cloudformation/FIXEngineApplication.yml [3513:3646]:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
  VPCPrefixListManagerFunction:
    Condition: ''
    DependsOn:
      - VPCPrefixListManagerRole
    Metadata:
      cfn_nag:
        rules_to_suppress:
          - id: W89
            reason: This function is only invoked during the deployment of this solution,
              potentially PRIOR to the creation of a VPC, and is never used again.
          - id: W92
            reason: This function is only invoked during the deployment of this solution
              and is never used again. Reserving concurrency would therefore be wasteful.
    Properties:
      Code:
        ZipFile: "import json\nimport boto3\nimport logging\nimport cfnresponse\n\
          from botocore.exceptions import ClientError\n\nLOGGER = logging.getLogger()\n\
          LOGGER.setLevel(logging.INFO)\nlogging.getLogger('boto3').setLevel(logging.INFO)\n\
          logging.getLogger('botocore').setLevel(logging.INFO)\n\n'''\n    - PrefixListId\
          \ | str\n    - AuthorizedCidrs | list\n    - EntryDescription | str\n'''\n\
          def handler(event, context):\n\n    LOGGER.info('----- REQUEST RECEIVED\
          \ -----')\n    LOGGER.info(json.dumps(event))\n\n    responseData = {}\n\
          \    \n    operation = event['ResourceProperties']['Type'].split('Custom::')[1]\n\
          \    properties = event['ResourceProperties']['Properties']\n    \n    #\
          \ If the Stack is Being Created or Updated\n    if event['RequestType']\
          \ in ['Create', 'Update']:\n        \n        ec2_client = boto3.client('ec2')\n\
          \        \n        try:\n            \n            prefix_list = ec2_client.describe_managed_prefix_lists(\n\
          \                PrefixListIds = [\n                    properties['PrefixListId']\n\
          \                ]\n            )\n            \n            if len(prefix_list['PrefixLists'])\
          \ == 0:\n                print('Prefix List w/ ID: ' + properties['PrefixListId']\
          \ + ' Could Not be Found')\n                return cfnresponse.send(event,\
          \ context, cfnresponse.FAILED, responseData)\n                \n       \
          \     else:\n                prefix_list = prefix_list['PrefixLists'][0]\n\
          \                \n            existing_entries = ec2_client.get_managed_prefix_list_entries(\n\
          \                PrefixListId = prefix_list['PrefixListId'],\n         \
          \   )\n        \n        except ClientError as e:\n            print(str(e))\n\
          \            return cfnresponse.send(event, context, cfnresponse.FAILED,\
          \ responseData)\n            \n        new_entries = properties['AuthorizedCidrs']\n\
          \        \n        entries_to_add = []\n        entries_to_remove = []\n\
          \        \n        # If There Are Existing Entries\n        if len(existing_entries['Entries'])\
          \ > 0:\n            \n            # For Each Existing Entry\n          \
          \  for existing_entry in existing_entries['Entries']:\n                \n\
          \                # If the CIDR is No Longer Authorized\n               \
          \ if existing_entry['Cidr'] not in new_entries:\n                    \n\
          \                    # We'll Queue it for Removal\n                    entries_to_remove.append({\n\
          \                        'Cidr': existing_entry['Cidr']\n              \
          \      })\n                \n                # Else, We'll Remove it from\
          \ our \"New Entries\" List\n                else:\n                    new_entries.remove(existing_entry['Cidr'])\n\
          \        \n        # For Each New Entry Remaining\n        for new_entry\
          \ in new_entries:\n            \n            # We'll Format its Input\n\
          \            entries_to_add.append({\n                'Cidr': new_entry,\n\
          \                'Description': properties['EntryDescription'],\n      \
          \      })\n        \n        # If There's at Least 1 Entry to Add or Remove\n\
          \        if len(entries_to_add) > 0 or len(entries_to_remove) > 0:\n   \
          \         \n            try:\n                \n                # We'll\
          \ Try to Update the List\n                ec2_client.modify_managed_prefix_list(\n\
          \                    PrefixListId = prefix_list['PrefixListId'],\n     \
          \               CurrentVersion = prefix_list['Version'],\n             \
          \       AddEntries = entries_to_add,\n                    RemoveEntries\
          \ = entries_to_remove,\n                )\n                \n          \
          \  except ClientError as e:\n                print(str(e))\n           \
          \     return cfnresponse.send(event, context, cfnresponse.FAILED, responseData)\n\
          \        \n        return cfnresponse.send(event, context, cfnresponse.SUCCESS,\
          \ responseData, properties['PrefixListId'])\n    \n    # If the Stack is\
          \ Being Deleted   \n    elif event['RequestType'] in ['Delete']:\n     \
          \   \n        # CFN Can Delete Prefix Lists Containing Entries, So There's\
          \ Nothing For Us to Do\n        return cfnresponse.send(event, context,\
          \ cfnresponse.SUCCESS, responseData)"
      Description: !Join
        - ''
        - - 'VPCPrefixListManager resource for '
          - !Ref 'AWS::StackName'
          - ' stack'
      Handler: index.handler
      KmsKeyArn: !If
        - KMSKeySupplied
        - !Ref 'KMSKeyARN'
        - ''
      Role: !GetAtt 'VPCPrefixListManagerRole.Arn'
      Runtime: python3.7
      Timeout: 15
    Type: AWS::Lambda::Function
  VPCPrefixListManagerLogGroup:
    Condition: ''
    DependsOn:
      - VPCPrefixListManagerFunction
    Metadata:
      cfn_nag:
        rules_to_suppress:
          - id: W84
            reason: These logs do not contain sensitive data.
    Properties:
      LogGroupName: !Join
        - ''
        - - /aws/lambda/
          - !Ref 'VPCPrefixListManagerFunction'
      RetentionInDays: !Ref 'LogRetentionInDays'
    Type: AWS::Logs::LogGroup
  VPCPrefixListManagerRole:
    Condition: ''
    DependsOn: []
    Metadata:
      cfn_nag:
        rules_to_suppress:
          - id: W11
            reason: ec2:DescribeManagedPrefixLists does not support resource filtering.
    Properties:
      AssumeRolePolicyDocument:
        Statement:
          - Action:
              - sts:AssumeRole
            Effect: Allow
            Principal:
              Service:
                - lambda.amazonaws.com
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole
      Policies:
        - PolicyDocument:
            Statement:
              - Action:
                  - ec2:DescribeManagedPrefixLists
                Effect: Allow
                Resource:
                  - '*'
              - Action:
                  - ec2:ModifyManagedPrefixList
                  - ec2:GetManagedPrefixListEntries
                Effect: Allow
                Resource:
                  - !GetAtt 'FIXClientVPCPrefixList.Arn'
                  - !GetAtt 'UserApplicationVPCPrefixList.Arn'
          PolicyName: PrimaryPolicy
    Type: AWS::IAM::Role
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -



cloudformation/FIXEngineVPCApplication.yml [3870:4003]:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
  VPCPrefixListManagerFunction:
    Condition: ''
    DependsOn:
      - VPCPrefixListManagerRole
    Metadata:
      cfn_nag:
        rules_to_suppress:
          - id: W89
            reason: This function is only invoked during the deployment of this solution,
              potentially PRIOR to the creation of a VPC, and is never used again.
          - id: W92
            reason: This function is only invoked during the deployment of this solution
              and is never used again. Reserving concurrency would therefore be wasteful.
    Properties:
      Code:
        ZipFile: "import json\nimport boto3\nimport logging\nimport cfnresponse\n\
          from botocore.exceptions import ClientError\n\nLOGGER = logging.getLogger()\n\
          LOGGER.setLevel(logging.INFO)\nlogging.getLogger('boto3').setLevel(logging.INFO)\n\
          logging.getLogger('botocore').setLevel(logging.INFO)\n\n'''\n    - PrefixListId\
          \ | str\n    - AuthorizedCidrs | list\n    - EntryDescription | str\n'''\n\
          def handler(event, context):\n\n    LOGGER.info('----- REQUEST RECEIVED\
          \ -----')\n    LOGGER.info(json.dumps(event))\n\n    responseData = {}\n\
          \    \n    operation = event['ResourceProperties']['Type'].split('Custom::')[1]\n\
          \    properties = event['ResourceProperties']['Properties']\n    \n    #\
          \ If the Stack is Being Created or Updated\n    if event['RequestType']\
          \ in ['Create', 'Update']:\n        \n        ec2_client = boto3.client('ec2')\n\
          \        \n        try:\n            \n            prefix_list = ec2_client.describe_managed_prefix_lists(\n\
          \                PrefixListIds = [\n                    properties['PrefixListId']\n\
          \                ]\n            )\n            \n            if len(prefix_list['PrefixLists'])\
          \ == 0:\n                print('Prefix List w/ ID: ' + properties['PrefixListId']\
          \ + ' Could Not be Found')\n                return cfnresponse.send(event,\
          \ context, cfnresponse.FAILED, responseData)\n                \n       \
          \     else:\n                prefix_list = prefix_list['PrefixLists'][0]\n\
          \                \n            existing_entries = ec2_client.get_managed_prefix_list_entries(\n\
          \                PrefixListId = prefix_list['PrefixListId'],\n         \
          \   )\n        \n        except ClientError as e:\n            print(str(e))\n\
          \            return cfnresponse.send(event, context, cfnresponse.FAILED,\
          \ responseData)\n            \n        new_entries = properties['AuthorizedCidrs']\n\
          \        \n        entries_to_add = []\n        entries_to_remove = []\n\
          \        \n        # If There Are Existing Entries\n        if len(existing_entries['Entries'])\
          \ > 0:\n            \n            # For Each Existing Entry\n          \
          \  for existing_entry in existing_entries['Entries']:\n                \n\
          \                # If the CIDR is No Longer Authorized\n               \
          \ if existing_entry['Cidr'] not in new_entries:\n                    \n\
          \                    # We'll Queue it for Removal\n                    entries_to_remove.append({\n\
          \                        'Cidr': existing_entry['Cidr']\n              \
          \      })\n                \n                # Else, We'll Remove it from\
          \ our \"New Entries\" List\n                else:\n                    new_entries.remove(existing_entry['Cidr'])\n\
          \        \n        # For Each New Entry Remaining\n        for new_entry\
          \ in new_entries:\n            \n            # We'll Format its Input\n\
          \            entries_to_add.append({\n                'Cidr': new_entry,\n\
          \                'Description': properties['EntryDescription'],\n      \
          \      })\n        \n        # If There's at Least 1 Entry to Add or Remove\n\
          \        if len(entries_to_add) > 0 or len(entries_to_remove) > 0:\n   \
          \         \n            try:\n                \n                # We'll\
          \ Try to Update the List\n                ec2_client.modify_managed_prefix_list(\n\
          \                    PrefixListId = prefix_list['PrefixListId'],\n     \
          \               CurrentVersion = prefix_list['Version'],\n             \
          \       AddEntries = entries_to_add,\n                    RemoveEntries\
          \ = entries_to_remove,\n                )\n                \n          \
          \  except ClientError as e:\n                print(str(e))\n           \
          \     return cfnresponse.send(event, context, cfnresponse.FAILED, responseData)\n\
          \        \n        return cfnresponse.send(event, context, cfnresponse.SUCCESS,\
          \ responseData, properties['PrefixListId'])\n    \n    # If the Stack is\
          \ Being Deleted   \n    elif event['RequestType'] in ['Delete']:\n     \
          \   \n        # CFN Can Delete Prefix Lists Containing Entries, So There's\
          \ Nothing For Us to Do\n        return cfnresponse.send(event, context,\
          \ cfnresponse.SUCCESS, responseData)"
      Description: !Join
        - ''
        - - 'VPCPrefixListManager resource for '
          - !Ref 'AWS::StackName'
          - ' stack'
      Handler: index.handler
      KmsKeyArn: !If
        - KMSKeySupplied
        - !Ref 'KMSKeyARN'
        - ''
      Role: !GetAtt 'VPCPrefixListManagerRole.Arn'
      Runtime: python3.7
      Timeout: 15
    Type: AWS::Lambda::Function
  VPCPrefixListManagerLogGroup:
    Condition: ''
    DependsOn:
      - VPCPrefixListManagerFunction
    Metadata:
      cfn_nag:
        rules_to_suppress:
          - id: W84
            reason: These logs do not contain sensitive data.
    Properties:
      LogGroupName: !Join
        - ''
        - - /aws/lambda/
          - !Ref 'VPCPrefixListManagerFunction'
      RetentionInDays: !Ref 'LogRetentionInDays'
    Type: AWS::Logs::LogGroup
  VPCPrefixListManagerRole:
    Condition: ''
    DependsOn: []
    Metadata:
      cfn_nag:
        rules_to_suppress:
          - id: W11
            reason: ec2:DescribeManagedPrefixLists does not support resource filtering.
    Properties:
      AssumeRolePolicyDocument:
        Statement:
          - Action:
              - sts:AssumeRole
            Effect: Allow
            Principal:
              Service:
                - lambda.amazonaws.com
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole
      Policies:
        - PolicyDocument:
            Statement:
              - Action:
                  - ec2:DescribeManagedPrefixLists
                Effect: Allow
                Resource:
                  - '*'
              - Action:
                  - ec2:ModifyManagedPrefixList
                  - ec2:GetManagedPrefixListEntries
                Effect: Allow
                Resource:
                  - !GetAtt 'FIXClientVPCPrefixList.Arn'
                  - !GetAtt 'UserApplicationVPCPrefixList.Arn'
          PolicyName: PrimaryPolicy
    Type: AWS::IAM::Role
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -



