { "Variables": { "EVENT_BUS_NAME": { "Ref": "QMBusFF5C6C0C" }, "EVENT_BUS_ARN": { "Fn::GetAtt": [ "QMBusFF5C6C0C", "Arn" ] }, "TA_STACKSET_ID": { "Fn::GetAtt": [ "QMTAStackSet", "StackSetId" ] }, "SQ_STACKSET_ID": { "Fn::GetAtt": [ "QMSQStackSet", "StackSetId" ] }, "SNS_STACKSET_ID": { "Fn::GetAtt": [ "QMSNSStackSet", "StackSetId" ] }, "QM_OU_PARAMETER": { "Ref": "QMOUs122D8EB4" }, "QM_ACCOUNT_PARAMETER": { "Fn::If": [ "AccountDeployCondition", { "Ref": "QMAccounts3D743F6B" }, { "Ref": "AWS::NoValue" } ] }, "DEPLOYMENT_MODEL": { "Ref": "DeploymentModel" }, "REGIONS_LIST": { "Ref": "RegionsList" }, "QM_REGIONS_LIST_PARAMETER": { "Ref": "QMRegionsList17794003" }, "SNS_SPOKE_REGION": { "Ref": "SnsSpokeRegion" }, "SQ_NOTIFICATION_THRESHOLD": { "Ref": "SQNotificationThreshold" }, "SQ_MONITORING_FREQUENCY": { "Ref": "SQMonitoringFrequency" }, "REPORT_OK_NOTIFICATIONS": { "Ref": "ReportOKNotifications" }, "SOLUTION_UUID": { "Fn::GetAtt": [ "QMHelperCreateUUIDE0D423E6", "UUID" ] }, "METRICS_ENDPOINT": { "Fn::FindInMap": [ "QuotaMonitorMap", "Metrics", "MetricsEndpoint" ] }, "SEND_METRIC": { "Fn::FindInMap": [ "QuotaMonitorMap", "Metrics", "SendAnonymizedData" ] }, "LOG_LEVEL": "info", "CUSTOM_SDK_USER_AGENT": "AwsSolution/SO0005/v6.3.12", "VERSION": "v6.3.12", "SOLUTION_ID": "SO0005" } }, "Handler": "index.handler", "KmsKeyArn": { "Fn::GetAtt": [ "KMSHubQMEncryptionKeyA80F8C05", "Arn" ] }, "Layers": [ { "Ref": "QMUtilsLayerQMUtilsLayerLayer80D5D993" } ], "MemorySize": 512, "Role": { "Fn::GetAtt": [ "QMDeploymentManagerQMDeploymentManagerLambdaServiceRole84304F72", "Arn" ] }, "Runtime": "nodejs24.x", "Timeout": 60 }, "DependsOn": [ "QMDeploymentManagerQMDeploymentManagerLambdaServiceRoleDefaultPolicy7E3D0777", "QMDeploymentManagerQMDeploymentManagerLambdaServiceRole84304F72" ], "Metadata": { "aws:cdk:path": "quota-monitor-hub/QM-Deployment-Manager/QM-Deployment-Manager-Lambda/Resource", "aws:asset:path": "asset.83e84c195cad8f17f3b60910869fa324d161c7fcf99194ec415fc3f64685f88c.zip", "aws:asset:is-bundled": false, "aws:asset:property": "Code", "cdk_nag": { "rules_to_suppress": [ { "reason": "GovCloud regions support only up to nodejs 16, risk is tolerable", "id": "AwsSolutions-L1" } ] }, "guard": { "SuppressedRules": [ "LAMBDA_INSIDE_VPC", "LAMBDA_CONCURRENCY_CHECK" ] } } }, "QMDeploymentManagerQMDeploymentManagerLambdaEventInvokeConfig4C3821AB": { "Type": "AWS::Lambda::EventInvokeConfig", "Properties": { "FunctionName": { "Ref": "QMDeploymentManagerQMDeploymentManagerLambdaB36F1B21" }, "MaximumEventAgeInSeconds": 14400, "Qualifier": "$LATEST" }, "Metadata": { "aws:cdk:path": "quota-monitor-hub/QM-Deployment-Manager/QM-Deployment-Manager-Lambda/EventInvokeConfig/Resource", "cdk_nag": { "rules_to_suppress": [ { "reason": "GovCloud regions support only up to nodejs 16, risk is tolerable", "id": "AwsSolutions-L1" } ] } } }, "CDKMetadata": { "Type": "AWS::CDK::Metadata", "Properties": { "Analytics": "v2:deflate64:H4sIAAAAAAAA/11R0U4DIRD8Ft/pqlU/wDaaGDXW1vja7HHbBu+Ak4WahvDvZrlaqy/MzO4AO9kpTG+u4eIMv3ii227SmwbyKqLu1HzjFhjQUqQg4hmHwbit0Ll3rYnGO4VfvM60IxcZ8p3gLLFYjnyZepKCYFGdZciPtJeKwG1vsPorKYrZyv/BuO2fz3/F2HwyHI+1onq0TYuQn3BP4Z0Cy2zzjfuj75PT8dA48jrng9v5jubebcz2OPz/4oKCNSwvFcVXa2SmyHAroPgKZkl3FGfIpAxayEt/yC248L3RNfTIiuJPhvyaKFXTSOr5az2RRbFjyG9+MFpaI1mlhnUww0+oU11Uu3dofdtAfsNmnKWSonTvU7vxwaI4QW7KxlcUi6p5VhG3smqdOHq7DsQ+BU0Mi+B3ppWV1M7y0Kg5f/hp8SXFIcWinG8JPvh8N72Gyxu4OPtgYyYhuWgswXLEb9doiwOMAgAA" }, "Metadata": { "aws:cdk:path": "quota-monitor-hub/CDKMetadata/Default" }, "Condition": "CDKMetadataAvailable" } }, "Outputs": { "SlackHookKey": { "Description": "SSM parameter for Slack Web Hook, change the value for your slack workspace", "Value": { "Fn::FindInMap": [ "QuotaMonitorMap", "SSMParameters", "SlackHook" ] }, "Condition": "SlackTrueCondition" }, "UUID": { "Description": "UUID for the deployment", "Value": { "Fn::GetAtt": [ "QMHelperCreateUUIDE0D423E6", "UUID" ] } }, "EventBus": { "Description": "Event Bus Arn in hub", "Value": { "Fn::GetAtt": [ "QMBusFF5C6C0C", "Arn" ] } }, "SNSTopic": { "Description": "The SNS Topic where notifications are published to", "Value": { "Ref": "QMSNSPublisherQMSNSPublisherSNSTopic7EE2EBF4" } } } }