@aws-solutions-constructs/aws-kinesisstreams-kinesisfirehose-s3
Version:
CDK constructs for defining an interaction between an Amazon Kinesis Data Stream (KDS), Amazon Kinesis Data Firehose (KDF) delivery stream and an Amazon S3 bucket.
728 lines • 17.5 kB
JSON
{
"Description": "Integration Test for aws-kinesisstreams-kinesisfirehose-s3",
"Resources": {
"testkinesislambdaKinesisStream00F67958": {
"Type": "AWS::Kinesis::Stream",
"Properties": {
"RetentionPeriodHours": 24,
"ShardCount": 1,
"StreamEncryption": {
"EncryptionType": "KMS",
"KeyId": "alias/aws/kinesis"
}
},
"UpdateReplacePolicy": "Retain",
"DeletionPolicy": "Retain"
},
"testkinesislambdaLambdaFunctionServiceRole965E2A08": {
"Type": "AWS::IAM::Role",
"Properties": {
"AssumeRolePolicyDocument": {
"Statement": [
{
"Action": "sts:AssumeRole",
"Effect": "Allow",
"Principal": {
"Service": "lambda.amazonaws.com"
}
}
],
"Version": "2012-10-17"
},
"Policies": [
{
"PolicyDocument": {
"Statement": [
{
"Action": [
"logs:CreateLogGroup",
"logs:CreateLogStream",
"logs:PutLogEvents"
],
"Effect": "Allow",
"Resource": {
"Fn::Join": [
"",
[
"arn:",
{
"Ref": "AWS::Partition"
},
":logs:",
{
"Ref": "AWS::Region"
},
":",
{
"Ref": "AWS::AccountId"
},
":log-group:/aws/lambda/*"
]
]
}
}
],
"Version": "2012-10-17"
},
"PolicyName": "LambdaFunctionServiceRolePolicy"
}
]
},
"Metadata": {
"guard": {
"SuppressedRules": [
"IAM_NO_INLINE_POLICY_CHECK"
]
}
}
},
"testkinesislambdaLambdaFunctionServiceRoleDefaultPolicy6FF6B6A5": {
"Type": "AWS::IAM::Policy",
"Properties": {
"PolicyDocument": {
"Statement": [
{
"Action": [
"kinesis:DescribeStream",
"kinesis:DescribeStreamConsumer",
"kinesis:DescribeStreamSummary",
"kinesis:GetRecords",
"kinesis:GetShardIterator",
"kinesis:ListShards",
"kinesis:ListStreams",
"kinesis:SubscribeToShard"
],
"Effect": "Allow",
"Resource": {
"Fn::GetAtt": [
"testkinesislambdaKinesisStream00F67958",
"Arn"
]
}
},
{
"Action": [
"sqs:GetQueueAttributes",
"sqs:GetQueueUrl",
"sqs:SendMessage"
],
"Effect": "Allow",
"Resource": {
"Fn::GetAtt": [
"testkinesislambdaSqsDlqQueueA754ACEA",
"Arn"
]
}
}
],
"Version": "2012-10-17"
},
"PolicyName": "testkinesislambdaLambdaFunctionServiceRoleDefaultPolicy6FF6B6A5",
"Roles": [
{
"Ref": "testkinesislambdaLambdaFunctionServiceRole965E2A08"
}
]
}
},
"testkinesislambdaLambdaFunction7F18F840": {
"Type": "AWS::Lambda::Function",
"Properties": {
"Code": {
"S3Bucket": {
"Fn::Sub": "cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}"
},
"S3Key": "26cf7db64552331215006953bf73e5adfb49b5bf0eb2298bfe04547b76c08b88.zip"
},
"Environment": {
"Variables": {
"AWS_NODEJS_CONNECTION_REUSE_ENABLED": "1"
}
},
"Handler": "index.handler",
"Role": {
"Fn::GetAtt": [
"testkinesislambdaLambdaFunctionServiceRole965E2A08",
"Arn"
]
},
"Runtime": "nodejs20.x",
"TracingConfig": {
"Mode": "Active"
}
},
"DependsOn": [
"testkinesislambdaLambdaFunctionServiceRoleDefaultPolicy6FF6B6A5",
"testkinesislambdaLambdaFunctionServiceRole965E2A08"
],
"Metadata": {
"cfn_nag": {
"rules_to_suppress": [
{
"id": "W58",
"reason": "Lambda functions has the required permission to write CloudWatch Logs. It uses custom policy instead of arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole with tighter permissions."
},
{
"id": "W89",
"reason": "This is not a rule for the general case, just for specific use cases/industries"
},
{
"id": "W92",
"reason": "Impossible for us to define the correct concurrency for clients"
}
]
}
}
},
"testkinesislambdaLambdaFunctioninlinePolicyAddedToExecutionRole049F0C37A": {
"Type": "AWS::IAM::Policy",
"Properties": {
"PolicyDocument": {
"Statement": [
{
"Action": [
"xray:PutTelemetryRecords",
"xray:PutTraceSegments"
],
"Effect": "Allow",
"Resource": "*"
}
],
"Version": "2012-10-17"
},
"PolicyName": "testkinesislambdaLambdaFunctioninlinePolicyAddedToExecutionRole049F0C37A",
"Roles": [
{
"Ref": "testkinesislambdaLambdaFunctionServiceRole965E2A08"
}
]
}
},
"testkinesislambdaLambdaFunctionKinesisEventSourcekinfhss3existingStreamObjtestkinesislambdaKinesisStream06A6475B85130EBE": {
"Type": "AWS::Lambda::EventSourceMapping",
"Properties": {
"BatchSize": 100,
"BisectBatchOnFunctionError": true,
"DestinationConfig": {
"OnFailure": {
"Destination": {
"Fn::GetAtt": [
"testkinesislambdaSqsDlqQueueA754ACEA",
"Arn"
]
}
}
},
"EventSourceArn": {
"Fn::GetAtt": [
"testkinesislambdaKinesisStream00F67958",
"Arn"
]
},
"FunctionName": {
"Ref": "testkinesislambdaLambdaFunction7F18F840"
},
"MaximumRecordAgeInSeconds": 86400,
"MaximumRetryAttempts": 500,
"StartingPosition": "TRIM_HORIZON"
}
},
"testkinesislambdaSqsDlqQueueA754ACEA": {
"Type": "AWS::SQS::Queue",
"Properties": {
"KmsMasterKeyId": "alias/aws/sqs"
},
"UpdateReplacePolicy": "Delete",
"DeletionPolicy": "Delete"
},
"testkinesislambdaSqsDlqQueuePolicy38A92DE9": {
"Type": "AWS::SQS::QueuePolicy",
"Properties": {
"PolicyDocument": {
"Statement": [
{
"Action": [
"sqs:AddPermission",
"sqs:DeleteMessage",
"sqs:GetQueueAttributes",
"sqs:ReceiveMessage",
"sqs:RemovePermission",
"sqs:SendMessage",
"sqs:SetQueueAttributes"
],
"Effect": "Allow",
"Principal": {
"AWS": {
"Fn::Join": [
"",
[
"arn:",
{
"Ref": "AWS::Partition"
},
":iam::",
{
"Ref": "AWS::AccountId"
},
":root"
]
]
}
},
"Resource": {
"Fn::GetAtt": [
"testkinesislambdaSqsDlqQueueA754ACEA",
"Arn"
]
},
"Sid": "QueueOwnerOnlyAccess"
},
{
"Action": "SQS:*",
"Condition": {
"Bool": {
"aws:SecureTransport": "false"
}
},
"Effect": "Deny",
"Principal": {
"AWS": "*"
},
"Resource": {
"Fn::GetAtt": [
"testkinesislambdaSqsDlqQueueA754ACEA",
"Arn"
]
},
"Sid": "HttpsOnly"
}
],
"Version": "2012-10-17"
},
"Queues": [
{
"Ref": "testkinesislambdaSqsDlqQueueA754ACEA"
}
]
}
},
"testkinesislambdaKinesisStreamGetRecordsIteratorAgeAlarm99DB34B3": {
"Type": "AWS::CloudWatch::Alarm",
"Properties": {
"AlarmDescription": "Consumer Record Processing Falling Behind, there is risk for data loss due to record expiration.",
"ComparisonOperator": "GreaterThanOrEqualToThreshold",
"EvaluationPeriods": 1,
"MetricName": "GetRecords.IteratorAgeMilliseconds",
"Namespace": "AWS/Kinesis",
"Period": 300,
"Statistic": "Maximum",
"Threshold": 43200000
}
},
"testkinesislambdaKinesisStreamReadProvisionedThroughputExceededAlarmAE98686F": {
"Type": "AWS::CloudWatch::Alarm",
"Properties": {
"AlarmDescription": "Consumer Application is Reading at a Slower Rate Than Expected.",
"ComparisonOperator": "GreaterThanThreshold",
"EvaluationPeriods": 1,
"MetricName": "ReadProvisionedThroughputExceeded",
"Namespace": "AWS/Kinesis",
"Period": 300,
"Statistic": "Average",
"Threshold": 0
}
},
"testexistingstreamfirehoses3stackKinesisFirehoseToS3S3BucketF4CE72AB": {
"Type": "AWS::S3::Bucket",
"Properties": {
"BucketEncryption": {
"ServerSideEncryptionConfiguration": [
{
"ServerSideEncryptionByDefault": {
"SSEAlgorithm": "AES256"
}
}
]
},
"LifecycleConfiguration": {
"Rules": [
{
"NoncurrentVersionTransitions": [
{
"StorageClass": "GLACIER",
"TransitionInDays": 90
}
],
"Status": "Enabled"
}
]
},
"PublicAccessBlockConfiguration": {
"BlockPublicAcls": true,
"BlockPublicPolicy": true,
"IgnorePublicAcls": true,
"RestrictPublicBuckets": true
},
"VersioningConfiguration": {
"Status": "Enabled"
}
},
"UpdateReplacePolicy": "Delete",
"DeletionPolicy": "Delete",
"Metadata": {
"cfn_nag": {
"rules_to_suppress": [
{
"id": "W35",
"reason": "This S3 bucket is created for unit/ integration testing purposes only."
}
]
}
}
},
"testexistingstreamfirehoses3stackKinesisFirehoseToS3S3BucketPolicy9448E597": {
"Type": "AWS::S3::BucketPolicy",
"Properties": {
"Bucket": {
"Ref": "testexistingstreamfirehoses3stackKinesisFirehoseToS3S3BucketF4CE72AB"
},
"PolicyDocument": {
"Statement": [
{
"Action": "s3:*",
"Condition": {
"Bool": {
"aws:SecureTransport": "false"
}
},
"Effect": "Deny",
"Principal": {
"AWS": "*"
},
"Resource": [
{
"Fn::GetAtt": [
"testexistingstreamfirehoses3stackKinesisFirehoseToS3S3BucketF4CE72AB",
"Arn"
]
},
{
"Fn::Join": [
"",
[
{
"Fn::GetAtt": [
"testexistingstreamfirehoses3stackKinesisFirehoseToS3S3BucketF4CE72AB",
"Arn"
]
},
"/*"
]
]
}
]
}
],
"Version": "2012-10-17"
}
}
},
"testexistingstreamfirehoses3stackKinesisFirehoseToS3firehoseloggroupE425A6C8": {
"Type": "AWS::Logs::LogGroup",
"UpdateReplacePolicy": "Delete",
"DeletionPolicy": "Delete",
"Metadata": {
"cfn_nag": {
"rules_to_suppress": [
{
"id": "W86",
"reason": "Retention period for CloudWatchLogs LogGroups are set to 'Never Expire' to preserve customer data indefinitely"
},
{
"id": "W84",
"reason": "By default CloudWatchLogs LogGroups data is encrypted using the CloudWatch server-side encryption keys (AWS Managed Keys)"
}
]
}
}
},
"testexistingstreamfirehoses3stackKinesisFirehoseToS3firehoseloggroupfirehoselogstream5F77A011": {
"Type": "AWS::Logs::LogStream",
"Properties": {
"LogGroupName": {
"Ref": "testexistingstreamfirehoses3stackKinesisFirehoseToS3firehoseloggroupE425A6C8"
}
},
"UpdateReplacePolicy": "Retain",
"DeletionPolicy": "Retain"
},
"testexistingstreamfirehoses3stackKinesisFirehoseToS3KinesisFirehoseRoleE4B0266E": {
"Type": "AWS::IAM::Role",
"Properties": {
"AssumeRolePolicyDocument": {
"Statement": [
{
"Action": "sts:AssumeRole",
"Effect": "Allow",
"Principal": {
"Service": "firehose.amazonaws.com"
}
}
],
"Version": "2012-10-17"
}
},
"Metadata": {
"guard": {
"SuppressedRules": [
"IAM_NO_INLINE_POLICY_CHECK"
]
}
}
},
"testexistingstreamfirehoses3stackKinesisFirehoseToS3KinesisFirehosePolicyE9C16144": {
"Type": "AWS::IAM::Policy",
"Properties": {
"PolicyDocument": {
"Statement": [
{
"Action": [
"s3:AbortMultipartUpload",
"s3:GetBucketLocation",
"s3:GetObject",
"s3:ListBucket",
"s3:ListBucketMultipartUploads",
"s3:PutObject"
],
"Effect": "Allow",
"Resource": [
{
"Fn::GetAtt": [
"testexistingstreamfirehoses3stackKinesisFirehoseToS3S3BucketF4CE72AB",
"Arn"
]
},
{
"Fn::Join": [
"",
[
{
"Fn::GetAtt": [
"testexistingstreamfirehoses3stackKinesisFirehoseToS3S3BucketF4CE72AB",
"Arn"
]
},
"/*"
]
]
}
]
},
{
"Action": "logs:PutLogEvents",
"Effect": "Allow",
"Resource": {
"Fn::Join": [
"",
[
"arn:",
{
"Ref": "AWS::Partition"
},
":logs:",
{
"Ref": "AWS::Region"
},
":",
{
"Ref": "AWS::AccountId"
},
":log-group:",
{
"Ref": "testexistingstreamfirehoses3stackKinesisFirehoseToS3firehoseloggroupE425A6C8"
},
":log-stream:",
{
"Ref": "testexistingstreamfirehoses3stackKinesisFirehoseToS3firehoseloggroupfirehoselogstream5F77A011"
}
]
]
}
}
],
"Version": "2012-10-17"
},
"PolicyName": "testexistingstreamfirehoses3stackKinesisFirehoseToS3KinesisFirehosePolicyE9C16144",
"Roles": [
{
"Ref": "testexistingstreamfirehoses3stackKinesisFirehoseToS3KinesisFirehoseRoleE4B0266E"
}
]
}
},
"testexistingstreamfirehoses3stackKinesisFirehoseToS3KinesisFirehose0834A7FB": {
"Type": "AWS::KinesisFirehose::DeliveryStream",
"Properties": {
"DeliveryStreamName": "KinesisFirehosekinfhss3existingSstackKinesisFirehoseToS3A84F50F0",
"DeliveryStreamType": "KinesisStreamAsSource",
"ExtendedS3DestinationConfiguration": {
"BucketARN": {
"Fn::GetAtt": [
"testexistingstreamfirehoses3stackKinesisFirehoseToS3S3BucketF4CE72AB",
"Arn"
]
},
"BufferingHints": {
"IntervalInSeconds": 300,
"SizeInMBs": 5
},
"CloudWatchLoggingOptions": {
"Enabled": true,
"LogGroupName": {
"Ref": "testexistingstreamfirehoses3stackKinesisFirehoseToS3firehoseloggroupE425A6C8"
},
"LogStreamName": {
"Ref": "testexistingstreamfirehoses3stackKinesisFirehoseToS3firehoseloggroupfirehoselogstream5F77A011"
}
},
"CompressionFormat": "GZIP",
"EncryptionConfiguration": {
"KMSEncryptionConfig": {
"AWSKMSKeyARN": {
"Fn::Join": [
"",
[
"arn:",
{
"Ref": "AWS::Partition"
},
":kms:",
{
"Ref": "AWS::Region"
},
":",
{
"Ref": "AWS::AccountId"
},
":alias/aws/s3"
]
]
}
}
},
"RoleARN": {
"Fn::GetAtt": [
"testexistingstreamfirehoses3stackKinesisFirehoseToS3KinesisFirehoseRoleE4B0266E",
"Arn"
]
}
},
"KinesisStreamSourceConfiguration": {
"KinesisStreamARN": {
"Fn::GetAtt": [
"testkinesislambdaKinesisStream00F67958",
"Arn"
]
},
"RoleARN": {
"Fn::GetAtt": [
"KinesisStreamsRole2BFD39A5",
"Arn"
]
}
}
},
"Metadata": {
"guard": {
"SuppressedRules": [
"KINESIS_FIREHOSE_REDSHIFT_DESTINATION_CONFIGURATION_NO_PLAINTEXT_PASSWORD",
"KINESIS_FIREHOSE_SPLUNK_DESTINATION_CONFIGURATION_NO_PLAINTEXT_PASSWORD"
]
}
}
},
"KinesisStreamsRole2BFD39A5": {
"Type": "AWS::IAM::Role",
"Properties": {
"AssumeRolePolicyDocument": {
"Statement": [
{
"Action": "sts:AssumeRole",
"Effect": "Allow",
"Principal": {
"Service": "firehose.amazonaws.com"
}
}
],
"Version": "2012-10-17"
},
"Policies": [
{
"PolicyDocument": {
"Statement": [
{
"Action": [
"kinesis:DescribeStream",
"kinesis:GetRecords",
"kinesis:GetShardIterator",
"kinesis:ListShards"
],
"Effect": "Allow",
"Resource": {
"Fn::GetAtt": [
"testkinesislambdaKinesisStream00F67958",
"Arn"
]
}
}
],
"Version": "2012-10-17"
},
"PolicyName": "KinesisStreamsRoleRolePolicy"
}
]
},
"Metadata": {
"guard": {
"SuppressedRules": [
"IAM_NO_INLINE_POLICY_CHECK"
]
}
}
}
},
"Parameters": {
"BootstrapVersion": {
"Type": "AWS::SSM::Parameter::Value<String>",
"Default": "/cdk-bootstrap/hnb659fds/version",
"Description": "Version of the CDK Bootstrap resources in this environment, automatically retrieved from SSM Parameter Store. [cdk:skip]"
}
},
"Rules": {
"CheckBootstrapVersion": {
"Assertions": [
{
"Assert": {
"Fn::Not": [
{
"Fn::Contains": [
[
"1",
"2",
"3",
"4",
"5"
],
{
"Ref": "BootstrapVersion"
}
]
}
]
},
"AssertDescription": "CDK bootstrap stack version 6 required. Please run 'cdk bootstrap' with a recent version of the CDK CLI."
}
]
}
}
}