deployment/real-time-web-analytics-with-kinesis-existing-vpc.yaml [185:481]:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
  LogsBucket:
    DeletionPolicy: Retain
    Type: AWS::S3::Bucket
    Properties:
      AccessControl: LogDeliveryWrite
      BucketEncryption:
        ServerSideEncryptionConfiguration:
        - ServerSideEncryptionByDefault:
            SSEAlgorithm: aws:kms
      Tags:
        -
          Key: SolutionId
          Value: SO0062
    Metadata:
      cfn_nag:
        rules_to_suppress:
          - id: W35
            reason: "Loggin not enabled, this is the logs bucket for CloudFront and the other S3 buckets"

  WebsiteBucket:
    Type: AWS::S3::Bucket
    DeletionPolicy: Retain
    Properties:
      WebsiteConfiguration:
        IndexDocument: index.html
        ErrorDocument: index.html
      LoggingConfiguration:
        DestinationBucketName: !Ref LogsBucket
        LogFilePrefix: container-bucket-access/
    Metadata:
      cfn_nag:
        rules_to_suppress:
          - id: W41
            reason: "Encryption not enabled, this bucket host a website accessed through CloudFront"

  AnalyticsBucket:
    Type: AWS::S3::Bucket
    DeletionPolicy: Retain
    Properties:
      LoggingConfiguration:
        DestinationBucketName: !Ref LogsBucket
        LogFilePrefix: container-bucket-access/
      BucketEncryption:
        ServerSideEncryptionConfiguration:
        - ServerSideEncryptionByDefault:
            SSEAlgorithm: aws:kms

  WebsiteBucketPolicy:
    Type: AWS::S3::BucketPolicy
    Properties:
      Bucket: !Ref WebsiteBucket
      PolicyDocument:
        Version: '2012-10-17'
        Statement:
          -
            Action:
                - "s3:GetObject"
            Effect: "Allow"
            Resource:
                - !Sub '${WebsiteBucket.Arn}/*'
            Principal:
                CanonicalUser: !GetAtt WebsiteOriginAccessIdentity.S3CanonicalUserId
    Metadata:
      cfn_nag:
        rules_to_suppress:
          - id: F16
            reason: "This is a public facing website bucket should be permitted."

  WebsiteOriginAccessIdentity:
    Type: AWS::CloudFront::CloudFrontOriginAccessIdentity
    Properties:
      CloudFrontOriginAccessIdentityConfig:
        Comment: !Sub "access-identity-${WebsiteBucket}"

  WebsiteDistribution:
    Type: AWS::CloudFront::Distribution
    Properties:
      DistributionConfig:
        Comment: "Website distribution for solution"
        Logging:
          IncludeCookies: false
          Bucket: !GetAtt LogsBucket.DomainName
          Prefix: cloudfront-logs/
        Origins:
            -
              Id: S3-solution-website
              DomainName: !Sub "${WebsiteBucket}.s3.${AWS::Region}.amazonaws.com"
              S3OriginConfig:
                  OriginAccessIdentity: !Sub "origin-access-identity/cloudfront/${WebsiteOriginAccessIdentity}"
        DefaultCacheBehavior:
            TargetOriginId: S3-solution-website
            AllowedMethods:
              - GET
              - HEAD
              - OPTIONS
              - PUT
              - POST
              - PATCH
              - DELETE
            CachedMethods:
              - GET
              - HEAD
              - OPTIONS
            ForwardedValues:
                QueryString: 'false'
            ViewerProtocolPolicy: redirect-to-https
        IPV6Enabled: 'true'
        ViewerCertificate:
            CloudFrontDefaultCertificate: 'true'
        Enabled: 'true'
        HttpVersion: 'http2'

# Cognito for Dashboard Users
  CognitoUserPool:
    Type: AWS::Cognito::UserPool
    Properties:
      UserPoolName: real-time-web-analytics-user-pool
      AliasAttributes:
        - email
      AutoVerifiedAttributes:
        - email
      AdminCreateUserConfig:
        AllowAdminCreateUserOnly: True
        InviteMessageTemplate:
          EmailMessage:
            !Sub |
              <p>You are invited to join the Real-Time Web Analytics dashboard. Your dashboard credentials are as follows:</p>
              <p>
              Username: <strong>{username}</strong><br />
              Password: <strong>{####}</strong>
              </p>
              <p>
              Please sign in to the dashboard with the user name and your temporary password provided above at: <br />
              https://${WebsiteDistribution.DomainName}/index.html
              </p>
          EmailSubject: "Your Real-Time Web Analytics Dashboard Login"
        UnusedAccountValidityDays: 7
      EmailVerificationMessage:
        !Sub |
          <p>You are invited to join the Real-Time Web Analytics dashboard. Your dashboard credentials are as follows:</p>
          <p>
          Username: <strong>{username}</strong><br />
          Password: <strong>{####}</strong>
          </p>
          <p>
          Please sign in to the dashboard with the user name and temporary password provided above at: <br />
          https://${WebsiteDistribution.DomainName}/index.html
          </p>
      EmailVerificationSubject: "Your Real-Time Web Analytics Dashboard Login"
      Policies:
        PasswordPolicy:
          MinimumLength: 8
          RequireLowercase: True
          RequireNumbers: True
          RequireSymbols: False
          RequireUppercase: True
      Schema:
        - AttributeDataType: String
          Name: email
          Required: True

  CognitoUserPoolClient:
    Type: AWS::Cognito::UserPoolClient
    Properties:
      ClientName: real-time-account-activity-report
      GenerateSecret: False
      WriteAttributes:
        - address
        - email
        - phone_number
      ReadAttributes:
        - name
        - email
        - email_verified
        - address
        - phone_number
        - phone_number_verified
      RefreshTokenValidity: 1
      UserPoolId: !Ref CognitoUserPool

  CognitoIdentityPool:
    Type: AWS::Cognito::IdentityPool
    Properties:
      IdentityPoolName: Realtime_Account_Activity_Pool
      CognitoIdentityProviders:
        - ClientId: !Ref CognitoUserPoolClient
          ProviderName: !GetAtt CognitoUserPool.ProviderName
      AllowUnauthenticatedIdentities: false

  CognitoIdentityPoolRoleAttachment:
    Type: AWS::Cognito::IdentityPoolRoleAttachment
    Properties:
      IdentityPoolId: !Sub '${CognitoIdentityPool}'
      Roles:
        unauthenticated: !GetAtt UnauthenticatedUserRole.Arn
        authenticated: !GetAtt AuthenticatedUserRole.Arn

  AuthenticatedUserRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              Federated:
               - cognito-identity.amazonaws.com
            Action:
              - sts:AssumeRoleWithWebIdentity
            Condition:
              StringEquals:
                cognito-identity.amazonaws.com:aud: !Sub '${CognitoIdentityPool}'
              ForAnyValue:StringLike:
                cognito-identity.amazonaws.com:amr: authenticated
      Path: /
      Policies:
        - PolicyName: root
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Effect: Allow
                Action:
                  - cognito-sync:*
                  - cognito-identity:*
                Resource: !Sub 'arn:aws:cognito-identity:${AWS::Region}:${AWS::AccountId}:identitypool/${CognitoIdentityPool}'
              - Effect: Allow
                Action:
                  - dynamodb:Scan
                Resource: !GetAtt MetricTable.Arn
              - Effect: Allow
                Action:
                  - dynamodb:Query
                Resource: !GetAtt MetricDetailsTable.Arn
    Metadata:
      cfn_nag:
        rules_to_suppress:
          - id: F3
            reason: "This is a access Policy."

  UnauthenticatedUserRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              Federated:
                - cognito-identity.amazonaws.com
            Action:
              - sts:AssumeRoleWithWebIdentity
            Condition:
              StringEquals:
                "cognito-identity.amazonaws.com:aud": !Ref CognitoIdentityPool
              ForAnyValue:StringLike:
                "cognito-identity.amazonaws.com:amr": unauthenticated
      Path: /
      Policies:
        - PolicyName: root
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Effect: Allow
                Action:
                  - mobileanalytics:PutEvents
                  - cognito-sync:*
                Resource: !Sub 'arn:aws:cognito-identity:${AWS::Region}:${AWS::AccountId}:identitypool/${CognitoIdentityPool}'
    Metadata:
      cfn_nag:
        rules_to_suppress:
          - id: F3
            reason: "This is a access Policy."

  WebCognitoUser:
    Type: AWS::Cognito::UserPoolUser
    DependsOn:
      - ConfigureWebsite
      - WebsiteBucketPolicy
      - AutoScalingGroup
    Properties:
      DesiredDeliveryMediums:
        - EMAIL
      ForceAliasCreation: True
      UserAttributes:
        - Name: email
          Value: !Ref UserEmail
        - Name: email_verified
          Value: True
      Username: !Ref UserName
      UserPoolId: !Ref CognitoUserPool

# AutoScaling and LoadBalancing
  AutoScalingGroup:
    Type: AWS::AutoScaling::AutoScalingGroup
    DependsOn: TargetGroup
    Properties:
      VPCZoneIdentifier:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -



deployment/real-time-web-analytics-with-kinesis.yaml [295:591]:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
  LogsBucket:
    DeletionPolicy: Retain
    Type: AWS::S3::Bucket
    Properties:
      AccessControl: LogDeliveryWrite
      BucketEncryption:
        ServerSideEncryptionConfiguration:
        - ServerSideEncryptionByDefault:
            SSEAlgorithm: aws:kms
      Tags:
        -
          Key: SolutionId
          Value: SO0062
    Metadata:
      cfn_nag:
        rules_to_suppress:
          - id: W35
            reason: "Loggin not enabled, this is the logs bucket for CloudFront and the other S3 buckets"

  WebsiteBucket:
    Type: AWS::S3::Bucket
    DeletionPolicy: Retain
    Properties:
      WebsiteConfiguration:
        IndexDocument: index.html
        ErrorDocument: index.html
      LoggingConfiguration:
        DestinationBucketName: !Ref LogsBucket
        LogFilePrefix: container-bucket-access/
    Metadata:
      cfn_nag:
        rules_to_suppress:
          - id: W41
            reason: "Encryption not enabled, this bucket host a website accessed through CloudFront"

  AnalyticsBucket:
    Type: AWS::S3::Bucket
    DeletionPolicy: Retain
    Properties:
      LoggingConfiguration:
        DestinationBucketName: !Ref LogsBucket
        LogFilePrefix: container-bucket-access/
      BucketEncryption:
        ServerSideEncryptionConfiguration:
        - ServerSideEncryptionByDefault:
            SSEAlgorithm: aws:kms

  WebsiteBucketPolicy:
    Type: AWS::S3::BucketPolicy
    Properties:
      Bucket: !Ref WebsiteBucket
      PolicyDocument:
        Version: '2012-10-17'
        Statement:
          -
            Action:
                - "s3:GetObject"
            Effect: "Allow"
            Resource:
                - !Sub '${WebsiteBucket.Arn}/*'
            Principal:
                CanonicalUser: !GetAtt WebsiteOriginAccessIdentity.S3CanonicalUserId
    Metadata:
      cfn_nag:
        rules_to_suppress:
          - id: F16
            reason: "This is a public facing website bucket should be permitted."

  WebsiteOriginAccessIdentity:
    Type: AWS::CloudFront::CloudFrontOriginAccessIdentity
    Properties:
      CloudFrontOriginAccessIdentityConfig:
        Comment: !Sub "access-identity-${WebsiteBucket}"

  WebsiteDistribution:
    Type: AWS::CloudFront::Distribution
    Properties:
      DistributionConfig:
        Comment: "Website distribution for solution"
        Logging:
          IncludeCookies: false
          Bucket: !GetAtt LogsBucket.DomainName
          Prefix: cloudfront-logs/
        Origins:
            -
              Id: S3-solution-website
              DomainName: !Sub "${WebsiteBucket}.s3.${AWS::Region}.amazonaws.com"
              S3OriginConfig:
                  OriginAccessIdentity: !Sub "origin-access-identity/cloudfront/${WebsiteOriginAccessIdentity}"
        DefaultCacheBehavior:
            TargetOriginId: S3-solution-website
            AllowedMethods:
              - GET
              - HEAD
              - OPTIONS
              - PUT
              - POST
              - PATCH
              - DELETE
            CachedMethods:
              - GET
              - HEAD
              - OPTIONS
            ForwardedValues:
                QueryString: 'false'
            ViewerProtocolPolicy: redirect-to-https
        IPV6Enabled: 'true'
        ViewerCertificate:
            CloudFrontDefaultCertificate: 'true'
        Enabled: 'true'
        HttpVersion: 'http2'

# Cognito for Dashboard Users
  CognitoUserPool:
    Type: AWS::Cognito::UserPool
    Properties:
      UserPoolName: real-time-web-analytics-user-pool
      AliasAttributes:
        - email
      AutoVerifiedAttributes:
        - email
      AdminCreateUserConfig:
        AllowAdminCreateUserOnly: True
        InviteMessageTemplate:
          EmailMessage:
            !Sub |
              <p>You are invited to join the Real-Time Web Analytics dashboard. Your dashboard credentials are as follows:</p>
              <p>
              Username: <strong>{username}</strong><br />
              Password: <strong>{####}</strong>
              </p>
              <p>
              Please sign in to the dashboard with the user name and your temporary password provided above at: <br />
              https://${WebsiteDistribution.DomainName}/index.html
              </p>
          EmailSubject: "Your Real-Time Web Analytics Dashboard Login"
        UnusedAccountValidityDays: 7
      EmailVerificationMessage:
        !Sub |
          <p>You are invited to join the Real-Time Web Analytics dashboard. Your dashboard credentials are as follows:</p>
          <p>
          Username: <strong>{username}</strong><br />
          Password: <strong>{####}</strong>
          </p>
          <p>
          Please sign in to the dashboard with the user name and temporary password provided above at: <br />
          https://${WebsiteDistribution.DomainName}/index.html
          </p>
      EmailVerificationSubject: "Your Real-Time Web Analytics Dashboard Login"
      Policies:
        PasswordPolicy:
          MinimumLength: 8
          RequireLowercase: True
          RequireNumbers: True
          RequireSymbols: False
          RequireUppercase: True
      Schema:
        - AttributeDataType: String
          Name: email
          Required: True

  CognitoUserPoolClient:
    Type: AWS::Cognito::UserPoolClient
    Properties:
      ClientName: real-time-account-activity-report
      GenerateSecret: False
      WriteAttributes:
        - address
        - email
        - phone_number
      ReadAttributes:
        - name
        - email
        - email_verified
        - address
        - phone_number
        - phone_number_verified
      RefreshTokenValidity: 1
      UserPoolId: !Ref CognitoUserPool

  CognitoIdentityPool:
    Type: AWS::Cognito::IdentityPool
    Properties:
      IdentityPoolName: Realtime_Account_Activity_Pool
      CognitoIdentityProviders:
        - ClientId: !Ref CognitoUserPoolClient
          ProviderName: !GetAtt CognitoUserPool.ProviderName
      AllowUnauthenticatedIdentities: false

  CognitoIdentityPoolRoleAttachment:
    Type: AWS::Cognito::IdentityPoolRoleAttachment
    Properties:
      IdentityPoolId: !Sub '${CognitoIdentityPool}'
      Roles:
        unauthenticated: !GetAtt UnauthenticatedUserRole.Arn
        authenticated: !GetAtt AuthenticatedUserRole.Arn

  AuthenticatedUserRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              Federated:
               - cognito-identity.amazonaws.com
            Action:
              - sts:AssumeRoleWithWebIdentity
            Condition:
              StringEquals:
                cognito-identity.amazonaws.com:aud: !Sub '${CognitoIdentityPool}'
              ForAnyValue:StringLike:
                cognito-identity.amazonaws.com:amr: authenticated
      Path: /
      Policies:
        - PolicyName: root
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Effect: Allow
                Action:
                  - cognito-sync:*
                  - cognito-identity:*
                Resource: !Sub 'arn:aws:cognito-identity:${AWS::Region}:${AWS::AccountId}:identitypool/${CognitoIdentityPool}'
              - Effect: Allow
                Action:
                  - dynamodb:Scan
                Resource: !GetAtt MetricTable.Arn
              - Effect: Allow
                Action:
                  - dynamodb:Query
                Resource: !GetAtt MetricDetailsTable.Arn
    Metadata:
      cfn_nag:
        rules_to_suppress:
          - id: F3
            reason: "This is a access Policy."

  UnauthenticatedUserRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              Federated:
                - cognito-identity.amazonaws.com
            Action:
              - sts:AssumeRoleWithWebIdentity
            Condition:
              StringEquals:
                "cognito-identity.amazonaws.com:aud": !Ref CognitoIdentityPool
              ForAnyValue:StringLike:
                "cognito-identity.amazonaws.com:amr": unauthenticated
      Path: /
      Policies:
        - PolicyName: root
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Effect: Allow
                Action:
                  - mobileanalytics:PutEvents
                  - cognito-sync:*
                Resource: !Sub 'arn:aws:cognito-identity:${AWS::Region}:${AWS::AccountId}:identitypool/${CognitoIdentityPool}'
    Metadata:
      cfn_nag:
        rules_to_suppress:
          - id: F3
            reason: "This is a access Policy."

  WebCognitoUser:
    Type: AWS::Cognito::UserPoolUser
    DependsOn:
      - ConfigureWebsite
      - WebsiteBucketPolicy
      - AutoScalingGroup
    Properties:
      DesiredDeliveryMediums:
        - EMAIL
      ForceAliasCreation: True
      UserAttributes:
        - Name: email
          Value: !Ref UserEmail
        - Name: email_verified
          Value: True
      Username: !Ref UserName
      UserPoolId: !Ref CognitoUserPool

# AutoScaling and LoadBalancing
  AutoScalingGroup:
    Type: AWS::AutoScaling::AutoScalingGroup
    DependsOn: TargetGroup
    Properties:
      VPCZoneIdentifier:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -



