{ "Description": "Integration Test for aws-kinesisstreams-kinesisfirehose-s3", "Resources": { "testkinesislambdaKinesisStream00F67958": { "Type": "AWS::Kinesis::Stream", "Properties": { "RetentionPeriodHours": 24, "ShardCount": 1, "StreamEncryption": { "EncryptionType": "KMS", "KeyId": "alias/aws/kinesis" } }, "UpdateReplacePolicy": "Retain", "DeletionPolicy": "Retain" }, "testkinesislambdaLambdaFunctionServiceRole965E2A08": { "Type": "AWS::IAM::Role", "Properties": { "AssumeRolePolicyDocument": { "Statement": [ { "Action": "sts:AssumeRole", "Effect": "Allow", "Principal": { "Service": "lambda.amazonaws.com" } } ], "Version": "2012-10-17" }, "Policies": [ { "PolicyDocument": { "Statement": [ { "Action": [ "logs:CreateLogGroup", "logs:CreateLogStream", "logs:PutLogEvents" ], "Effect": "Allow", "Resource": { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":logs:", { "Ref": "AWS::Region" }, ":", { "Ref": "AWS::AccountId" }, ":log-group:/aws/lambda/*" ] ] } } ], "Version": "2012-10-17" }, "PolicyName": "LambdaFunctionServiceRolePolicy" } ] }, "Metadata": { "guard": { "SuppressedRules": [ "IAM_NO_INLINE_POLICY_CHECK" ] } } }, "testkinesislambdaLambdaFunctionServiceRoleDefaultPolicy6FF6B6A5": { "Type": "AWS::IAM::Policy", "Properties": { "PolicyDocument": { "Statement": [ { "Action": [ "kinesis:DescribeStream", "kinesis:DescribeStreamConsumer", "kinesis:DescribeStreamSummary", "kinesis:GetRecords", "kinesis:GetShardIterator", "kinesis:ListShards", "kinesis:ListStreams", "kinesis:SubscribeToShard" ], "Effect": "Allow", "Resource": { "Fn::GetAtt": [ "testkinesislambdaKinesisStream00F67958", "Arn" ] } }, { "Action": [ "sqs:GetQueueAttributes", "sqs:GetQueueUrl", "sqs:SendMessage" ], "Effect": "Allow", "Resource": { "Fn::GetAtt": [ "testkinesislambdaSqsDlqQueueA754ACEA", "Arn" ] } } ], "Version": "2012-10-17" }, "PolicyName": "testkinesislambdaLambdaFunctionServiceRoleDefaultPolicy6FF6B6A5", "Roles": [ { "Ref": "testkinesislambdaLambdaFunctionServiceRole965E2A08" } ] } }, "testkinesislambdaLambdaFunction7F18F840": { "Type": "AWS::Lambda::Function", "Properties": { "Code": { "S3Bucket": { "Fn::Sub": "cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}" }, "S3Key": "26cf7db64552331215006953bf73e5adfb49b5bf0eb2298bfe04547b76c08b88.zip" }, "Environment": { "Variables": { "AWS_NODEJS_CONNECTION_REUSE_ENABLED": "1" } }, "Handler": "index.handler", "Role": { "Fn::GetAtt": [ "testkinesislambdaLambdaFunctionServiceRole965E2A08", "Arn" ] }, "Runtime": "nodejs20.x", "TracingConfig": { "Mode": "Active" } }, "DependsOn": [ "testkinesislambdaLambdaFunctionServiceRoleDefaultPolicy6FF6B6A5", "testkinesislambdaLambdaFunctionServiceRole965E2A08" ], "Metadata": { "cfn_nag": { "rules_to_suppress": [ { "id": "W58", "reason": "Lambda functions has the required permission to write CloudWatch Logs. It uses custom policy instead of arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole with tighter permissions." }, { "id": "W89", "reason": "This is not a rule for the general case, just for specific use cases/industries" }, { "id": "W92", "reason": "Impossible for us to define the correct concurrency for clients" } ] } } }, "testkinesislambdaLambdaFunctioninlinePolicyAddedToExecutionRole049F0C37A": { "Type": "AWS::IAM::Policy", "Properties": { "PolicyDocument": { "Statement": [ { "Action": [ "xray:PutTelemetryRecords", "xray:PutTraceSegments" ], "Effect": "Allow", "Resource": "*" } ], "Version": "2012-10-17" }, "PolicyName": "testkinesislambdaLambdaFunctioninlinePolicyAddedToExecutionRole049F0C37A", "Roles": [ { "Ref": "testkinesislambdaLambdaFunctionServiceRole965E2A08" } ] } }, "testkinesislambdaLambdaFunctionKinesisEventSourcekinfhss3existingStreamObjtestkinesislambdaKinesisStream06A6475B85130EBE": { "Type": "AWS::Lambda::EventSourceMapping", "Properties": { "BatchSize": 100, "BisectBatchOnFunctionError": true, "DestinationConfig": { "OnFailure": { "Destination": { "Fn::GetAtt": [ "testkinesislambdaSqsDlqQueueA754ACEA", "Arn" ] } } }, "EventSourceArn": { "Fn::GetAtt": [ "testkinesislambdaKinesisStream00F67958", "Arn" ] }, "FunctionName": { "Ref": "testkinesislambdaLambdaFunction7F18F840" }, "MaximumRecordAgeInSeconds": 86400, "MaximumRetryAttempts": 500, "StartingPosition": "TRIM_HORIZON" } }, "testkinesislambdaSqsDlqQueueA754ACEA": { "Type": "AWS::SQS::Queue", "Properties": { "KmsMasterKeyId": "alias/aws/sqs" }, "UpdateReplacePolicy": "Delete", "DeletionPolicy": "Delete" }, "testkinesislambdaSqsDlqQueuePolicy38A92DE9": { "Type": "AWS::SQS::QueuePolicy", "Properties": { "PolicyDocument": { "Statement": [ { "Action": [ "sqs:AddPermission", "sqs:DeleteMessage", "sqs:GetQueueAttributes", "sqs:ReceiveMessage", "sqs:RemovePermission", "sqs:SendMessage", "sqs:SetQueueAttributes" ], "Effect": "Allow", "Principal": { "AWS": { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":iam::", { "Ref": "AWS::AccountId" }, ":root" ] ] } }, "Resource": { "Fn::GetAtt": [ "testkinesislambdaSqsDlqQueueA754ACEA", "Arn" ] }, "Sid": "QueueOwnerOnlyAccess" }, { "Action": "SQS:*", "Condition": { "Bool": { "aws:SecureTransport": "false" } }, "Effect": "Deny", "Principal": { "AWS": "*" }, "Resource": { "Fn::GetAtt": [ "testkinesislambdaSqsDlqQueueA754ACEA", "Arn" ] }, "Sid": "HttpsOnly" } ], "Version": "2012-10-17" }, "Queues": [ { "Ref": "testkinesislambdaSqsDlqQueueA754ACEA" } ] } }, "testkinesislambdaKinesisStreamGetRecordsIteratorAgeAlarm99DB34B3": { "Type": "AWS::CloudWatch::Alarm", "Properties": { "AlarmDescription": "Consumer Record Processing Falling Behind, there is risk for data loss due to record expiration.", "ComparisonOperator": "GreaterThanOrEqualToThreshold", "EvaluationPeriods": 1, "MetricName": "GetRecords.IteratorAgeMilliseconds", "Namespace": "AWS/Kinesis", "Period": 300, "Statistic": "Maximum", "Threshold": 43200000 } }, "testkinesislambdaKinesisStreamReadProvisionedThroughputExceededAlarmAE98686F": { "Type": "AWS::CloudWatch::Alarm", "Properties": { "AlarmDescription": "Consumer Application is Reading at a Slower Rate Than Expected.", "ComparisonOperator": "GreaterThanThreshold", "EvaluationPeriods": 1, "MetricName": "ReadProvisionedThroughputExceeded", "Namespace": "AWS/Kinesis", "Period": 300, "Statistic": "Average", "Threshold": 0 } }, "testexistingstreamfirehoses3stackKinesisFirehoseToS3S3BucketF4CE72AB": { "Type": "AWS::S3::Bucket", "Properties": { "BucketEncryption": { "ServerSideEncryptionConfiguration": [ { "ServerSideEncryptionByDefault": { "SSEAlgorithm": "AES256" } } ] }, "LifecycleConfiguration": { "Rules": [ { "NoncurrentVersionTransitions": [ { "StorageClass": "GLACIER", "TransitionInDays": 90 } ], "Status": "Enabled" } ] }, "PublicAccessBlockConfiguration": { "BlockPublicAcls": true, "BlockPublicPolicy": true, "IgnorePublicAcls": true, "RestrictPublicBuckets": true }, "VersioningConfiguration": { "Status": "Enabled" } }, "UpdateReplacePolicy": "Delete", "DeletionPolicy": "Delete", "Metadata": { "cfn_nag": { "rules_to_suppress": [ { "id": "W35", "reason": "This S3 bucket is created for unit/ integration testing purposes only." } ] } } }, "testexistingstreamfirehoses3stackKinesisFirehoseToS3S3BucketPolicy9448E597": { "Type": "AWS::S3::BucketPolicy", "Properties": { "Bucket": { "Ref": "testexistingstreamfirehoses3stackKinesisFirehoseToS3S3BucketF4CE72AB" }, "PolicyDocument": { "Statement": [ { "Action": "s3:*", "Condition": { "Bool": { "aws:SecureTransport": "false" } }, "Effect": "Deny", "Principal": { "AWS": "*" }, "Resource": [ { "Fn::GetAtt": [ "testexistingstreamfirehoses3stackKinesisFirehoseToS3S3BucketF4CE72AB", "Arn" ] }, { "Fn::Join": [ "", [ { "Fn::GetAtt": [ "testexistingstreamfirehoses3stackKinesisFirehoseToS3S3BucketF4CE72AB", "Arn" ] }, "/*" ] ] } ] } ], "Version": "2012-10-17" } } }, "testexistingstreamfirehoses3stackKinesisFirehoseToS3firehoseloggroupE425A6C8": { "Type": "AWS::Logs::LogGroup", "UpdateReplacePolicy": "Delete", "DeletionPolicy": "Delete", "Metadata": { "cfn_nag": { "rules_to_suppress": [ { "id": "W86", "reason": "Retention period for CloudWatchLogs LogGroups are set to 'Never Expire' to preserve customer data indefinitely" }, { "id": "W84", "reason": "By default CloudWatchLogs LogGroups data is encrypted using the CloudWatch server-side encryption keys (AWS Managed Keys)" } ] } } }, "testexistingstreamfirehoses3stackKinesisFirehoseToS3firehoseloggroupfirehoselogstream5F77A011": { "Type": "AWS::Logs::LogStream", "Properties": { "LogGroupName": { "Ref": "testexistingstreamfirehoses3stackKinesisFirehoseToS3firehoseloggroupE425A6C8" } }, "UpdateReplacePolicy": "Retain", "DeletionPolicy": "Retain" }, "testexistingstreamfirehoses3stackKinesisFirehoseToS3KinesisFirehoseRoleE4B0266E": { "Type": "AWS::IAM::Role", "Properties": { "AssumeRolePolicyDocument": { "Statement": [ { "Action": "sts:AssumeRole", "Effect": "Allow", "Principal": { "Service": "firehose.amazonaws.com" } } ], "Version": "2012-10-17" } }, "Metadata": { "guard": { "SuppressedRules": [ "IAM_NO_INLINE_POLICY_CHECK" ] } } }, "testexistingstreamfirehoses3stackKinesisFirehoseToS3KinesisFirehosePolicyE9C16144": { "Type": "AWS::IAM::Policy", "Properties": { "PolicyDocument": { "Statement": [ { "Action": [ "s3:AbortMultipartUpload", "s3:GetBucketLocation", "s3:GetObject", "s3:ListBucket", "s3:ListBucketMultipartUploads", "s3:PutObject" ], "Effect": "Allow", "Resource": [ { "Fn::GetAtt": [ "testexistingstreamfirehoses3stackKinesisFirehoseToS3S3BucketF4CE72AB", "Arn" ] }, { "Fn::Join": [ "", [ { "Fn::GetAtt": [ "testexistingstreamfirehoses3stackKinesisFirehoseToS3S3BucketF4CE72AB", "Arn" ] }, "/*" ] ] } ] }, { "Action": "logs:PutLogEvents", "Effect": "Allow", "Resource": { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":logs:", { "Ref": "AWS::Region" }, ":", { "Ref": "AWS::AccountId" }, ":log-group:", { "Ref": "testexistingstreamfirehoses3stackKinesisFirehoseToS3firehoseloggroupE425A6C8" }, ":log-stream:", { "Ref": "testexistingstreamfirehoses3stackKinesisFirehoseToS3firehoseloggroupfirehoselogstream5F77A011" } ] ] } } ], "Version": "2012-10-17" }, "PolicyName": "testexistingstreamfirehoses3stackKinesisFirehoseToS3KinesisFirehosePolicyE9C16144", "Roles": [ { "Ref": "testexistingstreamfirehoses3stackKinesisFirehoseToS3KinesisFirehoseRoleE4B0266E" } ] } }, "testexistingstreamfirehoses3stackKinesisFirehoseToS3KinesisFirehose0834A7FB": { "Type": "AWS::KinesisFirehose::DeliveryStream", "Properties": { "DeliveryStreamName": "KinesisFirehosekinfhss3existingSstackKinesisFirehoseToS3A84F50F0", "DeliveryStreamType": "KinesisStreamAsSource", "ExtendedS3DestinationConfiguration": { "BucketARN": { "Fn::GetAtt": [ "testexistingstreamfirehoses3stackKinesisFirehoseToS3S3BucketF4CE72AB", "Arn" ] }, "BufferingHints": { "IntervalInSeconds": 300, "SizeInMBs": 5 }, "CloudWatchLoggingOptions": { "Enabled": true, "LogGroupName": { "Ref": "testexistingstreamfirehoses3stackKinesisFirehoseToS3firehoseloggroupE425A6C8" }, "LogStreamName": { "Ref": "testexistingstreamfirehoses3stackKinesisFirehoseToS3firehoseloggroupfirehoselogstream5F77A011" } }, "CompressionFormat": "GZIP", "EncryptionConfiguration": { "KMSEncryptionConfig": { "AWSKMSKeyARN": { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":kms:", { "Ref": "AWS::Region" }, ":", { "Ref": "AWS::AccountId" }, ":alias/aws/s3" ] ] } } }, "RoleARN": { "Fn::GetAtt": [ "testexistingstreamfirehoses3stackKinesisFirehoseToS3KinesisFirehoseRoleE4B0266E", "Arn" ] } }, "KinesisStreamSourceConfiguration": { "KinesisStreamARN": { "Fn::GetAtt": [ "testkinesislambdaKinesisStream00F67958", "Arn" ] }, "RoleARN": { "Fn::GetAtt": [ "KinesisStreamsRole2BFD39A5", "Arn" ] } } }, "Metadata": { "guard": { "SuppressedRules": [ "KINESIS_FIREHOSE_REDSHIFT_DESTINATION_CONFIGURATION_NO_PLAINTEXT_PASSWORD", "KINESIS_FIREHOSE_SPLUNK_DESTINATION_CONFIGURATION_NO_PLAINTEXT_PASSWORD" ] } } }, "KinesisStreamsRole2BFD39A5": { "Type": "AWS::IAM::Role", "Properties": { "AssumeRolePolicyDocument": { "Statement": [ { "Action": "sts:AssumeRole", "Effect": "Allow", "Principal": { "Service": "firehose.amazonaws.com" } } ], "Version": "2012-10-17" }, "Policies": [ { "PolicyDocument": { "Statement": [ { "Action": [ "kinesis:DescribeStream", "kinesis:GetRecords", "kinesis:GetShardIterator", "kinesis:ListShards" ], "Effect": "Allow", "Resource": { "Fn::GetAtt": [ "testkinesislambdaKinesisStream00F67958", "Arn" ] } } ], "Version": "2012-10-17" }, "PolicyName": "KinesisStreamsRoleRolePolicy" } ] }, "Metadata": { "guard": { "SuppressedRules": [ "IAM_NO_INLINE_POLICY_CHECK" ] } } } }, "Parameters": { "BootstrapVersion": { "Type": "AWS::SSM::Parameter::Value", "Default": "/cdk-bootstrap/hnb659fds/version", "Description": "Version of the CDK Bootstrap resources in this environment, automatically retrieved from SSM Parameter Store. [cdk:skip]" } }, "Rules": { "CheckBootstrapVersion": { "Assertions": [ { "Assert": { "Fn::Not": [ { "Fn::Contains": [ [ "1", "2", "3", "4", "5" ], { "Ref": "BootstrapVersion" } ] } ] }, "AssertDescription": "CDK bootstrap stack version 6 required. Please run 'cdk bootstrap' with a recent version of the CDK CLI." } ] } } }