tools/fixity/deployment/fixity.yaml [100:280]:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
  InternetGateway:
    Type: AWS::EC2::InternetGateway

  VPCGatewayAttachment:
    Type: AWS::EC2::VPCGatewayAttachment
    Properties:
      VpcId:
        Ref: VPC
      InternetGatewayId:
        Ref: InternetGateway

  Route:
    Type: AWS::EC2::Route
    Properties:
      RouteTableId:
        Ref: RouteTable
      DestinationCidrBlock: 0.0.0.0/0
      GatewayId:
        Ref: InternetGateway

  SecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: Security Group for the EC2 instances launched into the VPC by Batch
      VpcId:
        Ref: VPC

  SecurityGroupIngress:
   Type: AWS::EC2::SecurityGroupIngress
   Properties:
    GroupId: !Ref SecurityGroup
    IpProtocol: -1
    SourceSecurityGroupId: !GetAtt SecurityGroup.GroupId

  SubnetOne:
    Type: AWS::EC2::Subnet
    Properties:
      CidrBlock: 10.0.1.0/24
      VpcId:
        Ref: VPC
      MapPublicIpOnLaunch: true
      AvailabilityZone:
        Fn::Select:
          - 0
          - Fn::GetAZs: ""

  SubnetTwo:
    Type: AWS::EC2::Subnet
    Properties:
      CidrBlock: 10.0.2.0/24
      VpcId:
        Ref: VPC
      MapPublicIpOnLaunch: true
      AvailabilityZone:
        Fn::Select:
          - 1
          - Fn::GetAZs: ""

  SubnetThree:
    Type: AWS::EC2::Subnet
    Properties:
      CidrBlock: 10.0.3.0/24
      VpcId:
        Ref: VPC
      MapPublicIpOnLaunch: true
      AvailabilityZone:
        Fn::Select:
          - 2
          - Fn::GetAZs: ""

  RouteTable:
    Type: AWS::EC2::RouteTable
    Properties:
      VpcId:
        Ref: VPC

  SubnetRouteTableAssociationOne:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      RouteTableId:
        Ref: RouteTable
      SubnetId:
        Ref: SubnetOne

  SubnetRouteTableAssociationTwo:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      RouteTableId:
        Ref: RouteTable
      SubnetId:
        Ref: SubnetTwo

  SubnetRouteTableAssociationThree:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      RouteTableId:
        Ref: RouteTable
      SubnetId:
        Ref: SubnetThree

  FlowLogBucket:
    Type: AWS::S3::Bucket
    DeletionPolicy: Retain
    Properties:
      PublicAccessBlockConfiguration:
        BlockPublicAcls: true
        BlockPublicPolicy: true
        IgnorePublicAcls: true
        RestrictPublicBuckets: true
      BucketEncryption:
        ServerSideEncryptionConfiguration:
          -
            BucketKeyEnabled: true
            ServerSideEncryptionByDefault:
              SSEAlgorithm: AES256
      LifecycleConfiguration:
        Rules:
          -
            Id: Expire
            Status: Enabled
            Transitions:
              -
                StorageClass: GLACIER
                TransitionInDays: 90

  FlowLogBucketPolicy:
    Type: AWS::S3::BucketPolicy
    Properties:
      Bucket:
        Ref: FlowLogBucket
      PolicyDocument:
        Version: 2012-10-17
        Statement:

          # TLS only
          -
            Sid: "RequireTLS"
            Action:
              - "s3:*"
            Effect: "Deny"
            Resource:
              - Fn::Sub: arn:aws:s3:::${FlowLogBucket}/*
            Principal: "*"
            Condition:
              Bool:
                aws:SecureTransport: false

          -
            Sid: "AWSLogDeliveryWrite"
            Effect: Allow
            Action:
              - s3:PutObject
            Resource:
              Fn::Sub: arn:aws:s3:::${FlowLogBucket}/flow-logs/AWSLogs/*
            Principal:
              Service: delivery.logs.amazonaws.com
            Condition:
              StringEquals:
                's3:x-amz-acl' : bucket-owner-full-control

          -
            Sid: "AWSLogDeliveryAclCheck"
            Effect: Allow
            Action:
              - s3:GetBucketAcl
            Resource:
              Fn::Sub: arn:aws:s3:::${FlowLogBucket}
            Principal:
              Service: delivery.logs.amazonaws.com

  VPCLogDeliveringToS3:
    Type: AWS::EC2::FlowLog
    Properties:
      ResourceId:
        Ref: VPC
      ResourceType: VPC
      TrafficType: ALL
      LogDestination:
        Fn::GetAtt: FlowLogBucket.Arn
      LogDestinationType: s3
      MaxAggregationInterval: 60
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -



tools/mediasync/deployment/mediasync.yaml [95:275]:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
  InternetGateway:
    Type: AWS::EC2::InternetGateway

  VPCGatewayAttachment:
    Type: AWS::EC2::VPCGatewayAttachment
    Properties:
      VpcId:
        Ref: VPC
      InternetGatewayId:
        Ref: InternetGateway

  Route:
    Type: AWS::EC2::Route
    Properties:
      RouteTableId:
        Ref: RouteTable
      DestinationCidrBlock: 0.0.0.0/0
      GatewayId:
        Ref: InternetGateway

  SecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: Security Group for the EC2 instances launched into the VPC by Batch
      VpcId:
        Ref: VPC

  SecurityGroupIngress:
   Type: AWS::EC2::SecurityGroupIngress
   Properties:
    GroupId: !Ref SecurityGroup
    IpProtocol: -1
    SourceSecurityGroupId: !GetAtt SecurityGroup.GroupId

  SubnetOne:
    Type: AWS::EC2::Subnet
    Properties:
      CidrBlock: 10.0.1.0/24
      VpcId:
        Ref: VPC
      MapPublicIpOnLaunch: true
      AvailabilityZone:
        Fn::Select:
          - 0
          - Fn::GetAZs: ""

  SubnetTwo:
    Type: AWS::EC2::Subnet
    Properties:
      CidrBlock: 10.0.2.0/24
      VpcId:
        Ref: VPC
      MapPublicIpOnLaunch: true
      AvailabilityZone:
        Fn::Select:
          - 1
          - Fn::GetAZs: ""

  SubnetThree:
    Type: AWS::EC2::Subnet
    Properties:
      CidrBlock: 10.0.3.0/24
      VpcId:
        Ref: VPC
      MapPublicIpOnLaunch: true
      AvailabilityZone:
        Fn::Select:
          - 2
          - Fn::GetAZs: ""

  RouteTable:
    Type: AWS::EC2::RouteTable
    Properties:
      VpcId:
        Ref: VPC

  SubnetRouteTableAssociationOne:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      RouteTableId:
        Ref: RouteTable
      SubnetId:
        Ref: SubnetOne

  SubnetRouteTableAssociationTwo:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      RouteTableId:
        Ref: RouteTable
      SubnetId:
        Ref: SubnetTwo

  SubnetRouteTableAssociationThree:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      RouteTableId:
        Ref: RouteTable
      SubnetId:
        Ref: SubnetThree

  FlowLogBucket:
    Type: AWS::S3::Bucket
    DeletionPolicy: Retain
    Properties:
      PublicAccessBlockConfiguration:
        BlockPublicAcls: true
        BlockPublicPolicy: true
        IgnorePublicAcls: true
        RestrictPublicBuckets: true
      BucketEncryption:
        ServerSideEncryptionConfiguration:
          -
            BucketKeyEnabled: true
            ServerSideEncryptionByDefault:
              SSEAlgorithm: AES256
      LifecycleConfiguration:
        Rules:
          -
            Id: Expire
            Status: Enabled
            Transitions:
              -
                StorageClass: GLACIER
                TransitionInDays: 90

  FlowLogBucketPolicy:
    Type: AWS::S3::BucketPolicy
    Properties:
      Bucket:
        Ref: FlowLogBucket
      PolicyDocument:
        Version: 2012-10-17
        Statement:

          # TLS only
          -
            Sid: "RequireTLS"
            Action:
              - "s3:*"
            Effect: "Deny"
            Resource:
              - Fn::Sub: arn:aws:s3:::${FlowLogBucket}/*
            Principal: "*"
            Condition:
              Bool:
                aws:SecureTransport: false

          -
            Sid: "AWSLogDeliveryWrite"
            Effect: Allow
            Action:
              - s3:PutObject
            Resource:
              Fn::Sub: arn:aws:s3:::${FlowLogBucket}/flow-logs/AWSLogs/*
            Principal:
              Service: delivery.logs.amazonaws.com
            Condition:
              StringEquals:
                's3:x-amz-acl' : bucket-owner-full-control

          -
            Sid: "AWSLogDeliveryAclCheck"
            Effect: Allow
            Action:
              - s3:GetBucketAcl
            Resource:
              Fn::Sub: arn:aws:s3:::${FlowLogBucket}
            Principal:
              Service: delivery.logs.amazonaws.com

  VPCLogDeliveringToS3:
    Type: AWS::EC2::FlowLog
    Properties:
      ResourceId:
        Ref: VPC
      ResourceType: VPC
      TrafficType: ALL
      LogDestination:
        Fn::GetAtt: FlowLogBucket.Arn
      LogDestinationType: s3
      MaxAggregationInterval: 60
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -



