{ "Description": "(SO0284-DataStack) innovation-sandbox-on-aws v1.3.0", "Metadata": { "AWS::CloudFormation::Interface": { "ParameterLabels": { "Namespace": { "default": "Namespace" }, "SamlMetadataUrl": { "default": "SAML Metadata URL" }, "AwsAccessPortalUrl": { "default": "AWS Access Portal URL" } }, "ParameterGroups": [ { "Label": { "default": "Data Stack Configuration" }, "Parameters": [ "Namespace", "SamlMetadataUrl", "AwsAccessPortalUrl" ] } ] } }, "Parameters": { "Namespace": { "Type": "String", "Default": "myisb", "AllowedPattern": "^[0-9a-zA-Z]{3,8}$", "Description": "The namespace for this deployment of Innovation Sandbox (must be the same for all member stacks). Alphanumeric characters of length between 3 and 8" }, "SamlMetadataUrl": { "Type": "String", "AllowedPattern": "^https://.*$", "ConstraintDescription": "Must be a valid HTTPS URL (e.g., https://portal.sso.us-east-1.amazonaws.com/saml/metadata/...)", "Description": "The SAML metadata URL from the IDC SAML 2.0 application" }, "AwsAccessPortalUrl": { "Type": "String", "AllowedPattern": "^https://.*$", "ConstraintDescription": "Must be a valid HTTPS URL (e.g., https://d-xxxxxxxxxx.awsapps.com/start)", "Description": "The AWS Access Portal URL for IAM Identity Center SSO (e.g. https://d-xxxxxxxxxx.awsapps.com/start)" } }, "Resources": { "IsbKmsKeyInnovationSandboxData8BA6C3A2": { "Type": "AWS::KMS::Key", "Properties": { "Description": "Encryption Key for Innovation Sandbox: InnovationSandbox-Data", "EnableKeyRotation": true, "KeyPolicy": { "Statement": [ { "Action": "kms:*", "Effect": "Allow", "Principal": { "AWS": { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":iam::", { "Ref": "AWS::AccountId" }, ":root" ] ] } }, "Resource": "*" }, { "Action": [ "kms:Decrypt", "kms:Encrypt", "kms:ReEncrypt*", "kms:GenerateDataKey*" ], "Effect": "Allow", "Principal": { "Service": "logs.amazonaws.com" }, "Resource": "*" } ], "Version": "2012-10-17" }, "Tags": [ { "Key": "aws-solutions:isb-id", "Value": { "Fn::Join": [ "", [ { "Ref": "Namespace" }, "_isb" ] ] } } ] }, "UpdateReplacePolicy": "Retain", "DeletionPolicy": "Retain", "Metadata": { "aws:cdk:path": "InnovationSandbox-Data/IsbKmsKey-InnovationSandbox-Data/Resource" } }, "IsbKmsKeyInnovationSandboxDataAliasCC5DB0BD": { "Type": "AWS::KMS::Alias", "Properties": { "AliasName": { "Fn::Join": [ "", [ "alias/AwsSolutions/InnovationSandbox/", { "Ref": "Namespace" }, "/InnovationSandbox-Data" ] ] }, "TargetKeyId": { "Fn::GetAtt": [ "IsbKmsKeyInnovationSandboxData8BA6C3A2", "Arn" ] } }, "Metadata": { "aws:cdk:path": "InnovationSandbox-Data/IsbKmsKey-InnovationSandbox-Data/Alias/Resource" } }, "ConfigApplication1A42FDD2": { "Type": "AWS::AppConfig::Application", "Properties": { "Description": { "Fn::Join": [ "", [ "AppConfig Application for Innovation Sandbox on AWS - ", { "Ref": "Namespace" } ] ] }, "Name": { "Fn::Join": [ "", [ { "Ref": "Namespace" }, "-Config-Application" ] ] }, "Tags": [ { "Key": "aws-solutions:isb-id", "Value": { "Fn::Join": [ "", [ { "Ref": "Namespace" }, "_isb" ] ] } } ] }, "Metadata": { "aws:cdk:path": "InnovationSandbox-Data/Config/Application/Resource" } }, "ConfigEnvironment6C769E19": { "Type": "AWS::AppConfig::Environment", "Properties": { "ApplicationId": { "Ref": "ConfigApplication1A42FDD2" }, "Description": { "Fn::Join": [ "", [ "AppConfig Environment for Innovation Sandbox on AWS - ", { "Ref": "Namespace" } ] ] }, "Name": "InnovationSandboxData-Config-Environment-27C6CC45", "Tags": [ { "Key": "aws-solutions:isb-id", "Value": { "Fn::Join": [ "", [ { "Ref": "Namespace" }, "_isb" ] ] } } ] }, "Metadata": { "aws:cdk:path": "InnovationSandbox-Data/Config/Environment/Resource" } }, "ConfigDeploymentStrategy6B5E2A35": { "Type": "AWS::AppConfig::DeploymentStrategy", "Properties": { "DeploymentDurationInMinutes": 0, "Description": { "Fn::Join": [ "", [ "AppConfig DeploymentStrategy for Innovation Sandbox on AWS - ", { "Ref": "Namespace" } ] ] }, "FinalBakeTimeInMinutes": 0, "GrowthFactor": 100, "Name": { "Fn::Join": [ "", [ { "Ref": "Namespace" }, "-Config-DeploymentStrategy" ] ] }, "ReplicateTo": "NONE", "Tags": [ { "Key": "aws-solutions:isb-id", "Value": { "Fn::Join": [ "", [ { "Ref": "Namespace" }, "_isb" ] ] } } ] }, "Metadata": { "aws:cdk:path": "InnovationSandbox-Data/Config/DeploymentStrategy/Resource" } }, "ConfigNukeConfigHostedConfigurationConfigurationProfileEC3A0164": { "Type": "AWS::AppConfig::ConfigurationProfile", "Properties": { "ApplicationId": { "Ref": "ConfigApplication1A42FDD2" }, "Description": { "Fn::Join": [ "", [ "NukeConfig AppConfig HostedConfiguration for Innovation Sandbox on AWS - ", { "Ref": "Namespace" } ] ] }, "LocationUri": "hosted", "Name": "InnovationSandboxData-Config-NukeConfigHostedConfiguration-03245D50", "Tags": [ { "Key": "aws-solutions:isb-id", "Value": { "Fn::Join": [ "", [ { "Ref": "Namespace" }, "_isb" ] ] } } ] }, "Metadata": { "aws:cdk:path": "InnovationSandbox-Data/Config/NukeConfigHostedConfiguration/ConfigurationProfile" } }, "ConfigNukeConfigHostedConfiguration997D7FAE": { "Type": "AWS::AppConfig::HostedConfigurationVersion", "Properties": { "ApplicationId": { "Ref": "ConfigApplication1A42FDD2" }, "ConfigurationProfileId": { "Ref": "ConfigNukeConfigHostedConfigurationConfigurationProfileEC3A0164" }, "Content": "regions:\n - global # further AWS regions will be added dynamically from CleanupConfig\nbypass-alias-check-accounts:\n - \"%CLEANUP_ACCOUNT_ID%\"\nsettings:\n CloudFormationStack:\n DisableDeletionProtection: true\n CreateRoleToDeleteStack: true\n CognitoUserPool:\n DisableDeletionProtection: true\n DSQLCluster:\n DisableDeletionProtection: true\n DynamoDBTable:\n DisableDeletionProtection: true\n EC2Image:\n IncludeDisabled: true\n IncludeDeprecated: true\n DisableDeregistrationProtection: true\n EC2Instance:\n DisableStopProtection: true\n DisableDeletionProtection: true\n ELBv2:\n DisableDeletionProtection: true\n LightsailInstance:\n ForceDeleteAddOns: true\n NeptuneCluster:\n DisableDeletionProtection: true\n NeptuneInstance:\n DisableClusterDeletionProtection: true\n DisableDeletionProtection: true\n NeptuneGraph:\n DisableDeletionProtection: true\n QLDBLedger:\n DisableDeletionProtection: true\n QuickSightSubscription:\n DisableTerminationProtection: true\n RDSInstance:\n DisableDeletionProtection: true\n S3Bucket:\n BypassGovernanceRetention: true\n RemoveObjectLegalHold: true\nresource-types:\n excludes:\n - S3Object # Let the S3Bucket delete all Objects instead of individual objects (optimization)\n - ConfigServiceConfigurationRecorder\n - ConfigServiceDeliveryChannel\nblocklist:\n - \"%HUB_ACCOUNT_ID%\" # placeholder HUB_ACCOUNT_ID will be dynamically replaced during CodeBuild execution\naccounts:\n \"%CLEANUP_ACCOUNT_ID%\": # placeholder CLEANUP_ACCOUNT_ID will be dynamically replaced during CodeBuild execution\n filters:\n CloudFormationStack:\n - type: glob\n value: StackSet-Isb-* # protects sandbox account stack set instance from being deleted\n CloudTrailTrail:\n - type: glob\n value: aws-controltower-*\n - type: exact\n value: all-org-cloud-trail\n CloudWatchEventsRule:\n - property: Name\n type: glob\n value: aws-controltower-*\n - property: Name\n type: contains\n value: AWSControlTower\n IAMRole:\n - type: exact\n value: \"%CLEANUP_ROLE_NAME%\" # placeholder CLEANUP_ROLE_NAME will be dynamically replaced during CodeBuild executio\n - type: exact\n value: OrganizationAccountAccessRole\n - type: glob\n value: stacksets-exec-*\n - type: glob\n value: AWSReservedSSO_*\n - type: contains\n value: AWSControlTower\n - type: glob\n value: aws-controltower-*\n IAMRolePolicy:\n - property: \"role:RoleName\"\n type: exact\n value: \"%CLEANUP_ROLE_NAME%\" # placeholder CLEANUP_ROLE_NAME will be dynamically replaced during CodeBuild execution\n - property: \"role:RoleName\"\n type: exact\n value: OrganizationAccountAccessRole\n - property: \"role:RoleName\"\n type: glob\n value: stacksets-exec-*\n - type: glob\n value: AWSReservedSSO_*\n - property: \"role:RoleName\"\n type: contains\n value: AWSControlTower\n - property: \"role:RoleName\"\n type: glob\n value: aws-controltower-*\n IAMRolePolicyAttachment:\n - property: RoleName\n type: exact\n value: \"%CLEANUP_ROLE_NAME%\" # placeholder CLEANUP_ROLE_NAME will be dynamically replaced during CodeBuild execution\n - property: RoleName\n type: exact\n value: OrganizationAccountAccessRole\n - property: RoleName\n type: glob\n value: stacksets-exec-*\n - type: glob\n value: AWSReservedSSO_*\n - property: RoleName\n type: contains\n value: AWSControlTower\n - property: RoleName\n type: glob\n value: aws-controltower-*\n IAMSAMLProvider:\n - type: contains\n value: AWSSSO\n LambdaFunction:\n - type: glob\n value: aws-controltower-*\n CloudWatchLogsLogGroup:\n - type: contains\n value: aws-controltower\n OSPackage:\n - type: glob\n value: pkg-*\n - type: glob\n value: G*\n SNSSubscription:\n - property: \"ARN\"\n type: contains\n value: \"aws-controltower\"\n SNSTopic:\n - type: glob\n value: aws-controltower-*\n", "ContentType": "application/x-yaml", "Description": { "Fn::Join": [ "", [ "NukeConfig AppConfig HostedConfiguration for Innovation Sandbox on AWS - ", { "Ref": "Namespace" } ] ] } }, "UpdateReplacePolicy": "Retain", "DeletionPolicy": "Retain", "Metadata": { "aws:cdk:path": "InnovationSandbox-Data/Config/NukeConfigHostedConfiguration/Resource" } }, "ConfigNukeConfigHostedConfigurationDeploymentC180F1F24ADA5": { "Type": "AWS::AppConfig::Deployment", "Properties": { "ApplicationId": { "Ref": "ConfigApplication1A42FDD2" }, "ConfigurationProfileId": { "Ref": "ConfigNukeConfigHostedConfigurationConfigurationProfileEC3A0164" }, "ConfigurationVersion": { "Ref": "ConfigNukeConfigHostedConfiguration997D7FAE" }, "DeploymentStrategyId": { "Ref": "ConfigDeploymentStrategy6B5E2A35" }, "Description": { "Fn::Join": [ "", [ "NukeConfig AppConfig HostedConfiguration for Innovation Sandbox on AWS - ", { "Ref": "Namespace" } ] ] }, "EnvironmentId": { "Ref": "ConfigEnvironment6C769E19" }, "Tags": [ { "Key": "aws-solutions:isb-id", "Value": { "Fn::Join": [ "", [ { "Ref": "Namespace" }, "_isb" ] ] } } ] }, "Metadata": { "aws:cdk:path": "InnovationSandbox-Data/Config/NukeConfigHostedConfiguration/DeploymentC180F" } }, "ConfigValidatorExclusionConfigHostedConfigurationConfigurationProfile7F616F70": { "Type": "AWS::AppConfig::ConfigurationProfile", "Properties": { "ApplicationId": { "Ref": "ConfigApplication1A42FDD2" }, "Description": { "Fn::Join": [ "", [ "ValidatorExclusionConfig AppConfig HostedConfiguration for Innovation Sandbox on AWS - ", { "Ref": "Namespace" } ] ] }, "LocationUri": "hosted", "Name": "InnovationSandboxData-Config-ValidatorExclusionConfigHostedConfiguration-007B3113", "Tags": [ { "Key": "aws-solutions:isb-id", "Value": { "Fn::Join": [ "", [ { "Ref": "Namespace" }, "_isb" ] ] } } ] }, "Metadata": { "aws:cdk:path": "InnovationSandbox-Data/Config/ValidatorExclusionConfigHostedConfiguration/ConfigurationProfile" } }, "ConfigValidatorExclusionConfigHostedConfiguration47AD3080": { "Type": "AWS::AppConfig::HostedConfigurationVersion", "Properties": { "ApplicationId": { "Ref": "ConfigApplication1A42FDD2" }, "ConfigurationProfileId": { "Ref": "ConfigValidatorExclusionConfigHostedConfigurationConfigurationProfile7F616F70" }, "Content": "# ==============================================================================\n# Validator Exclusion Config — Innovation Sandbox on AWS\n# ==============================================================================\n#\n# SYNC REQUIREMENT: This config MUST be kept in sync with the nuke config\n# (nuke-config.yaml). Every resource that Nuke preserves via filters AND that\n# Resource Explorer indexes requires a corresponding exclusion entry here.\n# Otherwise the post-cleanup validator will flag it as a cleanup failure\n# (false positive) and quarantine the account unnecessarily.\n#\n# When modifying the nuke config:\n# 1. Check if the Nuke resource type has a corresponding Resource Explorer\n# resource type (see supported-resource-types docs).\n# 2. If YES → add a corresponding ARN pattern below.\n# 3. If NO → no action needed here.\n#\n# See: https://docs.aws.amazon.com/resource-explorer/latest/userguide/supported-resource-types.html\n#\n# Failure modes if out of sync:\n# - Filter in nuke config but NOT here → false-positive validation failure\n# - Filter here but NOT in nuke config → no impact (stale entry)\n# ==============================================================================\n\nvalidation:\n excludedArnPatterns:\n # =========================================================================\n # ISB Infrastructure\n # =========================================================================\n # CloudFormationStack filter: StackSet-Isb-*\n - \"arn:aws:cloudformation:*:*:stack/StackSet-Isb-*/*\"\n # IAMRole filter: InnovationSandbox-* (cleanup spoke role, matches %CLEANUP_ROLE_NAME%)\n - \"arn:aws:iam::*:role/InnovationSandbox-*\"\n # IAMRole filter: stacksets-exec-*\n - \"arn:aws:iam::*:role/stacksets-exec-*\"\n\n # =========================================================================\n # AWS Organizations\n # =========================================================================\n # IAMRole filter: OrganizationAccountAccessRole\n - \"arn:aws:iam::*:role/OrganizationAccountAccessRole\"\n\n # =========================================================================\n # AWS Control Tower / Landing Zone Accelerator\n # =========================================================================\n # IAMRole filters: aws-controltower-*, contains AWSControlTower, AWSAccelerator-*\n - \"arn:aws:iam::*:role/aws-controltower-*\"\n - \"arn:aws:iam::*:role/*AWSControlTower*\"\n - \"arn:aws:iam::*:role/AWSAccelerator-*\"\n # CloudTrailTrail filters: aws-controltower-*, all-org-cloud-trail\n - \"arn:aws:cloudtrail:*:*:trail/aws-controltower-*\"\n - \"arn:aws:cloudtrail:*:*:trail/all-org-cloud-trail\"\n # LambdaFunction filter: aws-controltower-*\n - \"arn:aws:lambda:*:*:function:aws-controltower-*\"\n # CloudWatchLogsLogGroup filter: contains aws-controltower\n - \"arn:aws:logs:*:*:log-group:*aws-controltower*\"\n # SNSTopic filter: aws-controltower-*\n - \"arn:aws:sns:*:*:aws-controltower-*\"\n # CloudWatchEventsRule filters: aws-controltower-*, contains AWSControlTower\n - \"arn:aws:events:*:*:rule/aws-controltower-*\"\n - \"arn:aws:events:*:*:rule/*AWSControlTower*\"\n\n # =========================================================================\n # AWS Security Incident Response (SIR)\n # =========================================================================\n # CloudWatchEventsRule filters: SIRGuardDutyRule, SIRSecurityHubRule\n # (managed by AWS SIR, cannot be deleted via DeleteRule API)\n - \"arn:aws:events:*:*:rule/SIRGuardDutyRule\"\n - \"arn:aws:events:*:*:rule/SIRSecurityHubRule\"\n\n # =========================================================================\n # AWS SSO / IAM Identity Center\n # =========================================================================\n # IAMRole filter: AWSReservedSSO_*\n - \"arn:aws:iam::*:role/*AWSReservedSSO_*\"\n # IAMSAMLProvider filter: contains AWSSSO\n - \"arn:aws:iam::*:saml-provider/*AWSSSO*\"\n\n # =========================================================================\n # Resource Explorer (must persist for validation to work)\n # =========================================================================\n # ResourceExplorer2Index filter: * (Task 19)\n - \"arn:aws:resource-explorer-2:*:*:index/*\"\n # ResourceExplorer2View filter: * (Task 19)\n - \"arn:aws:resource-explorer-2:*:*:view/*\"\n\n # =========================================================================\n # Nuke Built-In Filters (not in nuke config but Nuke skips them)\n # =========================================================================\n # AWS service-linked roles — Nuke preserves these by default\n - \"arn:aws:iam::*:role/aws-service-role/*\"\n\n # =========================================================================\n # AWS-Managed Defaults (exist in every account, cannot be deleted)\n # =========================================================================\n # These resources are created automatically by AWS services and persist\n # across cleanups. Nuke's built-in filters preserve them, but they appear\n # in Resource Explorer results and must be excluded from validation.\n - \"arn:aws:elasticache:*:*:user:default\"\n - \"arn:aws:athena:*:*:workgroup/primary\"\n - \"arn:aws:athena:*:*:datacatalog/AwsDataCatalog\"\n - \"arn:aws:memorydb:*:*:parametergroup/default.*\"\n - \"arn:aws:memorydb:*:*:acl/open-access\"\n - \"arn:aws:memorydb:*:*:user/default\"\n - \"arn:aws:events:*:*:event-bus/default\"\n - \"arn:aws:xray:*:*:sampling-rule/Default\"\n - \"arn:aws:s3:*:*:storage-lens/default-account-dashboard\"\n - \"arn:aws:rds:*:*:og:default:*\"\n - \"arn:aws:rds:*:*:pg:default.*\"\n - \"arn:aws:rds:*:*:cluster-pg:default.*\"\n - \"arn:aws:apprunner:*:*:autoscalingconfiguration/DefaultConfiguration/*\"\n # KMS keys\n # aws-nuke calls ScheduleKeyDeletion (minimum 7-day waiting period enforced\n # by AWS). Keys remain in Resource Explorer as PendingDeletion after a\n # successful nuke run.\n - \"arn:aws:kms:*:*:key/*\"\n", "ContentType": "application/x-yaml", "Description": { "Fn::Join": [ "", [ "ValidatorExclusionConfig AppConfig HostedConfiguration for Innovation Sandbox on AWS - ", { "Ref": "Namespace" } ] ] } }, "UpdateReplacePolicy": "Retain", "DeletionPolicy": "Retain", "Metadata": { "aws:cdk:path": "InnovationSandbox-Data/Config/ValidatorExclusionConfigHostedConfiguration/Resource" } }, "ConfigValidatorExclusionConfigHostedConfigurationDeploymentC180F7BAE3B05": { "Type": "AWS::AppConfig::Deployment", "Properties": { "ApplicationId": { "Ref": "ConfigApplication1A42FDD2" }, "ConfigurationProfileId": { "Ref": "ConfigValidatorExclusionConfigHostedConfigurationConfigurationProfile7F616F70" }, "ConfigurationVersion": { "Ref": "ConfigValidatorExclusionConfigHostedConfiguration47AD3080" }, "DeploymentStrategyId": { "Ref": "ConfigDeploymentStrategy6B5E2A35" }, "Description": { "Fn::Join": [ "", [ "ValidatorExclusionConfig AppConfig HostedConfiguration for Innovation Sandbox on AWS - ", { "Ref": "Namespace" } ] ] }, "EnvironmentId": { "Ref": "ConfigEnvironment6C769E19" }, "Tags": [ { "Key": "aws-solutions:isb-id", "Value": { "Fn::Join": [ "", [ { "Ref": "Namespace" }, "_isb" ] ] } } ] }, "DependsOn": [ "ConfigNukeConfigHostedConfigurationDeploymentC180F1F24ADA5" ], "Metadata": { "aws:cdk:path": "InnovationSandbox-Data/Config/ValidatorExclusionConfigHostedConfiguration/DeploymentC180F" } }, "SandboxAccountTableEFB9C069": { "Type": "AWS::DynamoDB::Table", "Properties": { "AttributeDefinitions": [ { "AttributeName": "awsAccountId", "AttributeType": "S" } ], "BillingMode": "PAY_PER_REQUEST", "DeletionProtectionEnabled": true, "KeySchema": [ { "AttributeName": "awsAccountId", "KeyType": "HASH" } ], "PointInTimeRecoverySpecification": { "PointInTimeRecoveryEnabled": true }, "SSESpecification": { "KMSMasterKeyId": { "Fn::GetAtt": [ "IsbKmsKeyInnovationSandboxData8BA6C3A2", "Arn" ] }, "SSEEnabled": true, "SSEType": "KMS" }, "Tags": [ { "Key": "aws-solutions:isb-id", "Value": { "Fn::Join": [ "", [ { "Ref": "Namespace" }, "_isb" ] ] } } ] }, "UpdateReplacePolicy": "Retain", "DeletionPolicy": "Retain", "Metadata": { "aws:cdk:path": "InnovationSandbox-Data/SandboxAccountTable/Resource" } }, "LeaseTemplateTable5128F8F4": { "Type": "AWS::DynamoDB::Table", "Properties": { "AttributeDefinitions": [ { "AttributeName": "uuid", "AttributeType": "S" }, { "AttributeName": "blueprintId", "AttributeType": "S" } ], "BillingMode": "PAY_PER_REQUEST", "DeletionProtectionEnabled": true, "GlobalSecondaryIndexes": [ { "IndexName": "blueprintId-index", "KeySchema": [ { "AttributeName": "blueprintId", "KeyType": "HASH" } ], "Projection": { "ProjectionType": "KEYS_ONLY" } } ], "KeySchema": [ { "AttributeName": "uuid", "KeyType": "HASH" } ], "PointInTimeRecoverySpecification": { "PointInTimeRecoveryEnabled": true }, "SSESpecification": { "KMSMasterKeyId": { "Fn::GetAtt": [ "IsbKmsKeyInnovationSandboxData8BA6C3A2", "Arn" ] }, "SSEEnabled": true, "SSEType": "KMS" }, "Tags": [ { "Key": "aws-solutions:isb-id", "Value": { "Fn::Join": [ "", [ { "Ref": "Namespace" }, "_isb" ] ] } } ] }, "UpdateReplacePolicy": "Retain", "DeletionPolicy": "Retain", "Metadata": { "aws:cdk:path": "InnovationSandbox-Data/LeaseTemplateTable/Resource" } }, "LeaseTable473C6DF2": { "Type": "AWS::DynamoDB::Table", "Properties": { "AttributeDefinitions": [ { "AttributeName": "userEmail", "AttributeType": "S" }, { "AttributeName": "uuid", "AttributeType": "S" }, { "AttributeName": "status", "AttributeType": "S" }, { "AttributeName": "originalLeaseTemplateUuid", "AttributeType": "S" } ], "BillingMode": "PAY_PER_REQUEST", "DeletionProtectionEnabled": true, "GlobalSecondaryIndexes": [ { "IndexName": "StatusIndex", "KeySchema": [ { "AttributeName": "status", "KeyType": "HASH" }, { "AttributeName": "originalLeaseTemplateUuid", "KeyType": "RANGE" } ], "Projection": { "ProjectionType": "ALL" } } ], "KeySchema": [ { "AttributeName": "userEmail", "KeyType": "HASH" }, { "AttributeName": "uuid", "KeyType": "RANGE" } ], "PointInTimeRecoverySpecification": { "PointInTimeRecoveryEnabled": true }, "SSESpecification": { "KMSMasterKeyId": { "Fn::GetAtt": [ "IsbKmsKeyInnovationSandboxData8BA6C3A2", "Arn" ] }, "SSEEnabled": true, "SSEType": "KMS" }, "Tags": [ { "Key": "aws-solutions:isb-id", "Value": { "Fn::Join": [ "", [ { "Ref": "Namespace" }, "_isb" ] ] } } ], "TimeToLiveSpecification": { "AttributeName": "ttl", "Enabled": true } }, "UpdateReplacePolicy": "Retain", "DeletionPolicy": "Retain", "Metadata": { "aws:cdk:path": "InnovationSandbox-Data/LeaseTable/Resource" } }, "BlueprintTableCDBC8C50": { "Type": "AWS::DynamoDB::Table", "Properties": { "AttributeDefinitions": [ { "AttributeName": "PK", "AttributeType": "S" }, { "AttributeName": "SK", "AttributeType": "S" }, { "AttributeName": "itemType", "AttributeType": "S" }, { "AttributeName": "blueprintId", "AttributeType": "S" } ], "BillingMode": "PAY_PER_REQUEST", "DeletionProtectionEnabled": true, "GlobalSecondaryIndexes": [ { "IndexName": "itemType-blueprintId-index", "KeySchema": [ { "AttributeName": "itemType", "KeyType": "HASH" }, { "AttributeName": "blueprintId", "KeyType": "RANGE" } ], "Projection": { "ProjectionType": "ALL" } } ], "KeySchema": [ { "AttributeName": "PK", "KeyType": "HASH" }, { "AttributeName": "SK", "KeyType": "RANGE" } ], "PointInTimeRecoverySpecification": { "PointInTimeRecoveryEnabled": true }, "SSESpecification": { "KMSMasterKeyId": { "Fn::GetAtt": [ "IsbKmsKeyInnovationSandboxData8BA6C3A2", "Arn" ] }, "SSEEnabled": true, "SSEType": "KMS" }, "Tags": [ { "Key": "aws-solutions:isb-id", "Value": { "Fn::Join": [ "", [ { "Ref": "Namespace" }, "_isb" ] ] } } ], "TimeToLiveSpecification": { "AttributeName": "ttl", "Enabled": true } }, "UpdateReplacePolicy": "Retain", "DeletionPolicy": "Retain", "Metadata": { "aws:cdk:path": "InnovationSandbox-Data/BlueprintTable/Resource" } }, "PrincipalTable7459E009": { "Type": "AWS::DynamoDB::Table", "Properties": { "AttributeDefinitions": [ { "AttributeName": "pk", "AttributeType": "S" }, { "AttributeName": "sk", "AttributeType": "S" }, { "AttributeName": "leaseId", "AttributeType": "S" }, { "AttributeName": "groupId", "AttributeType": "S" } ], "BillingMode": "PAY_PER_REQUEST", "DeletionProtectionEnabled": true, "GlobalSecondaryIndexes": [ { "IndexName": "LeaseIndex", "KeySchema": [ { "AttributeName": "leaseId", "KeyType": "HASH" }, { "AttributeName": "pk", "KeyType": "RANGE" } ], "Projection": { "ProjectionType": "ALL" } }, { "IndexName": "GroupIndex", "KeySchema": [ { "AttributeName": "groupId", "KeyType": "HASH" } ], "Projection": { "ProjectionType": "KEYS_ONLY" } } ], "KeySchema": [ { "AttributeName": "pk", "KeyType": "HASH" }, { "AttributeName": "sk", "KeyType": "RANGE" } ], "PointInTimeRecoverySpecification": { "PointInTimeRecoveryEnabled": true }, "SSESpecification": { "KMSMasterKeyId": { "Fn::GetAtt": [ "IsbKmsKeyInnovationSandboxData8BA6C3A2", "Arn" ] }, "SSEEnabled": true, "SSEType": "KMS" }, "Tags": [ { "Key": "aws-solutions:isb-id", "Value": { "Fn::Join": [ "", [ { "Ref": "Namespace" }, "_isb" ] ] } } ], "TimeToLiveSpecification": { "AttributeName": "ttl", "Enabled": true } }, "UpdateReplacePolicy": "Retain", "DeletionPolicy": "Retain", "Metadata": { "aws:cdk:path": "InnovationSandbox-Data/PrincipalTable/Resource" } }, "CleanupReportTableDAEB809C": { "Type": "AWS::DynamoDB::Table", "Properties": { "AttributeDefinitions": [ { "AttributeName": "pk", "AttributeType": "S" }, { "AttributeName": "sk", "AttributeType": "S" } ], "BillingMode": "PAY_PER_REQUEST", "DeletionProtectionEnabled": true, "KeySchema": [ { "AttributeName": "pk", "KeyType": "HASH" }, { "AttributeName": "sk", "KeyType": "RANGE" } ], "PointInTimeRecoverySpecification": { "PointInTimeRecoveryEnabled": true }, "SSESpecification": { "KMSMasterKeyId": { "Fn::GetAtt": [ "IsbKmsKeyInnovationSandboxData8BA6C3A2", "Arn" ] }, "SSEEnabled": true, "SSEType": "KMS" }, "Tags": [ { "Key": "aws-solutions:isb-id", "Value": { "Fn::Join": [ "", [ { "Ref": "Namespace" }, "_isb" ] ] } } ], "TimeToLiveSpecification": { "AttributeName": "ttl", "Enabled": true } }, "UpdateReplacePolicy": "Retain", "DeletionPolicy": "Retain", "Metadata": { "aws:cdk:path": "InnovationSandbox-Data/CleanupReportTable/Resource" } }, "ConfigTable5CD72349": { "Type": "AWS::DynamoDB::Table", "Properties": { "AttributeDefinitions": [ { "AttributeName": "section", "AttributeType": "S" }, { "AttributeName": "sk", "AttributeType": "S" } ], "BillingMode": "PAY_PER_REQUEST", "DeletionProtectionEnabled": true, "KeySchema": [ { "AttributeName": "section", "KeyType": "HASH" }, { "AttributeName": "sk", "KeyType": "RANGE" } ], "PointInTimeRecoverySpecification": { "PointInTimeRecoveryEnabled": true }, "SSESpecification": { "KMSMasterKeyId": { "Fn::GetAtt": [ "IsbKmsKeyInnovationSandboxData8BA6C3A2", "Arn" ] }, "SSEEnabled": true, "SSEType": "KMS" }, "Tags": [ { "Key": "aws-solutions:isb-id", "Value": { "Fn::Join": [ "", [ { "Ref": "Namespace" }, "_isb" ] ] } } ] }, "UpdateReplacePolicy": "Retain", "DeletionPolicy": "Retain", "Metadata": { "aws:cdk:path": "InnovationSandbox-Data/ConfigTable/Resource" } }, "UserPool6BA7E5F2": { "Type": "AWS::Cognito::UserPool", "Properties": { "AccountRecoverySetting": { "RecoveryMechanisms": [ { "Name": "verified_phone_number", "Priority": 1 }, { "Name": "verified_email", "Priority": 2 } ] }, "AdminCreateUserConfig": { "AllowAdminCreateUserOnly": true }, "AutoVerifiedAttributes": [ "email" ], "EmailVerificationMessage": "The verification code to your new account is {####}", "EmailVerificationSubject": "Verify your new account", "SmsVerificationMessage": "The verification code to your new account is {####}", "UserPoolName": { "Fn::Join": [ "", [ { "Ref": "Namespace" }, "-isb-users" ] ] }, "UserPoolTags": { "aws-solutions:isb-id": { "Fn::Join": [ "", [ { "Ref": "Namespace" }, "_isb" ] ] } }, "UsernameAttributes": [ "email" ], "VerificationMessageTemplate": { "DefaultEmailOption": "CONFIRM_WITH_CODE", "EmailMessage": "The verification code to your new account is {####}", "EmailSubject": "Verify your new account", "SmsMessage": "The verification code to your new account is {####}" } }, "UpdateReplacePolicy": "Retain", "DeletionPolicy": "Retain", "Metadata": { "aws:cdk:path": "InnovationSandbox-Data/UserPool/Resource" } }, "UserPoolAppClientDD0407EC": { "Type": "AWS::Cognito::UserPoolClient", "Properties": { "AccessTokenValidity": { "Fn::FindInMap": [ "Mapping", "context", "cognitoAccessTokenValidityMinutes", { "DefaultValue": "" } ] }, "AllowedOAuthFlows": [ "code" ], "AllowedOAuthFlowsUserPoolClient": true, "AllowedOAuthScopes": [ "openid", "email", "profile" ], "CallbackURLs": [ "https://localhost/callback" ], "ClientName": { "Fn::Join": [ "", [ { "Ref": "Namespace" }, "-isb-web" ] ] }, "GenerateSecret": false, "IdTokenValidity": { "Fn::FindInMap": [ "Mapping", "context", "cognitoIdTokenValidityMinutes", { "DefaultValue": "" } ] }, "LogoutURLs": [ "https://localhost/logout" ], "RefreshTokenValidity": { "Fn::FindInMap": [ "Mapping", "context", "cognitoRefreshTokenValidityDays", { "DefaultValue": "" } ] }, "SupportedIdentityProviders": [ { "Ref": "SamlIdentityProvider99D69842" } ], "TokenValidityUnits": { "AccessToken": "minutes", "IdToken": "minutes", "RefreshToken": "days" }, "UserPoolId": { "Ref": "UserPool6BA7E5F2" } }, "Metadata": { "aws:cdk:path": "InnovationSandbox-Data/UserPool/AppClient/Resource" } }, "UserPoolCognitoDomainD6C7F9FA": { "Type": "AWS::Cognito::UserPoolDomain", "Properties": { "Domain": { "Fn::Join": [ "-", [ "isb", { "Ref": "AWS::Region" }, { "Fn::Select": [ 0, { "Fn::Split": [ "-", { "Fn::Select": [ 2, { "Fn::Split": [ "/", { "Ref": "AWS::StackId" } ] } ] } ] } ] } ] ] }, "UserPoolId": { "Ref": "UserPool6BA7E5F2" } }, "Metadata": { "aws:cdk:path": "InnovationSandbox-Data/UserPool/CognitoDomain/Resource" } }, "SamlIdentityProvider99D69842": { "Type": "AWS::Cognito::UserPoolIdentityProvider", "Properties": { "ProviderDetails": { "IDPSignout": false, "MetadataURL": { "Ref": "SamlMetadataUrl" } }, "ProviderName": "IAMIdentityCenter", "ProviderType": "SAML", "UserPoolId": { "Ref": "UserPool6BA7E5F2" } }, "Metadata": { "aws:cdk:path": "InnovationSandbox-Data/SamlIdentityProvider/Resource" } }, "IsbIdentityPool": { "Type": "AWS::Cognito::IdentityPool", "Properties": { "AllowUnauthenticatedIdentities": false, "CognitoIdentityProviders": [ { "ClientId": { "Ref": "UserPoolAppClientDD0407EC" }, "ProviderName": { "Fn::GetAtt": [ "UserPool6BA7E5F2", "ProviderName" ] } } ], "IdentityPoolName": { "Fn::Join": [ "", [ { "Ref": "Namespace" }, "-isb-identity-pool" ] ] }, "IdentityPoolTags": [ { "Key": "aws-solutions:isb-id", "Value": { "Fn::Join": [ "", [ { "Ref": "Namespace" }, "_isb" ] ] } } ] }, "Metadata": { "aws:cdk:path": "InnovationSandbox-Data/IsbIdentityPool" } }, "IsbIdentityPoolAdminRole78B860C9": { "Type": "AWS::IAM::Role", "Properties": { "AssumeRolePolicyDocument": { "Statement": [ { "Action": "sts:AssumeRoleWithWebIdentity", "Condition": { "StringEquals": { "cognito-identity.amazonaws.com:aud": { "Ref": "IsbIdentityPool" } }, "ForAnyValue:StringLike": { "cognito-identity.amazonaws.com:amr": "authenticated" } }, "Effect": "Allow", "Principal": { "Federated": "cognito-identity.amazonaws.com" } } ], "Version": "2012-10-17" }, "RoleName": { "Fn::Join": [ "", [ { "Ref": "Namespace" }, "-isb-admin-role" ] ] }, "Tags": [ { "Key": "aws-solutions:isb-id", "Value": { "Fn::Join": [ "", [ { "Ref": "Namespace" }, "_isb" ] ] } } ] }, "Metadata": { "aws:cdk:path": "InnovationSandbox-Data/IsbIdentityPoolAdminRole/Resource", "guard": { "SuppressedRules": [ "CFN_NO_EXPLICIT_RESOURCE_NAMES" ] } } }, "IsbIdentityPoolManagerRole8FFC48FC": { "Type": "AWS::IAM::Role", "Properties": { "AssumeRolePolicyDocument": { "Statement": [ { "Action": "sts:AssumeRoleWithWebIdentity", "Condition": { "StringEquals": { "cognito-identity.amazonaws.com:aud": { "Ref": "IsbIdentityPool" } }, "ForAnyValue:StringLike": { "cognito-identity.amazonaws.com:amr": "authenticated" } }, "Effect": "Allow", "Principal": { "Federated": "cognito-identity.amazonaws.com" } } ], "Version": "2012-10-17" }, "RoleName": { "Fn::Join": [ "", [ { "Ref": "Namespace" }, "-isb-manager-role" ] ] }, "Tags": [ { "Key": "aws-solutions:isb-id", "Value": { "Fn::Join": [ "", [ { "Ref": "Namespace" }, "_isb" ] ] } } ] }, "Metadata": { "aws:cdk:path": "InnovationSandbox-Data/IsbIdentityPoolManagerRole/Resource", "guard": { "SuppressedRules": [ "CFN_NO_EXPLICIT_RESOURCE_NAMES" ] } } }, "IsbIdentityPoolUserRole540833A6": { "Type": "AWS::IAM::Role", "Properties": { "AssumeRolePolicyDocument": { "Statement": [ { "Action": "sts:AssumeRoleWithWebIdentity", "Condition": { "StringEquals": { "cognito-identity.amazonaws.com:aud": { "Ref": "IsbIdentityPool" } }, "ForAnyValue:StringLike": { "cognito-identity.amazonaws.com:amr": "authenticated" } }, "Effect": "Allow", "Principal": { "Federated": "cognito-identity.amazonaws.com" } } ], "Version": "2012-10-17" }, "RoleName": { "Fn::Join": [ "", [ { "Ref": "Namespace" }, "-isb-user-role" ] ] }, "Tags": [ { "Key": "aws-solutions:isb-id", "Value": { "Fn::Join": [ "", [ { "Ref": "Namespace" }, "_isb" ] ] } } ] }, "Metadata": { "aws:cdk:path": "InnovationSandbox-Data/IsbIdentityPoolUserRole/Resource", "guard": { "SuppressedRules": [ "CFN_NO_EXPLICIT_RESOURCE_NAMES" ] } } }, "IsbIdentityPoolRoleAttachment": { "Type": "AWS::Cognito::IdentityPoolRoleAttachment", "Properties": { "IdentityPoolId": { "Ref": "IsbIdentityPool" }, "RoleMappings": { "cognitoProvider": { "AmbiguousRoleResolution": "Deny", "IdentityProvider": { "Fn::Join": [ "", [ { "Fn::GetAtt": [ "UserPool6BA7E5F2", "ProviderName" ] }, ":", { "Ref": "UserPoolAppClientDD0407EC" } ] ] }, "RulesConfiguration": { "Rules": [ { "Claim": "custom:isb_roles", "MatchType": "Contains", "RoleARN": { "Fn::GetAtt": [ "IsbIdentityPoolAdminRole78B860C9", "Arn" ] }, "Value": "\"Admin\"" }, { "Claim": "custom:isb_roles", "MatchType": "Contains", "RoleARN": { "Fn::GetAtt": [ "IsbIdentityPoolManagerRole8FFC48FC", "Arn" ] }, "Value": "\"Manager\"" }, { "Claim": "custom:isb_roles", "MatchType": "Contains", "RoleARN": { "Fn::GetAtt": [ "IsbIdentityPoolUserRole540833A6", "Arn" ] }, "Value": "\"User\"" } ] }, "Type": "Rules" } }, "Roles": { "authenticated": { "Fn::GetAtt": [ "IsbIdentityPoolUserRole540833A6", "Arn" ] } } }, "Metadata": { "aws:cdk:path": "InnovationSandbox-Data/IsbIdentityPoolRoleAttachment" } }, "ConfigMigratorConfigMigratorLambdaFunctionFunctionRole215C26BD": { "Type": "AWS::IAM::Role", "Properties": { "AssumeRolePolicyDocument": { "Statement": [ { "Action": "sts:AssumeRole", "Effect": "Allow", "Principal": { "Service": "lambda.amazonaws.com" } } ], "Version": "2012-10-17" }, "Tags": [ { "Key": "aws-solutions:isb-id", "Value": { "Fn::Join": [ "", [ { "Ref": "Namespace" }, "_isb" ] ] } } ] }, "Metadata": { "aws:cdk:path": "InnovationSandbox-Data/ConfigMigrator/ConfigMigratorLambdaFunction/FunctionRole/Resource" } }, "ConfigMigratorConfigMigratorLambdaFunctionFunctionRoleDefaultPolicy26AA8D83": { "Type": "AWS::IAM::Policy", "Properties": { "PolicyDocument": { "Statement": [ { "Action": [ "xray:PutTraceSegments", "xray:PutTelemetryRecords" ], "Effect": "Allow", "Resource": "*" }, { "Action": [ "logs:CreateLogStream", "logs:PutLogEvents" ], "Effect": "Allow", "Resource": { "Fn::GetAtt": [ "ISBLogGroupCustomResources63629E09", "Arn" ] } }, { "Action": "appconfig:ListConfigurationProfiles", "Effect": "Allow", "Resource": { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":appconfig:", { "Ref": "AWS::Region" }, ":", { "Ref": "AWS::AccountId" }, ":application/", { "Ref": "ConfigApplication1A42FDD2" } ] ] } }, { "Action": [ "appconfig:StartConfigurationSession", "appconfig:GetLatestConfiguration" ], "Effect": "Allow", "Resource": { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":appconfig:", { "Ref": "AWS::Region" }, ":", { "Ref": "AWS::AccountId" }, ":application/", { "Ref": "ConfigApplication1A42FDD2" }, "/environment/", { "Ref": "ConfigEnvironment6C769E19" }, "/configuration/*" ] ] } }, { "Action": [ "dynamodb:BatchGetItem", "dynamodb:PutItem" ], "Effect": "Allow", "Resource": { "Fn::GetAtt": [ "ConfigTable5CD72349", "Arn" ] } }, { "Action": [ "kms:Decrypt", "kms:Encrypt", "kms:GenerateDataKey", "kms:DescribeKey" ], "Effect": "Allow", "Resource": { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":kms:", { "Ref": "AWS::Region" }, ":", { "Ref": "AWS::AccountId" }, ":key/", { "Ref": "IsbKmsKeyInnovationSandboxData8BA6C3A2" } ] ] } } ], "Version": "2012-10-17" }, "PolicyName": "ConfigMigratorConfigMigratorLambdaFunctionFunctionRoleDefaultPolicy26AA8D83", "Roles": [ { "Ref": "ConfigMigratorConfigMigratorLambdaFunctionFunctionRole215C26BD" } ] }, "Metadata": { "aws:cdk:path": "InnovationSandbox-Data/ConfigMigrator/ConfigMigratorLambdaFunction/FunctionRole/DefaultPolicy/Resource" } }, "ConfigMigratorConfigMigratorLambdaFunction4DA3FFF5": { "Type": "AWS::Lambda::Function", "Properties": { "Architectures": [ "arm64" ], "Code": { "S3Bucket": { "Fn::Sub": "solutions-${AWS::Region}" }, "S3Key": "innovation-sandbox-on-aws/v1.3.0/asset.40e21d5035af3c84b7655300117fd5e4e527b46acc7b7518b3b1e2e4debc76f7.zip" }, "Description": "Custom resource lambda that migrates AppConfig configuration to DynamoDB", "Environment": { "Variables": { "NODE_OPTIONS": "--enable-source-maps", "USER_AGENT_EXTRA": "AwsSolution/SO0284/v1.3.0", "POWERTOOLS_SERVICE_NAME": "innovation-sandbox", "AWS_XRAY_CONTEXT_MISSING": "IGNORE_ERROR", "APP_CONFIG_APPLICATION_ID": { "Ref": "ConfigApplication1A42FDD2" }, "APP_CONFIG_ENVIRONMENT_ID": { "Ref": "ConfigEnvironment6C769E19" }, "CONFIG_TABLE_NAME": { "Ref": "ConfigTable5CD72349" } } }, "FunctionName": { "Fn::Join": [ "", [ "ISB-ConfigMigratorLambdaFunction-", { "Ref": "Namespace" } ] ] }, "Handler": "index.handler", "Layers": [ { "Ref": "ConfigMigratorISBLambdaLayerInnovationSandboxDataDependenciesLayerVersion41B7A672" }, { "Ref": "ConfigMigratorISBLambdaLayerInnovationSandboxDataCommonLayerVersion13067F2D" } ], "LoggingConfig": { "ApplicationLogLevel": "INFO", "LogFormat": "JSON", "LogGroup": { "Ref": "ISBLogGroupCustomResources63629E09" }, "SystemLogLevel": "INFO" }, "MemorySize": 1024, "Role": { "Fn::GetAtt": [ "ConfigMigratorConfigMigratorLambdaFunctionFunctionRole215C26BD", "Arn" ] }, "Runtime": "nodejs24.x", "Tags": [ { "Key": "aws-solutions:isb-id", "Value": { "Fn::Join": [ "", [ { "Ref": "Namespace" }, "_isb" ] ] } } ], "Timeout": 60, "TracingConfig": { "Mode": "Active" } }, "DependsOn": [ "ConfigMigratorConfigMigratorLambdaFunctionFunctionRoleDefaultPolicy26AA8D83", "ConfigMigratorConfigMigratorLambdaFunctionFunctionRole215C26BD" ], "Metadata": { "aws:cdk:path": "InnovationSandbox-Data/ConfigMigrator/ConfigMigratorLambdaFunction/Function/Resource", "aws:asset:path": "asset.40e21d5035af3c84b7655300117fd5e4e527b46acc7b7518b3b1e2e4debc76f7", "aws:asset:is-bundled": true, "aws:asset:property": "Code", "guard": { "SuppressedRules": [ "LAMBDA_INSIDE_VPC", "LAMBDA_CONCURRENCY_CHECK" ] } } }, "ConfigMigratorConfigMigratorLambdaFunctionIsbProviderframeworkonEventServiceRoleA5F37513": { "Type": "AWS::IAM::Role", "Properties": { "AssumeRolePolicyDocument": { "Statement": [ { "Action": "sts:AssumeRole", "Effect": "Allow", "Principal": { "Service": "lambda.amazonaws.com" } } ], "Version": "2012-10-17" }, "ManagedPolicyArns": [ { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":iam::aws:policy/service-role/AWSLambdaBasicExecutionRole" ] ] } ], "Tags": [ { "Key": "aws-solutions:isb-id", "Value": { "Fn::Join": [ "", [ { "Ref": "Namespace" }, "_isb" ] ] } } ] }, "Metadata": { "aws:cdk:path": "InnovationSandbox-Data/ConfigMigrator/ConfigMigratorLambdaFunction/IsbProvider/framework-onEvent/ServiceRole/Resource" } }, "ConfigMigratorConfigMigratorLambdaFunctionIsbProviderframeworkonEventServiceRoleDefaultPolicy15F56057": { "Type": "AWS::IAM::Policy", "Properties": { "PolicyDocument": { "Statement": [ { "Action": "lambda:InvokeFunction", "Effect": "Allow", "Resource": [ { "Fn::GetAtt": [ "ConfigMigratorConfigMigratorLambdaFunction4DA3FFF5", "Arn" ] }, { "Fn::Join": [ "", [ { "Fn::GetAtt": [ "ConfigMigratorConfigMigratorLambdaFunction4DA3FFF5", "Arn" ] }, ":*" ] ] } ] }, { "Action": "lambda:GetFunction", "Effect": "Allow", "Resource": { "Fn::GetAtt": [ "ConfigMigratorConfigMigratorLambdaFunction4DA3FFF5", "Arn" ] } } ], "Version": "2012-10-17" }, "PolicyName": "ConfigMigratorConfigMigratorLambdaFunctionIsbProviderframeworkonEventServiceRoleDefaultPolicy15F56057", "Roles": [ { "Ref": "ConfigMigratorConfigMigratorLambdaFunctionIsbProviderframeworkonEventServiceRoleA5F37513" } ] }, "Metadata": { "aws:cdk:path": "InnovationSandbox-Data/ConfigMigrator/ConfigMigratorLambdaFunction/IsbProvider/framework-onEvent/ServiceRole/DefaultPolicy/Resource" } }, "ConfigMigratorConfigMigratorLambdaFunctionIsbProviderframeworkonEvent60AD5DE6": { "Type": "AWS::Lambda::Function", "Properties": { "Code": { "S3Bucket": { "Fn::Sub": "solutions-${AWS::Region}" }, "S3Key": "innovation-sandbox-on-aws/v1.3.0/asset.e16ffb3b34af185b8b30c88fdb19faa13b6c42bb38580485c4e84b384ee48b63.zip" }, "Description": "AWS CDK resource provider framework - onEvent (InnovationSandbox-Data/ConfigMigrator/ConfigMigratorLambdaFunction/IsbProvider)", "Environment": { "Variables": { "USER_ON_EVENT_FUNCTION_ARN": { "Fn::GetAtt": [ "ConfigMigratorConfigMigratorLambdaFunction4DA3FFF5", "Arn" ] } } }, "Handler": "framework.onEvent", "LoggingConfig": { "ApplicationLogLevel": "FATAL", "LogFormat": "JSON", "LogGroup": { "Ref": "ISBLogGroupCustomResources63629E09" } }, "Role": { "Fn::GetAtt": [ "ConfigMigratorConfigMigratorLambdaFunctionIsbProviderframeworkonEventServiceRoleA5F37513", "Arn" ] }, "Runtime": "nodejs24.x", "Tags": [ { "Key": "aws-solutions:isb-id", "Value": { "Fn::Join": [ "", [ { "Ref": "Namespace" }, "_isb" ] ] } } ], "Timeout": 900 }, "DependsOn": [ "ConfigMigratorConfigMigratorLambdaFunctionIsbProviderframeworkonEventServiceRoleDefaultPolicy15F56057", "ConfigMigratorConfigMigratorLambdaFunctionIsbProviderframeworkonEventServiceRoleA5F37513" ], "Metadata": { "aws:cdk:path": "InnovationSandbox-Data/ConfigMigrator/ConfigMigratorLambdaFunction/IsbProvider/framework-onEvent/Resource", "aws:asset:path": "asset.e16ffb3b34af185b8b30c88fdb19faa13b6c42bb38580485c4e84b384ee48b63", "aws:asset:is-bundled": false, "aws:asset:property": "Code", "guard": { "SuppressedRules": [ "LAMBDA_INSIDE_VPC", "LAMBDA_CONCURRENCY_CHECK" ] } } }, "ConfigMigratorConfigMigratorLambdaFunctionIsbCustomResourceD22C1266": { "Type": "Custom::ConfigMigrator", "Properties": { "ServiceToken": { "Fn::GetAtt": [ "ConfigMigratorConfigMigratorLambdaFunctionIsbProviderframeworkonEvent60AD5DE6", "Arn" ] } }, "UpdateReplacePolicy": "Delete", "DeletionPolicy": "Delete", "Metadata": { "aws:cdk:path": "InnovationSandbox-Data/ConfigMigrator/ConfigMigratorLambdaFunction/IsbCustomResource/Default" } }, "ConfigMigratorISBLambdaLayerInnovationSandboxDataCommonLayerVersion13067F2D": { "Type": "AWS::Lambda::LayerVersion", "Properties": { "CompatibleArchitectures": [ "arm64" ], "CompatibleRuntimes": [ "nodejs24.x" ], "Content": { "S3Bucket": { "Fn::Sub": "solutions-${AWS::Region}" }, "S3Key": "innovation-sandbox-on-aws/v1.3.0/asset.1f5cc6c90f95b6fb7be25037f56001dc1897d61f443e7e7d02106042e83d7cdb.zip" }, "Description": "Common lib for Innovation Sandbox on AWS" }, "Metadata": { "aws:cdk:path": "InnovationSandbox-Data/ConfigMigrator/ISB-Lambda-Layer-InnovationSandbox-Data/CommonLayerVersion/Resource", "aws:asset:path": "asset.1f5cc6c90f95b6fb7be25037f56001dc1897d61f443e7e7d02106042e83d7cdb", "aws:asset:is-bundled": false, "aws:asset:property": "Content" } }, "ConfigMigratorISBLambdaLayerInnovationSandboxDataDependenciesLayerVersion41B7A672": { "Type": "AWS::Lambda::LayerVersion", "Properties": { "CompatibleArchitectures": [ "arm64" ], "CompatibleRuntimes": [ "nodejs24.x" ], "Content": { "S3Bucket": { "Fn::Sub": "solutions-${AWS::Region}" }, "S3Key": "innovation-sandbox-on-aws/v1.3.0/asset.8e15abb3317296d7d4308c048fbc129062e3aa7565553a2d0f650d6e9c3801cc.zip" }, "Description": "Third party runtime dependencies for Innovation Sandbox on AWS" }, "Metadata": { "aws:cdk:path": "InnovationSandbox-Data/ConfigMigrator/ISB-Lambda-Layer-InnovationSandbox-Data/DependenciesLayerVersion/Resource", "aws:asset:path": "asset.8e15abb3317296d7d4308c048fbc129062e3aa7565553a2d0f650d6e9c3801cc", "aws:asset:is-bundled": false, "aws:asset:property": "Content" } }, "ISBLogGroupCustomResources63629E09": { "Type": "AWS::Logs::LogGroup", "Properties": { "KmsKeyId": { "Fn::GetAtt": [ "IsbKmsKeyInnovationSandboxData8BA6C3A2", "Arn" ] }, "RetentionInDays": { "Fn::FindInMap": [ "Mapping", "context", "cloudWatchLogRetentionInDays", { "DefaultValue": "" } ] }, "Tags": [ { "Key": "aws-solutions:isb-id", "Value": { "Fn::Join": [ "", [ { "Ref": "Namespace" }, "_isb" ] ] } } ] }, "UpdateReplacePolicy": "Retain", "DeletionPolicy": "Retain", "Metadata": { "aws:cdk:path": "InnovationSandbox-Data/ISBLogGroup-CustomResources/Resource", "guard": { "SuppressedRules": [ "CW_LOGGROUP_RETENTION_PERIOD_CHECK" ] } } }, "DataConfiguration459A4DE7": { "Type": "AWS::SSM::Parameter", "Properties": { "Description": "The configuration of the data stack of Innovation Sandbox", "Name": { "Fn::Join": [ "", [ "InnovationSandbox_", { "Ref": "Namespace" }, "_Data_Configuration" ] ] }, "Tags": { "aws-solutions:isb-id": { "Fn::Join": [ "", [ { "Ref": "Namespace" }, "_isb" ] ] } }, "Type": "String", "Value": { "Fn::Join": [ "", [ "{\"configApplicationId\":\"", { "Ref": "ConfigApplication1A42FDD2" }, "\",\"configEnvironmentId\":\"", { "Ref": "ConfigEnvironment6C769E19" }, "\",\"configTableName\":\"", { "Ref": "ConfigTable5CD72349" }, "\",\"nukeConfigConfigurationProfileId\":\"", { "Ref": "ConfigNukeConfigHostedConfigurationConfigurationProfileEC3A0164" }, "\",\"validatorExclusionConfigConfigurationProfileId\":\"", { "Ref": "ConfigValidatorExclusionConfigHostedConfigurationConfigurationProfile7F616F70" }, "\",\"accountTable\":\"", { "Ref": "SandboxAccountTableEFB9C069" }, "\",\"leaseTemplateTable\":\"", { "Ref": "LeaseTemplateTable5128F8F4" }, "\",\"leaseTable\":\"", { "Ref": "LeaseTable473C6DF2" }, "\",\"blueprintTable\":\"", { "Ref": "BlueprintTableCDBC8C50" }, "\",\"principalTable\":\"", { "Ref": "PrincipalTable7459E009" }, "\",\"cleanupReportTable\":\"", { "Ref": "CleanupReportTableDAEB809C" }, "\",\"tableKmsKeyId\":\"", { "Ref": "IsbKmsKeyInnovationSandboxData8BA6C3A2" }, "\",\"solutionVersion\":\"", { "Fn::FindInMap": [ "Mapping", "context", "version", { "DefaultValue": "" } ] }, "\",\"supportedSchemas\":\"[\\\"1\\\"]\",\"cognitoUserPoolId\":\"", { "Ref": "UserPool6BA7E5F2" }, "\",\"cognitoUserPoolArn\":\"", { "Fn::GetAtt": [ "UserPool6BA7E5F2", "Arn" ] }, "\",\"cognitoAppClientId\":\"", { "Ref": "UserPoolAppClientDD0407EC" }, "\",\"cognitoIdentityPoolId\":\"", { "Ref": "IsbIdentityPool" }, "\",\"cognitoDomain\":\"", { "Fn::Join": [ "-", [ "isb", { "Ref": "AWS::Region" }, { "Fn::Select": [ 0, { "Fn::Split": [ "-", { "Fn::Select": [ 2, { "Fn::Split": [ "/", { "Ref": "AWS::StackId" } ] } ] } ] } ] } ] ] }, "\",\"awsAccessPortalUrl\":\"", { "Ref": "AwsAccessPortalUrl" }, "\",\"identityPoolAdminRoleName\":\"", { "Ref": "IsbIdentityPoolAdminRole78B860C9" }, "\",\"identityPoolManagerRoleName\":\"", { "Ref": "IsbIdentityPoolManagerRole8FFC48FC" }, "\",\"identityPoolUserRoleName\":\"", { "Ref": "IsbIdentityPoolUserRole540833A6" }, "\"}" ] ] } }, "Metadata": { "aws:cdk:path": "InnovationSandbox-Data/DataConfiguration/Resource" } }, "CDKMetadata": { "Type": "AWS::CDK::Metadata", "Properties": { "Analytics": "v2:deflate64:H4sIAAAAAAAA/21SzW7bMAx+lt4VrXCB3tN064Z2m5FsuwaMzLhMJNEQ5RSG4XcfpDiOW/TE74cURYKFLu7v9e0NvMnCVMeFpZ3uNxHMUa32voQADiMGBW+y7Y9OdP+MXbJSWFoCSSSDQUHTGPZ7qnW/bBpLBiKxzwkz+tWfKLB36GOy5vQRG8tdgpsYIGKdW32ifmeJWK1yszZMbd4JZeA9WUz6J+n/MMhYdX1/UFXnwXG10/0f2J2LMxiU4dpTZN3/FQwls03ehC9gZWmc64NyoY/sgPw8YVQu9EeFPlLsysAnqjBswL1r9dFP3qSN35rzNVtcxgjm9TwhgdN9ElNijiVbMnnTZzQoC25XwdZzhQfRv3L41nqT9yx3WxDBKHqZgpI7/dCaI8YHEBxLdb/a+6liAi/QYZhtfs4HZbkW3b9w/RS4bbI/4kGJuHSXgXx9Pcr5hQ6DWqNwG0we7Cc0Dfla5S9uItSJmFYiu20Y80Rfd5id+QNz/LuNTRsHlfahD/LlVBS6KPTtzUGIFqH1kRzq9Tn+B8Ib2GRSAwAA" }, "Metadata": { "aws:cdk:path": "InnovationSandbox-Data/CDKMetadata/Default" }, "Condition": "CDKMetadataAvailable" } }, "Mappings": { "Mapping": { "context": { "solutionName": "innovation-sandbox-on-aws", "solutionId": "SO0284", "version": "v1.3.0", "distOutputBucket": "solutions", "publicEcrRegistry": "public.ecr.aws/aws-solutions", "publicEcrTag": "v1.3.0", "deploymentMode": "prod", "stackPrefix": "InnovationSandbox", "cloudWatchLogRetentionInDays": 90, "s3LogsArchiveRetentionInDays": 365, "s3LogsGlacierRetentionInDays": 2555, "apiThrottlingRateLimit": 100, "apiThrottlingBurstLimit": 200, "cognitoAccessTokenValidityMinutes": 60, "cognitoIdTokenValidityMinutes": 60, "cognitoRefreshTokenValidityDays": 7, "bucketPrefix": "innovation-sandbox-on-aws/v1.3.0/asset." } } }, "Outputs": { "ConfigApplicationId": { "Value": { "Ref": "ConfigApplication1A42FDD2" }, "Export": { "Name": { "Fn::Join": [ "", [ "InnovationSandbox-Data-", { "Ref": "Namespace" }, "-ConfigApplicationId" ] ] } } }, "ConfigEnvironmentId": { "Value": { "Ref": "ConfigEnvironment6C769E19" }, "Export": { "Name": { "Fn::Join": [ "", [ "InnovationSandbox-Data-", { "Ref": "Namespace" }, "-ConfigEnvironmentId" ] ] } } }, "ConfigDeploymentStrategyId": { "Value": { "Ref": "ConfigDeploymentStrategy6B5E2A35" }, "Export": { "Name": { "Fn::Join": [ "", [ "InnovationSandbox-Data-", { "Ref": "Namespace" }, "-ConfigDeploymentStrategyId" ] ] } } }, "NukeConfigConfigurationProfileId": { "Value": { "Ref": "ConfigNukeConfigHostedConfigurationConfigurationProfileEC3A0164" }, "Export": { "Name": { "Fn::Join": [ "", [ "InnovationSandbox-Data-", { "Ref": "Namespace" }, "-NukeConfigConfigurationProfileId" ] ] } } }, "ValidatorExclusionConfigConfigurationProfileId": { "Value": { "Ref": "ConfigValidatorExclusionConfigHostedConfigurationConfigurationProfile7F616F70" }, "Export": { "Name": { "Fn::Join": [ "", [ "InnovationSandbox-Data-", { "Ref": "Namespace" }, "-ValidatorExclusionConfigConfigurationProfileId" ] ] } } }, "SandboxAccountTable": { "Value": { "Ref": "SandboxAccountTableEFB9C069" }, "Export": { "Name": { "Fn::Join": [ "", [ "InnovationSandbox-Data-", { "Ref": "Namespace" }, "-SandboxAccountTable" ] ] } } }, "LeaseTemplateTable": { "Value": { "Ref": "LeaseTemplateTable5128F8F4" }, "Export": { "Name": { "Fn::Join": [ "", [ "InnovationSandbox-Data-", { "Ref": "Namespace" }, "-LeaseTemplateTable" ] ] } } }, "LeaseTable": { "Value": { "Ref": "LeaseTable473C6DF2" }, "Export": { "Name": { "Fn::Join": [ "", [ "InnovationSandbox-Data-", { "Ref": "Namespace" }, "-LeaseTable" ] ] } } }, "PrincipalTable": { "Value": { "Ref": "PrincipalTable7459E009" }, "Export": { "Name": { "Fn::Join": [ "", [ "InnovationSandbox-Data-", { "Ref": "Namespace" }, "-PrincipalTable" ] ] } } }, "CleanupReportTable": { "Value": { "Ref": "CleanupReportTableDAEB809C" }, "Export": { "Name": { "Fn::Join": [ "", [ "InnovationSandbox-Data-", { "Ref": "Namespace" }, "-CleanupReportTable" ] ] } } }, "CognitoUserPoolId": { "Value": { "Ref": "UserPool6BA7E5F2" }, "Export": { "Name": { "Fn::Join": [ "", [ "InnovationSandbox-Data-", { "Ref": "Namespace" }, "-CognitoUserPoolId" ] ] } } }, "CognitoAppClientId": { "Value": { "Ref": "UserPoolAppClientDD0407EC" }, "Export": { "Name": { "Fn::Join": [ "", [ "InnovationSandbox-Data-", { "Ref": "Namespace" }, "-CognitoAppClientId" ] ] } } }, "CognitoIdentityPoolId": { "Value": { "Ref": "IsbIdentityPool" }, "Export": { "Name": { "Fn::Join": [ "", [ "InnovationSandbox-Data-", { "Ref": "Namespace" }, "-CognitoIdentityPoolId" ] ] } } }, "CognitoDomain": { "Value": { "Fn::Join": [ "-", [ "isb", { "Ref": "AWS::Region" }, { "Fn::Select": [ 0, { "Fn::Split": [ "-", { "Fn::Select": [ 2, { "Fn::Split": [ "/", { "Ref": "AWS::StackId" } ] } ] } ] } ] } ] ] }, "Export": { "Name": { "Fn::Join": [ "", [ "InnovationSandbox-Data-", { "Ref": "Namespace" }, "-CognitoDomain" ] ] } } }, "CognitoAcsUrl": { "Value": { "Fn::Join": [ "", [ "https://", { "Fn::Join": [ "-", [ "isb", { "Ref": "AWS::Region" }, { "Fn::Select": [ 0, { "Fn::Split": [ "-", { "Fn::Select": [ 2, { "Fn::Split": [ "/", { "Ref": "AWS::StackId" } ] } ] } ] } ] } ] ] }, ".auth.", { "Ref": "AWS::Region" }, ".amazoncognito.com/saml2/idpresponse" ] ] }, "Export": { "Name": { "Fn::Join": [ "", [ "InnovationSandbox-Data-", { "Ref": "Namespace" }, "-CognitoAcsUrl" ] ] } } }, "CognitoAudience": { "Value": { "Fn::Join": [ "", [ "urn:amazon:cognito:sp:", { "Ref": "UserPool6BA7E5F2" } ] ] }, "Export": { "Name": { "Fn::Join": [ "", [ "InnovationSandbox-Data-", { "Ref": "Namespace" }, "-CognitoAudience" ] ] } } } }, "Conditions": { "CDKMetadataAvailable": { "Fn::Or": [ { "Fn::Or": [ { "Fn::Equals": [ { "Ref": "AWS::Region" }, "af-south-1" ] }, { "Fn::Equals": [ { "Ref": "AWS::Region" }, "ap-east-1" ] }, { "Fn::Equals": [ { "Ref": "AWS::Region" }, "ap-northeast-1" ] }, { "Fn::Equals": [ { "Ref": "AWS::Region" }, "ap-northeast-2" ] }, { "Fn::Equals": [ { "Ref": "AWS::Region" }, "ap-northeast-3" ] }, { "Fn::Equals": [ { "Ref": "AWS::Region" }, "ap-south-1" ] }, { "Fn::Equals": [ { "Ref": "AWS::Region" }, "ap-south-2" ] }, { "Fn::Equals": [ { "Ref": "AWS::Region" }, "ap-southeast-1" ] }, { "Fn::Equals": [ { "Ref": "AWS::Region" }, "ap-southeast-2" ] }, { "Fn::Equals": [ { "Ref": "AWS::Region" }, "ap-southeast-3" ] } ] }, { "Fn::Or": [ { "Fn::Equals": [ { "Ref": "AWS::Region" }, "ap-southeast-4" ] }, { "Fn::Equals": [ { "Ref": "AWS::Region" }, "ca-central-1" ] }, { "Fn::Equals": [ { "Ref": "AWS::Region" }, "ca-west-1" ] }, { "Fn::Equals": [ { "Ref": "AWS::Region" }, "cn-north-1" ] }, { "Fn::Equals": [ { "Ref": "AWS::Region" }, "cn-northwest-1" ] }, { "Fn::Equals": [ { "Ref": "AWS::Region" }, "eu-central-1" ] }, { "Fn::Equals": [ { "Ref": "AWS::Region" }, "eu-central-2" ] }, { "Fn::Equals": [ { "Ref": "AWS::Region" }, "eu-north-1" ] }, { "Fn::Equals": [ { "Ref": "AWS::Region" }, "eu-south-1" ] }, { "Fn::Equals": [ { "Ref": "AWS::Region" }, "eu-south-2" ] } ] }, { "Fn::Or": [ { "Fn::Equals": [ { "Ref": "AWS::Region" }, "eu-west-1" ] }, { "Fn::Equals": [ { "Ref": "AWS::Region" }, "eu-west-2" ] }, { "Fn::Equals": [ { "Ref": "AWS::Region" }, "eu-west-3" ] }, { "Fn::Equals": [ { "Ref": "AWS::Region" }, "il-central-1" ] }, { "Fn::Equals": [ { "Ref": "AWS::Region" }, "me-central-1" ] }, { "Fn::Equals": [ { "Ref": "AWS::Region" }, "me-south-1" ] }, { "Fn::Equals": [ { "Ref": "AWS::Region" }, "sa-east-1" ] }, { "Fn::Equals": [ { "Ref": "AWS::Region" }, "us-east-1" ] }, { "Fn::Equals": [ { "Ref": "AWS::Region" }, "us-east-2" ] }, { "Fn::Equals": [ { "Ref": "AWS::Region" }, "us-west-1" ] } ] }, { "Fn::Equals": [ { "Ref": "AWS::Region" }, "us-west-2" ] } ] } } }