@aws-solutions-constructs/aws-kinesisstreams-kinesisfirehose-s3
Version:
CDK constructs for defining an interaction between an Amazon Kinesis Data Stream (KDS), Amazon Kinesis Data Firehose (KDF) delivery stream and an Amazon S3 bucket.
836 lines • 18.8 kB
JSON
{
"Resources": {
"testkinesisfirehoses3KinesisStreamA5D50D48": {
"Type": "AWS::Kinesis::Stream",
"Properties": {
"RetentionPeriodHours": 24,
"ShardCount": 1,
"StreamEncryption": {
"EncryptionType": "KMS",
"KeyId": "alias/aws/kinesis"
}
},
"UpdateReplacePolicy": "Retain",
"DeletionPolicy": "Retain"
},
"testkinesisfirehoses3KinesisFirehoseToS3S3LoggingBucketCF5B8A5C": {
"Type": "AWS::S3::Bucket",
"Properties": {
"BucketEncryption": {
"ServerSideEncryptionConfiguration": [
{
"ServerSideEncryptionByDefault": {
"SSEAlgorithm": "AES256"
}
}
]
},
"LifecycleConfiguration": {
"Rules": [
{
"Status": "Enabled",
"Transitions": [
{
"StorageClass": "GLACIER",
"TransitionInDays": 7
}
]
}
]
},
"PublicAccessBlockConfiguration": {
"BlockPublicAcls": true,
"BlockPublicPolicy": true,
"IgnorePublicAcls": true,
"RestrictPublicBuckets": true
},
"Tags": [
{
"Key": "aws-cdk:auto-delete-objects",
"Value": "true"
}
],
"VersioningConfiguration": {
"Status": "Enabled"
}
},
"UpdateReplacePolicy": "Delete",
"DeletionPolicy": "Delete",
"Metadata": {
"cfn_nag": {
"rules_to_suppress": [
{
"id": "W35",
"reason": "This S3 bucket is used as the access logging bucket for another bucket"
}
]
}
}
},
"testkinesisfirehoses3KinesisFirehoseToS3S3LoggingBucketPolicyCF0D71BD": {
"Type": "AWS::S3::BucketPolicy",
"Properties": {
"Bucket": {
"Ref": "testkinesisfirehoses3KinesisFirehoseToS3S3LoggingBucketCF5B8A5C"
},
"PolicyDocument": {
"Statement": [
{
"Action": "s3:*",
"Condition": {
"Bool": {
"aws:SecureTransport": "false"
}
},
"Effect": "Deny",
"Principal": {
"AWS": "*"
},
"Resource": [
{
"Fn::GetAtt": [
"testkinesisfirehoses3KinesisFirehoseToS3S3LoggingBucketCF5B8A5C",
"Arn"
]
},
{
"Fn::Join": [
"",
[
{
"Fn::GetAtt": [
"testkinesisfirehoses3KinesisFirehoseToS3S3LoggingBucketCF5B8A5C",
"Arn"
]
},
"/*"
]
]
}
]
},
{
"Action": [
"s3:DeleteObject*",
"s3:GetBucket*",
"s3:List*",
"s3:PutBucketPolicy"
],
"Effect": "Allow",
"Principal": {
"AWS": {
"Fn::GetAtt": [
"CustomS3AutoDeleteObjectsCustomResourceProviderRole3B1BD092",
"Arn"
]
}
},
"Resource": [
{
"Fn::GetAtt": [
"testkinesisfirehoses3KinesisFirehoseToS3S3LoggingBucketCF5B8A5C",
"Arn"
]
},
{
"Fn::Join": [
"",
[
{
"Fn::GetAtt": [
"testkinesisfirehoses3KinesisFirehoseToS3S3LoggingBucketCF5B8A5C",
"Arn"
]
},
"/*"
]
]
}
]
},
{
"Action": "s3:PutObject",
"Condition": {
"ArnLike": {
"aws:SourceArn": {
"Fn::GetAtt": [
"testkinesisfirehoses3KinesisFirehoseToS3S3Bucket303877FF",
"Arn"
]
}
},
"StringEquals": {
"aws:SourceAccount": {
"Ref": "AWS::AccountId"
}
}
},
"Effect": "Allow",
"Principal": {
"Service": "logging.s3.amazonaws.com"
},
"Resource": {
"Fn::Join": [
"",
[
{
"Fn::GetAtt": [
"testkinesisfirehoses3KinesisFirehoseToS3S3LoggingBucketCF5B8A5C",
"Arn"
]
},
"/*"
]
]
}
}
],
"Version": "2012-10-17"
}
}
},
"testkinesisfirehoses3KinesisFirehoseToS3S3LoggingBucketAutoDeleteObjectsCustomResourceB808B0FC": {
"Type": "Custom::S3AutoDeleteObjects",
"Properties": {
"ServiceToken": {
"Fn::GetAtt": [
"CustomS3AutoDeleteObjectsCustomResourceProviderHandler9D90184F",
"Arn"
]
},
"BucketName": {
"Ref": "testkinesisfirehoses3KinesisFirehoseToS3S3LoggingBucketCF5B8A5C"
}
},
"DependsOn": [
"testkinesisfirehoses3KinesisFirehoseToS3S3LoggingBucketPolicyCF0D71BD"
],
"UpdateReplacePolicy": "Delete",
"DeletionPolicy": "Delete"
},
"testkinesisfirehoses3KinesisFirehoseToS3S3Bucket303877FF": {
"Type": "AWS::S3::Bucket",
"Properties": {
"BucketEncryption": {
"ServerSideEncryptionConfiguration": [
{
"ServerSideEncryptionByDefault": {
"SSEAlgorithm": "AES256"
}
}
]
},
"LifecycleConfiguration": {
"Rules": [
{
"NoncurrentVersionTransitions": [
{
"StorageClass": "GLACIER",
"TransitionInDays": 90
}
],
"Status": "Enabled"
}
]
},
"LoggingConfiguration": {
"DestinationBucketName": {
"Ref": "testkinesisfirehoses3KinesisFirehoseToS3S3LoggingBucketCF5B8A5C"
}
},
"PublicAccessBlockConfiguration": {
"BlockPublicAcls": true,
"BlockPublicPolicy": true,
"IgnorePublicAcls": true,
"RestrictPublicBuckets": true
},
"VersioningConfiguration": {
"Status": "Enabled"
}
},
"UpdateReplacePolicy": "Delete",
"DeletionPolicy": "Delete"
},
"testkinesisfirehoses3KinesisFirehoseToS3S3BucketPolicy46BDB29D": {
"Type": "AWS::S3::BucketPolicy",
"Properties": {
"Bucket": {
"Ref": "testkinesisfirehoses3KinesisFirehoseToS3S3Bucket303877FF"
},
"PolicyDocument": {
"Statement": [
{
"Action": "s3:*",
"Condition": {
"Bool": {
"aws:SecureTransport": "false"
}
},
"Effect": "Deny",
"Principal": {
"AWS": "*"
},
"Resource": [
{
"Fn::GetAtt": [
"testkinesisfirehoses3KinesisFirehoseToS3S3Bucket303877FF",
"Arn"
]
},
{
"Fn::Join": [
"",
[
{
"Fn::GetAtt": [
"testkinesisfirehoses3KinesisFirehoseToS3S3Bucket303877FF",
"Arn"
]
},
"/*"
]
]
}
]
}
],
"Version": "2012-10-17"
}
}
},
"testkinesisfirehoses3KinesisFirehoseToS3firehoseloggroupDDB24FE5": {
"Type": "AWS::Logs::LogGroup",
"UpdateReplacePolicy": "Delete",
"DeletionPolicy": "Delete",
"Metadata": {
"cfn_nag": {
"rules_to_suppress": [
{
"id": "W86",
"reason": "Retention period for CloudWatchLogs LogGroups are set to 'Never Expire' to preserve customer data indefinitely"
},
{
"id": "W84",
"reason": "By default CloudWatchLogs LogGroups data is encrypted using the CloudWatch server-side encryption keys (AWS Managed Keys)"
}
]
}
}
},
"testkinesisfirehoses3KinesisFirehoseToS3firehoseloggroupfirehoselogstreamEC0EA660": {
"Type": "AWS::Logs::LogStream",
"Properties": {
"LogGroupName": {
"Ref": "testkinesisfirehoses3KinesisFirehoseToS3firehoseloggroupDDB24FE5"
}
},
"UpdateReplacePolicy": "Retain",
"DeletionPolicy": "Retain"
},
"testkinesisfirehoses3KinesisFirehoseToS3KinesisFirehoseRole18870C08": {
"Type": "AWS::IAM::Role",
"Properties": {
"AssumeRolePolicyDocument": {
"Statement": [
{
"Action": "sts:AssumeRole",
"Effect": "Allow",
"Principal": {
"Service": "firehose.amazonaws.com"
}
}
],
"Version": "2012-10-17"
}
},
"Metadata": {
"guard": {
"SuppressedRules": [
"IAM_NO_INLINE_POLICY_CHECK"
]
}
}
},
"testkinesisfirehoses3KinesisFirehoseToS3KinesisFirehosePolicyD6A1BC51": {
"Type": "AWS::IAM::Policy",
"Properties": {
"PolicyDocument": {
"Statement": [
{
"Action": [
"s3:AbortMultipartUpload",
"s3:GetBucketLocation",
"s3:GetObject",
"s3:ListBucket",
"s3:ListBucketMultipartUploads",
"s3:PutObject"
],
"Effect": "Allow",
"Resource": [
{
"Fn::GetAtt": [
"testkinesisfirehoses3KinesisFirehoseToS3S3Bucket303877FF",
"Arn"
]
},
{
"Fn::Join": [
"",
[
{
"Fn::GetAtt": [
"testkinesisfirehoses3KinesisFirehoseToS3S3Bucket303877FF",
"Arn"
]
},
"/*"
]
]
}
]
},
{
"Action": "logs:PutLogEvents",
"Effect": "Allow",
"Resource": {
"Fn::Join": [
"",
[
"arn:",
{
"Ref": "AWS::Partition"
},
":logs:",
{
"Ref": "AWS::Region"
},
":",
{
"Ref": "AWS::AccountId"
},
":log-group:",
{
"Ref": "testkinesisfirehoses3KinesisFirehoseToS3firehoseloggroupDDB24FE5"
},
":log-stream:",
{
"Ref": "testkinesisfirehoses3KinesisFirehoseToS3firehoseloggroupfirehoselogstreamEC0EA660"
}
]
]
}
}
],
"Version": "2012-10-17"
},
"PolicyName": "testkinesisfirehoses3KinesisFirehoseToS3KinesisFirehosePolicyD6A1BC51",
"Roles": [
{
"Ref": "testkinesisfirehoses3KinesisFirehoseToS3KinesisFirehoseRole18870C08"
}
]
}
},
"testkinesisfirehoses3KinesisFirehoseToS3KinesisFirehoseEB65C83D": {
"Type": "AWS::KinesisFirehose::DeliveryStream",
"Properties": {
"DeliveryStreamName": "KinesisFirehosekinfhss3customLogoses3KinesisFirehoseToS397A96F65",
"DeliveryStreamType": "KinesisStreamAsSource",
"ExtendedS3DestinationConfiguration": {
"BucketARN": {
"Fn::GetAtt": [
"testkinesisfirehoses3KinesisFirehoseToS3S3Bucket303877FF",
"Arn"
]
},
"BufferingHints": {
"IntervalInSeconds": 300,
"SizeInMBs": 5
},
"CloudWatchLoggingOptions": {
"Enabled": true,
"LogGroupName": {
"Ref": "testkinesisfirehoses3KinesisFirehoseToS3firehoseloggroupDDB24FE5"
},
"LogStreamName": {
"Ref": "testkinesisfirehoses3KinesisFirehoseToS3firehoseloggroupfirehoselogstreamEC0EA660"
}
},
"CompressionFormat": "GZIP",
"EncryptionConfiguration": {
"KMSEncryptionConfig": {
"AWSKMSKeyARN": {
"Fn::Join": [
"",
[
"arn:",
{
"Ref": "AWS::Partition"
},
":kms:",
{
"Ref": "AWS::Region"
},
":",
{
"Ref": "AWS::AccountId"
},
":alias/aws/s3"
]
]
}
}
},
"RoleARN": {
"Fn::GetAtt": [
"testkinesisfirehoses3KinesisFirehoseToS3KinesisFirehoseRole18870C08",
"Arn"
]
}
},
"KinesisStreamSourceConfiguration": {
"KinesisStreamARN": {
"Fn::GetAtt": [
"testkinesisfirehoses3KinesisStreamA5D50D48",
"Arn"
]
},
"RoleARN": {
"Fn::GetAtt": [
"KinesisStreamsRole2BFD39A5",
"Arn"
]
}
}
},
"Metadata": {
"guard": {
"SuppressedRules": [
"KINESIS_FIREHOSE_REDSHIFT_DESTINATION_CONFIGURATION_NO_PLAINTEXT_PASSWORD",
"KINESIS_FIREHOSE_SPLUNK_DESTINATION_CONFIGURATION_NO_PLAINTEXT_PASSWORD"
]
}
}
},
"testkinesisfirehoses3KinesisStreamGetRecordsIteratorAgeAlarm52FF77D1": {
"Type": "AWS::CloudWatch::Alarm",
"Properties": {
"AlarmDescription": "Consumer Record Processing Falling Behind, there is risk for data loss due to record expiration.",
"ComparisonOperator": "GreaterThanOrEqualToThreshold",
"EvaluationPeriods": 1,
"MetricName": "GetRecords.IteratorAgeMilliseconds",
"Namespace": "AWS/Kinesis",
"Period": 300,
"Statistic": "Maximum",
"Threshold": 43200000
}
},
"testkinesisfirehoses3KinesisStreamReadProvisionedThroughputExceededAlarm4A9C6943": {
"Type": "AWS::CloudWatch::Alarm",
"Properties": {
"AlarmDescription": "Consumer Application is Reading at a Slower Rate Than Expected.",
"ComparisonOperator": "GreaterThanThreshold",
"EvaluationPeriods": 1,
"MetricName": "ReadProvisionedThroughputExceeded",
"Namespace": "AWS/Kinesis",
"Period": 300,
"Statistic": "Average",
"Threshold": 0
}
},
"KinesisStreamsRole2BFD39A5": {
"Type": "AWS::IAM::Role",
"Properties": {
"AssumeRolePolicyDocument": {
"Statement": [
{
"Action": "sts:AssumeRole",
"Effect": "Allow",
"Principal": {
"Service": "firehose.amazonaws.com"
}
}
],
"Version": "2012-10-17"
},
"Policies": [
{
"PolicyDocument": {
"Statement": [
{
"Action": [
"kinesis:DescribeStream",
"kinesis:GetRecords",
"kinesis:GetShardIterator",
"kinesis:ListShards"
],
"Effect": "Allow",
"Resource": {
"Fn::GetAtt": [
"testkinesisfirehoses3KinesisStreamA5D50D48",
"Arn"
]
}
}
],
"Version": "2012-10-17"
},
"PolicyName": "KinesisStreamsRoleRolePolicy"
}
]
},
"Metadata": {
"guard": {
"SuppressedRules": [
"IAM_NO_INLINE_POLICY_CHECK"
]
}
}
},
"CustomS3AutoDeleteObjectsCustomResourceProviderRole3B1BD092": {
"Type": "AWS::IAM::Role",
"Properties": {
"AssumeRolePolicyDocument": {
"Version": "2012-10-17",
"Statement": [
{
"Action": "sts:AssumeRole",
"Effect": "Allow",
"Principal": {
"Service": "lambda.amazonaws.com"
}
}
]
},
"ManagedPolicyArns": [
{
"Fn::Sub": "arn:${AWS::Partition}:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"
}
]
}
},
"CustomS3AutoDeleteObjectsCustomResourceProviderHandler9D90184F": {
"Type": "AWS::Lambda::Function",
"Properties": {
"Code": {
"S3Bucket": {
"Fn::Sub": "cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}"
},
"S3Key": "faa95a81ae7d7373f3e1f242268f904eb748d8d0fdd306e8a6fe515a1905a7d6.zip"
},
"Timeout": 900,
"MemorySize": 128,
"Handler": "index.handler",
"Role": {
"Fn::GetAtt": [
"CustomS3AutoDeleteObjectsCustomResourceProviderRole3B1BD092",
"Arn"
]
},
"Runtime": {
"Fn::FindInMap": [
"LatestNodeRuntimeMap",
{
"Ref": "AWS::Region"
},
"value"
]
},
"Description": {
"Fn::Join": [
"",
[
"Lambda function for auto-deleting objects in ",
{
"Ref": "testkinesisfirehoses3KinesisFirehoseToS3S3LoggingBucketCF5B8A5C"
},
" S3 bucket."
]
]
}
},
"DependsOn": [
"CustomS3AutoDeleteObjectsCustomResourceProviderRole3B1BD092"
],
"Metadata": {
"cfn_nag": {
"rules_to_suppress": [
{
"id": "W58",
"reason": "CDK generated custom resource"
},
{
"id": "W89",
"reason": "CDK generated custom resource"
},
{
"id": "W92",
"reason": "CDK generated custom resource"
}
]
}
}
}
},
"Mappings": {
"LatestNodeRuntimeMap": {
"af-south-1": {
"value": "nodejs20.x"
},
"ap-east-1": {
"value": "nodejs20.x"
},
"ap-northeast-1": {
"value": "nodejs20.x"
},
"ap-northeast-2": {
"value": "nodejs20.x"
},
"ap-northeast-3": {
"value": "nodejs20.x"
},
"ap-south-1": {
"value": "nodejs20.x"
},
"ap-south-2": {
"value": "nodejs20.x"
},
"ap-southeast-1": {
"value": "nodejs20.x"
},
"ap-southeast-2": {
"value": "nodejs20.x"
},
"ap-southeast-3": {
"value": "nodejs20.x"
},
"ap-southeast-4": {
"value": "nodejs20.x"
},
"ap-southeast-5": {
"value": "nodejs20.x"
},
"ap-southeast-7": {
"value": "nodejs20.x"
},
"ca-central-1": {
"value": "nodejs20.x"
},
"ca-west-1": {
"value": "nodejs20.x"
},
"cn-north-1": {
"value": "nodejs20.x"
},
"cn-northwest-1": {
"value": "nodejs20.x"
},
"eu-central-1": {
"value": "nodejs20.x"
},
"eu-central-2": {
"value": "nodejs20.x"
},
"eu-isoe-west-1": {
"value": "nodejs18.x"
},
"eu-north-1": {
"value": "nodejs20.x"
},
"eu-south-1": {
"value": "nodejs20.x"
},
"eu-south-2": {
"value": "nodejs20.x"
},
"eu-west-1": {
"value": "nodejs20.x"
},
"eu-west-2": {
"value": "nodejs20.x"
},
"eu-west-3": {
"value": "nodejs20.x"
},
"il-central-1": {
"value": "nodejs20.x"
},
"me-central-1": {
"value": "nodejs20.x"
},
"me-south-1": {
"value": "nodejs20.x"
},
"mx-central-1": {
"value": "nodejs20.x"
},
"sa-east-1": {
"value": "nodejs20.x"
},
"us-east-1": {
"value": "nodejs20.x"
},
"us-east-2": {
"value": "nodejs20.x"
},
"us-gov-east-1": {
"value": "nodejs20.x"
},
"us-gov-west-1": {
"value": "nodejs20.x"
},
"us-iso-east-1": {
"value": "nodejs18.x"
},
"us-iso-west-1": {
"value": "nodejs18.x"
},
"us-isob-east-1": {
"value": "nodejs18.x"
},
"us-isob-west-1": {
"value": "nodejs18.x"
},
"us-west-1": {
"value": "nodejs20.x"
},
"us-west-2": {
"value": "nodejs20.x"
}
}
},
"Parameters": {
"BootstrapVersion": {
"Type": "AWS::SSM::Parameter::Value<String>",
"Default": "/cdk-bootstrap/hnb659fds/version",
"Description": "Version of the CDK Bootstrap resources in this environment, automatically retrieved from SSM Parameter Store. [cdk:skip]"
}
},
"Rules": {
"CheckBootstrapVersion": {
"Assertions": [
{
"Assert": {
"Fn::Not": [
{
"Fn::Contains": [
[
"1",
"2",
"3",
"4",
"5"
],
{
"Ref": "BootstrapVersion"
}
]
}
]
},
"AssertDescription": "CDK bootstrap stack version 6 required. Please run 'cdk bootstrap' with a recent version of the CDK CLI."
}
]
}
}
}