@aws-solutions-constructs/aws-cloudfront-s3
Version:
CDK Constructs for AWS Cloudfront to AWS S3 integration.
1,280 lines • 30.5 kB
JSON
{
"Description": "Integration Test for aws-cloudfront-s3",
"Resources": {
"cmkKey598B20B2": {
"Type": "AWS::KMS::Key",
"Properties": {
"EnableKeyRotation": true,
"KeyPolicy": {
"Statement": [
{
"Action": "kms:*",
"Effect": "Allow",
"Principal": {
"AWS": {
"Fn::Join": [
"",
[
"arn:",
{
"Ref": "AWS::Partition"
},
":iam::",
{
"Ref": "AWS::AccountId"
},
":root"
]
]
}
},
"Resource": "*"
}
],
"Version": "2012-10-17"
}
},
"UpdateReplacePolicy": "Delete",
"DeletionPolicy": "Delete"
},
"testcloudfronts3cmkencryptionkeyS3LoggingBucket5CE52209": {
"Type": "AWS::S3::Bucket",
"Properties": {
"BucketEncryption": {
"ServerSideEncryptionConfiguration": [
{
"ServerSideEncryptionByDefault": {
"SSEAlgorithm": "AES256"
}
}
]
},
"PublicAccessBlockConfiguration": {
"BlockPublicAcls": true,
"BlockPublicPolicy": true,
"IgnorePublicAcls": true,
"RestrictPublicBuckets": true
},
"Tags": [
{
"Key": "aws-cdk:auto-delete-objects",
"Value": "true"
}
],
"VersioningConfiguration": {
"Status": "Enabled"
}
},
"UpdateReplacePolicy": "Delete",
"DeletionPolicy": "Delete",
"Metadata": {
"cfn_nag": {
"rules_to_suppress": [
{
"id": "W35",
"reason": "This S3 bucket is used as the access logging bucket for another bucket"
}
]
}
}
},
"testcloudfronts3cmkencryptionkeyS3LoggingBucketPolicyF38CB6DD": {
"Type": "AWS::S3::BucketPolicy",
"Properties": {
"Bucket": {
"Ref": "testcloudfronts3cmkencryptionkeyS3LoggingBucket5CE52209"
},
"PolicyDocument": {
"Statement": [
{
"Action": "s3:*",
"Condition": {
"Bool": {
"aws:SecureTransport": "false"
}
},
"Effect": "Deny",
"Principal": {
"AWS": "*"
},
"Resource": [
{
"Fn::GetAtt": [
"testcloudfronts3cmkencryptionkeyS3LoggingBucket5CE52209",
"Arn"
]
},
{
"Fn::Join": [
"",
[
{
"Fn::GetAtt": [
"testcloudfronts3cmkencryptionkeyS3LoggingBucket5CE52209",
"Arn"
]
},
"/*"
]
]
}
]
},
{
"Action": [
"s3:DeleteObject*",
"s3:GetBucket*",
"s3:List*",
"s3:PutBucketPolicy"
],
"Effect": "Allow",
"Principal": {
"AWS": {
"Fn::GetAtt": [
"CustomS3AutoDeleteObjectsCustomResourceProviderRole3B1BD092",
"Arn"
]
}
},
"Resource": [
{
"Fn::GetAtt": [
"testcloudfronts3cmkencryptionkeyS3LoggingBucket5CE52209",
"Arn"
]
},
{
"Fn::Join": [
"",
[
{
"Fn::GetAtt": [
"testcloudfronts3cmkencryptionkeyS3LoggingBucket5CE52209",
"Arn"
]
},
"/*"
]
]
}
]
},
{
"Action": "s3:PutObject",
"Condition": {
"ArnLike": {
"aws:SourceArn": {
"Fn::GetAtt": [
"testcloudfronts3cmkencryptionkeyS3Bucket0E74E5D2",
"Arn"
]
}
},
"StringEquals": {
"aws:SourceAccount": {
"Ref": "AWS::AccountId"
}
}
},
"Effect": "Allow",
"Principal": {
"Service": "logging.s3.amazonaws.com"
},
"Resource": {
"Fn::Join": [
"",
[
{
"Fn::GetAtt": [
"testcloudfronts3cmkencryptionkeyS3LoggingBucket5CE52209",
"Arn"
]
},
"/*"
]
]
}
}
],
"Version": "2012-10-17"
}
}
},
"testcloudfronts3cmkencryptionkeyS3LoggingBucketAutoDeleteObjectsCustomResource69EF1373": {
"Type": "Custom::S3AutoDeleteObjects",
"Properties": {
"ServiceToken": {
"Fn::GetAtt": [
"CustomS3AutoDeleteObjectsCustomResourceProviderHandler9D90184F",
"Arn"
]
},
"BucketName": {
"Ref": "testcloudfronts3cmkencryptionkeyS3LoggingBucket5CE52209"
}
},
"DependsOn": [
"testcloudfronts3cmkencryptionkeyS3LoggingBucketPolicyF38CB6DD"
],
"UpdateReplacePolicy": "Delete",
"DeletionPolicy": "Delete"
},
"testcloudfronts3cmkencryptionkeyS3Bucket0E74E5D2": {
"Type": "AWS::S3::Bucket",
"Properties": {
"BucketEncryption": {
"ServerSideEncryptionConfiguration": [
{
"ServerSideEncryptionByDefault": {
"KMSMasterKeyID": {
"Fn::GetAtt": [
"cmkKey598B20B2",
"Arn"
]
},
"SSEAlgorithm": "aws:kms"
}
}
]
},
"LifecycleConfiguration": {
"Rules": [
{
"NoncurrentVersionTransitions": [
{
"StorageClass": "GLACIER",
"TransitionInDays": 90
}
],
"Status": "Enabled"
}
]
},
"LoggingConfiguration": {
"DestinationBucketName": {
"Ref": "testcloudfronts3cmkencryptionkeyS3LoggingBucket5CE52209"
}
},
"PublicAccessBlockConfiguration": {
"BlockPublicAcls": true,
"BlockPublicPolicy": true,
"IgnorePublicAcls": true,
"RestrictPublicBuckets": true
},
"VersioningConfiguration": {
"Status": "Enabled"
}
},
"UpdateReplacePolicy": "Retain",
"DeletionPolicy": "Retain"
},
"testcloudfronts3cmkencryptionkeyS3BucketPolicy5DF57B01": {
"Type": "AWS::S3::BucketPolicy",
"Properties": {
"Bucket": {
"Ref": "testcloudfronts3cmkencryptionkeyS3Bucket0E74E5D2"
},
"PolicyDocument": {
"Statement": [
{
"Action": "s3:*",
"Condition": {
"Bool": {
"aws:SecureTransport": "false"
}
},
"Effect": "Deny",
"Principal": {
"AWS": "*"
},
"Resource": [
{
"Fn::GetAtt": [
"testcloudfronts3cmkencryptionkeyS3Bucket0E74E5D2",
"Arn"
]
},
{
"Fn::Join": [
"",
[
{
"Fn::GetAtt": [
"testcloudfronts3cmkencryptionkeyS3Bucket0E74E5D2",
"Arn"
]
},
"/*"
]
]
}
]
},
{
"Action": "s3:GetObject",
"Condition": {
"StringEquals": {
"AWS:SourceArn": {
"Fn::Join": [
"",
[
"arn:",
{
"Ref": "AWS::Partition"
},
":cloudfront::",
{
"Ref": "AWS::AccountId"
},
":distribution/",
{
"Ref": "testcloudfronts3cmkencryptionkeyCloudFrontDistribution57C8A907"
}
]
]
}
}
},
"Effect": "Allow",
"Principal": {
"Service": "cloudfront.amazonaws.com"
},
"Resource": {
"Fn::Join": [
"",
[
{
"Fn::GetAtt": [
"testcloudfronts3cmkencryptionkeyS3Bucket0E74E5D2",
"Arn"
]
},
"/*"
]
]
}
},
{
"Action": "s3:ListBucket",
"Condition": {
"StringEquals": {
"AWS:SourceArn": {
"Fn::Join": [
"",
[
"arn:",
{
"Ref": "AWS::Partition"
},
":cloudfront::",
{
"Ref": "AWS::AccountId"
},
":distribution/",
{
"Ref": "testcloudfronts3cmkencryptionkeyCloudFrontDistribution57C8A907"
}
]
]
}
}
},
"Effect": "Allow",
"Principal": {
"Service": "cloudfront.amazonaws.com"
},
"Resource": {
"Fn::GetAtt": [
"testcloudfronts3cmkencryptionkeyS3Bucket0E74E5D2",
"Arn"
]
}
}
],
"Version": "2012-10-17"
}
},
"Metadata": {
"cfn_nag": {
"rules_to_suppress": [
{
"id": "F16",
"reason": "Public website bucket policy requires a wildcard principal"
}
]
}
}
},
"testcloudfronts3cmkencryptionkeyCloudfrontLoggingBucketAccessLog8863921C": {
"Type": "AWS::S3::Bucket",
"Properties": {
"BucketEncryption": {
"ServerSideEncryptionConfiguration": [
{
"ServerSideEncryptionByDefault": {
"SSEAlgorithm": "AES256"
}
}
]
},
"PublicAccessBlockConfiguration": {
"BlockPublicAcls": true,
"BlockPublicPolicy": true,
"IgnorePublicAcls": true,
"RestrictPublicBuckets": true
},
"Tags": [
{
"Key": "aws-cdk:auto-delete-objects",
"Value": "true"
}
],
"VersioningConfiguration": {
"Status": "Enabled"
}
},
"UpdateReplacePolicy": "Delete",
"DeletionPolicy": "Delete",
"Metadata": {
"cfn_nag": {
"rules_to_suppress": [
{
"id": "W35",
"reason": "This S3 bucket is used as the access logging bucket for another bucket"
}
]
}
}
},
"testcloudfronts3cmkencryptionkeyCloudfrontLoggingBucketAccessLogPolicy8F931BD7": {
"Type": "AWS::S3::BucketPolicy",
"Properties": {
"Bucket": {
"Ref": "testcloudfronts3cmkencryptionkeyCloudfrontLoggingBucketAccessLog8863921C"
},
"PolicyDocument": {
"Statement": [
{
"Action": "s3:*",
"Condition": {
"Bool": {
"aws:SecureTransport": "false"
}
},
"Effect": "Deny",
"Principal": {
"AWS": "*"
},
"Resource": [
{
"Fn::GetAtt": [
"testcloudfronts3cmkencryptionkeyCloudfrontLoggingBucketAccessLog8863921C",
"Arn"
]
},
{
"Fn::Join": [
"",
[
{
"Fn::GetAtt": [
"testcloudfronts3cmkencryptionkeyCloudfrontLoggingBucketAccessLog8863921C",
"Arn"
]
},
"/*"
]
]
}
]
},
{
"Action": [
"s3:DeleteObject*",
"s3:GetBucket*",
"s3:List*",
"s3:PutBucketPolicy"
],
"Effect": "Allow",
"Principal": {
"AWS": {
"Fn::GetAtt": [
"CustomS3AutoDeleteObjectsCustomResourceProviderRole3B1BD092",
"Arn"
]
}
},
"Resource": [
{
"Fn::GetAtt": [
"testcloudfronts3cmkencryptionkeyCloudfrontLoggingBucketAccessLog8863921C",
"Arn"
]
},
{
"Fn::Join": [
"",
[
{
"Fn::GetAtt": [
"testcloudfronts3cmkencryptionkeyCloudfrontLoggingBucketAccessLog8863921C",
"Arn"
]
},
"/*"
]
]
}
]
},
{
"Action": "s3:PutObject",
"Condition": {
"ArnLike": {
"aws:SourceArn": {
"Fn::GetAtt": [
"testcloudfronts3cmkencryptionkeyCloudfrontLoggingBucket7C1787CD",
"Arn"
]
}
},
"StringEquals": {
"aws:SourceAccount": {
"Ref": "AWS::AccountId"
}
}
},
"Effect": "Allow",
"Principal": {
"Service": "logging.s3.amazonaws.com"
},
"Resource": {
"Fn::Join": [
"",
[
{
"Fn::GetAtt": [
"testcloudfronts3cmkencryptionkeyCloudfrontLoggingBucketAccessLog8863921C",
"Arn"
]
},
"/*"
]
]
}
}
],
"Version": "2012-10-17"
}
}
},
"testcloudfronts3cmkencryptionkeyCloudfrontLoggingBucketAccessLogAutoDeleteObjectsCustomResource4FF8A4C5": {
"Type": "Custom::S3AutoDeleteObjects",
"Properties": {
"ServiceToken": {
"Fn::GetAtt": [
"CustomS3AutoDeleteObjectsCustomResourceProviderHandler9D90184F",
"Arn"
]
},
"BucketName": {
"Ref": "testcloudfronts3cmkencryptionkeyCloudfrontLoggingBucketAccessLog8863921C"
}
},
"DependsOn": [
"testcloudfronts3cmkencryptionkeyCloudfrontLoggingBucketAccessLogPolicy8F931BD7"
],
"UpdateReplacePolicy": "Delete",
"DeletionPolicy": "Delete"
},
"testcloudfronts3cmkencryptionkeyCloudfrontLoggingBucket7C1787CD": {
"Type": "AWS::S3::Bucket",
"Properties": {
"AccessControl": "LogDeliveryWrite",
"BucketEncryption": {
"ServerSideEncryptionConfiguration": [
{
"ServerSideEncryptionByDefault": {
"SSEAlgorithm": "AES256"
}
}
]
},
"LoggingConfiguration": {
"DestinationBucketName": {
"Ref": "testcloudfronts3cmkencryptionkeyCloudfrontLoggingBucketAccessLog8863921C"
}
},
"OwnershipControls": {
"Rules": [
{
"ObjectOwnership": "ObjectWriter"
}
]
},
"PublicAccessBlockConfiguration": {
"BlockPublicAcls": true,
"BlockPublicPolicy": true,
"IgnorePublicAcls": true,
"RestrictPublicBuckets": true
},
"Tags": [
{
"Key": "aws-cdk:auto-delete-objects",
"Value": "true"
}
],
"VersioningConfiguration": {
"Status": "Enabled"
}
},
"UpdateReplacePolicy": "Delete",
"DeletionPolicy": "Delete"
},
"testcloudfronts3cmkencryptionkeyCloudfrontLoggingBucketPolicy5E737735": {
"Type": "AWS::S3::BucketPolicy",
"Properties": {
"Bucket": {
"Ref": "testcloudfronts3cmkencryptionkeyCloudfrontLoggingBucket7C1787CD"
},
"PolicyDocument": {
"Statement": [
{
"Action": "s3:*",
"Condition": {
"Bool": {
"aws:SecureTransport": "false"
}
},
"Effect": "Deny",
"Principal": {
"AWS": "*"
},
"Resource": [
{
"Fn::GetAtt": [
"testcloudfronts3cmkencryptionkeyCloudfrontLoggingBucket7C1787CD",
"Arn"
]
},
{
"Fn::Join": [
"",
[
{
"Fn::GetAtt": [
"testcloudfronts3cmkencryptionkeyCloudfrontLoggingBucket7C1787CD",
"Arn"
]
},
"/*"
]
]
}
]
},
{
"Action": [
"s3:DeleteObject*",
"s3:GetBucket*",
"s3:List*",
"s3:PutBucketPolicy"
],
"Effect": "Allow",
"Principal": {
"AWS": {
"Fn::GetAtt": [
"CustomS3AutoDeleteObjectsCustomResourceProviderRole3B1BD092",
"Arn"
]
}
},
"Resource": [
{
"Fn::GetAtt": [
"testcloudfronts3cmkencryptionkeyCloudfrontLoggingBucket7C1787CD",
"Arn"
]
},
{
"Fn::Join": [
"",
[
{
"Fn::GetAtt": [
"testcloudfronts3cmkencryptionkeyCloudfrontLoggingBucket7C1787CD",
"Arn"
]
},
"/*"
]
]
}
]
}
],
"Version": "2012-10-17"
}
}
},
"testcloudfronts3cmkencryptionkeyCloudfrontLoggingBucketAutoDeleteObjectsCustomResourceB088BCC7": {
"Type": "Custom::S3AutoDeleteObjects",
"Properties": {
"ServiceToken": {
"Fn::GetAtt": [
"CustomS3AutoDeleteObjectsCustomResourceProviderHandler9D90184F",
"Arn"
]
},
"BucketName": {
"Ref": "testcloudfronts3cmkencryptionkeyCloudfrontLoggingBucket7C1787CD"
}
},
"DependsOn": [
"testcloudfronts3cmkencryptionkeyCloudfrontLoggingBucketPolicy5E737735"
],
"UpdateReplacePolicy": "Delete",
"DeletionPolicy": "Delete"
},
"testcloudfronts3cmkencryptionkeyCloudFrontOac4EFECBD9": {
"Type": "AWS::CloudFront::OriginAccessControl",
"Properties": {
"OriginAccessControlConfig": {
"Description": "Origin access control provisioned by aws-cloudfront-s3",
"Name": {
"Fn::Join": [
"",
[
"aws-cloudfront-s3-testn-key-",
{
"Fn::Select": [
2,
{
"Fn::Split": [
"/",
{
"Ref": "AWS::StackId"
}
]
}
]
}
]
]
},
"OriginAccessControlOriginType": "s3",
"SigningBehavior": "always",
"SigningProtocol": "sigv4"
}
}
},
"testcloudfronts3cmkencryptionkeyCloudFrontDistribution57C8A907": {
"Type": "AWS::CloudFront::Distribution",
"Properties": {
"DistributionConfig": {
"DefaultCacheBehavior": {
"CachePolicyId": "658327ea-f89d-4fab-a63d-7e88639e58f6",
"Compress": true,
"TargetOriginId": "cfts3cmkprovidedasbucketproptestcloudfronts3cmkencryptionkeyCloudFrontDistributionOrigin1FA4541E3",
"ViewerProtocolPolicy": "redirect-to-https"
},
"DefaultRootObject": "index.html",
"Enabled": true,
"HttpVersion": "http2",
"IPV6Enabled": true,
"Logging": {
"Bucket": {
"Fn::GetAtt": [
"testcloudfronts3cmkencryptionkeyCloudfrontLoggingBucket7C1787CD",
"RegionalDomainName"
]
}
},
"Origins": [
{
"DomainName": {
"Fn::GetAtt": [
"testcloudfronts3cmkencryptionkeyS3Bucket0E74E5D2",
"RegionalDomainName"
]
},
"Id": "cfts3cmkprovidedasbucketproptestcloudfronts3cmkencryptionkeyCloudFrontDistributionOrigin1FA4541E3",
"OriginAccessControlId": {
"Fn::GetAtt": [
"testcloudfronts3cmkencryptionkeyCloudFrontOac4EFECBD9",
"Id"
]
},
"S3OriginConfig": {
"OriginAccessIdentity": ""
}
}
]
}
},
"Metadata": {
"cfn_nag": {
"rules_to_suppress": [
{
"id": "W70",
"reason": "Since the distribution uses the CloudFront domain name, CloudFront automatically sets the security policy to TLSv1 regardless of the value of MinimumProtocolVersion"
}
]
}
}
},
"testcloudfronts3cmkencryptionkeyLambdaFunctionServiceRole85783D1D": {
"Type": "AWS::IAM::Role",
"Properties": {
"AssumeRolePolicyDocument": {
"Statement": [
{
"Action": "sts:AssumeRole",
"Effect": "Allow",
"Principal": {
"Service": "lambda.amazonaws.com"
}
}
],
"Version": "2012-10-17"
},
"Policies": [
{
"PolicyDocument": {
"Statement": [
{
"Action": [
"logs:CreateLogGroup",
"logs:CreateLogStream",
"logs:PutLogEvents"
],
"Effect": "Allow",
"Resource": {
"Fn::Join": [
"",
[
"arn:",
{
"Ref": "AWS::Partition"
},
":logs:",
{
"Ref": "AWS::Region"
},
":",
{
"Ref": "AWS::AccountId"
},
":log-group:/aws/lambda/*"
]
]
}
}
],
"Version": "2012-10-17"
},
"PolicyName": "LambdaFunctionServiceRolePolicy"
}
]
},
"Metadata": {
"guard": {
"SuppressedRules": [
"IAM_NO_INLINE_POLICY_CHECK"
]
}
}
},
"testcloudfronts3cmkencryptionkeyLambdaFunction4DCD662E": {
"Type": "AWS::Lambda::Function",
"Properties": {
"Code": {
"S3Bucket": {
"Fn::Sub": "cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}"
},
"S3Key": "e97825c838d70ceb13ba2f6223a7d94ed35687b70bfb224a0b9128e698e3f28e.zip"
},
"Description": "Custom resource function that updates a provided key policy to allow CloudFront access.",
"Environment": {
"Variables": {
"AWS_NODEJS_CONNECTION_REUSE_ENABLED": "1"
}
},
"Handler": "index.handler",
"Role": {
"Fn::GetAtt": [
"testcloudfronts3cmkencryptionkeyLambdaFunctionServiceRole85783D1D",
"Arn"
]
},
"Runtime": "nodejs22.x",
"TracingConfig": {
"Mode": "Active"
}
},
"DependsOn": [
"testcloudfronts3cmkencryptionkeyLambdaFunctionServiceRole85783D1D"
],
"Metadata": {
"cfn_nag": {
"rules_to_suppress": [
{
"id": "W58",
"reason": "Lambda functions has the required permission to write CloudWatch Logs. It uses custom policy instead of arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole with tighter permissions."
},
{
"id": "W89",
"reason": "This is not a rule for the general case, just for specific use cases/industries"
},
{
"id": "W92",
"reason": "Impossible for us to define the correct concurrency for clients"
}
]
}
}
},
"testcloudfronts3cmkencryptionkeyLambdaFunctioninlinePolicyAddedToExecutionRole030BCEDF3": {
"Type": "AWS::IAM::Policy",
"Properties": {
"PolicyDocument": {
"Statement": [
{
"Action": [
"xray:PutTelemetryRecords",
"xray:PutTraceSegments"
],
"Effect": "Allow",
"Resource": "*"
}
],
"Version": "2012-10-17"
},
"PolicyName": "testcloudfronts3cmkencryptionkeyLambdaFunctioninlinePolicyAddedToExecutionRole030BCEDF3",
"Roles": [
{
"Ref": "testcloudfronts3cmkencryptionkeyLambdaFunctionServiceRole85783D1D"
}
]
}
},
"testcloudfronts3cmkencryptionkeytestcloudfronts3cmkencryptionkeyResourceCmkPolicyBD4BA975": {
"Type": "AWS::IAM::Policy",
"Properties": {
"PolicyDocument": {
"Statement": [
{
"Action": [
"kms:DescribeKey",
"kms:GetKeyPolicy",
"kms:PutKeyPolicy"
],
"Effect": "Allow",
"Resource": {
"Fn::GetAtt": [
"cmkKey598B20B2",
"Arn"
]
}
}
],
"Version": "2012-10-17"
},
"PolicyName": "testcloudfronts3cmkencryptionkeytestcloudfronts3cmkencryptionkeyResourceCmkPolicyBD4BA975",
"Roles": [
{
"Ref": "testcloudfronts3cmkencryptionkeyLambdaFunctionServiceRole85783D1D"
}
]
}
},
"testcloudfronts3cmkencryptionkeyKmsKeyPolicyUpdateProviderframeworkonEventServiceRole3D4040AD": {
"Type": "AWS::IAM::Role",
"Properties": {
"AssumeRolePolicyDocument": {
"Statement": [
{
"Action": "sts:AssumeRole",
"Effect": "Allow",
"Principal": {
"Service": "lambda.amazonaws.com"
}
}
],
"Version": "2012-10-17"
},
"ManagedPolicyArns": [
{
"Fn::Join": [
"",
[
"arn:",
{
"Ref": "AWS::Partition"
},
":iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"
]
]
}
]
}
},
"testcloudfronts3cmkencryptionkeyKmsKeyPolicyUpdateProviderframeworkonEventServiceRoleDefaultPolicy066CD751": {
"Type": "AWS::IAM::Policy",
"Properties": {
"PolicyDocument": {
"Statement": [
{
"Action": "lambda:InvokeFunction",
"Effect": "Allow",
"Resource": [
{
"Fn::GetAtt": [
"testcloudfronts3cmkencryptionkeyLambdaFunction4DCD662E",
"Arn"
]
},
{
"Fn::Join": [
"",
[
{
"Fn::GetAtt": [
"testcloudfronts3cmkencryptionkeyLambdaFunction4DCD662E",
"Arn"
]
},
":*"
]
]
}
]
}
],
"Version": "2012-10-17"
},
"PolicyName": "testcloudfronts3cmkencryptionkeyKmsKeyPolicyUpdateProviderframeworkonEventServiceRoleDefaultPolicy066CD751",
"Roles": [
{
"Ref": "testcloudfronts3cmkencryptionkeyKmsKeyPolicyUpdateProviderframeworkonEventServiceRole3D4040AD"
}
]
}
},
"testcloudfronts3cmkencryptionkeyKmsKeyPolicyUpdateProviderframeworkonEvent8BCBFC59": {
"Type": "AWS::Lambda::Function",
"Properties": {
"Code": {
"S3Bucket": {
"Fn::Sub": "cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}"
},
"S3Key": "bdc104ed9cab1b5b6421713c8155f0b753380595356f710400609664d3635eca.zip"
},
"Description": "AWS CDK resource provider framework - onEvent (cfts3-cmk-provided-as-bucket-prop/test-cloudfront-s3-cmk-encryption-key/KmsKeyPolicyUpdateProvider)",
"Environment": {
"Variables": {
"USER_ON_EVENT_FUNCTION_ARN": {
"Fn::GetAtt": [
"testcloudfronts3cmkencryptionkeyLambdaFunction4DCD662E",
"Arn"
]
}
}
},
"Handler": "framework.onEvent",
"LoggingConfig": {
"ApplicationLogLevel": "FATAL",
"LogFormat": "JSON"
},
"Role": {
"Fn::GetAtt": [
"testcloudfronts3cmkencryptionkeyKmsKeyPolicyUpdateProviderframeworkonEventServiceRole3D4040AD",
"Arn"
]
},
"Runtime": "nodejs22.x",
"Timeout": 900
},
"DependsOn": [
"testcloudfronts3cmkencryptionkeyKmsKeyPolicyUpdateProviderframeworkonEventServiceRoleDefaultPolicy066CD751",
"testcloudfronts3cmkencryptionkeyKmsKeyPolicyUpdateProviderframeworkonEventServiceRole3D4040AD"
],
"Metadata": {
"cfn_nag": {
"rules_to_suppress": [
{
"id": "W58",
"reason": "The CDK-provided lambda function that backs their Custom Resource Provider framework has an IAM role with the arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole Managed Policy attached, which grants permission to write to CloudWatch Logs"
},
{
"id": "W89",
"reason": "The CDK-provided lambda function that backs their Custom Resource Provider framework does not access VPC resources"
},
{
"id": "W92",
"reason": "The CDK-provided lambda function that backs their Custom Resource Provider framework does not define ReservedConcurrentExecutions"
}
]
}
}
},
"testcloudfronts3cmkencryptionkeyKmsKeyPolicyUpdateProviderframeworkonEventinlinePolicyAddedToExecutionRole0055AB010": {
"Type": "AWS::IAM::Policy",
"Properties": {
"PolicyDocument": {
"Statement": [
{
"Action": "lambda:GetFunction",
"Effect": "Allow",
"Resource": {
"Fn::GetAtt": [
"testcloudfronts3cmkencryptionkeyLambdaFunction4DCD662E",
"Arn"
]
}
}
],
"Version": "2012-10-17"
},
"PolicyName": "testcloudfronts3cmkencryptionkeyKmsKeyPolicyUpdateProviderframeworkonEventinlinePolicyAddedToExecutionRole0055AB010",
"Roles": [
{
"Ref": "testcloudfronts3cmkencryptionkeyKmsKeyPolicyUpdateProviderframeworkonEventServiceRole3D4040AD"
}
]
}
},
"testcloudfronts3cmkencryptionkeyKmsKeyPolicyUpdaterFAFEBF0F": {
"Type": "Custom::KmsKeyPolicyUpdater",
"Properties": {
"ServiceToken": {
"Fn::GetAtt": [
"testcloudfronts3cmkencryptionkeyKmsKeyPolicyUpdateProviderframeworkonEvent8BCBFC59",
"Arn"
]
},
"KmsKeyId": {
"Ref": "cmkKey598B20B2"
},
"CloudFrontDistributionId": {
"Ref": "testcloudfronts3cmkencryptionkeyCloudFrontDistribution57C8A907"
},
"AccountId": {
"Ref": "AWS::AccountId"
}
},
"UpdateReplacePolicy": "Delete",
"DeletionPolicy": "Delete"
},
"CustomS3AutoDeleteObjectsCustomResourceProviderRole3B1BD092": {
"Type": "AWS::IAM::Role",
"Properties": {
"AssumeRolePolicyDocument": {
"Version": "2012-10-17",
"Statement": [
{
"Action": "sts:AssumeRole",
"Effect": "Allow",
"Principal": {
"Service": "lambda.amazonaws.com"
}
}
]
},
"ManagedPolicyArns": [
{
"Fn::Sub": "arn:${AWS::Partition}:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"
}
]
}
},
"CustomS3AutoDeleteObjectsCustomResourceProviderHandler9D90184F": {
"Type": "AWS::Lambda::Function",
"Properties": {
"Code": {
"S3Bucket": {
"Fn::Sub": "cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}"
},
"S3Key": "faa95a81ae7d7373f3e1f242268f904eb748d8d0fdd306e8a6fe515a1905a7d6.zip"
},
"Timeout": 900,
"MemorySize": 128,
"Handler": "index.handler",
"Role": {
"Fn::GetAtt": [
"CustomS3AutoDeleteObjectsCustomResourceProviderRole3B1BD092",
"Arn"
]
},
"Runtime": "nodejs22.x",
"Description": {
"Fn::Join": [
"",
[
"Lambda function for auto-deleting objects in ",
{
"Ref": "testcloudfronts3cmkencryptionkeyS3LoggingBucket5CE52209"
},
" S3 bucket."
]
]
}
},
"DependsOn": [
"CustomS3AutoDeleteObjectsCustomResourceProviderRole3B1BD092"
],
"Metadata": {
"cfn_nag": {
"rules_to_suppress": [
{
"id": "W58",
"reason": "CDK generated custom resource"
},
{
"id": "W89",
"reason": "CDK generated custom resource"
},
{
"id": "W92",
"reason": "CDK generated custom resource"
}
]
}
}
}
},
"Parameters": {
"BootstrapVersion": {
"Type": "AWS::SSM::Parameter::Value<String>",
"Default": "/cdk-bootstrap/hnb659fds/version",
"Description": "Version of the CDK Bootstrap resources in this environment, automatically retrieved from SSM Parameter Store. [cdk:skip]"
}
},
"Rules": {
"CheckBootstrapVersion": {
"Assertions": [
{
"Assert": {
"Fn::Not": [
{
"Fn::Contains": [
[
"1",
"2",
"3",
"4",
"5"
],
{
"Ref": "BootstrapVersion"
}
]
}
]
},
"AssertDescription": "CDK bootstrap stack version 6 required. Please run 'cdk bootstrap' with a recent version of the CDK CLI."
}
]
}
}
}