{ "Description": "Integration Test for aws-cloudfront-s3", "Resources": { "cmkKey598B20B2": { "Type": "AWS::KMS::Key", "Properties": { "EnableKeyRotation": true, "KeyPolicy": { "Statement": [ { "Action": "kms:*", "Effect": "Allow", "Principal": { "AWS": { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":iam::", { "Ref": "AWS::AccountId" }, ":root" ] ] } }, "Resource": "*" } ], "Version": "2012-10-17" } }, "UpdateReplacePolicy": "Delete", "DeletionPolicy": "Delete" }, "testcloudfronts3cmkencryptionkeyS3LoggingBucket5CE52209": { "Type": "AWS::S3::Bucket", "Properties": { "BucketEncryption": { "ServerSideEncryptionConfiguration": [ { "ServerSideEncryptionByDefault": { "SSEAlgorithm": "AES256" } } ] }, "PublicAccessBlockConfiguration": { "BlockPublicAcls": true, "BlockPublicPolicy": true, "IgnorePublicAcls": true, "RestrictPublicBuckets": true }, "Tags": [ { "Key": "aws-cdk:auto-delete-objects", "Value": "true" } ], "VersioningConfiguration": { "Status": "Enabled" } }, "UpdateReplacePolicy": "Delete", "DeletionPolicy": "Delete", "Metadata": { "cfn_nag": { "rules_to_suppress": [ { "id": "W35", "reason": "This S3 bucket is used as the access logging bucket for another bucket" } ] } } }, "testcloudfronts3cmkencryptionkeyS3LoggingBucketPolicyF38CB6DD": { "Type": "AWS::S3::BucketPolicy", "Properties": { "Bucket": { "Ref": "testcloudfronts3cmkencryptionkeyS3LoggingBucket5CE52209" }, "PolicyDocument": { "Statement": [ { "Action": "s3:*", "Condition": { "Bool": { "aws:SecureTransport": "false" } }, "Effect": "Deny", "Principal": { "AWS": "*" }, "Resource": [ { "Fn::GetAtt": [ "testcloudfronts3cmkencryptionkeyS3LoggingBucket5CE52209", "Arn" ] }, { "Fn::Join": [ "", [ { "Fn::GetAtt": [ "testcloudfronts3cmkencryptionkeyS3LoggingBucket5CE52209", "Arn" ] }, "/*" ] ] } ] }, { "Action": [ "s3:DeleteObject*", "s3:GetBucket*", "s3:List*", "s3:PutBucketPolicy" ], "Effect": "Allow", "Principal": { "AWS": { "Fn::GetAtt": [ "CustomS3AutoDeleteObjectsCustomResourceProviderRole3B1BD092", "Arn" ] } }, "Resource": [ { "Fn::GetAtt": [ "testcloudfronts3cmkencryptionkeyS3LoggingBucket5CE52209", "Arn" ] }, { "Fn::Join": [ "", [ { "Fn::GetAtt": [ "testcloudfronts3cmkencryptionkeyS3LoggingBucket5CE52209", "Arn" ] }, "/*" ] ] } ] }, { "Action": "s3:PutObject", "Condition": { "ArnLike": { "aws:SourceArn": { "Fn::GetAtt": [ "testcloudfronts3cmkencryptionkeyS3Bucket0E74E5D2", "Arn" ] } }, "StringEquals": { "aws:SourceAccount": { "Ref": "AWS::AccountId" } } }, "Effect": "Allow", "Principal": { "Service": "logging.s3.amazonaws.com" }, "Resource": { "Fn::Join": [ "", [ { "Fn::GetAtt": [ "testcloudfronts3cmkencryptionkeyS3LoggingBucket5CE52209", "Arn" ] }, "/*" ] ] } } ], "Version": "2012-10-17" } } }, "testcloudfronts3cmkencryptionkeyS3LoggingBucketAutoDeleteObjectsCustomResource69EF1373": { "Type": "Custom::S3AutoDeleteObjects", "Properties": { "ServiceToken": { "Fn::GetAtt": [ "CustomS3AutoDeleteObjectsCustomResourceProviderHandler9D90184F", "Arn" ] }, "BucketName": { "Ref": "testcloudfronts3cmkencryptionkeyS3LoggingBucket5CE52209" } }, "DependsOn": [ "testcloudfronts3cmkencryptionkeyS3LoggingBucketPolicyF38CB6DD" ], "UpdateReplacePolicy": "Delete", "DeletionPolicy": "Delete" }, "testcloudfronts3cmkencryptionkeyS3Bucket0E74E5D2": { "Type": "AWS::S3::Bucket", "Properties": { "BucketEncryption": { "ServerSideEncryptionConfiguration": [ { "ServerSideEncryptionByDefault": { "KMSMasterKeyID": { "Fn::GetAtt": [ "cmkKey598B20B2", "Arn" ] }, "SSEAlgorithm": "aws:kms" } } ] }, "LifecycleConfiguration": { "Rules": [ { "NoncurrentVersionTransitions": [ { "StorageClass": "GLACIER", "TransitionInDays": 90 } ], "Status": "Enabled" } ] }, "LoggingConfiguration": { "DestinationBucketName": { "Ref": "testcloudfronts3cmkencryptionkeyS3LoggingBucket5CE52209" } }, "PublicAccessBlockConfiguration": { "BlockPublicAcls": true, "BlockPublicPolicy": true, "IgnorePublicAcls": true, "RestrictPublicBuckets": true }, "VersioningConfiguration": { "Status": "Enabled" } }, "UpdateReplacePolicy": "Retain", "DeletionPolicy": "Retain" }, "testcloudfronts3cmkencryptionkeyS3BucketPolicy5DF57B01": { "Type": "AWS::S3::BucketPolicy", "Properties": { "Bucket": { "Ref": "testcloudfronts3cmkencryptionkeyS3Bucket0E74E5D2" }, "PolicyDocument": { "Statement": [ { "Action": "s3:*", "Condition": { "Bool": { "aws:SecureTransport": "false" } }, "Effect": "Deny", "Principal": { "AWS": "*" }, "Resource": [ { "Fn::GetAtt": [ "testcloudfronts3cmkencryptionkeyS3Bucket0E74E5D2", "Arn" ] }, { "Fn::Join": [ "", [ { "Fn::GetAtt": [ "testcloudfronts3cmkencryptionkeyS3Bucket0E74E5D2", "Arn" ] }, "/*" ] ] } ] }, { "Action": "s3:GetObject", "Condition": { "StringEquals": { "AWS:SourceArn": { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":cloudfront::", { "Ref": "AWS::AccountId" }, ":distribution/", { "Ref": "testcloudfronts3cmkencryptionkeyCloudFrontDistribution57C8A907" } ] ] } } }, "Effect": "Allow", "Principal": { "Service": "cloudfront.amazonaws.com" }, "Resource": { "Fn::Join": [ "", [ { "Fn::GetAtt": [ "testcloudfronts3cmkencryptionkeyS3Bucket0E74E5D2", "Arn" ] }, "/*" ] ] } }, { "Action": "s3:ListBucket", "Condition": { "StringEquals": { "AWS:SourceArn": { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":cloudfront::", { "Ref": "AWS::AccountId" }, ":distribution/", { "Ref": "testcloudfronts3cmkencryptionkeyCloudFrontDistribution57C8A907" } ] ] } } }, "Effect": "Allow", "Principal": { "Service": "cloudfront.amazonaws.com" }, "Resource": { "Fn::GetAtt": [ "testcloudfronts3cmkencryptionkeyS3Bucket0E74E5D2", "Arn" ] } } ], "Version": "2012-10-17" } }, "Metadata": { "cfn_nag": { "rules_to_suppress": [ { "id": "F16", "reason": "Public website bucket policy requires a wildcard principal" } ] } } }, "testcloudfronts3cmkencryptionkeyCloudfrontLoggingBucketAccessLog8863921C": { "Type": "AWS::S3::Bucket", "Properties": { "BucketEncryption": { "ServerSideEncryptionConfiguration": [ { "ServerSideEncryptionByDefault": { "SSEAlgorithm": "AES256" } } ] }, "PublicAccessBlockConfiguration": { "BlockPublicAcls": true, "BlockPublicPolicy": true, "IgnorePublicAcls": true, "RestrictPublicBuckets": true }, "Tags": [ { "Key": "aws-cdk:auto-delete-objects", "Value": "true" } ], "VersioningConfiguration": { "Status": "Enabled" } }, "UpdateReplacePolicy": "Delete", "DeletionPolicy": "Delete", "Metadata": { "cfn_nag": { "rules_to_suppress": [ { "id": "W35", "reason": "This S3 bucket is used as the access logging bucket for another bucket" } ] } } }, "testcloudfronts3cmkencryptionkeyCloudfrontLoggingBucketAccessLogPolicy8F931BD7": { "Type": "AWS::S3::BucketPolicy", "Properties": { "Bucket": { "Ref": "testcloudfronts3cmkencryptionkeyCloudfrontLoggingBucketAccessLog8863921C" }, "PolicyDocument": { "Statement": [ { "Action": "s3:*", "Condition": { "Bool": { "aws:SecureTransport": "false" } }, "Effect": "Deny", "Principal": { "AWS": "*" }, "Resource": [ { "Fn::GetAtt": [ "testcloudfronts3cmkencryptionkeyCloudfrontLoggingBucketAccessLog8863921C", "Arn" ] }, { "Fn::Join": [ "", [ { "Fn::GetAtt": [ "testcloudfronts3cmkencryptionkeyCloudfrontLoggingBucketAccessLog8863921C", "Arn" ] }, "/*" ] ] } ] }, { "Action": [ "s3:DeleteObject*", "s3:GetBucket*", "s3:List*", "s3:PutBucketPolicy" ], "Effect": "Allow", "Principal": { "AWS": { "Fn::GetAtt": [ "CustomS3AutoDeleteObjectsCustomResourceProviderRole3B1BD092", "Arn" ] } }, "Resource": [ { "Fn::GetAtt": [ "testcloudfronts3cmkencryptionkeyCloudfrontLoggingBucketAccessLog8863921C", "Arn" ] }, { "Fn::Join": [ "", [ { "Fn::GetAtt": [ "testcloudfronts3cmkencryptionkeyCloudfrontLoggingBucketAccessLog8863921C", "Arn" ] }, "/*" ] ] } ] }, { "Action": "s3:PutObject", "Condition": { "ArnLike": { "aws:SourceArn": { "Fn::GetAtt": [ "testcloudfronts3cmkencryptionkeyCloudfrontLoggingBucket7C1787CD", "Arn" ] } }, "StringEquals": { "aws:SourceAccount": { "Ref": "AWS::AccountId" } } }, "Effect": "Allow", "Principal": { "Service": "logging.s3.amazonaws.com" }, "Resource": { "Fn::Join": [ "", [ { "Fn::GetAtt": [ "testcloudfronts3cmkencryptionkeyCloudfrontLoggingBucketAccessLog8863921C", "Arn" ] }, "/*" ] ] } } ], "Version": "2012-10-17" } } }, "testcloudfronts3cmkencryptionkeyCloudfrontLoggingBucketAccessLogAutoDeleteObjectsCustomResource4FF8A4C5": { "Type": "Custom::S3AutoDeleteObjects", "Properties": { "ServiceToken": { "Fn::GetAtt": [ "CustomS3AutoDeleteObjectsCustomResourceProviderHandler9D90184F", "Arn" ] }, "BucketName": { "Ref": "testcloudfronts3cmkencryptionkeyCloudfrontLoggingBucketAccessLog8863921C" } }, "DependsOn": [ "testcloudfronts3cmkencryptionkeyCloudfrontLoggingBucketAccessLogPolicy8F931BD7" ], "UpdateReplacePolicy": "Delete", "DeletionPolicy": "Delete" }, "testcloudfronts3cmkencryptionkeyCloudfrontLoggingBucket7C1787CD": { "Type": "AWS::S3::Bucket", "Properties": { "AccessControl": "LogDeliveryWrite", "BucketEncryption": { "ServerSideEncryptionConfiguration": [ { "ServerSideEncryptionByDefault": { "SSEAlgorithm": "AES256" } } ] }, "LoggingConfiguration": { "DestinationBucketName": { "Ref": "testcloudfronts3cmkencryptionkeyCloudfrontLoggingBucketAccessLog8863921C" } }, "OwnershipControls": { "Rules": [ { "ObjectOwnership": "ObjectWriter" } ] }, "PublicAccessBlockConfiguration": { "BlockPublicAcls": true, "BlockPublicPolicy": true, "IgnorePublicAcls": true, "RestrictPublicBuckets": true }, "Tags": [ { "Key": "aws-cdk:auto-delete-objects", "Value": "true" } ], "VersioningConfiguration": { "Status": "Enabled" } }, "UpdateReplacePolicy": "Delete", "DeletionPolicy": "Delete" }, "testcloudfronts3cmkencryptionkeyCloudfrontLoggingBucketPolicy5E737735": { "Type": "AWS::S3::BucketPolicy", "Properties": { "Bucket": { "Ref": "testcloudfronts3cmkencryptionkeyCloudfrontLoggingBucket7C1787CD" }, "PolicyDocument": { "Statement": [ { "Action": "s3:*", "Condition": { "Bool": { "aws:SecureTransport": "false" } }, "Effect": "Deny", "Principal": { "AWS": "*" }, "Resource": [ { "Fn::GetAtt": [ "testcloudfronts3cmkencryptionkeyCloudfrontLoggingBucket7C1787CD", "Arn" ] }, { "Fn::Join": [ "", [ { "Fn::GetAtt": [ "testcloudfronts3cmkencryptionkeyCloudfrontLoggingBucket7C1787CD", "Arn" ] }, "/*" ] ] } ] }, { "Action": [ "s3:DeleteObject*", "s3:GetBucket*", "s3:List*", "s3:PutBucketPolicy" ], "Effect": "Allow", "Principal": { "AWS": { "Fn::GetAtt": [ "CustomS3AutoDeleteObjectsCustomResourceProviderRole3B1BD092", "Arn" ] } }, "Resource": [ { "Fn::GetAtt": [ "testcloudfronts3cmkencryptionkeyCloudfrontLoggingBucket7C1787CD", "Arn" ] }, { "Fn::Join": [ "", [ { "Fn::GetAtt": [ "testcloudfronts3cmkencryptionkeyCloudfrontLoggingBucket7C1787CD", "Arn" ] }, "/*" ] ] } ] } ], "Version": "2012-10-17" } } }, "testcloudfronts3cmkencryptionkeyCloudfrontLoggingBucketAutoDeleteObjectsCustomResourceB088BCC7": { "Type": "Custom::S3AutoDeleteObjects", "Properties": { "ServiceToken": { "Fn::GetAtt": [ "CustomS3AutoDeleteObjectsCustomResourceProviderHandler9D90184F", "Arn" ] }, "BucketName": { "Ref": "testcloudfronts3cmkencryptionkeyCloudfrontLoggingBucket7C1787CD" } }, "DependsOn": [ "testcloudfronts3cmkencryptionkeyCloudfrontLoggingBucketPolicy5E737735" ], "UpdateReplacePolicy": "Delete", "DeletionPolicy": "Delete" }, "testcloudfronts3cmkencryptionkeyCloudFrontOac4EFECBD9": { "Type": "AWS::CloudFront::OriginAccessControl", "Properties": { "OriginAccessControlConfig": { "Description": "Origin access control provisioned by aws-cloudfront-s3", "Name": { "Fn::Join": [ "", [ "aws-cloudfront-s3-testn-key-", { "Fn::Select": [ 2, { "Fn::Split": [ "/", { "Ref": "AWS::StackId" } ] } ] } ] ] }, "OriginAccessControlOriginType": "s3", "SigningBehavior": "always", "SigningProtocol": "sigv4" } } }, "testcloudfronts3cmkencryptionkeyCloudFrontDistribution57C8A907": { "Type": "AWS::CloudFront::Distribution", "Properties": { "DistributionConfig": { "DefaultCacheBehavior": { "CachePolicyId": "658327ea-f89d-4fab-a63d-7e88639e58f6", "Compress": true, "TargetOriginId": "cfts3cmkprovidedasbucketproptestcloudfronts3cmkencryptionkeyCloudFrontDistributionOrigin1FA4541E3", "ViewerProtocolPolicy": "redirect-to-https" }, "DefaultRootObject": "index.html", "Enabled": true, "HttpVersion": "http2", "IPV6Enabled": true, "Logging": { "Bucket": { "Fn::GetAtt": [ "testcloudfronts3cmkencryptionkeyCloudfrontLoggingBucket7C1787CD", "RegionalDomainName" ] } }, "Origins": [ { "DomainName": { "Fn::GetAtt": [ "testcloudfronts3cmkencryptionkeyS3Bucket0E74E5D2", "RegionalDomainName" ] }, "Id": "cfts3cmkprovidedasbucketproptestcloudfronts3cmkencryptionkeyCloudFrontDistributionOrigin1FA4541E3", "OriginAccessControlId": { "Fn::GetAtt": [ "testcloudfronts3cmkencryptionkeyCloudFrontOac4EFECBD9", "Id" ] }, "S3OriginConfig": { "OriginAccessIdentity": "" } } ] } }, "Metadata": { "cfn_nag": { "rules_to_suppress": [ { "id": "W70", "reason": "Since the distribution uses the CloudFront domain name, CloudFront automatically sets the security policy to TLSv1 regardless of the value of MinimumProtocolVersion" } ] } } }, "testcloudfronts3cmkencryptionkeyLambdaFunctionServiceRole85783D1D": { "Type": "AWS::IAM::Role", "Properties": { "AssumeRolePolicyDocument": { "Statement": [ { "Action": "sts:AssumeRole", "Effect": "Allow", "Principal": { "Service": "lambda.amazonaws.com" } } ], "Version": "2012-10-17" }, "Policies": [ { "PolicyDocument": { "Statement": [ { "Action": [ "logs:CreateLogGroup", "logs:CreateLogStream", "logs:PutLogEvents" ], "Effect": "Allow", "Resource": { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":logs:", { "Ref": "AWS::Region" }, ":", { "Ref": "AWS::AccountId" }, ":log-group:/aws/lambda/*" ] ] } } ], "Version": "2012-10-17" }, "PolicyName": "LambdaFunctionServiceRolePolicy" } ] }, "Metadata": { "guard": { "SuppressedRules": [ "IAM_NO_INLINE_POLICY_CHECK" ] } } }, "testcloudfronts3cmkencryptionkeyLambdaFunction4DCD662E": { "Type": "AWS::Lambda::Function", "Properties": { "Code": { "S3Bucket": { "Fn::Sub": "cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}" }, "S3Key": "e97825c838d70ceb13ba2f6223a7d94ed35687b70bfb224a0b9128e698e3f28e.zip" }, "Description": "Custom resource function that updates a provided key policy to allow CloudFront access.", "Environment": { "Variables": { "AWS_NODEJS_CONNECTION_REUSE_ENABLED": "1" } }, "Handler": "index.handler", "Role": { "Fn::GetAtt": [ "testcloudfronts3cmkencryptionkeyLambdaFunctionServiceRole85783D1D", "Arn" ] }, "Runtime": "nodejs20.x", "TracingConfig": { "Mode": "Active" } }, "DependsOn": [ "testcloudfronts3cmkencryptionkeyLambdaFunctionServiceRole85783D1D" ], "Metadata": { "cfn_nag": { "rules_to_suppress": [ { "id": "W58", "reason": "Lambda functions has the required permission to write CloudWatch Logs. It uses custom policy instead of arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole with tighter permissions." }, { "id": "W89", "reason": "This is not a rule for the general case, just for specific use cases/industries" }, { "id": "W92", "reason": "Impossible for us to define the correct concurrency for clients" } ] } } }, "testcloudfronts3cmkencryptionkeyLambdaFunctioninlinePolicyAddedToExecutionRole030BCEDF3": { "Type": "AWS::IAM::Policy", "Properties": { "PolicyDocument": { "Statement": [ { "Action": [ "xray:PutTelemetryRecords", "xray:PutTraceSegments" ], "Effect": "Allow", "Resource": "*" } ], "Version": "2012-10-17" }, "PolicyName": "testcloudfronts3cmkencryptionkeyLambdaFunctioninlinePolicyAddedToExecutionRole030BCEDF3", "Roles": [ { "Ref": "testcloudfronts3cmkencryptionkeyLambdaFunctionServiceRole85783D1D" } ] } }, "testcloudfronts3cmkencryptionkeytestcloudfronts3cmkencryptionkeyResourceCmkPolicyBD4BA975": { "Type": "AWS::IAM::Policy", "Properties": { "PolicyDocument": { "Statement": [ { "Action": [ "kms:DescribeKey", "kms:GetKeyPolicy", "kms:PutKeyPolicy" ], "Effect": "Allow", "Resource": { "Fn::GetAtt": [ "cmkKey598B20B2", "Arn" ] } } ], "Version": "2012-10-17" }, "PolicyName": "testcloudfronts3cmkencryptionkeytestcloudfronts3cmkencryptionkeyResourceCmkPolicyBD4BA975", "Roles": [ { "Ref": "testcloudfronts3cmkencryptionkeyLambdaFunctionServiceRole85783D1D" } ] } }, "testcloudfronts3cmkencryptionkeyKmsKeyPolicyUpdateProviderframeworkonEventServiceRole3D4040AD": { "Type": "AWS::IAM::Role", "Properties": { "AssumeRolePolicyDocument": { "Statement": [ { "Action": "sts:AssumeRole", "Effect": "Allow", "Principal": { "Service": "lambda.amazonaws.com" } } ], "Version": "2012-10-17" }, "ManagedPolicyArns": [ { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":iam::aws:policy/service-role/AWSLambdaBasicExecutionRole" ] ] } ] } }, "testcloudfronts3cmkencryptionkeyKmsKeyPolicyUpdateProviderframeworkonEventServiceRoleDefaultPolicy066CD751": { "Type": "AWS::IAM::Policy", "Properties": { "PolicyDocument": { "Statement": [ { "Action": "lambda:InvokeFunction", "Effect": "Allow", "Resource": [ { "Fn::GetAtt": [ "testcloudfronts3cmkencryptionkeyLambdaFunction4DCD662E", "Arn" ] }, { "Fn::Join": [ "", [ { "Fn::GetAtt": [ "testcloudfronts3cmkencryptionkeyLambdaFunction4DCD662E", "Arn" ] }, ":*" ] ] } ] } ], "Version": "2012-10-17" }, "PolicyName": "testcloudfronts3cmkencryptionkeyKmsKeyPolicyUpdateProviderframeworkonEventServiceRoleDefaultPolicy066CD751", "Roles": [ { "Ref": "testcloudfronts3cmkencryptionkeyKmsKeyPolicyUpdateProviderframeworkonEventServiceRole3D4040AD" } ] } }, "testcloudfronts3cmkencryptionkeyKmsKeyPolicyUpdateProviderframeworkonEvent8BCBFC59": { "Type": "AWS::Lambda::Function", "Properties": { "Code": { "S3Bucket": { "Fn::Sub": "cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}" }, "S3Key": "bdc104ed9cab1b5b6421713c8155f0b753380595356f710400609664d3635eca.zip" }, "Description": "AWS CDK resource provider framework - onEvent (cfts3-cmk-provided-as-bucket-prop/test-cloudfront-s3-cmk-encryption-key/KmsKeyPolicyUpdateProvider)", "Environment": { "Variables": { "USER_ON_EVENT_FUNCTION_ARN": { "Fn::GetAtt": [ "testcloudfronts3cmkencryptionkeyLambdaFunction4DCD662E", "Arn" ] } } }, "Handler": "framework.onEvent", "LoggingConfig": { "ApplicationLogLevel": "FATAL", "LogFormat": "JSON" }, "Role": { "Fn::GetAtt": [ "testcloudfronts3cmkencryptionkeyKmsKeyPolicyUpdateProviderframeworkonEventServiceRole3D4040AD", "Arn" ] }, "Runtime": "nodejs22.x", "Timeout": 900 }, "DependsOn": [ "testcloudfronts3cmkencryptionkeyKmsKeyPolicyUpdateProviderframeworkonEventServiceRoleDefaultPolicy066CD751", "testcloudfronts3cmkencryptionkeyKmsKeyPolicyUpdateProviderframeworkonEventServiceRole3D4040AD" ], "Metadata": { "cfn_nag": { "rules_to_suppress": [ { "id": "W58", "reason": "The CDK-provided lambda function that backs their Custom Resource Provider framework has an IAM role with the arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole Managed Policy attached, which grants permission to write to CloudWatch Logs" }, { "id": "W89", "reason": "The CDK-provided lambda function that backs their Custom Resource Provider framework does not access VPC resources" }, { "id": "W92", "reason": "The CDK-provided lambda function that backs their Custom Resource Provider framework does not define ReservedConcurrentExecutions" } ] } } }, "testcloudfronts3cmkencryptionkeyKmsKeyPolicyUpdateProviderframeworkonEventinlinePolicyAddedToExecutionRole0055AB010": { "Type": "AWS::IAM::Policy", "Properties": { "PolicyDocument": { "Statement": [ { "Action": "lambda:GetFunction", "Effect": "Allow", "Resource": { "Fn::GetAtt": [ "testcloudfronts3cmkencryptionkeyLambdaFunction4DCD662E", "Arn" ] } } ], "Version": "2012-10-17" }, "PolicyName": "testcloudfronts3cmkencryptionkeyKmsKeyPolicyUpdateProviderframeworkonEventinlinePolicyAddedToExecutionRole0055AB010", "Roles": [ { "Ref": "testcloudfronts3cmkencryptionkeyKmsKeyPolicyUpdateProviderframeworkonEventServiceRole3D4040AD" } ] } }, "testcloudfronts3cmkencryptionkeyKmsKeyPolicyUpdaterFAFEBF0F": { "Type": "Custom::KmsKeyPolicyUpdater", "Properties": { "ServiceToken": { "Fn::GetAtt": [ "testcloudfronts3cmkencryptionkeyKmsKeyPolicyUpdateProviderframeworkonEvent8BCBFC59", "Arn" ] }, "KmsKeyId": { "Ref": "cmkKey598B20B2" }, "CloudFrontDistributionId": { "Ref": "testcloudfronts3cmkencryptionkeyCloudFrontDistribution57C8A907" }, "AccountId": { "Ref": "AWS::AccountId" } }, "UpdateReplacePolicy": "Delete", "DeletionPolicy": "Delete" }, "CustomS3AutoDeleteObjectsCustomResourceProviderRole3B1BD092": { "Type": "AWS::IAM::Role", "Properties": { "AssumeRolePolicyDocument": { "Version": "2012-10-17", "Statement": [ { "Action": "sts:AssumeRole", "Effect": "Allow", "Principal": { "Service": "lambda.amazonaws.com" } } ] }, "ManagedPolicyArns": [ { "Fn::Sub": "arn:${AWS::Partition}:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole" } ] } }, "CustomS3AutoDeleteObjectsCustomResourceProviderHandler9D90184F": { "Type": "AWS::Lambda::Function", "Properties": { "Code": { "S3Bucket": { "Fn::Sub": "cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}" }, "S3Key": "faa95a81ae7d7373f3e1f242268f904eb748d8d0fdd306e8a6fe515a1905a7d6.zip" }, "Timeout": 900, "MemorySize": 128, "Handler": "index.handler", "Role": { "Fn::GetAtt": [ "CustomS3AutoDeleteObjectsCustomResourceProviderRole3B1BD092", "Arn" ] }, "Runtime": "nodejs22.x", "Description": { "Fn::Join": [ "", [ "Lambda function for auto-deleting objects in ", { "Ref": "testcloudfronts3cmkencryptionkeyS3LoggingBucket5CE52209" }, " S3 bucket." ] ] } }, "DependsOn": [ "CustomS3AutoDeleteObjectsCustomResourceProviderRole3B1BD092" ], "Metadata": { "cfn_nag": { "rules_to_suppress": [ { "id": "W58", "reason": "CDK generated custom resource" }, { "id": "W89", "reason": "CDK generated custom resource" }, { "id": "W92", "reason": "CDK generated custom resource" } ] } } } }, "Parameters": { "BootstrapVersion": { "Type": "AWS::SSM::Parameter::Value", "Default": "/cdk-bootstrap/hnb659fds/version", "Description": "Version of the CDK Bootstrap resources in this environment, automatically retrieved from SSM Parameter Store. [cdk:skip]" } }, "Rules": { "CheckBootstrapVersion": { "Assertions": [ { "Assert": { "Fn::Not": [ { "Fn::Contains": [ [ "1", "2", "3", "4", "5" ], { "Ref": "BootstrapVersion" } ] } ] }, "AssertDescription": "CDK bootstrap stack version 6 required. Please run 'cdk bootstrap' with a recent version of the CDK CLI." } ] } } }