FlowLogsTestStack.template.json

{
 "Resources": {
  "VPCB9E5F0B4": {
   "Type": "AWS::EC2::VPC",
   "Properties": {
    "CidrBlock": "10.0.0.0/16",
    "EnableDnsHostnames": true,
    "EnableDnsSupport": true,
    "InstanceTenancy": "default",
    "Tags": [
     {
      "Key": "Name",
      "Value": "FlowLogsTestStack/VPC"
     }
    ]
   }
  },
  "VPCPublicSubnet1SubnetB4246D30": {
   "Type": "AWS::EC2::Subnet",
   "Properties": {
    "VpcId": {
     "Ref": "VPCB9E5F0B4"
    },
    "AvailabilityZone": {
     "Fn::Select": [
      0,
      {
       "Fn::GetAZs": ""
      }
     ]
    },
    "CidrBlock": "10.0.0.0/18",
    "MapPublicIpOnLaunch": true,
    "Tags": [
     {
      "Key": "aws-cdk:subnet-name",
      "Value": "Public"
     },
     {
      "Key": "aws-cdk:subnet-type",
      "Value": "Public"
     },
     {
      "Key": "Name",
      "Value": "FlowLogsTestStack/VPC/PublicSubnet1"
     }
    ]
   }
  },
  "VPCPublicSubnet1RouteTableFEE4B781": {
   "Type": "AWS::EC2::RouteTable",
   "Properties": {
    "VpcId": {
     "Ref": "VPCB9E5F0B4"
    },
    "Tags": [
     {
      "Key": "Name",
      "Value": "FlowLogsTestStack/VPC/PublicSubnet1"
     }
    ]
   }
  },
  "VPCPublicSubnet1RouteTableAssociation0B0896DC": {
   "Type": "AWS::EC2::SubnetRouteTableAssociation",
   "Properties": {
    "RouteTableId": {
     "Ref": "VPCPublicSubnet1RouteTableFEE4B781"
    },
    "SubnetId": {
     "Ref": "VPCPublicSubnet1SubnetB4246D30"
    }
   }
  },
  "VPCPublicSubnet1DefaultRoute91CEF279": {
   "Type": "AWS::EC2::Route",
   "Properties": {
    "RouteTableId": {
     "Ref": "VPCPublicSubnet1RouteTableFEE4B781"
    },
    "DestinationCidrBlock": "0.0.0.0/0",
    "GatewayId": {
     "Ref": "VPCIGWB7E252D3"
    }
   },
   "DependsOn": [
    "VPCVPCGW99B986DC"
   ]
  },
  "VPCPublicSubnet1EIP6AD938E8": {
   "Type": "AWS::EC2::EIP",
   "Properties": {
    "Domain": "vpc",
    "Tags": [
     {
      "Key": "Name",
      "Value": "FlowLogsTestStack/VPC/PublicSubnet1"
     }
    ]
   }
  },
  "VPCPublicSubnet1NATGatewayE0556630": {
   "Type": "AWS::EC2::NatGateway",
   "Properties": {
    "SubnetId": {
     "Ref": "VPCPublicSubnet1SubnetB4246D30"
    },
    "AllocationId": {
     "Fn::GetAtt": [
      "VPCPublicSubnet1EIP6AD938E8",
      "AllocationId"
     ]
    },
    "Tags": [
     {
      "Key": "Name",
      "Value": "FlowLogsTestStack/VPC/PublicSubnet1"
     }
    ]
   },
   "DependsOn": [
    "VPCPublicSubnet1DefaultRoute91CEF279",
    "VPCPublicSubnet1RouteTableAssociation0B0896DC"
   ]
  },
  "VPCPublicSubnet2Subnet74179F39": {
   "Type": "AWS::EC2::Subnet",
   "Properties": {
    "VpcId": {
     "Ref": "VPCB9E5F0B4"
    },
    "AvailabilityZone": {
     "Fn::Select": [
      1,
      {
       "Fn::GetAZs": ""
      }
     ]
    },
    "CidrBlock": "10.0.64.0/18",
    "MapPublicIpOnLaunch": true,
    "Tags": [
     {
      "Key": "aws-cdk:subnet-name",
      "Value": "Public"
     },
     {
      "Key": "aws-cdk:subnet-type",
      "Value": "Public"
     },
     {
      "Key": "Name",
      "Value": "FlowLogsTestStack/VPC/PublicSubnet2"
     }
    ]
   }
  },
  "VPCPublicSubnet2RouteTable6F1A15F1": {
   "Type": "AWS::EC2::RouteTable",
   "Properties": {
    "VpcId": {
     "Ref": "VPCB9E5F0B4"
    },
    "Tags": [
     {
      "Key": "Name",
      "Value": "FlowLogsTestStack/VPC/PublicSubnet2"
     }
    ]
   }
  },
  "VPCPublicSubnet2RouteTableAssociation5A808732": {
   "Type": "AWS::EC2::SubnetRouteTableAssociation",
   "Properties": {
    "RouteTableId": {
     "Ref": "VPCPublicSubnet2RouteTable6F1A15F1"
    },
    "SubnetId": {
     "Ref": "VPCPublicSubnet2Subnet74179F39"
    }
   }
  },
  "VPCPublicSubnet2DefaultRouteB7481BBA": {
   "Type": "AWS::EC2::Route",
   "Properties": {
    "RouteTableId": {
     "Ref": "VPCPublicSubnet2RouteTable6F1A15F1"
    },
    "DestinationCidrBlock": "0.0.0.0/0",
    "GatewayId": {
     "Ref": "VPCIGWB7E252D3"
    }
   },
   "DependsOn": [
    "VPCVPCGW99B986DC"
   ]
  },
  "VPCPublicSubnet2EIP4947BC00": {
   "Type": "AWS::EC2::EIP",
   "Properties": {
    "Domain": "vpc",
    "Tags": [
     {
      "Key": "Name",
      "Value": "FlowLogsTestStack/VPC/PublicSubnet2"
     }
    ]
   }
  },
  "VPCPublicSubnet2NATGateway3C070193": {
   "Type": "AWS::EC2::NatGateway",
   "Properties": {
    "SubnetId": {
     "Ref": "VPCPublicSubnet2Subnet74179F39"
    },
    "AllocationId": {
     "Fn::GetAtt": [
      "VPCPublicSubnet2EIP4947BC00",
      "AllocationId"
     ]
    },
    "Tags": [
     {
      "Key": "Name",
      "Value": "FlowLogsTestStack/VPC/PublicSubnet2"
     }
    ]
   },
   "DependsOn": [
    "VPCPublicSubnet2DefaultRouteB7481BBA",
    "VPCPublicSubnet2RouteTableAssociation5A808732"
   ]
  },
  "VPCPrivateSubnet1Subnet8BCA10E0": {
   "Type": "AWS::EC2::Subnet",
   "Properties": {
    "VpcId": {
     "Ref": "VPCB9E5F0B4"
    },
    "AvailabilityZone": {
     "Fn::Select": [
      0,
      {
       "Fn::GetAZs": ""
      }
     ]
    },
    "CidrBlock": "10.0.128.0/18",
    "MapPublicIpOnLaunch": false,
    "Tags": [
     {
      "Key": "aws-cdk:subnet-name",
      "Value": "Private"
     },
     {
      "Key": "aws-cdk:subnet-type",
      "Value": "Private"
     },
     {
      "Key": "Name",
      "Value": "FlowLogsTestStack/VPC/PrivateSubnet1"
     }
    ]
   }
  },
  "VPCPrivateSubnet1RouteTableBE8A6027": {
   "Type": "AWS::EC2::RouteTable",
   "Properties": {
    "VpcId": {
     "Ref": "VPCB9E5F0B4"
    },
    "Tags": [
     {
      "Key": "Name",
      "Value": "FlowLogsTestStack/VPC/PrivateSubnet1"
     }
    ]
   }
  },
  "VPCPrivateSubnet1RouteTableAssociation347902D1": {
   "Type": "AWS::EC2::SubnetRouteTableAssociation",
   "Properties": {
    "RouteTableId": {
     "Ref": "VPCPrivateSubnet1RouteTableBE8A6027"
    },
    "SubnetId": {
     "Ref": "VPCPrivateSubnet1Subnet8BCA10E0"
    }
   }
  },
  "VPCPrivateSubnet1DefaultRouteAE1D6490": {
   "Type": "AWS::EC2::Route",
   "Properties": {
    "RouteTableId": {
     "Ref": "VPCPrivateSubnet1RouteTableBE8A6027"
    },
    "DestinationCidrBlock": "0.0.0.0/0",
    "NatGatewayId": {
     "Ref": "VPCPublicSubnet1NATGatewayE0556630"
    }
   }
  },
  "VPCPrivateSubnet2SubnetCFCDAA7A": {
   "Type": "AWS::EC2::Subnet",
   "Properties": {
    "VpcId": {
     "Ref": "VPCB9E5F0B4"
    },
    "AvailabilityZone": {
     "Fn::Select": [
      1,
      {
       "Fn::GetAZs": ""
      }
     ]
    },
    "CidrBlock": "10.0.192.0/18",
    "MapPublicIpOnLaunch": false,
    "Tags": [
     {
      "Key": "aws-cdk:subnet-name",
      "Value": "Private"
     },
     {
      "Key": "aws-cdk:subnet-type",
      "Value": "Private"
     },
     {
      "Key": "Name",
      "Value": "FlowLogsTestStack/VPC/PrivateSubnet2"
     }
    ]
   }
  },
  "VPCPrivateSubnet2RouteTable0A19E10E": {
   "Type": "AWS::EC2::RouteTable",
   "Properties": {
    "VpcId": {
     "Ref": "VPCB9E5F0B4"
    },
    "Tags": [
     {
      "Key": "Name",
      "Value": "FlowLogsTestStack/VPC/PrivateSubnet2"
     }
    ]
   }
  },
  "VPCPrivateSubnet2RouteTableAssociation0C73D413": {
   "Type": "AWS::EC2::SubnetRouteTableAssociation",
   "Properties": {
    "RouteTableId": {
     "Ref": "VPCPrivateSubnet2RouteTable0A19E10E"
    },
    "SubnetId": {
     "Ref": "VPCPrivateSubnet2SubnetCFCDAA7A"
    }
   }
  },
  "VPCPrivateSubnet2DefaultRouteF4F5CFD2": {
   "Type": "AWS::EC2::Route",
   "Properties": {
    "RouteTableId": {
     "Ref": "VPCPrivateSubnet2RouteTable0A19E10E"
    },
    "DestinationCidrBlock": "0.0.0.0/0",
    "NatGatewayId": {
     "Ref": "VPCPublicSubnet2NATGateway3C070193"
    }
   }
  },
  "VPCIGWB7E252D3": {
   "Type": "AWS::EC2::InternetGateway",
   "Properties": {
    "Tags": [
     {
      "Key": "Name",
      "Value": "FlowLogsTestStack/VPC"
     }
    ]
   }
  },
  "VPCVPCGW99B986DC": {
   "Type": "AWS::EC2::VPCGatewayAttachment",
   "Properties": {
    "VpcId": {
     "Ref": "VPCB9E5F0B4"
    },
    "InternetGatewayId": {
     "Ref": "VPCIGWB7E252D3"
    }
   }
  },
  "VPCFlowLogsS3BucketFB7DC2BE": {
   "Type": "AWS::S3::Bucket",
   "Properties": {
    "Tags": [
     {
      "Key": "Name",
      "Value": "FlowLogsTestStack/VPC"
     }
    ]
   },
   "UpdateReplacePolicy": "Retain",
   "DeletionPolicy": "Retain"
  },
  "VPCFlowLogsS3BucketPolicyB2C2A045": {
   "Type": "AWS::S3::BucketPolicy",
   "Properties": {
    "Bucket": {
     "Ref": "VPCFlowLogsS3BucketFB7DC2BE"
    },
    "PolicyDocument": {
     "Statement": [
      {
       "Action": "s3:PutObject",
       "Condition": {
        "StringEquals": {
         "s3:x-amz-acl": "bucket-owner-full-control",
         "aws:SourceAccount": {
          "Ref": "AWS::AccountId"
         }
        },
        "ArnLike": {
         "aws:SourceArn": {
          "Fn::Join": [
           "",
           [
            "arn:",
            {
             "Ref": "AWS::Partition"
            },
            ":logs:",
            {
             "Ref": "AWS::Region"
            },
            ":",
            {
             "Ref": "AWS::AccountId"
            },
            ":*"
           ]
          ]
         }
        }
       },
       "Effect": "Allow",
       "Principal": {
        "Service": "delivery.logs.amazonaws.com"
       },
       "Resource": {
        "Fn::Join": [
         "",
         [
          {
           "Fn::GetAtt": [
            "VPCFlowLogsS3BucketFB7DC2BE",
            "Arn"
           ]
          },
          "/AWSLogs/",
          {
           "Ref": "AWS::AccountId"
          },
          "/*"
         ]
        ]
       }
      },
      {
       "Action": [
        "s3:GetBucketAcl",
        "s3:ListBucket"
       ],
       "Condition": {
        "StringEquals": {
         "aws:SourceAccount": {
          "Ref": "AWS::AccountId"
         }
        },
        "ArnLike": {
         "aws:SourceArn": {
          "Fn::Join": [
           "",
           [
            "arn:",
            {
             "Ref": "AWS::Partition"
            },
            ":logs:",
            {
             "Ref": "AWS::Region"
            },
            ":",
            {
             "Ref": "AWS::AccountId"
            },
            ":*"
           ]
          ]
         }
        }
       },
       "Effect": "Allow",
       "Principal": {
        "Service": "delivery.logs.amazonaws.com"
       },
       "Resource": {
        "Fn::GetAtt": [
         "VPCFlowLogsS3BucketFB7DC2BE",
         "Arn"
        ]
       }
      }
     ],
     "Version": "2012-10-17"
    }
   }
  },
  "VPCFlowLogsS3FlowLogB5256CFF": {
   "Type": "AWS::EC2::FlowLog",
   "Properties": {
    "ResourceId": {
     "Ref": "VPCB9E5F0B4"
    },
    "ResourceType": "VPC",
    "TrafficType": "ALL",
    "LogDestination": {
     "Fn::GetAtt": [
      "VPCFlowLogsS3BucketFB7DC2BE",
      "Arn"
     ]
    },
    "LogDestinationType": "s3",
    "Tags": [
     {
      "Key": "Name",
      "Value": "FlowLogsTestStack/VPC"
     }
    ]
   }
  },
  "VPCFlowLogsS3KeyPrefixFlowLogB57F1746": {
   "Type": "AWS::EC2::FlowLog",
   "Properties": {
    "ResourceId": {
     "Ref": "VPCB9E5F0B4"
    },
    "ResourceType": "VPC",
    "TrafficType": "ALL",
    "LogDestination": {
     "Fn::Join": [
      "",
      [
       {
        "Fn::GetAtt": [
         "Bucket83908E77",
         "Arn"
        ]
       },
       "/prefix/"
      ]
     ]
    },
    "LogDestinationType": "s3",
    "Tags": [
     {
      "Key": "Name",
      "Value": "FlowLogsTestStack/VPC"
     }
    ]
   }
  },
  "FlowLogsCWIAMRole017AD736": {
   "Type": "AWS::IAM::Role",
   "Properties": {
    "AssumeRolePolicyDocument": {
     "Statement": [
      {
       "Action": "sts:AssumeRole",
       "Effect": "Allow",
       "Principal": {
        "Service": "vpc-flow-logs.amazonaws.com"
       }
      }
     ],
     "Version": "2012-10-17"
    }
   }
  },
  "FlowLogsCWIAMRoleDefaultPolicy943C8A20": {
   "Type": "AWS::IAM::Policy",
   "Properties": {
    "PolicyDocument": {
     "Statement": [
      {
       "Action": [
        "logs:CreateLogStream",
        "logs:DescribeLogStreams",
        "logs:PutLogEvents"
       ],
       "Effect": "Allow",
       "Resource": {
        "Fn::GetAtt": [
         "FlowLogsCWLogGroup0398E8F8",
         "Arn"
        ]
       }
      },
      {
       "Action": "iam:PassRole",
       "Effect": "Allow",
       "Resource": {
        "Fn::GetAtt": [
         "FlowLogsCWIAMRole017AD736",
         "Arn"
        ]
       }
      }
     ],
     "Version": "2012-10-17"
    },
    "PolicyName": "FlowLogsCWIAMRoleDefaultPolicy943C8A20",
    "Roles": [
     {
      "Ref": "FlowLogsCWIAMRole017AD736"
     }
    ]
   }
  },
  "FlowLogsCWLogGroup0398E8F8": {
   "Type": "AWS::Logs::LogGroup",
   "Properties": {
    "RetentionInDays": 731
   },
   "UpdateReplacePolicy": "Retain",
   "DeletionPolicy": "Retain"
  },
  "FlowLogsCWFlowLog9CED86DA": {
   "Type": "AWS::EC2::FlowLog",
   "Properties": {
    "ResourceId": {
     "Ref": "VPCB9E5F0B4"
    },
    "ResourceType": "VPC",
    "TrafficType": "ALL",
    "DeliverLogsPermissionArn": {
     "Fn::GetAtt": [
      "FlowLogsCWIAMRole017AD736",
      "Arn"
     ]
    },
    "LogDestinationType": "cloud-watch-logs",
    "LogGroupName": {
     "Ref": "FlowLogsCWLogGroup0398E8F8"
    }
   }
  },
  "Bucket83908E77": {
   "Type": "AWS::S3::Bucket",
   "Properties": {
    "Tags": [
     {
      "Key": "aws-cdk:auto-delete-objects",
      "Value": "true"
     }
    ]
   },
   "UpdateReplacePolicy": "Delete",
   "DeletionPolicy": "Delete"
  },
  "BucketPolicyE9A3008A": {
   "Type": "AWS::S3::BucketPolicy",
   "Properties": {
    "Bucket": {
     "Ref": "Bucket83908E77"
    },
    "PolicyDocument": {
     "Statement": [
      {
       "Action": [
        "s3:DeleteObject*",
        "s3:GetBucket*",
        "s3:List*"
       ],
       "Effect": "Allow",
       "Principal": {
        "AWS": {
         "Fn::GetAtt": [
          "CustomS3AutoDeleteObjectsCustomResourceProviderRole3B1BD092",
          "Arn"
         ]
        }
       },
       "Resource": [
        {
         "Fn::GetAtt": [
          "Bucket83908E77",
          "Arn"
         ]
        },
        {
         "Fn::Join": [
          "",
          [
           {
            "Fn::GetAtt": [
             "Bucket83908E77",
             "Arn"
            ]
           },
           "/*"
          ]
         ]
        }
       ]
      },
      {
       "Action": "s3:PutObject",
       "Condition": {
        "StringEquals": {
         "s3:x-amz-acl": "bucket-owner-full-control",
         "aws:SourceAccount": {
          "Ref": "AWS::AccountId"
         }
        },
        "ArnLike": {
         "aws:SourceArn": {
          "Fn::Join": [
           "",
           [
            "arn:",
            {
             "Ref": "AWS::Partition"
            },
            ":logs:",
            {
             "Ref": "AWS::Region"
            },
            ":",
            {
             "Ref": "AWS::AccountId"
            },
            ":*"
           ]
          ]
         }
        }
       },
       "Effect": "Allow",
       "Principal": {
        "Service": "delivery.logs.amazonaws.com"
       },
       "Resource": [
        {
         "Fn::Join": [
          "",
          [
           {
            "Fn::GetAtt": [
             "Bucket83908E77",
             "Arn"
            ]
           },
           "/AWSLogs/",
           {
            "Ref": "AWS::AccountId"
           },
           "/*"
          ]
         ]
        },
        {
         "Fn::Join": [
          "",
          [
           {
            "Fn::GetAtt": [
             "Bucket83908E77",
             "Arn"
            ]
           },
           "/prefix/AWSLogs/",
           {
            "Ref": "AWS::AccountId"
           },
           "/*"
          ]
         ]
        }
       ]
      },
      {
       "Action": [
        "s3:GetBucketAcl",
        "s3:ListBucket"
       ],
       "Condition": {
        "StringEquals": {
         "aws:SourceAccount": {
          "Ref": "AWS::AccountId"
         }
        },
        "ArnLike": {
         "aws:SourceArn": {
          "Fn::Join": [
           "",
           [
            "arn:",
            {
             "Ref": "AWS::Partition"
            },
            ":logs:",
            {
             "Ref": "AWS::Region"
            },
            ":",
            {
             "Ref": "AWS::AccountId"
            },
            ":*"
           ]
          ]
         }
        }
       },
       "Effect": "Allow",
       "Principal": {
        "Service": "delivery.logs.amazonaws.com"
       },
       "Resource": {
        "Fn::GetAtt": [
         "Bucket83908E77",
         "Arn"
        ]
       }
      }
     ],
     "Version": "2012-10-17"
    }
   }
  },
  "BucketAutoDeleteObjectsCustomResourceBAFD23C2": {
   "Type": "Custom::S3AutoDeleteObjects",
   "Properties": {
    "ServiceToken": {
     "Fn::GetAtt": [
      "CustomS3AutoDeleteObjectsCustomResourceProviderHandler9D90184F",
      "Arn"
     ]
    },
    "BucketName": {
     "Ref": "Bucket83908E77"
    }
   },
   "DependsOn": [
    "BucketPolicyE9A3008A"
   ],
   "UpdateReplacePolicy": "Delete",
   "DeletionPolicy": "Delete"
  },
  "CustomS3AutoDeleteObjectsCustomResourceProviderRole3B1BD092": {
   "Type": "AWS::IAM::Role",
   "Properties": {
    "AssumeRolePolicyDocument": {
     "Version": "2012-10-17",
     "Statement": [
      {
       "Action": "sts:AssumeRole",
       "Effect": "Allow",
       "Principal": {
        "Service": "lambda.amazonaws.com"
       }
      }
     ]
    },
    "ManagedPolicyArns": [
     {
      "Fn::Sub": "arn:${AWS::Partition}:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"
     }
    ]
   }
  },
  "CustomS3AutoDeleteObjectsCustomResourceProviderHandler9D90184F": {
   "Type": "AWS::Lambda::Function",
   "Properties": {
    "Code": {
     "S3Bucket": {
      "Fn::Sub": "cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}"
     },
     "S3Key": "bb426cfb5fed5237e5928f871893b243ddf86a591a592b558bd29f60e28bad9d.zip"
    },
    "Timeout": 900,
    "MemorySize": 128,
    "Handler": "__entrypoint__.handler",
    "Role": {
     "Fn::GetAtt": [
      "CustomS3AutoDeleteObjectsCustomResourceProviderRole3B1BD092",
      "Arn"
     ]
    },
    "Runtime": "nodejs14.x",
    "Description": {
     "Fn::Join": [
      "",
      [
       "Lambda function for auto-deleting objects in ",
       {
        "Ref": "Bucket83908E77"
       },
       " S3 bucket."
      ]
     ]
    }
   },
   "DependsOn": [
    "CustomS3AutoDeleteObjectsCustomResourceProviderRole3B1BD092"
   ]
  }
 },
 "Parameters": {
  "BootstrapVersion": {
   "Type": "AWS::SSM::Parameter::Value<String>",
   "Default": "/cdk-bootstrap/hnb659fds/version",
   "Description": "Version of the CDK Bootstrap resources in this environment, automatically retrieved from SSM Parameter Store. [cdk:skip]"
  }
 },
 "Rules": {
  "CheckBootstrapVersion": {
   "Assertions": [
    {
     "Assert": {
      "Fn::Not": [
       {
        "Fn::Contains": [
         [
          "1",
          "2",
          "3",
          "4",
          "5"
         ],
         {
          "Ref": "BootstrapVersion"
         }
        ]
       }
      ]
     },
     "AssertDescription": "CDK bootstrap stack version 6 required. Please run 'cdk bootstrap' with a recent version of the CDK CLI."
    }
   ]
  }
 }
}