cloudformation/FIXEngineApplication.yml [1395:1534]:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Metadata:
      cfn_nag:
        rules_to_suppress:
          - id: W5
            reason: Outbound HTTP(S) traffic is required to download third-party dependencies.
    Properties:
      GroupDescription: Security Group for Fargate Tasks
      SecurityGroupEgress:
        - CidrIp: '0.0.0.0/0'
          Description: All HTTP Traffic
          FromPort: 80
          IpProtocol: tcp
          ToPort: 80
        - CidrIp: '0.0.0.0/0'
          Description: All HTTPS Traffic
          FromPort: 443
          IpProtocol: tcp
          ToPort: 443
        - CidrIp: '0.0.0.0/0'
          Description: Kafka Traffic
          FromPort: !If
            - KafkaTLSEnabled
            - 9094
            - 9092
          IpProtocol: tcp
          ToPort: !If
            - KafkaTLSEnabled
            - 9094
            - 9092
        - CidrIp: '0.0.0.0/0'
          Description: FIX Server Traffic
          FromPort: !Ref 'FIXServerPort'
          IpProtocol: tcp
          ToPort: !Ref 'FIXServerPort'
      SecurityGroupIngress:
        - Description: FIX Engine Access for FIX Clients
          FromPort: !If
            - IsAcceptorStack
            - !Ref 'FIXServerPort'
            - 32768
          IpProtocol: tcp
          SourcePrefixListId: !Ref 'FIXClientVPCPrefixList'
          ToPort: !If
            - IsAcceptorStack
            - !Ref 'FIXServerPort'
            - 65535
        - Description: AWS Route53 Health Checks
          FromPort: !Ref 'FIXServerPort'
          IpProtocol: tcp
          SourcePrefixListId: !Ref 'Route53HealthCheckVPCPrefixList'
          ToPort: !Ref 'FIXServerPort'
      VpcId: !Ref 'VPC'
    Type: AWS::EC2::SecurityGroup
  FargateSecurityGroupEgressToRDS:
    DependsOn:
      - FargateSecurityGroup
    Properties:
      Description: Allow Database Traffic to RDS
      DestinationSecurityGroupId: !GetAtt 'RDSClusterSecurityGroup.GroupId'
      FromPort: 3306
      GroupId: !GetAtt 'FargateSecurityGroup.GroupId'
      IpProtocol: tcp
      ToPort: 3306
    Type: AWS::EC2::SecurityGroupEgress
  FargateTaskRole:
    DependsOn:
      - RDSClusterNonAdminSecret
    Properties:
      AssumeRolePolicyDocument:
        Statement:
          - Action:
              - sts:AssumeRole
            Effect: Allow
            Principal:
              Service:
                - ecs-tasks.amazonaws.com
      ManagedPolicyArns: []
      Policies:
        - PolicyDocument:
            Statement:
              - Action:
                  - secretsmanager:GetSecretValue
                Effect: Allow
                Resource:
                  - !Join
                    - '-'
                    - - !Select
                        - 0
                        - !Split
                          - '-'
                          - !Ref 'RDSClusterNonAdminSecret'
                      - !Select
                        - 1
                        - !Split
                          - '-'
                          - !Ref 'RDSClusterNonAdminSecret'
                      - !Select
                        - 2
                        - !Split
                          - '-'
                          - !Ref 'RDSClusterNonAdminSecret'
                      - !Select
                        - 3
                        - !Split
                          - '-'
                          - !Ref 'RDSClusterNonAdminSecret'
                  - !Ref 'RDSClusterNonAdminSecret'
              - Action:
                  - ssm:GetParameter
                Effect: Allow
                Resource:
                  - !Join
                    - ''
                    - - 'arn:aws:ssm:'
                      - !Ref 'AWS::Region'
                      - ':'
                      - !Ref 'AWS::AccountId'
                      - :parameter/fixengine/
                      - !Ref 'AWS::StackName'
                      - /*
          PolicyName: primary-policy
    Type: AWS::IAM::Role
  FargateTaskRoleGAPolicy:
    Condition: IsAcceptorStack
    DependsOn:
      - FargateTaskRole
      - GlobalAcceleratorEndpointGroup
    Properties:
      PolicyDocument:
        Statement:
          - Action:
              - globalaccelerator:UpdateEndpointGroup
              - globalaccelerator:DescribeEndpointGroup
            Effect: Allow
            Resource:
              - !GetAtt 'GlobalAcceleratorEndpointGroup.EndpointGroupArn'
      PolicyName: global-accelerator-access
      Roles:
        - !Ref 'FargateTaskRole'
    Type: AWS::IAM::Policy
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -



cloudformation/FIXEngineVPCApplication.yml [1508:1647]:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Metadata:
      cfn_nag:
        rules_to_suppress:
          - id: W5
            reason: Outbound HTTP(S) traffic is required to download third-party dependencies.
    Properties:
      GroupDescription: Security Group for Fargate Tasks
      SecurityGroupEgress:
        - CidrIp: '0.0.0.0/0'
          Description: All HTTP Traffic
          FromPort: 80
          IpProtocol: tcp
          ToPort: 80
        - CidrIp: '0.0.0.0/0'
          Description: All HTTPS Traffic
          FromPort: 443
          IpProtocol: tcp
          ToPort: 443
        - CidrIp: '0.0.0.0/0'
          Description: Kafka Traffic
          FromPort: !If
            - KafkaTLSEnabled
            - 9094
            - 9092
          IpProtocol: tcp
          ToPort: !If
            - KafkaTLSEnabled
            - 9094
            - 9092
        - CidrIp: '0.0.0.0/0'
          Description: FIX Server Traffic
          FromPort: !Ref 'FIXServerPort'
          IpProtocol: tcp
          ToPort: !Ref 'FIXServerPort'
      SecurityGroupIngress:
        - Description: FIX Engine Access for FIX Clients
          FromPort: !If
            - IsAcceptorStack
            - !Ref 'FIXServerPort'
            - 32768
          IpProtocol: tcp
          SourcePrefixListId: !Ref 'FIXClientVPCPrefixList'
          ToPort: !If
            - IsAcceptorStack
            - !Ref 'FIXServerPort'
            - 65535
        - Description: AWS Route53 Health Checks
          FromPort: !Ref 'FIXServerPort'
          IpProtocol: tcp
          SourcePrefixListId: !Ref 'Route53HealthCheckVPCPrefixList'
          ToPort: !Ref 'FIXServerPort'
      VpcId: !Ref 'VPC'
    Type: AWS::EC2::SecurityGroup
  FargateSecurityGroupEgressToRDS:
    DependsOn:
      - FargateSecurityGroup
    Properties:
      Description: Allow Database Traffic to RDS
      DestinationSecurityGroupId: !GetAtt 'RDSClusterSecurityGroup.GroupId'
      FromPort: 3306
      GroupId: !GetAtt 'FargateSecurityGroup.GroupId'
      IpProtocol: tcp
      ToPort: 3306
    Type: AWS::EC2::SecurityGroupEgress
  FargateTaskRole:
    DependsOn:
      - RDSClusterNonAdminSecret
    Properties:
      AssumeRolePolicyDocument:
        Statement:
          - Action:
              - sts:AssumeRole
            Effect: Allow
            Principal:
              Service:
                - ecs-tasks.amazonaws.com
      ManagedPolicyArns: []
      Policies:
        - PolicyDocument:
            Statement:
              - Action:
                  - secretsmanager:GetSecretValue
                Effect: Allow
                Resource:
                  - !Join
                    - '-'
                    - - !Select
                        - 0
                        - !Split
                          - '-'
                          - !Ref 'RDSClusterNonAdminSecret'
                      - !Select
                        - 1
                        - !Split
                          - '-'
                          - !Ref 'RDSClusterNonAdminSecret'
                      - !Select
                        - 2
                        - !Split
                          - '-'
                          - !Ref 'RDSClusterNonAdminSecret'
                      - !Select
                        - 3
                        - !Split
                          - '-'
                          - !Ref 'RDSClusterNonAdminSecret'
                  - !Ref 'RDSClusterNonAdminSecret'
              - Action:
                  - ssm:GetParameter
                Effect: Allow
                Resource:
                  - !Join
                    - ''
                    - - 'arn:aws:ssm:'
                      - !Ref 'AWS::Region'
                      - ':'
                      - !Ref 'AWS::AccountId'
                      - :parameter/fixengine/
                      - !Ref 'AWS::StackName'
                      - /*
          PolicyName: primary-policy
    Type: AWS::IAM::Role
  FargateTaskRoleGAPolicy:
    Condition: IsAcceptorStack
    DependsOn:
      - FargateTaskRole
      - GlobalAcceleratorEndpointGroup
    Properties:
      PolicyDocument:
        Statement:
          - Action:
              - globalaccelerator:UpdateEndpointGroup
              - globalaccelerator:DescribeEndpointGroup
            Effect: Allow
            Resource:
              - !GetAtt 'GlobalAcceleratorEndpointGroup.EndpointGroupArn'
      PolicyName: global-accelerator-access
      Roles:
        - !Ref 'FargateTaskRole'
    Type: AWS::IAM::Policy
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -



