cloudformation/FIXEngineApplication.yml [2212:2455]:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Properties:
      GroupDescription: Security Group for MSK Cluster
      SecurityGroupEgress:
        - CidrIp: '0.0.0.0/32'
          Description: Deny All Traffic
          FromPort: 1
          IpProtocol: tcp
          ToPort: 1
      SecurityGroupIngress:
        - Description: MSK Access for Private User App Ranges
          FromPort: !If
            - KafkaTLSEnabled
            - 9094
            - 9092
          IpProtocol: tcp
          SourcePrefixListId: !Ref 'UserApplicationVPCPrefixList'
          ToPort: !If
            - KafkaTLSEnabled
            - 9094
            - 9092
        - Description: Non TLS Communication
          FromPort: !If
            - KafkaTLSEnabled
            - 9094
            - 9092
          IpProtocol: tcp
          SourceSecurityGroupId: !Ref 'FargateSecurityGroup'
          ToPort: !If
            - KafkaTLSEnabled
            - 9094
            - 9092
        - Description: Zookeeper Administration
          FromPort: 2181
          IpProtocol: tcp
          SourceSecurityGroupId: !Ref 'MSKClusterPrepSecurityGroup'
          ToPort: 2181
      VpcId: !Ref 'VPC'
    Type: AWS::EC2::SecurityGroup
  MSKInitializationDocument:
    DependsOn:
      - MSKCluster
      - MSKClusterPrepExecutionRole
      - MSKClusterPrepSecurityGroup
      - MSKClusterPrepInstanceRoleProfile
    Properties:
      Content:
        assumeRole: '{{ExecutionRoleArn}}'
        description: !Join
          - ''
          - - 'Configures the MSK cluster by CloudFormation stack '
            - !Ref 'AWS::StackName'
        mainSteps:
          - action: aws:runInstances
            inputs:
              BlockDeviceMappings:
                - DeviceName: /dev/sda1
                  Ebs:
                    Encrypted: true
                    VolumeSize: 8
                    VolumeType: gp2
              IamInstanceProfileName: !Ref 'MSKClusterPrepInstanceRoleProfile'
              ImageId: '{{LatestAmazonLinux2AMIId}}'
              InstanceType: t3a.small
              MaxInstanceCount: 1
              MinInstanceCount: 1
              SecurityGroupIds:
                - !Ref 'MSKClusterPrepSecurityGroup'
              SubnetId: !Ref 'PrimaryPrivateSubnet'
              TagSpecifications:
                - ResourceType: instance
                  Tags:
                    - Key: Name
                      Value: !Join
                        - '-'
                        - - !Ref 'AWS::StackName'
                          - MSKInitializer
                    - Key: LaunchedBy
                      Value: SSMAutomation
                    - Key: StackName
                      Value: !Ref 'AWS::StackName'
            maxAttempts: 3
            name: LaunchInstance
            onFailure: step:SignalFailure
            timeoutSeconds: 300
          - action: aws:runCommand
            inputs:
              CloudWatchOutputConfig:
                CloudWatchLogGroupName: !Ref 'MSKClusterPrepLogGroup'
                CloudWatchOutputEnabled: true
              DocumentName: AWS-RunShellScript
              InstanceIds:
                - '{{LaunchInstance.InstanceIds}}'
              Parameters:
                commands:
                  - sudo yum -y update
                  - sudo yum -y install java-1.8.0-openjdk-devel
                  - sudo wget https://archive.apache.org/dist/kafka/2.2.1/kafka_2.12-2.2.1.tgz
                  - sudo tar -xzf kafka_2.12-2.2.1.tgz
                  - cd kafka_2.12-2.2.1
                  - !Join
                    - ''
                    - - 'ZOOKEEPER_CONN_STRING=$(aws kafka describe-cluster --region '
                      - !Ref 'AWS::Region'
                      - ' --cluster-arn "'
                      - !Ref 'MSKCluster'
                      - '" --query ''ClusterInfo.ZookeeperConnectString'' --output
                        text)'
                  - !Join
                    - ''
                    - - bin/kafka-topics.sh --create --zookeeper $ZOOKEEPER_CONN_STRING
                        --replication-factor 2 --partitions 1 --topic "TO-FIX-ENGINE"
                  - !Join
                    - ''
                    - - bin/kafka-topics.sh --create --zookeeper $ZOOKEEPER_CONN_STRING
                        --replication-factor 2 --partitions 1 --topic "FROM-FIX-ENGINE"
            name: CreateMSKTopics
            onFailure: step:TerminateInstanceOnFailure
          - action: aws:executeAwsApi
            inputs:
              Api: TerminateInstances
              InstanceIds:
                - '{{LaunchInstance.InstanceIds}}'
              Service: ec2
            name: TerminateInstanceOnSuccess
            onFailure: step:SignalFailure
          - action: aws:executeAwsApi
            inputs:
              Api: SignalResource
              LogicalResourceId: MSKClusterInitializationWaiter
              Service: cloudformation
              StackName: !Ref 'AWS::StackName'
              Status: SUCCESS
              UniqueId: !Ref 'AWS::StackName'
            isEnd: true
            name: SignalSuccess
            onFailure: step:SignalFailure
          - action: aws:executeAwsApi
            inputs:
              Api: TerminateInstances
              InstanceIds:
                - '{{LaunchInstance.InstanceIds}}'
              Service: ec2
            name: TerminateInstanceOnFailure
            onFailure: step:SignalFailure
          - action: aws:executeAwsApi
            inputs:
              Api: SignalResource
              LogicalResourceId: MSKClusterInitializationWaiter
              Service: cloudformation
              StackName: !Ref 'AWS::StackName'
              Status: FAILURE
              UniqueId: !Ref 'AWS::StackName'
            isEnd: true
            name: SignalFailure
        parameters:
          ExecutionRoleArn:
            default: !GetAtt 'MSKClusterPrepExecutionRole.Arn'
            description: The service role to use for this automation.
            type: String
          LatestAmazonLinux2AMIId:
            default: '{{ssm:/aws/service/ami-amazon-linux-latest/amzn2-ami-hvm-x86_64-ebs}}'
            description: The latest Amazon Linux 2 AMI queried from the public parameter.
            type: String
        schemaVersion: '0.3'
      DocumentType: Automation
    Type: AWS::SSM::Document
  MiscMethodsHandlerFunction:
    Condition: ''
    DependsOn:
      - MiscMethodsHandlerRole
    Metadata:
      cfn_nag:
        rules_to_suppress:
          - id: W89
            reason: This function is only invoked during the deployment of this solution,
              potentially PRIOR to the creation of a VPC, and is never used again.
          - id: W92
            reason: This function is only invoked during the deployment of this solution
              and is never used again. Reserving concurrency would therefore be wasteful.
    Properties:
      Code:
        ZipFile: "import json\nimport logging\nimport cfnresponse\nfrom botocore.exceptions\
          \ import ClientError\n\nLOGGER = logging.getLogger()\nLOGGER.setLevel(logging.INFO)\n\
          \ndef handler(event, context):\n\n    LOGGER.info('----- REQUEST RECEIVED\
          \ -----')\n    LOGGER.info(json.dumps(event))\n\n    response_data = {}\n\
          \    \n    operation = event['ResourceProperties']['Type'].split('Custom::')[1]\n\
          \    properties = event['ResourceProperties']['Properties']\n    \n    if\
          \ event['RequestType'] in ['Create', 'Update']:\n        \n        if operation\
          \ == 'ManipulateString':\n            \n            action = properties['Action']\n\
          \            input_str = properties['InputString']\n            \n     \
          \       if action == 'lower':\n                sanitized_str = input_str.lower()\n\
          \                \n            elif action == 'upper':\n               \
          \ sanitized_str = input_str.upper()\n                \n            response_data['OutputString']\
          \ = sanitized_str\n            return cfnresponse.send(event, context, cfnresponse.SUCCESS,\
          \ response_data, sanitized_str)\n                \n    elif event['RequestType']\
          \ in ['Delete']:\n        \n        return cfnresponse.send(event, context,\
          \ cfnresponse.SUCCESS, response_data)"
      Description: !Join
        - ''
        - - 'MiscMethodsHandler resource for '
          - !Ref 'AWS::StackName'
          - ' stack'
      Handler: index.handler
      KmsKeyArn: !If
        - KMSKeySupplied
        - !Ref 'KMSKeyARN'
        - ''
      Role: !GetAtt 'MiscMethodsHandlerRole.Arn'
      Runtime: python3.7
      Timeout: 15
    Type: AWS::Lambda::Function
  MiscMethodsHandlerLogGroup:
    Condition: ''
    DependsOn:
      - MiscMethodsHandlerFunction
    Metadata:
      cfn_nag:
        rules_to_suppress:
          - id: W84
            reason: These logs do not contain sensitive data.
    Properties:
      LogGroupName: !Join
        - ''
        - - /aws/lambda/
          - !Ref 'MiscMethodsHandlerFunction'
      RetentionInDays: !Ref 'LogRetentionInDays'
    Type: AWS::Logs::LogGroup
  MiscMethodsHandlerRole:
    Condition: ''
    DependsOn: []
    Metadata: {}
    Properties:
      AssumeRolePolicyDocument:
        Statement:
          - Action:
              - sts:AssumeRole
            Effect: Allow
            Principal:
              Service:
                - lambda.amazonaws.com
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole
      Policies: []
    Type: AWS::IAM::Role
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -



cloudformation/FIXEngineVPCApplication.yml [2381:2624]:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Properties:
      GroupDescription: Security Group for MSK Cluster
      SecurityGroupEgress:
        - CidrIp: '0.0.0.0/32'
          Description: Deny All Traffic
          FromPort: 1
          IpProtocol: tcp
          ToPort: 1
      SecurityGroupIngress:
        - Description: MSK Access for Private User App Ranges
          FromPort: !If
            - KafkaTLSEnabled
            - 9094
            - 9092
          IpProtocol: tcp
          SourcePrefixListId: !Ref 'UserApplicationVPCPrefixList'
          ToPort: !If
            - KafkaTLSEnabled
            - 9094
            - 9092
        - Description: Non TLS Communication
          FromPort: !If
            - KafkaTLSEnabled
            - 9094
            - 9092
          IpProtocol: tcp
          SourceSecurityGroupId: !Ref 'FargateSecurityGroup'
          ToPort: !If
            - KafkaTLSEnabled
            - 9094
            - 9092
        - Description: Zookeeper Administration
          FromPort: 2181
          IpProtocol: tcp
          SourceSecurityGroupId: !Ref 'MSKClusterPrepSecurityGroup'
          ToPort: 2181
      VpcId: !Ref 'VPC'
    Type: AWS::EC2::SecurityGroup
  MSKInitializationDocument:
    DependsOn:
      - MSKCluster
      - MSKClusterPrepExecutionRole
      - MSKClusterPrepSecurityGroup
      - MSKClusterPrepInstanceRoleProfile
    Properties:
      Content:
        assumeRole: '{{ExecutionRoleArn}}'
        description: !Join
          - ''
          - - 'Configures the MSK cluster by CloudFormation stack '
            - !Ref 'AWS::StackName'
        mainSteps:
          - action: aws:runInstances
            inputs:
              BlockDeviceMappings:
                - DeviceName: /dev/sda1
                  Ebs:
                    Encrypted: true
                    VolumeSize: 8
                    VolumeType: gp2
              IamInstanceProfileName: !Ref 'MSKClusterPrepInstanceRoleProfile'
              ImageId: '{{LatestAmazonLinux2AMIId}}'
              InstanceType: t3a.small
              MaxInstanceCount: 1
              MinInstanceCount: 1
              SecurityGroupIds:
                - !Ref 'MSKClusterPrepSecurityGroup'
              SubnetId: !Ref 'PrimaryPrivateSubnet'
              TagSpecifications:
                - ResourceType: instance
                  Tags:
                    - Key: Name
                      Value: !Join
                        - '-'
                        - - !Ref 'AWS::StackName'
                          - MSKInitializer
                    - Key: LaunchedBy
                      Value: SSMAutomation
                    - Key: StackName
                      Value: !Ref 'AWS::StackName'
            maxAttempts: 3
            name: LaunchInstance
            onFailure: step:SignalFailure
            timeoutSeconds: 300
          - action: aws:runCommand
            inputs:
              CloudWatchOutputConfig:
                CloudWatchLogGroupName: !Ref 'MSKClusterPrepLogGroup'
                CloudWatchOutputEnabled: true
              DocumentName: AWS-RunShellScript
              InstanceIds:
                - '{{LaunchInstance.InstanceIds}}'
              Parameters:
                commands:
                  - sudo yum -y update
                  - sudo yum -y install java-1.8.0-openjdk-devel
                  - sudo wget https://archive.apache.org/dist/kafka/2.2.1/kafka_2.12-2.2.1.tgz
                  - sudo tar -xzf kafka_2.12-2.2.1.tgz
                  - cd kafka_2.12-2.2.1
                  - !Join
                    - ''
                    - - 'ZOOKEEPER_CONN_STRING=$(aws kafka describe-cluster --region '
                      - !Ref 'AWS::Region'
                      - ' --cluster-arn "'
                      - !Ref 'MSKCluster'
                      - '" --query ''ClusterInfo.ZookeeperConnectString'' --output
                        text)'
                  - !Join
                    - ''
                    - - bin/kafka-topics.sh --create --zookeeper $ZOOKEEPER_CONN_STRING
                        --replication-factor 2 --partitions 1 --topic "TO-FIX-ENGINE"
                  - !Join
                    - ''
                    - - bin/kafka-topics.sh --create --zookeeper $ZOOKEEPER_CONN_STRING
                        --replication-factor 2 --partitions 1 --topic "FROM-FIX-ENGINE"
            name: CreateMSKTopics
            onFailure: step:TerminateInstanceOnFailure
          - action: aws:executeAwsApi
            inputs:
              Api: TerminateInstances
              InstanceIds:
                - '{{LaunchInstance.InstanceIds}}'
              Service: ec2
            name: TerminateInstanceOnSuccess
            onFailure: step:SignalFailure
          - action: aws:executeAwsApi
            inputs:
              Api: SignalResource
              LogicalResourceId: MSKClusterInitializationWaiter
              Service: cloudformation
              StackName: !Ref 'AWS::StackName'
              Status: SUCCESS
              UniqueId: !Ref 'AWS::StackName'
            isEnd: true
            name: SignalSuccess
            onFailure: step:SignalFailure
          - action: aws:executeAwsApi
            inputs:
              Api: TerminateInstances
              InstanceIds:
                - '{{LaunchInstance.InstanceIds}}'
              Service: ec2
            name: TerminateInstanceOnFailure
            onFailure: step:SignalFailure
          - action: aws:executeAwsApi
            inputs:
              Api: SignalResource
              LogicalResourceId: MSKClusterInitializationWaiter
              Service: cloudformation
              StackName: !Ref 'AWS::StackName'
              Status: FAILURE
              UniqueId: !Ref 'AWS::StackName'
            isEnd: true
            name: SignalFailure
        parameters:
          ExecutionRoleArn:
            default: !GetAtt 'MSKClusterPrepExecutionRole.Arn'
            description: The service role to use for this automation.
            type: String
          LatestAmazonLinux2AMIId:
            default: '{{ssm:/aws/service/ami-amazon-linux-latest/amzn2-ami-hvm-x86_64-ebs}}'
            description: The latest Amazon Linux 2 AMI queried from the public parameter.
            type: String
        schemaVersion: '0.3'
      DocumentType: Automation
    Type: AWS::SSM::Document
  MiscMethodsHandlerFunction:
    Condition: ''
    DependsOn:
      - MiscMethodsHandlerRole
    Metadata:
      cfn_nag:
        rules_to_suppress:
          - id: W89
            reason: This function is only invoked during the deployment of this solution,
              potentially PRIOR to the creation of a VPC, and is never used again.
          - id: W92
            reason: This function is only invoked during the deployment of this solution
              and is never used again. Reserving concurrency would therefore be wasteful.
    Properties:
      Code:
        ZipFile: "import json\nimport logging\nimport cfnresponse\nfrom botocore.exceptions\
          \ import ClientError\n\nLOGGER = logging.getLogger()\nLOGGER.setLevel(logging.INFO)\n\
          \ndef handler(event, context):\n\n    LOGGER.info('----- REQUEST RECEIVED\
          \ -----')\n    LOGGER.info(json.dumps(event))\n\n    response_data = {}\n\
          \    \n    operation = event['ResourceProperties']['Type'].split('Custom::')[1]\n\
          \    properties = event['ResourceProperties']['Properties']\n    \n    if\
          \ event['RequestType'] in ['Create', 'Update']:\n        \n        if operation\
          \ == 'ManipulateString':\n            \n            action = properties['Action']\n\
          \            input_str = properties['InputString']\n            \n     \
          \       if action == 'lower':\n                sanitized_str = input_str.lower()\n\
          \                \n            elif action == 'upper':\n               \
          \ sanitized_str = input_str.upper()\n                \n            response_data['OutputString']\
          \ = sanitized_str\n            return cfnresponse.send(event, context, cfnresponse.SUCCESS,\
          \ response_data, sanitized_str)\n                \n    elif event['RequestType']\
          \ in ['Delete']:\n        \n        return cfnresponse.send(event, context,\
          \ cfnresponse.SUCCESS, response_data)"
      Description: !Join
        - ''
        - - 'MiscMethodsHandler resource for '
          - !Ref 'AWS::StackName'
          - ' stack'
      Handler: index.handler
      KmsKeyArn: !If
        - KMSKeySupplied
        - !Ref 'KMSKeyARN'
        - ''
      Role: !GetAtt 'MiscMethodsHandlerRole.Arn'
      Runtime: python3.7
      Timeout: 15
    Type: AWS::Lambda::Function
  MiscMethodsHandlerLogGroup:
    Condition: ''
    DependsOn:
      - MiscMethodsHandlerFunction
    Metadata:
      cfn_nag:
        rules_to_suppress:
          - id: W84
            reason: These logs do not contain sensitive data.
    Properties:
      LogGroupName: !Join
        - ''
        - - /aws/lambda/
          - !Ref 'MiscMethodsHandlerFunction'
      RetentionInDays: !Ref 'LogRetentionInDays'
    Type: AWS::Logs::LogGroup
  MiscMethodsHandlerRole:
    Condition: ''
    DependsOn: []
    Metadata: {}
    Properties:
      AssumeRolePolicyDocument:
        Statement:
          - Action:
              - sts:AssumeRole
            Effect: Allow
            Principal:
              Service:
                - lambda.amazonaws.com
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole
      Policies: []
    Type: AWS::IAM::Role
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -



