cloudformation/FIXEngineApplication.yml [868:1134]:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Metadata:
      cfn_nag:
        rules_to_suppress:
          - id: W5
            reason: Outbound HTTP(S) traffic is required to download third-party dependencies.
    Properties:
      GroupDescription: Security Group for EC2 Instances Launched via SSM Automation
      SecurityGroupEgress:
        - CidrIp: '0.0.0.0/0'
          Description: All HTTP Traffic
          FromPort: 80
          IpProtocol: tcp
          ToPort: 80
        - CidrIp: '0.0.0.0/0'
          Description: Allow All HTTPS Traffic
          FromPort: 443
          IpProtocol: tcp
          ToPort: 443
      VpcId: !Ref 'VPC'
    Type: AWS::EC2::SecurityGroup
  ECSImageBuildStarter:
    DependsOn:
      - ECRRepository
      - ECSImageBuildPolicy
      - ECSImageBuildDocument
      - AutomationDocumentStarterLogGroup
    Properties:
      Properties:
        AutomationDocumentName: !Ref 'ECSImageBuildDocument'
        EligibleRequestTypes:
          - Create
          - Update
        ExecutionRoleArn: !GetAtt 'ECSImageBuildExecutionRole.Arn'
        RepositoryName: !Ref 'ECRRepository'
        TemplateVersion: '1.37'
      ServiceToken: !GetAtt 'AutomationDocumentStarterFunction.Arn'
      Type: Custom::StartSSMAutomationDocument
      Version: '1.0'
    Type: AWS::CloudFormation::CustomResource
  ECSImageBuildWaiter:
    CreationPolicy:
      ResourceSignal:
        Count: 1
        Timeout: PT20M
    DependsOn:
      - ECSImageBuildPolicy
      - ECSImageBuildDocument
      - AutomationDocumentStarterLogGroup
    Type: AWS::CloudFormation::WaitCondition
  ECSImageRemover:
    DependsOn:
      - ECRRepository
      - ECSImageRemoverLogGroup
    Properties:
      Properties:
        RepositoryName: !Ref 'ECRRepository'
      ServiceToken: !GetAtt 'ECSImageRemoverFunction.Arn'
      Type: Custom::ECSImageRemover
      Version: '1.0'
    Type: AWS::CloudFormation::CustomResource
  ECSImageRemoverFunction:
    Condition: ''
    DependsOn:
      - ECSImageRemoverRole
    Metadata:
      cfn_nag:
        rules_to_suppress:
          - id: W89
            reason: This function is only invoked during the deployment of this solution,
              potentially PRIOR to the creation of a VPC, and is never used again.
          - id: W92
            reason: This function is only invoked during the deployment of this solution
              and is never used again. Reserving concurrency would therefore be wasteful.
    Properties:
      Code:
        ZipFile: "import json\nimport boto3\nimport logging\nimport cfnresponse\n\
          from botocore.exceptions import ClientError\n\nLOGGER = logging.getLogger()\n\
          LOGGER.setLevel(logging.INFO)\nlogging.getLogger('boto3').setLevel(logging.INFO)\n\
          logging.getLogger('botocore').setLevel(logging.INFO)\n\n'''\n    - RepositoryName\
          \ | str\n'''\ndef handler(event, context):\n\n    LOGGER.info('----- REQUEST\
          \ RECEIVED -----')\n    LOGGER.info(json.dumps(event))\n\n    responseData\
          \ = {}\n\n    operation = event['ResourceProperties']['Type'].split('Custom::')[1]\n\
          \    properties = event['ResourceProperties']['Properties']\n    \n    if\
          \ event['RequestType'] in ['Delete']:\n        \n        ecr_client = boto3.client('ecr')\n\
          \n        try:\n            \n            existing_images = ecr_client.describe_images(\n\
          \                repositoryName = properties['RepositoryName']\n       \
          \     )\n            \n            if len(existing_images['imageDetails'])\
          \ > 0:\n                \n                images_to_delete = []\n      \
          \          for image in existing_images['imageDetails']:\n             \
          \       \n                    images_to_delete.append({\n              \
          \          'imageDigest': image['imageDigest']\n                    })\n\
          \                    \n                ecr_client.batch_delete_image(\n\
          \                    repositoryName = properties['RepositoryName'],\n  \
          \                  imageIds = images_to_delete\n                )\n    \
          \            \n            return cfnresponse.send(event, context, cfnresponse.SUCCESS,\
          \ responseData, properties['RepositoryName'])\n            \n        except\
          \ ClientError as e:\n        \n            print(str(e))\n            return\
          \ cfnresponse.send(event, context, cfnresponse.FAILED, responseData)\n \
          \   \n    elif event['RequestType'] in ['Create', 'Update']:\n        \n\
          \        return cfnresponse.send(event, context, cfnresponse.SUCCESS, responseData)"
      Description: !Join
        - ''
        - - 'ECSImageRemover resource for '
          - !Ref 'AWS::StackName'
          - ' stack'
      Handler: index.handler
      KmsKeyArn: !If
        - KMSKeySupplied
        - !Ref 'KMSKeyARN'
        - ''
      Role: !GetAtt 'ECSImageRemoverRole.Arn'
      Runtime: python3.7
      Timeout: 15
    Type: AWS::Lambda::Function
  ECSImageRemoverLogGroup:
    Condition: ''
    DependsOn:
      - ECSImageRemoverFunction
    Metadata:
      cfn_nag:
        rules_to_suppress:
          - id: W84
            reason: These logs do not contain sensitive data.
    Properties:
      LogGroupName: !Join
        - ''
        - - /aws/lambda/
          - !Ref 'ECSImageRemoverFunction'
      RetentionInDays: !Ref 'LogRetentionInDays'
    Type: AWS::Logs::LogGroup
  ECSImageRemoverRole:
    Condition: ''
    DependsOn:
      - ECRRepository
    Metadata: {}
    Properties:
      AssumeRolePolicyDocument:
        Statement:
          - Action:
              - sts:AssumeRole
            Effect: Allow
            Principal:
              Service:
                - lambda.amazonaws.com
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole
      Policies:
        - PolicyDocument:
            Statement:
              - Action:
                  - ecr:DescribeImages
                  - ecr:BatchDeleteImage
                Effect: Allow
                Resource:
                  - !GetAtt 'ECRRepository.Arn'
          PolicyName: PrimaryPolicy
    Type: AWS::IAM::Role
  FIXClientPrefixListUpdater:
    DependsOn:
      - FIXClientVPCPrefixList
      - VPCPrefixListManagerLogGroup
    Properties:
      Properties:
        AuthorizedCidrs: !Ref 'FIXClientCIDRs'
        EntryDescription: !Join
          - ''
          - - 'Authorized FIX Client CIDR in '
            - !Ref 'AWS::StackName'
            - ' stack'
        PrefixListId: !Ref 'FIXClientVPCPrefixList'
      ServiceToken: !GetAtt 'VPCPrefixListManagerFunction.Arn'
      Type: Custom::UpdateFIXClientPrefixList
      Version: '1.0'
    Type: AWS::CloudFormation::CustomResource
  FIXClientVPCPrefixList:
    Properties:
      AddressFamily: IPv4
      MaxEntries: 5
      PrefixListName: !Join
        - ''
        - - !Ref 'AWS::StackName'
          - '-'
          - FIXClientCIDRs
    Type: AWS::EC2::PrefixList
  FIXServerDNSNameParam:
    Condition: ''
    Properties:
      Description: !Join
        - ''
        - - 'Socket connection host for '
          - !Ref 'AWS::StackName'
          - ' stack'
      Name: !Join
        - /
        - - /fixengine
          - !Ref 'AWS::StackName'
          - FIXServerDNSName
      Tier: Standard
      Type: String
      Value: !If
        - FIXServerDNSNameSupplied
        - !Ref 'FIXServerDNSName'
        - None
    Type: AWS::SSM::Parameter
  FIXServerPortParam:
    Condition: ''
    Properties:
      Description: !Join
        - ''
        - - 'FIX engine server port defined in the parameters of the '
          - !Ref 'AWS::StackName'
          - ' stack'
      Name: !Join
        - /
        - - /fixengine
          - !Ref 'AWS::StackName'
          - FIXServerPort
      Tier: Standard
      Type: String
      Value: !Ref 'FIXServerPort'
    Type: AWS::SSM::Parameter
  FIXVersionIntParam:
    Condition: ''
    Properties:
      Description: !Join
        - ''
        - - 'FIX engine version as integer for '
          - !Ref 'AWS::StackName'
          - ' stack'
      Name: !Join
        - /
        - - /fixengine
          - !Ref 'AWS::StackName'
          - FIXVersionInt
      Tier: Standard
      Type: String
      Value: !Join
        - ''
        - !Split
          - .
          - !Ref 'FIXVersion'
    Type: AWS::SSM::Parameter
  FIXVersionParam:
    Condition: ''
    Properties:
      Description: !Join
        - ''
        - - 'FIX engine version for '
          - !Ref 'AWS::StackName'
          - ' stack'
      Name: !Join
        - /
        - - /fixengine
          - !Ref 'AWS::StackName'
          - FIXVersion
      Tier: Standard
      Type: String
      Value: !Ref 'FIXVersion'
    Type: AWS::SSM::Parameter
  FailoverAcceptorECSService:
    Condition: IsAcceptorStack
    DependsOn:
      - FailoverECSCluster
      - FargateSecurityGroup
      - FailoverAcceptorECSTaskDefinition
      - FailoverTargetGroup
      - FailoverNLBListener
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -



cloudformation/FIXEngineVPCApplication.yml [878:1144]:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Metadata:
      cfn_nag:
        rules_to_suppress:
          - id: W5
            reason: Outbound HTTP(S) traffic is required to download third-party dependencies.
    Properties:
      GroupDescription: Security Group for EC2 Instances Launched via SSM Automation
      SecurityGroupEgress:
        - CidrIp: '0.0.0.0/0'
          Description: All HTTP Traffic
          FromPort: 80
          IpProtocol: tcp
          ToPort: 80
        - CidrIp: '0.0.0.0/0'
          Description: Allow All HTTPS Traffic
          FromPort: 443
          IpProtocol: tcp
          ToPort: 443
      VpcId: !Ref 'VPC'
    Type: AWS::EC2::SecurityGroup
  ECSImageBuildStarter:
    DependsOn:
      - ECRRepository
      - ECSImageBuildPolicy
      - ECSImageBuildDocument
      - AutomationDocumentStarterLogGroup
    Properties:
      Properties:
        AutomationDocumentName: !Ref 'ECSImageBuildDocument'
        EligibleRequestTypes:
          - Create
          - Update
        ExecutionRoleArn: !GetAtt 'ECSImageBuildExecutionRole.Arn'
        RepositoryName: !Ref 'ECRRepository'
        TemplateVersion: '1.37'
      ServiceToken: !GetAtt 'AutomationDocumentStarterFunction.Arn'
      Type: Custom::StartSSMAutomationDocument
      Version: '1.0'
    Type: AWS::CloudFormation::CustomResource
  ECSImageBuildWaiter:
    CreationPolicy:
      ResourceSignal:
        Count: 1
        Timeout: PT20M
    DependsOn:
      - ECSImageBuildPolicy
      - ECSImageBuildDocument
      - AutomationDocumentStarterLogGroup
    Type: AWS::CloudFormation::WaitCondition
  ECSImageRemover:
    DependsOn:
      - ECRRepository
      - ECSImageRemoverLogGroup
    Properties:
      Properties:
        RepositoryName: !Ref 'ECRRepository'
      ServiceToken: !GetAtt 'ECSImageRemoverFunction.Arn'
      Type: Custom::ECSImageRemover
      Version: '1.0'
    Type: AWS::CloudFormation::CustomResource
  ECSImageRemoverFunction:
    Condition: ''
    DependsOn:
      - ECSImageRemoverRole
    Metadata:
      cfn_nag:
        rules_to_suppress:
          - id: W89
            reason: This function is only invoked during the deployment of this solution,
              potentially PRIOR to the creation of a VPC, and is never used again.
          - id: W92
            reason: This function is only invoked during the deployment of this solution
              and is never used again. Reserving concurrency would therefore be wasteful.
    Properties:
      Code:
        ZipFile: "import json\nimport boto3\nimport logging\nimport cfnresponse\n\
          from botocore.exceptions import ClientError\n\nLOGGER = logging.getLogger()\n\
          LOGGER.setLevel(logging.INFO)\nlogging.getLogger('boto3').setLevel(logging.INFO)\n\
          logging.getLogger('botocore').setLevel(logging.INFO)\n\n'''\n    - RepositoryName\
          \ | str\n'''\ndef handler(event, context):\n\n    LOGGER.info('----- REQUEST\
          \ RECEIVED -----')\n    LOGGER.info(json.dumps(event))\n\n    responseData\
          \ = {}\n\n    operation = event['ResourceProperties']['Type'].split('Custom::')[1]\n\
          \    properties = event['ResourceProperties']['Properties']\n    \n    if\
          \ event['RequestType'] in ['Delete']:\n        \n        ecr_client = boto3.client('ecr')\n\
          \n        try:\n            \n            existing_images = ecr_client.describe_images(\n\
          \                repositoryName = properties['RepositoryName']\n       \
          \     )\n            \n            if len(existing_images['imageDetails'])\
          \ > 0:\n                \n                images_to_delete = []\n      \
          \          for image in existing_images['imageDetails']:\n             \
          \       \n                    images_to_delete.append({\n              \
          \          'imageDigest': image['imageDigest']\n                    })\n\
          \                    \n                ecr_client.batch_delete_image(\n\
          \                    repositoryName = properties['RepositoryName'],\n  \
          \                  imageIds = images_to_delete\n                )\n    \
          \            \n            return cfnresponse.send(event, context, cfnresponse.SUCCESS,\
          \ responseData, properties['RepositoryName'])\n            \n        except\
          \ ClientError as e:\n        \n            print(str(e))\n            return\
          \ cfnresponse.send(event, context, cfnresponse.FAILED, responseData)\n \
          \   \n    elif event['RequestType'] in ['Create', 'Update']:\n        \n\
          \        return cfnresponse.send(event, context, cfnresponse.SUCCESS, responseData)"
      Description: !Join
        - ''
        - - 'ECSImageRemover resource for '
          - !Ref 'AWS::StackName'
          - ' stack'
      Handler: index.handler
      KmsKeyArn: !If
        - KMSKeySupplied
        - !Ref 'KMSKeyARN'
        - ''
      Role: !GetAtt 'ECSImageRemoverRole.Arn'
      Runtime: python3.7
      Timeout: 15
    Type: AWS::Lambda::Function
  ECSImageRemoverLogGroup:
    Condition: ''
    DependsOn:
      - ECSImageRemoverFunction
    Metadata:
      cfn_nag:
        rules_to_suppress:
          - id: W84
            reason: These logs do not contain sensitive data.
    Properties:
      LogGroupName: !Join
        - ''
        - - /aws/lambda/
          - !Ref 'ECSImageRemoverFunction'
      RetentionInDays: !Ref 'LogRetentionInDays'
    Type: AWS::Logs::LogGroup
  ECSImageRemoverRole:
    Condition: ''
    DependsOn:
      - ECRRepository
    Metadata: {}
    Properties:
      AssumeRolePolicyDocument:
        Statement:
          - Action:
              - sts:AssumeRole
            Effect: Allow
            Principal:
              Service:
                - lambda.amazonaws.com
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole
      Policies:
        - PolicyDocument:
            Statement:
              - Action:
                  - ecr:DescribeImages
                  - ecr:BatchDeleteImage
                Effect: Allow
                Resource:
                  - !GetAtt 'ECRRepository.Arn'
          PolicyName: PrimaryPolicy
    Type: AWS::IAM::Role
  FIXClientPrefixListUpdater:
    DependsOn:
      - FIXClientVPCPrefixList
      - VPCPrefixListManagerLogGroup
    Properties:
      Properties:
        AuthorizedCidrs: !Ref 'FIXClientCIDRs'
        EntryDescription: !Join
          - ''
          - - 'Authorized FIX Client CIDR in '
            - !Ref 'AWS::StackName'
            - ' stack'
        PrefixListId: !Ref 'FIXClientVPCPrefixList'
      ServiceToken: !GetAtt 'VPCPrefixListManagerFunction.Arn'
      Type: Custom::UpdateFIXClientPrefixList
      Version: '1.0'
    Type: AWS::CloudFormation::CustomResource
  FIXClientVPCPrefixList:
    Properties:
      AddressFamily: IPv4
      MaxEntries: 5
      PrefixListName: !Join
        - ''
        - - !Ref 'AWS::StackName'
          - '-'
          - FIXClientCIDRs
    Type: AWS::EC2::PrefixList
  FIXServerDNSNameParam:
    Condition: ''
    Properties:
      Description: !Join
        - ''
        - - 'Socket connection host for '
          - !Ref 'AWS::StackName'
          - ' stack'
      Name: !Join
        - /
        - - /fixengine
          - !Ref 'AWS::StackName'
          - FIXServerDNSName
      Tier: Standard
      Type: String
      Value: !If
        - FIXServerDNSNameSupplied
        - !Ref 'FIXServerDNSName'
        - None
    Type: AWS::SSM::Parameter
  FIXServerPortParam:
    Condition: ''
    Properties:
      Description: !Join
        - ''
        - - 'FIX engine server port defined in the parameters of the '
          - !Ref 'AWS::StackName'
          - ' stack'
      Name: !Join
        - /
        - - /fixengine
          - !Ref 'AWS::StackName'
          - FIXServerPort
      Tier: Standard
      Type: String
      Value: !Ref 'FIXServerPort'
    Type: AWS::SSM::Parameter
  FIXVersionIntParam:
    Condition: ''
    Properties:
      Description: !Join
        - ''
        - - 'FIX engine version as integer for '
          - !Ref 'AWS::StackName'
          - ' stack'
      Name: !Join
        - /
        - - /fixengine
          - !Ref 'AWS::StackName'
          - FIXVersionInt
      Tier: Standard
      Type: String
      Value: !Join
        - ''
        - !Split
          - .
          - !Ref 'FIXVersion'
    Type: AWS::SSM::Parameter
  FIXVersionParam:
    Condition: ''
    Properties:
      Description: !Join
        - ''
        - - 'FIX engine version for '
          - !Ref 'AWS::StackName'
          - ' stack'
      Name: !Join
        - /
        - - /fixengine
          - !Ref 'AWS::StackName'
          - FIXVersion
      Tier: Standard
      Type: String
      Value: !Ref 'FIXVersion'
    Type: AWS::SSM::Parameter
  FailoverAcceptorECSService:
    Condition: IsAcceptorStack
    DependsOn:
      - FailoverECSCluster
      - FargateSecurityGroup
      - FailoverAcceptorECSTaskDefinition
      - FailoverTargetGroup
      - FailoverNLBListener
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -



