{ "Description": "(SO0284-ComputeStack) innovation-sandbox-on-aws v1.3.0", "Metadata": { "AWS::CloudFormation::Interface": { "ParameterLabels": { "Namespace": { "default": "Namespace" }, "OrgMgtAccountId": { "default": "Org Management Account Id" }, "IdcAccountId": { "default": "IDC Account Id" }, "AllowListedIPRanges": { "default": "Allow Listed IP Ranges" }, "UseStableTagging": { "default": "Use Stable Tagging" }, "AcceptSolutionTermsOfUse": { "default": "Accept Solution Terms of Use" }, "CustomDomainName": { "default": "Custom Domain Name (Optional)" }, "CustomDomainCertificateArn": { "default": "Custom Domain Certificate ARN (Optional)" } }, "ParameterGroups": [ { "Label": { "default": "Compute Stack Configuration" }, "Parameters": [ "Namespace", "OrgMgtAccountId", "IdcAccountId", "AllowListedIPRanges", "UseStableTagging", "AcceptSolutionTermsOfUse", "CustomDomainName", "CustomDomainCertificateArn" ] } ] } }, "Parameters": { "Namespace": { "Type": "String", "Default": "myisb", "AllowedPattern": "^[0-9a-zA-Z]{3,8}$", "Description": "The namespace for this deployment of Innovation Sandbox (must be the same for all member stacks). Alphanumeric characters of length between 3 and 8" }, "OrgMgtAccountId": { "Type": "String", "AllowedPattern": "^[0-9]{12}$", "Description": "The AWS Account Id of the org's management account where the account pool stack is deployed" }, "IdcAccountId": { "Type": "String", "AllowedPattern": "^[0-9]{12}$", "Description": "The AWS Account Id where the IAM Identity Center is configured" }, "AllowListedIPRanges": { "Type": "CommaDelimitedList", "Default": "0.0.0.0/1,128.0.0.0/1", "AllowedPattern": "^((\\d{1,3}\\.){3}\\d{1,3}/([0-9]|[1-2][0-9]|3[0-2]))(\\s*,\\s*((\\d{1,3}\\.){3}\\d{1,3}/([0-9]|[1-2][0-9]|3[0-2])))*$", "Description": "Comma separated list of CIDR ranges that allow access to the API. To allow all the entire internet, leave the default 0.0.0.0/1,128.0.0.0/1" }, "UseStableTagging": { "Type": "String", "Default": "Yes", "AllowedValues": [ "Yes", "No" ], "Description": "Automatically use the most up to date and secure account cleaner image up until the next minor release. Selecting 'No' will pull the image as originally released, without any security updates." }, "AcceptSolutionTermsOfUse": { "Type": "String", "AllowedPattern": "^Accept$", "ConstraintDescription": "You must enter \"Accept\" to deploy this template", "Description": "The Innovation Sandbox on AWS (\"ISB\") allows you to experiment with AWS resources in non-production accounts. Customers are responsible for making their own independent assessment of the information in this document. This document: (a) is for informational purposes only, (b) represents AWS current product offerings and practices, which are subject to change without notice, and (c) does not create any commitments or assurances from AWS and its affiliates, suppliers or licensors. AWS products or services including ISB are provided \"as is\" and AWS does not make any warranties, representations, or conditions of any kind, whether express or implied about ISB. AWS responsibilities and liabilities to its customers are controlled by AWS agreements, and this document is not part of, nor does it modify, any agreement between AWS and its customers.\n\nYou assume all responsibility for your use of ISB and making your own independent assessments of ISB, as well as any compliance with any additional terms, licenses, laws, rules, regulations, policies, or standards that apply to you, and, your use of ISB is subject to the AWS Shared Responsibility Model.\n\nThese Terms of Use supplement, and do not modify, any other existing agreements between you and AWS.\n\n* Non-Production Environments Only: The ISB solution is for use only for experiments in a non-production environment and may make irreversible changes to your environment, such as terminating AWS resources. It is not for use in production accounts.\n* Limitations of Cost Control Mechanisms: AWS makes no guarantees that usage cost will never exceed the budget limit set in ISB, and ISB may not prevent spend from going over the budget in all cases.\n* May Not Terminate All AWS Resources: In certain limited situations, ISB may not delete all AWS Resources and AWS will attempt to notify you that manual intervention is necessary for these accounts. These accounts could continue to incur costs until manually resolved by you. AWS makes no guarantees regarding the automatic termination of these resources by ISB and you are responsible for all fees in cases where ISB does not automatically terminate resources.\n* No Third-Party Use: ISB allows you to provide your own AWS accounts to internal end-users for learning and experimentation. You may not provide your AWS accounts to third-party users (such as other companies or public users) as this may grant third-party users access to your AWS resources.\n* Manually Adding New Users: If you have manually added additional users to an AWS account which has already been granted to a sandbox user by ISB, it is your responsibility to ensure deletion of the user’s access after their sandbox use.\n* Fraud and Abuse Detection: You are responsible for monitoring your sandbox account to detect any cases of potential fraud, abuse, or misuse.\n\nTo proceed with the deployment, please enter \"Accept\" to confirm your agreement to these terms.\n" }, "CustomDomainName": { "Type": "String", "Default": "", "AllowedPattern": "^$|^([a-zA-Z0-9]([a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?\\.)+[a-zA-Z]{2,63}$", "ConstraintDescription": "Must be a single domain like isb.example.com (no https://, no path, no '*'), or empty", "Description": "A single fully-qualified domain to serve ISB on, e.g. isb.example.com. Provide Custom Domain Certificate ARN as well to attach it (with TLS) to the ISB CloudFront distribution. If you front ISB with your own edge/proxy, set this to your public domain and leave the certificate ARN empty. No wildcards, scheme, or path. Leave empty to use the default CloudFront URL." }, "CustomDomainCertificateArn": { "Type": "String", "Default": "", "AllowedPattern": "^$|^arn:aws[a-zA-Z-]*:acm:us-east-1:[0-9]{12}:certificate/[0-9a-fA-F-]+$", "ConstraintDescription": "Must be an ACM certificate ARN in us-east-1, or empty", "Description": "ARN of an existing ACM certificate that covers the Custom Domain Name (a wildcard cert is fine). The certificate must be in us-east-1, because CloudFront only reads certificates from that Region regardless of where this stack is deployed. Provide this to serve the domain on the ISB CloudFront distribution. Leave empty if you terminate TLS on your own edge/proxy." } }, "Resources": { "IsbSpokeConfigJsonParamResolverParseJsonConfigurationFunctionRoleAD0AD111": { "Type": "AWS::IAM::Role", "Properties": { "AssumeRolePolicyDocument": { "Statement": [ { "Action": "sts:AssumeRole", "Effect": "Allow", "Principal": { "Service": "lambda.amazonaws.com" } } ], "Version": "2012-10-17" }, "Tags": [ { "Key": "aws-solutions:isb-id", "Value": { "Fn::Join": [ "", [ { "Ref": "Namespace" }, "_isb" ] ] } } ] }, "Metadata": { "aws:cdk:path": "InnovationSandbox-Compute/IsbSpokeConfigJsonParamResolver/ParseJsonConfiguration/FunctionRole/Resource" } }, "IsbSpokeConfigJsonParamResolverParseJsonConfigurationFunctionRoleDefaultPolicy5140CE0C": { "Type": "AWS::IAM::Policy", "Properties": { "PolicyDocument": { "Statement": [ { "Action": [ "xray:PutTraceSegments", "xray:PutTelemetryRecords" ], "Effect": "Allow", "Resource": "*" }, { "Action": [ "logs:CreateLogStream", "logs:PutLogEvents" ], "Effect": "Allow", "Resource": { "Fn::GetAtt": [ "ISBLogGroupCustomResources63629E09", "Arn" ] } } ], "Version": "2012-10-17" }, "PolicyName": "IsbSpokeConfigJsonParamResolverParseJsonConfigurationFunctionRoleDefaultPolicy5140CE0C", "Roles": [ { "Ref": "IsbSpokeConfigJsonParamResolverParseJsonConfigurationFunctionRoleAD0AD111" } ] }, "Metadata": { "aws:cdk:path": "InnovationSandbox-Compute/IsbSpokeConfigJsonParamResolver/ParseJsonConfiguration/FunctionRole/DefaultPolicy/Resource" } }, "IsbSpokeConfigJsonParamResolverParseJsonConfigurationFunctionCE168970": { "Type": "AWS::Lambda::Function", "Properties": { "Architectures": [ "arm64" ], "Code": { "S3Bucket": { "Fn::Sub": "solutions-${AWS::Region}" }, "S3Key": "innovation-sandbox-on-aws/v1.3.0/asset.9467086e61250d35bbedc388839ca71ed0a7fc36b52f2f64e0db64ae66526d6e.zip" }, "Description": "Parses configuration passed in JSON format", "Environment": { "Variables": { "NODE_OPTIONS": "--enable-source-maps", "USER_AGENT_EXTRA": "AwsSolution/SO0284/v1.3.0", "POWERTOOLS_SERVICE_NAME": "innovation-sandbox", "AWS_XRAY_CONTEXT_MISSING": "IGNORE_ERROR" } }, "FunctionName": { "Fn::Join": [ "", [ "ISB-ParseJsonConfiguration-", { "Ref": "Namespace" } ] ] }, "Handler": "index.handler", "Layers": [ { "Ref": "IsbSpokeConfigJsonParamResolverISBLambdaLayerInnovationSandboxComputeDependenciesLayerVersion4DD7969A" }, { "Ref": "IsbSpokeConfigJsonParamResolverISBLambdaLayerInnovationSandboxComputeCommonLayerVersionB1BF66A1" } ], "LoggingConfig": { "ApplicationLogLevel": "INFO", "LogFormat": "JSON", "LogGroup": { "Ref": "ISBLogGroupCustomResources63629E09" }, "SystemLogLevel": "INFO" }, "MemorySize": 1024, "Role": { "Fn::GetAtt": [ "IsbSpokeConfigJsonParamResolverParseJsonConfigurationFunctionRoleAD0AD111", "Arn" ] }, "Runtime": "nodejs24.x", "Tags": [ { "Key": "aws-solutions:isb-id", "Value": { "Fn::Join": [ "", [ { "Ref": "Namespace" }, "_isb" ] ] } } ], "Timeout": 60, "TracingConfig": { "Mode": "Active" } }, "DependsOn": [ "IsbSpokeConfigJsonParamResolverParseJsonConfigurationFunctionRoleDefaultPolicy5140CE0C", "IsbSpokeConfigJsonParamResolverParseJsonConfigurationFunctionRoleAD0AD111" ], "Metadata": { "aws:cdk:path": "InnovationSandbox-Compute/IsbSpokeConfigJsonParamResolver/ParseJsonConfiguration/Function/Resource", "aws:asset:path": "asset.9467086e61250d35bbedc388839ca71ed0a7fc36b52f2f64e0db64ae66526d6e", "aws:asset:is-bundled": true, "aws:asset:property": "Code", "guard": { "SuppressedRules": [ "LAMBDA_INSIDE_VPC", "LAMBDA_CONCURRENCY_CHECK" ] } } }, "IsbSpokeConfigJsonParamResolverParseJsonConfigurationIsbProviderframeworkonEventServiceRoleAE0FBDD1": { "Type": "AWS::IAM::Role", "Properties": { "AssumeRolePolicyDocument": { "Statement": [ { "Action": "sts:AssumeRole", "Effect": "Allow", "Principal": { "Service": "lambda.amazonaws.com" } } ], "Version": "2012-10-17" }, "ManagedPolicyArns": [ { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":iam::aws:policy/service-role/AWSLambdaBasicExecutionRole" ] ] } ], "Tags": [ { "Key": "aws-solutions:isb-id", "Value": { "Fn::Join": [ "", [ { "Ref": "Namespace" }, "_isb" ] ] } } ] }, "Metadata": { "aws:cdk:path": "InnovationSandbox-Compute/IsbSpokeConfigJsonParamResolver/ParseJsonConfiguration/IsbProvider/framework-onEvent/ServiceRole/Resource" } }, "IsbSpokeConfigJsonParamResolverParseJsonConfigurationIsbProviderframeworkonEventServiceRoleDefaultPolicy550E8662": { "Type": "AWS::IAM::Policy", "Properties": { "PolicyDocument": { "Statement": [ { "Action": "lambda:InvokeFunction", "Effect": "Allow", "Resource": [ { "Fn::GetAtt": [ "IsbSpokeConfigJsonParamResolverParseJsonConfigurationFunctionCE168970", "Arn" ] }, { "Fn::Join": [ "", [ { "Fn::GetAtt": [ "IsbSpokeConfigJsonParamResolverParseJsonConfigurationFunctionCE168970", "Arn" ] }, ":*" ] ] } ] }, { "Action": "lambda:GetFunction", "Effect": "Allow", "Resource": { "Fn::GetAtt": [ "IsbSpokeConfigJsonParamResolverParseJsonConfigurationFunctionCE168970", "Arn" ] } } ], "Version": "2012-10-17" }, "PolicyName": "IsbSpokeConfigJsonParamResolverParseJsonConfigurationIsbProviderframeworkonEventServiceRoleDefaultPolicy550E8662", "Roles": [ { "Ref": "IsbSpokeConfigJsonParamResolverParseJsonConfigurationIsbProviderframeworkonEventServiceRoleAE0FBDD1" } ] }, "Metadata": { "aws:cdk:path": "InnovationSandbox-Compute/IsbSpokeConfigJsonParamResolver/ParseJsonConfiguration/IsbProvider/framework-onEvent/ServiceRole/DefaultPolicy/Resource" } }, "IsbSpokeConfigJsonParamResolverParseJsonConfigurationIsbProviderframeworkonEventD19E887B": { "Type": "AWS::Lambda::Function", "Properties": { "Code": { "S3Bucket": { "Fn::Sub": "solutions-${AWS::Region}" }, "S3Key": "innovation-sandbox-on-aws/v1.3.0/asset.e16ffb3b34af185b8b30c88fdb19faa13b6c42bb38580485c4e84b384ee48b63.zip" }, "Description": "AWS CDK resource provider framework - onEvent (InnovationSandbox-Compute/IsbSpokeConfigJsonParamResolver/ParseJsonConfiguration/IsbProvider)", "Environment": { "Variables": { "USER_ON_EVENT_FUNCTION_ARN": { "Fn::GetAtt": [ "IsbSpokeConfigJsonParamResolverParseJsonConfigurationFunctionCE168970", "Arn" ] } } }, "Handler": "framework.onEvent", "LoggingConfig": { "ApplicationLogLevel": "FATAL", "LogFormat": "JSON", "LogGroup": { "Ref": "ISBLogGroupCustomResources63629E09" } }, "Role": { "Fn::GetAtt": [ "IsbSpokeConfigJsonParamResolverParseJsonConfigurationIsbProviderframeworkonEventServiceRoleAE0FBDD1", "Arn" ] }, "Runtime": "nodejs24.x", "Tags": [ { "Key": "aws-solutions:isb-id", "Value": { "Fn::Join": [ "", [ { "Ref": "Namespace" }, "_isb" ] ] } } ], "Timeout": 900 }, "DependsOn": [ "IsbSpokeConfigJsonParamResolverParseJsonConfigurationIsbProviderframeworkonEventServiceRoleDefaultPolicy550E8662", "IsbSpokeConfigJsonParamResolverParseJsonConfigurationIsbProviderframeworkonEventServiceRoleAE0FBDD1" ], "Metadata": { "aws:cdk:path": "InnovationSandbox-Compute/IsbSpokeConfigJsonParamResolver/ParseJsonConfiguration/IsbProvider/framework-onEvent/Resource", "aws:asset:path": "asset.e16ffb3b34af185b8b30c88fdb19faa13b6c42bb38580485c4e84b384ee48b63", "aws:asset:is-bundled": false, "aws:asset:property": "Code", "guard": { "SuppressedRules": [ "LAMBDA_INSIDE_VPC", "LAMBDA_CONCURRENCY_CHECK" ] } } }, "IsbSpokeConfigJsonParamResolverParseJsonConfigurationIsbCustomResource57F98B57": { "Type": "Custom::ParseJsonConfiguration", "Properties": { "ServiceToken": { "Fn::GetAtt": [ "IsbSpokeConfigJsonParamResolverParseJsonConfigurationIsbProviderframeworkonEventD19E887B", "Arn" ] }, "idcConfigParamArn": { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":ssm:", { "Ref": "AWS::Region" }, ":", { "Ref": "IdcAccountId" }, ":parameter/InnovationSandbox_", { "Ref": "Namespace" }, "_Idc_Configuration" ] ] }, "accountPoolConfigParamArn": { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":ssm:", { "Ref": "AWS::Region" }, ":", { "Ref": "OrgMgtAccountId" }, ":parameter/InnovationSandbox_", { "Ref": "Namespace" }, "_AccountPool_Configuration" ] ] }, "dataConfigParamArn": { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":ssm:", { "Ref": "AWS::Region" }, ":", { "Ref": "AWS::AccountId" }, ":parameter/InnovationSandbox_", { "Ref": "Namespace" }, "_Data_Configuration" ] ] }, "namespace": { "Ref": "Namespace" }, "forceUpdate": 1787757853907 }, "UpdateReplacePolicy": "Delete", "DeletionPolicy": "Delete", "Metadata": { "aws:cdk:path": "InnovationSandbox-Compute/IsbSpokeConfigJsonParamResolver/ParseJsonConfiguration/IsbCustomResource/Default" } }, "IsbSpokeConfigJsonParamResolverISBLambdaLayerInnovationSandboxComputeCommonLayerVersionB1BF66A1": { "Type": "AWS::Lambda::LayerVersion", "Properties": { "CompatibleArchitectures": [ "arm64" ], "CompatibleRuntimes": [ "nodejs24.x" ], "Content": { "S3Bucket": { "Fn::Sub": "solutions-${AWS::Region}" }, "S3Key": "innovation-sandbox-on-aws/v1.3.0/asset.1f5cc6c90f95b6fb7be25037f56001dc1897d61f443e7e7d02106042e83d7cdb.zip" }, "Description": "Common lib for Innovation Sandbox on AWS" }, "Metadata": { "aws:cdk:path": "InnovationSandbox-Compute/IsbSpokeConfigJsonParamResolver/ISB-Lambda-Layer-InnovationSandbox-Compute/CommonLayerVersion/Resource", "aws:asset:path": "asset.1f5cc6c90f95b6fb7be25037f56001dc1897d61f443e7e7d02106042e83d7cdb", "aws:asset:is-bundled": false, "aws:asset:property": "Content" } }, "IsbSpokeConfigJsonParamResolverISBLambdaLayerInnovationSandboxComputeDependenciesLayerVersion4DD7969A": { "Type": "AWS::Lambda::LayerVersion", "Properties": { "CompatibleArchitectures": [ "arm64" ], "CompatibleRuntimes": [ "nodejs24.x" ], "Content": { "S3Bucket": { "Fn::Sub": "solutions-${AWS::Region}" }, "S3Key": "innovation-sandbox-on-aws/v1.3.0/asset.8e15abb3317296d7d4308c048fbc129062e3aa7565553a2d0f650d6e9c3801cc.zip" }, "Description": "Third party runtime dependencies for Innovation Sandbox on AWS" }, "Metadata": { "aws:cdk:path": "InnovationSandbox-Compute/IsbSpokeConfigJsonParamResolver/ISB-Lambda-Layer-InnovationSandbox-Compute/DependenciesLayerVersion/Resource", "aws:asset:path": "asset.8e15abb3317296d7d4308c048fbc129062e3aa7565553a2d0f650d6e9c3801cc", "aws:asset:is-bundled": false, "aws:asset:property": "Content" } }, "IsbKmsKeyInnovationSandboxComputeB43F03BE": { "Type": "AWS::KMS::Key", "Properties": { "Description": "Encryption Key for Innovation Sandbox: InnovationSandbox-Compute", "EnableKeyRotation": true, "KeyPolicy": { "Statement": [ { "Action": "kms:*", "Effect": "Allow", "Principal": { "AWS": { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":iam::", { "Ref": "AWS::AccountId" }, ":root" ] ] } }, "Resource": "*" }, { "Action": [ "kms:Decrypt", "kms:Encrypt", "kms:ReEncrypt*", "kms:GenerateDataKey*" ], "Effect": "Allow", "Principal": { "Service": "logs.amazonaws.com" }, "Resource": "*" }, { "Action": [ "kms:Decrypt", "kms:Encrypt", "kms:ReEncrypt*", "kms:GenerateDataKey*" ], "Effect": "Allow", "Principal": { "Service": "events.amazonaws.com" }, "Resource": "*" }, { "Action": [ "kms:Decrypt", "kms:GenerateDataKey", "kms:DescribeKey" ], "Condition": { "StringEquals": { "aws:SourceAccount": { "Ref": "AWS::AccountId" }, "aws:SourceArn": { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":events:", { "Ref": "AWS::Region" }, ":", { "Ref": "AWS::AccountId" }, ":event-bus/", { "Ref": "Namespace" }, "-ISBEventBus" ] ] }, "kms:EncryptionContext:aws:events:event-bus:arn": { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":events:", { "Ref": "AWS::Region" }, ":", { "Ref": "AWS::AccountId" }, ":event-bus/", { "Ref": "Namespace" }, "-ISBEventBus" ] ] } } }, "Effect": "Allow", "Principal": { "Service": "events.amazonaws.com" }, "Resource": "*" }, { "Action": [ "kms:Decrypt", "kms:Encrypt", "kms:ReEncrypt*", "kms:GenerateDataKey*" ], "Effect": "Allow", "Principal": { "Service": "sqs.amazonaws.com" }, "Resource": "*" }, { "Action": "kms:Decrypt", "Condition": { "ArnLike": { "AWS:SourceArn": { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":cloudfront::", { "Ref": "AWS::AccountId" }, ":distribution/*" ] ] } } }, "Effect": "Allow", "Principal": { "Service": "cloudfront.amazonaws.com" }, "Resource": "*" }, { "Action": [ "kms:Encrypt", "kms:Decrypt", "kms:GenerateDataKey*" ], "Condition": { "StringEquals": { "AWS:SourceAccount": { "Ref": "AWS::AccountId" } } }, "Effect": "Allow", "Principal": { "Service": "delivery.logs.amazonaws.com" }, "Resource": "*" } ], "Version": "2012-10-17" }, "Tags": [ { "Key": "aws-solutions:isb-id", "Value": { "Fn::Join": [ "", [ { "Ref": "Namespace" }, "_isb" ] ] } } ] }, "UpdateReplacePolicy": "Retain", "DeletionPolicy": "Retain", "Metadata": { "aws:cdk:path": "InnovationSandbox-Compute/IsbKmsKey-InnovationSandbox-Compute/Resource" } }, "IsbKmsKeyInnovationSandboxComputeAliasA03BE0B8": { "Type": "AWS::KMS::Alias", "Properties": { "AliasName": { "Fn::Join": [ "", [ "alias/AwsSolutions/InnovationSandbox/", { "Ref": "Namespace" }, "/InnovationSandbox-Compute" ] ] }, "TargetKeyId": { "Fn::GetAtt": [ "IsbKmsKeyInnovationSandboxComputeB43F03BE", "Arn" ] } }, "Metadata": { "aws:cdk:path": "InnovationSandbox-Compute/IsbKmsKey-InnovationSandbox-Compute/Alias/Resource" } }, "ISBLogGroupCustomResources63629E09": { "Type": "AWS::Logs::LogGroup", "Properties": { "KmsKeyId": { "Fn::GetAtt": [ "IsbKmsKeyInnovationSandboxComputeB43F03BE", "Arn" ] }, "RetentionInDays": { "Fn::FindInMap": [ "Mapping", "context", "cloudWatchLogRetentionInDays", { "DefaultValue": "" } ] }, "Tags": [ { "Key": "aws-solutions:isb-id", "Value": { "Fn::Join": [ "", [ { "Ref": "Namespace" }, "_isb" ] ] } } ] }, "UpdateReplacePolicy": "Retain", "DeletionPolicy": "Retain", "Metadata": { "aws:cdk:path": "InnovationSandbox-Compute/ISBLogGroup-CustomResources/Resource", "guard": { "SuppressedRules": [ "CW_LOGGROUP_RETENTION_PERIOD_CHECK" ] } } }, "SharedParamReaderSsmReadPolicy435E9A92": { "Type": "AWS::IAM::Policy", "Properties": { "PolicyDocument": { "Statement": [ { "Action": "ssm:GetParameter", "Effect": "Allow", "Resource": [ { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":ssm:", { "Ref": "AWS::Region" }, ":", { "Ref": "IdcAccountId" }, ":parameter/InnovationSandbox_", { "Ref": "Namespace" }, "_Idc_Configuration" ] ] }, { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":ssm:", { "Ref": "AWS::Region" }, ":", { "Ref": "OrgMgtAccountId" }, ":parameter/InnovationSandbox_", { "Ref": "Namespace" }, "_AccountPool_Configuration" ] ] }, { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":ssm:", { "Ref": "AWS::Region" }, ":", { "Ref": "AWS::AccountId" }, ":parameter/InnovationSandbox_", { "Ref": "Namespace" }, "_Data_Configuration" ] ] } ] } ], "Version": "2012-10-17" }, "PolicyName": "SharedParamReaderSsmReadPolicy435E9A92", "Roles": [ { "Ref": "IsbSpokeConfigJsonParamResolverParseJsonConfigurationFunctionRoleAD0AD111" } ] }, "Metadata": { "aws:cdk:path": "InnovationSandbox-Compute/SharedParamReaderSsmReadPolicy/Resource" } }, "ISBLogGroupE607F9A7": { "Type": "AWS::Logs::LogGroup", "Properties": { "KmsKeyId": { "Fn::GetAtt": [ "IsbKmsKeyInnovationSandboxComputeB43F03BE", "Arn" ] }, "RetentionInDays": { "Fn::FindInMap": [ "Mapping", "context", "cloudWatchLogRetentionInDays", { "DefaultValue": "" } ] }, "Tags": [ { "Key": "aws-solutions:isb-id", "Value": { "Fn::Join": [ "", [ { "Ref": "Namespace" }, "_isb" ] ] } } ] }, "UpdateReplacePolicy": "Retain", "DeletionPolicy": "Retain", "Metadata": { "aws:cdk:path": "InnovationSandbox-Compute/ISBLogGroup/Resource", "guard": { "SuppressedRules": [ "CW_LOGGROUP_RETENTION_PERIOD_CHECK" ] } } }, "ISBLogGroupPolicyResourcePolicy395D72DA": { "Type": "AWS::Logs::ResourcePolicy", "Properties": { "PolicyDocument": { "Fn::Join": [ "", [ "{\"Statement\":[{\"Action\":[\"logs:CreateLogStream\",\"logs:PutLogEvents\"],\"Effect\":\"Allow\",\"Principal\":{\"Service\":[\"events.amazonaws.com\",\"delivery.logs.amazonaws.com\"]},\"Resource\":\"", { "Fn::GetAtt": [ "ISBLogGroupE607F9A7", "Arn" ] }, "\"}],\"Version\":\"2012-10-17\"}" ] ] }, "PolicyName": { "Fn::Join": [ "", [ { "Ref": "Namespace" }, "-ISBLogGroupPolicy" ] ] } }, "Metadata": { "aws:cdk:path": "InnovationSandbox-Compute/ISBLogGroup/Policy/ResourcePolicy" } }, "ISBLogGroupCleanup485A102F": { "Type": "AWS::Logs::LogGroup", "Properties": { "KmsKeyId": { "Fn::GetAtt": [ "IsbKmsKeyInnovationSandboxComputeB43F03BE", "Arn" ] }, "RetentionInDays": { "Fn::FindInMap": [ "Mapping", "context", "cloudWatchLogRetentionInDays", { "DefaultValue": "" } ] }, "Tags": [ { "Key": "aws-solutions:isb-id", "Value": { "Fn::Join": [ "", [ { "Ref": "Namespace" }, "_isb" ] ] } } ] }, "UpdateReplacePolicy": "Retain", "DeletionPolicy": "Retain", "Metadata": { "aws:cdk:path": "InnovationSandbox-Compute/ISBLogGroup-Cleanup/Resource", "guard": { "SuppressedRules": [ "CW_LOGGROUP_RETENTION_PERIOD_CHECK" ] } } }, "DeploymentUUIDLambdaFunctionFunctionRoleDB238E11": { "Type": "AWS::IAM::Role", "Properties": { "AssumeRolePolicyDocument": { "Statement": [ { "Action": "sts:AssumeRole", "Effect": "Allow", "Principal": { "Service": "lambda.amazonaws.com" } } ], "Version": "2012-10-17" }, "Tags": [ { "Key": "aws-solutions:isb-id", "Value": { "Fn::Join": [ "", [ { "Ref": "Namespace" }, "_isb" ] ] } } ] }, "Metadata": { "aws:cdk:path": "InnovationSandbox-Compute/DeploymentUUID/LambdaFunction/FunctionRole/Resource" } }, "DeploymentUUIDLambdaFunctionFunctionRoleDefaultPolicy7D6AE82D": { "Type": "AWS::IAM::Policy", "Properties": { "PolicyDocument": { "Statement": [ { "Action": [ "xray:PutTraceSegments", "xray:PutTelemetryRecords" ], "Effect": "Allow", "Resource": "*" }, { "Action": [ "logs:CreateLogStream", "logs:PutLogEvents" ], "Effect": "Allow", "Resource": { "Fn::GetAtt": [ "ISBLogGroupCustomResources63629E09", "Arn" ] } } ], "Version": "2012-10-17" }, "PolicyName": "DeploymentUUIDLambdaFunctionFunctionRoleDefaultPolicy7D6AE82D", "Roles": [ { "Ref": "DeploymentUUIDLambdaFunctionFunctionRoleDB238E11" } ] }, "Metadata": { "aws:cdk:path": "InnovationSandbox-Compute/DeploymentUUID/LambdaFunction/FunctionRole/DefaultPolicy/Resource" } }, "DeploymentUUIDLambdaFunction297287F6": { "Type": "AWS::Lambda::Function", "Properties": { "Architectures": [ "arm64" ], "Code": { "S3Bucket": { "Fn::Sub": "solutions-${AWS::Region}" }, "S3Key": "innovation-sandbox-on-aws/v1.3.0/asset.90a11c28d2d533c4e4a7a651733050d99b71328c88ae1ea7130498d5493a1761.zip" }, "Description": "Custom resource lambda provider that generates a UUID on stack creation", "Environment": { "Variables": { "NODE_OPTIONS": "--enable-source-maps", "USER_AGENT_EXTRA": "AwsSolution/SO0284/v1.3.0", "POWERTOOLS_SERVICE_NAME": "innovation-sandbox", "AWS_XRAY_CONTEXT_MISSING": "IGNORE_ERROR" } }, "FunctionName": { "Fn::Join": [ "", [ "ISB-LambdaFunction-", { "Ref": "Namespace" } ] ] }, "Handler": "index.handler", "Layers": [ { "Ref": "IsbSpokeConfigJsonParamResolverISBLambdaLayerInnovationSandboxComputeDependenciesLayerVersion4DD7969A" }, { "Ref": "IsbSpokeConfigJsonParamResolverISBLambdaLayerInnovationSandboxComputeCommonLayerVersionB1BF66A1" } ], "LoggingConfig": { "ApplicationLogLevel": "INFO", "LogFormat": "JSON", "LogGroup": { "Ref": "ISBLogGroupCustomResources63629E09" }, "SystemLogLevel": "INFO" }, "MemorySize": 1024, "Role": { "Fn::GetAtt": [ "DeploymentUUIDLambdaFunctionFunctionRoleDB238E11", "Arn" ] }, "Runtime": "nodejs24.x", "Tags": [ { "Key": "aws-solutions:isb-id", "Value": { "Fn::Join": [ "", [ { "Ref": "Namespace" }, "_isb" ] ] } } ], "Timeout": 60, "TracingConfig": { "Mode": "Active" } }, "DependsOn": [ "DeploymentUUIDLambdaFunctionFunctionRoleDefaultPolicy7D6AE82D", "DeploymentUUIDLambdaFunctionFunctionRoleDB238E11" ], "Metadata": { "aws:cdk:path": "InnovationSandbox-Compute/DeploymentUUID/LambdaFunction/Function/Resource", "aws:asset:path": "asset.90a11c28d2d533c4e4a7a651733050d99b71328c88ae1ea7130498d5493a1761", "aws:asset:is-bundled": true, "aws:asset:property": "Code", "guard": { "SuppressedRules": [ "LAMBDA_INSIDE_VPC", "LAMBDA_CONCURRENCY_CHECK" ] } } }, "DeploymentUUIDLambdaFunctionIsbProviderframeworkonEventServiceRole78CDE25E": { "Type": "AWS::IAM::Role", "Properties": { "AssumeRolePolicyDocument": { "Statement": [ { "Action": "sts:AssumeRole", "Effect": "Allow", "Principal": { "Service": "lambda.amazonaws.com" } } ], "Version": "2012-10-17" }, "ManagedPolicyArns": [ { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":iam::aws:policy/service-role/AWSLambdaBasicExecutionRole" ] ] } ], "Tags": [ { "Key": "aws-solutions:isb-id", "Value": { "Fn::Join": [ "", [ { "Ref": "Namespace" }, "_isb" ] ] } } ] }, "Metadata": { "aws:cdk:path": "InnovationSandbox-Compute/DeploymentUUID/LambdaFunction/IsbProvider/framework-onEvent/ServiceRole/Resource" } }, "DeploymentUUIDLambdaFunctionIsbProviderframeworkonEventServiceRoleDefaultPolicy20766167": { "Type": "AWS::IAM::Policy", "Properties": { "PolicyDocument": { "Statement": [ { "Action": "lambda:InvokeFunction", "Effect": "Allow", "Resource": [ { "Fn::GetAtt": [ "DeploymentUUIDLambdaFunction297287F6", "Arn" ] }, { "Fn::Join": [ "", [ { "Fn::GetAtt": [ "DeploymentUUIDLambdaFunction297287F6", "Arn" ] }, ":*" ] ] } ] }, { "Action": "lambda:GetFunction", "Effect": "Allow", "Resource": { "Fn::GetAtt": [ "DeploymentUUIDLambdaFunction297287F6", "Arn" ] } } ], "Version": "2012-10-17" }, "PolicyName": "DeploymentUUIDLambdaFunctionIsbProviderframeworkonEventServiceRoleDefaultPolicy20766167", "Roles": [ { "Ref": "DeploymentUUIDLambdaFunctionIsbProviderframeworkonEventServiceRole78CDE25E" } ] }, "Metadata": { "aws:cdk:path": "InnovationSandbox-Compute/DeploymentUUID/LambdaFunction/IsbProvider/framework-onEvent/ServiceRole/DefaultPolicy/Resource" } }, "DeploymentUUIDLambdaFunctionIsbProviderframeworkonEvent42333667": { "Type": "AWS::Lambda::Function", "Properties": { "Code": { "S3Bucket": { "Fn::Sub": "solutions-${AWS::Region}" }, "S3Key": "innovation-sandbox-on-aws/v1.3.0/asset.e16ffb3b34af185b8b30c88fdb19faa13b6c42bb38580485c4e84b384ee48b63.zip" }, "Description": "AWS CDK resource provider framework - onEvent (InnovationSandbox-Compute/DeploymentUUID/LambdaFunction/IsbProvider)", "Environment": { "Variables": { "USER_ON_EVENT_FUNCTION_ARN": { "Fn::GetAtt": [ "DeploymentUUIDLambdaFunction297287F6", "Arn" ] } } }, "Handler": "framework.onEvent", "LoggingConfig": { "ApplicationLogLevel": "FATAL", "LogFormat": "JSON", "LogGroup": { "Ref": "ISBLogGroupCustomResources63629E09" } }, "Role": { "Fn::GetAtt": [ "DeploymentUUIDLambdaFunctionIsbProviderframeworkonEventServiceRole78CDE25E", "Arn" ] }, "Runtime": "nodejs24.x", "Tags": [ { "Key": "aws-solutions:isb-id", "Value": { "Fn::Join": [ "", [ { "Ref": "Namespace" }, "_isb" ] ] } } ], "Timeout": 900 }, "DependsOn": [ "DeploymentUUIDLambdaFunctionIsbProviderframeworkonEventServiceRoleDefaultPolicy20766167", "DeploymentUUIDLambdaFunctionIsbProviderframeworkonEventServiceRole78CDE25E" ], "Metadata": { "aws:cdk:path": "InnovationSandbox-Compute/DeploymentUUID/LambdaFunction/IsbProvider/framework-onEvent/Resource", "aws:asset:path": "asset.e16ffb3b34af185b8b30c88fdb19faa13b6c42bb38580485c4e84b384ee48b63", "aws:asset:is-bundled": false, "aws:asset:property": "Code", "guard": { "SuppressedRules": [ "LAMBDA_INSIDE_VPC", "LAMBDA_CONCURRENCY_CHECK" ] } } }, "DeploymentUUIDLambdaFunctionIsbCustomResourceE707861E": { "Type": "Custom::DeploymentUUID", "Properties": { "ServiceToken": { "Fn::GetAtt": [ "DeploymentUUIDLambdaFunctionIsbProviderframeworkonEvent42333667", "Arn" ] } }, "UpdateReplacePolicy": "Delete", "DeletionPolicy": "Delete", "Metadata": { "aws:cdk:path": "InnovationSandbox-Compute/DeploymentUUID/LambdaFunction/IsbCustomResource/Default" } }, "IntermediateRole6D2F2036": { "Type": "AWS::IAM::Role", "Properties": { "AssumeRolePolicyDocument": { "Statement": [ { "Effect": "Allow", "Action": "sts:AssumeRole", "Principal": { "AWS": { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":iam::", { "Ref": "AWS::AccountId" }, ":root" ] ] } }, "Condition": { "StringEquals": { "aws:PrincipalTag/aws-solutions:isb-id": { "Fn::Join": [ "", [ { "Ref": "Namespace" }, "_isb" ] ] } } } }, { "Effect": "Allow", "Action": "sts:AssumeRole", "Principal": { "Service": "cloudformation.amazonaws.com" }, "Condition": { "StringEquals": { "aws:SourceAccount": { "Ref": "AWS::AccountId" } }, "ArnLike": { "aws:SourceArn": { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":cloudformation:*:", { "Ref": "AWS::AccountId" }, ":stackset/*" ] ] } } } } ], "Version": "2012-10-17" }, "RoleName": { "Fn::Join": [ "", [ "InnovationSandbox-", { "Ref": "Namespace" }, "-IntermediateRole" ] ] }, "Tags": [ { "Key": "aws-solutions:isb-id", "Value": { "Fn::Join": [ "", [ { "Ref": "Namespace" }, "_isb" ] ] } } ] }, "Metadata": { "aws:cdk:path": "InnovationSandbox-Compute/IntermediateRole/Resource", "guard": { "SuppressedRules": [ "CFN_NO_EXPLICIT_RESOURCE_NAMES" ] } } }, "IntermediateRoleDefaultPolicy7308C44F": { "Type": "AWS::IAM::Policy", "Properties": { "PolicyDocument": { "Statement": [ { "Action": "sts:AssumeRole", "Effect": "Allow", "Resource": { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":iam::", { "Ref": "IdcAccountId" }, ":role/InnovationSandbox-", { "Ref": "Namespace" }, "-IdcRole" ] ] } }, { "Action": "sts:AssumeRole", "Effect": "Allow", "Resource": { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":iam::", { "Ref": "OrgMgtAccountId" }, ":role/InnovationSandbox-", { "Ref": "Namespace" }, "-OrgMgtRole" ] ] } }, { "Action": "sts:AssumeRole", "Effect": "Allow", "Resource": { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":iam::*:role/InnovationSandbox-", { "Ref": "Namespace" }, "-SandboxAccountRole" ] ] } } ], "Version": "2012-10-17" }, "PolicyName": "IntermediateRoleDefaultPolicy7308C44F", "Roles": [ { "Ref": "IntermediateRole6D2F2036" } ] }, "Metadata": { "aws:cdk:path": "InnovationSandbox-Compute/IntermediateRole/DefaultPolicy/Resource" } }, "ISBEventBusDLQCBA480AD": { "Type": "AWS::SQS::Queue", "Properties": { "KmsMasterKeyId": { "Fn::GetAtt": [ "IsbKmsKeyInnovationSandboxComputeB43F03BE", "Arn" ] }, "QueueName": { "Fn::Join": [ "", [ "ISB-", { "Ref": "Namespace" }, "-ISBEventBus-DLQ" ] ] }, "Tags": [ { "Key": "aws-solutions:isb-id", "Value": { "Fn::Join": [ "", [ { "Ref": "Namespace" }, "_isb" ] ] } } ] }, "UpdateReplacePolicy": "Delete", "DeletionPolicy": "Delete", "Metadata": { "aws:cdk:path": "InnovationSandbox-Compute/ISBEventBusDLQ/Resource" } }, "ISBEventBusDLQPolicy5521128C": { "Type": "AWS::SQS::QueuePolicy", "Properties": { "PolicyDocument": { "Statement": [ { "Action": "sqs:*", "Condition": { "Bool": { "aws:SecureTransport": "false" } }, "Effect": "Deny", "Principal": { "AWS": "*" }, "Resource": { "Fn::GetAtt": [ "ISBEventBusDLQCBA480AD", "Arn" ] } } ], "Version": "2012-10-17" }, "Queues": [ { "Ref": "ISBEventBusDLQCBA480AD" } ] }, "Metadata": { "aws:cdk:path": "InnovationSandbox-Compute/ISBEventBusDLQ/Policy/Resource" } }, "ISBEventBusD5514129": { "Type": "AWS::Events::EventBus", "Properties": { "DeadLetterConfig": { "Arn": { "Fn::GetAtt": [ "ISBEventBusDLQCBA480AD", "Arn" ] } }, "Description": "core event bus for all ISB activity", "KmsKeyIdentifier": { "Fn::GetAtt": [ "IsbKmsKeyInnovationSandboxComputeB43F03BE", "Arn" ] }, "Name": { "Fn::Join": [ "", [ { "Ref": "Namespace" }, "-ISBEventBus" ] ] }, "Tags": [ { "Key": "aws-solutions:isb-id", "Value": { "Fn::Join": [ "", [ { "Ref": "Namespace" }, "_isb" ] ] } } ] }, "Metadata": { "aws:cdk:path": "InnovationSandbox-Compute/ISBEventBus/Resource" } }, "DLQ581697C4": { "Type": "AWS::SQS::Queue", "Properties": { "KmsMasterKeyId": { "Fn::GetAtt": [ "IsbKmsKeyInnovationSandboxComputeB43F03BE", "Arn" ] }, "Tags": [ { "Key": "aws-solutions:isb-id", "Value": { "Fn::Join": [ "", [ { "Ref": "Namespace" }, "_isb" ] ] } } ] }, "UpdateReplacePolicy": "Delete", "DeletionPolicy": "Delete", "Metadata": { "aws:cdk:path": "InnovationSandbox-Compute/DLQ/Resource" } }, "DLQPolicyC8FA9269": { "Type": "AWS::SQS::QueuePolicy", "Properties": { "PolicyDocument": { "Statement": [ { "Action": "sqs:*", "Condition": { "Bool": { "aws:SecureTransport": "false" } }, "Effect": "Deny", "Principal": { "AWS": "*" }, "Resource": { "Fn::GetAtt": [ "DLQ581697C4", "Arn" ] } } ], "Version": "2012-10-17" }, "Queues": [ { "Ref": "DLQ581697C4" } ] }, "Metadata": { "aws:cdk:path": "InnovationSandbox-Compute/DLQ/Policy/Resource" } }, "ISBEventBusLogging37337846": { "Type": "AWS::Events::Rule", "Properties": { "Description": "logs all events that get sent to the ISB event bus", "EventBusName": { "Ref": "ISBEventBusD5514129" }, "EventPattern": { "source": [ { "prefix": "" } ] }, "State": "ENABLED", "Tags": [ { "Key": "aws-solutions:isb-id", "Value": { "Fn::Join": [ "", [ { "Ref": "Namespace" }, "_isb" ] ] } } ], "Targets": [ { "Arn": { "Fn::GetAtt": [ "ISBLogGroupE607F9A7", "Arn" ] }, "DeadLetterConfig": { "Arn": { "Fn::GetAtt": [ "DLQ581697C4", "Arn" ] } }, "Id": "Target0", "InputTransformer": { "InputPathsMap": { "detail-type": "$.detail-type", "time": "$.time" }, "InputTemplate": "{\"message\":\"ISBEventBus received event\",\"timestamp\":