{ "Description": "(SO0140) - Amazon S3 Glacier Re:Freezer copies Amazon S3 Glacier Vault archives to Amazon S3 Bucket. Version v1.0.1", "Metadata": { "AWS::CloudFormation::Interface": { "ParameterGroups": [ { "Label": { "default": "Required input parameters" }, "Parameters": [ "SourceVault", "DestinationBucket", "DestinationStorageClass", "GlacierRetrievalTier" ] }, { "Label": { "default": "Confirmation to avoid excessive costs" }, "Parameters": [ "CloudTrailExportConfirmation", "SNSTopicForVaultConfirmation" ] }, { "Label": { "default": "[OPTIONAL] External filenames override for ArchiveDescription" }, "Parameters": [ "FilelistS3Location" ] } ], "ParameterLabels": { "SourceVault": { "default": "Source Glacier vault name" }, "DestinationBucket": { "default": "S3 destination bucket name" }, "DestinationStorageClass": { "default": "S3 destination storage class" }, "GlacierRetrievalTier": { "default": "Glacier retrieval tier" }, "FilelistS3Location": { "default": "Amazon S3 location of the CSV file as BUCKET/FILEPATH" }, "CloudTrailExportConfirmation": { "default": "Have you checked that there is only one Cloudtrail export to S3 bucket configured in your account?" }, "SNSTopicForVaultConfirmation": { "default": "Has default SNS notification topic on the vault been disabled or is it acceptable to receive notification for ALL archives in the vault?" } } } }, "Mappings": { "AnonymousStatisticsMap": { "SendAnonymousStatistics": { "Data": "Yes" } } }, "Parameters": { "SourceVault": { "Type": "String", "AllowedPattern": ".+" }, "DestinationBucket": { "Type": "String", "AllowedPattern": ".+" }, "DestinationStorageClass": { "Type": "String", "Default": "STANDARD", "AllowedValues": [ "STANDARD", "INTELLIGENT_TIERING", "STANDARD_IA", "ONEZONE_IA", "GLACIER", "DEEP_ARCHIVE" ] }, "GlacierRetrievalTier": { "Type": "String", "Default": "Bulk", "AllowedValues": [ "Bulk" ] }, "FilelistS3Location": { "Type": "String", "Default": "" }, "CloudTrailExportConfirmation": { "Type": "String", "AllowedValues": [ "Yes", "No" ] }, "SNSTopicForVaultConfirmation": { "Type": "String", "AllowedValues": [ "Yes", "No" ] } }, "Resources": { "stagingBucket": { "Type": "AWS::S3::Bucket", "Properties": { "BucketEncryption": { "ServerSideEncryptionConfiguration": [ { "ServerSideEncryptionByDefault": { "SSEAlgorithm": "AES256" } } ] }, "PublicAccessBlockConfiguration": { "BlockPublicAcls": true, "BlockPublicPolicy": true, "IgnorePublicAcls": true, "RestrictPublicBuckets": true }, "Tags": [ { "Key": "solution", "Value": "amazon-s3-glacier-refreezer" } ] }, "UpdateReplacePolicy": "Delete", "DeletionPolicy": "Delete", "Metadata": { "cfn_nag": { "rules_to_suppress": [ { "id": "W51", "reason": "This bucket does not need a bucket policy" }, { "id": "W35", "reason": "Temporary storage - access logs are not required. EngSec exemption received." } ] } } }, "stagingBucketStagingBucketPolicyCD743064": { "Type": "AWS::S3::BucketPolicy", "Properties": { "Bucket": { "Ref": "stagingBucket" }, "PolicyDocument": { "Statement": [ { "Action": "s3:*", "Condition": { "Bool": { "aws:SecureTransport": "false" } }, "Effect": "Deny", "Principal": "*", "Resource": [ { "Fn::GetAtt": [ "stagingBucket", "Arn" ] }, { "Fn::Join": [ "", [ { "Fn::GetAtt": [ "stagingBucket", "Arn" ] }, "/*" ] ] } ] } ], "Version": "2012-10-17" } }, "Metadata": { "aws:cdk:path": "amazon-s3-glacier-refreezer/stagingBucket/StagingBucket/Policy/Resource" } }, "glueDataCatalogtoLowercaseServiceRole45F7D11F": { "Type": "AWS::IAM::Role", "Properties": { "AssumeRolePolicyDocument": { "Statement": [ { "Action": "sts:AssumeRole", "Effect": "Allow", "Principal": { "Service": "lambda.amazonaws.com" } } ], "Version": "2012-10-17" }, "ManagedPolicyArns": [ { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":iam::aws:policy/service-role/AWSLambdaBasicExecutionRole" ] ] } ], "Tags": [ { "Key": "solution", "Value": "amazon-s3-glacier-refreezer" } ] }, "Metadata": { "aws:cdk:path": "amazon-s3-glacier-refreezer/glueDataCatalog/toLowercase/ServiceRole/Resource" } }, "glueDataCatalogtoLowercase8AA0AFF5": { "Type": "AWS::Lambda::Function", "Properties": { "Code": { "ZipFile": "/*********************************************************************************************************************\n * Copyright 2021 Amazon.com, Inc. or its affiliates. All Rights Reserved. *\n * *\n * Licensed under the Apache License, Version 2.0 (the \"License\"). You may not use this file except in compliance *\n * with the License. A copy of the License is located at *\n * *\n * http://www.apache.org/licenses/ *\n * *\n * or in the 'license' file accompanying this file. This file is distributed on an 'AS IS' BASIS, WITHOUT WARRANTIES *\n * OR CONDITIONS OF ANY KIND, express or implied. See the License for the specific language governing permissions *\n * and limitations under the License. *\n *********************************************************************************************************************/\n\n/**\n * @author Solution Builders\n */\n\n'use strict';\n\nconst response = require('cfn-response');\nexports.handler = function(event, context) {\n console.log(JSON.stringify(event))\n let responseData = {}\n for(const [key, val] of Object.entries(event.ResourceProperties)) {\n responseData[key] = val.toLowerCase();\n }\n console.log(responseData) \n response.send(event, context, response.SUCCESS, responseData);\n};\n" }, "Role": { "Fn::GetAtt": [ "glueDataCatalogtoLowercaseServiceRole45F7D11F", "Arn" ] }, "FunctionName": { "Fn::Join": [ "", [ { "Ref": "AWS::StackName" }, "-toLowercase" ] ] }, "Handler": "index.handler", "Runtime": "nodejs12.x", "Tags": [ { "Key": "solution", "Value": "amazon-s3-glacier-refreezer" } ] }, "DependsOn": [ "glueDataCatalogtoLowercaseServiceRole45F7D11F" ], "Metadata": { "cfn_nag": { "rules_to_suppress": [ { "id": "W58", "reason": "cfn nag is unable to reason about CDK generated cloudwatch log permissions" }, { "id": "W89", "reason": "This is a fully serverless solution - no VPC is required" }, { "id": "W92", "reason": "Reserved Concurrency is set on high priority functions only by design" } ] } } }, "glueDataCatalogtoLowercaseTrigger0ABB3AB5": { "Type": "AWS::CloudFormation::CustomResource", "Properties": { "ServiceToken": { "Fn::GetAtt": [ "glueDataCatalogtoLowercase8AA0AFF5", "Arn" ] }, "stack_name": { "Ref": "AWS::StackName" } }, "UpdateReplacePolicy": "Delete", "DeletionPolicy": "Delete", "Metadata": { "aws:cdk:path": "amazon-s3-glacier-refreezer/glueDataCatalog/toLowercaseTrigger/Default" } }, "glueDataCatalogInventoryDatabase96DE1AD3": { "Type": "AWS::Glue::Database", "Properties": { "CatalogId": { "Ref": "AWS::AccountId" }, "DatabaseInput": { "Name": { "Fn::Join": [ "", [ { "Fn::GetAtt": [ "glueDataCatalogtoLowercaseTrigger0ABB3AB5", "stack_name" ] }, "-inventory" ] ] } } }, "Metadata": { "aws:cdk:path": "amazon-s3-glacier-refreezer/glueDataCatalog/InventoryDatabase/Resource" } }, "glueDataCatalogInventoryTable05E5F37F": { "Type": "AWS::Glue::Table", "Properties": { "CatalogId": { "Ref": "AWS::AccountId" }, "DatabaseName": { "Ref": "glueDataCatalogInventoryDatabase96DE1AD3" }, "TableInput": { "Description": { "Fn::Join": [ "", [ { "Fn::GetAtt": [ "glueDataCatalogtoLowercaseTrigger0ABB3AB5", "stack_name" ] }, "-grf-inventory generated by CDK" ] ] }, "Name": { "Fn::Join": [ "", [ { "Fn::GetAtt": [ "glueDataCatalogtoLowercaseTrigger0ABB3AB5", "stack_name" ] }, "-grf-inventory" ] ] }, "Parameters": { "has_encrypted_data": false, "skip.header.line.count": "1" }, "StorageDescriptor": { "Columns": [ { "Name": "archiveid", "Type": "string" }, { "Name": "archivedescription", "Type": "string" }, { "Name": "creationdate", "Type": "string" }, { "Name": "size", "Type": "bigint" }, { "Name": "sha256treehash", "Type": "string" } ], "Compressed": false, "InputFormat": "org.apache.hadoop.mapred.TextInputFormat", "Location": { "Fn::Join": [ "", [ "s3://", { "Ref": "stagingBucket" }, "/inventory/" ] ] }, "OutputFormat": "org.apache.hadoop.hive.ql.io.HiveIgnoreKeyTextOutputFormat", "SerdeInfo": { "Parameters": { "escapeChar": "\\", "quoteChar": "\"" }, "SerializationLibrary": "org.apache.hadoop.hive.serde2.OpenCSVSerde" }, "StoredAsSubDirectories": false }, "TableType": "EXTERNAL_TABLE" } }, "Metadata": { "aws:cdk:path": "amazon-s3-glacier-refreezer/glueDataCatalog/InventoryTable/Table" } }, "glueDataCatalogFilelistTable2224351B": { "Type": "AWS::Glue::Table", "Properties": { "CatalogId": { "Ref": "AWS::AccountId" }, "DatabaseName": { "Ref": "glueDataCatalogInventoryDatabase96DE1AD3" }, "TableInput": { "Description": { "Fn::Join": [ "", [ { "Fn::GetAtt": [ "glueDataCatalogtoLowercaseTrigger0ABB3AB5", "stack_name" ] }, "-grf-filelist generated by CDK" ] ] }, "Name": { "Fn::Join": [ "", [ { "Fn::GetAtt": [ "glueDataCatalogtoLowercaseTrigger0ABB3AB5", "stack_name" ] }, "-grf-filelist" ] ] }, "Parameters": { "has_encrypted_data": false }, "StorageDescriptor": { "Columns": [ { "Name": "archiveid", "Type": "string" }, { "Name": "override", "Type": "string" } ], "Compressed": false, "InputFormat": "org.apache.hadoop.mapred.TextInputFormat", "Location": { "Fn::Join": [ "", [ "s3://", { "Ref": "stagingBucket" }, "/filelist/" ] ] }, "OutputFormat": "org.apache.hadoop.hive.ql.io.HiveIgnoreKeyTextOutputFormat", "SerdeInfo": { "SerializationLibrary": "org.apache.hadoop.hive.serde2.OpenCSVSerde" }, "StoredAsSubDirectories": false }, "TableType": "EXTERNAL_TABLE" } }, "Metadata": { "aws:cdk:path": "amazon-s3-glacier-refreezer/glueDataCatalog/FilelistTable/Table" } }, "glueDataCatalogPartitionedinventoryTable94032B41": { "Type": "AWS::Glue::Table", "Properties": { "CatalogId": { "Ref": "AWS::AccountId" }, "DatabaseName": { "Ref": "glueDataCatalogInventoryDatabase96DE1AD3" }, "TableInput": { "Description": { "Fn::Join": [ "", [ { "Fn::GetAtt": [ "glueDataCatalogtoLowercaseTrigger0ABB3AB5", "stack_name" ] }, "-grf-inventory-partitioned generated by CDK" ] ] }, "Name": { "Fn::Join": [ "", [ { "Fn::GetAtt": [ "glueDataCatalogtoLowercaseTrigger0ABB3AB5", "stack_name" ] }, "-grf-inventory-partitioned" ] ] }, "Parameters": { "has_encrypted_data": false, "parquet.compression": "SNAPPY" }, "PartitionKeys": [ { "Name": "part", "Type": "bigint" } ], "StorageDescriptor": { "Columns": [ { "Name": "archiveid", "Type": "string" }, { "Name": "archivedescription", "Type": "string" }, { "Name": "creationdate", "Type": "string" }, { "Name": "size", "Type": "bigint" }, { "Name": "sha256treehash", "Type": "string" }, { "Name": "row_num", "Type": "bigint" } ], "Compressed": false, "InputFormat": "org.apache.hadoop.hive.ql.io.parquet.MapredParquetInputFormat", "Location": { "Fn::Join": [ "", [ "s3://", { "Ref": "stagingBucket" }, "/partitioned/" ] ] }, "OutputFormat": "org.apache.hadoop.hive.ql.io.parquet.MapredParquetOutputFormat", "SerdeInfo": { "SerializationLibrary": "org.apache.hadoop.hive.ql.io.parquet.serde.ParquetHiveSerDe" }, "StoredAsSubDirectories": false }, "TableType": "EXTERNAL_TABLE" } }, "Metadata": { "aws:cdk:path": "amazon-s3-glacier-refreezer/glueDataCatalog/PartitionedinventoryTable/Table" } }, "glueDataCatalogAthenaWorkgroup81F608D4": { "Type": "AWS::Athena::WorkGroup", "Properties": { "Name": { "Fn::Join": [ "", [ { "Ref": "AWS::StackName" }, "-glacier-refreezer-sol" ] ] }, "RecursiveDeleteOption": true, "State": "ENABLED", "Tags": [ { "Key": "solution", "Value": "amazon-s3-glacier-refreezer" } ], "WorkGroupConfiguration": { "EnforceWorkGroupConfiguration": true, "EngineVersion": { "SelectedEngineVersion": "Athena engine version 2" }, "ResultConfiguration": { "OutputLocation": { "Fn::Join": [ "", [ "s3://", { "Ref": "stagingBucket" }, "/results" ] ] } } } }, "Metadata": { "aws:cdk:path": "amazon-s3-glacier-refreezer/glueDataCatalog/AthenaWorkgroup" } }, "dynamoDataCatalogStatusTableE9ACB88F": { "Type": "AWS::DynamoDB::Table", "Properties": { "KeySchema": [ { "AttributeName": "aid", "KeyType": "HASH" } ], "AttributeDefinitions": [ { "AttributeName": "aid", "AttributeType": "S" }, { "AttributeName": "pid", "AttributeType": "N" }, { "AttributeName": "ifn", "AttributeType": "N" }, { "AttributeName": "fname", "AttributeType": "S" } ], "BillingMode": "PROVISIONED", "GlobalSecondaryIndexes": [ { "IndexName": "max-file-index", "KeySchema": [ { "AttributeName": "pid", "KeyType": "HASH" }, { "AttributeName": "ifn", "KeyType": "RANGE" } ], "Projection": { "ProjectionType": "KEYS_ONLY" }, "ProvisionedThroughput": { "ReadCapacityUnits": 5, "WriteCapacityUnits": 30 } }, { "IndexName": "name-index", "KeySchema": [ { "AttributeName": "fname", "KeyType": "HASH" } ], "Projection": { "ProjectionType": "KEYS_ONLY" }, "ProvisionedThroughput": { "ReadCapacityUnits": 15, "WriteCapacityUnits": 30 } } ], "PointInTimeRecoverySpecification": { "PointInTimeRecoveryEnabled": true }, "ProvisionedThroughput": { "ReadCapacityUnits": 25, "WriteCapacityUnits": 30 }, "StreamSpecification": { "StreamViewType": "NEW_AND_OLD_IMAGES" }, "TableName": { "Fn::Join": [ "", [ { "Ref": "AWS::StackName" }, "-grf-job-status" ] ] }, "Tags": [ { "Key": "solution", "Value": "amazon-s3-glacier-refreezer" } ] }, "UpdateReplacePolicy": "Delete", "DeletionPolicy": "Delete", "Metadata": { "cfn_nag": { "rules_to_suppress": [ { "id": "W28", "reason": "Transient table - updates must be through deletion/redeployment of the stack only" }, { "id": "W74", "reason": "Metadata table - no encryption required" } ] } } }, "dynamoDataCatalogStatusTableWriteScalingTargetD6BBCD46": { "Type": "AWS::ApplicationAutoScaling::ScalableTarget", "Properties": { "MaxCapacity": 500, "MinCapacity": 30, "ResourceId": { "Fn::Join": [ "", [ "table/", { "Ref": "dynamoDataCatalogStatusTableE9ACB88F" } ] ] }, "RoleARN": { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":iam::", { "Ref": "AWS::AccountId" }, ":role/aws-service-role/dynamodb.application-autoscaling.amazonaws.com/AWSServiceRoleForApplicationAutoScaling_DynamoDBTable" ] ] }, "ScalableDimension": "dynamodb:table:WriteCapacityUnits", "ServiceNamespace": "dynamodb" }, "Metadata": { "aws:cdk:path": "amazon-s3-glacier-refreezer/dynamoDataCatalog/StatusTable/WriteScaling/Target/Resource" } }, "dynamoDataCatalogStatusTableWriteScalingTargetTrackingD2EC7DF0": { "Type": "AWS::ApplicationAutoScaling::ScalingPolicy", "Properties": { "PolicyName": "amazons3glacierrefreezerdynamoDataCatalogStatusTableWriteScalingTargetTrackingB24854FC", "PolicyType": "TargetTrackingScaling", "ScalingTargetId": { "Ref": "dynamoDataCatalogStatusTableWriteScalingTargetD6BBCD46" }, "TargetTrackingScalingPolicyConfiguration": { "PredefinedMetricSpecification": { "PredefinedMetricType": "DynamoDBWriteCapacityUtilization" }, "ScaleInCooldown": 60, "ScaleOutCooldown": 10, "TargetValue": 70 } }, "Metadata": { "aws:cdk:path": "amazon-s3-glacier-refreezer/dynamoDataCatalog/StatusTable/WriteScaling/Target/Tracking/Resource" } }, "dynamoDataCatalogStatusTableReadScalingTarget544936B3": { "Type": "AWS::ApplicationAutoScaling::ScalableTarget", "Properties": { "MaxCapacity": 500, "MinCapacity": 25, "ResourceId": { "Fn::Join": [ "", [ "table/", { "Ref": "dynamoDataCatalogStatusTableE9ACB88F" } ] ] }, "RoleARN": { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":iam::", { "Ref": "AWS::AccountId" }, ":role/aws-service-role/dynamodb.application-autoscaling.amazonaws.com/AWSServiceRoleForApplicationAutoScaling_DynamoDBTable" ] ] }, "ScalableDimension": "dynamodb:table:ReadCapacityUnits", "ServiceNamespace": "dynamodb" }, "Metadata": { "aws:cdk:path": "amazon-s3-glacier-refreezer/dynamoDataCatalog/StatusTable/ReadScaling/Target/Resource" } }, "dynamoDataCatalogStatusTableReadScalingTargetTrackingEA8022B1": { "Type": "AWS::ApplicationAutoScaling::ScalingPolicy", "Properties": { "PolicyName": "amazons3glacierrefreezerdynamoDataCatalogStatusTableReadScalingTargetTracking56BC99D0", "PolicyType": "TargetTrackingScaling", "ScalingTargetId": { "Ref": "dynamoDataCatalogStatusTableReadScalingTarget544936B3" }, "TargetTrackingScalingPolicyConfiguration": { "PredefinedMetricSpecification": { "PredefinedMetricType": "DynamoDBReadCapacityUtilization" }, "ScaleInCooldown": 60, "ScaleOutCooldown": 10, "TargetValue": 70 } }, "Metadata": { "aws:cdk:path": "amazon-s3-glacier-refreezer/dynamoDataCatalog/StatusTable/ReadScaling/Target/Tracking/Resource" } }, "dynamoDataCatalogStatusTablemaxfileindexReadScalingTarget4766C10B": { "Type": "AWS::ApplicationAutoScaling::ScalableTarget", "Properties": { "MaxCapacity": 500, "MinCapacity": 5, "ResourceId": { "Fn::Join": [ "", [ "table/", { "Ref": "dynamoDataCatalogStatusTableE9ACB88F" }, "/index/max-file-index" ] ] }, "RoleARN": { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":iam::", { "Ref": "AWS::AccountId" }, ":role/aws-service-role/dynamodb.application-autoscaling.amazonaws.com/AWSServiceRoleForApplicationAutoScaling_DynamoDBTable" ] ] }, "ScalableDimension": "dynamodb:index:ReadCapacityUnits", "ServiceNamespace": "dynamodb" }, "Metadata": { "aws:cdk:path": "amazon-s3-glacier-refreezer/dynamoDataCatalog/StatusTable/max-file-indexReadScaling/Target/Resource" } }, "dynamoDataCatalogStatusTablemaxfileindexReadScalingTargetTrackingC5BD9481": { "Type": "AWS::ApplicationAutoScaling::ScalingPolicy", "Properties": { "PolicyName": "amazons3glacierrefreezerdynamoDataCatalogStatusTablemaxfileindexReadScalingTargetTracking5E5E1960", "PolicyType": "TargetTrackingScaling", "ScalingTargetId": { "Ref": "dynamoDataCatalogStatusTablemaxfileindexReadScalingTarget4766C10B" }, "TargetTrackingScalingPolicyConfiguration": { "PredefinedMetricSpecification": { "PredefinedMetricType": "DynamoDBReadCapacityUtilization" }, "ScaleInCooldown": 60, "ScaleOutCooldown": 10, "TargetValue": 70 } }, "Metadata": { "aws:cdk:path": "amazon-s3-glacier-refreezer/dynamoDataCatalog/StatusTable/max-file-indexReadScaling/Target/Tracking/Resource" } }, "dynamoDataCatalogStatusTablemaxfileindexWriteScalingTargetFD4F0C81": { "Type": "AWS::ApplicationAutoScaling::ScalableTarget", "Properties": { "MaxCapacity": 500, "MinCapacity": 30, "ResourceId": { "Fn::Join": [ "", [ "table/", { "Ref": "dynamoDataCatalogStatusTableE9ACB88F" }, "/index/max-file-index" ] ] }, "RoleARN": { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":iam::", { "Ref": "AWS::AccountId" }, ":role/aws-service-role/dynamodb.application-autoscaling.amazonaws.com/AWSServiceRoleForApplicationAutoScaling_DynamoDBTable" ] ] }, "ScalableDimension": "dynamodb:index:WriteCapacityUnits", "ServiceNamespace": "dynamodb" }, "Metadata": { "aws:cdk:path": "amazon-s3-glacier-refreezer/dynamoDataCatalog/StatusTable/max-file-indexWriteScaling/Target/Resource" } }, "dynamoDataCatalogStatusTablemaxfileindexWriteScalingTargetTracking43B81A6C": { "Type": "AWS::ApplicationAutoScaling::ScalingPolicy", "Properties": { "PolicyName": "amazons3glacierrefreezerdynamoDataCatalogStatusTablemaxfileindexWriteScalingTargetTracking1B3109FA", "PolicyType": "TargetTrackingScaling", "ScalingTargetId": { "Ref": "dynamoDataCatalogStatusTablemaxfileindexWriteScalingTargetFD4F0C81" }, "TargetTrackingScalingPolicyConfiguration": { "PredefinedMetricSpecification": { "PredefinedMetricType": "DynamoDBWriteCapacityUtilization" }, "ScaleInCooldown": 60, "ScaleOutCooldown": 10, "TargetValue": 70 } }, "Metadata": { "aws:cdk:path": "amazon-s3-glacier-refreezer/dynamoDataCatalog/StatusTable/max-file-indexWriteScaling/Target/Tracking/Resource" } }, "dynamoDataCatalogStatusTablenameindexReadScalingTarget756A5D45": { "Type": "AWS::ApplicationAutoScaling::ScalableTarget", "Properties": { "MaxCapacity": 500, "MinCapacity": 15, "ResourceId": { "Fn::Join": [ "", [ "table/", { "Ref": "dynamoDataCatalogStatusTableE9ACB88F" }, "/index/name-index" ] ] }, "RoleARN": { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":iam::", { "Ref": "AWS::AccountId" }, ":role/aws-service-role/dynamodb.application-autoscaling.amazonaws.com/AWSServiceRoleForApplicationAutoScaling_DynamoDBTable" ] ] }, "ScalableDimension": "dynamodb:index:ReadCapacityUnits", "ServiceNamespace": "dynamodb" }, "Metadata": { "aws:cdk:path": "amazon-s3-glacier-refreezer/dynamoDataCatalog/StatusTable/name-indexReadScaling/Target/Resource" } }, "dynamoDataCatalogStatusTablenameindexReadScalingTargetTracking0A15E69B": { "Type": "AWS::ApplicationAutoScaling::ScalingPolicy", "Properties": { "PolicyName": "amazons3glacierrefreezerdynamoDataCatalogStatusTablenameindexReadScalingTargetTracking9E903362", "PolicyType": "TargetTrackingScaling", "ScalingTargetId": { "Ref": "dynamoDataCatalogStatusTablenameindexReadScalingTarget756A5D45" }, "TargetTrackingScalingPolicyConfiguration": { "PredefinedMetricSpecification": { "PredefinedMetricType": "DynamoDBReadCapacityUtilization" }, "ScaleInCooldown": 60, "ScaleOutCooldown": 10, "TargetValue": 70 } }, "Metadata": { "aws:cdk:path": "amazon-s3-glacier-refreezer/dynamoDataCatalog/StatusTable/name-indexReadScaling/Target/Tracking/Resource" } }, "dynamoDataCatalogStatusTablenameindexWriteScalingTargetBF74747A": { "Type": "AWS::ApplicationAutoScaling::ScalableTarget", "Properties": { "MaxCapacity": 500, "MinCapacity": 30, "ResourceId": { "Fn::Join": [ "", [ "table/", { "Ref": "dynamoDataCatalogStatusTableE9ACB88F" }, "/index/name-index" ] ] }, "RoleARN": { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":iam::", { "Ref": "AWS::AccountId" }, ":role/aws-service-role/dynamodb.application-autoscaling.amazonaws.com/AWSServiceRoleForApplicationAutoScaling_DynamoDBTable" ] ] }, "ScalableDimension": "dynamodb:index:WriteCapacityUnits", "ServiceNamespace": "dynamodb" }, "Metadata": { "aws:cdk:path": "amazon-s3-glacier-refreezer/dynamoDataCatalog/StatusTable/name-indexWriteScaling/Target/Resource" } }, "dynamoDataCatalogStatusTablenameindexWriteScalingTargetTrackingBF88D57A": { "Type": "AWS::ApplicationAutoScaling::ScalingPolicy", "Properties": { "PolicyName": "amazons3glacierrefreezerdynamoDataCatalogStatusTablenameindexWriteScalingTargetTracking7E11FCFA", "PolicyType": "TargetTrackingScaling", "ScalingTargetId": { "Ref": "dynamoDataCatalogStatusTablenameindexWriteScalingTargetBF74747A" }, "TargetTrackingScalingPolicyConfiguration": { "PredefinedMetricSpecification": { "PredefinedMetricType": "DynamoDBWriteCapacityUtilization" }, "ScaleInCooldown": 60, "ScaleOutCooldown": 10, "TargetValue": 70 } }, "Metadata": { "aws:cdk:path": "amazon-s3-glacier-refreezer/dynamoDataCatalog/StatusTable/name-indexWriteScaling/Target/Tracking/Resource" } }, "dynamoDataCatalogMetricsTable174C007B": { "Type": "AWS::DynamoDB::Table", "Properties": { "KeySchema": [ { "AttributeName": "pk", "KeyType": "HASH" } ], "AttributeDefinitions": [ { "AttributeName": "pk", "AttributeType": "S" } ], "BillingMode": "PAY_PER_REQUEST", "PointInTimeRecoverySpecification": { "PointInTimeRecoveryEnabled": true }, "TableName": { "Fn::Join": [ "", [ { "Ref": "AWS::StackName" }, "-grf-job-metrics" ] ] }, "Tags": [ { "Key": "solution", "Value": "amazon-s3-glacier-refreezer" } ] }, "UpdateReplacePolicy": "Delete", "DeletionPolicy": "Delete", "Metadata": { "cfn_nag": { "rules_to_suppress": [ { "id": "W28", "reason": "Transient table - updates must be through deletion/redeployment of the stack only" }, { "id": "W74", "reason": "Metadata table - no encryption required" } ] } } }, "archiveNotifications": { "Type": "AWS::SNS::Topic", "Properties": { "Tags": [ { "Key": "solution", "Value": "amazon-s3-glacier-refreezer" } ] }, "Metadata": { "cfn_nag": { "rules_to_suppress": [ { "id": "W47", "reason": "Non sensitive metadata - encryption is not required and cost inefficient" } ] } } }, "ArchiveNotificationsPolicyB2E509DE": { "Type": "AWS::SNS::TopicPolicy", "Properties": { "PolicyDocument": { "Statement": [ { "Action": [ "sns:GetTopicAttributes", "sns:SetTopicAttributes", "sns:AddPermission", "sns:RemovePermission", "sns:DeleteTopic", "sns:Subscribe", "sns:ListSubscriptionsByTopic", "sns:Publish", "sns:Receive" ], "Condition": { "StringEquals": { "AWS:SourceOwner": { "Ref": "AWS::AccountId" } } }, "Effect": "Allow", "Principal": { "Service": "glacier.amazonaws.com" }, "Resource": { "Ref": "archiveNotifications" }, "Sid": "permitService" }, { "Action": [ "sns:GetTopicAttributes", "sns:SetTopicAttributes", "sns:AddPermission", "sns:RemovePermission", "sns:DeleteTopic", "sns:Subscribe", "sns:ListSubscriptionsByTopic", "sns:Publish" ], "Condition": { "Bool": { "aws:SecureTransport": false } }, "Effect": "Deny", "Principal": "*", "Resource": { "Ref": "archiveNotifications" }, "Sid": "denyInsecureTransport" } ], "Version": "2012-10-17" }, "Topics": [ { "Ref": "archiveNotifications" } ] }, "Metadata": { "aws:cdk:path": "amazon-s3-glacier-refreezer/ArchiveNotifications/Policy/Resource" } }, "monitoringCalculateMetricsRoleA76278A7": { "Type": "AWS::IAM::Role", "Properties": { "AssumeRolePolicyDocument": { "Statement": [ { "Action": "sts:AssumeRole", "Effect": "Allow", "Principal": { "Service": "lambda.amazonaws.com" } } ], "Version": "2012-10-17" }, "Tags": [ { "Key": "solution", "Value": "amazon-s3-glacier-refreezer" } ] }, "Metadata": { "aws:cdk:path": "amazon-s3-glacier-refreezer/monitoring/CalculateMetricsRole/Resource" } }, "monitoringCalculateMetricsRoleDefaultPolicy22C0E657": { "Type": "AWS::IAM::Policy", "Properties": { "PolicyDocument": { "Statement": [ { "Action": [ "dynamodb:BatchGetItem", "dynamodb:GetRecords", "dynamodb:GetShardIterator", "dynamodb:Query", "dynamodb:GetItem", "dynamodb:Scan", "dynamodb:ConditionCheckItem", "dynamodb:BatchWriteItem", "dynamodb:PutItem", "dynamodb:UpdateItem", "dynamodb:DeleteItem" ], "Effect": "Allow", "Resource": [ { "Fn::GetAtt": [ "dynamoDataCatalogMetricsTable174C007B", "Arn" ] }, { "Ref": "AWS::NoValue" } ] } ], "Version": "2012-10-17" }, "PolicyName": "monitoringCalculateMetricsRoleDefaultPolicy22C0E657", "Roles": [ { "Ref": "monitoringCalculateMetricsRoleA76278A7" } ] }, "Metadata": { "aws:cdk:path": "amazon-s3-glacier-refreezer/monitoring/CalculateMetricsRole/DefaultPolicy/Resource" } }, "monitoringCalculateMetricsRolePolicy0C1EF64D": { "Type": "AWS::IAM::Policy", "Properties": { "PolicyDocument": { "Statement": [ { "Action": [ "logs:CreateLogGroup", "logs:CreateLogStream", "logs:PutLogEvents" ], "Effect": "Allow", "Resource": { "Fn::Join": [ "", [ "arn:aws-cn:logs:", { "Ref": "AWS::Region" }, ":", { "Ref": "AWS::AccountId" }, ":log-group:/aws/lambda/", { "Ref": "AWS::StackName" }, "-calculateMetrics:**" ] ] }, "Sid": "allowCloudWatchLogs" }, { "Action": [ "dynamodb:ListStreams", "dynamodb:DescribeStream", "dynamodb:GetRecords", "dynamodb:GetShardIterator", "dynamodb:ListShards" ], "Effect": "Allow", "Resource": { "Fn::Join": [ "", [ { "Fn::GetAtt": [ "dynamoDataCatalogStatusTableE9ACB88F", "Arn" ] }, "/stream/*" ] ] } } ], "Version": "2012-10-17" }, "PolicyName": "monitoringCalculateMetricsRolePolicy0C1EF64D", "Roles": [ { "Ref": "monitoringCalculateMetricsRoleA76278A7" } ] }, "Metadata": { "aws:cdk:path": "amazon-s3-glacier-refreezer/monitoring/CalculateMetricsRolePolicy/Resource" } }, "monitoringCalculateMetrics1B70CF5B": { "Type": "AWS::Lambda::Function", "Properties": { "Code": { "S3Bucket": { "Fn::Sub": "solutions-${AWS::Region}" }, "S3Key": "amazon-s3-glacier-refreezer/v1.0.1/asset2ccdcd32e7df8f8597b8d7531f02c13184894dc7d66878d1d4b4e928bfae52d9.zip" }, "Role": { "Fn::GetAtt": [ "monitoringCalculateMetricsRoleA76278A7", "Arn" ] }, "Environment": { "Variables": { "METRICS_TABLE": { "Ref": "dynamoDataCatalogMetricsTable174C007B" } } }, "FunctionName": { "Fn::Join": [ "", [ { "Ref": "AWS::StackName" }, "-calculateMetrics" ] ] }, "Handler": "index.handler", "Runtime": "nodejs12.x", "Tags": [ { "Key": "solution", "Value": "amazon-s3-glacier-refreezer" } ] }, "DependsOn": [ "monitoringCalculateMetricsRoleDefaultPolicy22C0E657", "monitoringCalculateMetricsRoleA76278A7", "monitoringCalculateMetricsRolePolicy0C1EF64D" ], "Metadata": { "cfn_nag": { "rules_to_suppress": [ { "id": "W58", "reason": "cfn nag is unable to reason about CDK generated cloudwatch log permissions" }, { "id": "W89", "reason": "This is a fully serverless solution - no VPC is required" }, { "id": "W92", "reason": "Reserved Concurrency is set on high priority functions only by design" } ] } } }, "monitoringCalculateMetricsDynamoDBEventSourceamazons3glacierrefreezerdynamoDataCatalogStatusTable7052596D0ABFB5EB": { "Type": "AWS::Lambda::EventSourceMapping", "Properties": { "FunctionName": { "Ref": "monitoringCalculateMetrics1B70CF5B" }, "BatchSize": 1000, "EventSourceArn": { "Fn::GetAtt": [ "dynamoDataCatalogStatusTableE9ACB88F", "StreamArn" ] }, "MaximumBatchingWindowInSeconds": 30, "ParallelizationFactor": 1, "StartingPosition": "TRIM_HORIZON" }, "DependsOn": [ "monitoringCalculateMetricsRolePolicy0C1EF64D" ], "Metadata": { "aws:cdk:path": "amazon-s3-glacier-refreezer/monitoring/CalculateMetrics/DynamoDBEventSource:amazons3glacierrefreezerdynamoDataCatalogStatusTable7052596D/Resource" } }, "monitoringPostMetricsRole87B61E7B": { "Type": "AWS::IAM::Role", "Properties": { "AssumeRolePolicyDocument": { "Statement": [ { "Action": "sts:AssumeRole", "Effect": "Allow", "Principal": { "Service": "lambda.amazonaws.com" } } ], "Version": "2012-10-17" }, "Tags": [ { "Key": "solution", "Value": "amazon-s3-glacier-refreezer" } ] }, "Metadata": { "aws:cdk:path": "amazon-s3-glacier-refreezer/monitoring/PostMetricsRole/Resource" } }, "monitoringPostMetricsRolePolicy596F9F4D": { "Type": "AWS::IAM::Policy", "Properties": { "PolicyDocument": { "Statement": [ { "Action": "dynamodb:Query", "Effect": "Allow", "Resource": { "Fn::GetAtt": [ "dynamoDataCatalogMetricsTable174C007B", "Arn" ] } }, { "Action": "cloudwatch:PutMetricData", "Condition": { "StringEquals": { "cloudwatch:namespace": "AmazonS3GlacierReFreezer" } }, "Effect": "Allow", "Resource": "*", "Sid": "permitPostMetrics" }, { "Action": [ "logs:CreateLogGroup", "logs:CreateLogStream", "logs:PutLogEvents" ], "Effect": "Allow", "Resource": { "Fn::Join": [ "", [ "arn:aws-cn:logs:", { "Ref": "AWS::Region" }, ":", { "Ref": "AWS::AccountId" }, ":log-group:/aws/lambda/", { "Ref": "AWS::StackName" }, "-postMetrics:**" ] ] }, "Sid": "allowCloudWatchLogs" } ], "Version": "2012-10-17" }, "PolicyName": "monitoringPostMetricsRolePolicy596F9F4D", "Roles": [ { "Ref": "monitoringPostMetricsRole87B61E7B" } ] }, "Metadata": { "cfn_nag": { "rules_to_suppress": [ { "id": "W12", "reason": "CloudWatch does not support metric ARNs. Using Namespace condition" } ] } } }, "monitoringPostMetrics98F9F947": { "Type": "AWS::Lambda::Function", "Properties": { "Code": { "S3Bucket": { "Fn::Sub": "solutions-${AWS::Region}" }, "S3Key": "amazon-s3-glacier-refreezer/v1.0.1/asset211583dcc4889ee1992af37f6a66e2d510dcb9870d3275390aa9c31247bed011.zip" }, "Role": { "Fn::GetAtt": [ "monitoringPostMetricsRole87B61E7B", "Arn" ] }, "Environment": { "Variables": { "METRICS_TABLE": { "Ref": "dynamoDataCatalogMetricsTable174C007B" }, "STATUS_TABLE": { "Ref": "dynamoDataCatalogStatusTableE9ACB88F" }, "STACK_NAME": { "Ref": "AWS::StackName" }, "ARCHIVE_NOTIFICATIONS_TOPIC": { "Fn::GetAtt": [ "archiveNotifications", "TopicName" ] } } }, "FunctionName": { "Fn::Join": [ "", [ { "Ref": "AWS::StackName" }, "-postMetrics" ] ] }, "Handler": "index.handler", "Runtime": "nodejs12.x", "Tags": [ { "Key": "solution", "Value": "amazon-s3-glacier-refreezer" } ] }, "DependsOn": [ "monitoringPostMetricsRole87B61E7B", "monitoringPostMetricsRolePolicy596F9F4D" ], "Metadata": { "cfn_nag": { "rules_to_suppress": [ { "id": "W58", "reason": "cfn nag is unable to reason about CDK generated cloudwatch log permissions" }, { "id": "W89", "reason": "This is a fully serverless solution - no VPC is required" }, { "id": "W92", "reason": "Reserved Concurrency is set on high priority functions only by design" } ] } } }, "monitoringPostMetricSchedule8675C968": { "Type": "AWS::Events::Rule", "Properties": { "ScheduleExpression": "rate(1 minute)", "State": "ENABLED", "Targets": [ { "Arn": { "Fn::GetAtt": [ "monitoringPostMetrics98F9F947", "Arn" ] }, "Id": "Target0" } ] }, "Metadata": { "aws:cdk:path": "amazon-s3-glacier-refreezer/monitoring/PostMetricSchedule/Resource" } }, "monitoringPostMetricScheduleAllowEventRuleamazons3glacierrefreezermonitoringPostMetrics267F3B25BC9F085A": { "Type": "AWS::Lambda::Permission", "Properties": { "Action": "lambda:InvokeFunction", "FunctionName": { "Fn::GetAtt": [ "monitoringPostMetrics98F9F947", "Arn" ] }, "Principal": "events.amazonaws.com", "SourceArn": { "Fn::GetAtt": [ "monitoringPostMetricSchedule8675C968", "Arn" ] } }, "Metadata": { "aws:cdk:path": "amazon-s3-glacier-refreezer/monitoring/PostMetricSchedule/AllowEventRuleamazons3glacierrefreezermonitoringPostMetrics267F3B25" } }, "monitoringglacierrefreezerdashboardE7F6D8AE": { "Type": "AWS::CloudWatch::Dashboard", "Properties": { "DashboardBody": { "Fn::Join": [ "", [ "{\"widgets\":[{\"type\":\"metric\",\"width\":24,\"height\":3,\"x\":0,\"y\":0,\"properties\":{\"view\":\"singleValue\",\"title\":\"Amazon S3 Glacier Re:Freezer Progress Metrics : ", { "Ref": "AWS::StackName" }, "\",\"region\":\"", { "Ref": "AWS::Region" }, "\",\"metrics\":[[\"AmazonS3GlacierReFreezer\",\"Total Archives\",\"CloudFormation Stack\",\"", { "Ref": "AWS::StackName" }, "\",{\"accountId\":\"", { "Ref": "AWS::AccountId" }, "\",\"stat\":\"Maximum\"}],[\"AmazonS3GlacierReFreezer\",\"Requested from Glacier\",\"CloudFormation Stack\",\"", { "Ref": "AWS::StackName" }, "\",{\"accountId\":\"", { "Ref": "AWS::AccountId" }, "\",\"stat\":\"Maximum\"}],[\"AmazonS3GlacierReFreezer\",\"Staged\",\"CloudFormation Stack\",\"", { "Ref": "AWS::StackName" }, "\",{\"accountId\":\"", { "Ref": "AWS::AccountId" }, "\",\"stat\":\"Maximum\"}],[\"AmazonS3GlacierReFreezer\",\"Hashes Validated\",\"CloudFormation Stack\",\"", { "Ref": "AWS::StackName" }, "\",{\"accountId\":\"", { "Ref": "AWS::AccountId" }, "\",\"stat\":\"Maximum\"}],[\"AmazonS3GlacierReFreezer\",\"Copied to Destination\",\"CloudFormation Stack\",\"", { "Ref": "AWS::StackName" }, "\",{\"accountId\":\"", { "Ref": "AWS::AccountId" }, "\",\"stat\":\"Maximum\"}]]}},{\"type\":\"metric\",\"width\":24,\"height\":6,\"x\":0,\"y\":3,\"properties\":{\"view\":\"timeSeries\",\"title\":\"Timeline\",\"region\":\"", { "Ref": "AWS::Region" }, "\",\"metrics\":[[\"AmazonS3GlacierReFreezer\",\"Total Archives\",\"CloudFormation Stack\",\"", { "Ref": "AWS::StackName" }, "\",{\"accountId\":\"", { "Ref": "AWS::AccountId" }, "\",\"stat\":\"Maximum\"}],[\"AmazonS3GlacierReFreezer\",\"Requested from Glacier\",\"CloudFormation Stack\",\"", { "Ref": "AWS::StackName" }, "\",{\"accountId\":\"", { "Ref": "AWS::AccountId" }, "\",\"stat\":\"Maximum\"}],[\"AmazonS3GlacierReFreezer\",\"Staged\",\"CloudFormation Stack\",\"", { "Ref": "AWS::StackName" }, "\",{\"accountId\":\"", { "Ref": "AWS::AccountId" }, "\",\"stat\":\"Maximum\"}],[\"AmazonS3GlacierReFreezer\",\"Hashes Validated\",\"CloudFormation Stack\",\"", { "Ref": "AWS::StackName" }, "\",{\"accountId\":\"", { "Ref": "AWS::AccountId" }, "\",\"stat\":\"Maximum\"}],[\"AmazonS3GlacierReFreezer\",\"Copied to Destination\",\"CloudFormation Stack\",\"", { "Ref": "AWS::StackName" }, "\",{\"accountId\":\"", { "Ref": "AWS::AccountId" }, "\",\"stat\":\"Maximum\"}]],\"yAxis\":{}}},{\"type\":\"log\",\"width\":24,\"height\":6,\"x\":0,\"y\":9,\"properties\":{\"view\":\"table\",\"title\":\"Errors\",\"region\":\"", { "Ref": "AWS::Region" }, "\",\"query\":\"SOURCE '/aws/vendedlogs/states/", { "Ref": "AWS::StackName" }, "-stageTwoOrchestrator' | SOURCE '/aws/lambda/", { "Ref": "AWS::StackName" }, "-calculateMetrics' | SOURCE '/aws/lambda/", { "Ref": "AWS::StackName" }, "-calculateTreehash' | SOURCE '/aws/lambda/", { "Ref": "AWS::StackName" }, "-copyArchive' | SOURCE '/aws/lambda/", { "Ref": "AWS::StackName" }, "-copyChunk' | SOURCE '/aws/lambda/", { "Ref": "AWS::StackName" }, "-deployGlueJobScript' | SOURCE '/aws/lambda/", { "Ref": "AWS::StackName" }, "-downloadInventory' | SOURCE '/aws/lambda/", { "Ref": "AWS::StackName" }, "-downloadInventoryPart' | SOURCE '/aws/lambda/", { "Ref": "AWS::StackName" }, "-generateUuid' | SOURCE '/aws/lambda/", { "Ref": "AWS::StackName" }, "-postMetrics' | SOURCE '/aws/lambda/", { "Ref": "AWS::StackName" }, "-requestArchives' | SOURCE '/aws/lambda/", { "Ref": "AWS::StackName" }, "-requestInventory' | SOURCE '/aws/lambda/", { "Ref": "AWS::StackName" }, "-sendAnonymousStats' | SOURCE '/aws/lambda/", { "Ref": "AWS::StackName" }, "-toLowercase' | fields @timestamp, @message \\n| filter @message like /error/ or @message like /Error/ or @message like /ERROR/\\n| sort by @timestamp desc\"}},{\"type\":\"metric\",\"width\":24,\"height\":6,\"x\":0,\"y\":15,\"properties\":{\"view\":\"timeSeries\",\"title\":\"Oldest SQS Message\",\"region\":\"", { "Ref": "AWS::Region" }, "\",\"metrics\":[[\"AWS/SQS\",\"ApproximateAgeOfOldestMessage\",\"QueueName\",\"", { "Ref": "AWS::StackName" }, "-archive-notification-queue\"],[\"AWS/SQS\",\"ApproximateAgeOfOldestMessage\",\"QueueName\",\"", { "Ref": "AWS::StackName" }, "-chunk-copy-queue\"]],\"yAxis\":{}}}]}" ] ] }, "DashboardName": { "Fn::Join": [ "", [ { "Ref": "AWS::StackName" }, "-Amazon-S3-Glacier-ReFreezer" ] ] } }, "Metadata": { "aws:cdk:path": "amazon-s3-glacier-refreezer/monitoring/glacier-refreezer-dashboard/Resource" } }, "monitoringstageTwoOrchestratorLogGroup62996996": { "Type": "AWS::Logs::LogGroup", "Properties": { "LogGroupName": { "Fn::Join": [ "", [ "/aws/vendedlogs/states/", { "Ref": "AWS::StackName" }, "-stageTwoOrchestrator" ] ] }, "RetentionInDays": 90 }, "Metadata": { "cfn_nag": { "rules_to_suppress": [ { "id": "W84", "reason": "The solution is a temporary, one off deployment. No sensitive or PII data logged." } ] } }, "DeletionPolicy": "Retain" }, "monitoringcalculateMetricsLogGroup9961A214": { "Type": "AWS::Logs::LogGroup", "Properties": { "LogGroupName": { "Fn::Join": [ "", [ "/aws/lambda/", { "Ref": "AWS::StackName" }, "-calculateMetrics" ] ] }, "RetentionInDays": 90 }, "Metadata": { "cfn_nag": { "rules_to_suppress": [ { "id": "W84", "reason": "The solution is a temporary, one off deployment. No sensitive or PII data logged." } ] } }, "DeletionPolicy": "Retain" }, "monitoringcalculateTreehashLogGroup6FC738B3": { "Type": "AWS::Logs::LogGroup", "Properties": { "LogGroupName": { "Fn::Join": [ "", [ "/aws/lambda/", { "Ref": "AWS::StackName" }, "-calculateTreehash" ] ] }, "RetentionInDays": 90 }, "Metadata": { "cfn_nag": { "rules_to_suppress": [ { "id": "W84", "reason": "The solution is a temporary, one off deployment. No sensitive or PII data logged." } ] } }, "DeletionPolicy": "Retain" }, "monitoringcopyArchiveLogGroupBB702B1B": { "Type": "AWS::Logs::LogGroup", "Properties": { "LogGroupName": { "Fn::Join": [ "", [ "/aws/lambda/", { "Ref": "AWS::StackName" }, "-copyArchive" ] ] }, "RetentionInDays": 90 }, "Metadata": { "cfn_nag": { "rules_to_suppress": [ { "id": "W84", "reason": "The solution is a temporary, one off deployment. No sensitive or PII data logged." } ] } }, "DeletionPolicy": "Retain" }, "monitoringcopyChunkLogGroup5D04918E": { "Type": "AWS::Logs::LogGroup", "Properties": { "LogGroupName": { "Fn::Join": [ "", [ "/aws/lambda/", { "Ref": "AWS::StackName" }, "-copyChunk" ] ] }, "RetentionInDays": 90 }, "Metadata": { "cfn_nag": { "rules_to_suppress": [ { "id": "W84", "reason": "The solution is a temporary, one off deployment. No sensitive or PII data logged." } ] } }, "DeletionPolicy": "Retain" }, "monitoringdeployGlueJobScriptLogGroupAA50E4DE": { "Type": "AWS::Logs::LogGroup", "Properties": { "LogGroupName": { "Fn::Join": [ "", [ "/aws/lambda/", { "Ref": "AWS::StackName" }, "-deployGlueJobScript" ] ] }, "RetentionInDays": 90 }, "Metadata": { "cfn_nag": { "rules_to_suppress": [ { "id": "W84", "reason": "The solution is a temporary, one off deployment. No sensitive or PII data logged." } ] } }, "DeletionPolicy": "Retain" }, "monitoringdownloadInventoryLogGroup2471C2FF": { "Type": "AWS::Logs::LogGroup", "Properties": { "LogGroupName": { "Fn::Join": [ "", [ "/aws/lambda/", { "Ref": "AWS::StackName" }, "-downloadInventory" ] ] }, "RetentionInDays": 90 }, "Metadata": { "cfn_nag": { "rules_to_suppress": [ { "id": "W84", "reason": "The solution is a temporary, one off deployment. No sensitive or PII data logged." } ] } }, "DeletionPolicy": "Retain" }, "monitoringdownloadInventoryPartLogGroupD9E69690": { "Type": "AWS::Logs::LogGroup", "Properties": { "LogGroupName": { "Fn::Join": [ "", [ "/aws/lambda/", { "Ref": "AWS::StackName" }, "-downloadInventoryPart" ] ] }, "RetentionInDays": 90 }, "Metadata": { "cfn_nag": { "rules_to_suppress": [ { "id": "W84", "reason": "The solution is a temporary, one off deployment. No sensitive or PII data logged." } ] } }, "DeletionPolicy": "Retain" }, "monitoringgenerateUuidLogGroup18A074CF": { "Type": "AWS::Logs::LogGroup", "Properties": { "LogGroupName": { "Fn::Join": [ "", [ "/aws/lambda/", { "Ref": "AWS::StackName" }, "-generateUuid" ] ] }, "RetentionInDays": 90 }, "Metadata": { "cfn_nag": { "rules_to_suppress": [ { "id": "W84", "reason": "The solution is a temporary, one off deployment. No sensitive or PII data logged." } ] } }, "DeletionPolicy": "Retain" }, "monitoringpostMetricsLogGroup670566A8": { "Type": "AWS::Logs::LogGroup", "Properties": { "LogGroupName": { "Fn::Join": [ "", [ "/aws/lambda/", { "Ref": "AWS::StackName" }, "-postMetrics" ] ] }, "RetentionInDays": 90 }, "Metadata": { "cfn_nag": { "rules_to_suppress": [ { "id": "W84", "reason": "The solution is a temporary, one off deployment. No sensitive or PII data logged." } ] } }, "DeletionPolicy": "Retain" }, "monitoringrequestArchivesLogGroup70D7C9C5": { "Type": "AWS::Logs::LogGroup", "Properties": { "LogGroupName": { "Fn::Join": [ "", [ "/aws/lambda/", { "Ref": "AWS::StackName" }, "-requestArchives" ] ] }, "RetentionInDays": 90 }, "Metadata": { "cfn_nag": { "rules_to_suppress": [ { "id": "W84", "reason": "The solution is a temporary, one off deployment. No sensitive or PII data logged." } ] } }, "DeletionPolicy": "Retain" }, "monitoringrequestInventoryLogGroupB7C9607D": { "Type": "AWS::Logs::LogGroup", "Properties": { "LogGroupName": { "Fn::Join": [ "", [ "/aws/lambda/", { "Ref": "AWS::StackName" }, "-requestInventory" ] ] }, "RetentionInDays": 90 }, "Metadata": { "cfn_nag": { "rules_to_suppress": [ { "id": "W84", "reason": "The solution is a temporary, one off deployment. No sensitive or PII data logged." } ] } }, "DeletionPolicy": "Retain" }, "monitoringsendAnonymousStatsLogGroup0C9968BB": { "Type": "AWS::Logs::LogGroup", "Properties": { "LogGroupName": { "Fn::Join": [ "", [ "/aws/lambda/", { "Ref": "AWS::StackName" }, "-sendAnonymousStats" ] ] }, "RetentionInDays": 90 }, "Metadata": { "cfn_nag": { "rules_to_suppress": [ { "id": "W84", "reason": "The solution is a temporary, one off deployment. No sensitive or PII data logged." } ] } }, "DeletionPolicy": "Retain" }, "monitoringtoLowercaseLogGroupC05CBA29": { "Type": "AWS::Logs::LogGroup", "Properties": { "LogGroupName": { "Fn::Join": [ "", [ "/aws/lambda/", { "Ref": "AWS::StackName" }, "-toLowercase" ] ] }, "RetentionInDays": 90 }, "Metadata": { "cfn_nag": { "rules_to_suppress": [ { "id": "W84", "reason": "The solution is a temporary, one off deployment. No sensitive or PII data logged." } ] } }, "DeletionPolicy": "Retain" }, "statisticsGenerateUuidServiceRole2FEB4F4B": { "Type": "AWS::IAM::Role", "Properties": { "AssumeRolePolicyDocument": { "Statement": [ { "Action": "sts:AssumeRole", "Effect": "Allow", "Principal": { "Service": "lambda.amazonaws.com" } } ], "Version": "2012-10-17" }, "ManagedPolicyArns": [ { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":iam::aws:policy/service-role/AWSLambdaBasicExecutionRole" ] ] } ], "Tags": [ { "Key": "solution", "Value": "amazon-s3-glacier-refreezer" } ] }, "Metadata": { "aws:cdk:path": "amazon-s3-glacier-refreezer/statistics/GenerateUuid/ServiceRole/Resource" } }, "statisticsGenerateUuidF0CAA49C": { "Type": "AWS::Lambda::Function", "Properties": { "Code": { "S3Bucket": { "Fn::Sub": "solutions-${AWS::Region}" }, "S3Key": "amazon-s3-glacier-refreezer/v1.0.1/asset2d5ea2df61f77c9589ac2031eef351a348bcc2ffef0874efa25d80aee1c55f27.zip" }, "Role": { "Fn::GetAtt": [ "statisticsGenerateUuidServiceRole2FEB4F4B", "Arn" ] }, "Description": "This function generates UUID for each deployment", "FunctionName": { "Fn::Join": [ "", [ { "Ref": "AWS::StackName" }, "-generateUuid" ] ] }, "Handler": "index.handler", "MemorySize": 256, "Runtime": "nodejs12.x", "Tags": [ { "Key": "solution", "Value": "amazon-s3-glacier-refreezer" } ], "Timeout": 20 }, "DependsOn": [ "statisticsGenerateUuidServiceRole2FEB4F4B" ], "Metadata": { "cfn_nag": { "rules_to_suppress": [ { "id": "W58", "reason": "cfn nag is unable to reason about CDK generated cloudwatch log permissions" }, { "id": "W89", "reason": "This is a fully serverless solution - no VPC is required" }, { "id": "W92", "reason": "Reserved Concurrency is set on high priority functions only by design" } ] } } }, "statisticsGenerateUuidTriggerAFF2A046": { "Type": "AWS::CloudFormation::CustomResource", "Properties": { "ServiceToken": { "Fn::GetAtt": [ "statisticsGenerateUuidF0CAA49C", "Arn" ] } }, "UpdateReplacePolicy": "Delete", "DeletionPolicy": "Delete", "Metadata": { "aws:cdk:path": "amazon-s3-glacier-refreezer/statistics/GenerateUuidTrigger/Default" } }, "statisticsSendAnonymousStatsServiceRoleFEE7F44D": { "Type": "AWS::IAM::Role", "Properties": { "AssumeRolePolicyDocument": { "Statement": [ { "Action": "sts:AssumeRole", "Effect": "Allow", "Principal": { "Service": "lambda.amazonaws.com" } } ], "Version": "2012-10-17" }, "ManagedPolicyArns": [ { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":iam::aws:policy/service-role/AWSLambdaBasicExecutionRole" ] ] } ], "Tags": [ { "Key": "solution", "Value": "amazon-s3-glacier-refreezer" } ] }, "Metadata": { "aws:cdk:path": "amazon-s3-glacier-refreezer/statistics/SendAnonymousStats/ServiceRole/Resource" } }, "statisticsSendAnonymousStatsD2E34707": { "Type": "AWS::Lambda::Function", "Properties": { "Code": { "S3Bucket": { "Fn::Sub": "solutions-${AWS::Region}" }, "S3Key": "amazon-s3-glacier-refreezer/v1.0.1/asset1d47fc8fe263ea74d9af91c07639601d7f3aacbf469e0be9733c4039ee998a62.zip" }, "Role": { "Fn::GetAtt": [ "statisticsSendAnonymousStatsServiceRoleFEE7F44D", "Arn" ] }, "Description": "This function sends anonymous statistics to the AWS Solutions Builders team", "Environment": { "Variables": { "UUID": { "Fn::GetAtt": [ "statisticsGenerateUuidTriggerAFF2A046", "UUID" ] }, "REGION": { "Ref": "AWS::Region" }, "SOLUTION_ID": "SO0140", "VERSION": "v1.0.1", "STORAGE_CLASS": { "Ref": "DestinationStorageClass" }, "RETRIEVAL_TIER": { "Ref": "GlacierRetrievalTier" }, "SEND_ANONYMOUS_STATISTICS": { "Fn::FindInMap": [ "AnonymousStatisticsMap", "SendAnonymousStatistics", "Data" ] } } }, "FunctionName": { "Fn::Join": [ "", [ { "Ref": "AWS::StackName" }, "-sendAnonymousStats" ] ] }, "Handler": "index.handler", "MemorySize": 128, "Runtime": "nodejs12.x", "Tags": [ { "Key": "solution", "Value": "amazon-s3-glacier-refreezer" } ], "Timeout": 300 }, "DependsOn": [ "statisticsSendAnonymousStatsServiceRoleFEE7F44D" ], "Metadata": { "cfn_nag": { "rules_to_suppress": [ { "id": "W58", "reason": "cfn nag is unable to reason about CDK generated cloudwatch log permissions" }, { "id": "W89", "reason": "This is a fully serverless solution - no VPC is required" }, { "id": "W92", "reason": "Reserved Concurrency is set on high priority functions only by design" } ] } } }, "stageThreetreehashcalcqueue77403987": { "Type": "AWS::SQS::Queue", "Properties": { "MessageRetentionPeriod": 1209600, "QueueName": { "Fn::Join": [ "", [ { "Ref": "AWS::StackName" }, "-treehash-calc-queue" ] ] }, "Tags": [ { "Key": "solution", "Value": "amazon-s3-glacier-refreezer" } ], "VisibilityTimeout": 905 }, "UpdateReplacePolicy": "Delete", "DeletionPolicy": "Delete", "Metadata": { "cfn_nag": { "rules_to_suppress": [ { "id": "W48", "reason": "Non sensitive metadata - encryption is not required and cost inefficient" } ] } } }, "stageThreetreehashcalcqueuePolicyAC24B291": { "Type": "AWS::SQS::QueuePolicy", "Properties": { "PolicyDocument": { "Statement": [ { "Action": "sqs:*", "Condition": { "Bool": { "aws:SecureTransport": false } }, "Effect": "Deny", "Principal": "*", "Resource": { "Fn::GetAtt": [ "stageThreetreehashcalcqueue77403987", "Arn" ] }, "Sid": "denyInsecureTransport" } ], "Version": "2012-10-17" }, "Queues": [ { "Ref": "stageThreetreehashcalcqueue77403987" } ] }, "Metadata": { "aws:cdk:path": "amazon-s3-glacier-refreezer/stageThree/treehash-calc-queue/Policy/Resource" } }, "stageThreearchivenotificationqueue402FED49": { "Type": "AWS::SQS::Queue", "Properties": { "QueueName": { "Fn::Join": [ "", [ { "Ref": "AWS::StackName" }, "-archive-notification-queue" ] ] }, "Tags": [ { "Key": "solution", "Value": "amazon-s3-glacier-refreezer" } ], "VisibilityTimeout": 905 }, "UpdateReplacePolicy": "Delete", "DeletionPolicy": "Delete", "Metadata": { "cfn_nag": { "rules_to_suppress": [ { "id": "W48", "reason": "Non sensitive metadata - encryption is not required and cost inefficient" } ] } } }, "stageThreearchivenotificationqueuePolicy277C3061": { "Type": "AWS::SQS::QueuePolicy", "Properties": { "PolicyDocument": { "Statement": [ { "Action": "sqs:*", "Condition": { "Bool": { "aws:SecureTransport": false } }, "Effect": "Deny", "Principal": "*", "Resource": { "Fn::GetAtt": [ "stageThreearchivenotificationqueue402FED49", "Arn" ] }, "Sid": "denyInsecureTransport" }, { "Action": "sqs:SendMessage", "Condition": { "ArnEquals": { "aws:SourceArn": { "Ref": "archiveNotifications" } } }, "Effect": "Allow", "Principal": { "Service": "sns.amazonaws.com" }, "Resource": { "Fn::GetAtt": [ "stageThreearchivenotificationqueue402FED49", "Arn" ] } } ], "Version": "2012-10-17" }, "Queues": [ { "Ref": "stageThreearchivenotificationqueue402FED49" } ] }, "Metadata": { "aws:cdk:path": "amazon-s3-glacier-refreezer/stageThree/archive-notification-queue/Policy/Resource" } }, "stageThreearchivenotificationqueueamazons3glacierrefreezerArchiveNotifications862D893DDD383B3A": { "Type": "AWS::SNS::Subscription", "Properties": { "Protocol": "sqs", "TopicArn": { "Ref": "archiveNotifications" }, "Endpoint": { "Fn::GetAtt": [ "stageThreearchivenotificationqueue402FED49", "Arn" ] } }, "Metadata": { "aws:cdk:path": "amazon-s3-glacier-refreezer/stageThree/archive-notification-queue/amazons3glacierrefreezerArchiveNotifications862D893D/Resource" } }, "stageThreechunkcopyqueue6E6E5A95": { "Type": "AWS::SQS::Queue", "Properties": { "QueueName": { "Fn::Join": [ "", [ { "Ref": "AWS::StackName" }, "-chunk-copy-queue" ] ] }, "Tags": [ { "Key": "solution", "Value": "amazon-s3-glacier-refreezer" } ], "VisibilityTimeout": 905 }, "UpdateReplacePolicy": "Delete", "DeletionPolicy": "Delete", "Metadata": { "cfn_nag": { "rules_to_suppress": [ { "id": "W48", "reason": "Non sensitive metadata - encryption is not required and cost inefficient" } ] } } }, "stageThreechunkcopyqueuePolicy1B170AFE": { "Type": "AWS::SQS::QueuePolicy", "Properties": { "PolicyDocument": { "Statement": [ { "Action": "sqs:*", "Condition": { "Bool": { "aws:SecureTransport": false } }, "Effect": "Deny", "Principal": "*", "Resource": { "Fn::GetAtt": [ "stageThreechunkcopyqueue6E6E5A95", "Arn" ] }, "Sid": "denyInsecureTransport" } ], "Version": "2012-10-17" }, "Queues": [ { "Ref": "stageThreechunkcopyqueue6E6E5A95" } ] }, "Metadata": { "aws:cdk:path": "amazon-s3-glacier-refreezer/stageThree/chunk-copy-queue/Policy/Resource" } }, "stageThreeCopyArchiveRoleF6DAB445": { "Type": "AWS::IAM::Role", "Properties": { "AssumeRolePolicyDocument": { "Statement": [ { "Action": "sts:AssumeRole", "Effect": "Allow", "Principal": { "Service": "lambda.amazonaws.com" } } ], "Version": "2012-10-17" }, "Tags": [ { "Key": "solution", "Value": "amazon-s3-glacier-refreezer" } ] }, "Metadata": { "aws:cdk:path": "amazon-s3-glacier-refreezer/stageThree/CopyArchiveRole/Resource" } }, "stageThreeCopyArchiveRoleDefaultPolicy61EA658E": { "Type": "AWS::IAM::Policy", "Properties": { "PolicyDocument": { "Statement": [ { "Action": [ "s3:GetObject*", "s3:GetBucket*", "s3:List*", "s3:DeleteObject*", "s3:PutObject*", "s3:Abort*" ], "Effect": "Allow", "Resource": [ { "Fn::GetAtt": [ "stagingBucket", "Arn" ] }, { "Fn::Join": [ "", [ { "Fn::GetAtt": [ "stagingBucket", "Arn" ] }, "/*" ] ] } ] }, { "Action": [ "dynamodb:BatchGetItem", "dynamodb:GetRecords", "dynamodb:GetShardIterator", "dynamodb:Query", "dynamodb:GetItem", "dynamodb:Scan", "dynamodb:ConditionCheckItem", "dynamodb:BatchWriteItem", "dynamodb:PutItem", "dynamodb:UpdateItem", "dynamodb:DeleteItem" ], "Effect": "Allow", "Resource": [ { "Fn::GetAtt": [ "dynamoDataCatalogStatusTableE9ACB88F", "Arn" ] }, { "Fn::Join": [ "", [ { "Fn::GetAtt": [ "dynamoDataCatalogStatusTableE9ACB88F", "Arn" ] }, "/index/*" ] ] } ] }, { "Action": [ "sqs:SendMessage", "sqs:GetQueueAttributes", "sqs:GetQueueUrl" ], "Effect": "Allow", "Resource": { "Fn::GetAtt": [ "stageThreechunkcopyqueue6E6E5A95", "Arn" ] } }, { "Action": [ "sqs:SendMessage", "sqs:GetQueueAttributes", "sqs:GetQueueUrl" ], "Effect": "Allow", "Resource": { "Fn::GetAtt": [ "stageThreetreehashcalcqueue77403987", "Arn" ] } } ], "Version": "2012-10-17" }, "PolicyName": "stageThreeCopyArchiveRoleDefaultPolicy61EA658E", "Roles": [ { "Ref": "stageThreeCopyArchiveRoleF6DAB445" } ] }, "Metadata": { "aws:cdk:path": "amazon-s3-glacier-refreezer/stageThree/CopyArchiveRole/DefaultPolicy/Resource" } }, "stageThreeCopyArchiveRolePolicyBDE7CBFE": { "Type": "AWS::IAM::Policy", "Properties": { "PolicyDocument": { "Statement": [ { "Action": [ "logs:CreateLogGroup", "logs:CreateLogStream", "logs:PutLogEvents" ], "Effect": "Allow", "Resource": { "Fn::Join": [ "", [ "arn:aws-cn:logs:", { "Ref": "AWS::Region" }, ":", { "Ref": "AWS::AccountId" }, ":log-group:/aws/lambda/", { "Ref": "AWS::StackName" }, "-copyArchive:**" ] ] }, "Sid": "allowCloudWatchLogs" }, { "Action": [ "glacier:GetJobOutput", "glacier:InitiateJob" ], "Condition": { "Bool": { "aws:SecureTransport": true } }, "Effect": "Allow", "Resource": { "Fn::Join": [ "", [ "arn:aws-cn:glacier:", { "Ref": "AWS::Region" }, ":", { "Ref": "AWS::AccountId" }, ":vaults/", { "Ref": "SourceVault" } ] ] }, "Sid": "allowGlacierAccess" }, { "Action": [ "sqs:ReceiveMessage", "sqs:DeleteMessage", "sqs:GetQueueAttributes" ], "Effect": "Allow", "Resource": { "Fn::GetAtt": [ "stageThreearchivenotificationqueue402FED49", "Arn" ] }, "Sid": "allowSqsSubscribeAccess" } ], "Version": "2012-10-17" }, "PolicyName": "stageThreeCopyArchiveRolePolicyBDE7CBFE", "Roles": [ { "Ref": "stageThreeCopyArchiveRoleF6DAB445" } ] }, "Metadata": { "aws:cdk:path": "amazon-s3-glacier-refreezer/stageThree/CopyArchiveRolePolicy/Resource" } }, "stageThreeCopyArchive3C4457DF": { "Type": "AWS::Lambda::Function", "Properties": { "Code": { "S3Bucket": { "Fn::Sub": "solutions-${AWS::Region}" }, "S3Key": "amazon-s3-glacier-refreezer/v1.0.1/asset7e0f034e16fe302efa87dd3650e4457b33735732fbd551a5adf005eab9141fa0.zip" }, "Role": { "Fn::GetAtt": [ "stageThreeCopyArchiveRoleF6DAB445", "Arn" ] }, "Environment": { "Variables": { "VAULT": { "Ref": "SourceVault" }, "STAGING_BUCKET": { "Ref": "stagingBucket" }, "STAGING_BUCKET_PREFIX": "stagingdata", "STATUS_TABLE": { "Ref": "dynamoDataCatalogStatusTableE9ACB88F" }, "SQS_CHUNK": { "Fn::GetAtt": [ "stageThreechunkcopyqueue6E6E5A95", "QueueName" ] }, "SQS_HASH": { "Fn::GetAtt": [ "stageThreetreehashcalcqueue77403987", "QueueName" ] } } }, "FunctionName": { "Fn::Join": [ "", [ { "Ref": "AWS::StackName" }, "-copyArchive" ] ] }, "Handler": "index.handler", "MemorySize": 1024, "ReservedConcurrentExecutions": 40, "Runtime": "nodejs12.x", "Tags": [ { "Key": "solution", "Value": "amazon-s3-glacier-refreezer" } ], "Timeout": 900 }, "DependsOn": [ "stageThreeCopyArchiveRoleDefaultPolicy61EA658E", "stageThreeCopyArchiveRoleF6DAB445", "stageThreeCopyArchiveRolePolicyBDE7CBFE" ], "Metadata": { "cfn_nag": { "rules_to_suppress": [ { "id": "W58", "reason": "cfn nag is unable to reason about CDK generated cloudwatch log permissions" }, { "id": "W89", "reason": "This is a fully serverless solution - no VPC is required" }, { "id": "W92", "reason": "Reserved Concurrency is set on high priority functions only by design" } ] } } }, "stageThreeCopyArchiveSqsEventSourceamazons3glacierrefreezerstageThreearchivenotificationqueue413D53D11BDB6C8C": { "Type": "AWS::Lambda::EventSourceMapping", "Properties": { "FunctionName": { "Ref": "stageThreeCopyArchive3C4457DF" }, "BatchSize": 1, "EventSourceArn": { "Fn::GetAtt": [ "stageThreearchivenotificationqueue402FED49", "Arn" ] } }, "DependsOn": [ "stageThreeCopyArchiveRolePolicyBDE7CBFE" ], "Metadata": { "aws:cdk:path": "amazon-s3-glacier-refreezer/stageThree/CopyArchive/SqsEventSource:amazons3glacierrefreezerstageThreearchivenotificationqueue413D53D1/Resource" } }, "stageThreeCopyChunkRole24158C8C": { "Type": "AWS::IAM::Role", "Properties": { "AssumeRolePolicyDocument": { "Statement": [ { "Action": "sts:AssumeRole", "Effect": "Allow", "Principal": { "Service": "lambda.amazonaws.com" } } ], "Version": "2012-10-17" }, "Tags": [ { "Key": "solution", "Value": "amazon-s3-glacier-refreezer" } ] }, "Metadata": { "aws:cdk:path": "amazon-s3-glacier-refreezer/stageThree/CopyChunkRole/Resource" } }, "stageThreeCopyChunkRoleDefaultPolicyA5C59C91": { "Type": "AWS::IAM::Policy", "Properties": { "PolicyDocument": { "Statement": [ { "Action": [ "s3:GetObject*", "s3:GetBucket*", "s3:List*", "s3:DeleteObject*", "s3:PutObject*", "s3:Abort*" ], "Effect": "Allow", "Resource": [ { "Fn::GetAtt": [ "stagingBucket", "Arn" ] }, { "Fn::Join": [ "", [ { "Fn::GetAtt": [ "stagingBucket", "Arn" ] }, "/*" ] ] } ] }, { "Action": [ "dynamodb:BatchGetItem", "dynamodb:GetRecords", "dynamodb:GetShardIterator", "dynamodb:Query", "dynamodb:GetItem", "dynamodb:Scan", "dynamodb:ConditionCheckItem", "dynamodb:BatchWriteItem", "dynamodb:PutItem", "dynamodb:UpdateItem", "dynamodb:DeleteItem" ], "Effect": "Allow", "Resource": [ { "Fn::GetAtt": [ "dynamoDataCatalogStatusTableE9ACB88F", "Arn" ] }, { "Fn::Join": [ "", [ { "Fn::GetAtt": [ "dynamoDataCatalogStatusTableE9ACB88F", "Arn" ] }, "/index/*" ] ] } ] }, { "Action": [ "sqs:SendMessage", "sqs:GetQueueAttributes", "sqs:GetQueueUrl" ], "Effect": "Allow", "Resource": { "Fn::GetAtt": [ "stageThreetreehashcalcqueue77403987", "Arn" ] } } ], "Version": "2012-10-17" }, "PolicyName": "stageThreeCopyChunkRoleDefaultPolicyA5C59C91", "Roles": [ { "Ref": "stageThreeCopyChunkRole24158C8C" } ] }, "Metadata": { "aws:cdk:path": "amazon-s3-glacier-refreezer/stageThree/CopyChunkRole/DefaultPolicy/Resource" } }, "stageThreeCopyChunkRolePolicy8072E407": { "Type": "AWS::IAM::Policy", "Properties": { "PolicyDocument": { "Statement": [ { "Action": [ "logs:CreateLogGroup", "logs:CreateLogStream", "logs:PutLogEvents" ], "Effect": "Allow", "Resource": { "Fn::Join": [ "", [ "arn:aws-cn:logs:", { "Ref": "AWS::Region" }, ":", { "Ref": "AWS::AccountId" }, ":log-group:/aws/lambda/", { "Ref": "AWS::StackName" }, "-copyChunk:**" ] ] }, "Sid": "allowCloudWatchLogs" }, { "Action": [ "glacier:GetJobOutput", "glacier:InitiateJob" ], "Condition": { "Bool": { "aws:SecureTransport": true } }, "Effect": "Allow", "Resource": { "Fn::Join": [ "", [ "arn:aws-cn:glacier:", { "Ref": "AWS::Region" }, ":", { "Ref": "AWS::AccountId" }, ":vaults/", { "Ref": "SourceVault" } ] ] }, "Sid": "allowGlacierAccess" }, { "Action": [ "sqs:ReceiveMessage", "sqs:DeleteMessage", "sqs:GetQueueAttributes" ], "Effect": "Allow", "Resource": { "Fn::GetAtt": [ "stageThreechunkcopyqueue6E6E5A95", "Arn" ] }, "Sid": "allowSqsSubscribeAccess" } ], "Version": "2012-10-17" }, "PolicyName": "stageThreeCopyChunkRolePolicy8072E407", "Roles": [ { "Ref": "stageThreeCopyChunkRole24158C8C" } ] }, "Metadata": { "aws:cdk:path": "amazon-s3-glacier-refreezer/stageThree/CopyChunkRolePolicy/Resource" } }, "stageThreeCopyChunk9DFA72B0": { "Type": "AWS::Lambda::Function", "Properties": { "Code": { "S3Bucket": { "Fn::Sub": "solutions-${AWS::Region}" }, "S3Key": "amazon-s3-glacier-refreezer/v1.0.1/asset973f9b6098b028a50f28428c2f709101c1c9014ab6db00054be36d49c354fad4.zip" }, "Role": { "Fn::GetAtt": [ "stageThreeCopyChunkRole24158C8C", "Arn" ] }, "Environment": { "Variables": { "VAULT": { "Ref": "SourceVault" }, "STAGING_BUCKET": { "Ref": "stagingBucket" }, "STAGING_BUCKET_PREFIX": "stagingdata", "STATUS_TABLE": { "Ref": "dynamoDataCatalogStatusTableE9ACB88F" }, "SQS_HASH": { "Fn::GetAtt": [ "stageThreetreehashcalcqueue77403987", "QueueName" ] } } }, "FunctionName": { "Fn::Join": [ "", [ { "Ref": "AWS::StackName" }, "-copyChunk" ] ] }, "Handler": "index.handler", "MemorySize": 1024, "ReservedConcurrentExecutions": 30, "Runtime": "nodejs12.x", "Tags": [ { "Key": "solution", "Value": "amazon-s3-glacier-refreezer" } ], "Timeout": 900 }, "DependsOn": [ "stageThreeCopyChunkRoleDefaultPolicyA5C59C91", "stageThreeCopyChunkRole24158C8C" ], "Metadata": { "cfn_nag": { "rules_to_suppress": [ { "id": "W58", "reason": "cfn nag is unable to reason about CDK generated cloudwatch log permissions" }, { "id": "W89", "reason": "This is a fully serverless solution - no VPC is required" }, { "id": "W92", "reason": "Reserved Concurrency is set on high priority functions only by design" } ] } } }, "stageThreeCopyChunkSqsEventSourceamazons3glacierrefreezerstageThreechunkcopyqueue61F100E75E81AE88": { "Type": "AWS::Lambda::EventSourceMapping", "Properties": { "FunctionName": { "Ref": "stageThreeCopyChunk9DFA72B0" }, "BatchSize": 1, "EventSourceArn": { "Fn::GetAtt": [ "stageThreechunkcopyqueue6E6E5A95", "Arn" ] } }, "Metadata": { "aws:cdk:path": "amazon-s3-glacier-refreezer/stageThree/CopyChunk/SqsEventSource:amazons3glacierrefreezerstageThreechunkcopyqueue61F100E7/Resource" } }, "stageTwoDeployGlueJobScriptServiceRoleE1F020B7": { "Type": "AWS::IAM::Role", "Properties": { "AssumeRolePolicyDocument": { "Statement": [ { "Action": "sts:AssumeRole", "Effect": "Allow", "Principal": { "Service": "lambda.amazonaws.com" } } ], "Version": "2012-10-17" }, "ManagedPolicyArns": [ { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":iam::aws:policy/service-role/AWSLambdaBasicExecutionRole" ] ] } ], "Tags": [ { "Key": "solution", "Value": "amazon-s3-glacier-refreezer" } ] }, "DependsOn": [ "monitoringCalculateMetricsDynamoDBEventSourceamazons3glacierrefreezerdynamoDataCatalogStatusTable7052596D0ABFB5EB", "monitoringCalculateMetrics1B70CF5B", "monitoringcalculateMetricsLogGroup9961A214", "monitoringCalculateMetricsRoleDefaultPolicy22C0E657", "monitoringCalculateMetricsRoleA76278A7", "monitoringCalculateMetricsRolePolicy0C1EF64D", "monitoringcalculateTreehashLogGroup6FC738B3", "monitoringcopyArchiveLogGroupBB702B1B", "monitoringcopyChunkLogGroup5D04918E", "monitoringdeployGlueJobScriptLogGroupAA50E4DE", "monitoringdownloadInventoryLogGroup2471C2FF", "monitoringdownloadInventoryPartLogGroupD9E69690", "monitoringgenerateUuidLogGroup18A074CF", "monitoringglacierrefreezerdashboardE7F6D8AE", "monitoringPostMetrics98F9F947", "monitoringPostMetricScheduleAllowEventRuleamazons3glacierrefreezermonitoringPostMetrics267F3B25BC9F085A", "monitoringPostMetricSchedule8675C968", "monitoringpostMetricsLogGroup670566A8", "monitoringPostMetricsRole87B61E7B", "monitoringPostMetricsRolePolicy596F9F4D", "monitoringrequestArchivesLogGroup70D7C9C5", "monitoringrequestInventoryLogGroupB7C9607D", "monitoringsendAnonymousStatsLogGroup0C9968BB", "monitoringstageTwoOrchestratorLogGroup62996996", "monitoringtoLowercaseLogGroupC05CBA29" ], "Metadata": { "aws:cdk:path": "amazon-s3-glacier-refreezer/stageTwo/DeployGlueJobScript/ServiceRole/Resource" } }, "stageTwoDeployGlueJobScriptServiceRoleDefaultPolicyD6DC7335": { "Type": "AWS::IAM::Policy", "Properties": { "PolicyDocument": { "Statement": [ { "Action": [ "s3:DeleteObject*", "s3:PutObject*", "s3:Abort*" ], "Effect": "Allow", "Resource": [ { "Fn::GetAtt": [ "stagingBucket", "Arn" ] }, { "Fn::Join": [ "", [ { "Fn::GetAtt": [ "stagingBucket", "Arn" ] }, "/*" ] ] } ] } ], "Version": "2012-10-17" }, "PolicyName": "stageTwoDeployGlueJobScriptServiceRoleDefaultPolicyD6DC7335", "Roles": [ { "Ref": "stageTwoDeployGlueJobScriptServiceRoleE1F020B7" } ] }, "DependsOn": [ "monitoringCalculateMetricsDynamoDBEventSourceamazons3glacierrefreezerdynamoDataCatalogStatusTable7052596D0ABFB5EB", "monitoringCalculateMetrics1B70CF5B", "monitoringcalculateMetricsLogGroup9961A214", "monitoringCalculateMetricsRoleDefaultPolicy22C0E657", "monitoringCalculateMetricsRoleA76278A7", "monitoringCalculateMetricsRolePolicy0C1EF64D", "monitoringcalculateTreehashLogGroup6FC738B3", "monitoringcopyArchiveLogGroupBB702B1B", "monitoringcopyChunkLogGroup5D04918E", "monitoringdeployGlueJobScriptLogGroupAA50E4DE", "monitoringdownloadInventoryLogGroup2471C2FF", "monitoringdownloadInventoryPartLogGroupD9E69690", "monitoringgenerateUuidLogGroup18A074CF", "monitoringglacierrefreezerdashboardE7F6D8AE", "monitoringPostMetrics98F9F947", "monitoringPostMetricScheduleAllowEventRuleamazons3glacierrefreezermonitoringPostMetrics267F3B25BC9F085A", "monitoringPostMetricSchedule8675C968", "monitoringpostMetricsLogGroup670566A8", "monitoringPostMetricsRole87B61E7B", "monitoringPostMetricsRolePolicy596F9F4D", "monitoringrequestArchivesLogGroup70D7C9C5", "monitoringrequestInventoryLogGroupB7C9607D", "monitoringsendAnonymousStatsLogGroup0C9968BB", "monitoringstageTwoOrchestratorLogGroup62996996", "monitoringtoLowercaseLogGroupC05CBA29" ], "Metadata": { "aws:cdk:path": "amazon-s3-glacier-refreezer/stageTwo/DeployGlueJobScript/ServiceRole/DefaultPolicy/Resource" } }, "stageTwoDeployGlueJobScriptD9AB96C6": { "Type": "AWS::Lambda::Function", "Properties": { "Code": { "S3Bucket": { "Fn::Sub": "solutions-${AWS::Region}" }, "S3Key": "amazon-s3-glacier-refreezer/v1.0.1/asset45bdf8210e762eb99bc58d03541cf95a631a37837574e57dd3d2b401f85606a5.zip" }, "Role": { "Fn::GetAtt": [ "stageTwoDeployGlueJobScriptServiceRoleE1F020B7", "Arn" ] }, "Environment": { "Variables": { "STAGING_BUCKET": { "Ref": "stagingBucket" } } }, "FunctionName": { "Fn::Join": [ "", [ { "Ref": "AWS::StackName" }, "-deployGlueJobScript" ] ] }, "Handler": "index.handler", "MemorySize": 128, "Runtime": "nodejs12.x", "Tags": [ { "Key": "solution", "Value": "amazon-s3-glacier-refreezer" } ], "Timeout": 60 }, "DependsOn": [ "monitoringCalculateMetricsDynamoDBEventSourceamazons3glacierrefreezerdynamoDataCatalogStatusTable7052596D0ABFB5EB", "monitoringCalculateMetrics1B70CF5B", "monitoringcalculateMetricsLogGroup9961A214", "monitoringCalculateMetricsRoleDefaultPolicy22C0E657", "monitoringCalculateMetricsRoleA76278A7", "monitoringCalculateMetricsRolePolicy0C1EF64D", "monitoringcalculateTreehashLogGroup6FC738B3", "monitoringcopyArchiveLogGroupBB702B1B", "monitoringcopyChunkLogGroup5D04918E", "monitoringdeployGlueJobScriptLogGroupAA50E4DE", "monitoringdownloadInventoryLogGroup2471C2FF", "monitoringdownloadInventoryPartLogGroupD9E69690", "monitoringgenerateUuidLogGroup18A074CF", "monitoringglacierrefreezerdashboardE7F6D8AE", "monitoringPostMetrics98F9F947", "monitoringPostMetricScheduleAllowEventRuleamazons3glacierrefreezermonitoringPostMetrics267F3B25BC9F085A", "monitoringPostMetricSchedule8675C968", "monitoringpostMetricsLogGroup670566A8", "monitoringPostMetricsRole87B61E7B", "monitoringPostMetricsRolePolicy596F9F4D", "monitoringrequestArchivesLogGroup70D7C9C5", "monitoringrequestInventoryLogGroupB7C9607D", "monitoringsendAnonymousStatsLogGroup0C9968BB", "monitoringstageTwoOrchestratorLogGroup62996996", "monitoringtoLowercaseLogGroupC05CBA29", "stageTwoDeployGlueJobScriptServiceRoleDefaultPolicyD6DC7335", "stageTwoDeployGlueJobScriptServiceRoleE1F020B7" ], "Metadata": { "cfn_nag": { "rules_to_suppress": [ { "id": "W58", "reason": "cfn nag is unable to reason about CDK generated cloudwatch log permissions" }, { "id": "W89", "reason": "This is a fully serverless solution - no VPC is required" }, { "id": "W92", "reason": "Reserved Concurrency is set on high priority functions only by design" } ] } } }, "stageTwodeployGlueJobScriptTriggerBF203D6E": { "Type": "AWS::CloudFormation::CustomResource", "Properties": { "ServiceToken": { "Fn::GetAtt": [ "stageTwoDeployGlueJobScriptD9AB96C6", "Arn" ] } }, "DependsOn": [ "monitoringCalculateMetricsDynamoDBEventSourceamazons3glacierrefreezerdynamoDataCatalogStatusTable7052596D0ABFB5EB", "monitoringCalculateMetrics1B70CF5B", "monitoringcalculateMetricsLogGroup9961A214", "monitoringCalculateMetricsRoleDefaultPolicy22C0E657", "monitoringCalculateMetricsRoleA76278A7", "monitoringCalculateMetricsRolePolicy0C1EF64D", "monitoringcalculateTreehashLogGroup6FC738B3", "monitoringcopyArchiveLogGroupBB702B1B", "monitoringcopyChunkLogGroup5D04918E", "monitoringdeployGlueJobScriptLogGroupAA50E4DE", "monitoringdownloadInventoryLogGroup2471C2FF", "monitoringdownloadInventoryPartLogGroupD9E69690", "monitoringgenerateUuidLogGroup18A074CF", "monitoringglacierrefreezerdashboardE7F6D8AE", "monitoringPostMetrics98F9F947", "monitoringPostMetricScheduleAllowEventRuleamazons3glacierrefreezermonitoringPostMetrics267F3B25BC9F085A", "monitoringPostMetricSchedule8675C968", "monitoringpostMetricsLogGroup670566A8", "monitoringPostMetricsRole87B61E7B", "monitoringPostMetricsRolePolicy596F9F4D", "monitoringrequestArchivesLogGroup70D7C9C5", "monitoringrequestInventoryLogGroupB7C9607D", "monitoringsendAnonymousStatsLogGroup0C9968BB", "monitoringstageTwoOrchestratorLogGroup62996996", "monitoringtoLowercaseLogGroupC05CBA29" ], "UpdateReplacePolicy": "Delete", "DeletionPolicy": "Delete", "Metadata": { "aws:cdk:path": "amazon-s3-glacier-refreezer/stageTwo/deployGlueJobScriptTrigger/Default" } }, "stageTwoRequestArchiveRole00DF0F46": { "Type": "AWS::IAM::Role", "Properties": { "AssumeRolePolicyDocument": { "Statement": [ { "Action": "sts:AssumeRole", "Effect": "Allow", "Principal": { "Service": "lambda.amazonaws.com" } } ], "Version": "2012-10-17" }, "Tags": [ { "Key": "solution", "Value": "amazon-s3-glacier-refreezer" } ] }, "DependsOn": [ "monitoringCalculateMetricsDynamoDBEventSourceamazons3glacierrefreezerdynamoDataCatalogStatusTable7052596D0ABFB5EB", "monitoringCalculateMetrics1B70CF5B", "monitoringcalculateMetricsLogGroup9961A214", "monitoringCalculateMetricsRoleDefaultPolicy22C0E657", "monitoringCalculateMetricsRoleA76278A7", "monitoringCalculateMetricsRolePolicy0C1EF64D", "monitoringcalculateTreehashLogGroup6FC738B3", "monitoringcopyArchiveLogGroupBB702B1B", "monitoringcopyChunkLogGroup5D04918E", "monitoringdeployGlueJobScriptLogGroupAA50E4DE", "monitoringdownloadInventoryLogGroup2471C2FF", "monitoringdownloadInventoryPartLogGroupD9E69690", "monitoringgenerateUuidLogGroup18A074CF", "monitoringglacierrefreezerdashboardE7F6D8AE", "monitoringPostMetrics98F9F947", "monitoringPostMetricScheduleAllowEventRuleamazons3glacierrefreezermonitoringPostMetrics267F3B25BC9F085A", "monitoringPostMetricSchedule8675C968", "monitoringpostMetricsLogGroup670566A8", "monitoringPostMetricsRole87B61E7B", "monitoringPostMetricsRolePolicy596F9F4D", "monitoringrequestArchivesLogGroup70D7C9C5", "monitoringrequestInventoryLogGroupB7C9607D", "monitoringsendAnonymousStatsLogGroup0C9968BB", "monitoringstageTwoOrchestratorLogGroup62996996", "monitoringtoLowercaseLogGroupC05CBA29" ], "Metadata": { "aws:cdk:path": "amazon-s3-glacier-refreezer/stageTwo/RequestArchiveRole/Resource" } }, "stageTwoRequestArchiveRoleDefaultPolicy2CD86D07": { "Type": "AWS::IAM::Policy", "Properties": { "PolicyDocument": { "Statement": [ { "Action": [ "s3:GetObject*", "s3:GetBucket*", "s3:List*", "s3:DeleteObject*", "s3:PutObject*", "s3:Abort*" ], "Effect": "Allow", "Resource": [ { "Fn::GetAtt": [ "stagingBucket", "Arn" ] }, { "Fn::Join": [ "", [ { "Fn::GetAtt": [ "stagingBucket", "Arn" ] }, "/*" ] ] } ] }, { "Action": [ "dynamodb:BatchGetItem", "dynamodb:GetRecords", "dynamodb:GetShardIterator", "dynamodb:Query", "dynamodb:GetItem", "dynamodb:Scan", "dynamodb:ConditionCheckItem", "dynamodb:BatchWriteItem", "dynamodb:PutItem", "dynamodb:UpdateItem", "dynamodb:DeleteItem" ], "Effect": "Allow", "Resource": [ { "Fn::GetAtt": [ "dynamoDataCatalogStatusTableE9ACB88F", "Arn" ] }, { "Fn::Join": [ "", [ { "Fn::GetAtt": [ "dynamoDataCatalogStatusTableE9ACB88F", "Arn" ] }, "/index/*" ] ] } ] } ], "Version": "2012-10-17" }, "PolicyName": "stageTwoRequestArchiveRoleDefaultPolicy2CD86D07", "Roles": [ { "Ref": "stageTwoRequestArchiveRole00DF0F46" } ] }, "DependsOn": [ "monitoringCalculateMetricsDynamoDBEventSourceamazons3glacierrefreezerdynamoDataCatalogStatusTable7052596D0ABFB5EB", "monitoringCalculateMetrics1B70CF5B", "monitoringcalculateMetricsLogGroup9961A214", "monitoringCalculateMetricsRoleDefaultPolicy22C0E657", "monitoringCalculateMetricsRoleA76278A7", "monitoringCalculateMetricsRolePolicy0C1EF64D", "monitoringcalculateTreehashLogGroup6FC738B3", "monitoringcopyArchiveLogGroupBB702B1B", "monitoringcopyChunkLogGroup5D04918E", "monitoringdeployGlueJobScriptLogGroupAA50E4DE", "monitoringdownloadInventoryLogGroup2471C2FF", "monitoringdownloadInventoryPartLogGroupD9E69690", "monitoringgenerateUuidLogGroup18A074CF", "monitoringglacierrefreezerdashboardE7F6D8AE", "monitoringPostMetrics98F9F947", "monitoringPostMetricScheduleAllowEventRuleamazons3glacierrefreezermonitoringPostMetrics267F3B25BC9F085A", "monitoringPostMetricSchedule8675C968", "monitoringpostMetricsLogGroup670566A8", "monitoringPostMetricsRole87B61E7B", "monitoringPostMetricsRolePolicy596F9F4D", "monitoringrequestArchivesLogGroup70D7C9C5", "monitoringrequestInventoryLogGroupB7C9607D", "monitoringsendAnonymousStatsLogGroup0C9968BB", "monitoringstageTwoOrchestratorLogGroup62996996", "monitoringtoLowercaseLogGroupC05CBA29" ], "Metadata": { "aws:cdk:path": "amazon-s3-glacier-refreezer/stageTwo/RequestArchiveRole/DefaultPolicy/Resource" } }, "stageTwoRequestArchiveRolePolicy57718876": { "Type": "AWS::IAM::Policy", "Properties": { "PolicyDocument": { "Statement": [ { "Action": [ "athena:StartQueryExecution", "athena:GetQueryResults", "athena:GetWorkGroup", "athena:CancelQueryExecution", "athena:StopQueryExecution", "athena:GetQueryExecution", "glue:GetTable", "glue:UpdateTable", "glue:GetPartitions", "glue:BatchCreatePartition" ], "Condition": { "Bool": { "aws:SecureTransport": true } }, "Effect": "Allow", "Resource": [ { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":glue:", { "Ref": "AWS::Region" }, ":", { "Ref": "AWS::AccountId" }, ":catalog" ] ] }, { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":glue:", { "Ref": "AWS::Region" }, ":", { "Ref": "AWS::AccountId" }, ":database/", { "Ref": "glueDataCatalogInventoryDatabase96DE1AD3" } ] ] }, { "Fn::Join": [ "", [ "arn:aws-cn:athena:*:", { "Ref": "AWS::AccountId" }, ":workgroup/", { "Ref": "AWS::StackName" }, "-glacier-refreezer-sol" ] ] }, { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":glue:", { "Ref": "AWS::Region" }, ":", { "Ref": "AWS::AccountId" }, ":table/", { "Ref": "glueDataCatalogInventoryDatabase96DE1AD3" }, "/", { "Ref": "glueDataCatalogPartitionedinventoryTable94032B41" } ] ] } ], "Sid": "allowStagingAccess" }, { "Action": [ "logs:CreateLogGroup", "logs:CreateLogStream", "logs:PutLogEvents" ], "Effect": "Allow", "Resource": { "Fn::Join": [ "", [ "arn:aws-cn:logs:", { "Ref": "AWS::Region" }, ":", { "Ref": "AWS::AccountId" }, ":log-group:/aws/lambda/", { "Ref": "AWS::StackName" }, "-requestArchives:**" ] ] }, "Sid": "allowCloudWatchLogs" }, { "Action": [ "glacier:GetJobOutput", "glacier:InitiateJob" ], "Condition": { "Bool": { "aws:SecureTransport": true } }, "Effect": "Allow", "Resource": { "Fn::Join": [ "", [ "arn:aws-cn:glacier:", { "Ref": "AWS::Region" }, ":", { "Ref": "AWS::AccountId" }, ":vaults/", { "Ref": "SourceVault" } ] ] }, "Sid": "allowGlacierAccess" } ], "Version": "2012-10-17" }, "PolicyName": "stageTwoRequestArchiveRolePolicy57718876", "Roles": [ { "Ref": "stageTwoRequestArchiveRole00DF0F46" } ] }, "DependsOn": [ "monitoringCalculateMetricsDynamoDBEventSourceamazons3glacierrefreezerdynamoDataCatalogStatusTable7052596D0ABFB5EB", "monitoringCalculateMetrics1B70CF5B", "monitoringcalculateMetricsLogGroup9961A214", "monitoringCalculateMetricsRoleDefaultPolicy22C0E657", "monitoringCalculateMetricsRoleA76278A7", "monitoringCalculateMetricsRolePolicy0C1EF64D", "monitoringcalculateTreehashLogGroup6FC738B3", "monitoringcopyArchiveLogGroupBB702B1B", "monitoringcopyChunkLogGroup5D04918E", "monitoringdeployGlueJobScriptLogGroupAA50E4DE", "monitoringdownloadInventoryLogGroup2471C2FF", "monitoringdownloadInventoryPartLogGroupD9E69690", "monitoringgenerateUuidLogGroup18A074CF", "monitoringglacierrefreezerdashboardE7F6D8AE", "monitoringPostMetrics98F9F947", "monitoringPostMetricScheduleAllowEventRuleamazons3glacierrefreezermonitoringPostMetrics267F3B25BC9F085A", "monitoringPostMetricSchedule8675C968", "monitoringpostMetricsLogGroup670566A8", "monitoringPostMetricsRole87B61E7B", "monitoringPostMetricsRolePolicy596F9F4D", "monitoringrequestArchivesLogGroup70D7C9C5", "monitoringrequestInventoryLogGroupB7C9607D", "monitoringsendAnonymousStatsLogGroup0C9968BB", "monitoringstageTwoOrchestratorLogGroup62996996", "monitoringtoLowercaseLogGroupC05CBA29" ], "Metadata": { "aws:cdk:path": "amazon-s3-glacier-refreezer/stageTwo/RequestArchiveRolePolicy/Resource" } }, "stageTwoRequestArchives06ED0831": { "Type": "AWS::Lambda::Function", "Properties": { "Code": { "S3Bucket": { "Fn::Sub": "solutions-${AWS::Region}" }, "S3Key": "amazon-s3-glacier-refreezer/v1.0.1/assetb055bfc492896b170ce37b337ca3040f5609024d931250a29280c5f99ad77d78.zip" }, "Role": { "Fn::GetAtt": [ "stageTwoRequestArchiveRole00DF0F46", "Arn" ] }, "Environment": { "Variables": { "AWS_NODEJS_CONNECTION_REUSE_ENABLED": "1", "SNS_TOPIC": { "Ref": "archiveNotifications" }, "STAGING_BUCKET": { "Ref": "stagingBucket" }, "TIER": { "Ref": "GlacierRetrievalTier" }, "STATUS_TABLE": { "Ref": "dynamoDataCatalogStatusTableE9ACB88F" }, "VAULT": { "Ref": "SourceVault" }, "DATABASE": { "Ref": "glueDataCatalogInventoryDatabase96DE1AD3" }, "ATHENA_WORKGROUP": { "Fn::Join": [ "", [ { "Ref": "AWS::StackName" }, "-glacier-refreezer-sol" ] ] }, "PARTITIONED_INVENTORY_TABLE": { "Ref": "glueDataCatalogPartitionedinventoryTable94032B41" }, "DQL": "65970697666560" } }, "FunctionName": { "Fn::Join": [ "", [ { "Ref": "AWS::StackName" }, "-requestArchives" ] ] }, "Handler": "index.handler", "MemorySize": 1024, "Runtime": "nodejs12.x", "Tags": [ { "Key": "solution", "Value": "amazon-s3-glacier-refreezer" } ], "Timeout": 900 }, "DependsOn": [ "monitoringCalculateMetricsDynamoDBEventSourceamazons3glacierrefreezerdynamoDataCatalogStatusTable7052596D0ABFB5EB", "monitoringCalculateMetrics1B70CF5B", "monitoringcalculateMetricsLogGroup9961A214", "monitoringCalculateMetricsRoleDefaultPolicy22C0E657", "monitoringCalculateMetricsRoleA76278A7", "monitoringCalculateMetricsRolePolicy0C1EF64D", "monitoringcalculateTreehashLogGroup6FC738B3", "monitoringcopyArchiveLogGroupBB702B1B", "monitoringcopyChunkLogGroup5D04918E", "monitoringdeployGlueJobScriptLogGroupAA50E4DE", "monitoringdownloadInventoryLogGroup2471C2FF", "monitoringdownloadInventoryPartLogGroupD9E69690", "monitoringgenerateUuidLogGroup18A074CF", "monitoringglacierrefreezerdashboardE7F6D8AE", "monitoringPostMetrics98F9F947", "monitoringPostMetricScheduleAllowEventRuleamazons3glacierrefreezermonitoringPostMetrics267F3B25BC9F085A", "monitoringPostMetricSchedule8675C968", "monitoringpostMetricsLogGroup670566A8", "monitoringPostMetricsRole87B61E7B", "monitoringPostMetricsRolePolicy596F9F4D", "monitoringrequestArchivesLogGroup70D7C9C5", "monitoringrequestInventoryLogGroupB7C9607D", "monitoringsendAnonymousStatsLogGroup0C9968BB", "monitoringstageTwoOrchestratorLogGroup62996996", "monitoringtoLowercaseLogGroupC05CBA29", "stageTwoRequestArchiveRoleDefaultPolicy2CD86D07", "stageTwoRequestArchiveRole00DF0F46" ], "Metadata": { "cfn_nag": { "rules_to_suppress": [ { "id": "W58", "reason": "cfn nag is unable to reason about CDK generated cloudwatch log permissions" }, { "id": "W89", "reason": "This is a fully serverless solution - no VPC is required" }, { "id": "W92", "reason": "Reserved Concurrency is set on high priority functions only by design" } ] } } }, "stageTwoGlueJobRoleDEC61075": { "Type": "AWS::IAM::Role", "Properties": { "AssumeRolePolicyDocument": { "Statement": [ { "Action": "sts:AssumeRole", "Effect": "Allow", "Principal": { "Service": "glue.amazonaws.com" } } ], "Version": "2012-10-17" }, "RoleName": { "Fn::Join": [ "", [ { "Ref": "AWS::StackName" }, "-glue-job-role" ] ] }, "Tags": [ { "Key": "solution", "Value": "amazon-s3-glacier-refreezer" } ] }, "DependsOn": [ "monitoringCalculateMetricsDynamoDBEventSourceamazons3glacierrefreezerdynamoDataCatalogStatusTable7052596D0ABFB5EB", "monitoringCalculateMetrics1B70CF5B", "monitoringcalculateMetricsLogGroup9961A214", "monitoringCalculateMetricsRoleDefaultPolicy22C0E657", "monitoringCalculateMetricsRoleA76278A7", "monitoringCalculateMetricsRolePolicy0C1EF64D", "monitoringcalculateTreehashLogGroup6FC738B3", "monitoringcopyArchiveLogGroupBB702B1B", "monitoringcopyChunkLogGroup5D04918E", "monitoringdeployGlueJobScriptLogGroupAA50E4DE", "monitoringdownloadInventoryLogGroup2471C2FF", "monitoringdownloadInventoryPartLogGroupD9E69690", "monitoringgenerateUuidLogGroup18A074CF", "monitoringglacierrefreezerdashboardE7F6D8AE", "monitoringPostMetrics98F9F947", "monitoringPostMetricScheduleAllowEventRuleamazons3glacierrefreezermonitoringPostMetrics267F3B25BC9F085A", "monitoringPostMetricSchedule8675C968", "monitoringpostMetricsLogGroup670566A8", "monitoringPostMetricsRole87B61E7B", "monitoringPostMetricsRolePolicy596F9F4D", "monitoringrequestArchivesLogGroup70D7C9C5", "monitoringrequestInventoryLogGroupB7C9607D", "monitoringsendAnonymousStatsLogGroup0C9968BB", "monitoringstageTwoOrchestratorLogGroup62996996", "monitoringtoLowercaseLogGroupC05CBA29" ], "Metadata": { "cfn_nag": { "rules_to_suppress": [ { "id": "W28", "reason": "Transient, one off solution - updates must be through deletion/redeployment of the stack only" } ] } } }, "stageTwoGlueJobRoleDefaultPolicy6890375C": { "Type": "AWS::IAM::Policy", "Properties": { "PolicyDocument": { "Statement": [ { "Action": [ "s3:GetObject*", "s3:GetBucket*", "s3:List*", "s3:DeleteObject*", "s3:PutObject*", "s3:Abort*" ], "Effect": "Allow", "Resource": [ { "Fn::GetAtt": [ "stagingBucket", "Arn" ] }, { "Fn::Join": [ "", [ { "Fn::GetAtt": [ "stagingBucket", "Arn" ] }, "/*" ] ] } ] }, { "Action": [ "athena:StartQueryExecution", "athena:GetQueryResults", "athena:GetWorkGroup", "athena:CancelQueryExecution", "athena:StopQueryExecution", "athena:GetQueryExecution", "glue:GetTable", "glue:UpdateTable", "glue:GetPartitions", "glue:BatchCreatePartition" ], "Condition": { "Bool": { "aws:SecureTransport": true } }, "Effect": "Allow", "Resource": [ { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":glue:", { "Ref": "AWS::Region" }, ":", { "Ref": "AWS::AccountId" }, ":catalog" ] ] }, { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":glue:", { "Ref": "AWS::Region" }, ":", { "Ref": "AWS::AccountId" }, ":database/", { "Ref": "glueDataCatalogInventoryDatabase96DE1AD3" } ] ] }, { "Fn::Join": [ "", [ "arn:aws-cn:athena:*:", { "Ref": "AWS::AccountId" }, ":workgroup/", { "Ref": "AWS::StackName" }, "-glacier-refreezer-sol" ] ] }, { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":glue:", { "Ref": "AWS::Region" }, ":", { "Ref": "AWS::AccountId" }, ":table/", { "Ref": "glueDataCatalogInventoryDatabase96DE1AD3" }, "/", { "Ref": "glueDataCatalogInventoryTable05E5F37F" } ] ] }, { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":glue:", { "Ref": "AWS::Region" }, ":", { "Ref": "AWS::AccountId" }, ":table/", { "Ref": "glueDataCatalogInventoryDatabase96DE1AD3" }, "/", { "Ref": "glueDataCatalogFilelistTable2224351B" } ] ] }, { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":glue:", { "Ref": "AWS::Region" }, ":", { "Ref": "AWS::AccountId" }, ":table/", { "Ref": "glueDataCatalogInventoryDatabase96DE1AD3" }, "/", { "Ref": "glueDataCatalogPartitionedinventoryTable94032B41" } ] ] } ], "Sid": "allowStagingAccess" }, { "Action": [ "logs:CreateLogGroup", "logs:CreateLogStream", "logs:PutLogEvents" ], "Effect": "Allow", "Resource": { "Fn::Join": [ "", [ "arn:aws-cn:logs:", { "Ref": "AWS::Region" }, ":", { "Ref": "AWS::AccountId" }, ":log-group:/aws-glue/jobs/*:**" ] ] }, "Sid": "allowLogging" } ], "Version": "2012-10-17" }, "PolicyName": "stageTwoGlueJobRoleDefaultPolicy6890375C", "Roles": [ { "Ref": "stageTwoGlueJobRoleDEC61075" } ] }, "DependsOn": [ "monitoringCalculateMetricsDynamoDBEventSourceamazons3glacierrefreezerdynamoDataCatalogStatusTable7052596D0ABFB5EB", "monitoringCalculateMetrics1B70CF5B", "monitoringcalculateMetricsLogGroup9961A214", "monitoringCalculateMetricsRoleDefaultPolicy22C0E657", "monitoringCalculateMetricsRoleA76278A7", "monitoringCalculateMetricsRolePolicy0C1EF64D", "monitoringcalculateTreehashLogGroup6FC738B3", "monitoringcopyArchiveLogGroupBB702B1B", "monitoringcopyChunkLogGroup5D04918E", "monitoringdeployGlueJobScriptLogGroupAA50E4DE", "monitoringdownloadInventoryLogGroup2471C2FF", "monitoringdownloadInventoryPartLogGroupD9E69690", "monitoringgenerateUuidLogGroup18A074CF", "monitoringglacierrefreezerdashboardE7F6D8AE", "monitoringPostMetrics98F9F947", "monitoringPostMetricScheduleAllowEventRuleamazons3glacierrefreezermonitoringPostMetrics267F3B25BC9F085A", "monitoringPostMetricSchedule8675C968", "monitoringpostMetricsLogGroup670566A8", "monitoringPostMetricsRole87B61E7B", "monitoringPostMetricsRolePolicy596F9F4D", "monitoringrequestArchivesLogGroup70D7C9C5", "monitoringrequestInventoryLogGroupB7C9607D", "monitoringsendAnonymousStatsLogGroup0C9968BB", "monitoringstageTwoOrchestratorLogGroup62996996", "monitoringtoLowercaseLogGroupC05CBA29" ], "Metadata": { "aws:cdk:path": "amazon-s3-glacier-refreezer/stageTwo/GlueJobRole/DefaultPolicy/Resource" } }, "stageTwoGlueRepartitionJob3EB94529": { "Type": "AWS::Glue::Job", "Properties": { "Command": { "Name": "glueetl", "ScriptLocation": { "Fn::Join": [ "", [ "s3://", { "Ref": "stagingBucket" }, "/glue/partition-inventory.py" ] ] } }, "Role": { "Fn::GetAtt": [ "stageTwoGlueJobRoleDEC61075", "Arn" ] }, "DefaultArguments": { "--job-bookmark-option": "job-bookmark-disable", "--enable-continuous-cloudwatch-log": "true", "--enable-continuous-log-filter": "false", "--DATABASE": { "Ref": "glueDataCatalogInventoryDatabase96DE1AD3" }, "--INVENTORY_TABLE": { "Ref": "glueDataCatalogInventoryTable05E5F37F" }, "--FILENAME_TABLE": { "Ref": "glueDataCatalogFilelistTable2224351B" }, "--OUTPUT_TABLE": { "Ref": "glueDataCatalogPartitionedinventoryTable94032B41" }, "--STAGING_BUCKET": { "Ref": "stagingBucket" }, "--DQL": 65970697666560 }, "Description": "To repartition the inventory table", "ExecutionProperty": { "MaxConcurrentRuns": 1 }, "GlueVersion": "2.0", "MaxCapacity": 5, "MaxRetries": 0, "Name": { "Fn::Join": [ "", [ { "Ref": "AWS::StackName" }, "-glacier-refreezer" ] ] }, "Tags": { "solution": "amazon-s3-glacier-refreezer" } }, "DependsOn": [ "monitoringCalculateMetricsDynamoDBEventSourceamazons3glacierrefreezerdynamoDataCatalogStatusTable7052596D0ABFB5EB", "monitoringCalculateMetrics1B70CF5B", "monitoringcalculateMetricsLogGroup9961A214", "monitoringCalculateMetricsRoleDefaultPolicy22C0E657", "monitoringCalculateMetricsRoleA76278A7", "monitoringCalculateMetricsRolePolicy0C1EF64D", "monitoringcalculateTreehashLogGroup6FC738B3", "monitoringcopyArchiveLogGroupBB702B1B", "monitoringcopyChunkLogGroup5D04918E", "monitoringdeployGlueJobScriptLogGroupAA50E4DE", "monitoringdownloadInventoryLogGroup2471C2FF", "monitoringdownloadInventoryPartLogGroupD9E69690", "monitoringgenerateUuidLogGroup18A074CF", "monitoringglacierrefreezerdashboardE7F6D8AE", "monitoringPostMetrics98F9F947", "monitoringPostMetricScheduleAllowEventRuleamazons3glacierrefreezermonitoringPostMetrics267F3B25BC9F085A", "monitoringPostMetricSchedule8675C968", "monitoringpostMetricsLogGroup670566A8", "monitoringPostMetricsRole87B61E7B", "monitoringPostMetricsRolePolicy596F9F4D", "monitoringrequestArchivesLogGroup70D7C9C5", "monitoringrequestInventoryLogGroupB7C9607D", "monitoringsendAnonymousStatsLogGroup0C9968BB", "monitoringstageTwoOrchestratorLogGroup62996996", "monitoringtoLowercaseLogGroupC05CBA29" ], "Metadata": { "aws:cdk:path": "amazon-s3-glacier-refreezer/stageTwo/GlueRepartitionJob" } }, "stageTwoStepfunctionsOrchestratorRole1165D332": { "Type": "AWS::IAM::Role", "Properties": { "AssumeRolePolicyDocument": { "Statement": [ { "Action": "sts:AssumeRole", "Effect": "Allow", "Principal": { "Service": { "Fn::Join": [ "", [ "states.", { "Ref": "AWS::Region" }, ".amazonaws.com" ] ] } } } ], "Version": "2012-10-17" }, "Tags": [ { "Key": "solution", "Value": "amazon-s3-glacier-refreezer" } ] }, "DependsOn": [ "monitoringCalculateMetricsDynamoDBEventSourceamazons3glacierrefreezerdynamoDataCatalogStatusTable7052596D0ABFB5EB", "monitoringCalculateMetrics1B70CF5B", "monitoringcalculateMetricsLogGroup9961A214", "monitoringCalculateMetricsRoleDefaultPolicy22C0E657", "monitoringCalculateMetricsRoleA76278A7", "monitoringCalculateMetricsRolePolicy0C1EF64D", "monitoringcalculateTreehashLogGroup6FC738B3", "monitoringcopyArchiveLogGroupBB702B1B", "monitoringcopyChunkLogGroup5D04918E", "monitoringdeployGlueJobScriptLogGroupAA50E4DE", "monitoringdownloadInventoryLogGroup2471C2FF", "monitoringdownloadInventoryPartLogGroupD9E69690", "monitoringgenerateUuidLogGroup18A074CF", "monitoringglacierrefreezerdashboardE7F6D8AE", "monitoringPostMetrics98F9F947", "monitoringPostMetricScheduleAllowEventRuleamazons3glacierrefreezermonitoringPostMetrics267F3B25BC9F085A", "monitoringPostMetricSchedule8675C968", "monitoringpostMetricsLogGroup670566A8", "monitoringPostMetricsRole87B61E7B", "monitoringPostMetricsRolePolicy596F9F4D", "monitoringrequestArchivesLogGroup70D7C9C5", "monitoringrequestInventoryLogGroupB7C9607D", "monitoringsendAnonymousStatsLogGroup0C9968BB", "monitoringstageTwoOrchestratorLogGroup62996996", "monitoringtoLowercaseLogGroupC05CBA29" ], "Metadata": { "aws:cdk:path": "amazon-s3-glacier-refreezer/stageTwo/Stepfunctions/OrchestratorRole/Resource" } }, "stageTwoStepfunctionsOrchestratorRolePolicyAAB3B86F": { "Type": "AWS::IAM::Policy", "Properties": { "PolicyDocument": { "Statement": [ { "Action": [ "s3:ListBucket", "s3:ListBucketVersions", "s3:GetBucketLocation", "s3:GetObject", "s3:GetObjectAcl", "s3:PutObject", "s3:DeleteObject", "s3:ListBucketMultipartUploads", "s3:ListMultipartUploadParts", "s3:AbortMultipartUpload" ], "Effect": "Allow", "Resource": [ { "Fn::GetAtt": [ "stagingBucket", "Arn" ] }, { "Fn::Join": [ "", [ { "Fn::GetAtt": [ "stagingBucket", "Arn" ] }, "/*" ] ] } ], "Sid": "allowS3ReadWrite" }, { "Action": [ "athena:StartQueryExecution", "athena:GetQueryResults", "athena:GetWorkGroup", "athena:CancelQueryExecution", "athena:StopQueryExecution", "athena:GetQueryExecution", "glue:GetTable", "glue:UpdateTable", "glue:GetPartitions", "glue:BatchCreatePartition" ], "Condition": { "Bool": { "aws:SecureTransport": true } }, "Effect": "Allow", "Resource": [ { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":glue:", { "Ref": "AWS::Region" }, ":", { "Ref": "AWS::AccountId" }, ":catalog" ] ] }, { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":glue:", { "Ref": "AWS::Region" }, ":", { "Ref": "AWS::AccountId" }, ":database/", { "Ref": "glueDataCatalogInventoryDatabase96DE1AD3" } ] ] }, { "Fn::Join": [ "", [ "arn:aws-cn:athena:*:", { "Ref": "AWS::AccountId" }, ":workgroup/", { "Ref": "AWS::StackName" }, "-glacier-refreezer-sol" ] ] }, { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":glue:", { "Ref": "AWS::Region" }, ":", { "Ref": "AWS::AccountId" }, ":table/", { "Ref": "glueDataCatalogInventoryDatabase96DE1AD3" }, "/", { "Ref": "glueDataCatalogInventoryTable05E5F37F" } ] ] }, { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":glue:", { "Ref": "AWS::Region" }, ":", { "Ref": "AWS::AccountId" }, ":table/", { "Ref": "glueDataCatalogInventoryDatabase96DE1AD3" }, "/", { "Ref": "glueDataCatalogPartitionedinventoryTable94032B41" } ] ] } ], "Sid": "allowStagingAccess" }, { "Action": [ "glue:StartJobRun", "glue:GetJobRun", "glue:GetJobRuns" ], "Effect": "Allow", "Resource": { "Fn::Join": [ "", [ "arn:aws-cn:glue:", { "Ref": "AWS::Region" }, ":", { "Ref": "AWS::AccountId" }, ":job/", { "Ref": "AWS::StackName" }, "-glacier-refreezer" ] ] }, "Sid": "allowGlueJobRun" }, { "Action": "lambda:InvokeFunction", "Effect": "Allow", "Resource": [ { "Fn::GetAtt": [ "stageTwoRequestArchives06ED0831", "Arn" ] }, { "Fn::GetAtt": [ "statisticsSendAnonymousStatsD2E34707", "Arn" ] } ], "Sid": "allowLambdaInvocations" }, { "Action": "dynamodb:PutItem", "Effect": "Allow", "Resource": { "Fn::GetAtt": [ "dynamoDataCatalogMetricsTable174C007B", "Arn" ] }, "Sid": "allowPutTotalArchiveMetric" }, { "Action": [ "logs:CreateLogGroup", "logs:CreateLogStream", "logs:PutLogEvents" ], "Effect": "Allow", "Resource": { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":logs:", { "Ref": "AWS::Region" }, ":", { "Ref": "AWS::AccountId" }, ":log-group:/aws/vendedlogs/states/", { "Ref": "AWS::StackName" }, "-stageTwoOrchestrator:*" ] ] }, "Sid": "allowLogOutput" }, { "Action": [ "logs:CreateLogDelivery", "logs:GetLogDelivery", "logs:UpdateLogDelivery", "logs:DeleteLogDelivery", "logs:ListLogDeliveries", "logs:PutResourcePolicy", "logs:DescribeResourcePolicies", "logs:DescribeLogGroups" ], "Effect": "Allow", "Resource": "*", "Sid": "allowLogDelivery" } ], "Version": "2012-10-17" }, "PolicyName": "stageTwoStepfunctionsOrchestratorRolePolicyAAB3B86F", "Roles": [ { "Ref": "stageTwoStepfunctionsOrchestratorRole1165D332" } ] }, "DependsOn": [ "monitoringCalculateMetricsDynamoDBEventSourceamazons3glacierrefreezerdynamoDataCatalogStatusTable7052596D0ABFB5EB", "monitoringCalculateMetrics1B70CF5B", "monitoringcalculateMetricsLogGroup9961A214", "monitoringCalculateMetricsRoleDefaultPolicy22C0E657", "monitoringCalculateMetricsRoleA76278A7", "monitoringCalculateMetricsRolePolicy0C1EF64D", "monitoringcalculateTreehashLogGroup6FC738B3", "monitoringcopyArchiveLogGroupBB702B1B", "monitoringcopyChunkLogGroup5D04918E", "monitoringdeployGlueJobScriptLogGroupAA50E4DE", "monitoringdownloadInventoryLogGroup2471C2FF", "monitoringdownloadInventoryPartLogGroupD9E69690", "monitoringgenerateUuidLogGroup18A074CF", "monitoringglacierrefreezerdashboardE7F6D8AE", "monitoringPostMetrics98F9F947", "monitoringPostMetricScheduleAllowEventRuleamazons3glacierrefreezermonitoringPostMetrics267F3B25BC9F085A", "monitoringPostMetricSchedule8675C968", "monitoringpostMetricsLogGroup670566A8", "monitoringPostMetricsRole87B61E7B", "monitoringPostMetricsRolePolicy596F9F4D", "monitoringrequestArchivesLogGroup70D7C9C5", "monitoringrequestInventoryLogGroupB7C9607D", "monitoringsendAnonymousStatsLogGroup0C9968BB", "monitoringstageTwoOrchestratorLogGroup62996996", "monitoringtoLowercaseLogGroupC05CBA29" ], "Metadata": { "cfn_nag": { "rules_to_suppress": [ { "id": "W12", "reason": "[*] Access granted as per documentation: https://docs.aws.amazon.com/step-functions/latest/dg/cw-logs.html" }, { "id": "W76", "reason": "SPCM complexity greater then 25 is appropriate for the logic implemented" } ] } } }, "stageTwoOrchestrator": { "Type": "AWS::StepFunctions::StateMachine", "Properties": { "RoleArn": { "Fn::GetAtt": [ "stageTwoStepfunctionsOrchestratorRole1165D332", "Arn" ] }, "DefinitionString": { "Fn::Join": [ "", [ "{\"StartAt\":\"Parallel Queries\",\"States\":{\"Parallel Queries\":{\"Type\":\"Parallel\",\"Next\":\"Check Inventory State\",\"Branches\":[{\"StartAt\":\"Start Inventory Query\",\"States\":{\"Start Inventory Query\":{\"Next\":\"Get Inventory Results\",\"Type\":\"Task\",\"OutputPath\":\"$.QueryExecution\",\"Resource\":\"arn:", { "Ref": "AWS::Partition" }, ":states:::athena:startQueryExecution.sync\",\"Parameters\":{\"QueryString\":\"SELECT COUNT(1) AS archiveCount, COALESCE(SUM(size),0) AS vaultSize FROM \\\"", { "Ref": "glueDataCatalogInventoryTable05E5F37F" }, "\\\";\",\"QueryExecutionContext\":{\"Database\":\"", { "Ref": "glueDataCatalogInventoryDatabase96DE1AD3" }, "\"},\"ResultConfiguration\":{},\"WorkGroup\":\"", { "Ref": "AWS::StackName" }, "-glacier-refreezer-sol\"}},\"Get Inventory Results\":{\"End\":true,\"Type\":\"Task\",\"OutputPath\":\"$.ResultSet.Rows[1]\",\"Resource\":\"arn:", { "Ref": "AWS::Partition" }, ":states:::athena:getQueryResults\",\"Parameters\":{\"QueryExecutionId.$\":\"$.QueryExecutionId\"}}}},{\"StartAt\":\"Start Partitioned Query\",\"States\":{\"Start Partitioned Query\":{\"Next\":\"Get Partitioned Results\",\"Type\":\"Task\",\"OutputPath\":\"$.QueryExecution\",\"Resource\":\"arn:", { "Ref": "AWS::Partition" }, ":states:::athena:startQueryExecution.sync\",\"Parameters\":{\"QueryString\":\"SELECT COUNT(1) AS archiveCount FROM \\\"", { "Ref": "glueDataCatalogPartitionedinventoryTable94032B41" }, "\\\";\",\"QueryExecutionContext\":{\"Database\":\"", { "Ref": "glueDataCatalogInventoryDatabase96DE1AD3" }, "\"},\"ResultConfiguration\":{},\"WorkGroup\":\"", { "Ref": "AWS::StackName" }, "-glacier-refreezer-sol\"}},\"Get Partitioned Results\":{\"End\":true,\"Type\":\"Task\",\"OutputPath\":\"$.ResultSet.Rows[1]\",\"Resource\":\"arn:", { "Ref": "AWS::Partition" }, ":states:::athena:getQueryResults\",\"Parameters\":{\"QueryExecutionId.$\":\"$.QueryExecutionId\"}}}}],\"ResultSelector\":{\"inventoryTable\":{\"archiveCount.$\":\"$[0].Data[0].VarCharValue\",\"vaultSize.$\":\"$[0].Data[1].VarCharValue\"},\"partitionedTable\":{\"archiveCount.$\":\"$[1].Data[0].VarCharValue\"}}},\"Check Inventory State\":{\"Type\":\"Choice\",\"Choices\":[{\"Variable\":\"$.inventoryTable.archiveCount\",\"StringEquals\":\"0\",\"Next\":\"FAIL: Inventory Empty\"},{\"And\":[{\"Not\":{\"Variable\":\"$.partitionedTable.archiveCount\",\"StringEquals\":\"0\"}},{\"Not\":{\"Variable\":\"$.inventoryTable.archiveCount\",\"StringEqualsPath\":\"$.partitionedTable.archiveCount\"}}],\"Next\":\"FAIL: Inventory-Partitioned Mismatch\"}],\"Default\":\"Partitioning Required ?\"},\"Partitioning Required ?\":{\"Type\":\"Choice\",\"Choices\":[{\"Variable\":\"$.inventoryTable.archiveCount\",\"StringEqualsPath\":\"$.partitionedTable.archiveCount\",\"Next\":\"Start Max Partition Query\"}],\"Default\":\"Parallel Partitioning and Stats update\"},\"Parallel Partitioning and Stats update\":{\"Type\":\"Parallel\",\"Next\":\"Start Max Partition Query\",\"Branches\":[{\"StartAt\":\"Run Glue Partitioning\",\"States\":{\"Run Glue Partitioning\":{\"End\":true,\"Type\":\"Task\",\"Resource\":\"arn:", { "Ref": "AWS::Partition" }, ":states:::glue:startJobRun.sync\",\"Parameters\":{\"JobName\":\"", { "Ref": "AWS::StackName" }, "-glacier-refreezer\",\"Arguments\":{\"--ARCHIVE_COUNT.$\":\"$.inventoryTable.archiveCount\",\"--VAULT_SIZE.$\":\"$.inventoryTable.vaultSize\"}}}}},{\"StartAt\":\"Update Count Metric\",\"States\":{\"Update Count Metric\":{\"Next\":\"Update Size Metric\",\"Type\":\"Task\",\"ResultPath\":\"$.putItemResult\",\"Resource\":\"arn:", { "Ref": "AWS::Partition" }, ":states:::dynamodb:putItem\",\"Parameters\":{\"Item\":{\"pk\":{\"S\":\"count\"},\"total\":{\"N.$\":\"$.inventoryTable.archiveCount\"}},\"TableName\":\"", { "Ref": "dynamoDataCatalogMetricsTable174C007B" }, "\"}},\"Update Size Metric\":{\"Next\":\"Send Anonymous Statistics\",\"Type\":\"Task\",\"ResultPath\":\"$.putItemResult\",\"Resource\":\"arn:", { "Ref": "AWS::Partition" }, ":states:::dynamodb:putItem\",\"Parameters\":{\"Item\":{\"pk\":{\"S\":\"size\"},\"total\":{\"N.$\":\"$.inventoryTable.vaultSize\"}},\"TableName\":\"", { "Ref": "dynamoDataCatalogMetricsTable174C007B" }, "\"}},\"Send Anonymous Statistics\":{\"End\":true,\"Retry\":[{\"ErrorEquals\":[\"Lambda.ServiceException\",\"Lambda.AWSLambdaException\",\"Lambda.SdkClientException\"],\"IntervalSeconds\":2,\"MaxAttempts\":6,\"BackoffRate\":2},{\"ErrorEquals\":[\"States.ALL\"],\"IntervalSeconds\":2,\"MaxAttempts\":6,\"BackoffRate\":2}],\"Catch\":[{\"ErrorEquals\":[\"States.ALL\"],\"Next\":\"Ignore SendStats Errors\"}],\"Type\":\"Task\",\"InputPath\":\"$.inventoryTable\",\"Resource\":\"arn:", { "Ref": "AWS::Partition" }, ":states:::lambda:invoke\",\"Parameters\":{\"FunctionName\":\"", { "Fn::GetAtt": [ "statisticsSendAnonymousStatsD2E34707", "Arn" ] }, "\",\"Payload.$\":\"$\"}},\"Ignore SendStats Errors\":{\"Type\":\"Pass\",\"End\":true}}}]},\"Start Max Partition Query\":{\"Next\":\"Get Max Partition Result\",\"Type\":\"Task\",\"OutputPath\":\"$.QueryExecution\",\"Resource\":\"arn:", { "Ref": "AWS::Partition" }, ":states:::athena:startQueryExecution.sync\",\"Parameters\":{\"QueryString\":\"SELECT '{ \\\"nextPartition\\\": 0, \\\"maxPartition\\\" :' || CAST(MAX(part) AS VARCHAR) || '}'FROM \\\"", { "Ref": "glueDataCatalogPartitionedinventoryTable94032B41" }, "\\\";\",\"QueryExecutionContext\":{\"Database\":\"", { "Ref": "glueDataCatalogInventoryDatabase96DE1AD3" }, "\"},\"ResultConfiguration\":{},\"WorkGroup\":\"", { "Ref": "AWS::StackName" }, "-glacier-refreezer-sol\"}},\"Get Max Partition Result\":{\"Next\":\"Request Archives Retrieval\",\"Type\":\"Task\",\"OutputPath\":\"$.result\",\"ResultSelector\":{\"result.$\":\"States.StringToJson($.ResultSet.Rows[1].Data[0].VarCharValue)\"},\"Resource\":\"arn:", { "Ref": "AWS::Partition" }, ":states:::athena:getQueryResults\",\"Parameters\":{\"QueryExecutionId.$\":\"$.QueryExecutionId\"}},\"Request Archives Retrieval\":{\"Next\":\"Is Complete?\",\"Retry\":[{\"ErrorEquals\":[\"Lambda.ServiceException\",\"Lambda.AWSLambdaException\",\"Lambda.SdkClientException\"],\"IntervalSeconds\":2,\"MaxAttempts\":6,\"BackoffRate\":2},{\"ErrorEquals\":[\"States.ALL\"],\"IntervalSeconds\":15,\"MaxAttempts\":10000,\"BackoffRate\":1}],\"Type\":\"Task\",\"OutputPath\":\"$.Payload\",\"Resource\":\"arn:", { "Ref": "AWS::Partition" }, ":states:::lambda:invoke\",\"Parameters\":{\"FunctionName\":\"", { "Fn::GetAtt": [ "stageTwoRequestArchives06ED0831", "Arn" ] }, "\",\"Payload.$\":\"$\"}},\"Wait X Seconds\":{\"Type\":\"Wait\",\"SecondsPath\":\"$.timeout\",\"Next\":\"Request Archives Retrieval\"},\"Is Complete?\":{\"Type\":\"Choice\",\"Choices\":[{\"Variable\":\"$.nextPartition\",\"NumericGreaterThanPath\":\"$.maxPartition\",\"Next\":\"Success\"}],\"Default\":\"Wait X Seconds\"},\"Success\":{\"Type\":\"Succeed\"},\"FAIL: Inventory Empty\":{\"Type\":\"Fail\",\"Error\":\"Vault Inventory Table is empty. Has it been downloaded?\"},\"FAIL: Inventory-Partitioned Mismatch\":{\"Type\":\"Fail\",\"Error\":\"Inventory and Partitioned table counts are greater than 0 and do not match. Cannot proceed.\"}}}" ] ] }, "LoggingConfiguration": { "Destinations": [ { "CloudWatchLogsLogGroup": { "LogGroupArn": { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":logs:", { "Ref": "AWS::Region" }, ":", { "Ref": "AWS::AccountId" }, ":log-group:/aws/vendedlogs/states/", { "Ref": "AWS::StackName" }, "-stageTwoOrchestrator:*" ] ] } } } ], "Level": "ALL" }, "StateMachineName": { "Fn::Join": [ "", [ { "Ref": "AWS::StackName" }, "-stageTwoOrchestrator" ] ] }, "StateMachineType": "STANDARD", "Tags": [ { "Key": "solution", "Value": "amazon-s3-glacier-refreezer" } ] }, "DependsOn": [ "monitoringCalculateMetricsDynamoDBEventSourceamazons3glacierrefreezerdynamoDataCatalogStatusTable7052596D0ABFB5EB", "monitoringCalculateMetrics1B70CF5B", "monitoringcalculateMetricsLogGroup9961A214", "monitoringCalculateMetricsRoleDefaultPolicy22C0E657", "monitoringCalculateMetricsRoleA76278A7", "monitoringCalculateMetricsRolePolicy0C1EF64D", "monitoringcalculateTreehashLogGroup6FC738B3", "monitoringcopyArchiveLogGroupBB702B1B", "monitoringcopyChunkLogGroup5D04918E", "monitoringdeployGlueJobScriptLogGroupAA50E4DE", "monitoringdownloadInventoryLogGroup2471C2FF", "monitoringdownloadInventoryPartLogGroupD9E69690", "monitoringgenerateUuidLogGroup18A074CF", "monitoringglacierrefreezerdashboardE7F6D8AE", "monitoringPostMetrics98F9F947", "monitoringPostMetricScheduleAllowEventRuleamazons3glacierrefreezermonitoringPostMetrics267F3B25BC9F085A", "monitoringPostMetricSchedule8675C968", "monitoringpostMetricsLogGroup670566A8", "monitoringPostMetricsRole87B61E7B", "monitoringPostMetricsRolePolicy596F9F4D", "monitoringrequestArchivesLogGroup70D7C9C5", "monitoringrequestInventoryLogGroupB7C9607D", "monitoringsendAnonymousStatsLogGroup0C9968BB", "monitoringstageTwoOrchestratorLogGroup62996996", "monitoringtoLowercaseLogGroupC05CBA29", "stageTwoStepfunctionsOrchestratorRole1165D332", "stageTwoStepfunctionsOrchestratorRolePolicyAAB3B86F" ], "Metadata": { "aws:cdk:path": "amazon-s3-glacier-refreezer/stageTwo/Stepfunctions/StageTwoOrchestrator/Resource" } }, "inventoryNotification": { "Type": "AWS::SNS::Topic", "Properties": { "Tags": [ { "Key": "solution", "Value": "amazon-s3-glacier-refreezer" } ] }, "DependsOn": [ "monitoringCalculateMetricsDynamoDBEventSourceamazons3glacierrefreezerdynamoDataCatalogStatusTable7052596D0ABFB5EB", "monitoringCalculateMetrics1B70CF5B", "monitoringcalculateMetricsLogGroup9961A214", "monitoringCalculateMetricsRoleDefaultPolicy22C0E657", "monitoringCalculateMetricsRoleA76278A7", "monitoringCalculateMetricsRolePolicy0C1EF64D", "monitoringcalculateTreehashLogGroup6FC738B3", "monitoringcopyArchiveLogGroupBB702B1B", "monitoringcopyChunkLogGroup5D04918E", "monitoringdeployGlueJobScriptLogGroupAA50E4DE", "monitoringdownloadInventoryLogGroup2471C2FF", "monitoringdownloadInventoryPartLogGroupD9E69690", "monitoringgenerateUuidLogGroup18A074CF", "monitoringglacierrefreezerdashboardE7F6D8AE", "monitoringPostMetrics98F9F947", "monitoringPostMetricScheduleAllowEventRuleamazons3glacierrefreezermonitoringPostMetrics267F3B25BC9F085A", "monitoringPostMetricSchedule8675C968", "monitoringpostMetricsLogGroup670566A8", "monitoringPostMetricsRole87B61E7B", "monitoringPostMetricsRolePolicy596F9F4D", "monitoringrequestArchivesLogGroup70D7C9C5", "monitoringrequestInventoryLogGroupB7C9607D", "monitoringsendAnonymousStatsLogGroup0C9968BB", "monitoringstageTwoOrchestratorLogGroup62996996", "monitoringtoLowercaseLogGroupC05CBA29" ], "Metadata": { "cfn_nag": { "rules_to_suppress": [ { "id": "W47", "reason": "Non sensitive metadata - encryption is not required and cost inefficient" } ] } } }, "stageOneInventoryNotificationPolicy66D24C4B": { "Type": "AWS::SNS::TopicPolicy", "Properties": { "PolicyDocument": { "Statement": [ { "Action": [ "sns:GetTopicAttributes", "sns:SetTopicAttributes", "sns:AddPermission", "sns:RemovePermission", "sns:DeleteTopic", "sns:Subscribe", "sns:ListSubscriptionsByTopic", "sns:Publish" ], "Condition": { "Bool": { "aws:SecureTransport": false } }, "Effect": "Deny", "Principal": "*", "Resource": { "Ref": "inventoryNotification" }, "Sid": "denyInsecureTransport" }, { "Action": [ "sns:GetTopicAttributes", "sns:SetTopicAttributes", "sns:AddPermission", "sns:RemovePermission", "sns:DeleteTopic", "sns:Subscribe", "sns:ListSubscriptionsByTopic", "sns:Publish", "sns:Receive" ], "Condition": { "StringEquals": { "AWS:SourceOwner": { "Ref": "AWS::AccountId" } } }, "Effect": "Allow", "Principal": { "Service": "glacier.amazonaws.com" }, "Resource": { "Ref": "inventoryNotification" }, "Sid": "permitService" } ], "Version": "2012-10-17" }, "Topics": [ { "Ref": "inventoryNotification" } ] }, "DependsOn": [ "monitoringCalculateMetricsDynamoDBEventSourceamazons3glacierrefreezerdynamoDataCatalogStatusTable7052596D0ABFB5EB", "monitoringCalculateMetrics1B70CF5B", "monitoringcalculateMetricsLogGroup9961A214", "monitoringCalculateMetricsRoleDefaultPolicy22C0E657", "monitoringCalculateMetricsRoleA76278A7", "monitoringCalculateMetricsRolePolicy0C1EF64D", "monitoringcalculateTreehashLogGroup6FC738B3", "monitoringcopyArchiveLogGroupBB702B1B", "monitoringcopyChunkLogGroup5D04918E", "monitoringdeployGlueJobScriptLogGroupAA50E4DE", "monitoringdownloadInventoryLogGroup2471C2FF", "monitoringdownloadInventoryPartLogGroupD9E69690", "monitoringgenerateUuidLogGroup18A074CF", "monitoringglacierrefreezerdashboardE7F6D8AE", "monitoringPostMetrics98F9F947", "monitoringPostMetricScheduleAllowEventRuleamazons3glacierrefreezermonitoringPostMetrics267F3B25BC9F085A", "monitoringPostMetricSchedule8675C968", "monitoringpostMetricsLogGroup670566A8", "monitoringPostMetricsRole87B61E7B", "monitoringPostMetricsRolePolicy596F9F4D", "monitoringrequestArchivesLogGroup70D7C9C5", "monitoringrequestInventoryLogGroupB7C9607D", "monitoringsendAnonymousStatsLogGroup0C9968BB", "monitoringstageTwoOrchestratorLogGroup62996996", "monitoringtoLowercaseLogGroupC05CBA29" ], "Metadata": { "aws:cdk:path": "amazon-s3-glacier-refreezer/stageOne/InventoryNotification/Policy/Resource" } }, "stageOnerequestInventoryServiceRole5904E2D3": { "Type": "AWS::IAM::Role", "Properties": { "AssumeRolePolicyDocument": { "Statement": [ { "Action": "sts:AssumeRole", "Effect": "Allow", "Principal": { "Service": "lambda.amazonaws.com" } } ], "Version": "2012-10-17" }, "ManagedPolicyArns": [ { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":iam::aws:policy/service-role/AWSLambdaBasicExecutionRole" ] ] } ], "Tags": [ { "Key": "solution", "Value": "amazon-s3-glacier-refreezer" } ] }, "DependsOn": [ "monitoringCalculateMetricsDynamoDBEventSourceamazons3glacierrefreezerdynamoDataCatalogStatusTable7052596D0ABFB5EB", "monitoringCalculateMetrics1B70CF5B", "monitoringcalculateMetricsLogGroup9961A214", "monitoringCalculateMetricsRoleDefaultPolicy22C0E657", "monitoringCalculateMetricsRoleA76278A7", "monitoringCalculateMetricsRolePolicy0C1EF64D", "monitoringcalculateTreehashLogGroup6FC738B3", "monitoringcopyArchiveLogGroupBB702B1B", "monitoringcopyChunkLogGroup5D04918E", "monitoringdeployGlueJobScriptLogGroupAA50E4DE", "monitoringdownloadInventoryLogGroup2471C2FF", "monitoringdownloadInventoryPartLogGroupD9E69690", "monitoringgenerateUuidLogGroup18A074CF", "monitoringglacierrefreezerdashboardE7F6D8AE", "monitoringPostMetrics98F9F947", "monitoringPostMetricScheduleAllowEventRuleamazons3glacierrefreezermonitoringPostMetrics267F3B25BC9F085A", "monitoringPostMetricSchedule8675C968", "monitoringpostMetricsLogGroup670566A8", "monitoringPostMetricsRole87B61E7B", "monitoringPostMetricsRolePolicy596F9F4D", "monitoringrequestArchivesLogGroup70D7C9C5", "monitoringrequestInventoryLogGroupB7C9607D", "monitoringsendAnonymousStatsLogGroup0C9968BB", "monitoringstageTwoOrchestratorLogGroup62996996", "monitoringtoLowercaseLogGroupC05CBA29" ], "Metadata": { "aws:cdk:path": "amazon-s3-glacier-refreezer/stageOne/requestInventory/ServiceRole/Resource" } }, "stageOnerequestInventoryServiceRoleDefaultPolicyE7A49E61": { "Type": "AWS::IAM::Policy", "Properties": { "PolicyDocument": { "Statement": [ { "Action": [ "s3:GetObject*", "s3:GetBucket*", "s3:List*", "s3:DeleteObject*", "s3:PutObject*", "s3:Abort*" ], "Effect": "Allow", "Resource": [ { "Fn::GetAtt": [ "stagingBucket", "Arn" ] }, { "Fn::Join": [ "", [ { "Fn::GetAtt": [ "stagingBucket", "Arn" ] }, "/*" ] ] } ] }, { "Action": [ "s3:GetObject*", "s3:GetBucket*", "s3:List*", "s3:DeleteObject*", "s3:PutObject*", "s3:Abort*" ], "Effect": "Allow", "Resource": [ { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":s3:::", { "Ref": "DestinationBucket" } ] ] }, { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":s3:::", { "Ref": "DestinationBucket" }, "/*" ] ] } ] }, { "Action": [ "s3:ListBucket", "s3:ListBucketMultipartUploads", "s3:GetBucketLocation", "s3:GetObject", "s3:GetObjectAcl" ], "Condition": { "Bool": { "aws:SecureTransport": true } }, "Effect": "Allow", "Resource": { "Fn::Join": [ "", [ "arn:aws-cn:s3:::", { "Ref": "FilelistS3Location" } ] ] }, "Sid": "allowS3Access" }, { "Action": [ "glacier:GetJobOutput", "glacier:InitiateJob" ], "Condition": { "Bool": { "aws:SecureTransport": true } }, "Effect": "Allow", "Resource": { "Fn::Join": [ "", [ "arn:aws-cn:glacier:", { "Ref": "AWS::Region" }, ":", { "Ref": "AWS::AccountId" }, ":vaults/", { "Ref": "SourceVault" } ] ] }, "Sid": "allowGlacierAccess" } ], "Version": "2012-10-17" }, "PolicyName": "stageOnerequestInventoryServiceRoleDefaultPolicyE7A49E61", "Roles": [ { "Ref": "stageOnerequestInventoryServiceRole5904E2D3" } ] }, "DependsOn": [ "monitoringCalculateMetricsDynamoDBEventSourceamazons3glacierrefreezerdynamoDataCatalogStatusTable7052596D0ABFB5EB", "monitoringCalculateMetrics1B70CF5B", "monitoringcalculateMetricsLogGroup9961A214", "monitoringCalculateMetricsRoleDefaultPolicy22C0E657", "monitoringCalculateMetricsRoleA76278A7", "monitoringCalculateMetricsRolePolicy0C1EF64D", "monitoringcalculateTreehashLogGroup6FC738B3", "monitoringcopyArchiveLogGroupBB702B1B", "monitoringcopyChunkLogGroup5D04918E", "monitoringdeployGlueJobScriptLogGroupAA50E4DE", "monitoringdownloadInventoryLogGroup2471C2FF", "monitoringdownloadInventoryPartLogGroupD9E69690", "monitoringgenerateUuidLogGroup18A074CF", "monitoringglacierrefreezerdashboardE7F6D8AE", "monitoringPostMetrics98F9F947", "monitoringPostMetricScheduleAllowEventRuleamazons3glacierrefreezermonitoringPostMetrics267F3B25BC9F085A", "monitoringPostMetricSchedule8675C968", "monitoringpostMetricsLogGroup670566A8", "monitoringPostMetricsRole87B61E7B", "monitoringPostMetricsRolePolicy596F9F4D", "monitoringrequestArchivesLogGroup70D7C9C5", "monitoringrequestInventoryLogGroupB7C9607D", "monitoringsendAnonymousStatsLogGroup0C9968BB", "monitoringstageTwoOrchestratorLogGroup62996996", "monitoringtoLowercaseLogGroupC05CBA29" ], "Metadata": { "aws:cdk:path": "amazon-s3-glacier-refreezer/stageOne/requestInventory/ServiceRole/DefaultPolicy/Resource" } }, "stageOnerequestInventory8924DF79": { "Type": "AWS::Lambda::Function", "Properties": { "Code": { "S3Bucket": { "Fn::Sub": "solutions-${AWS::Region}" }, "S3Key": "amazon-s3-glacier-refreezer/v1.0.1/asset9065da64e66d37e976d8da2154a997851c3b02c81eda6d5cb8d2b7a80f63c80f.zip" }, "Role": { "Fn::GetAtt": [ "stageOnerequestInventoryServiceRole5904E2D3", "Arn" ] }, "Environment": { "Variables": { "SOURCE_VAULT": { "Ref": "SourceVault" }, "STAGING_BUCKET": { "Ref": "stagingBucket" }, "STAGING_LIST_PREFIX": "filelist", "FILELIST_LOCATION": { "Ref": "FilelistS3Location" }, "DESTINATION_BUCKET": { "Ref": "DestinationBucket" }, "SNS_TOPIC_ARN": { "Ref": "inventoryNotification" }, "CLOUDTRAIL_EXPORT_CONF": { "Ref": "CloudTrailExportConfirmation" }, "SNS_VAULT_CONF": { "Ref": "SNSTopicForVaultConfirmation" } } }, "FunctionName": { "Fn::Join": [ "", [ { "Ref": "AWS::StackName" }, "-requestInventory" ] ] }, "Handler": "index.handler", "MemorySize": 256, "Runtime": "nodejs12.x", "Tags": [ { "Key": "solution", "Value": "amazon-s3-glacier-refreezer" } ], "Timeout": 900 }, "DependsOn": [ "monitoringCalculateMetricsDynamoDBEventSourceamazons3glacierrefreezerdynamoDataCatalogStatusTable7052596D0ABFB5EB", "monitoringCalculateMetrics1B70CF5B", "monitoringcalculateMetricsLogGroup9961A214", "monitoringCalculateMetricsRoleDefaultPolicy22C0E657", "monitoringCalculateMetricsRoleA76278A7", "monitoringCalculateMetricsRolePolicy0C1EF64D", "monitoringcalculateTreehashLogGroup6FC738B3", "monitoringcopyArchiveLogGroupBB702B1B", "monitoringcopyChunkLogGroup5D04918E", "monitoringdeployGlueJobScriptLogGroupAA50E4DE", "monitoringdownloadInventoryLogGroup2471C2FF", "monitoringdownloadInventoryPartLogGroupD9E69690", "monitoringgenerateUuidLogGroup18A074CF", "monitoringglacierrefreezerdashboardE7F6D8AE", "monitoringPostMetrics98F9F947", "monitoringPostMetricScheduleAllowEventRuleamazons3glacierrefreezermonitoringPostMetrics267F3B25BC9F085A", "monitoringPostMetricSchedule8675C968", "monitoringpostMetricsLogGroup670566A8", "monitoringPostMetricsRole87B61E7B", "monitoringPostMetricsRolePolicy596F9F4D", "monitoringrequestArchivesLogGroup70D7C9C5", "monitoringrequestInventoryLogGroupB7C9607D", "monitoringsendAnonymousStatsLogGroup0C9968BB", "monitoringstageTwoOrchestratorLogGroup62996996", "monitoringtoLowercaseLogGroupC05CBA29", "stageOnerequestInventoryServiceRoleDefaultPolicyE7A49E61", "stageOnerequestInventoryServiceRole5904E2D3" ], "Metadata": { "cfn_nag": { "rules_to_suppress": [ { "id": "W58", "reason": "cfn nag is unable to reason about CDK generated cloudwatch log permissions" }, { "id": "W89", "reason": "This is a fully serverless solution - no VPC is required" }, { "id": "W92", "reason": "Reserved Concurrency is set on high priority functions only by design" } ] } } }, "stageOnerequestInventoryTriggerB9B55962": { "Type": "AWS::CloudFormation::CustomResource", "Properties": { "ServiceToken": { "Fn::GetAtt": [ "stageOnerequestInventory8924DF79", "Arn" ] } }, "DependsOn": [ "monitoringCalculateMetricsDynamoDBEventSourceamazons3glacierrefreezerdynamoDataCatalogStatusTable7052596D0ABFB5EB", "monitoringCalculateMetrics1B70CF5B", "monitoringcalculateMetricsLogGroup9961A214", "monitoringCalculateMetricsRoleDefaultPolicy22C0E657", "monitoringCalculateMetricsRoleA76278A7", "monitoringCalculateMetricsRolePolicy0C1EF64D", "monitoringcalculateTreehashLogGroup6FC738B3", "monitoringcopyArchiveLogGroupBB702B1B", "monitoringcopyChunkLogGroup5D04918E", "monitoringdeployGlueJobScriptLogGroupAA50E4DE", "monitoringdownloadInventoryLogGroup2471C2FF", "monitoringdownloadInventoryPartLogGroupD9E69690", "monitoringgenerateUuidLogGroup18A074CF", "monitoringglacierrefreezerdashboardE7F6D8AE", "monitoringPostMetrics98F9F947", "monitoringPostMetricScheduleAllowEventRuleamazons3glacierrefreezermonitoringPostMetrics267F3B25BC9F085A", "monitoringPostMetricSchedule8675C968", "monitoringpostMetricsLogGroup670566A8", "monitoringPostMetricsRole87B61E7B", "monitoringPostMetricsRolePolicy596F9F4D", "monitoringrequestArchivesLogGroup70D7C9C5", "monitoringrequestInventoryLogGroupB7C9607D", "monitoringsendAnonymousStatsLogGroup0C9968BB", "monitoringstageTwoOrchestratorLogGroup62996996", "monitoringtoLowercaseLogGroupC05CBA29" ], "UpdateReplacePolicy": "Delete", "DeletionPolicy": "Delete", "Metadata": { "aws:cdk:path": "amazon-s3-glacier-refreezer/stageOne/requestInventoryTrigger/Default" } }, "stageOnedownloadInventoryPartServiceRole73BC3A9B": { "Type": "AWS::IAM::Role", "Properties": { "AssumeRolePolicyDocument": { "Statement": [ { "Action": "sts:AssumeRole", "Effect": "Allow", "Principal": { "Service": "lambda.amazonaws.com" } } ], "Version": "2012-10-17" }, "ManagedPolicyArns": [ { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":iam::aws:policy/service-role/AWSLambdaBasicExecutionRole" ] ] } ], "Tags": [ { "Key": "solution", "Value": "amazon-s3-glacier-refreezer" } ] }, "DependsOn": [ "monitoringCalculateMetricsDynamoDBEventSourceamazons3glacierrefreezerdynamoDataCatalogStatusTable7052596D0ABFB5EB", "monitoringCalculateMetrics1B70CF5B", "monitoringcalculateMetricsLogGroup9961A214", "monitoringCalculateMetricsRoleDefaultPolicy22C0E657", "monitoringCalculateMetricsRoleA76278A7", "monitoringCalculateMetricsRolePolicy0C1EF64D", "monitoringcalculateTreehashLogGroup6FC738B3", "monitoringcopyArchiveLogGroupBB702B1B", "monitoringcopyChunkLogGroup5D04918E", "monitoringdeployGlueJobScriptLogGroupAA50E4DE", "monitoringdownloadInventoryLogGroup2471C2FF", "monitoringdownloadInventoryPartLogGroupD9E69690", "monitoringgenerateUuidLogGroup18A074CF", "monitoringglacierrefreezerdashboardE7F6D8AE", "monitoringPostMetrics98F9F947", "monitoringPostMetricScheduleAllowEventRuleamazons3glacierrefreezermonitoringPostMetrics267F3B25BC9F085A", "monitoringPostMetricSchedule8675C968", "monitoringpostMetricsLogGroup670566A8", "monitoringPostMetricsRole87B61E7B", "monitoringPostMetricsRolePolicy596F9F4D", "monitoringrequestArchivesLogGroup70D7C9C5", "monitoringrequestInventoryLogGroupB7C9607D", "monitoringsendAnonymousStatsLogGroup0C9968BB", "monitoringstageTwoOrchestratorLogGroup62996996", "monitoringtoLowercaseLogGroupC05CBA29" ], "Metadata": { "aws:cdk:path": "amazon-s3-glacier-refreezer/stageOne/downloadInventoryPart/ServiceRole/Resource" } }, "stageOnedownloadInventoryPartServiceRoleDefaultPolicy59CA83BD": { "Type": "AWS::IAM::Policy", "Properties": { "PolicyDocument": { "Statement": [ { "Action": [ "s3:GetObject*", "s3:GetBucket*", "s3:List*", "s3:DeleteObject*", "s3:PutObject*", "s3:Abort*" ], "Effect": "Allow", "Resource": [ { "Fn::GetAtt": [ "stagingBucket", "Arn" ] }, { "Fn::Join": [ "", [ { "Fn::GetAtt": [ "stagingBucket", "Arn" ] }, "/*" ] ] } ] }, { "Action": [ "glacier:GetJobOutput", "glacier:InitiateJob" ], "Condition": { "Bool": { "aws:SecureTransport": true } }, "Effect": "Allow", "Resource": { "Fn::Join": [ "", [ "arn:aws-cn:glacier:", { "Ref": "AWS::Region" }, ":", { "Ref": "AWS::AccountId" }, ":vaults/", { "Ref": "SourceVault" } ] ] }, "Sid": "allowGlacierAccess" } ], "Version": "2012-10-17" }, "PolicyName": "stageOnedownloadInventoryPartServiceRoleDefaultPolicy59CA83BD", "Roles": [ { "Ref": "stageOnedownloadInventoryPartServiceRole73BC3A9B" } ] }, "DependsOn": [ "monitoringCalculateMetricsDynamoDBEventSourceamazons3glacierrefreezerdynamoDataCatalogStatusTable7052596D0ABFB5EB", "monitoringCalculateMetrics1B70CF5B", "monitoringcalculateMetricsLogGroup9961A214", "monitoringCalculateMetricsRoleDefaultPolicy22C0E657", "monitoringCalculateMetricsRoleA76278A7", "monitoringCalculateMetricsRolePolicy0C1EF64D", "monitoringcalculateTreehashLogGroup6FC738B3", "monitoringcopyArchiveLogGroupBB702B1B", "monitoringcopyChunkLogGroup5D04918E", "monitoringdeployGlueJobScriptLogGroupAA50E4DE", "monitoringdownloadInventoryLogGroup2471C2FF", "monitoringdownloadInventoryPartLogGroupD9E69690", "monitoringgenerateUuidLogGroup18A074CF", "monitoringglacierrefreezerdashboardE7F6D8AE", "monitoringPostMetrics98F9F947", "monitoringPostMetricScheduleAllowEventRuleamazons3glacierrefreezermonitoringPostMetrics267F3B25BC9F085A", "monitoringPostMetricSchedule8675C968", "monitoringpostMetricsLogGroup670566A8", "monitoringPostMetricsRole87B61E7B", "monitoringPostMetricsRolePolicy596F9F4D", "monitoringrequestArchivesLogGroup70D7C9C5", "monitoringrequestInventoryLogGroupB7C9607D", "monitoringsendAnonymousStatsLogGroup0C9968BB", "monitoringstageTwoOrchestratorLogGroup62996996", "monitoringtoLowercaseLogGroupC05CBA29" ], "Metadata": { "aws:cdk:path": "amazon-s3-glacier-refreezer/stageOne/downloadInventoryPart/ServiceRole/DefaultPolicy/Resource" } }, "stageOnedownloadInventoryPartC8387F3A": { "Type": "AWS::Lambda::Function", "Properties": { "Code": { "S3Bucket": { "Fn::Sub": "solutions-${AWS::Region}" }, "S3Key": "amazon-s3-glacier-refreezer/v1.0.1/asset3543f21b4803b9fc8f85ac70eaa3c7a2e5c4c14226aae2781e59b4a9c9027134.zip" }, "Role": { "Fn::GetAtt": [ "stageOnedownloadInventoryPartServiceRole73BC3A9B", "Arn" ] }, "FunctionName": { "Fn::Join": [ "", [ { "Ref": "AWS::StackName" }, "-downloadInventoryPart" ] ] }, "Handler": "index.handler", "MemorySize": 1024, "Runtime": "nodejs12.x", "Tags": [ { "Key": "solution", "Value": "amazon-s3-glacier-refreezer" } ], "Timeout": 900 }, "DependsOn": [ "monitoringCalculateMetricsDynamoDBEventSourceamazons3glacierrefreezerdynamoDataCatalogStatusTable7052596D0ABFB5EB", "monitoringCalculateMetrics1B70CF5B", "monitoringcalculateMetricsLogGroup9961A214", "monitoringCalculateMetricsRoleDefaultPolicy22C0E657", "monitoringCalculateMetricsRoleA76278A7", "monitoringCalculateMetricsRolePolicy0C1EF64D", "monitoringcalculateTreehashLogGroup6FC738B3", "monitoringcopyArchiveLogGroupBB702B1B", "monitoringcopyChunkLogGroup5D04918E", "monitoringdeployGlueJobScriptLogGroupAA50E4DE", "monitoringdownloadInventoryLogGroup2471C2FF", "monitoringdownloadInventoryPartLogGroupD9E69690", "monitoringgenerateUuidLogGroup18A074CF", "monitoringglacierrefreezerdashboardE7F6D8AE", "monitoringPostMetrics98F9F947", "monitoringPostMetricScheduleAllowEventRuleamazons3glacierrefreezermonitoringPostMetrics267F3B25BC9F085A", "monitoringPostMetricSchedule8675C968", "monitoringpostMetricsLogGroup670566A8", "monitoringPostMetricsRole87B61E7B", "monitoringPostMetricsRolePolicy596F9F4D", "monitoringrequestArchivesLogGroup70D7C9C5", "monitoringrequestInventoryLogGroupB7C9607D", "monitoringsendAnonymousStatsLogGroup0C9968BB", "monitoringstageTwoOrchestratorLogGroup62996996", "monitoringtoLowercaseLogGroupC05CBA29", "stageOnedownloadInventoryPartServiceRoleDefaultPolicy59CA83BD", "stageOnedownloadInventoryPartServiceRole73BC3A9B" ], "Metadata": { "cfn_nag": { "rules_to_suppress": [ { "id": "W58", "reason": "cfn nag is unable to reason about CDK generated cloudwatch log permissions" }, { "id": "W89", "reason": "This is a fully serverless solution - no VPC is required" }, { "id": "W92", "reason": "Reserved Concurrency is set on high priority functions only by design" } ] } } }, "stageOnedownloadInventoryServiceRole411212F6": { "Type": "AWS::IAM::Role", "Properties": { "AssumeRolePolicyDocument": { "Statement": [ { "Action": "sts:AssumeRole", "Effect": "Allow", "Principal": { "Service": "lambda.amazonaws.com" } } ], "Version": "2012-10-17" }, "ManagedPolicyArns": [ { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":iam::aws:policy/service-role/AWSLambdaBasicExecutionRole" ] ] } ], "Tags": [ { "Key": "solution", "Value": "amazon-s3-glacier-refreezer" } ] }, "DependsOn": [ "monitoringCalculateMetricsDynamoDBEventSourceamazons3glacierrefreezerdynamoDataCatalogStatusTable7052596D0ABFB5EB", "monitoringCalculateMetrics1B70CF5B", "monitoringcalculateMetricsLogGroup9961A214", "monitoringCalculateMetricsRoleDefaultPolicy22C0E657", "monitoringCalculateMetricsRoleA76278A7", "monitoringCalculateMetricsRolePolicy0C1EF64D", "monitoringcalculateTreehashLogGroup6FC738B3", "monitoringcopyArchiveLogGroupBB702B1B", "monitoringcopyChunkLogGroup5D04918E", "monitoringdeployGlueJobScriptLogGroupAA50E4DE", "monitoringdownloadInventoryLogGroup2471C2FF", "monitoringdownloadInventoryPartLogGroupD9E69690", "monitoringgenerateUuidLogGroup18A074CF", "monitoringglacierrefreezerdashboardE7F6D8AE", "monitoringPostMetrics98F9F947", "monitoringPostMetricScheduleAllowEventRuleamazons3glacierrefreezermonitoringPostMetrics267F3B25BC9F085A", "monitoringPostMetricSchedule8675C968", "monitoringpostMetricsLogGroup670566A8", "monitoringPostMetricsRole87B61E7B", "monitoringPostMetricsRolePolicy596F9F4D", "monitoringrequestArchivesLogGroup70D7C9C5", "monitoringrequestInventoryLogGroupB7C9607D", "monitoringsendAnonymousStatsLogGroup0C9968BB", "monitoringstageTwoOrchestratorLogGroup62996996", "monitoringtoLowercaseLogGroupC05CBA29" ], "Metadata": { "aws:cdk:path": "amazon-s3-glacier-refreezer/stageOne/downloadInventory/ServiceRole/Resource" } }, "stageOnedownloadInventoryServiceRoleDefaultPolicy8C7F6A4F": { "Type": "AWS::IAM::Policy", "Properties": { "PolicyDocument": { "Statement": [ { "Action": [ "s3:GetObject*", "s3:GetBucket*", "s3:List*", "s3:DeleteObject*", "s3:PutObject*", "s3:Abort*" ], "Effect": "Allow", "Resource": [ { "Fn::GetAtt": [ "stagingBucket", "Arn" ] }, { "Fn::Join": [ "", [ { "Fn::GetAtt": [ "stagingBucket", "Arn" ] }, "/*" ] ] } ] }, { "Action": [ "glacier:GetJobOutput", "glacier:InitiateJob" ], "Condition": { "Bool": { "aws:SecureTransport": true } }, "Effect": "Allow", "Resource": { "Fn::Join": [ "", [ "arn:aws-cn:glacier:", { "Ref": "AWS::Region" }, ":", { "Ref": "AWS::AccountId" }, ":vaults/", { "Ref": "SourceVault" } ] ] }, "Sid": "allowGlacierAccess" }, { "Action": "lambda:InvokeFunction", "Effect": "Allow", "Resource": { "Fn::GetAtt": [ "stageOnedownloadInventoryPartC8387F3A", "Arn" ] } }, { "Action": "states:StartExecution", "Effect": "Allow", "Resource": { "Ref": "stageTwoOrchestrator" } } ], "Version": "2012-10-17" }, "PolicyName": "stageOnedownloadInventoryServiceRoleDefaultPolicy8C7F6A4F", "Roles": [ { "Ref": "stageOnedownloadInventoryServiceRole411212F6" } ] }, "DependsOn": [ "monitoringCalculateMetricsDynamoDBEventSourceamazons3glacierrefreezerdynamoDataCatalogStatusTable7052596D0ABFB5EB", "monitoringCalculateMetrics1B70CF5B", "monitoringcalculateMetricsLogGroup9961A214", "monitoringCalculateMetricsRoleDefaultPolicy22C0E657", "monitoringCalculateMetricsRoleA76278A7", "monitoringCalculateMetricsRolePolicy0C1EF64D", "monitoringcalculateTreehashLogGroup6FC738B3", "monitoringcopyArchiveLogGroupBB702B1B", "monitoringcopyChunkLogGroup5D04918E", "monitoringdeployGlueJobScriptLogGroupAA50E4DE", "monitoringdownloadInventoryLogGroup2471C2FF", "monitoringdownloadInventoryPartLogGroupD9E69690", "monitoringgenerateUuidLogGroup18A074CF", "monitoringglacierrefreezerdashboardE7F6D8AE", "monitoringPostMetrics98F9F947", "monitoringPostMetricScheduleAllowEventRuleamazons3glacierrefreezermonitoringPostMetrics267F3B25BC9F085A", "monitoringPostMetricSchedule8675C968", "monitoringpostMetricsLogGroup670566A8", "monitoringPostMetricsRole87B61E7B", "monitoringPostMetricsRolePolicy596F9F4D", "monitoringrequestArchivesLogGroup70D7C9C5", "monitoringrequestInventoryLogGroupB7C9607D", "monitoringsendAnonymousStatsLogGroup0C9968BB", "monitoringstageTwoOrchestratorLogGroup62996996", "monitoringtoLowercaseLogGroupC05CBA29" ], "Metadata": { "aws:cdk:path": "amazon-s3-glacier-refreezer/stageOne/downloadInventory/ServiceRole/DefaultPolicy/Resource" } }, "stageOnedownloadInventory7367D822": { "Type": "AWS::Lambda::Function", "Properties": { "Code": { "S3Bucket": { "Fn::Sub": "solutions-${AWS::Region}" }, "S3Key": "amazon-s3-glacier-refreezer/v1.0.1/asset217171a39f741cb7857226b93252ebd11c7371216a599c3703557997c246ad79.zip" }, "Role": { "Fn::GetAtt": [ "stageOnedownloadInventoryServiceRole411212F6", "Arn" ] }, "Environment": { "Variables": { "INVENTORY_BUCKET": { "Ref": "stagingBucket" }, "BUCKET_PREFIX": "inventory", "GLACIER_VAULT": { "Ref": "SourceVault" }, "STAGE_TWO_SF_ARN": { "Ref": "stageTwoOrchestrator" }, "INVENTORY_PART_FUNCTION": { "Ref": "stageOnedownloadInventoryPartC8387F3A" } } }, "FunctionName": { "Fn::Join": [ "", [ { "Ref": "AWS::StackName" }, "-downloadInventory" ] ] }, "Handler": "index.handler", "MemorySize": 1024, "Runtime": "nodejs12.x", "Tags": [ { "Key": "solution", "Value": "amazon-s3-glacier-refreezer" } ], "Timeout": 900 }, "DependsOn": [ "monitoringCalculateMetricsDynamoDBEventSourceamazons3glacierrefreezerdynamoDataCatalogStatusTable7052596D0ABFB5EB", "monitoringCalculateMetrics1B70CF5B", "monitoringcalculateMetricsLogGroup9961A214", "monitoringCalculateMetricsRoleDefaultPolicy22C0E657", "monitoringCalculateMetricsRoleA76278A7", "monitoringCalculateMetricsRolePolicy0C1EF64D", "monitoringcalculateTreehashLogGroup6FC738B3", "monitoringcopyArchiveLogGroupBB702B1B", "monitoringcopyChunkLogGroup5D04918E", "monitoringdeployGlueJobScriptLogGroupAA50E4DE", "monitoringdownloadInventoryLogGroup2471C2FF", "monitoringdownloadInventoryPartLogGroupD9E69690", "monitoringgenerateUuidLogGroup18A074CF", "monitoringglacierrefreezerdashboardE7F6D8AE", "monitoringPostMetrics98F9F947", "monitoringPostMetricScheduleAllowEventRuleamazons3glacierrefreezermonitoringPostMetrics267F3B25BC9F085A", "monitoringPostMetricSchedule8675C968", "monitoringpostMetricsLogGroup670566A8", "monitoringPostMetricsRole87B61E7B", "monitoringPostMetricsRolePolicy596F9F4D", "monitoringrequestArchivesLogGroup70D7C9C5", "monitoringrequestInventoryLogGroupB7C9607D", "monitoringsendAnonymousStatsLogGroup0C9968BB", "monitoringstageTwoOrchestratorLogGroup62996996", "monitoringtoLowercaseLogGroupC05CBA29", "stageOnedownloadInventoryServiceRoleDefaultPolicy8C7F6A4F", "stageOnedownloadInventoryServiceRole411212F6" ], "Metadata": { "cfn_nag": { "rules_to_suppress": [ { "id": "W58", "reason": "cfn nag is unable to reason about CDK generated cloudwatch log permissions" }, { "id": "W89", "reason": "This is a fully serverless solution - no VPC is required" }, { "id": "W92", "reason": "Reserved Concurrency is set on high priority functions only by design" } ] } } }, "stageOnedownloadInventoryAllowInvokeamazons3glacierrefreezerstageOneInventoryNotificationD1444801FA8E86D3": { "Type": "AWS::Lambda::Permission", "Properties": { "Action": "lambda:InvokeFunction", "FunctionName": { "Fn::GetAtt": [ "stageOnedownloadInventory7367D822", "Arn" ] }, "Principal": "sns.amazonaws.com", "SourceArn": { "Ref": "inventoryNotification" } }, "DependsOn": [ "monitoringCalculateMetricsDynamoDBEventSourceamazons3glacierrefreezerdynamoDataCatalogStatusTable7052596D0ABFB5EB", "monitoringCalculateMetrics1B70CF5B", "monitoringcalculateMetricsLogGroup9961A214", "monitoringCalculateMetricsRoleDefaultPolicy22C0E657", "monitoringCalculateMetricsRoleA76278A7", "monitoringCalculateMetricsRolePolicy0C1EF64D", "monitoringcalculateTreehashLogGroup6FC738B3", "monitoringcopyArchiveLogGroupBB702B1B", "monitoringcopyChunkLogGroup5D04918E", "monitoringdeployGlueJobScriptLogGroupAA50E4DE", "monitoringdownloadInventoryLogGroup2471C2FF", "monitoringdownloadInventoryPartLogGroupD9E69690", "monitoringgenerateUuidLogGroup18A074CF", "monitoringglacierrefreezerdashboardE7F6D8AE", "monitoringPostMetrics98F9F947", "monitoringPostMetricScheduleAllowEventRuleamazons3glacierrefreezermonitoringPostMetrics267F3B25BC9F085A", "monitoringPostMetricSchedule8675C968", "monitoringpostMetricsLogGroup670566A8", "monitoringPostMetricsRole87B61E7B", "monitoringPostMetricsRolePolicy596F9F4D", "monitoringrequestArchivesLogGroup70D7C9C5", "monitoringrequestInventoryLogGroupB7C9607D", "monitoringsendAnonymousStatsLogGroup0C9968BB", "monitoringstageTwoOrchestratorLogGroup62996996", "monitoringtoLowercaseLogGroupC05CBA29" ], "Metadata": { "aws:cdk:path": "amazon-s3-glacier-refreezer/stageOne/downloadInventory/AllowInvoke:amazons3glacierrefreezerstageOneInventoryNotificationD1444801" } }, "stageOnedownloadInventoryInventoryNotification72A472C2": { "Type": "AWS::SNS::Subscription", "Properties": { "Protocol": "lambda", "TopicArn": { "Ref": "inventoryNotification" }, "Endpoint": { "Fn::GetAtt": [ "stageOnedownloadInventory7367D822", "Arn" ] } }, "DependsOn": [ "monitoringCalculateMetricsDynamoDBEventSourceamazons3glacierrefreezerdynamoDataCatalogStatusTable7052596D0ABFB5EB", "monitoringCalculateMetrics1B70CF5B", "monitoringcalculateMetricsLogGroup9961A214", "monitoringCalculateMetricsRoleDefaultPolicy22C0E657", "monitoringCalculateMetricsRoleA76278A7", "monitoringCalculateMetricsRolePolicy0C1EF64D", "monitoringcalculateTreehashLogGroup6FC738B3", "monitoringcopyArchiveLogGroupBB702B1B", "monitoringcopyChunkLogGroup5D04918E", "monitoringdeployGlueJobScriptLogGroupAA50E4DE", "monitoringdownloadInventoryLogGroup2471C2FF", "monitoringdownloadInventoryPartLogGroupD9E69690", "monitoringgenerateUuidLogGroup18A074CF", "monitoringglacierrefreezerdashboardE7F6D8AE", "monitoringPostMetrics98F9F947", "monitoringPostMetricScheduleAllowEventRuleamazons3glacierrefreezermonitoringPostMetrics267F3B25BC9F085A", "monitoringPostMetricSchedule8675C968", "monitoringpostMetricsLogGroup670566A8", "monitoringPostMetricsRole87B61E7B", "monitoringPostMetricsRolePolicy596F9F4D", "monitoringrequestArchivesLogGroup70D7C9C5", "monitoringrequestInventoryLogGroupB7C9607D", "monitoringsendAnonymousStatsLogGroup0C9968BB", "monitoringstageTwoOrchestratorLogGroup62996996", "monitoringtoLowercaseLogGroupC05CBA29" ], "Metadata": { "aws:cdk:path": "amazon-s3-glacier-refreezer/stageOne/downloadInventory/InventoryNotification/Resource" } }, "stageFourcalculateTreehashServiceRoleC753ABC4": { "Type": "AWS::IAM::Role", "Properties": { "AssumeRolePolicyDocument": { "Statement": [ { "Action": "sts:AssumeRole", "Effect": "Allow", "Principal": { "Service": "lambda.amazonaws.com" } } ], "Version": "2012-10-17" }, "ManagedPolicyArns": [ { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":iam::aws:policy/service-role/AWSLambdaBasicExecutionRole" ] ] } ], "Tags": [ { "Key": "solution", "Value": "amazon-s3-glacier-refreezer" } ] }, "Metadata": { "aws:cdk:path": "amazon-s3-glacier-refreezer/stageFour/calculateTreehash/ServiceRole/Resource" } }, "stageFourcalculateTreehashServiceRoleDefaultPolicyBF15D3E2": { "Type": "AWS::IAM::Policy", "Properties": { "PolicyDocument": { "Statement": [ { "Action": [ "s3:GetObject*", "s3:GetBucket*", "s3:List*", "s3:DeleteObject*", "s3:PutObject*", "s3:Abort*" ], "Effect": "Allow", "Resource": [ { "Fn::GetAtt": [ "stagingBucket", "Arn" ] }, { "Fn::Join": [ "", [ { "Fn::GetAtt": [ "stagingBucket", "Arn" ] }, "/*" ] ] } ] }, { "Action": [ "dynamodb:BatchGetItem", "dynamodb:GetRecords", "dynamodb:GetShardIterator", "dynamodb:Query", "dynamodb:GetItem", "dynamodb:Scan", "dynamodb:ConditionCheckItem", "dynamodb:BatchWriteItem", "dynamodb:PutItem", "dynamodb:UpdateItem", "dynamodb:DeleteItem" ], "Effect": "Allow", "Resource": [ { "Fn::GetAtt": [ "dynamoDataCatalogStatusTableE9ACB88F", "Arn" ] }, { "Fn::Join": [ "", [ { "Fn::GetAtt": [ "dynamoDataCatalogStatusTableE9ACB88F", "Arn" ] }, "/index/*" ] ] } ] }, { "Action": [ "s3:GetObject*", "s3:GetBucket*", "s3:List*", "s3:DeleteObject*", "s3:PutObject*", "s3:Abort*" ], "Effect": "Allow", "Resource": [ { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":s3:::", { "Ref": "DestinationBucket" } ] ] }, { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":s3:::", { "Ref": "DestinationBucket" }, "/*" ] ] } ] }, { "Action": [ "sqs:ReceiveMessage", "sqs:ChangeMessageVisibility", "sqs:GetQueueUrl", "sqs:DeleteMessage", "sqs:GetQueueAttributes" ], "Effect": "Allow", "Resource": { "Fn::GetAtt": [ "stageThreetreehashcalcqueue77403987", "Arn" ] } } ], "Version": "2012-10-17" }, "PolicyName": "stageFourcalculateTreehashServiceRoleDefaultPolicyBF15D3E2", "Roles": [ { "Ref": "stageFourcalculateTreehashServiceRoleC753ABC4" } ] }, "Metadata": { "aws:cdk:path": "amazon-s3-glacier-refreezer/stageFour/calculateTreehash/ServiceRole/DefaultPolicy/Resource" } }, "stageFourcalculateTreehashC1E7BFB4": { "Type": "AWS::Lambda::Function", "Properties": { "Code": { "S3Bucket": { "Fn::Sub": "solutions-${AWS::Region}" }, "S3Key": "amazon-s3-glacier-refreezer/v1.0.1/asset17eec4c6eb1bea9838979d1d7d51cd7d4955292be5a8700b9939062ec7cd93fb.zip" }, "Role": { "Fn::GetAtt": [ "stageFourcalculateTreehashServiceRoleC753ABC4", "Arn" ] }, "Environment": { "Variables": { "DESTINATION_BUCKET": { "Ref": "DestinationBucket" }, "STORAGE_CLASS": { "Ref": "DestinationStorageClass" }, "STAGING_BUCKET": { "Ref": "stagingBucket" }, "STAGING_BUCKET_PREFIX": "stagingdata", "STATUS_TABLE": { "Ref": "dynamoDataCatalogStatusTableE9ACB88F" }, "SQS_ARCHIVE_NOTIFICATION": { "Fn::GetAtt": [ "stageThreearchivenotificationqueue402FED49", "QueueName" ] } } }, "FunctionName": { "Fn::Join": [ "", [ { "Ref": "AWS::StackName" }, "-calculateTreehash" ] ] }, "Handler": "index.handler", "MemorySize": 1024, "ReservedConcurrentExecutions": 50, "Runtime": "nodejs12.x", "Tags": [ { "Key": "solution", "Value": "amazon-s3-glacier-refreezer" } ], "Timeout": 900 }, "DependsOn": [ "stageFourcalculateTreehashServiceRoleDefaultPolicyBF15D3E2", "stageFourcalculateTreehashServiceRoleC753ABC4" ], "Metadata": { "cfn_nag": { "rules_to_suppress": [ { "id": "W58", "reason": "cfn nag is unable to reason about CDK generated cloudwatch log permissions" }, { "id": "W89", "reason": "This is a fully serverless solution - no VPC is required" }, { "id": "W92", "reason": "Reserved Concurrency is set on high priority functions only by design" } ] } } }, "stageFourcalculateTreehashSqsEventSourceamazons3glacierrefreezerstageThreetreehashcalcqueueCF0039B2AB054DB0": { "Type": "AWS::Lambda::EventSourceMapping", "Properties": { "FunctionName": { "Ref": "stageFourcalculateTreehashC1E7BFB4" }, "BatchSize": 1, "EventSourceArn": { "Fn::GetAtt": [ "stageThreetreehashcalcqueue77403987", "Arn" ] } }, "Metadata": { "aws:cdk:path": "amazon-s3-glacier-refreezer/stageFour/calculateTreehash/SqsEventSource:amazons3glacierrefreezerstageThreetreehashcalcqueueCF0039B2/Resource" } }, "CDKMetadata": { "Type": "AWS::CDK::Metadata", "Properties": { "Analytics": "v2:deflate64:H4sIAAAAAAAAA21TTW/bMAz9Lb0rarMC23VZ2gYdOiyzA/RMy6yj2pY8iUoXGP7vo6R8tejFeqSpR/KRmsv5zTd5c/Ud3vxM1e31qKxDOZYEqhXLF/MLhkGbJsI1OOiR0ImlNZ5cUCSWwZPtC/Q2OIUx6oRPYOE9EhM2B57fgYZAETFPrUlbM4mYf/S3cvwRVIvp7wHlY207rfZnd7Yn0UFf1SDHh2BUZIoRJ3y/Q0NlquKij8+9a3S99j4Vo6GXY2G73FA8z+mPiZsusE53QFCBT4EnvIEqXz2Bn7biFmmLBiSbz9a1K2fDIOq9gd7WlRzfX+LoYeBEEPuAQNYr6LhS1oczlGzEqAWR01UgFEfPBlyT1fvgycfG8ViZpsxs567eOSbhjeeK7KBVqiiB9D3fuDTLUHnl9HAcwKXNZLcziCvgZdoEgVF/5i/CQeAQ+1WdDfUbkNpGVf22suDqLOvB4GHbxkf9nmyT5fN/medPwJCIMkjfc50XJpdCOLwctsPPCHzL9xdpLrygjjjY7e//oQqplfxnhdnPCx068mLFk0/RPNUiGHGXZrgO9EjYi6e0kI9mZ1v8kFCO8Ql1HXZizYqIZ9AkHkB3Yrm1ml9KGZRCrAWzE++m2mqTGru0p2kSxtYoX/31bv5Fzr/K+dWr13rmgiHdoyzy+R/RWm9s2wMAAA==" }, "Metadata": { "aws:cdk:path": "amazon-s3-glacier-refreezer/CDKMetadata/Default" }, "Condition": "CDKMetadataAvailable" } }, "Outputs": { "CloudTrailExportConfirmationSelection": { "Description": "Selected option for CloudTrail Export confirmation", "Value": { "Ref": "CloudTrailExportConfirmation" } }, "SNSTopicForVaultConfirmationSelection": { "Description": "Selected option for SNS Topic for Vault confirmation", "Value": { "Ref": "SNSTopicForVaultConfirmation" } }, "StagingBucketName": { "Description": "Staging Bucket Name", "Value": { "Ref": "stagingBucket" } }, "dashboardUrl": { "Description": "Progress Dashboard URL", "Value": { "Fn::Join": [ "", [ "https://", { "Ref": "AWS::Region" }, ".console.aws.amazon.com/cloudwatch/home?region=", { "Ref": "AWS::Region" }, "#dashboards:name=", { "Ref": "AWS::StackName" }, "-Amazon-S3-Glacier-ReFreezer;accountId=", { "Ref": "AWS::AccountId" } ] ] } } }, "Conditions": { "CDKMetadataAvailable": { "Fn::Or": [ { "Fn::Or": [ { "Fn::Equals": [ { "Ref": "AWS::Region" }, "af-south-1" ] }, { "Fn::Equals": [ { "Ref": "AWS::Region" }, "ap-east-1" ] }, { "Fn::Equals": [ { "Ref": "AWS::Region" }, "ap-northeast-1" ] }, { "Fn::Equals": [ { "Ref": "AWS::Region" }, "ap-northeast-2" ] }, { "Fn::Equals": [ { "Ref": "AWS::Region" }, "ap-south-1" ] }, { "Fn::Equals": [ { "Ref": "AWS::Region" }, "ap-southeast-1" ] }, { "Fn::Equals": [ { "Ref": "AWS::Region" }, "ap-southeast-2" ] }, { "Fn::Equals": [ { "Ref": "AWS::Region" }, "ca-central-1" ] }, { "Fn::Equals": [ { "Ref": "AWS::Region" }, "cn-north-1" ] }, { "Fn::Equals": [ { "Ref": "AWS::Region" }, "cn-northwest-1" ] } ] }, { "Fn::Or": [ { "Fn::Equals": [ { "Ref": "AWS::Region" }, "eu-central-1" ] }, { "Fn::Equals": [ { "Ref": "AWS::Region" }, "eu-north-1" ] }, { "Fn::Equals": [ { "Ref": "AWS::Region" }, "eu-south-1" ] }, { "Fn::Equals": [ { "Ref": "AWS::Region" }, "eu-west-1" ] }, { "Fn::Equals": [ { "Ref": "AWS::Region" }, "eu-west-2" ] }, { "Fn::Equals": [ { "Ref": "AWS::Region" }, "eu-west-3" ] }, { "Fn::Equals": [ { "Ref": "AWS::Region" }, "me-south-1" ] }, { "Fn::Equals": [ { "Ref": "AWS::Region" }, "sa-east-1" ] }, { "Fn::Equals": [ { "Ref": "AWS::Region" }, "us-east-1" ] }, { "Fn::Equals": [ { "Ref": "AWS::Region" }, "us-east-2" ] } ] }, { "Fn::Or": [ { "Fn::Equals": [ { "Ref": "AWS::Region" }, "us-west-1" ] }, { "Fn::Equals": [ { "Ref": "AWS::Region" }, "us-west-2" ] } ] } ] } } }