cdk-integ-elasticsearch-custom-kms-key.template.json

{
 "Resources": {
  "Key961B73FD": {
   "Type": "AWS::KMS::Key",
   "Properties": {
    "KeyPolicy": {
     "Statement": [
      {
       "Action": "kms:*",
       "Effect": "Allow",
       "Principal": {
        "AWS": {
         "Fn::Join": [
          "",
          [
           "arn:",
           {
            "Ref": "AWS::Partition"
           },
           ":iam::",
           {
            "Ref": "AWS::AccountId"
           },
           ":root"
          ]
         ]
        }
       },
       "Resource": "*"
      }
     ],
     "Version": "2012-10-17"
    }
   },
   "UpdateReplacePolicy": "Retain",
   "DeletionPolicy": "Retain"
  },
  "DomainSlowSearchLogs5B35A97A": {
   "Type": "AWS::Logs::LogGroup",
   "Properties": {
    "RetentionInDays": 30
   },
   "UpdateReplacePolicy": "Retain",
   "DeletionPolicy": "Retain"
  },
  "DomainAppLogs21698C1B": {
   "Type": "AWS::Logs::LogGroup",
   "Properties": {
    "RetentionInDays": 30
   },
   "UpdateReplacePolicy": "Retain",
   "DeletionPolicy": "Retain"
  },
  "DomainESLogGroupPolicyc82ca7bfe2f2589b859ebab89e88da2efd284adfadA70E756D": {
   "Type": "Custom::CloudwatchLogResourcePolicy",
   "Properties": {
    "ServiceToken": {
     "Fn::GetAtt": [
      "AWS679f53fac002430cb0da5b7982bd22872D164C4C",
      "Arn"
     ]
    },
    "Create": {
     "Fn::Join": [
      "",
      [
       "{\"service\":\"CloudWatchLogs\",\"action\":\"putResourcePolicy\",\"parameters\":{\"policyName\":\"ESLogPolicyc82ca7bfe2f2589b859ebab89e88da2efd284adfad\",\"policyDocument\":\"{\\\"Statement\\\":[{\\\"Action\\\":[\\\"logs:PutLogEvents\\\",\\\"logs:CreateLogStream\\\"],\\\"Effect\\\":\\\"Allow\\\",\\\"Principal\\\":{\\\"Service\\\":\\\"es.amazonaws.com\\\"},\\\"Resource\\\":[\\\"",
       {
        "Fn::GetAtt": [
         "DomainSlowSearchLogs5B35A97A",
         "Arn"
        ]
       },
       "\\\",\\\"",
       {
        "Fn::GetAtt": [
         "DomainAppLogs21698C1B",
         "Arn"
        ]
       },
       "\\\"]}],\\\"Version\\\":\\\"2012-10-17\\\"}\"},\"physicalResourceId\":{\"id\":\"ESLogGroupPolicyc82ca7bfe2f2589b859ebab89e88da2efd284adfad\"}}"
      ]
     ]
    },
    "Update": {
     "Fn::Join": [
      "",
      [
       "{\"service\":\"CloudWatchLogs\",\"action\":\"putResourcePolicy\",\"parameters\":{\"policyName\":\"ESLogPolicyc82ca7bfe2f2589b859ebab89e88da2efd284adfad\",\"policyDocument\":\"{\\\"Statement\\\":[{\\\"Action\\\":[\\\"logs:PutLogEvents\\\",\\\"logs:CreateLogStream\\\"],\\\"Effect\\\":\\\"Allow\\\",\\\"Principal\\\":{\\\"Service\\\":\\\"es.amazonaws.com\\\"},\\\"Resource\\\":[\\\"",
       {
        "Fn::GetAtt": [
         "DomainSlowSearchLogs5B35A97A",
         "Arn"
        ]
       },
       "\\\",\\\"",
       {
        "Fn::GetAtt": [
         "DomainAppLogs21698C1B",
         "Arn"
        ]
       },
       "\\\"]}],\\\"Version\\\":\\\"2012-10-17\\\"}\"},\"physicalResourceId\":{\"id\":\"ESLogGroupPolicyc82ca7bfe2f2589b859ebab89e88da2efd284adfad\"}}"
      ]
     ]
    },
    "Delete": "{\"service\":\"CloudWatchLogs\",\"action\":\"deleteResourcePolicy\",\"parameters\":{\"policyName\":\"ESLogPolicyc82ca7bfe2f2589b859ebab89e88da2efd284adfad\"},\"ignoreErrorCodesMatching\":\"ResourceNotFoundException\"}",
    "InstallLatestAwsSdk": true
   },
   "DependsOn": [
    "DomainESLogGroupPolicyc82ca7bfe2f2589b859ebab89e88da2efd284adfadCustomResourcePolicy0B41F6DF"
   ],
   "UpdateReplacePolicy": "Delete",
   "DeletionPolicy": "Delete"
  },
  "DomainESLogGroupPolicyc82ca7bfe2f2589b859ebab89e88da2efd284adfadCustomResourcePolicy0B41F6DF": {
   "Type": "AWS::IAM::Policy",
   "Properties": {
    "PolicyDocument": {
     "Statement": [
      {
       "Action": [
        "logs:DeleteResourcePolicy",
        "logs:PutResourcePolicy"
       ],
       "Effect": "Allow",
       "Resource": "*"
      }
     ],
     "Version": "2012-10-17"
    },
    "PolicyName": "DomainESLogGroupPolicyc82ca7bfe2f2589b859ebab89e88da2efd284adfadCustomResourcePolicy0B41F6DF",
    "Roles": [
     {
      "Ref": "AWS679f53fac002430cb0da5b7982bd2287ServiceRoleC1EA0FF2"
     }
    ]
   }
  },
  "Domain66AC69E0": {
   "Type": "AWS::Elasticsearch::Domain",
   "Properties": {
    "CognitoOptions": {
     "Enabled": false
    },
    "DomainEndpointOptions": {
     "EnforceHTTPS": false,
     "TLSSecurityPolicy": "Policy-Min-TLS-1-0-2019-07"
    },
    "EBSOptions": {
     "EBSEnabled": true,
     "VolumeSize": 10,
     "VolumeType": "gp2"
    },
    "ElasticsearchClusterConfig": {
     "DedicatedMasterEnabled": false,
     "InstanceCount": 1,
     "InstanceType": "r5.large.elasticsearch",
     "ZoneAwarenessEnabled": false
    },
    "ElasticsearchVersion": "7.1",
    "EncryptionAtRestOptions": {
     "Enabled": true,
     "KmsKeyId": {
      "Ref": "Key961B73FD"
     }
    },
    "LogPublishingOptions": {
     "ES_APPLICATION_LOGS": {
      "CloudWatchLogsLogGroupArn": {
       "Fn::GetAtt": [
        "DomainAppLogs21698C1B",
        "Arn"
       ]
      },
      "Enabled": true
     },
     "SEARCH_SLOW_LOGS": {
      "CloudWatchLogsLogGroupArn": {
       "Fn::GetAtt": [
        "DomainSlowSearchLogs5B35A97A",
        "Arn"
       ]
      },
      "Enabled": true
     }
    },
    "NodeToNodeEncryptionOptions": {
     "Enabled": true
    }
   },
   "DependsOn": [
    "DomainESLogGroupPolicyc82ca7bfe2f2589b859ebab89e88da2efd284adfadCustomResourcePolicy0B41F6DF",
    "DomainESLogGroupPolicyc82ca7bfe2f2589b859ebab89e88da2efd284adfadA70E756D"
   ],
   "UpdateReplacePolicy": "Delete",
   "DeletionPolicy": "Delete"
  },
  "DomainESAccessPolicy89986F33": {
   "Type": "Custom::ElasticsearchAccessPolicy",
   "Properties": {
    "ServiceToken": {
     "Fn::GetAtt": [
      "AWS679f53fac002430cb0da5b7982bd22872D164C4C",
      "Arn"
     ]
    },
    "Create": {
     "Fn::Join": [
      "",
      [
       "{\"action\":\"updateElasticsearchDomainConfig\",\"service\":\"ES\",\"parameters\":{\"DomainName\":\"",
       {
        "Ref": "Domain66AC69E0"
       },
       "\",\"AccessPolicies\":\"{\\\"Statement\\\":[{\\\"Action\\\":\\\"es:ESHttp*\\\",\\\"Effect\\\":\\\"Allow\\\",\\\"Principal\\\":{\\\"AWS\\\":\\\"arn:",
       {
        "Ref": "AWS::Partition"
       },
       ":iam::",
       {
        "Ref": "AWS::AccountId"
       },
       ":root\\\"},\\\"Resource\\\":\\\"*\\\"}],\\\"Version\\\":\\\"2012-10-17\\\"}\"},\"outputPaths\":[\"DomainConfig.ElasticsearchClusterConfig.AccessPolicies\"],\"physicalResourceId\":{\"id\":\"",
       {
        "Ref": "Domain66AC69E0"
       },
       "AccessPolicy\"}}"
      ]
     ]
    },
    "Update": {
     "Fn::Join": [
      "",
      [
       "{\"action\":\"updateElasticsearchDomainConfig\",\"service\":\"ES\",\"parameters\":{\"DomainName\":\"",
       {
        "Ref": "Domain66AC69E0"
       },
       "\",\"AccessPolicies\":\"{\\\"Statement\\\":[{\\\"Action\\\":\\\"es:ESHttp*\\\",\\\"Effect\\\":\\\"Allow\\\",\\\"Principal\\\":{\\\"AWS\\\":\\\"arn:",
       {
        "Ref": "AWS::Partition"
       },
       ":iam::",
       {
        "Ref": "AWS::AccountId"
       },
       ":root\\\"},\\\"Resource\\\":\\\"*\\\"}],\\\"Version\\\":\\\"2012-10-17\\\"}\"},\"outputPaths\":[\"DomainConfig.ElasticsearchClusterConfig.AccessPolicies\"],\"physicalResourceId\":{\"id\":\"",
       {
        "Ref": "Domain66AC69E0"
       },
       "AccessPolicy\"}}"
      ]
     ]
    },
    "InstallLatestAwsSdk": true
   },
   "DependsOn": [
    "DomainESAccessPolicyCustomResourcePolicy9747FC42"
   ],
   "UpdateReplacePolicy": "Delete",
   "DeletionPolicy": "Delete"
  },
  "DomainESAccessPolicyCustomResourcePolicy9747FC42": {
   "Type": "AWS::IAM::Policy",
   "Properties": {
    "PolicyDocument": {
     "Statement": [
      {
       "Action": "es:UpdateElasticsearchDomainConfig",
       "Effect": "Allow",
       "Resource": {
        "Fn::GetAtt": [
         "Domain66AC69E0",
         "Arn"
        ]
       }
      }
     ],
     "Version": "2012-10-17"
    },
    "PolicyName": "DomainESAccessPolicyCustomResourcePolicy9747FC42",
    "Roles": [
     {
      "Ref": "AWS679f53fac002430cb0da5b7982bd2287ServiceRoleC1EA0FF2"
     }
    ]
   }
  },
  "AWS679f53fac002430cb0da5b7982bd2287ServiceRoleC1EA0FF2": {
   "Type": "AWS::IAM::Role",
   "Properties": {
    "AssumeRolePolicyDocument": {
     "Statement": [
      {
       "Action": "sts:AssumeRole",
       "Effect": "Allow",
       "Principal": {
        "Service": "lambda.amazonaws.com"
       }
      }
     ],
     "Version": "2012-10-17"
    },
    "ManagedPolicyArns": [
     {
      "Fn::Join": [
       "",
       [
        "arn:",
        {
         "Ref": "AWS::Partition"
        },
        ":iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"
       ]
      ]
     }
    ]
   }
  },
  "AWS679f53fac002430cb0da5b7982bd2287ServiceRoleDefaultPolicyD28E1A5E": {
   "Type": "AWS::IAM::Policy",
   "Properties": {
    "PolicyDocument": {
     "Statement": [
      {
       "Action": [
        "kms:CreateGrant",
        "kms:Describe*",
        "kms:List*"
       ],
       "Effect": "Allow",
       "Resource": {
        "Fn::GetAtt": [
         "Key961B73FD",
         "Arn"
        ]
       }
      }
     ],
     "Version": "2012-10-17"
    },
    "PolicyName": "AWS679f53fac002430cb0da5b7982bd2287ServiceRoleDefaultPolicyD28E1A5E",
    "Roles": [
     {
      "Ref": "AWS679f53fac002430cb0da5b7982bd2287ServiceRoleC1EA0FF2"
     }
    ]
   }
  },
  "AWS679f53fac002430cb0da5b7982bd22872D164C4C": {
   "Type": "AWS::Lambda::Function",
   "Properties": {
    "Code": {
     "S3Bucket": {
      "Fn::Sub": "cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}"
     },
     "S3Key": "105b4f39ae68785e705640aa91919e412fcba2dd454aca53412747be8d955286.zip"
    },
    "Role": {
     "Fn::GetAtt": [
      "AWS679f53fac002430cb0da5b7982bd2287ServiceRoleC1EA0FF2",
      "Arn"
     ]
    },
    "Handler": "index.handler",
    "Runtime": "nodejs14.x",
    "Timeout": 120
   },
   "DependsOn": [
    "AWS679f53fac002430cb0da5b7982bd2287ServiceRoleDefaultPolicyD28E1A5E",
    "AWS679f53fac002430cb0da5b7982bd2287ServiceRoleC1EA0FF2"
   ]
  }
 },
 "Parameters": {
  "BootstrapVersion": {
   "Type": "AWS::SSM::Parameter::Value<String>",
   "Default": "/cdk-bootstrap/hnb659fds/version",
   "Description": "Version of the CDK Bootstrap resources in this environment, automatically retrieved from SSM Parameter Store. [cdk:skip]"
  }
 },
 "Rules": {
  "CheckBootstrapVersion": {
   "Assertions": [
    {
     "Assert": {
      "Fn::Not": [
       {
        "Fn::Contains": [
         [
          "1",
          "2",
          "3",
          "4",
          "5"
         ],
         {
          "Ref": "BootstrapVersion"
         }
        ]
       }
      ]
     },
     "AssertDescription": "CDK bootstrap stack version 6 required. Please run 'cdk bootstrap' with a recent version of the CDK CLI."
    }
   ]
  }
 }
}