cloudformation/FIXEngineApplication.yml [2695:3026]:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
  RDSCluster:
    DeletionPolicy: Snapshot
    DependsOn:
      - RDSClusterSubnetGroup
      - RDSClusterAdminSecret
      - RDSClusterSecurityGroup
      - RDSClusterParameterGroup
    Properties:
      DBClusterParameterGroupName: !Ref 'RDSClusterParameterGroup'
      DBSubnetGroupName: !Ref 'RDSClusterSubnetGroup'
      EnableCloudwatchLogsExports:
        - error
        - general
        - slowquery
        - audit
      EnableIAMDatabaseAuthentication: false
      Engine: aurora
      EngineMode: multimaster
      EngineVersion: 5.6.10a
      KmsKeyId: !If
        - KMSKeySupplied
        - !Ref 'KMSKeyARN'
        - ''
      MasterUserPassword: !Join
        - ''
        - - '{{resolve:secretsmanager:'
          - !Ref 'RDSClusterAdminSecret'
          - :SecretString:password}}
      MasterUsername: !Join
        - ''
        - - '{{resolve:secretsmanager:'
          - !Ref 'RDSClusterAdminSecret'
          - :SecretString:username}}
      StorageEncrypted: true
      Tags: []
      VpcSecurityGroupIds:
        - !Ref 'RDSClusterSecurityGroup'
    Type: AWS::RDS::DBCluster
  RDSClusterAdminSecret:
    Metadata:
      cfn_nag:
        rules_to_suppress:
          - id: W77
            reason: No cross-account access to this secret is required.
    Properties:
      Description: !Join
        - ''
        - - 'Admin credentials for '
          - !Ref 'AWS::StackName'
          - ' RDS cluster'
      GenerateSecretString:
        ExcludeCharacters: '"@/\,*!#$%-[]()_:^&`<>;+='''
        ExcludeLowercase: false
        ExcludeNumbers: false
        ExcludePunctuation: true
        ExcludeUppercase: false
        GenerateStringKey: password
        IncludeSpace: false
        PasswordLength: 16
        RequireEachIncludedType: true
        SecretStringTemplate: '{"username": "FEAdmin"}'
    Type: AWS::SecretsManager::Secret
  RDSClusterAdminSecretAttachment:
    DependsOn:
      - RDSCluster
      - RDSClusterAdminSecret
    Properties:
      SecretId: !Ref 'RDSClusterAdminSecret'
      TargetId: !Ref 'RDSCluster'
      TargetType: AWS::RDS::DBCluster
    Type: AWS::SecretsManager::SecretTargetAttachment
  RDSClusterErrorLogGroup:
    DependsOn:
      - RDSCluster
    Metadata:
      cfn_nag:
        rules_to_suppress:
          - id: W84
            reason: These logs do not contain sensitive data.
    Properties:
      LogGroupName: !Join
        - /
        - - /aws/rds/cluster
          - !Ref 'RDSCluster'
          - error
      RetentionInDays: !Ref 'LogRetentionInDays'
    Type: AWS::Logs::LogGroup
  RDSClusterInitializationStarter:
    DependsOn:
      - RDSClusterPrepPolicy
      - RDSInitializationDocument
      - FargateSecurityGroupEgressToRDS
      - AutomationDocumentStarterLogGroup
    Properties:
      Properties:
        AutomationDocumentName: !Ref 'RDSInitializationDocument'
        EligibleRequestTypes:
          - Create
        ExecutionRoleArn: !GetAtt 'RDSClusterPrepExecutionRole.Arn'
      ServiceToken: !GetAtt 'AutomationDocumentStarterFunction.Arn'
      Type: Custom::StartSSMAutomationDocument
      Version: '1.0'
    Type: AWS::CloudFormation::CustomResource
  RDSClusterInitializationWaiter:
    CreationPolicy:
      ResourceSignal:
        Count: 1
        Timeout: PT15M
    DependsOn:
      - RDSClusterPrepPolicy
      - RDSInitializationDocument
      - AutomationDocumentStarterLogGroup
    Type: AWS::CloudFormation::WaitCondition
  RDSClusterNonAdminSecret:
    Metadata:
      cfn_nag:
        rules_to_suppress:
          - id: W77
            reason: No cross-account access to this secret is required.
    Properties:
      Description: !Join
        - ''
        - - 'Non-Admin credentials for '
          - !Ref 'AWS::StackName'
          - ' RDS cluster'
      GenerateSecretString:
        ExcludeCharacters: '"@/\,*!#$%-[]()_:^&`<>;+='''
        ExcludeLowercase: false
        ExcludeNumbers: false
        ExcludePunctuation: true
        ExcludeUppercase: false
        GenerateStringKey: password
        IncludeSpace: false
        PasswordLength: 16
        RequireEachIncludedType: true
        SecretStringTemplate: '{"username": "fixengine"}'
    Type: AWS::SecretsManager::Secret
  RDSClusterNonAdminSecretArnParam:
    Condition: ''
    Properties:
      Description: !Join
        - ''
        - - 'ARN of RDS cluster non-admin secret for '
          - !Ref 'AWS::StackName'
          - ' stack'
      Name: !Join
        - /
        - - /fixengine
          - !Ref 'AWS::StackName'
          - RDSClusterNonAdminSecretArn
      Tier: Standard
      Type: String
      Value: !Ref 'RDSClusterNonAdminSecret'
    Type: AWS::SSM::Parameter
  RDSClusterNonAdminSecretAttachment:
    DependsOn:
      - RDSCluster
      - RDSClusterNonAdminSecret
    Properties:
      SecretId: !Ref 'RDSClusterNonAdminSecret'
      TargetId: !Ref 'RDSCluster'
      TargetType: AWS::RDS::DBCluster
    Type: AWS::SecretsManager::SecretTargetAttachment
  RDSClusterParameterGroup:
    Properties:
      Description: !Join
        - ''
        - - 'Cluster parameter group for '
          - !Ref 'AWS::StackName'
          - ' stack'
      Family: aurora5.6
      Parameters:
        server_audit_logging: 0
        server_audit_logs_upload: 0
    Type: AWS::RDS::DBClusterParameterGroup
  RDSClusterPrepExecutionRole:
    DependsOn: []
    Properties:
      AssumeRolePolicyDocument:
        Statement:
          - Action:
              - sts:AssumeRole
            Effect: Allow
            Principal:
              Service:
                - ssm.amazonaws.com
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/service-role/AmazonSSMAutomationRole
      Policies:
        - PolicyDocument:
            Statement:
              - Action:
                  - ec2:RunInstances
                Effect: Allow
                Resource:
                  - !Join
                    - ''
                    - - 'arn:aws:ec2:'
                      - !Ref 'AWS::Region'
                      - ::image/*
                  - !Join
                    - ''
                    - - 'arn:aws:ec2:'
                      - !Ref 'AWS::Region'
                      - ':'
                      - !Ref 'AWS::AccountId'
                      - :subnet/*
                  - !Join
                    - ''
                    - - 'arn:aws:ec2:'
                      - !Ref 'AWS::Region'
                      - ':'
                      - !Ref 'AWS::AccountId'
                      - :security-group/
                      - !GetAtt 'RDSClusterSecurityGroup.GroupId'
              - Action:
                  - iam:PassRole
                Effect: Allow
                Resource:
                  - !GetAtt 'RDSClusterPrepInstanceRole.Arn'
              - Action:
                  - cloudformation:SignalResource
                Effect: Allow
                Resource:
                  - !Ref 'AWS::StackId'
          PolicyName: primary-policy
    Type: AWS::IAM::Role
  RDSClusterPrepInstanceRole:
    DependsOn:
      - RDSClusterPrepLogGroup
      - RDSClusterAdminSecret
      - RDSClusterNonAdminSecret
    Properties:
      AssumeRolePolicyDocument:
        Statement:
          - Action:
              - sts:AssumeRole
            Effect: Allow
            Principal:
              Service:
                - ec2.amazonaws.com
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore
      Policies:
        - PolicyDocument:
            Statement:
              - Action:
                  - secretsmanager:GetSecretValue
                Effect: Allow
                Resource:
                  - !Ref 'RDSClusterAdminSecret'
                  - !Ref 'RDSClusterNonAdminSecret'
              - Action:
                  - logs:PutLogEvents
                  - logs:CreateLogGroup
                  - logs:CreateLogStream
                  - logs:DescribeLogGroups
                  - logs:DescribeLogStreams
                Effect: Allow
                Resource:
                  - !Join
                    - ''
                    - - 'arn:aws:logs:'
                      - !Ref 'AWS::Region'
                      - ':'
                      - !Ref 'AWS::AccountId'
                      - ':log-group:'
                      - !Ref 'RDSClusterPrepLogGroup'
                  - !Join
                    - ''
                    - - 'arn:aws:logs:'
                      - !Ref 'AWS::Region'
                      - ':'
                      - !Ref 'AWS::AccountId'
                      - ':log-group:'
                      - !Ref 'RDSClusterPrepLogGroup'
                      - :log-stream:*
          PolicyName: primary-policy
    Type: AWS::IAM::Role
  RDSClusterPrepInstanceRoleProfile:
    DependsOn:
      - RDSClusterPrepInstanceRole
    Properties:
      Path: /
      Roles:
        - !Ref 'RDSClusterPrepInstanceRole'
    Type: AWS::IAM::InstanceProfile
  RDSClusterPrepLogGroup:
    Metadata:
      cfn_nag:
        rules_to_suppress:
          - id: W84
            reason: These logs do not contain sensitive data.
    Properties:
      LogGroupName: !Join
        - /
        - - /aws/ssm
          - !Ref 'AWS::StackName'
          - RDSPrepAutomation
      RetentionInDays: !Ref 'LogRetentionInDays'
    Type: AWS::Logs::LogGroup
  RDSClusterPrepPolicy:
    DependsOn:
      - AutomationDocumentStarterRole
      - RDSInitializationDocument
      - RDSClusterPrepExecutionRole
    Properties:
      PolicyDocument:
        Statement:
          - Action:
              - iam:PassRole
            Effect: Allow
            Resource:
              - !GetAtt 'RDSClusterPrepExecutionRole.Arn'
          - Action:
              - ssm:StartAutomationExecution
            Effect: Allow
            Resource:
              - !Join
                - ''
                - - 'arn:aws:ssm:'
                  - !Ref 'AWS::Region'
                  - ':'
                  - !Ref 'AWS::AccountId'
                  - :automation-definition/
                  - !Ref 'RDSInitializationDocument'
                  - :$DEFAULT
      PolicyName: RDSClusterPrepPolicy
      Roles:
        - !Ref 'AutomationDocumentStarterRole'
    Type: AWS::IAM::Policy
  RDSClusterPrepSecurityGroup:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -



cloudformation/FIXEngineVPCApplication.yml [3006:3337]:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
  RDSCluster:
    DeletionPolicy: Snapshot
    DependsOn:
      - RDSClusterSubnetGroup
      - RDSClusterAdminSecret
      - RDSClusterSecurityGroup
      - RDSClusterParameterGroup
    Properties:
      DBClusterParameterGroupName: !Ref 'RDSClusterParameterGroup'
      DBSubnetGroupName: !Ref 'RDSClusterSubnetGroup'
      EnableCloudwatchLogsExports:
        - error
        - general
        - slowquery
        - audit
      EnableIAMDatabaseAuthentication: false
      Engine: aurora
      EngineMode: multimaster
      EngineVersion: 5.6.10a
      KmsKeyId: !If
        - KMSKeySupplied
        - !Ref 'KMSKeyARN'
        - ''
      MasterUserPassword: !Join
        - ''
        - - '{{resolve:secretsmanager:'
          - !Ref 'RDSClusterAdminSecret'
          - :SecretString:password}}
      MasterUsername: !Join
        - ''
        - - '{{resolve:secretsmanager:'
          - !Ref 'RDSClusterAdminSecret'
          - :SecretString:username}}
      StorageEncrypted: true
      Tags: []
      VpcSecurityGroupIds:
        - !Ref 'RDSClusterSecurityGroup'
    Type: AWS::RDS::DBCluster
  RDSClusterAdminSecret:
    Metadata:
      cfn_nag:
        rules_to_suppress:
          - id: W77
            reason: No cross-account access to this secret is required.
    Properties:
      Description: !Join
        - ''
        - - 'Admin credentials for '
          - !Ref 'AWS::StackName'
          - ' RDS cluster'
      GenerateSecretString:
        ExcludeCharacters: '"@/\,*!#$%-[]()_:^&`<>;+='''
        ExcludeLowercase: false
        ExcludeNumbers: false
        ExcludePunctuation: true
        ExcludeUppercase: false
        GenerateStringKey: password
        IncludeSpace: false
        PasswordLength: 16
        RequireEachIncludedType: true
        SecretStringTemplate: '{"username": "FEAdmin"}'
    Type: AWS::SecretsManager::Secret
  RDSClusterAdminSecretAttachment:
    DependsOn:
      - RDSCluster
      - RDSClusterAdminSecret
    Properties:
      SecretId: !Ref 'RDSClusterAdminSecret'
      TargetId: !Ref 'RDSCluster'
      TargetType: AWS::RDS::DBCluster
    Type: AWS::SecretsManager::SecretTargetAttachment
  RDSClusterErrorLogGroup:
    DependsOn:
      - RDSCluster
    Metadata:
      cfn_nag:
        rules_to_suppress:
          - id: W84
            reason: These logs do not contain sensitive data.
    Properties:
      LogGroupName: !Join
        - /
        - - /aws/rds/cluster
          - !Ref 'RDSCluster'
          - error
      RetentionInDays: !Ref 'LogRetentionInDays'
    Type: AWS::Logs::LogGroup
  RDSClusterInitializationStarter:
    DependsOn:
      - RDSClusterPrepPolicy
      - RDSInitializationDocument
      - FargateSecurityGroupEgressToRDS
      - AutomationDocumentStarterLogGroup
    Properties:
      Properties:
        AutomationDocumentName: !Ref 'RDSInitializationDocument'
        EligibleRequestTypes:
          - Create
        ExecutionRoleArn: !GetAtt 'RDSClusterPrepExecutionRole.Arn'
      ServiceToken: !GetAtt 'AutomationDocumentStarterFunction.Arn'
      Type: Custom::StartSSMAutomationDocument
      Version: '1.0'
    Type: AWS::CloudFormation::CustomResource
  RDSClusterInitializationWaiter:
    CreationPolicy:
      ResourceSignal:
        Count: 1
        Timeout: PT15M
    DependsOn:
      - RDSClusterPrepPolicy
      - RDSInitializationDocument
      - AutomationDocumentStarterLogGroup
    Type: AWS::CloudFormation::WaitCondition
  RDSClusterNonAdminSecret:
    Metadata:
      cfn_nag:
        rules_to_suppress:
          - id: W77
            reason: No cross-account access to this secret is required.
    Properties:
      Description: !Join
        - ''
        - - 'Non-Admin credentials for '
          - !Ref 'AWS::StackName'
          - ' RDS cluster'
      GenerateSecretString:
        ExcludeCharacters: '"@/\,*!#$%-[]()_:^&`<>;+='''
        ExcludeLowercase: false
        ExcludeNumbers: false
        ExcludePunctuation: true
        ExcludeUppercase: false
        GenerateStringKey: password
        IncludeSpace: false
        PasswordLength: 16
        RequireEachIncludedType: true
        SecretStringTemplate: '{"username": "fixengine"}'
    Type: AWS::SecretsManager::Secret
  RDSClusterNonAdminSecretArnParam:
    Condition: ''
    Properties:
      Description: !Join
        - ''
        - - 'ARN of RDS cluster non-admin secret for '
          - !Ref 'AWS::StackName'
          - ' stack'
      Name: !Join
        - /
        - - /fixengine
          - !Ref 'AWS::StackName'
          - RDSClusterNonAdminSecretArn
      Tier: Standard
      Type: String
      Value: !Ref 'RDSClusterNonAdminSecret'
    Type: AWS::SSM::Parameter
  RDSClusterNonAdminSecretAttachment:
    DependsOn:
      - RDSCluster
      - RDSClusterNonAdminSecret
    Properties:
      SecretId: !Ref 'RDSClusterNonAdminSecret'
      TargetId: !Ref 'RDSCluster'
      TargetType: AWS::RDS::DBCluster
    Type: AWS::SecretsManager::SecretTargetAttachment
  RDSClusterParameterGroup:
    Properties:
      Description: !Join
        - ''
        - - 'Cluster parameter group for '
          - !Ref 'AWS::StackName'
          - ' stack'
      Family: aurora5.6
      Parameters:
        server_audit_logging: 0
        server_audit_logs_upload: 0
    Type: AWS::RDS::DBClusterParameterGroup
  RDSClusterPrepExecutionRole:
    DependsOn: []
    Properties:
      AssumeRolePolicyDocument:
        Statement:
          - Action:
              - sts:AssumeRole
            Effect: Allow
            Principal:
              Service:
                - ssm.amazonaws.com
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/service-role/AmazonSSMAutomationRole
      Policies:
        - PolicyDocument:
            Statement:
              - Action:
                  - ec2:RunInstances
                Effect: Allow
                Resource:
                  - !Join
                    - ''
                    - - 'arn:aws:ec2:'
                      - !Ref 'AWS::Region'
                      - ::image/*
                  - !Join
                    - ''
                    - - 'arn:aws:ec2:'
                      - !Ref 'AWS::Region'
                      - ':'
                      - !Ref 'AWS::AccountId'
                      - :subnet/*
                  - !Join
                    - ''
                    - - 'arn:aws:ec2:'
                      - !Ref 'AWS::Region'
                      - ':'
                      - !Ref 'AWS::AccountId'
                      - :security-group/
                      - !GetAtt 'RDSClusterSecurityGroup.GroupId'
              - Action:
                  - iam:PassRole
                Effect: Allow
                Resource:
                  - !GetAtt 'RDSClusterPrepInstanceRole.Arn'
              - Action:
                  - cloudformation:SignalResource
                Effect: Allow
                Resource:
                  - !Ref 'AWS::StackId'
          PolicyName: primary-policy
    Type: AWS::IAM::Role
  RDSClusterPrepInstanceRole:
    DependsOn:
      - RDSClusterPrepLogGroup
      - RDSClusterAdminSecret
      - RDSClusterNonAdminSecret
    Properties:
      AssumeRolePolicyDocument:
        Statement:
          - Action:
              - sts:AssumeRole
            Effect: Allow
            Principal:
              Service:
                - ec2.amazonaws.com
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore
      Policies:
        - PolicyDocument:
            Statement:
              - Action:
                  - secretsmanager:GetSecretValue
                Effect: Allow
                Resource:
                  - !Ref 'RDSClusterAdminSecret'
                  - !Ref 'RDSClusterNonAdminSecret'
              - Action:
                  - logs:PutLogEvents
                  - logs:CreateLogGroup
                  - logs:CreateLogStream
                  - logs:DescribeLogGroups
                  - logs:DescribeLogStreams
                Effect: Allow
                Resource:
                  - !Join
                    - ''
                    - - 'arn:aws:logs:'
                      - !Ref 'AWS::Region'
                      - ':'
                      - !Ref 'AWS::AccountId'
                      - ':log-group:'
                      - !Ref 'RDSClusterPrepLogGroup'
                  - !Join
                    - ''
                    - - 'arn:aws:logs:'
                      - !Ref 'AWS::Region'
                      - ':'
                      - !Ref 'AWS::AccountId'
                      - ':log-group:'
                      - !Ref 'RDSClusterPrepLogGroup'
                      - :log-stream:*
          PolicyName: primary-policy
    Type: AWS::IAM::Role
  RDSClusterPrepInstanceRoleProfile:
    DependsOn:
      - RDSClusterPrepInstanceRole
    Properties:
      Path: /
      Roles:
        - !Ref 'RDSClusterPrepInstanceRole'
    Type: AWS::IAM::InstanceProfile
  RDSClusterPrepLogGroup:
    Metadata:
      cfn_nag:
        rules_to_suppress:
          - id: W84
            reason: These logs do not contain sensitive data.
    Properties:
      LogGroupName: !Join
        - /
        - - /aws/ssm
          - !Ref 'AWS::StackName'
          - RDSPrepAutomation
      RetentionInDays: !Ref 'LogRetentionInDays'
    Type: AWS::Logs::LogGroup
  RDSClusterPrepPolicy:
    DependsOn:
      - AutomationDocumentStarterRole
      - RDSInitializationDocument
      - RDSClusterPrepExecutionRole
    Properties:
      PolicyDocument:
        Statement:
          - Action:
              - iam:PassRole
            Effect: Allow
            Resource:
              - !GetAtt 'RDSClusterPrepExecutionRole.Arn'
          - Action:
              - ssm:StartAutomationExecution
            Effect: Allow
            Resource:
              - !Join
                - ''
                - - 'arn:aws:ssm:'
                  - !Ref 'AWS::Region'
                  - ':'
                  - !Ref 'AWS::AccountId'
                  - :automation-definition/
                  - !Ref 'RDSInitializationDocument'
                  - :$DEFAULT
      PolicyName: RDSClusterPrepPolicy
      Roles:
        - !Ref 'AutomationDocumentStarterRole'
    Type: AWS::IAM::Policy
  RDSClusterPrepSecurityGroup:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -



