{ "Description": "(SO0284) innovation-sandbox-on-aws v1.3.0", "Metadata": { "AWS::CloudFormation::Interface": { "ParameterLabels": { "Namespace": { "default": "Namespace" }, "HubAccountId": { "default": "Hub Account Id" }, "ParentOuId": { "default": "Parent OU Id" }, "IsbManagedRegions": { "default": "ISB Managed Regions" }, "AdditionalAllowedServices": { "default": "Additional Allowed Services" }, "AdditionalPrincipalExceptions": { "default": "Additional Principal Exceptions" }, "BedrockInferenceProfilePatterns": { "default": "Bedrock Inference Profile Patterns" } }, "ParameterGroups": [ { "Label": { "default": "AccountPool Stack Configuration" }, "Parameters": [ "Namespace", "HubAccountId", "ParentOuId", "IsbManagedRegions", "AdditionalAllowedServices", "AdditionalPrincipalExceptions", "BedrockInferenceProfilePatterns" ] } ] } }, "Parameters": { "Namespace": { "Type": "String", "Default": "myisb", "AllowedPattern": "^[0-9a-zA-Z]{3,8}$", "Description": "The namespace for this deployment of Innovation Sandbox (must be the same for all member stacks). Alphanumeric characters of length between 3 and 8" }, "HubAccountId": { "Type": "String", "AllowedPattern": "^[0-9]{12}$", "Description": "The AWS Account Id where the Innovation Sandbox hub application is (to be) deployed" }, "ParentOuId": { "Type": "String", "AllowedPattern": "^(r-[0-9a-z]{4,32})|(ou-[0-9a-z]{4,32}-[a-z0-9]{8,32})$", "Description": "Provide Root id or organization unit id where Innovation Sandbox OUs will be created" }, "IsbManagedRegions": { "Type": "CommaDelimitedList", "AllowedPattern": "^[a-z]{2}(-[a-z]+-\\d{1})(,[ ]*[a-z]{2}(-[a-z]+-\\d{1}))*$", "ConstraintDescription": "Must be a comma-separated list of valid AWS Region codes, e.g., us-east-1,eu-west-1", "Description": "Provide list of AWS Regions to limit the use to specific regions." }, "AdditionalAllowedServices": { "Type": "CommaDelimitedList", "Default": "", "AllowedPattern": "^$|^[a-zA-Z0-9-]+:[a-zA-Z0-9*]+(,\\s*[a-zA-Z0-9-]+:[a-zA-Z0-9*]+)*$", "ConstraintDescription": "Must be empty or a comma-separated list of service:action patterns (e.g., sts:*,bedrock:*). Each entry must follow service:action format. Bare wildcards like *:* are not allowed.", "Description": "Optional comma-separated list of additional AWS service actions to allow in sandbox accounts. Actions that already exist in the default allowed list will appear as duplicates in the SCP, which has no effect. Refer to the Implementation Guide for the default list of supported services." }, "AdditionalPrincipalExceptions": { "Type": "CommaDelimitedList", "Default": "", "AllowedPattern": "^$|^arn:aws:iam::[0-9*]+:role/[a-zA-Z0-9_+=,.@/-]*[a-zA-Z0-9_+=,.@-]+\\*?$", "ConstraintDescription": "Must be empty or a valid IAM role ARN (e.g., arn:aws:iam::123456789012:role/MyRole,arn:aws:iam::*:role/ServiceRole*). A bare wildcard role name (arn:aws:iam::*:role/*) is not allowed. Do not use trailing or consecutive commas.", "Description": "Optional comma-separated list of IAM role ARNs to exclude from SCP restrictions in sandbox accounts. Supports wildcard (*) at the end of role names. Do not use trailing commas, consecutive commas, or bare wildcards (arn:aws:iam::*:role/*)." }, "BedrockInferenceProfilePatterns": { "Type": "CommaDelimitedList", "Default": "", "AllowedPattern": "^$|^arn:aws:bedrock:[a-z0-9*-]+:[0-9*]+:inference-profile/[a-zA-Z0-9.*:_-]+$", "ConstraintDescription": "Must be empty or a comma-separated list of Bedrock inference profile ARN patterns (e.g., arn:aws:bedrock:*:*:inference-profile/*). Each entry must include the inference-profile/ segment. Overly broad patterns like arn:aws:bedrock:*:*:* are not allowed.", "Description": "Allow Bedrock cross-region inference by specifying inference profile ARN patterns that are exempt from the region deny SCP. When empty, all cross-region Bedrock calls are blocked by the region restriction SCP. Example patterns: arn:aws:bedrock:*:*:inference-profile/* (all profiles), arn:aws:bedrock:*:*:inference-profile/us.* (US profiles only)." } }, "Conditions": { "HasAdditionalAllowedServices": { "Fn::Not": [ { "Fn::Equals": [ { "Fn::Join": [ "", { "Ref": "AdditionalAllowedServices" } ] }, "" ] } ] }, "HasAdditionalPrincipalExceptions": { "Fn::Not": [ { "Fn::Equals": [ { "Fn::Join": [ "", { "Ref": "AdditionalPrincipalExceptions" } ] }, "" ] } ] }, "HasBedrockInferenceProfilePatterns": { "Fn::Not": [ { "Fn::Equals": [ { "Fn::Join": [ "", { "Ref": "BedrockInferenceProfilePatterns" } ] }, "" ] } ] }, "CDKMetadataAvailable": { "Fn::Or": [ { "Fn::Or": [ { "Fn::Equals": [ { "Ref": "AWS::Region" }, "af-south-1" ] }, { "Fn::Equals": [ { "Ref": "AWS::Region" }, "ap-east-1" ] }, { "Fn::Equals": [ { "Ref": "AWS::Region" }, "ap-northeast-1" ] }, { "Fn::Equals": [ { "Ref": "AWS::Region" }, "ap-northeast-2" ] }, { "Fn::Equals": [ { "Ref": "AWS::Region" }, "ap-northeast-3" ] }, { "Fn::Equals": [ { "Ref": "AWS::Region" }, "ap-south-1" ] }, { "Fn::Equals": [ { "Ref": "AWS::Region" }, "ap-south-2" ] }, { "Fn::Equals": [ { "Ref": "AWS::Region" }, "ap-southeast-1" ] }, { "Fn::Equals": [ { "Ref": "AWS::Region" }, "ap-southeast-2" ] }, { "Fn::Equals": [ { "Ref": "AWS::Region" }, "ap-southeast-3" ] } ] }, { "Fn::Or": [ { "Fn::Equals": [ { "Ref": "AWS::Region" }, "ap-southeast-4" ] }, { "Fn::Equals": [ { "Ref": "AWS::Region" }, "ca-central-1" ] }, { "Fn::Equals": [ { "Ref": "AWS::Region" }, "ca-west-1" ] }, { "Fn::Equals": [ { "Ref": "AWS::Region" }, "cn-north-1" ] }, { "Fn::Equals": [ { "Ref": "AWS::Region" }, "cn-northwest-1" ] }, { "Fn::Equals": [ { "Ref": "AWS::Region" }, "eu-central-1" ] }, { "Fn::Equals": [ { "Ref": "AWS::Region" }, "eu-central-2" ] }, { "Fn::Equals": [ { "Ref": "AWS::Region" }, "eu-north-1" ] }, { "Fn::Equals": [ { "Ref": "AWS::Region" }, "eu-south-1" ] }, { "Fn::Equals": [ { "Ref": "AWS::Region" }, "eu-south-2" ] } ] }, { "Fn::Or": [ { "Fn::Equals": [ { "Ref": "AWS::Region" }, "eu-west-1" ] }, { "Fn::Equals": [ { "Ref": "AWS::Region" }, "eu-west-2" ] }, { "Fn::Equals": [ { "Ref": "AWS::Region" }, "eu-west-3" ] }, { "Fn::Equals": [ { "Ref": "AWS::Region" }, "il-central-1" ] }, { "Fn::Equals": [ { "Ref": "AWS::Region" }, "me-central-1" ] }, { "Fn::Equals": [ { "Ref": "AWS::Region" }, "me-south-1" ] }, { "Fn::Equals": [ { "Ref": "AWS::Region" }, "sa-east-1" ] }, { "Fn::Equals": [ { "Ref": "AWS::Region" }, "us-east-1" ] }, { "Fn::Equals": [ { "Ref": "AWS::Region" }, "us-east-2" ] }, { "Fn::Equals": [ { "Ref": "AWS::Region" }, "us-west-1" ] } ] }, { "Fn::Equals": [ { "Ref": "AWS::Region" }, "us-west-2" ] } ] } }, "Resources": { "InnovationSandboxAccountPoolOu": { "Type": "AWS::Organizations::OrganizationalUnit", "Properties": { "Name": { "Fn::Join": [ "", [ { "Ref": "Namespace" }, "_InnovationSandboxAccountPool" ] ] }, "ParentId": { "Ref": "ParentOuId" }, "Tags": [ { "Key": "aws-solutions:isb-id", "Value": { "Fn::Join": [ "", [ { "Ref": "Namespace" }, "_isb" ] ] } } ] }, "Metadata": { "aws:cdk:path": "InnovationSandbox-AccountPool/InnovationSandboxAccountPoolOu" } }, "AvailableOu": { "Type": "AWS::Organizations::OrganizationalUnit", "Properties": { "Name": "Available", "ParentId": { "Fn::GetAtt": [ "InnovationSandboxAccountPoolOu", "Id" ] }, "Tags": [ { "Key": "aws-solutions:isb-id", "Value": { "Fn::Join": [ "", [ { "Ref": "Namespace" }, "_isb" ] ] } } ] }, "Metadata": { "aws:cdk:path": "InnovationSandbox-AccountPool/AvailableOu" } }, "ActiveOu": { "Type": "AWS::Organizations::OrganizationalUnit", "Properties": { "Name": "Active", "ParentId": { "Fn::GetAtt": [ "InnovationSandboxAccountPoolOu", "Id" ] }, "Tags": [ { "Key": "aws-solutions:isb-id", "Value": { "Fn::Join": [ "", [ { "Ref": "Namespace" }, "_isb" ] ] } } ] }, "Metadata": { "aws:cdk:path": "InnovationSandbox-AccountPool/ActiveOu" } }, "CleanUpOu": { "Type": "AWS::Organizations::OrganizationalUnit", "Properties": { "Name": "CleanUp", "ParentId": { "Fn::GetAtt": [ "InnovationSandboxAccountPoolOu", "Id" ] }, "Tags": [ { "Key": "aws-solutions:isb-id", "Value": { "Fn::Join": [ "", [ { "Ref": "Namespace" }, "_isb" ] ] } } ] }, "Metadata": { "aws:cdk:path": "InnovationSandbox-AccountPool/CleanUpOu" } }, "QuarantineOu": { "Type": "AWS::Organizations::OrganizationalUnit", "Properties": { "Name": "Quarantine", "ParentId": { "Fn::GetAtt": [ "InnovationSandboxAccountPoolOu", "Id" ] }, "Tags": [ { "Key": "aws-solutions:isb-id", "Value": { "Fn::Join": [ "", [ { "Ref": "Namespace" }, "_isb" ] ] } } ] }, "Metadata": { "aws:cdk:path": "InnovationSandbox-AccountPool/QuarantineOu" } }, "EntryOu": { "Type": "AWS::Organizations::OrganizationalUnit", "Properties": { "Name": "Entry", "ParentId": { "Fn::GetAtt": [ "InnovationSandboxAccountPoolOu", "Id" ] }, "Tags": [ { "Key": "aws-solutions:isb-id", "Value": { "Fn::Join": [ "", [ { "Ref": "Namespace" }, "_isb" ] ] } } ] }, "Metadata": { "aws:cdk:path": "InnovationSandbox-AccountPool/EntryOu" } }, "ExitOu": { "Type": "AWS::Organizations::OrganizationalUnit", "Properties": { "Name": "Exit", "ParentId": { "Fn::GetAtt": [ "InnovationSandboxAccountPoolOu", "Id" ] }, "Tags": [ { "Key": "aws-solutions:isb-id", "Value": { "Fn::Join": [ "", [ { "Ref": "Namespace" }, "_isb" ] ] } } ] }, "Metadata": { "aws:cdk:path": "InnovationSandbox-AccountPool/ExitOu" } }, "FrozenOu": { "Type": "AWS::Organizations::OrganizationalUnit", "Properties": { "Name": "Frozen", "ParentId": { "Fn::GetAtt": [ "InnovationSandboxAccountPoolOu", "Id" ] }, "Tags": [ { "Key": "aws-solutions:isb-id", "Value": { "Fn::Join": [ "", [ { "Ref": "Namespace" }, "_isb" ] ] } } ] }, "Metadata": { "aws:cdk:path": "InnovationSandbox-AccountPool/FrozenOu" } }, "InnovationSandboxAwsNukeSupportedServicesScp": { "Type": "AWS::Organizations::Policy", "Properties": { "Content": { "Fn::Join": [ "", [ "{\"Version\":\"2012-10-17\",\"Statement\":[{\"Sid\":\"DenyAllExceptAwsNukeSupportedServices\",\"Effect\":\"Deny\",\"NotAction\":[", "\"access-analyzer:*\",\"acm:*\",\"acm-pca:*\",\"amplify:*\",\"aoss:*\",\"apigateway:*\",\"appconfig:*\",\"application-autoscaling:*\",\"applicationinsights:*\",\"appmesh:*\",\"apprunner:*\",\"appstream:*\",\"appsync:*\",\"aps:*\",\"athena:*\",\"autoscaling:*\",\"autoscaling-plans:*\",\"backup:*\",\"batch:*\",\"bedrock:*\",\"bedrock-agentcore:*\",\"budgets:*\",\"cloud9:*\",\"clouddirectory:*\",\"cloudformation:*\",\"cloudfront:*\",\"cloudhsm:*\",\"cloudsearch:*\",\"cloudshell:*\",\"cloudtrail:*\",\"cloudwatch:*\",\"codeartifact:*\",\"codebuild:*\",\"codecommit:*\",\"codedeploy:*\",\"codeguru-profiler:*\",\"codeguru-reviewer:*\",\"codepipeline:*\",\"codestar:*\",\"cognito-identity:*\",\"cognito-idp:*\",\"comprehend:*\",\"config:*\",\"dms:*\",\"datapipeline:*\",\"dax:*\",\"databrew:*\",\"devicefarm:*\",\"docdb-elastic:*\",\"ds:*\",\"dsql:*\",\"dynamodb:*\",\"ec2:*\",\"ec2messages:*\",\"ecr:*\",\"ecr-public:*\",\"ecs:*\",\"elasticfilesystem:*\",\"eks:*\",\"eks-auth:*\",\"elasticache:*\",\"elasticbeanstalk:*\",\"es:*\",\"elastictranscoder:*\",\"elasticloadbalancing:*\",\"elasticmapreduce:*\",\"events:*\",\"execute-api:*\",\"firehose:*\",\"fms:*\",\"fsx:*\",\"gamelift:*\",\"globalaccelerator:*\",\"glue:*\",\"grafana:*\",\"guardduty:*\",\"iam:*\",\"imagebuilder:*\",\"inspector:*\",\"inspector2:*\",\"iot:*\",\"iotsitewise:*\",\"iottwinmaker:*\",\"kendra:*\",\"kinesis:*\",\"kinesisanalytics:*\",\"kinesisvideo:*\",\"kms:*\",\"lakeformation:*\",\"lambda:*\",\"lightsail:*\",\"logs:*\",\"machinelearning:*\",\"macie2:*\",\"managedblockchain:*\",\"mediaconvert:*\",\"medialive:*\",\"mediapackage:*\",\"mediastore:*\",\"mediatailor:*\",\"memorydb:*\",\"mgn:*\",\"mq:*\",\"kafka:*\",\"neptune-db:*\",\"networkmanager:*\",\"opensearch:*\",\"opsworks:*\",\"opsworks-cm:*\",\"sms-voice:*\",\"q:*\",\"pipes:*\",\"polly:*\",\"qldb:*\",\"quicksight:*\",\"rds:*\",\"redshift:*\",\"redshift-serverless:*\",\"rekognition:*\",\"resource-explorer-2:*\",\"resource-groups:*\",\"robomaker:*\",\"route53:*\",\"route53resolver:*\",\"s3:*\",\"s3tables:*\",\"s3vectors:*\",\"sagemaker:*\",\"scheduler:*\",\"secretsmanager:*\",\"securityhub:*\",\"servicecatalog:*\",\"servicediscovery:*\",\"ses:*\",\"states:*\",\"signer:*\",\"sdb:*\",\"sns:*\",\"sqs:*\",\"ssm:*\",\"ssm-guiconnect:*\",\"ssmmessages:*\",\"storagegateway:*\",\"sts:*\",\"tag:*\",\"textract:*\",\"timestream:*\",\"transcribe:*\",\"transfer:*\",\"waf:*\",\"wafv2:*\",\"workspaces:*\",\"xray:*\"", { "Fn::If": [ "HasAdditionalAllowedServices", { "Fn::Join": [ "", [ ",\"", { "Fn::Join": [ "\",\"", { "Ref": "AdditionalAllowedServices" } ] }, "\"" ] ] }, "" ] }, "],\"Resource\":[\"*\"],\"Condition\":", "{\"ArnNotLike\":{\"aws:PrincipalARN\":[", { "Fn::Join": [ "", [ "\"arn:aws:iam::*:role/InnovationSandbox-", { "Ref": "Namespace" }, "*\",\"arn:aws:iam::*:role/aws-reserved/sso.amazonaws.com/*AWSReservedSSO_", { "Ref": "Namespace" }, "_IsbAdmins*\",\"arn:aws:iam::*:role/stacksets-exec-*\",\"arn:aws:iam::*:role/AWSControlTowerExecution\"" ] ] }, { "Fn::If": [ "HasAdditionalPrincipalExceptions", { "Fn::Join": [ "", [ ",\"", { "Fn::Join": [ "\",\"", { "Ref": "AdditionalPrincipalExceptions" } ] }, "\"" ] ] }, "" ] }, "]}}", "}]}" ] ] }, "Description": "Service Control Policy (SCP) to allow only services supported by AWS Nuke clean workflow. ", "Name": { "Fn::Join": [ "", [ { "Ref": "Namespace" }, "-InnovationSandboxAwsNukeSupportedServicesScp" ] ] }, "Tags": [ { "Key": "aws-solutions:isb-id", "Value": { "Fn::Join": [ "", [ { "Ref": "Namespace" }, "_isb" ] ] } } ], "TargetIds": [ { "Fn::GetAtt": [ "InnovationSandboxAccountPoolOu", "Id" ] } ], "Type": "SERVICE_CONTROL_POLICY" }, "Metadata": { "aws:cdk:path": "InnovationSandbox-AccountPool/InnovationSandboxAwsNukeSupportedServicesScp" } }, "InnovationSandboxRestrictionsScp": { "Type": "AWS::Organizations::Policy", "Properties": { "Content": { "Statement": [ { "Action": [ "aws-portal:ModifyAccount", "aws-portal:ViewAccount", "cloudtrail:CreateServiceLinkedChannel", "cloudtrail:UpdateServiceLinkedChannel", "iam:CreateUser", "networkmanager:AssociateTransitGatewayConnectPeer", "networkmanager:DisassociateTransitGatewayConnectPeer", "networkmanager:StartOrganizationServiceAccessUpdate", "ram:CreateResourceShare", "ram:EnableSharingWithAwsOrganization", "ssm:ModifyDocumentPermission", "wafv2:DisassociateFirewallManager", "wafv2:PutFirewallManagerRuleGroups", "cloudtrail:LookupEvents" ], "Condition": { "ArnNotLike": { "aws:PrincipalARN": { "Fn::If": [ "HasAdditionalPrincipalExceptions", { "Fn::Split": [ "|", { "Fn::Join": [ "|", [ { "Fn::Join": [ "", [ "arn:aws:iam::*:role/InnovationSandbox-", { "Ref": "Namespace" }, "*" ] ] }, { "Fn::Join": [ "", [ "arn:aws:iam::*:role/aws-reserved/sso.amazonaws.com/*AWSReservedSSO_", { "Ref": "Namespace" }, "_IsbAdmins*" ] ] }, "arn:aws:iam::*:role/stacksets-exec-*", "arn:aws:iam::*:role/AWSControlTowerExecution", { "Fn::Join": [ "|", { "Ref": "AdditionalPrincipalExceptions" } ] } ] ] } ] }, [ { "Fn::Join": [ "", [ "arn:aws:iam::*:role/InnovationSandbox-", { "Ref": "Namespace" }, "*" ] ] }, { "Fn::Join": [ "", [ "arn:aws:iam::*:role/aws-reserved/sso.amazonaws.com/*AWSReservedSSO_", { "Ref": "Namespace" }, "_IsbAdmins*" ] ] }, "arn:aws:iam::*:role/stacksets-exec-*", "arn:aws:iam::*:role/AWSControlTowerExecution" ] ] } } }, "Effect": "Deny", "Resource": "*", "Sid": "SecurityAndIsolationRestrictions" }, { "Action": [ "aws-portal:ModifyBilling", "aws-portal:ModifyPaymentMethods", "ce:CreateAnomalyMonitor", "ce:CreateAnomalySubscription", "ce:CreateCostCategoryDefinition", "ce:CreateNotificationSubscription", "ce:CreateReport", "ce:UpdatePreferences", "devicefarm:Purchase*", "devicefarm:RenewOffering", "dynamodb:Purchase*", "ec2:AcceptReservedInstancesExchangeQuote", "ec2:EnableIpamOrganizationAdminAccount", "ec2:ModifyReservedInstances", "ec2:Purchase*", "elasticache:Purchase*", "es:Purchase*", "glacier:Purchase*", "mediaconnect:Purchase*", "medialive:Purchase*", "rds:Purchase*", "redshift:Purchase*", "shield:AssociateDRTRole", "shield:CreateProtection", "shield:CreateSubscription", "shield:UpdateEmergencyContactSettings" ], "Condition": { "ArnNotLike": { "aws:PrincipalARN": { "Fn::If": [ "HasAdditionalPrincipalExceptions", { "Fn::Split": [ "|", { "Fn::Join": [ "|", [ { "Fn::Join": [ "", [ "arn:aws:iam::*:role/InnovationSandbox-", { "Ref": "Namespace" }, "*" ] ] }, { "Fn::Join": [ "", [ "arn:aws:iam::*:role/aws-reserved/sso.amazonaws.com/*AWSReservedSSO_", { "Ref": "Namespace" }, "_IsbAdmins*" ] ] }, "arn:aws:iam::*:role/stacksets-exec-*", "arn:aws:iam::*:role/AWSControlTowerExecution", { "Fn::Join": [ "|", { "Ref": "AdditionalPrincipalExceptions" } ] } ] ] } ] }, [ { "Fn::Join": [ "", [ "arn:aws:iam::*:role/InnovationSandbox-", { "Ref": "Namespace" }, "*" ] ] }, { "Fn::Join": [ "", [ "arn:aws:iam::*:role/aws-reserved/sso.amazonaws.com/*AWSReservedSSO_", { "Ref": "Namespace" }, "_IsbAdmins*" ] ] }, "arn:aws:iam::*:role/stacksets-exec-*", "arn:aws:iam::*:role/AWSControlTowerExecution" ] ] } } }, "Effect": "Deny", "Resource": "*", "Sid": "CostImplicationRestrictions" }, { "Action": [ "account:EnableRegion", "auditmanager:DeregisterOrganizationAdminAccount", "auditmanager:RegisterOrganizationAdminAccount", "backup:PutBackupVaultLockConfiguration", "bedrock-agentcore:*Registry*", "cassandra:UpdatePartitioner", "chime:*", "cloudhsm:*", "deepcomposer:AssociateCoupon", "directconnect:AllocateConnectionOnInterconnect", "directconnect:AllocateHostedConnection", "directconnect:AssociateHostedConnection", "directconnect:CreateInterconnect", "drs:CreateExtendedSourceServer", "elasticache:PurchaseReservedCacheNodesOffering", "events:CreatePartnerEventSource", "glacier:AbortVaultLock", "glacier:CompleteVaultLock", "glacier:InitiateVaultLock", "glacier:SetVaultAccessPolicy", "iotevents:PutLoggingOptions", "iotsitewise:CreateBulkImportJob", "lambda:CreateCodeSigningConfig", "license-manager:CreateLicenseConversionTaskForResource", "macie2:UpdateOrganizationConfiguration", "mediaConvert:CreateQueue", "medialive:ClaimDevice", "mgn:*", "robomaker:CreateDeploymentJob", "robomaker:CreateFleet", "robomaker:CreateRobot", "robomaker:DeregisterRobot", "robomaker:RegisterRobot", "robomaker:SyncDeploymentJob", "robomaker:UpdateRobotDeployment", "route53domains:*", "s3-object-lambda:PutObjectLegalHold", "s3-object-lambda:PutObjectRetention", "s3:PutObjectLegalHold", "ses:PutDeliverabilityDashboardOption", "storagegateway:*", "wam:*", "wellarchitected:UpdateGlobalSettings", "workmail:AssumeImpersonationRole", "workmail:CreateImpersonationRole", "workmail:UpdateImpersonationRole", "workspaces:ModifyAccount" ], "Condition": { "ArnNotLike": { "aws:PrincipalARN": { "Fn::If": [ "HasAdditionalPrincipalExceptions", { "Fn::Split": [ "|", { "Fn::Join": [ "|", [ { "Fn::Join": [ "", [ "arn:aws:iam::*:role/InnovationSandbox-", { "Ref": "Namespace" }, "*" ] ] }, { "Fn::Join": [ "", [ "arn:aws:iam::*:role/aws-reserved/sso.amazonaws.com/*AWSReservedSSO_", { "Ref": "Namespace" }, "_IsbAdmins*" ] ] }, "arn:aws:iam::*:role/stacksets-exec-*", "arn:aws:iam::*:role/AWSControlTowerExecution", { "Fn::Join": [ "|", { "Ref": "AdditionalPrincipalExceptions" } ] } ] ] } ] }, [ { "Fn::Join": [ "", [ "arn:aws:iam::*:role/InnovationSandbox-", { "Ref": "Namespace" }, "*" ] ] }, { "Fn::Join": [ "", [ "arn:aws:iam::*:role/aws-reserved/sso.amazonaws.com/*AWSReservedSSO_", { "Ref": "Namespace" }, "_IsbAdmins*" ] ] }, "arn:aws:iam::*:role/stacksets-exec-*", "arn:aws:iam::*:role/AWSControlTowerExecution" ] ] } } }, "Effect": "Deny", "Resource": "*", "Sid": "OperationalRestrictions" }, { "Action": "events:PutRule", "Effect": "Deny", "Resource": [ "arn:aws:events:*:*:rule/SIRGuardDutyRule", "arn:aws:events:*:*:rule/SIRSecurityHubRule" ], "Sid": "ProtectSIREventBridgeRules" } ], "Version": "2012-10-17" }, "Description": "Service Control Policy (SCP) to add restrictions for security, isolation, cost and operations related resources.", "Name": { "Fn::Join": [ "", [ { "Ref": "Namespace" }, "-InnovationSandboxRestrictionsScp" ] ] }, "Tags": [ { "Key": "aws-solutions:isb-id", "Value": { "Fn::Join": [ "", [ { "Ref": "Namespace" }, "_isb" ] ] } } ], "TargetIds": [ { "Fn::GetAtt": [ "InnovationSandboxAccountPoolOu", "Id" ] } ], "Type": "SERVICE_CONTROL_POLICY" }, "Metadata": { "aws:cdk:path": "InnovationSandbox-AccountPool/InnovationSandboxRestrictionsScp" } }, "InnovationSandboxProtectISBScp": { "Type": "AWS::Organizations::Policy", "Properties": { "Content": { "Statement": [ { "Action": "*", "Condition": { "ArnNotLike": { "aws:PrincipalARN": [ { "Fn::Join": [ "", [ "arn:aws:iam::*:role/InnovationSandbox-", { "Ref": "Namespace" }, "*" ] ] }, { "Fn::Join": [ "", [ "arn:aws:iam::*:role/aws-reserved/sso.amazonaws.com/*AWSReservedSSO_", { "Ref": "Namespace" }, "_IsbAdmins*" ] ] }, "arn:aws:iam::*:role/stacksets-exec-*", "arn:aws:iam::*:role/AWSControlTowerExecution" ] } }, "Effect": "Deny", "Resource": [ { "Fn::Join": [ "", [ "arn:aws:iam::*:role/InnovationSandbox-", { "Ref": "Namespace" }, "*" ] ] }, "arn:aws:iam::*:role/AWSReservedSSO*", { "Fn::Join": [ "", [ "arn:aws:*:*:*:*Isb-", { "Ref": "Namespace" }, "*" ] ] }, "arn:aws:iam::*:role/stacksets-exec-*", "arn:aws:iam::*:saml-provider/*AWSSSO*" ], "Sid": "ProtectIsbControlPlaneResources" }, { "Action": [ "resource-explorer-2:DeleteIndex", "resource-explorer-2:UpdateIndexType", "resource-explorer-2:AssociateDefaultView", "resource-explorer-2:DisassociateDefaultView" ], "Condition": { "ArnNotLike": { "aws:PrincipalARN": [ { "Fn::Join": [ "", [ "arn:aws:iam::*:role/InnovationSandbox-", { "Ref": "Namespace" }, "*" ] ] }, { "Fn::Join": [ "", [ "arn:aws:iam::*:role/aws-reserved/sso.amazonaws.com/*AWSReservedSSO_", { "Ref": "Namespace" }, "_IsbAdmins*" ] ] }, "arn:aws:iam::*:role/stacksets-exec-*", "arn:aws:iam::*:role/AWSControlTowerExecution" ] } }, "Effect": "Deny", "Resource": "*", "Sid": "ProtectIsbResourceExplorerIndex" }, { "Action": [ "resource-explorer-2:DeleteView", "resource-explorer-2:UpdateView" ], "Condition": { "ArnNotLike": { "aws:PrincipalARN": [ { "Fn::Join": [ "", [ "arn:aws:iam::*:role/InnovationSandbox-", { "Ref": "Namespace" }, "*" ] ] }, { "Fn::Join": [ "", [ "arn:aws:iam::*:role/aws-reserved/sso.amazonaws.com/*AWSReservedSSO_", { "Ref": "Namespace" }, "_IsbAdmins*" ] ] }, "arn:aws:iam::*:role/stacksets-exec-*", "arn:aws:iam::*:role/AWSControlTowerExecution" ] } }, "Effect": "Deny", "Resource": "arn:aws:resource-explorer-2:*:*:view/isb-post-cleanup-validator/*", "Sid": "ProtectIsbResourceExplorerValidatorView" }, { "Action": "*", "Condition": { "ArnNotLike": { "aws:PrincipalARN": [ "arn:aws:iam::*:role/AWSControlTowerExecution", "arn:aws:iam::*:role/stacksets-exec-*" ] } }, "Effect": "Deny", "Resource": [ "arn:aws:cloudtrail:*:*:trail/aws-controltower-*", "arn:aws:events:*:*:rule/aws-controltower-*", "arn:aws:events:*:*:rule/*AWSControlTower*", "arn:aws:lambda:*:*:function:aws-controltower-*", "arn:aws:logs:*:*:log-group:*aws-controltower*", "arn:aws:sns:*:*:aws-controltower-*", "arn:aws:iam::*:role/aws-controltower-*", "arn:aws:iam::*:role/*AWSControlTower*" ], "Sid": "ProtectControlTowerResources" }, { "Action": [ "config:DeleteConfigurationRecorder", "config:DeleteDeliveryChannel", "config:DeleteRetentionConfiguration", "config:PutConfigurationRecorder", "config:PutDeliveryChannel", "config:PutRetentionConfiguration", "config:StopConfigurationRecorder" ], "Condition": { "ArnNotLike": { "aws:PrincipalARN": "arn:aws:iam::*:role/AWSControlTowerExecution" } }, "Effect": "Deny", "Resource": "*", "Sid": "DenyConfigActions" }, { "Action": "config:*", "Condition": { "StringEquals": { "aws:ResourceTag/aws-control-tower": "managed-by-control-tower" }, "ArnNotLike": { "aws:PrincipalARN": "arn:aws:iam::*:role/AWSControlTowerExecution" } }, "Effect": "Deny", "Resource": "*", "Sid": "ProtectControlTowerTaggedConfigResources" }, { "Action": [ "config:TagResource", "config:UntagResource" ], "Condition": { "ForAnyValue:StringEquals": { "aws:TagKeys": "aws-control-tower" }, "ArnNotLike": { "aws:PrincipalARN": "arn:aws:iam::*:role/AWSControlTowerExecution" } }, "Effect": "Deny", "Resource": "*", "Sid": "DenyControlTowerConfigTagActions" } ], "Version": "2012-10-17" }, "Description": "Service Control Policy (SCP) for Innovation Sandbox to protect ISB control plane resources.", "Name": { "Fn::Join": [ "", [ { "Ref": "Namespace" }, "-InnovationSandboxProtectISBResourcesScp" ] ] }, "Tags": [ { "Key": "aws-solutions:isb-id", "Value": { "Fn::Join": [ "", [ { "Ref": "Namespace" }, "_isb" ] ] } } ], "TargetIds": [ { "Fn::GetAtt": [ "InnovationSandboxAccountPoolOu", "Id" ] } ], "Type": "SERVICE_CONTROL_POLICY" }, "Metadata": { "aws:cdk:path": "InnovationSandbox-AccountPool/InnovationSandboxProtectISBScp" } }, "InnovationSandboxLimitRegionsScp": { "Type": "AWS::Organizations::Policy", "Properties": { "Content": { "Statement": [ { "Action": "*", "Condition": { "StringNotEquals": { "aws:RequestedRegion": { "Ref": "IsbManagedRegions" } }, "ArnNotLike": { "Fn::If": [ "HasBedrockInferenceProfilePatterns", { "aws:PrincipalARN": { "Fn::If": [ "HasAdditionalPrincipalExceptions", { "Fn::Split": [ "|", { "Fn::Join": [ "|", [ { "Fn::Join": [ "", [ "arn:aws:iam::*:role/InnovationSandbox-", { "Ref": "Namespace" }, "*" ] ] }, { "Fn::Join": [ "", [ "arn:aws:iam::*:role/aws-reserved/sso.amazonaws.com/*AWSReservedSSO_", { "Ref": "Namespace" }, "_IsbAdmins*" ] ] }, "arn:aws:iam::*:role/stacksets-exec-*", "arn:aws:iam::*:role/AWSControlTowerExecution", { "Fn::Join": [ "|", { "Ref": "AdditionalPrincipalExceptions" } ] } ] ] } ] }, [ { "Fn::Join": [ "", [ "arn:aws:iam::*:role/InnovationSandbox-", { "Ref": "Namespace" }, "*" ] ] }, { "Fn::Join": [ "", [ "arn:aws:iam::*:role/aws-reserved/sso.amazonaws.com/*AWSReservedSSO_", { "Ref": "Namespace" }, "_IsbAdmins*" ] ] }, "arn:aws:iam::*:role/stacksets-exec-*", "arn:aws:iam::*:role/AWSControlTowerExecution" ] ] }, "bedrock:InferenceProfileArn": { "Ref": "BedrockInferenceProfilePatterns" } }, { "aws:PrincipalARN": { "Fn::If": [ "HasAdditionalPrincipalExceptions", { "Fn::Split": [ "|", { "Fn::Join": [ "|", [ { "Fn::Join": [ "", [ "arn:aws:iam::*:role/InnovationSandbox-", { "Ref": "Namespace" }, "*" ] ] }, { "Fn::Join": [ "", [ "arn:aws:iam::*:role/aws-reserved/sso.amazonaws.com/*AWSReservedSSO_", { "Ref": "Namespace" }, "_IsbAdmins*" ] ] }, "arn:aws:iam::*:role/stacksets-exec-*", "arn:aws:iam::*:role/AWSControlTowerExecution", { "Fn::Join": [ "|", { "Ref": "AdditionalPrincipalExceptions" } ] } ] ] } ] }, [ { "Fn::Join": [ "", [ "arn:aws:iam::*:role/InnovationSandbox-", { "Ref": "Namespace" }, "*" ] ] }, { "Fn::Join": [ "", [ "arn:aws:iam::*:role/aws-reserved/sso.amazonaws.com/*AWSReservedSSO_", { "Ref": "Namespace" }, "_IsbAdmins*" ] ] }, "arn:aws:iam::*:role/stacksets-exec-*", "arn:aws:iam::*:role/AWSControlTowerExecution" ] ] } } ] } }, "Effect": "Deny", "Resource": "*", "Sid": "DenyRegionAccess" } ], "Version": "2012-10-17" }, "Description": "Service Control Policy (SCP) for Innovation Sandbox to limit use of AWS Regions.", "Name": { "Fn::Join": [ "", [ { "Ref": "Namespace" }, "-InnovationSandboxLimitRegionsScp" ] ] }, "Tags": [ { "Key": "aws-solutions:isb-id", "Value": { "Fn::Join": [ "", [ { "Ref": "Namespace" }, "_isb" ] ] } } ], "TargetIds": [ { "Fn::GetAtt": [ "InnovationSandboxAccountPoolOu", "Id" ] } ], "Type": "SERVICE_CONTROL_POLICY" }, "Metadata": { "aws:cdk:path": "InnovationSandbox-AccountPool/InnovationSandboxLimitRegionsScp" } }, "InnovationSandboxWriteProtectionScp": { "Type": "AWS::Organizations::Policy", "Properties": { "Content": { "Statement": [ { "Action": "*", "Condition": { "ArnNotLike": { "aws:PrincipalARN": [ { "Fn::Join": [ "", [ "arn:aws:iam::*:role/InnovationSandbox-", { "Ref": "Namespace" }, "*" ] ] }, { "Fn::Join": [ "", [ "arn:aws:iam::*:role/aws-reserved/sso.amazonaws.com/*AWSReservedSSO_", { "Ref": "Namespace" }, "_IsbAdmins*" ] ] }, "arn:aws:iam::*:role/stacksets-exec-*", "arn:aws:iam::*:role/AWSControlTowerExecution" ] } }, "Effect": "Deny", "Resource": "*", "Sid": "DenyAllExceptIsbRoles" } ], "Version": "2012-10-17" }, "Description": "Service Control Policy (SCP) for Innovation Sandbox to restrict all resource to create or modify actions.", "Name": { "Fn::Join": [ "", [ { "Ref": "Namespace" }, "-InnovationSandboxWriteProtectionScp" ] ] }, "Tags": [ { "Key": "aws-solutions:isb-id", "Value": { "Fn::Join": [ "", [ { "Ref": "Namespace" }, "_isb" ] ] } } ], "TargetIds": [ { "Fn::GetAtt": [ "AvailableOu", "Id" ] }, { "Fn::GetAtt": [ "CleanUpOu", "Id" ] }, { "Fn::GetAtt": [ "QuarantineOu", "Id" ] }, { "Fn::GetAtt": [ "EntryOu", "Id" ] }, { "Fn::GetAtt": [ "ExitOu", "Id" ] } ], "Type": "SERVICE_CONTROL_POLICY" }, "Metadata": { "aws:cdk:path": "InnovationSandbox-AccountPool/InnovationSandboxWriteProtectionScp" } }, "OrgMgtRoleADB4C27C": { "Type": "AWS::IAM::Role", "Properties": { "AssumeRolePolicyDocument": { "Statement": [ { "Action": "sts:AssumeRole", "Condition": { "ArnEquals": { "aws:PrincipalArn": { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":iam::", { "Ref": "HubAccountId" }, ":role/InnovationSandbox-", { "Ref": "Namespace" }, "-IntermediateRole" ] ] } } }, "Effect": "Allow", "Principal": { "AWS": { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":iam::", { "Ref": "HubAccountId" }, ":root" ] ] } } } ], "Version": "2012-10-17" }, "Description": "Role to be assumed for operations on the org management account", "RoleName": { "Fn::Join": [ "", [ "InnovationSandbox-", { "Ref": "Namespace" }, "-OrgMgtRole" ] ] }, "Tags": [ { "Key": "aws-solutions:isb-id", "Value": { "Fn::Join": [ "", [ { "Ref": "Namespace" }, "_isb" ] ] } } ] }, "Metadata": { "aws:cdk:path": "InnovationSandbox-AccountPool/OrgMgtRole/Resource", "guard": { "SuppressedRules": [ "CFN_NO_EXPLICIT_RESOURCE_NAMES" ] } } }, "OrganizationsPolicyFD65B3A6": { "Type": "AWS::IAM::Policy", "Properties": { "PolicyDocument": { "Statement": [ { "Action": [ "organizations:ListOrganizationalUnitsForParent", "organizations:ListAccountsForParent" ], "Effect": "Allow", "Resource": [ { "Fn::GetAtt": [ "InnovationSandboxAccountPoolOu", "Arn" ] }, { "Fn::GetAtt": [ "AvailableOu", "Arn" ] }, { "Fn::GetAtt": [ "ActiveOu", "Arn" ] }, { "Fn::GetAtt": [ "CleanUpOu", "Arn" ] }, { "Fn::GetAtt": [ "QuarantineOu", "Arn" ] }, { "Fn::GetAtt": [ "EntryOu", "Arn" ] }, { "Fn::GetAtt": [ "ExitOu", "Arn" ] }, { "Fn::GetAtt": [ "FrozenOu", "Arn" ] } ] }, { "Action": "organizations:MoveAccount", "Effect": "Allow", "Resource": [ { "Fn::GetAtt": [ "AvailableOu", "Arn" ] }, { "Fn::GetAtt": [ "ActiveOu", "Arn" ] }, { "Fn::GetAtt": [ "CleanUpOu", "Arn" ] }, { "Fn::GetAtt": [ "QuarantineOu", "Arn" ] }, { "Fn::GetAtt": [ "EntryOu", "Arn" ] }, { "Fn::GetAtt": [ "ExitOu", "Arn" ] }, { "Fn::GetAtt": [ "FrozenOu", "Arn" ] }, { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":organizations::", { "Ref": "AWS::AccountId" }, ":account/", { "Fn::Select": [ 1, { "Fn::Split": [ "/", { "Fn::GetAtt": [ "InnovationSandboxAccountPoolOu", "Arn" ] } ] } ] }, "/*" ] ] }, { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":organizations::", { "Ref": "AWS::AccountId" }, ":root/", { "Fn::Select": [ 1, { "Fn::Split": [ "/", { "Fn::GetAtt": [ "InnovationSandboxAccountPoolOu", "Arn" ] } ] } ] }, "/*" ] ] } ] }, { "Action": "organizations:DescribeAccount", "Effect": "Allow", "Resource": { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":organizations::", { "Ref": "AWS::AccountId" }, ":account/", { "Fn::Select": [ 1, { "Fn::Split": [ "/", { "Fn::GetAtt": [ "InnovationSandboxAccountPoolOu", "Arn" ] } ] } ] }, "/*" ] ] } }, { "Action": [ "organizations:TagResource", "organizations:UntagResource" ], "Condition": { "ForAllValues:StringEquals": { "aws:TagKeys": [ { "Fn::Join": [ "", [ "ISB-", { "Ref": "Namespace" }, ":LeaseId" ] ] }, { "Fn::Join": [ "", [ "ISB-", { "Ref": "Namespace" }, ":CostReportGroup" ] ] }, { "Fn::Join": [ "", [ "ISB-", { "Ref": "Namespace" }, ":LeaseTemplate" ] ] }, { "Fn::Join": [ "", [ "ISB-", { "Ref": "Namespace" }, ":User" ] ] }, { "Fn::Join": [ "", [ "ISB-", { "Ref": "Namespace" }, ":Status" ] ] } ] } }, "Effect": "Allow", "Resource": { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":organizations::", { "Ref": "AWS::AccountId" }, ":account/", { "Fn::Select": [ 1, { "Fn::Split": [ "/", { "Fn::GetAtt": [ "InnovationSandboxAccountPoolOu", "Arn" ] } ] } ] }, "/*" ] ] } } ], "Version": "2012-10-17" }, "PolicyName": "OrganizationsPolicyFD65B3A6", "Roles": [ { "Ref": "OrgMgtRoleADB4C27C" } ] }, "Metadata": { "aws:cdk:path": "InnovationSandbox-AccountPool/OrganizationsPolicy/Resource" } }, "CostExplorerPolicy2242901C": { "Type": "AWS::IAM::Policy", "Properties": { "PolicyDocument": { "Statement": [ { "Action": [ "ce:GetCostAndUsage", "ce:UpdateCostAllocationTagsStatus", "ce:ListCostAllocationTags" ], "Effect": "Allow", "Resource": "*" } ], "Version": "2012-10-17" }, "PolicyName": "CostExplorerPolicy2242901C", "Roles": [ { "Ref": "OrgMgtRoleADB4C27C" } ] }, "Metadata": { "aws:cdk:path": "InnovationSandbox-AccountPool/CostExplorerPolicy/Resource" } }, "AccountPoolConfigurationCF37E5E0": { "Type": "AWS::SSM::Parameter", "Properties": { "Description": "The Account pool configuration for Innovation Sandbox", "Name": { "Fn::Join": [ "", [ "InnovationSandbox_", { "Ref": "Namespace" }, "_AccountPool_Configuration" ] ] }, "Tags": { "aws-solutions:isb-id": { "Fn::Join": [ "", [ { "Ref": "Namespace" }, "_isb" ] ] } }, "Tier": "Advanced", "Type": "String", "Value": { "Fn::Join": [ "", [ "{\"sandboxOuId\":\"", { "Fn::GetAtt": [ "InnovationSandboxAccountPoolOu", "Id" ] }, "\",\"availableOuId\":\"", { "Fn::GetAtt": [ "AvailableOu", "Id" ] }, "\",\"activeOuId\":\"", { "Fn::GetAtt": [ "ActiveOu", "Id" ] }, "\",\"frozenOuId\":\"", { "Fn::GetAtt": [ "FrozenOu", "Id" ] }, "\",\"cleanupOuId\":\"", { "Fn::GetAtt": [ "CleanUpOu", "Id" ] }, "\",\"quarantineOuId\":\"", { "Fn::GetAtt": [ "QuarantineOu", "Id" ] }, "\",\"entryOuId\":\"", { "Fn::GetAtt": [ "EntryOu", "Id" ] }, "\",\"exitOuId\":\"", { "Fn::GetAtt": [ "ExitOu", "Id" ] }, "\",\"solutionVersion\":\"", { "Fn::FindInMap": [ "Mapping", "context", "version", { "DefaultValue": "" } ] }, "\",\"supportedSchemas\":\"[\\\"1\\\"]\",\"isbManagedRegions\":\"", { "Fn::Join": [ ",", { "Ref": "IsbManagedRegions" } ] }, "\",\"additionalAllowedServices\":\"", { "Fn::Join": [ ",", { "Ref": "AdditionalAllowedServices" } ] }, "\",\"bedrockInferenceProfilePatterns\":\"", { "Fn::Join": [ ",", { "Ref": "BedrockInferenceProfilePatterns" } ] }, "\"}" ] ] } }, "Metadata": { "aws:cdk:path": "InnovationSandbox-AccountPool/AccountPoolConfiguration/Resource" } }, "AccountPoolConfigParameterShare": { "Type": "AWS::RAM::ResourceShare", "Properties": { "AllowExternalPrincipals": false, "Name": { "Fn::Join": [ "", [ "Isb-", { "Ref": "Namespace" }, "-AccountPoolConfigShare" ] ] }, "PermissionArns": [ "arn:aws:ram::aws:permission/AWSRAMDefaultPermissionSSMParameterReadOnly" ], "Principals": [ { "Ref": "HubAccountId" } ], "ResourceArns": [ { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":ssm:", { "Ref": "AWS::Region" }, ":", { "Ref": "AWS::AccountId" }, ":parameter/", { "Ref": "AccountPoolConfigurationCF37E5E0" } ] ] } ], "Tags": [ { "Key": "aws-solutions:isb-id", "Value": { "Fn::Join": [ "", [ { "Ref": "Namespace" }, "_isb" ] ] } } ] }, "Metadata": { "aws:cdk:path": "InnovationSandbox-AccountPool/AccountPoolConfigParameterShare" } }, "IsbStackSet": { "Type": "AWS::CloudFormation::StackSet", "Properties": { "AutoDeployment": { "Enabled": true, "RetainStacksOnAccountRemoval": false }, "Capabilities": [ "CAPABILITY_NAMED_IAM" ], "Description": "StackSet for Innovation Sandbox", "ManagedExecution": { "Active": true }, "OperationPreferences": { "ConcurrencyMode": "SOFT_FAILURE_TOLERANCE", "FailureTolerancePercentage": 100, "MaxConcurrentPercentage": 100, "RegionConcurrencyType": "PARALLEL" }, "Parameters": [ { "ParameterKey": "Namespace", "ParameterValue": { "Ref": "Namespace" } }, { "ParameterKey": "HubAccountId", "ParameterValue": { "Ref": "HubAccountId" } } ], "PermissionModel": "SERVICE_MANAGED", "StackInstancesGroup": [ { "DeploymentTargets": { "OrganizationalUnitIds": [ { "Fn::GetAtt": [ "InnovationSandboxAccountPoolOu", "Id" ] } ] }, "Regions": [ { "Ref": "AWS::Region" } ] } ], "StackSetName": { "Fn::Join": [ "", [ "Isb-", { "Ref": "Namespace" }, "-SandboxAccountResources" ] ] }, "Tags": [ { "Key": "aws-solutions:isb-id", "Value": { "Fn::Join": [ "", [ { "Ref": "Namespace" }, "_isb" ] ] } } ], "TemplateURL": { "Fn::Sub": "https://s3.${AWS::Region}.${AWS::URLSuffix}/solutions-${AWS::Region}/innovation-sandbox-on-aws/v1.3.0/asset.911496af86cabaea67c537a09aff2b1c978f8052b12da18e5f1c559567a6055c.json" } }, "Metadata": { "aws:cdk:path": "InnovationSandbox-AccountPool/IsbStackSet" } }, "CostAllocationTagActivatorFunctionRole1DE7A39F": { "Type": "AWS::IAM::Role", "Properties": { "AssumeRolePolicyDocument": { "Statement": [ { "Action": "sts:AssumeRole", "Effect": "Allow", "Principal": { "Service": "lambda.amazonaws.com" } } ], "Version": "2012-10-17" }, "Tags": [ { "Key": "aws-solutions:isb-id", "Value": { "Fn::Join": [ "", [ { "Ref": "Namespace" }, "_isb" ] ] } } ] }, "Metadata": { "aws:cdk:path": "InnovationSandbox-AccountPool/CostAllocationTagActivator/CostAllocationTagActivator/FunctionRole/Resource" } }, "CostAllocationTagActivatorFunctionRoleDefaultPolicy6801705B": { "Type": "AWS::IAM::Policy", "Properties": { "PolicyDocument": { "Statement": [ { "Action": [ "xray:PutTraceSegments", "xray:PutTelemetryRecords" ], "Effect": "Allow", "Resource": "*" }, { "Action": [ "logs:CreateLogStream", "logs:PutLogEvents" ], "Effect": "Allow", "Resource": { "Fn::GetAtt": [ "ISBLogGroupCustomResources63629E09", "Arn" ] } }, { "Action": "ce:UpdateCostAllocationTagsStatus", "Effect": "Allow", "Resource": "*" } ], "Version": "2012-10-17" }, "PolicyName": "CostAllocationTagActivatorFunctionRoleDefaultPolicy6801705B", "Roles": [ { "Ref": "CostAllocationTagActivatorFunctionRole1DE7A39F" } ] }, "Metadata": { "aws:cdk:path": "InnovationSandbox-AccountPool/CostAllocationTagActivator/CostAllocationTagActivator/FunctionRole/DefaultPolicy/Resource" } }, "CostAllocationTagActivatorFunctionBF9E923D": { "Type": "AWS::Lambda::Function", "Properties": { "Architectures": [ "arm64" ], "Code": { "S3Bucket": { "Fn::Sub": "solutions-${AWS::Region}" }, "S3Key": "innovation-sandbox-on-aws/v1.3.0/asset.0581f036d15cd41f221cb2c9eb42ead5ed1fee079754f240fd0940187bd563b7.zip" }, "Description": "Custom resource lambda that activates the cost allocation tag", "Environment": { "Variables": { "NODE_OPTIONS": "--enable-source-maps", "USER_AGENT_EXTRA": "AwsSolution/SO0284/v1.3.0", "POWERTOOLS_SERVICE_NAME": "innovation-sandbox", "AWS_XRAY_CONTEXT_MISSING": "IGNORE_ERROR", "ISB_TAG_NAME": "aws-solutions:isb-id" } }, "FunctionName": { "Fn::Join": [ "", [ "ISB-CostAllocationTagActivator-", { "Ref": "Namespace" } ] ] }, "Handler": "index.handler", "Layers": [ { "Ref": "CostAllocationTagActivatorISBLambdaLayerInnovationSandboxAccountPoolDependenciesLayerVersion6803FFB4" }, { "Ref": "CostAllocationTagActivatorISBLambdaLayerInnovationSandboxAccountPoolCommonLayerVersion50519BCF" } ], "LoggingConfig": { "ApplicationLogLevel": "INFO", "LogFormat": "JSON", "LogGroup": { "Ref": "ISBLogGroupCustomResources63629E09" }, "SystemLogLevel": "INFO" }, "MemorySize": 1024, "Role": { "Fn::GetAtt": [ "CostAllocationTagActivatorFunctionRole1DE7A39F", "Arn" ] }, "Runtime": "nodejs24.x", "Tags": [ { "Key": "aws-solutions:isb-id", "Value": { "Fn::Join": [ "", [ { "Ref": "Namespace" }, "_isb" ] ] } } ], "Timeout": 60, "TracingConfig": { "Mode": "Active" } }, "DependsOn": [ "CostAllocationTagActivatorFunctionRoleDefaultPolicy6801705B", "CostAllocationTagActivatorFunctionRole1DE7A39F" ], "Metadata": { "aws:cdk:path": "InnovationSandbox-AccountPool/CostAllocationTagActivator/CostAllocationTagActivator/Function/Resource", "aws:asset:path": "asset.0581f036d15cd41f221cb2c9eb42ead5ed1fee079754f240fd0940187bd563b7", "aws:asset:is-bundled": true, "aws:asset:property": "Code", "guard": { "SuppressedRules": [ "LAMBDA_INSIDE_VPC", "LAMBDA_CONCURRENCY_CHECK" ] } } }, "CostAllocationTagActivatorIsbProviderframeworkonEventServiceRoleBB4B75CD": { "Type": "AWS::IAM::Role", "Properties": { "AssumeRolePolicyDocument": { "Statement": [ { "Action": "sts:AssumeRole", "Effect": "Allow", "Principal": { "Service": "lambda.amazonaws.com" } } ], "Version": "2012-10-17" }, "ManagedPolicyArns": [ { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":iam::aws:policy/service-role/AWSLambdaBasicExecutionRole" ] ] } ], "Tags": [ { "Key": "aws-solutions:isb-id", "Value": { "Fn::Join": [ "", [ { "Ref": "Namespace" }, "_isb" ] ] } } ] }, "Metadata": { "aws:cdk:path": "InnovationSandbox-AccountPool/CostAllocationTagActivator/CostAllocationTagActivator/IsbProvider/framework-onEvent/ServiceRole/Resource" } }, "CostAllocationTagActivatorIsbProviderframeworkonEventServiceRoleDefaultPolicyF20A12B0": { "Type": "AWS::IAM::Policy", "Properties": { "PolicyDocument": { "Statement": [ { "Action": "lambda:InvokeFunction", "Effect": "Allow", "Resource": [ { "Fn::GetAtt": [ "CostAllocationTagActivatorFunctionBF9E923D", "Arn" ] }, { "Fn::Join": [ "", [ { "Fn::GetAtt": [ "CostAllocationTagActivatorFunctionBF9E923D", "Arn" ] }, ":*" ] ] } ] }, { "Action": "lambda:GetFunction", "Effect": "Allow", "Resource": { "Fn::GetAtt": [ "CostAllocationTagActivatorFunctionBF9E923D", "Arn" ] } } ], "Version": "2012-10-17" }, "PolicyName": "CostAllocationTagActivatorIsbProviderframeworkonEventServiceRoleDefaultPolicyF20A12B0", "Roles": [ { "Ref": "CostAllocationTagActivatorIsbProviderframeworkonEventServiceRoleBB4B75CD" } ] }, "Metadata": { "aws:cdk:path": "InnovationSandbox-AccountPool/CostAllocationTagActivator/CostAllocationTagActivator/IsbProvider/framework-onEvent/ServiceRole/DefaultPolicy/Resource" } }, "CostAllocationTagActivatorIsbProviderframeworkonEvent12245C05": { "Type": "AWS::Lambda::Function", "Properties": { "Code": { "S3Bucket": { "Fn::Sub": "solutions-${AWS::Region}" }, "S3Key": "innovation-sandbox-on-aws/v1.3.0/asset.e16ffb3b34af185b8b30c88fdb19faa13b6c42bb38580485c4e84b384ee48b63.zip" }, "Description": "AWS CDK resource provider framework - onEvent (InnovationSandbox-AccountPool/CostAllocationTagActivator/CostAllocationTagActivator/IsbProvider)", "Environment": { "Variables": { "USER_ON_EVENT_FUNCTION_ARN": { "Fn::GetAtt": [ "CostAllocationTagActivatorFunctionBF9E923D", "Arn" ] } } }, "Handler": "framework.onEvent", "LoggingConfig": { "ApplicationLogLevel": "FATAL", "LogFormat": "JSON", "LogGroup": { "Ref": "ISBLogGroupCustomResources63629E09" } }, "Role": { "Fn::GetAtt": [ "CostAllocationTagActivatorIsbProviderframeworkonEventServiceRoleBB4B75CD", "Arn" ] }, "Runtime": "nodejs24.x", "Tags": [ { "Key": "aws-solutions:isb-id", "Value": { "Fn::Join": [ "", [ { "Ref": "Namespace" }, "_isb" ] ] } } ], "Timeout": 900 }, "DependsOn": [ "CostAllocationTagActivatorIsbProviderframeworkonEventServiceRoleDefaultPolicyF20A12B0", "CostAllocationTagActivatorIsbProviderframeworkonEventServiceRoleBB4B75CD" ], "Metadata": { "aws:cdk:path": "InnovationSandbox-AccountPool/CostAllocationTagActivator/CostAllocationTagActivator/IsbProvider/framework-onEvent/Resource", "aws:asset:path": "asset.e16ffb3b34af185b8b30c88fdb19faa13b6c42bb38580485c4e84b384ee48b63", "aws:asset:is-bundled": false, "aws:asset:property": "Code", "guard": { "SuppressedRules": [ "LAMBDA_INSIDE_VPC", "LAMBDA_CONCURRENCY_CHECK" ] } } }, "CostAllocationTagActivatorIsbCustomResourceDADB260C": { "Type": "Custom::CostAllocationTag", "Properties": { "ServiceToken": { "Fn::GetAtt": [ "CostAllocationTagActivatorIsbProviderframeworkonEvent12245C05", "Arn" ] } }, "UpdateReplacePolicy": "Delete", "DeletionPolicy": "Delete", "Metadata": { "aws:cdk:path": "InnovationSandbox-AccountPool/CostAllocationTagActivator/CostAllocationTagActivator/IsbCustomResource/Default" } }, "CostAllocationTagActivatorISBLambdaLayerInnovationSandboxAccountPoolCommonLayerVersion50519BCF": { "Type": "AWS::Lambda::LayerVersion", "Properties": { "CompatibleArchitectures": [ "arm64" ], "CompatibleRuntimes": [ "nodejs24.x" ], "Content": { "S3Bucket": { "Fn::Sub": "solutions-${AWS::Region}" }, "S3Key": "innovation-sandbox-on-aws/v1.3.0/asset.1f5cc6c90f95b6fb7be25037f56001dc1897d61f443e7e7d02106042e83d7cdb.zip" }, "Description": "Common lib for Innovation Sandbox on AWS" }, "Metadata": { "aws:cdk:path": "InnovationSandbox-AccountPool/CostAllocationTagActivator/ISB-Lambda-Layer-InnovationSandbox-AccountPool/CommonLayerVersion/Resource", "aws:asset:path": "asset.1f5cc6c90f95b6fb7be25037f56001dc1897d61f443e7e7d02106042e83d7cdb", "aws:asset:is-bundled": false, "aws:asset:property": "Content" } }, "CostAllocationTagActivatorISBLambdaLayerInnovationSandboxAccountPoolDependenciesLayerVersion6803FFB4": { "Type": "AWS::Lambda::LayerVersion", "Properties": { "CompatibleArchitectures": [ "arm64" ], "CompatibleRuntimes": [ "nodejs24.x" ], "Content": { "S3Bucket": { "Fn::Sub": "solutions-${AWS::Region}" }, "S3Key": "innovation-sandbox-on-aws/v1.3.0/asset.8e15abb3317296d7d4308c048fbc129062e3aa7565553a2d0f650d6e9c3801cc.zip" }, "Description": "Third party runtime dependencies for Innovation Sandbox on AWS" }, "Metadata": { "aws:cdk:path": "InnovationSandbox-AccountPool/CostAllocationTagActivator/ISB-Lambda-Layer-InnovationSandbox-AccountPool/DependenciesLayerVersion/Resource", "aws:asset:path": "asset.8e15abb3317296d7d4308c048fbc129062e3aa7565553a2d0f650d6e9c3801cc", "aws:asset:is-bundled": false, "aws:asset:property": "Content" } }, "IsbKmsKeyInnovationSandboxAccountPool0065BC85": { "Type": "AWS::KMS::Key", "Properties": { "Description": "Encryption Key for Innovation Sandbox: InnovationSandbox-AccountPool", "EnableKeyRotation": true, "KeyPolicy": { "Statement": [ { "Action": "kms:*", "Effect": "Allow", "Principal": { "AWS": { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":iam::", { "Ref": "AWS::AccountId" }, ":root" ] ] } }, "Resource": "*" }, { "Action": [ "kms:Decrypt", "kms:Encrypt", "kms:ReEncrypt*", "kms:GenerateDataKey*" ], "Effect": "Allow", "Principal": { "Service": "logs.amazonaws.com" }, "Resource": "*" } ], "Version": "2012-10-17" }, "Tags": [ { "Key": "aws-solutions:isb-id", "Value": { "Fn::Join": [ "", [ { "Ref": "Namespace" }, "_isb" ] ] } } ] }, "UpdateReplacePolicy": "Retain", "DeletionPolicy": "Retain", "Metadata": { "aws:cdk:path": "InnovationSandbox-AccountPool/IsbKmsKey-InnovationSandbox-AccountPool/Resource" } }, "IsbKmsKeyInnovationSandboxAccountPoolAliasB9DAB86A": { "Type": "AWS::KMS::Alias", "Properties": { "AliasName": { "Fn::Join": [ "", [ "alias/AwsSolutions/InnovationSandbox/", { "Ref": "Namespace" }, "/InnovationSandbox-AccountPool" ] ] }, "TargetKeyId": { "Fn::GetAtt": [ "IsbKmsKeyInnovationSandboxAccountPool0065BC85", "Arn" ] } }, "Metadata": { "aws:cdk:path": "InnovationSandbox-AccountPool/IsbKmsKey-InnovationSandbox-AccountPool/Alias/Resource" } }, "ISBLogGroupCustomResources63629E09": { "Type": "AWS::Logs::LogGroup", "Properties": { "KmsKeyId": { "Fn::GetAtt": [ "IsbKmsKeyInnovationSandboxAccountPool0065BC85", "Arn" ] }, "RetentionInDays": { "Fn::FindInMap": [ "Mapping", "context", "cloudWatchLogRetentionInDays", { "DefaultValue": "" } ] }, "Tags": [ { "Key": "aws-solutions:isb-id", "Value": { "Fn::Join": [ "", [ { "Ref": "Namespace" }, "_isb" ] ] } } ] }, "UpdateReplacePolicy": "Retain", "DeletionPolicy": "Retain", "Metadata": { "aws:cdk:path": "InnovationSandbox-AccountPool/ISBLogGroup-CustomResources/Resource", "guard": { "SuppressedRules": [ "CW_LOGGROUP_RETENTION_PERIOD_CHECK" ] } } }, "CDKMetadata": { "Type": "AWS::CDK::Metadata", "Properties": { "Analytics": "v2:deflate64:H4sIAAAAAAAA/1VQTW/CMAz9LdyDh4rEHSpth7ENUW3XyqRuF5oPFKcgVuW/TwkMdafn915s57mAYrWCxQwvPJdNP9fqAGMVUPaibO0OPRoK5BMpnW1UUM4KvHA9Ot+hVT+YFIaxbO3HREH9aVXIM5xW8hqFQgPj3mlKYsabM33DbNJ2r2z3b/WDROHRQBpA7AYvqfpGT4KXNTJTYFgnELyEzSB7ChtkElK7oWmdN/lnqTsHrCgIjebQYG1dQ0eG9wzPg5U55s3M0R7ao9jilfwXeU6kbO2UR9EbhvGVcrgEa62QE8lFFNp1DOPWdS/eDafcf69jTOwNTydlO5HjVAG7ROTAwZna36Mz7Lw7qyadKDt/NxGT+0SRssGRn85FAUUBi9mRlZr7wQZlCPY3/AWRPLsyBwIAAA==" }, "Metadata": { "aws:cdk:path": "InnovationSandbox-AccountPool/CDKMetadata/Default" }, "Condition": "CDKMetadataAvailable" } }, "Mappings": { "Mapping": { "context": { "solutionName": "innovation-sandbox-on-aws", "solutionId": "SO0284", "version": "v1.3.0", "distOutputBucket": "solutions", "publicEcrRegistry": "public.ecr.aws/aws-solutions", "publicEcrTag": "v1.3.0", "deploymentMode": "prod", "stackPrefix": "InnovationSandbox", "cloudWatchLogRetentionInDays": 90, "s3LogsArchiveRetentionInDays": 365, "s3LogsGlacierRetentionInDays": 2555, "apiThrottlingRateLimit": 100, "apiThrottlingBurstLimit": 200, "cognitoAccessTokenValidityMinutes": 60, "cognitoIdTokenValidityMinutes": 60, "cognitoRefreshTokenValidityDays": 7, "bucketPrefix": "innovation-sandbox-on-aws/v1.3.0/asset." } } } }