aws-landing-zone-initiation.yaml

#  Copyright 2020 Amazon.com, Inc. or its affiliates. All Rights Reserved.
#
#  Licensed under the Apache License Version 2.0 (the "License"). You may not 
#  use this file except in compliance with the License. A copy of the License is 
#  located at                                                           
#
#      http://www.apache.org/licenses/
#
#  or in the "license" file accompanying this file. This file is distributed on  
#  an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, express or 
#  implied. See the License for the specific language governing permissions and  
#  limitations under the License.      
#
AWSTemplateFormatVersion: '2010-09-09'
Description: '(SO0044) - AWS Landing Zone Version v2.4.6, AddOns Version aov1.0'

Parameters:
  SharedServicesAccountEmail:
    Description: Email address used to create a centralized Shared Services account
    Type: String
    MinLength: 6
    MaxLength: 64
    AllowedPattern: ^[_A-Za-z0-9-\+\.]+(\.[_A-Za-z0-9-]+)*@[A-Za-z0-9-]+(\.[A-Za-z0-9]+)*(\.[A-Za-z]{2,})$
    ConstraintDescription: Account Email can contain only ASCII characters. This must be in the format of something@email.com
  LoggingAccountEmail:
    Description: Email address used create a centralized audit log account
    Type: String
    MinLength: 6
    MaxLength: 64
    AllowedPattern: ^[_A-Za-z0-9-\+\.]+(\.[_A-Za-z0-9-]+)*@[A-Za-z0-9-]+(\.[A-Za-z0-9]+)*(\.[A-Za-z]{2,})$
    ConstraintDescription: Account Email can contain only ASCII characters. This must be in the format of something@email.com
  SecurityAccountEmail:
    Description: Email address used create a centralized security account
    Type: String
    MinLength: 6
    MaxLength: 64
    AllowedPattern: ^[_A-Za-z0-9-\+\.]+(\.[_A-Za-z0-9-]+)*@[A-Za-z0-9-]+(\.[A-Za-z0-9]+)*(\.[A-Za-z]{2,})$
    ConstraintDescription: Account Email can contain only ASCII characters. This must be in the format of something@email.com
  SecurityAlertEmail:
    Description: Email for all the Security Alerts related to Landing Zone
    Type: String
    MinLength: 6
    MaxLength: 64
    AllowedPattern: ^[_A-Za-z0-9-\+\.]+(\.[_A-Za-z0-9-]+)*@[A-Za-z0-9-]+(\.[A-Za-z0-9]+)*(\.[A-Za-z]{2,})$
    ConstraintDescription: Security Alert Email can contain only ASCII characters. This must be in the format of something@email.com
  SubscribeAllChangeEventsEmailToTopic:
    Type: String
    Default: 'No'
    Description: Indicates whether AllConfigurationEmail will be subscribed to the AllConfigurationTopicName topic.
    AllowedValues:
      - 'Yes'
      - 'No'
  AllChangeEventsEmail:
    Description: Email for all the alerts related to Landing Zone
    Type: String
    Default: ''
    MinLength: 0
    MaxLength: 64
  NestedOUDelimiter:
    Description: Delimiter for nested OU names in Manifest file
    Type: String
    Default: "Colon (:)"
    AllowedValues:
      - "Colon (:)"
      - "Dot (.)"
      - "Hyphen (-)"
      - "Underscore (_)"
      - "Semicolon (;)"
      - "Hash (#)"
      - "Pipe (|)"
  CoreOUName:
    Description: Name of Organizations Unit for the Core Accounts. CloudFormation template validation only allows '-' (hyphen, '.' (period) special characters in the OU names
    Type: String
    Default: core
    MinLength: 1
    MaxLength: 128
  NonCoreOUNames:
    Description: Comma separated list of additional Organizations Unit names for organizing additional AWS accounts by applications, business units, etc. CloudFormation template validation only allows '-' (hyphen, '.' (period) special characters in the OU names
    Default: applications
    Type: CommaDelimitedList
  PipelineApprovalStage:
    Description: Do you want to add a manual approval stage to the AWS Landing Zone Configuration Pipeline?
    AllowedValues:
      - 'Yes'
      - 'No'
    Default: 'No'
    Type: String
  PipelineApprovalEmail:
    Description: (Not required if Pipeline Approval Stage = 'No') Email for notifying that the Landing Zone pipeline is waiting for an Approval
    Type: String
  BuildLandingZone:
    Description: Do you want to trigger the pipeline right away to build the Landing Zone?
    AllowedValues:
      - 'Yes'
      - 'No'
    Default: 'Yes'
    Type: String
  LockStackSetsExecutionRole:
    Description: Do you want to lock down the AWS StackSetsExecution role in the member accounts?
    AllowedValues:
      - 'Yes'
      - 'No'
    Default: 'Yes'
    Type: String

# Shared Services VPC
  VPCOptions:
    Type: String
    Default: Shared-Services-Network-3-AZs
    Description: Create a shared service VPC with subnets in 2 or 3 AZs. The 3 AZ option is recommended for all regions except when the desired AD Region only has 2 AZs.
    AllowedValues:
      - Shared-Services-Network-2-AZs
      - Shared-Services-Network-3-AZs
  VPCCidr:
    Type: String
    Default: '100.64.0.0/16'
    AllowedPattern: ^(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])(\/(1[6-9]|2[0-8]))$
    ConstraintDescription: CIDR block parameter must be in the form x.x.x.x/16-28
    Description: CIDR block for the Shared Services VPC

# AWS Config
  EnableAllRegions:
    Type: String
    Description: "AWS recommends only changing this option to speed up the configuration of POC or demo environments. This setting controls the regions that will be monitored by Amazon GuardDuty, AWS Config/Rules, and security notifications. Monitoring in all AWS regions is highly recommended."
    Default: 'All regions'
    AllowedValues:
    - 'All regions'
    - 'Current region only'

# AWS Config Rules
  EnableEncryptedVolumesRule:
    Type: String
    Description: "Enables the AWS managed encrypted-volumes config rule."
    Default: 'Yes'
    AllowedValues:
    - 'Yes'
    - 'No'
  EnableRdsEncryptionRule:
    Type: String
    Description: "Enables the AWS managed rds-storage-encrypted config rule."
    Default: 'Yes'
    AllowedValues:
    - 'Yes'
    - 'No'
  EnableS3PublicReadRule:
    Type: String
    Description: "Enables the AWS managed s3-bucket-public-read-prohibited config rule."
    Default: 'Yes'
    AllowedValues:
    - 'Yes'
    - 'No'
  EnableS3PublicWriteRule:
    Type: String
    Description: "Enables the AWS managed s3-bucket-public-write-prohibited config rule."
    Default: 'Yes'
    AllowedValues:
    - 'Yes'
    - 'No'
  EnableS3ServerSideEncryptionRule:
    Type: String
    Description: "Enables the AWS managed s3-bucket-server-side-encryption-enabled config rule."
    Default: 'Yes'
    AllowedValues:
    - 'Yes'
    - 'No'
  EnableRootMfaRule:
    Type: String
    Description: "Enables the AWS managed root-account-mfa-enabled config rule."
    Default: 'Yes'
    AllowedValues:
    - 'Yes'
    - 'No'
  EnableIamPasswordPolicyRule:
    Type: String
    Description: "Enables the AWS managed iam-password-policy config rule."
    Default: 'Yes'
    AllowedValues:
    - 'Yes'
    - 'No'
  EnableRestrictedCommonPortsRule:
    Type: String
    Description: "Enables the AWS managed restricted-common-ports config rule."
    Default: 'Yes'
    AllowedValues:
    - 'Yes'
    - 'No'
  EnableRestrictedSshRule:
    Type: String
    Description: "Enables the AWS managed restricted-ssh config rule."
    Default: 'Yes'
    AllowedValues:
    - 'Yes'
    - 'No'

# Flow logs retention in days
  LogsRetentionInDays:
    Description: 'Specifies the number of days you want to retain VPC flow logs in each account.'
    Type: Number
    Default: 90
    AllowedValues: [1, 3, 5, 7, 14, 30, 60, 90, 120, 150, 180, 365, 400, 545, 731, 1827, 3653]

# Add-On Publisher Parameters

  AddonsManagedParameter:
    Type: String
    Description: "Should AWS automatically make new versions of Add-On(s) available in the Add-On portfolio?"
    Default: 'AWS Managed'
    AllowedValues:
      - 'AWS Managed'
      - 'Manual Updates'

  NotificationAddonsEmailParameter:
    Type: String
    Description: Email to notify customers that new add-on(s) are available in the Add-On Portfolio.
    Default: ''
    MinLength: 0
    MaxLength: 64

  RegionConcurrencyType:
    Description: Select the the concurrency type of deploying StackSets operations in Regions.
    Default: 'PARALLEL'
    Type: String
    AllowedValues:
      - 'PARALLEL'
      - 'SEQUENTIAL'

  MaxConcurrentPercentage:
    Description: The maximum percentage of accounts in which to perform this operation at one time.
    Default: 100
    Type: String

  FailureTolerancePercentage:
    Description: The percentage of accounts, per Region, for which this stack operation can fail before AWS CloudFormation stops the operation in that Region.
    Default: 10
    Type: String

Metadata:
  AWS::CloudFormation::Interface:
    ParameterGroups:
    - Label:
        default: Landing Zone Core Account Configuration
      Parameters:
      - SharedServicesAccountEmail
      - LoggingAccountEmail
      - SecurityAccountEmail
      - NestedOUDelimiter
      - CoreOUName
      - NonCoreOUNames
      - SecurityAlertEmail
      - LockStackSetsExecutionRole
      - SubscribeAllChangeEventsEmailToTopic
      - AllChangeEventsEmail
    - Label:
        default: Landing Zone Pipeline Configuration
      Parameters:
      - PipelineApprovalStage
      - PipelineApprovalEmail
      - BuildLandingZone
    - Label:
        default: Shared Services VPC Configuration
      Parameters:
        - VPCOptions
        - VPCCidr
    - Label:
        default: VPC Flow Logs Retention Policy
      Parameters:
        - LogsRetentionInDays
    - Label:
        default: AWS Security and Configuration services
      Parameters:
      - EnableAllRegions
    - Label:
        default: AWS Config Rules
      Parameters:
        - EnableEncryptedVolumesRule
        - EnableRdsEncryptionRule
        - EnableS3PublicReadRule
        - EnableS3PublicWriteRule
        - EnableS3ServerSideEncryptionRule
        - EnableRootMfaRule
        - EnableIamPasswordPolicyRule
        - EnableRestrictedCommonPortsRule
        - EnableRestrictedSshRule
    - Label:
        default: "Add-On Publisher Configuration"
      Parameters:
        - AddonsManagedParameter
        - NotificationAddonsEmailParameter
    - Label:
        default: AWS CloudFormation StackSets Configuration
      Parameters:
        - RegionConcurrencyType
        - MaxConcurrentPercentage
        - FailureTolerancePercentage

    ParameterLabels:
      SharedServicesAccountEmail:
        default: Shared Services Account Email Address
      LoggingAccountEmail:
        default: Log Archive Account Email Address
      SecurityAccountEmail:
        default: Security Account Email Address
      NestedOUDelimiter:
        default: Nested OU Name Delimiter
      CoreOUName:
        default: Core OU Name
      NonCoreOUNames:
        default: Non Core OU Names
      SecurityAlertEmail:
        default: Security Alert Email Address
      LockStackSetsExecutionRole:
        default: Lock StackSetsExecution Role
      AllChangeEventsEmail:
        default: All Change Events Email
      SubscribeAllChangeEventsEmailToTopic:
        default: Subscribe All Change Events Email to Topic
      PipelineApprovalStage:
        default: Pipeline Approval Stage
      PipelineApprovalEmail:
        default: Pipeline Approval Email Address
      BuildLandingZone:
        default: Auto Build Landing Zone
      VPCOptions:
        default: Shared Services VPC Options
      VPCCidr:
        default: Shared Services VPC CIDR
      EnableAllRegions:
        default: Enable AWS Security and Configuration Monitoring in
      EnableEncryptedVolumesRule:
        default: Enable Encrypted Volumes Rule
      EnableRdsEncryptionRule:
        default: Enable RDS Encryption Rule
      EnableS3PublicReadRule:
        default: Enable S3 Public Read Rule
      EnableS3PublicWriteRule:
        default: Enable S3 Public Write Rule
      EnableS3ServerSideEncryptionRule:
        default: Enable S3 SSE Policy Rule
      EnableRootMfaRule:
        default: Enable Root MFA Rule
      EnableIamPasswordPolicyRule:
        default: Enable IAM Password Policy Rule
      EnableRestrictedCommonPortsRule:
        default: Enable Restricted Common Ports Rule
      EnableRestrictedSshRule:
        default: Enable Restricted SSH Rule
      LogsRetentionInDays:
        default: VPC Flow Logs Retention In Days
      AddonsManagedParameter:
        default: "AWS Manages Service Catalog Add-On Portfolio?"
      NotificationAddonsEmailParameter:
        default: "Add-On Update Notification Email"
      RegionConcurrencyType:
        default: Region Concurrency Type
      MaxConcurrentPercentage:
        default: Max Concurrent Percentage
      FailureTolerancePercentage:
        default: Failure Tolerance Percentage

Mappings:
  SSMParameterNames:
    LandingZoneSCProductConstraintRoleParameterName:
      Name: /org/primary/service_catalog/constraint/role_arn
    LandingZoneSCPortfolioPrincipalRoleParameterName:
      Name: /org/primary/service_catalog/principal/role_arn
    LandingZoneSecurityAlertEmailParameterName:
      Name: /org/primary/security_alert_email_id
    LandingZoneAllAlertEmailParameterName:
      Name: /org/primary/all_alerts_email_id
    LandingZoneLambdaParameterName:
      Name: /org/primary/avm_lambda_arn
  BucketConfiguration:
    SourceBucketName:
      Name: "solutions-reference"
    SourceKeyName:
      Name: aws-landing-zone/v2.4.6/aws-landing-zone-configuration.zip
    LandingZonePipelineS3TriggerKey:
      Name: aws-landing-zone-configuration.zip
    LandingZonePipelineS3NonTriggerKey:
      Name: _aws-landing-zone-configuration.zip
  KMS:
    Alias:
      Name: AwsLandingZoneKMSKey
  VPC:
    Shared-Services-Network-2-AZs:
      AvailabilityZones: 2
      PublicSubnets:
          - PublicSubnet1CIDR
          - PublicSubnet2CIDR
      PrivateSubnets:
          - PrivateSubnet1ACIDR
          - PrivateSubnet2ACIDR
      CreateAdditionalPrivateSubnets: 'false'
      CreatePrivateSubnets: 'true'
      CreatePublicSubnets: 'true'
      TransitVPC: 'false'
    Shared-Services-Network-3-AZs:
      AvailabilityZones: 3
      PublicSubnets:
          - PublicSubnet1CIDR
          - PublicSubnet2CIDR
          - PublicSubnet3CIDR
      PrivateSubnets:
          - PrivateSubnet1ACIDR
          - PrivateSubnet2ACIDR
          - PrivateSubnet3ACIDR
      CreateAdditionalPrivateSubnets: 'false'
      CreatePrivateSubnets: 'true'
      CreatePublicSubnets: 'true'
      TransitVPC: 'false'
  Solution:
    Metrics:
      SendAnonymousData: 'Yes'
      SolutionID: 'SO0044'
      MetricsURL: 'https://metrics.awssolutionsbuilder.com/generic'
    Data:
      AddonTemplate: 'https://s3.amazonaws.com/solutions-reference/aws-landing-zone/v2.4.6/aws-landing-zone-initiation.template'
  LambdaFunction:
    Logging:
      Level: 'info'
  FindReplace:
    Values:
      NoneType: 'null'
      BoolType: 'yes,no,Yes,No,True,False,true,false'  # no spaces are allowed in this string, comma is the only allowed delimiter

Conditions:
  IsPipelineApprovalStageCondition: !Equals [!Ref PipelineApprovalStage, 'Yes']
  IsBuildLandingZoneCondition: !Equals [!Ref BuildLandingZone, 'Yes']
  IsSubscribeToTopicCondition: !Equals [!Ref SubscribeAllChangeEventsEmailToTopic, 'Yes']
  IsAddonsManagedCondition: !Equals [!Ref AddonsManagedParameter, 'AWS Managed']
  IsAddonsEmailEmpty: !Equals [!Ref NotificationAddonsEmailParameter, '']

Resources:
  # IAM Role for Service Catalog Principal
  LandingZoneSCPortfolioPrincipalRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              Service: lambda.amazonaws.com
            Action: sts:AssumeRole
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/AWSServiceCatalogEndUserFullAccess

  # IAM Role for Service Catalog Product Constraint
  LandingZoneSCProductConstraintRole:
    Type: AWS::IAM::Role
    Metadata:
      cfn_nag:
        rules_to_suppress:
          - id: F3
            reason: "Allow catalog-user:* : required by AWS Service Catalog Launch Constraints Documentation"
             # https://docs.aws.amazon.com/servicecatalog/latest/adminguide/constraints-launch.html
          - id: W11
            reason: "Allow Resource * for Cloudformation/S3 API: required by AWS Service Catalog Launch Constraints Documentation"
            # https://docs.aws.amazon.com/servicecatalog/latest/adminguide/constraints-launch.html
          - id: W28
            reason: "The role name is defined to identify AWS Landing Zone resources."
    Properties:
      RoleName: LandingZoneSCProductConstraintRole
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              Service: servicecatalog.amazonaws.com
            Action: sts:AssumeRole
      Path: /
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/AWSLambda_FullAccess
      Policies:
        - PolicyName: LZAVMProductPolicy
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Effect: Allow
                Action:
                  - logs:CreateLogGroup
                  - logs:CreateLogStream
                  - logs:PutLogEvents
                Resource:
                  - Fn::Sub: 'arn:aws:logs:${AWS::Region}:${AWS::AccountId}:log-group:/aws/lambda/*'
              - Effect: Allow
                Action:
                  - catalog-user:*
                  - cloudformation:CreateStack
                  - cloudformation:DeleteStack
                  - cloudformation:DescribeStackEvents
                  - cloudformation:DescribeStacks
                  - cloudformation:ListStacks
                  - cloudformation:GetTemplateSummary
                  - cloudformation:SetStackPolicy
                  - cloudformation:ValidateTemplate
                  - cloudformation:UpdateStack
                  - s3:GetObject
                Resource: '*'
              - Effect: Allow
                Action:
                  - xray:PutTraceSegments
                  - xray:PutTelemetryRecords
                Resource: '*'
              - Effect: Allow
                Action:
                  - states:DescribeStateMachine
                  - states:ListExecutions
                  - states:StartExecution
                  - states:StopExecution
                Resource:
                  - Fn::Sub: ${OrganizationsStateMachine}
                  - Fn::Sub: ${ServiceControlPolicyMachine}
                  - Fn::Sub: ${StackSetStateMachine}
                  - Fn::Sub: ${ServiceCatalogStateMachine}
                  - Fn::Sub: ${LaunchAVMStateMachine}
                  - Fn::Sub: ${CheckAVMExistsStateMachine}
              - Effect: Allow
                Action:
                  - states:DescribeStateMachineForExecution
                  - states:DescribeExecution
                Resource:
                  - !Sub arn:aws:states:${AWS::Region}:${AWS::AccountId}:execution:${OrganizationsStateMachine.Name}:*
                  - !Sub arn:aws:states:${AWS::Region}:${AWS::AccountId}:execution:${ServiceControlPolicyMachine.Name}:*
                  - !Sub arn:aws:states:${AWS::Region}:${AWS::AccountId}:execution:${StackSetStateMachine.Name}:*
                  - !Sub arn:aws:states:${AWS::Region}:${AWS::AccountId}:execution:${ServiceCatalogStateMachine.Name}:*
                  - !Sub arn:aws:states:${AWS::Region}:${AWS::AccountId}:execution:${LaunchAVMStateMachine.Name}:*
                  - !Sub arn:aws:states:${AWS::Region}:${AWS::AccountId}:execution:${CheckAVMExistsStateMachine.Name}:*
                  - !Sub arn:aws:states:${AWS::Region}:${AWS::AccountId}:execution:${HandshakeStateMachine.Name}:*

  # IAM Role for CloudFormation StackSet Administration in Master account
  AWSCloudFormationStackSetAdministrationRole:
    Metadata:
      cfn_nag:
        rules_to_suppress:
          - id: W11
            reason: "Allow * in the ARN of the execution role to allow cross account access to user created child account in the AWS Organizations"
          - id: W28
            reason: "The role name is defined to identify AWS Landing Zone resources."
    Type: AWS::IAM::Role
    Properties:
      RoleName: AWSCloudFormationStackSetAdministrationRole
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              Service: cloudformation.amazonaws.com
            Action:
              - sts:AssumeRole
      Path: /
      Policies:
        - PolicyName: AssumeRole-AWSCloudFormationStackSetExecutionRole
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Effect: Allow
                Action:
                  - sts:AssumeRole
                Resource:
                  - "arn:aws:iam::*:role/AWSCloudFormationStackSetExecutionRole"

  # IAM Role for CloudFormation StackSet Execution in Master account
  AWSCloudFormationStackSetExecutionRole:
    Type: AWS::IAM::Role
    Metadata:
      cfn_nag:
        rules_to_suppress:
          - id: W28
            reason: "The role name is defined to allow cross account access from the master account."
          - id: W43
            reason: "The admin permissions needed for StackSet service to deploy unknown customer defined resources."
    Properties:
      RoleName: AWSCloudFormationStackSetExecutionRole
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              AWS:
                - Fn::Sub: ${AWSCloudFormationStackSetAdministrationRole.Arn}
                - Fn::Sub: ${StateMachineLambdaRole.Arn}
                - Fn::Sub: ${LandingZoneLambdaRole.Arn}
            Action:
              - sts:AssumeRole
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/AdministratorAccess

  # SSM Parameter to store the IAM Role ARN of Service Catalog Principal
  LandingZoneSCPortfolioPrincipalRoleParameter:
    DependsOn:
      - LandingZoneSCPortfolioPrincipalRole
    Type: AWS::SSM::Parameter
    Properties:
      Name:
        Fn::FindInMap:
          - SSMParameterNames
          - LandingZoneSCPortfolioPrincipalRoleParameterName
          - Name
      Description: Contains the IAM Role Arn for Landing Zone Service Catalog Principal
      Type: StringList
      Value:
        Fn::Sub:
          '${StateMachineLambdaRole.Arn}'

  # SSM Parameter to store the IAM Role ARN of Service Catalog Constraint
  LandingZoneSCProductConstraintRoleParameter:
    DependsOn:
      - LandingZoneSCProductConstraintRole
    Type: AWS::SSM::Parameter
    Properties:
      Name:
        Fn::FindInMap:
          - SSMParameterNames
          - LandingZoneSCProductConstraintRoleParameterName
          - Name
      Description: Contains the IAM Role Arn for Landing Zone Launch Constraint
      Type: String
      Value:
        Fn::Sub:
          '${LandingZoneSCProductConstraintRole.Arn}'

  SecurityAlertEmailParameter:
    Type: AWS::SSM::Parameter
    Properties:
      Name: !FindInMap [SSMParameterNames, LandingZoneSecurityAlertEmailParameterName, Name]
      Description: Contains the Landing Zone Security Alert Email ID
      Type: String
      Value: !Ref SecurityAlertEmail

  AllAlertEmailParameter:
    Type: AWS::SSM::Parameter
    Properties:
      Name: !FindInMap [SSMParameterNames, LandingZoneAllAlertEmailParameterName, Name]
      Description: Contains the Landing Zone Change Alert Email ID
      Type: String
      Value: !If [IsSubscribeToTopicCondition, !Ref AllChangeEventsEmail, 'no-notifications@email.com']

  PipelineApprovalTopic:
    Type: AWS::SNS::Topic
    Metadata:
      cfn_nag:
        rules_to_suppress:
          - id: W47
            reason: "The SNS topic does not require a KMS Master Key."
    Condition: IsPipelineApprovalStageCondition
    Properties:
      Subscription:
      - Endpoint: !Ref PipelineApprovalEmail
        Protocol: email

  LandingZonePipelineS3Bucket:
    Type: AWS::S3::Bucket
    Properties:
      BucketName: !Sub aws-landing-zone-configuration-${AWS::AccountId}-${AWS::Region}
      BucketEncryption:
        ServerSideEncryptionConfiguration:
          - ServerSideEncryptionByDefault:
              SSEAlgorithm: AES256
      VersioningConfiguration:
        Status: Enabled
      LoggingConfiguration:
        DestinationBucketName: !Ref S3LoggingBucket
      PublicAccessBlockConfiguration:
        BlockPublicAcls: True
        BlockPublicPolicy: True
        IgnorePublicAcls: True
        RestrictPublicBuckets: True

  LandingZonePipelineArtifactS3Bucket:
    Type: AWS::S3::Bucket
    DeletionPolicy: Retain
    Properties:
      VersioningConfiguration:
        Status: Enabled
      LoggingConfiguration:
        DestinationBucketName: !Ref S3LoggingBucket
      BucketEncryption:
        ServerSideEncryptionConfiguration:
          - ServerSideEncryptionByDefault:
              SSEAlgorithm: AES256
      PublicAccessBlockConfiguration:
        BlockPublicAcls: True
        BlockPublicPolicy: True
        IgnorePublicAcls: True
        RestrictPublicBuckets: True

  LandingZonePipelineS3BucketPolicy:
    Type: AWS::S3::BucketPolicy
    Properties:
      Bucket: !Ref LandingZonePipelineS3Bucket
      PolicyDocument:
        Statement:
          - Sid: DenyDeleteBucket
            Effect: Deny
            Principal: "*"
            Action: s3:DeleteBucket
            Resource: !Sub "arn:aws:s3:::${LandingZonePipelineS3Bucket}"

  LandingZonePipelineArtifactS3BucketPolicy:
    Type: AWS::S3::BucketPolicy
    Properties:
      Bucket: !Ref LandingZonePipelineArtifactS3Bucket
      PolicyDocument:
        Statement:
          - Sid: DenyDeleteBucket
            Effect: Deny
            Principal: "*"
            Action: s3:DeleteBucket
            Resource: !Sub "arn:aws:s3:::${LandingZonePipelineArtifactS3Bucket}"


  # Create buckets using S3-SSE keys for default encryption
  S3LoggingBucket:
    DeletionPolicy: Retain
    Type: AWS::S3::Bucket
    Metadata:
      cfn_nag:
        rules_to_suppress:
          - id: W35
            reason: "This S3 bucket is used as the destination for 'LandingZonePipelineS3Bucket' and 'LandingZonePipelineArtifactS3Bucket'"
          - id: W51
            reason: "Log delivery controlled by ACL, not bucket policy"
    Properties:
      BucketName: !Sub aws-landing-zone-s3-access-logs-${AWS::AccountId}-${AWS::Region}
      AccessControl: LogDeliveryWrite
      VersioningConfiguration:
        Status: Enabled
      BucketEncryption:
        ServerSideEncryptionConfiguration:
          - ServerSideEncryptionByDefault:
              SSEAlgorithm: AES256
      PublicAccessBlockConfiguration:
        BlockPublicAcls: True
        BlockPublicPolicy: True
        IgnorePublicAcls: True
        RestrictPublicBuckets: True
##
  LandingZoneCodePipelineRole:
    Type: AWS::IAM::Role
    Metadata:
      cfn_nag:
        rules_to_suppress:
          - id: W28
            reason: "The role name is defined to identify AWS Landing Zone resources."
          - id: W11
            reason: "Allow Resource * for KMS/SSM API. KMS Service only support all resources. Key ID is generated by the service. SSM parameters are customer defined."
    Properties:
      RoleName: LandingZoneCodePipelineRole
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: "Allow"
            Principal:
              Service:
                - "codepipeline.amazonaws.com"
            Action:
              - "sts:AssumeRole"
      Path: "/"
      Policies:
        - PolicyName: "AWS-Landing-Zone-CodePipeline-Policy"
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Effect: "Allow"
                Action:
                  - s3:GetBucketVersioning
                Resource:
                  - !Sub "arn:aws:s3:::${LandingZonePipelineArtifactS3Bucket}"
                  - !Sub "arn:aws:s3:::${LandingZonePipelineS3Bucket}"
              - Effect: "Allow"
                Action:
                  - s3:PutObject
                  - s3:GetObject
                  - s3:GetObjectVersion
                Resource:
                  - !Sub "arn:aws:s3:::${LandingZonePipelineArtifactS3Bucket}/*"
                  - !Sub "arn:aws:s3:::${LandingZonePipelineS3Bucket}/*"
              - Effect: Allow
                Action:
                  - ssm:PutParameter
                  - ssm:GetParameter
                  - ssm:DeleteParameter
                  - ssm:GetParametersByPath
                Resource: !Sub arn:aws:ssm:${AWS::Region}:${AWS::AccountId}:parameter/*
              - Effect: Allow
                Action:
                  - ssm:DescribeParameters
                Resource: '*' # The APIs above only support '*' resource.
              - Effect: "Allow"
                Action:
                  - "codebuild:BatchGetBuilds"
                  - "codebuild:StartBuild"
                Resource:
                  - !Sub "arn:aws:codebuild:${AWS::Region}:${AWS::AccountId}:project/${LandingZoneCodeBuild}"
                  - !Sub "arn:aws:codebuild:${AWS::Region}:${AWS::AccountId}:project/${BaselineResourceCodeBuild}"
                  - !Sub "arn:aws:codebuild:${AWS::Region}:${AWS::AccountId}:project/${LaunchAVMCodeBuild}"
              - Effect: "Allow"
                Action:
                  - codecommit:GetBranch
                  - codecommit:GetCommit
                  - codecommit:UploadArchive
                  - codecommit:GetUploadArchiveStatus
                  - codecommit:CancelUploadArchive
                Resource: "*"
              - Effect: "Allow"
                Action:
                  - "lambda:InvokeFunction"
                Resource: !GetAtt StateMachineTriggerLambda.Arn
              - Effect: "Allow"
                Action:
                  - lambda:ListFunctions
                  - lambda:ListVersionsByFunction
                Resource: "*"
              - !If
                - IsPipelineApprovalStageCondition
                - Effect: "Allow"
                  Action:
                    - "sns:Publish"
                  Resource: !Ref PipelineApprovalTopic
                - !Ref AWS::NoValue

  LandingZoneCodePipeline:
    Type: AWS::CodePipeline::Pipeline
    Properties:
      Name: AWS-Landing-Zone-CodePipeline
      RoleArn: !GetAtt LandingZoneCodePipelineRole.Arn
      ArtifactStore:
        Location: !Ref LandingZonePipelineArtifactS3Bucket
        Type: S3
      Stages:
        - Name: Source
          Actions:
            - Name: Source
              ActionTypeId:
                Category: Source
                Owner: AWS
                Version: "1"
                Provider: S3
              OutputArtifacts:
                - Name: SourceApp
              Configuration:
                S3Bucket: !Ref LandingZonePipelineS3Bucket
                S3ObjectKey: !FindInMap [BucketConfiguration, LandingZonePipelineS3TriggerKey, Name]
              RunOrder: 1
        - Name: Build
          Actions:
              - Name: CodeBuild
                InputArtifacts:
                  - Name: SourceApp
                ActionTypeId:
                  Category: Build
                  Owner: AWS
                  Version: "1"
                  Provider: CodeBuild
                OutputArtifacts:
                  - Name: BuiltApp
                Configuration:
                  ProjectName: !Ref LandingZoneCodeBuild
        - !If
          - IsPipelineApprovalStageCondition
          - Name: Approval
            Actions:
              - Name: Approval
                ActionTypeId:
                  Category: Approval
                  Owner: AWS
                  Version: "1"
                  Provider: Manual
                RunOrder: 1
                Configuration:
                  NotificationArn: !Ref PipelineApprovalTopic
          - !Ref AWS::NoValue
        - Name: CoreAccounts
          Actions:
            - Name: Deploy
              InputArtifacts:
                - Name: BuiltApp
              ActionTypeId:
                Category: Invoke
                Owner: AWS
                Version: "1"
                Provider: Lambda
              Configuration:
                FunctionName: !Ref StateMachineTriggerLambda
                UserParameters: "{\"pipeline_stage\": \"core_accounts\", \"artifact\" : \"BuiltApp\", \"exec_mode\" : \"sequential\"}"
              RunOrder: 1
        - Name: ServiceControlPolicy
          Actions:
            - Name: Deploy
              InputArtifacts:
                - Name: BuiltApp
              ActionTypeId:
                Category: Invoke
                Owner: AWS
                Version: "1"
                Provider: Lambda
              Configuration:
                FunctionName: !Ref StateMachineTriggerLambda
                UserParameters: "{\"pipeline_stage\": \"service_control_policy\", \"artifact\" : \"BuiltApp\", \"exec_mode\" : \"sequential\"}"
              RunOrder: 1
        - Name: CoreResource
          Actions:
            - Name: Deploy
              InputArtifacts:
                - Name: BuiltApp
              ActionTypeId:
                Category: Invoke
                Owner: AWS
                Version: "1"
                Provider: Lambda
              Configuration:
                FunctionName: !Ref StateMachineTriggerLambda
                UserParameters: "{\"pipeline_stage\": \"core_resources\", \"artifact\" : \"BuiltApp\", \"exec_mode\" : \"sequential\"}"
              RunOrder: 1
        - Name: ServiceCatalog
          Actions:
            - Name: Deploy
              InputArtifacts:
                - Name: BuiltApp
              ActionTypeId:
                Category: Invoke
                Owner: AWS
                Version: "1"
                Provider: Lambda
              Configuration:
                FunctionName: !Ref StateMachineTriggerLambda
                UserParameters: "{\"pipeline_stage\": \"service_catalog\", \"artifact\" : \"BuiltApp\", \"exec_mode\" : \"sequential\"}"
              RunOrder: 1
        - Name: BaselineResource
          Actions:
            - Name: CodeBuild
              InputArtifacts:
                - Name: BuiltApp
              ActionTypeId:
                Category: Build
                Owner: AWS
                Version: "1"
                Provider: CodeBuild
              Configuration:
                ProjectName: !Ref BaselineResourceCodeBuild
        - Name: LaunchAVM
          Actions:
              - Name: CodeBuild
                InputArtifacts:
                  - Name: BuiltApp
                ActionTypeId:
                  Category: Build
                  Owner: AWS
                  Version: "1"
                  Provider: CodeBuild
                Configuration:
                  ProjectName: !Ref LaunchAVMCodeBuild
##
  LandingZoneCodeBuildRole:
    Type: "AWS::IAM::Role"
    Metadata:
      cfn_nag:
        rules_to_suppress:
          - id: W11
            reason: "Allow Resource * for Cloudformation/SSM API: needs to support user defined cfn templates and ssm parameter names."
    Properties:
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: "Allow"
            Principal:
              Service:
                - "codebuild.amazonaws.com"
            Action:
              - "sts:AssumeRole"
      Path: "/"
      Policies:
        - PolicyName: "AWS-Landing-Zone-CodeBuild-Policy"
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Effect: Allow
                Action:
                  - logs:CreateLogGroup
                  - logs:CreateLogStream
                  - logs:PutLogEvents
                Resource:
                  - !Sub "arn:aws:logs:${AWS::Region}:${AWS::AccountId}:log-group:/aws/codebuild/*"
              - Effect: "Allow"
                Action:
                  - s3:PutObject
                  - s3:GetObjectVersion
                  - s3:DeleteObject
                Resource:
                  - !Sub "arn:aws:s3:::${LandingZonePipelineArtifactS3Bucket}/*"
              - Effect: Allow
                Action:
                  - s3:GetObject
                  - cloudformation:ValidateTemplate
                Resource: "*" # needed to support a feature that allows customer to define s3 links in manifest and
                # download template from any bucket
              - Effect: "Allow"
                Action:
                  - s3:GetObject
                Resource:
                  - "arn:aws:s3:::solutions-reference/*"
              - Effect: Allow
                Action:
                  - ssm:GetParameter
                  - ssm:GetParametersByPath
                Resource: !Sub arn:aws:ssm:${AWS::Region}:${AWS::AccountId}:parameter/*
              - Effect: Allow
                Action:
                  - ssm:DescribeParameters
                Resource: '*'

  LandingZoneCodeBuild:
      Type: AWS::CodeBuild::Project
      DependsOn: LandingZoneDeploymentLambda
      Properties:
          Name: AWS-Landing-Zone-CodeBuild
          ServiceRole: !GetAtt LandingZoneCodeBuildRole.Arn
          EncryptionKey: !Join ["/", ["alias", !FindInMap [KMS, Alias, Name]]]
          Source:
              Type: CODEPIPELINE
              BuildSpec: "version: 0.2\nphases:\n  install:\n    runtime-versions:\n      python: 3.10\n      ruby: 3.1\n    commands:\n      - export current=`pwd`\n      - if [ -f manifest.yaml ];then export current=`pwd`;else if [ -f aws-landing-zone-configuration/manifest.yaml ]; then export current=`pwd`/aws-landing-zone-configuration;	else echo 'manifest.yaml does not exist at the root level of aws-landing-zone-configuration.zip or inside aws-landing-zone-configuration folder, please check the ZIP file'; exit 1;	fi; fi;\n      - apt-get update && apt-get upgrade -y\n      - apt-get install zip wget python3-pip libyaml-dev rsync -y\n      - which python3 && python3 --version\n      - which pip && pip --version\n      - pip install --upgrade virtualenv==20.0.35\n      - pip install --upgrade PyYAML==5.3.1\n      - pip install --upgrade yorm==1.6.2\n      - pip install --upgrade jinja2==3.1.2\n      - pip install --upgrade pykwalify==1.7.0\n      - pip install cfn_flip==1.2.3\n      - pip freeze\n      - ruby -v\n      - gem -v\n      - gem install cfn-nag -v 0.8.10\n  pre_build:\n    commands:\n      - cd $current\n      - echo 'Download the Validation scripts'\n      - aws s3 cp s3://solutions-reference/aws-landing-zone/v2.4.6/aws-landing-zone-validation.zip $current\n      - unzip -o $current/aws-landing-zone-validation.zip -d $current\n      - cp bin/lz_scripts/* .\n  build:\n    commands:\n      - echo 'Starting build `date` in `pwd`'\n      - echo 'bash merge_directories.sh $LAMBDA_ARN_SSM_PS_KEY $NONE_TYPE_VALUES $BOOL_VALUES'\n      - bash merge_directories.sh $LAMBDA_ARN_SSM_PS_KEY $NONE_TYPE_VALUES $BOOL_VALUES\n      - echo 'Executing validation tests'\n      - echo 'bash $current/validation/run-validation.sh $ARTIFACT_BUCKET'\n      - bash $current/validation/run-validation.sh $ARTIFACT_BUCKET\n      - echo 'Installing validation tests completed `date`'\n      - echo 'Source Dist completed `date`'\n  post_build:\n    commands:\n      - echo 'Starting post build `date` in `pwd`'\n      - echo 'build completed on `date`'\n      - echo 'Printing Merge Report'\n      - cat merge_report.txt\nartifacts:\n  files:\n      - '**/*'\n"
          Environment:
              ComputeType: BUILD_GENERAL1_SMALL
              Image: "aws/codebuild/standard:6.0"
              Type: LINUX_CONTAINER
              EnvironmentVariables:
                  - Name: ARTIFACT_BUCKET
                    Value: !Ref LandingZonePipelineArtifactS3Bucket
                  - Name: LAMBDA_ARN_SSM_PS_KEY
                    Value: !FindInMap [SSMParameterNames, LandingZoneLambdaParameterName, Name]
                  - Name: NONE_TYPE_VALUES
                    Value: !FindInMap [FindReplace, Values, NoneType]
                  - Name: BOOL_VALUES
                    Value: !FindInMap [FindReplace, Values, BoolType]
                  - Name: SOLUTION_ID
                    Value: !FindInMap [ Solution, Metrics, SolutionID ]
                  - Name: SOLUTION_VERSION
                    Value: v2.4.6
                  - Name: METRICS_URL
                    Value: !FindInMap [ Solution, Metrics, MetricsURL ]
          Artifacts:
              Name: !Sub ${LandingZonePipelineArtifactS3Bucket}-Built
              Type: CODEPIPELINE

  BaselineResourceCodeBuildRole:
    Type: "AWS::IAM::Role"
    Metadata:
      cfn_nag:
        rules_to_suppress:
          - id: W11
            reason: "Allow * for Organizations APIs to list/describe/move user created child accounts in the AWS Organizations"
          - id: W11
            reason: "Allow * for states:DescribeStateMachineForExecution and states:DescribeExecution because the state machine execution ARNs are generated at run-time"
    Properties:
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: "Allow"
            Principal:
              Service:
                - "codebuild.amazonaws.com"
            Action:
              - "sts:AssumeRole"
      Path: "/"
      Policies:
        - PolicyName: "AWS-Landing-Zone-Baseline-Resource-CodeBuild-Policy"
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Effect: Allow
                Action:
                  - logs:CreateLogGroup
                  - logs:CreateLogStream
                  - logs:PutLogEvents
                Resource:
                  - !Sub "arn:aws:logs:${AWS::Region}:${AWS::AccountId}:log-group:/aws/codebuild/*"
              - Effect: "Allow"
                Action:
                  - s3:GetObject
                  - s3:PutObject
                Resource:
                  - !Sub "arn:aws:s3:::${LandingZonePipelineArtifactS3Bucket}/*"
              - Effect: "Allow"
                Action:
                  - s3:GetObject
                Resource:
                  - "arn:aws:s3:::solutions-reference/*"
              - Effect: Allow
                Action:
                  - states:ListExecutions
                  - states:StartExecution
                  - states:StopExecution
                  - states:DescribeStateMachine
                Resource:
                  - !Ref StackSetStateMachine
              - Effect: Allow
                Action:
                  - states:DescribeStateMachineForExecution
                  - states:DescribeExecution
                Resource:
                  - !Sub arn:aws:states:${AWS::Region}:${AWS::AccountId}:execution:${StackSetStateMachine.Name}:*
              - Effect: Allow
                Action:
                  - organizations:ListRoots
                  - organizations:ListOrganizationalUnitsForParent
                  - organizations:ListAccountsForParent
                Resource: '*' # The APIs above only support '*' resource.
              - Effect: Allow
                Action:
                  - sts:AssumeRole
                Resource: 'arn:aws:iam::*:role/AWSCloudFormationStackSetExecutionRole'
              - Effect: Allow
                Action:
                  - ssm:GetParameter
                  - ssm:PutParameter
                  - ssm:GetParametersByPath
                Resource: !Sub arn:aws:ssm:${AWS::Region}:${AWS::AccountId}:parameter/*
              - Effect: Allow
                Action:
                  - ssm:DescribeParameters
                Resource: '*' # The APIs above only support '*' resource.
              - Effect: Allow
                Action:
                  - kms:Encrypt
                  - kms:Decrypt
                  - kms:ReEncryptFrom
                  - kms:ReEncryptTo
                  - kms:GenerateDataKey
                  - kms:GenerateDataKeyWithoutPlaintext
                  - kms:DescribeKey
                Resource:
                  - !Sub arn:aws:kms:${AWS::Region}:${AWS::AccountId}:key/*
              - Effect: Allow
                Action:
                  - sts:AssumeRole
                Resource: 'arn:aws:iam::*:role/AWSCloudFormationStackSetExecutionRole'
              - Effect: Allow
                Action:
                  - ec2:DescribeAvailabilityZones
                Resource:
                  - '*' # The APIs above only support '*' resource.
              - Effect: Allow
                Action:
                  - cloudformation:DescribeStackSet
                  - cloudformation:ListStackInstances
                  - cloudformation:ListStackSetOperations
                Resource:
                  - !Sub arn:aws:cloudformation:${AWS::Region}:${AWS::AccountId}:stackset/*

  LaunchAVMCodeBuildRole:
    Type: "AWS::IAM::Role"
    Metadata:
      cfn_nag:
        rules_to_suppress:
          - id: W11
            reason: "Allow * for Organizations APIs to list/describe/move user created child accounts in the AWS Organizations"
          - id: W11
            reason: "Allow * for states:DescribeStateMachineForExecution and states:DescribeExecution because the state machine execution ARNs are generated at run-time"
    Properties:
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: "Allow"
            Principal:
              Service:
                - "codebuild.amazonaws.com"
            Action:
              - "sts:AssumeRole"
      Path: "/"
      Policies:
        - PolicyName: "AWS-Landing-Zone-LaunchAVM-CodeBuild-Policy"
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Effect: Allow
                Action:
                  - logs:CreateLogGroup
                  - logs:CreateLogStream
                  - logs:PutLogEvents
                Resource:
                  - !Sub "arn:aws:logs:${AWS::Region}:${AWS::AccountId}:log-group:/aws/codebuild/*"
              - Effect: "Allow"
                Action:
                  - s3:GetObject
                Resource:
                  - !Sub "arn:aws:s3:::${LandingZonePipelineArtifactS3Bucket}/*"
              - Effect: "Allow"
                Action:
                  - s3:GetObject
                Resource:
                  - "arn:aws:s3:::solutions-reference/*"
              - Effect: Allow
                Action:
                  - states:ListExecutions
                  - states:StartExecution
                  - states:StopExecution
                  - states:DescribeStateMachine
                Resource:
                  - !Ref LaunchAVMStateMachine
              - Effect: Allow
                Action:
                  - states:DescribeStateMachineForExecution
                  - states:DescribeExecution
                Resource:
                  - !Sub arn:aws:states:${AWS::Region}:${AWS::AccountId}:execution:${LaunchAVMStateMachine.Name}:*
              - Effect: Allow
                Action:
                  - servicecatalog:ListPortfolios
                  - servicecatalog:SearchProvisionedProducts
                  - servicecatalog:SearchProductsAsAdmin
                  - servicecatalog:ListProvisioningArtifacts
                  - cloudformation:DescribeStacks
                  - cloudformation:ListStacks
                Resource: '*'
              - Effect: Allow
                Action:
                  - organizations:ListRoots
                  - organizations:ListOrganizationalUnitsForParent
                  - organizations:ListAccountsForParent
                  - organizations:DescribeAccount
                  - organizations:MoveAccount
                Resource: '*'
              - Effect: Allow
                Action:
                  - ssm:PutParameter
                  - ssm:GetParameter
                  - ssm:GetParametersByPath
                Resource: !Sub arn:aws:ssm:${AWS::Region}:${AWS::AccountId}:parameter/*
              - Effect: Allow
                Action:
                  - ssm:DescribeParameters
                Resource: '*' # The APIs above only support '*' resource.

  BaselineResourceCodeBuild:
      Type: AWS::CodeBuild::Project
      DependsOn: LandingZoneDeploymentLambda
      Properties:
          Name: AWS-Landing-Zone-Baseline-Resources-CodeBuild
          ServiceRole: !GetAtt BaselineResourceCodeBuildRole.Arn
          EncryptionKey: !Join ["/", ["alias", !FindInMap [KMS, Alias, Name]]]
          Source:
              Type: CODEPIPELINE
              BuildSpec: "version: 0.2\nphases:\n  install:\n    runtime-versions:\n      python: 3.10\n    commands:\n      - export current=`pwd`\n      - if [ -f manifest.yaml ];then export current=`pwd`;else if [ -f aws-landing-zone-configuration/manifest.yaml ]; then export current=`pwd`/aws-landing-zone-configuration;	else echo 'manifest.yaml does not exist at the root level of aws-landing-zone-configuration.zip or inside aws-landing-zone-configuration folder, please check the ZIP file'; exit 1;	fi; fi;\n      - apt-get update && apt-get upgrade -y\n      - apt-get install zip wget python3-pip libyaml-dev -y\n      - which python3 && python3 --version\n      - which pip && pip --version\n      - pip install --upgrade virtualenv==20.0.35\n      - pip install --upgrade PyYAML==5.3.1\n      - pip install --upgrade yorm==1.6.2\n      - pip freeze\n  pre_build:\n    commands:\n      - cd $current\n      - echo 'Download the Baseline Resource Deployments Code'\n      - aws s3 cp s3://solutions-reference/aws-landing-zone/v2.4.6/aws-landing-zone-baseline-resource.zip $current\n      - unzip -o $current/aws-landing-zone-baseline-resource.zip -d $current\n  build:\n    commands:\n      - echo 'Starting Baseline Resource Deployments `date` in `pwd`'\n      - echo 'python3 launch_baseline_resources.py $LOG_LEVEL $WAIT_TIME $current/manifest.yaml $SM_ARN_STACK_SET $ARTIFACT_BUCKET $STAGE_NAME $KMS_KEY_ALIAS_NAME'\n      - python3 launch_baseline_resources.py $LOG_LEVEL $WAIT_TIME $current/manifest.yaml $SM_ARN_STACK_SET $ARTIFACT_BUCKET $STAGE_NAME $KMS_KEY_ALIAS_NAME\n      - echo 'Completed Baseline Resource Deployments `date` in `pwd`'\nartifacts:\n  files:\n      - '**/*'\n"
          Environment:
              ComputeType: BUILD_GENERAL1_SMALL
              Image: "aws/codebuild/standard:6.0"
              Type: LINUX_CONTAINER
              EnvironmentVariables:
                  - Name: SM_ARN_STACK_SET
                    Value: !Ref StackSetStateMachine
                  - Name: LOG_LEVEL
                    Value: !FindInMap [LambdaFunction, Logging, Level]
                  - Name: WAIT_TIME
                    Value: "30"
                  - Name: STAGE_NAME
                    Value: "BaselineResources"
                  - Name: ARTIFACT_BUCKET
                    Value: !Ref LandingZonePipelineArtifactS3Bucket
                  - Name: KMS_KEY_ALIAS_NAME
                    Value: !FindInMap [KMS, Alias, Name]
                  - Name: SOLUTION_ID
                    Value: !FindInMap [ Solution, Metrics, SolutionID ]
                  - Name: SOLUTION_VERSION
                    Value: v2.4.6
                  - Name: METRICS_URL
                    Value: !FindInMap [ Solution, Metrics, MetricsURL ]
                  - Name: SSM_KEY_FOR_LOCK_DOWN_ROLE_ARNS
                    Value: lock_down_role_arns_list
                  - Name: UNLOCK_ROLE_ARNS
                    Value: !Sub arn:aws:iam::${AWS::AccountId}:root
          Artifacts:
              Name: !Sub ${LandingZonePipelineArtifactS3Bucket}-Built
              Type: CODEPIPELINE
          TimeoutInMinutes: 480

  LaunchAVMCodeBuild:
      Type: AWS::CodeBuild::Project
      DependsOn: LandingZoneDeploymentLambda
      Properties:
          Name: AWS-Landing-Zone-LaunchAVM-CodeBuild
          ServiceRole: !GetAtt LaunchAVMCodeBuildRole.Arn
          EncryptionKey: !Join ["/", ["alias", !FindInMap [KMS, Alias, Name]]]
          Source:
              Type: CODEPIPELINE
              BuildSpec: "version: 0.2\nphases:\n  install:\n    runtime-versions:\n      python: 3.10\n    commands:\n      - export current=`pwd`\n      - if [ -f manifest.yaml ];then export current=`pwd`;else if [ -f aws-landing-zone-configuration/manifest.yaml ]; then export current=`pwd`/aws-landing-zone-configuration;	else echo 'manifest.yaml does not exist at the root level of aws-landing-zone-configuration.zip or inside aws-landing-zone-configuration folder, please check the ZIP file'; exit 1;	fi; fi;\n      - apt-get update && apt-get upgrade -y\n      - apt-get install zip wget python3-pip libyaml-dev -y\n      - which python3 && python3 --version\n      - which pip && pip --version\n      - pip install --upgrade virtualenv==20.0.35\n      - pip install --upgrade PyYAML==5.3.1\n      - pip install --upgrade yorm==1.6.2\n      - pip freeze\n  pre_build:\n    commands:\n      - cd $current\n      - echo 'Download the Launch AVM Code'\n      - aws s3 cp s3://solutions-reference/aws-landing-zone/v2.4.6/aws-landing-zone-launch-avm.zip $current\n      - unzip -o $current/aws-landing-zone-launch-avm.zip -d $current\n  build:\n    commands:\n      - echo 'Starting Launch AVM `date` in `pwd`'\n      - echo 'python3 launch_avm.py $log_level $wait_time $current/manifest.yaml $sm_arn_launch_avm $batch_size'\n      - python3 launch_avm.py $log_level $wait_time $current/manifest.yaml $sm_arn_launch_avm $batch_size\n      - echo 'Completed Launch AVM `date` in `pwd`'\nartifacts:\n  files:\n      - '**/*'\n"
          Environment:
              ComputeType: BUILD_GENERAL1_SMALL
              Image: "aws/codebuild/standard:6.0"
              Type: LINUX_CONTAINER
              EnvironmentVariables:
                  - Name: sm_arn_launch_avm
                    Value: !Ref LaunchAVMStateMachine
                  - Name: log_level
                    Value: !FindInMap [LambdaFunction, Logging, Level]
                  - Name: wait_time
                    Value: "30"
                  - Name: batch_size
                    Value: "10"
                  - Name: SOLUTION_ID
                    Value: !FindInMap [ Solution, Metrics, SolutionID ]
                  - Name: SOLUTION_VERSION
                    Value: v2.4.6
                  - Name: METRICS_URL
                    Value: !FindInMap [ Solution, Metrics, MetricsURL ]
          Artifacts:
              Name: !Sub ${LandingZonePipelineArtifactS3Bucket}-Built
              Type: CODEPIPELINE
          TimeoutInMinutes: 480

  LandingZoneDeploymentLambdaRole:
    Type: AWS::IAM::Role
    Metadata:
      cfn_nag:
        rules_to_suppress:
          - id: W11
            reason: "Allow Resource * for KMS API. KMS Service only support all resources. Key ID is generated by the service."
          - id: W28
            reason: "The role name is defined to identify AWS Landing Zone resources."
    Properties:
      RoleName: LandingZoneDeploymentLambdaRole
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              Service: lambda.amazonaws.com
            Action: sts:AssumeRole
      Path: /
      Policies:
        - PolicyName: LandingZoneDeploymentLambda
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Effect: Allow
                Action:
                  - logs:CreateLogGroup
                  - logs:CreateLogStream
                  - logs:PutLogEvents
                Resource:
                  - !Sub arn:aws:logs:${AWS::Region}:${AWS::AccountId}:log-group:/aws/lambda/*
              - Effect: Allow
                Action:
                  - xray:PutTraceSegments
                  - xray:PutTelemetryRecords
                Resource: '*'
              - Effect: "Allow"
                Action:
                  - s3:GetEncryptionConfiguration
                  - s3:PutEncryptionConfiguration
                Resource:
                  - !GetAtt LandingZonePipelineS3Bucket.Arn
              - Effect: "Allow"
                Action:
                  - kms:DescribeKey
                  - kms:TagResource
                  - kms:PutKeyPolicy
                  - kms:GetKeyRotationStatus
                  - kms:EnableKeyRotation
                Resource:
                  - !Sub arn:aws:kms:${AWS::Region}:${AWS::AccountId}:key/*
              - Effect: "Allow"
                Action:
                  - kms:CreateKey
                  - kms:ListAliases
                Resource: "*"
              - Effect: Allow
                Action:
                  - kms:CreateAlias
                Resource:
                  - !Sub arn:aws:kms:${AWS::Region}:${AWS::AccountId}:alias/*
                  - !Sub arn:aws:kms:${AWS::Region}:${AWS::AccountId}:key/*
              - Effect: Allow
                Action:
                  - ssm:PutParameter
                  - ssm:GetParameter
                  - ssm:DeleteParameter
                  - ssm:GetParametersByPath
                Resource: !Sub arn:aws:ssm:${AWS::Region}:${AWS::AccountId}:parameter/*
              - Effect: Allow
                Action:
                  - ssm:DescribeParameters
                Resource: '*'
              - Effect: "Allow"
                Action:
                  - s3:GetObject
                Resource:
                  - "arn:aws:s3:::solutions-reference/*"
              - Effect: "Allow"
                Action:
                  - s3:GetObject
                  - s3:PutObject
                Resource:
                  - !Sub "arn:aws:s3:::${LandingZonePipelineS3Bucket}/*"
  LandingZoneDeploymentLambda:
    Type: AWS::Lambda::Function
    Metadata:
      cfn_nag:
        rules_to_suppress:
          - id: W89
            reason: "This lambda function does not need access to VPC resources"
          - id: W92
            reason: "This use case does not need to set the ReservedConcurrentExecutions"
    Properties:
      Environment:
        Variables:
          log_level: !FindInMap [LambdaFunction, Logging, Level]
          KMS_KEY_ALIAS_NAME: !FindInMap [KMS, Alias, Name]
          SOLUTION_ID: !FindInMap [ Solution, Metrics, SolutionID ]
          SOLUTION_VERSION: v2.4.6
          METRICS_URL: !FindInMap [Solution, Metrics, MetricsURL]
      Code:
        S3Bucket: !Sub "solutions-${AWS::Region}"
        S3Key: aws-landing-zone/v2.4.6/aws-landing-zone-config-deployer.zip
      FunctionName: LandingZoneDeploymentLambda
      Description: AWS Landing Zone Deployment Lambda
      Handler: config_deployer.lambda_handler
      MemorySize: 512
      Role: !GetAtt 'LandingZoneDeploymentLambdaRole.Arn'
      Runtime: python3.9
      Timeout: 300
      TracingConfig:
          Mode: Active

  LandingZoneConfigDeployer:
    Type: Custom::ConfigDeployer
    Properties:
      metrics_flag: !FindInMap [Solution, Metrics, SendAnonymousData]
      email_list:
        - !Ref SharedServicesAccountEmail
        - !Ref LoggingAccountEmail
        - !Ref SecurityAccountEmail
        - !Ref SecurityAlertEmail
      bucket_config:
        destination_bucket_name: !Ref LandingZonePipelineS3Bucket
        destination_s3_key: !If [IsBuildLandingZoneCondition, !FindInMap [BucketConfiguration, LandingZonePipelineS3TriggerKey, Name], !FindInMap [BucketConfiguration, LandingZonePipelineS3NonTriggerKey, Name]]
        source_bucket_name: !FindInMap [BucketConfiguration, SourceBucketName, Name]
        source_s3_key: !FindInMap [BucketConfiguration, SourceKeyName, Name]
      kms_config:
        kms_key_alias: !Join ["/", ["alias", !FindInMap [KMS, Alias, Name]]]
        kms_key_policy:
          Version: "2012-10-17"
          Id: "key-alz-1"
          Statement:
            -
              Sid: "Allow administration of the key"
              Effect: "Allow"
              Principal:
                AWS: !Join ["", ["arn:aws:iam::", Ref: "AWS::AccountId", ":root" ]]
              Action:
                - "kms:Create*"
                - "kms:Describe*"
                - "kms:Enable*"
                - "kms:List*"
                - "kms:Put*"
                - "kms:Update*"
                - "kms:Revoke*"
                - "kms:Disable*"
                - "kms:Get*"
                - "kms:Delete*"
                - "kms:ScheduleKeyDeletion"
                - "kms:CancelKeyDeletion"
              Resource: "*"
            -
              Sid: "Allow use of the key"
              Effect: "Allow"
              Principal:
                AWS:
                    - Fn::Sub: ${LandingZoneLambdaRole.Arn}
                    - Fn::Sub: ${StateMachineLambdaRole.Arn}
                    - Fn::Sub: ${LandingZoneDeploymentLambdaRole.Arn}
                    - Fn::Sub: ${StateMachineTriggerLambdaRole.Arn}
                    - Fn::Sub: ${LandingZoneCodePipelineRole.Arn}
                    - Fn::Sub: ${HandshakeSMLambdaRole.Arn}
                    - Fn::Sub: ${LandingZoneCodeBuildRole.Arn}
                    - Fn::Sub: ${BaselineResourceCodeBuildRole.Arn}
                    - Fn::Sub: ${LaunchAVMCodeBuildRole.Arn}
              Action:
                - "kms:Encrypt"
                - "kms:Decrypt"
                - "kms:ReEncrypt*"
                - "kms:GenerateDataKey*"
                - "kms:DescribeKey"
              Resource: "*"
      find_replace:
        - file_name: manifest.yaml.j2
          parameters:
            region: !Sub ${AWS::Region}
            core_ou: !Ref CoreOUName
            ou_list: !Ref NonCoreOUNames
            security_email: !Ref SecurityAccountEmail
            logging_email: !Ref LoggingAccountEmail
            shared_services_email: !Ref SharedServicesAccountEmail
            security_alert_email: !Ref SecurityAlertEmail
            lock_down_stack_sets_role: !Ref LockStackSetsExecutionRole
            enable_all_regions: !Ref EnableAllRegions
            nested_ou_delimiter: !Ref NestedOUDelimiter
        - file_name: parameters/core_accounts/aws-landing-zone-shared-services-vpc.json.j2
          parameters:
            number_of_az: !FindInMap [VPC, !Ref VPCOptions, AvailabilityZones]
            additional_private_subnets: !FindInMap [VPC, !Ref VPCOptions, CreateAdditionalPrivateSubnets]
            create_private_subnets: !FindInMap [VPC, !Ref VPCOptions, CreatePrivateSubnets]
            create_public_subnets: !FindInMap [VPC, !Ref VPCOptions, CreatePublicSubnets]
            private_subnet1a_cidr: !GetAtt VPCCalculator.PrivateSubnet1ACIDR
            private_subnet1b_cidr: !GetAtt VPCCalculator.PrivateSubnet1BCIDR
            private_subnet2a_cidr: !GetAtt VPCCalculator.PrivateSubnet2ACIDR
            private_subnet2b_cidr: !GetAtt VPCCalculator.PrivateSubnet2BCIDR
            private_subnet3a_cidr: !GetAtt VPCCalculator.PrivateSubnet3ACIDR
            private_subnet3b_cidr: !GetAtt VPCCalculator.PrivateSubnet3BCIDR
            private_subnet4a_cidr: !GetAtt VPCCalculator.PrivateSubnet4ACIDR
            private_subnet4b_cidr: !GetAtt VPCCalculator.PrivateSubnet4BCIDR
            public_subnet1_cidr: !GetAtt VPCCalculator.PublicSubnet1CIDR
            public_subnet2_cidr: !GetAtt VPCCalculator.PublicSubnet2CIDR
            public_subnet3_cidr: !GetAtt VPCCalculator.PublicSubnet3CIDR
            public_subnet4_cidr: !GetAtt VPCCalculator.PublicSubnet4CIDR
            logs_retention_in_days: !Ref LogsRetentionInDays
            vpc_cidr: !Ref VPCCidr
            transit_vpc: !FindInMap [VPC, !Ref VPCOptions, TransitVPC]
        - file_name: parameters/aws_baseline/aws-landing-zone-config-rules-global.json.j2
          parameters:
            enable_root_mfa_rule: !Ref EnableRootMfaRule
            enable_iam_password_policy_rule: !Ref EnableIamPasswordPolicyRule
        - file_name: parameters/aws_baseline/aws-landing-zone-config-rules.json.j2
          parameters:
            enable_encrypted_volumes_rule: !Ref EnableEncryptedVolumesRule
            enable_rds_encryption_rule: !Ref EnableRdsEncryptionRule
            enable_s3_public_read_rule: !Ref EnableS3PublicReadRule
            enable_s3_public_write_rule: !Ref EnableS3PublicWriteRule
            enable_s3_server_side_encryption_rule: !Ref EnableS3ServerSideEncryptionRule
            enable_restricted_common_ports_rule: !Ref EnableRestrictedCommonPortsRule
            enable_restricted_ssh_rule: !Ref EnableRestrictedSshRule
        - file_name: parameters/core_accounts/aws-landing-zone-notification.json.j2
          parameters:
            subscribe_to_all_configuration_topic: !Ref SubscribeAllChangeEventsEmailToTopic

      ServiceToken: !GetAtt LandingZoneDeploymentLambda.Arn

  StateMachineTriggerLambdaRole:
    Type: AWS::IAM::Role
    Metadata:
      cfn_nag:
        rules_to_suppress:
          - id: W28
            reason: "The role name is defined to identify AWS Landing Zone resources."
          - id: W76
            reason: "This is not a security concern. We plan to segment the large policy document into smaller inline policies in the future release."
          - id: W11
            reason: "Allow Resource * for KMS/SSM API. KMS Service only support all resources. Key ID is generated by the service. SSM parameters are customer defined."
    Properties:
      RoleName: StateMachineTriggerLambdaRole
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              Service: lambda.amazonaws.com
            Action: sts:AssumeRole
      Path: /
      Policies:
        - PolicyName: LandingZoneStateMachineTriggerLambda
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Effect: Allow
                Action:
                  - logs:CreateLogGroup
                  - logs:CreateLogStream
                  - logs:PutLogEvents
                Resource:
                  - Fn::Sub: 'arn:aws:logs:${AWS::Region}:${AWS::AccountId}:log-group:/aws/lambda/*'
              - Effect: Allow
                Action:
                  - ssm:PutParameter
                  - ssm:GetParameter
                  - ssm:DeleteParameter
                  - ssm:GetParametersByPath
                Resource: !Sub arn:aws:ssm:${AWS::Region}:${AWS::AccountId}:parameter/*
              - Effect: Allow
                Action:
                  - ssm:DescribeParameters
                Resource: '*'
              - Effect: Allow
                Action:
                  - kms:Encrypt
                  - kms:Decrypt
                  - kms:ReEncryptFrom
                  - kms:ReEncryptTo
                  - kms:GenerateDataKey
                  - kms:GenerateDataKeyWithoutPlaintext
                  - kms:DescribeKey
                Resource:
                  - !Sub arn:aws:kms:${AWS::Region}:${AWS::AccountId}:key/*
              - Effect: Allow
                Action:
                  - xray:PutTraceSegments
                  - xray:PutTelemetryRecords
                Resource: '*'
              - Effect: Allow
                Action:
                  - s3:PutObject
                  - s3:GetObject
                  - s3:ListBucketByTags
                  - s3:ListBucketMultipartUploads
                  - s3:ListAllMyBuckets
                  - s3:PutBucketLogging
                  - s3:ListBucketVersions
                  - s3:ListBucket
                Resource: '*'  # supports remotely sourced templates feature. The host S3 bucket can be created by the customer.
              - Effect: Allow
                Action:
                  - states:DescribeStateMachine
                  - states:ListExecutions
                  - states:StartExecution
                  - states:StopExecution
                Resource:
                  - !Ref OrganizationsStateMachine
                  - !Ref ServiceControlPolicyMachine
                  - !Ref StackSetStateMachine
                  - !Ref ServiceCatalogStateMachine
                  - !Ref LaunchAVMStateMachine
                  - !Ref CheckAVMExistsStateMachine
                  - !Ref HandshakeStateMachine
              - Effect: Allow
                Action:
                  - states:DescribeStateMachineForExecution
                  - states:DescribeExecution
                Resource:
                  - !Sub arn:aws:states:${AWS::Region}:${AWS::AccountId}:execution:${OrganizationsStateMachine.Name}:*
                  - !Sub arn:aws:states:${AWS::Region}:${AWS::AccountId}:execution:${ServiceControlPolicyMachine.Name}:*
                  - !Sub arn:aws:states:${AWS::Region}:${AWS::AccountId}:execution:${StackSetStateMachine.Name}:*
                  - !Sub arn:aws:states:${AWS::Region}:${AWS::AccountId}:execution:${ServiceCatalogStateMachine.Name}:*
                  - !Sub arn:aws:states:${AWS::Region}:${AWS::AccountId}:execution:${LaunchAVMStateMachine.Name}:*
                  - !Sub arn:aws:states:${AWS::Region}:${AWS::AccountId}:execution:${CheckAVMExistsStateMachine.Name}:*
                  - !Sub arn:aws:states:${AWS::Region}:${AWS::AccountId}:execution:${HandshakeStateMachine.Name}:*

              - Effect: Allow
                Action:
                  - codepipeline:PutJobSuccessResult
                  - codepipeline:PutJobFailureResult
                Resource: '*'
              - Effect: Allow
                Action:
                  - organizations:ListRoots
                  - organizations:ListOrganizationalUnitsForParent
                  - organizations:ListAccountsForParent
                  - organizations:DescribeAccount
                Resource: '*'
              - Effect: Allow
                Action:
                  - sts:AssumeRole
                Resource: 'arn:aws:iam::*:role/AWSCloudFormationStackSetExecutionRole'
              - Effect: Allow
                Action:
                  - ec2:DescribeAvailabilityZones
                  - ec2:DescribeRegions
                Resource: '*'
              - Effect: Allow
                Action:
                  - cloudformation:DescribeStackSet
                  - cloudformation:ListStackInstances
                  - cloudformation:ListStackSetOperations
                Resource: '*'

  StateMachineTriggerLambda:
    Type: AWS::Lambda::Function
    Metadata:
      cfn_nag:
        rules_to_suppress:
          - id: W89
            reason: "This lambda function does not need access to VPC resources"
          - id: W92
            reason: "This use case does not need to set the ReservedConcurrentExecutions"
    Properties:
      Environment:
        Variables:
          log_level: !FindInMap [LambdaFunction, Logging, Level]
          KMS_KEY_ALIAS_NAME: !FindInMap [KMS, Alias, Name]
          staging_bucket: !Ref LandingZonePipelineArtifactS3Bucket
          wait_time: "5"
          sm_arn_account: !Ref OrganizationsStateMachine
          sm_arn_stack_set: !Ref StackSetStateMachine
          sm_arn_service_control_policy: !Ref ServiceControlPolicyMachine
          sm_arn_service_catalog: !Ref ServiceCatalogStateMachine
          sm_arn_baseline_resources: !Ref StackSetStateMachine
          sm_arn_launch_avm: !Ref LaunchAVMStateMachine
          sm_arn_check_avm_exists: !Ref CheckAVMExistsStateMachine
          sm_arn_handshake_sm: !Ref HandshakeStateMachine
          lambda_arn_param_name: !FindInMap [SSMParameterNames, LandingZoneLambdaParameterName, Name]
          SOLUTION_ID: !FindInMap [ Solution, Metrics, SolutionID ]
          SOLUTION_VERSION: v2.4.6
          METRICS_URL: !FindInMap [ Solution, Metrics, MetricsURL ]
      Code:
        S3Bucket: !Sub "solutions-${AWS::Region}"
        S3Key: aws-landing-zone/v2.4.6/aws-landing-zone-state-machine-trigger.zip
      FunctionName: LandingZoneStateMachineTriggerLambda
      Description: AWS Landing Zone State Machine Trigger
      Handler: state_machine_trigger.lambda_handler
      MemorySize: 3008
      Role: !GetAtt 'StateMachineTriggerLambdaRole.Arn'
      Runtime: python3.9
      Timeout: 900
      TracingConfig:
          Mode: Active

  StateMachineLambdaRole:
    Type: AWS::IAM::Role
    Metadata:
      cfn_nag:
        rules_to_suppress:
          - id: F38
            reason: "PassRole action is required to make changes to all (*) the Service Catalog Resources"
          - id: W76
            reason: "This is not a security concern. We plan to segment the large policy document into smaller inline policies in the future release."
          - id: W28
            reason: "The role name is defined to identify AWS Landing Zone resources."
          - id: W11
            reason: "Allow Resource * for KMS/SSM/Org/SC/CFN API. Key ID is generated by the service. Other resources are customer defined."
    Properties:
      RoleName: StateMachineLambdaRole
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              Service: lambda.amazonaws.com
            Action: sts:AssumeRole
      Path: /
      Policies:
        - PolicyName: StateMachineLambda
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Effect: Allow
                Action:
                  - logs:CreateLogGroup
                  - logs:CreateLogStream
                  - logs:PutLogEvents
                Resource:
                  - Fn::Sub: 'arn:aws:logs:${AWS::Region}:${AWS::AccountId}:log-group:/aws/lambda/*'
              - Effect: Allow
                Action:
                  - organizations:ListPolicies
                  - organizations:ListPoliciesForTarget
                  - organizations:ListTargetsForPolicy
                  - organizations:ListParents
                  - organizations:ListRoots
                  - organizations:ListAccounts
                  - organizations:ListOrganizationalUnitsForParent
                  - organizations:ListAccountsForParent
                  - organizations:DescribeAccount
                  - organizations:DescribeCreateAccountStatus
                  - organizations:DescribeOrganization
                  - organizations:EnablePolicyType
                  - organizations:CreateOrganization
                  - organizations:CreateOrganizationalUnit
                  - organizations:CreatePolicy
                  - organizations:UpdatePolicy
                  - organizations:DeletePolicy
                  - organizations:DetachPolicy
                  - organizations:AttachPolicy
                  - organizations:CreateAccount
                  - organizations:MoveAccount
                  - organizations:UpdateOrganizationalUnit
                  - organizations:DeleteOrganizationalUnit
                Resource: '*' # The APIs above only support '*' resource.
              - Effect: Allow
                Action:
                  - servicecatalog:DescribePortfolio
                  - servicecatalog:DescribeProvisioningArtifact
                  - servicecatalog:DescribeConstraint
                  - servicecatalog:ListTagOptions
                  - servicecatalog:ListResourcesForTagOption
                  - servicecatalog:ListPortfoliosForProduct
                  - servicecatalog:ListConstraintsForPortfolio
                  - servicecatalog:ListProvisioningArtifacts
                  - servicecatalog:ListPrincipalsForPortfolio
                  - servicecatalog:ListPortfolios
                  - servicecatalog:DescribeRecord
                  - servicecatalog:DescribeProvisionedProduct
                  - servicecatalog:SearchProvisionedProducts
                Resource: '*'
              - Effect: Allow
                Action:
                  - servicecatalog:CreateConstraint
                  - servicecatalog:CreatePortfolio
                  - servicecatalog:CreateProduct
                  - servicecatalog:CreateTagOption
                  - servicecatalog:CreateProvisioningArtifact
                  - servicecatalog:UpdateProvisioningArtifact
                  - servicecatalog:DeleteProvisioningArtifact
                  - servicecatalog:UpdatePortfolio
                  - servicecatalog:UpdateProduct
                  - servicecatalog:UpdateTagOption
                  - servicecatalog:DeleteConstraint
                  - servicecatalog:DeletePortfolio
                  - servicecatalog:DeleteProduct
                  - servicecatalog:AssociatePrincipalWithPortfolio
                  - servicecatalog:AssociateProductWithPortfolio
                  - servicecatalog:AssociateTagOptionWithResource
                  - servicecatalog:DisassociatePrincipalFromPortfolio
                  - servicecatalog:DisassociateProductFromPortfolio
                  - servicecatalog:DisassociateTagOptionFromResource
                  - servicecatalog:DeleteProduct
                  - servicecatalog:UpdateProvisionedProduct
                  - servicecatalog:TerminateProvisionedProduct
                  - servicecatalog:TagResource
                Resource:
                  - !Sub arn:aws:catalog:${AWS::Region}:${AWS::AccountId}:portfolio/*
                  - !Sub arn:aws:catalog:${AWS::Region}:${AWS::AccountId}:product/*
                  - !Sub arn:aws:servicecatalog:${AWS::Region}:${AWS::AccountId}:*/*
              - Effect: Allow
                Action:
                  - servicecatalog:SearchProductsAsAdmin
                  - servicecatalog:ProvisionProduct
                Resource: '*'
                Condition:
                  StringEquals:
                    servicecatalog:accountLevel: self
              - Effect: Allow
                Action:
                  - cloudformation:CreateStackSet
                  - cloudformation:CreateStack
                  - cloudformation:DeleteStack
                  - cloudformation:DeleteStackSet
                  - cloudformation:CreateStackInstances
                  - cloudformation:DeleteStackInstances
                  - cloudformation:UpdateStackSet
                  - cloudformation:UpdateStackInstances
                  - cloudformation:TagResource
                Resource:
                  - !Sub arn:aws:cloudformation:${AWS::Region}:${AWS::AccountId}:stack/*
                  - !Sub arn:aws:cloudformation:${AWS::Region}:${AWS::AccountId}:stackset/*
              - Effect: Allow
                Action:
                  - cloudformation:DescribeStackInstance
                  - cloudformation:DescribeStackSetOperation
                  - cloudformation:DescribeStackSet
                  - cloudformation:TagResource
                  - cloudformation:ListStackInstances
                  - cloudformation:GetTemplateSummary
                  - cloudformation:DescribeStacks
                  - cloudformation:ListStacks
                Resource:
                  - !Sub arn:aws:cloudformation:${AWS::Region}:${AWS::AccountId}:stack/*
                  - !Sub arn:aws:cloudformation:${AWS::Region}:${AWS::AccountId}:stackset/*
              - Effect: Allow
                Action:
                  - ssm:PutParameter
                  - ssm:GetParameter
                  - ssm:GetParameters
                  - ssm:DeleteParameter
                  - ssm:GetParametersByPath
                Resource: !Sub arn:aws:ssm:${AWS::Region}:${AWS::AccountId}:parameter/*
              - Effect: Allow
                Action:
                  - ssm:DescribeParameters
                  - cloudformation:ValidateTemplate
                Resource: '*'
              - Effect: Allow
                Action:
                  - kms:Encrypt
                  - kms:Decrypt
                  - kms:ReEncryptFrom
                  - kms:ReEncryptTo
                  - kms:GenerateDataKey
                  - kms:GenerateDataKeyWithoutPlaintext
                  - kms:DescribeKey
                Resource:
                  - !Sub arn:aws:kms:${AWS::Region}:${AWS::AccountId}:key/*
              - Effect: Allow
                Action:
                  - xray:PutTraceSegments
                  - xray:PutTelemetryRecords
                Resource: '*'
              - Effect: Allow
                Action:
                  - iam:CreateServiceLinkedRole
                  - iam:PutRolePolicy
                  - iam:UpdateRoleDescription
                  - iam:DeleteServiceLinkedRole
                  - iam:GetServiceLinkedRoleDeletionStatus
                  - iam:GetGroup
                  - iam:PassRole
                  - iam:GetRole
                Resource: '*'
              - Effect: Allow
                Action:
                  - s3:PutObject
                  - s3:GetObject
                  - s3:ListBucketByTags
                  - s3:ListBucketMultipartUploads
                  - s3:ListAllMyBuckets
                  - s3:PutBucketLogging
                  - s3:ListBucketVersions
                  - s3:ListBucket
                Resource: '*'
              - Effect: Allow
                Action:
                  - ec2:DescribeInternetGateways
                  - ec2:DescribeRegions
                  - ec2:DescribeSubnets
                  - ec2:DescribeVpcs
                  - ec2:DeleteInternetGateway
                  - ec2:DeleteSubnet
                  - ec2:DeleteVpc
                  - ec2:DetachInternetGateway
                  - ec2:CreateKeyPair
                  - ec2:CreateSecurityGroup
                  - ec2:CreateNetworkInterface
                  - ec2:DescribeNetworkInterfaces
                  - ec2:AuthorizeSecurityGroupIngress
                  - ec2:AuthorizeSecurityGroupEgress
                  - ec2:DeleteSecurityGroup
                  - ec2:DeleteNetworkInterface
                  - ec2:RevokeSecurityGroupIngress
                  - ec2:RevokeSecurityGroupEgress
                Resource: '*'
              - Effect: Allow
                Action:
                  - ds:ConnectDirectory
                  - ds:DescribeDirectories
                  - ds:DeleteDirectory
                Resource: '*'
              - Effect: Allow
                Action:
                  - sts:AssumeRole
                Resource: 'arn:aws:iam::*:role/AWSCloudFormationStackSetExecutionRole'
  StateMachineLambda:
    Type: AWS::Lambda::Function
    Metadata:
      cfn_nag:
        rules_to_suppress:
          - id: W89
            reason: "This lambda function does not need access to VPC resources"
          - id: W92
            reason: "This use case does not need to set the ReservedConcurrentExecutions"
    Properties:
      Environment:
        Variables:
          log_level: !FindInMap [LambdaFunction, Logging, Level]
          KMS_KEY_ALIAS_NAME: !FindInMap [KMS, Alias, Name]
          MAX_CONCURRENT_PERCENT: !Ref MaxConcurrentPercentage
          FAILED_TOLERANCE_PERCENT: !Ref FailureTolerancePercentage
          REGION_CONCURRENCY_TYPE: !Ref RegionConcurrencyType
          SSM_KEY_FOR_LOCK_DOWN_ROLE_ARNS: lock_down_role_arns_list
          UNLOCK_ROLE_ARNS: !Sub arn:aws:iam::${AWS::AccountId}:root
          SOLUTION_ID: !FindInMap [ Solution, Metrics, SolutionID ]
          SOLUTION_VERSION: v2.4.6
          METRICS_URL: !FindInMap [ Solution, Metrics, MetricsURL ]
      Code:
        S3Bucket: !Sub "solutions-${AWS::Region}"
        S3Key: aws-landing-zone/v2.4.6/aws-landing-zone-state-machine.zip
      FunctionName: LandingZoneStateMachineLambda
      Description: AWS Landing Zone State Machine Handler
      Handler: state_machine_router.lambda_handler
      MemorySize: 1024
      Role: !GetAtt 'StateMachineLambdaRole.Arn'
      Runtime: python3.9
      Timeout: 300
      TracingConfig:
          Mode: Active

  HandshakeSMLambdaRole:
    Type: AWS::IAM::Role
    Metadata:
      cfn_nag:
        rules_to_suppress:
          - id: W28
            reason: "The role name is defined to identify AWS Landing Zone resources."
          - id: W11
            reason: "Allow Resource * for KMS/GuardDuty API. KMS Key ID and GD Detector Id are generated by the service. SSM parameters are customer defined."
    Properties:
      RoleName: LandingZoneHandshakeSMLambdaRole
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              Service: lambda.amazonaws.com
            Action: sts:AssumeRole
      Path: /
      Policies:
        - PolicyName: LandingZoneHandshakeSMLambda
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Effect: Allow
                Action:
                  - logs:CreateLogGroup
                  - logs:CreateLogStream
                  - logs:PutLogEvents
                Resource:
                  - Fn::Sub: 'arn:aws:logs:${AWS::Region}:${AWS::AccountId}:log-group:/aws/lambda/*'
              - Effect: Allow
                Action:
                  - xray:PutTraceSegments
                  - xray:PutTelemetryRecords
                Resource: '*'
              - Effect: Allow
                Action:
                  - ec2:DescribeInternetGateways
                  - ec2:DescribeRegions
                  - ec2:DescribeSubnets
                  - ec2:DescribeVpcs
                  - ec2:DeleteInternetGateway
                  - ec2:DeleteSubnet
                  - ec2:DeleteVpc
                  - ec2:DetachInternetGateway
                  - ec2:CreateKeyPair
                  - ec2:DescribeAvailabilityZones
                  - ec2:DescribeVPCPeeringConnections
                  - ec2:CreateVPCPeeringConnection
                  - ec2:AcceptVPCPeeringConnection
                  - ec2:DeleteVPCPeeringConnection
                  - ec2:CreateRoute
                  - ec2:ReplaceRoute
                  - ec2:DeleteRoute
                Resource: '*'
              - Effect: Allow
                Action:
                  - guardduty:ListInvitations
                  - guardduty:ListDetectors
                  - guardduty:ListMembers
                  - guardduty:CreateDetector
                  - guardduty:DeleteDetector
                  - guardduty:CreateMembers
                  - guardduty:InviteMembers
                  - guardduty:AcceptInvitation
                  - guardduty:GetMasterAccount
                  - guardduty:DeleteMembers
                  - guardduty:DisassociateFromMasterAccount
                Resource: '*'

              - Effect: Allow
                Action:
                  - ssm:PutParameter
                  - ssm:GetParameter
                  - ssm:GetParameters
                  - ssm:DeleteParameter
                Resource: !Sub arn:aws:ssm:${AWS::Region}:${AWS::AccountId}:parameter/*
              - Effect: Allow
                Action:
                  - ssm:DescribeParameters
                Resource: '*'
              - Effect: Allow
                Action:
                  - kms:Encrypt
                  - kms:Decrypt
                  - kms:ReEncryptFrom
                  - kms:ReEncryptTo
                  - kms:GenerateDataKey
                  - kms:GenerateDataKeyWithoutPlaintext
                  - kms:DescribeKey
                Resource:
                  - !Sub arn:aws:kms:${AWS::Region}:${AWS::AccountId}:key/*
              - Effect: Allow
                Action:
                  - sts:AssumeRole
                Resource: 'arn:aws:iam::*:role/AWSCloudFormationStackSetExecutionRole'
  HandshakeSMLambda:
    Type: AWS::Lambda::Function
    Metadata:
      cfn_nag:
        rules_to_suppress:
          - id: W89
            reason: "This lambda function does not need access to VPC resources"
          - id: W92
            reason: "This use case does not need to set the ReservedConcurrentExecutions"
    Properties:
      Environment:
        Variables:
          log_level: !FindInMap [LambdaFunction, Logging, Level]
          wait_time: '15'
          SOLUTION_ID: !FindInMap [ Solution, Metrics, SolutionID ]
          SOLUTION_VERSION: v2.4.6
          METRICS_URL: !FindInMap [ Solution, Metrics, MetricsURL ]
      Code:
        S3Bucket: !Sub "solutions-${AWS::Region}"
        S3Key: aws-landing-zone/v2.4.6/aws-landing-zone-handshake-state-machine.zip
      Description: AWS Lambda-backed Custom Resources for Handshake Mechanism
      FunctionName: LandingZoneHandshakeSMLambda
      Handler: handshake_sm_router.lambda_handler
      MemorySize: 1024
      Role: !GetAtt 'HandshakeSMLambdaRole.Arn'
      Runtime: python3.9
      Timeout: 660
      TracingConfig:
        Mode: Active

  LockDownRoleArnParameter0:
    DependsOn:
      - StateMachineLambda
    Type: AWS::SSM::Parameter
    Properties:
      Name: /lock_down_role_arns_list/AWSCloudFormationStackSetAdministrationRole
      Description: Contains the IAM Role ARNs to lock down the AWSCloudFormationStackSetExecutionRole Role in member account
      Type: String
      Value: !Sub ${AWSCloudFormationStackSetAdministrationRole.Arn}

  LockDownRoleArnParameter1:
    DependsOn:
      - StateMachineLambda
    Type: AWS::SSM::Parameter
    Properties:
      Name: /lock_down_role_arns_list/StateMachineTriggerLambdaRole
      Description: Contains the IAM Role ARNs to lock down the AWSCloudFormationStackSetExecutionRole Role in member account
      Type: String
      Value: !Sub arn:aws:iam::${AWS::AccountId}:role/StateMachineTriggerLambdaRole

  LockDownRoleArnParameter2:
    DependsOn:
      - StateMachineLambda
    Type: AWS::SSM::Parameter
    Properties:
      Name: /lock_down_role_arns_list/LandingZoneLambdaRole
      Description: Contains the IAM Role ARNs to lock down the AWSCloudFormationStackSetExecutionRole Role in member account
      Type: String
      Value: !Sub arn:aws:iam::${AWS::AccountId}:role/LandingZoneLambdaRole

  LockDownRoleArnParameter3:
    DependsOn:
      - StateMachineLambda
    Type: AWS::SSM::Parameter
    Properties:
      Name: /lock_down_role_arns_list/StateMachineLambdaRole
      Description: Contains the IAM Role ARNs to lock down the AWSCloudFormationStackSetExecutionRole Role in member account
      Type: String
      Value: !Sub arn:aws:iam::${AWS::AccountId}:role/StateMachineLambdaRole

  LockDownRoleArnParameter4:
    DependsOn:
      - StateMachineLambda
    Type: AWS::SSM::Parameter
    Properties:
      Name: /lock_down_role_arns_list/LandingZoneHandshakeSMLambdaRole
      Description: Contains the IAM Role ARNs to lock down the AWSCloudFormationStackSetExecutionRole Role in member account
      Type: String
      Value: !Sub arn:aws:iam::${AWS::AccountId}:role/LandingZoneHandshakeSMLambdaRole

  LockDownRoleArnParameter5:
    Type: AWS::SSM::Parameter
    Properties:
      Name: /lock_down_role_arns_list/BaselineResourceCodeBuildRole
      Description: Contains the IAM Role ARNs to lock down the AWSCloudFormationStackSetExecutionRole Role in member account
      Type: String
      Value: !GetAtt BaselineResourceCodeBuildRole.Arn

  LandingZoneLambdaRole:
    Type: AWS::IAM::Role
    Metadata:
      cfn_nag:
        rules_to_suppress:
          - id: W28
            reason: "The role name is defined to identify AWS Landing Zone resources."
          - id: W76
            reason: "This is not a security concern. We plan to segment the large policy document into smaller inline policies in the future release."
          - id: W11
            reason: "Allow Resource * for KMS/EC2 API. KMS Key ID is generated by the service. SSM parameters and EC2 resources are customer defined."
    Properties:
      RoleName: LandingZoneLambdaRole
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              Service: lambda.amazonaws.com
            Action: sts:AssumeRole
      Path: /
      Policies:
        - PolicyName: LandingZoneLambda
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Effect: Allow
                Action:
                  - logs:CreateLogGroup
                  - logs:CreateLogStream
                  - logs:PutLogEvents
                Resource:
                  - Fn::Sub: 'arn:aws:logs:${AWS::Region}:${AWS::AccountId}:log-group:/aws/lambda/*'
              - Effect: Allow
                Action:
                  - xray:PutTraceSegments
                  - xray:PutTelemetryRecords
                Resource: '*'
              - Effect: Allow
                Action:
                  - states:DescribeStateMachine
                  - states:ListExecutions
                  - states:StartExecution
                  - states:StopExecution
                Resource:
                  - !Ref OrganizationsStateMachine
                  - !Ref ServiceControlPolicyMachine
                  - !Ref StackSetStateMachine
                  - !Ref ServiceCatalogStateMachine
                  - !Ref LaunchAVMStateMachine
                  - !Ref CheckAVMExistsStateMachine
                  - !Ref HandshakeStateMachine
              - Effect: Allow
                Action:
                  - states:DescribeStateMachineForExecution
                  - states:DescribeExecution
                Resource:
                  - !Sub arn:aws:states:${AWS::Region}:${AWS::AccountId}:execution:${OrganizationsStateMachine.Name}:*
                  - !Sub arn:aws:states:${AWS::Region}:${AWS::AccountId}:execution:${ServiceControlPolicyMachine.Name}:*
                  - !Sub arn:aws:states:${AWS::Region}:${AWS::AccountId}:execution:${StackSetStateMachine.Name}:*
                  - !Sub arn:aws:states:${AWS::Region}:${AWS::AccountId}:execution:${ServiceCatalogStateMachine.Name}:*
                  - !Sub arn:aws:states:${AWS::Region}:${AWS::AccountId}:execution:${LaunchAVMStateMachine.Name}:*
                  - !Sub arn:aws:states:${AWS::Region}:${AWS::AccountId}:execution:${CheckAVMExistsStateMachine.Name}:*
                  - !Sub arn:aws:states:${AWS::Region}:${AWS::AccountId}:execution:${HandshakeStateMachine.Name}:*
              - Effect: Allow
                Action:
                  - ec2:DescribeInternetGateways
                  - ec2:DescribeRegions
                  - ec2:DescribeSubnets
                  - ec2:DescribeVpcs
                  - ec2:DeleteInternetGateway
                  - ec2:DeleteSubnet
                  - ec2:DeleteVpc
                  - ec2:DetachInternetGateway
                  - ec2:CreateKeyPair
                  - ec2:DescribeAvailabilityZones
                  - ec2:DescribeVPCPeeringConnections
                  - ec2:CreateVPCPeeringConnection
                  - ec2:AcceptVPCPeeringConnection
                  - ec2:DeleteVPCPeeringConnection
                  - ec2:CreateRoute
                  - ec2:ReplaceRoute
                  - ec2:DeleteRoute
                Resource: '*'
              - Effect: Allow
                Action:
                  - ssm:PutParameter
                  - ssm:GetParameter
                  - ssm:GetParameters
                  - ssm:DeleteParameter
                Resource: !Sub arn:aws:ssm:${AWS::Region}:${AWS::AccountId}:parameter/*
              - Effect: Allow
                Action:
                  - ssm:DescribeParameters
                Resource: '*' # The APIs above only support '*' resource.
              - Effect: Allow
                Action:
                  - kms:Encrypt
                  - kms:Decrypt
                  - kms:ReEncryptFrom
                  - kms:ReEncryptTo
                  - kms:GenerateDataKey
                  - kms:GenerateDataKeyWithoutPlaintext
                  - kms:DescribeKey
                Resource:
                  - !Sub arn:aws:kms:${AWS::Region}:${AWS::AccountId}:key/*
              - Effect: Allow
                Action:
                  - sts:AssumeRole
                Resource: 'arn:aws:iam::*:role/AWSCloudFormationStackSetExecutionRole'

  LandingZoneLambda:
    Type: AWS::Lambda::Function
    Metadata:
      cfn_nag:
        rules_to_suppress:
          - id: W89
            reason: "This lambda function does not need access to VPC resources"
          - id: W92
            reason: "This use case does not need to set the ReservedConcurrentExecutions"
    Properties:
      Environment:
        Variables:
          log_level: !FindInMap [LambdaFunction, Logging, Level]
          KMS_KEY_ALIAS_NAME: !FindInMap [KMS, Alias, Name]
          sm_arn_account: !Ref OrganizationsStateMachine
          sm_arn_stack_set: !Ref StackSetStateMachine
          sm_arn_service_control_policy: !Ref ServiceControlPolicyMachine
          sm_arn_service_catalog: !Ref ServiceCatalogStateMachine
          sm_arn_baseline_resources: !Ref StackSetStateMachine
          sm_arn_launch_avm: !Ref LaunchAVMStateMachine
          sm_arn_check_avm_exists: !Ref CheckAVMExistsStateMachine
          sm_arn_handshake_sm: !Ref HandshakeStateMachine
          SOLUTION_ID: !FindInMap [ Solution, Metrics, SolutionID ]
          SOLUTION_VERSION: v2.4.6
          METRICS_URL: !FindInMap [ Solution, Metrics, MetricsURL ]
      Code:
        S3Bucket: !Sub "solutions-${AWS::Region}"
        S3Key: aws-landing-zone/v2.4.6/aws-landing-zone-avm-cr.zip
      Description: AWS Lambda-backed Custom Resources for AVM
      FunctionName: LandingZone
      Handler: lambda_custom_resource.lambda_handler
      MemorySize: 1024
      Role: !GetAtt 'LandingZoneLambdaRole.Arn'
      Runtime: python3.9
      Timeout: 300
      TracingConfig:
          Mode: Active

  VPCCalculator:
    Type: Custom::VPCCalculator
    Properties:
      VPCCidr: !Ref VPCCidr
      PublicSubnets: !FindInMap
        - VPC
        - !Ref VPCOptions
        - PublicSubnets
      PrivateSubnets: !FindInMap
        - VPC
        - !Ref VPCOptions
        - PrivateSubnets
      AvailabilityZones: !FindInMap
        - VPC
        - !Ref VPCOptions
        - AvailabilityZones
      CreatePrivateSubnets: !FindInMap
        - VPC
        - !Ref VPCOptions
        - CreatePrivateSubnets
      CreateAdditionalPrivateSubnets: !FindInMap
        - VPC
        - !Ref VPCOptions
        - CreateAdditionalPrivateSubnets
      ServiceToken: !GetAtt LandingZoneLambda.Arn

  LandingZoneLambdaParameter:
    DependsOn:
      - LandingZoneLambda
    Type: AWS::SSM::Parameter
    Properties:
      Name: !FindInMap [SSMParameterNames, LandingZoneLambdaParameterName, Name]
      Description: Contains the Lambda ARN for AVM Custom Resource
      Type: String
      Value: !Sub ${LandingZoneLambda.Arn}

  StateMachineRole:
    Type: "AWS::IAM::Role"
    Metadata:
      cfn_nag:
        rules_to_suppress:
          - id: W11
            reason: "Allow Resource * for AWS Lambda Functions in the account. State Machine execution fails otherwise."
    Properties:
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          -
            Effect: "Allow"
            Principal:
              Service:
                - !Sub "states.${AWS::Region}.amazonaws.com"
            Action:
              - "sts:AssumeRole"
      Path: "/"
      Policies:
        - PolicyName: "lambda"
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Effect: "Allow"
                Action:
                  - "lambda:InvokeFunction"
                Resource: !Sub "arn:aws:lambda:${AWS::Region}:${AWS::AccountId}:function:*"

  OrganizationsStateMachine:
    Type: 'AWS::StepFunctions::StateMachine'
    Properties:
      StateMachineName: LandingZoneOrganizationsStateMachine
      RoleArn: !GetAtt 'StateMachineRole.Arn'
      DefinitionString:
        Fn::Sub: |-
          {
            "Comment": "A state machine that manages the AWS Organization, Organizational Units and Accounts",
            "StartAt": "Metrics Pass",
            "States": {
              "Metrics Pass": {
                "Type": "Pass",
                "Result": {
                  "ClassName": "GeneralFunctions",
                  "FunctionName": "send_execution_data"
                },
                "ResultPath": "$.params",
                "Next": "Metrics"
              },
              "Metrics": {
                "Type": "Task",
                "Resource": "${StateMachineLambda.Arn}",
                "TimeoutSeconds": 300,
                "HeartbeatSeconds": 60,
                "Next": "Check Organization Pass"
              },
              "Check Organization Pass": {
                "Type": "Pass",
                "Result": {
                  "ClassName": "Organizations",
                  "FunctionName": "list_roots"
                },
                "ResultPath": "$.params",
                "Next": "Check Organization"
              },
              "Check Organization": {
                "Type": "Task",
                "Resource": "${StateMachineLambda.Arn}",
                "Next": "Check Organization Unit Pass"
              },
              "Check Organization Unit Pass": {
                "Type": "Pass",
                "Result": {
                  "ClassName": "Organizations",
                  "FunctionName": "check_organization_unit"
                },
                "ResultPath": "$.params",
                "Next": "Check Organization Unit"
              },
              "Check Organization Unit": {
                "Type": "Task",
                "Resource": "${StateMachineLambda.Arn}",
                "Next": "Check Account Pass"
              },
              "Check Account Pass": {
                "Type": "Pass",
                "Result": {
                  "ClassName": "Organizations",
                  "FunctionName": "list_accounts"
                },
                "ResultPath": "$.params",
                "Next": "Check Account"
              },
              "Check Account": {
                "Type": "Task",
                "Resource": "${StateMachineLambda.Arn}",
                "Next": "Check Complete?"
              },
              "Check Complete?": {
                "Type": "Choice",
                "Choices": [
                  {
                    "Variable": "$.NextToken",
                    "StringEquals": "Complete",
                    "Next": "Request Type"
                  }
                ],
                "Default": "Check Account Wait"
              },
              "Check Account Wait": {
                "Type": "Wait",
                "Seconds": 5,
                "Next": "Check Account"
              },
              "Request Type": {
                "Type": "Choice",
                "Choices": [
                  {
                    "Variable": "$.RequestType",
                    "StringEquals": "Update",
                    "Next": "Create Update"
                  },
                  {
                    "Variable": "$.RequestType",
                    "StringEquals": "Delete",
                    "Next": "Delete"
                  }
                ],
                "Default": "Create Update"
              },
              "Create Update": {
                "Type": "Pass",
                "Next": "Create Organization Choice"
              },
              "Delete": {
                "Type": "Pass",
                "Next": "Account Id?"
              },
              "Create Organization Choice": {
                "Type": "Choice",
                "Choices": [
                  {
                    "Variable": "$.RootId",
                    "StringEquals": "None",
                    "Next": "Create Organization Pass"
                  }
                ],
                "Default": "Create Organization Unit Choice"
              },
              "Create Organization Pass": {
                "Type": "Pass",
                "Result": {
                  "ClassName": "Organizations",
                  "FunctionName": "create_organization"
                },
                "ResultPath": "$.params",
                "Next": "Create Organization"
              },
              "Create Organization": {
                "Type": "Task",
                "Resource": "${StateMachineLambda.Arn}",
                "Next": "Create Organization Unit Choice"
              },
              "Create Organization Unit Choice": {
                "Type": "Choice",
                "Choices": [
                  {
                    "Variable": "$.OUId",
                    "StringEquals": "None",
                    "Next": "Create Organization Unit Pass"
                  }
                ],
                "Default": "Account Choice"
              },
              "Create Organization Unit Pass": {
                "Type": "Pass",
                "Result": {
                  "ClassName": "Organizations",
                  "FunctionName": "create_organization_unit"
                },
                "ResultPath": "$.params",
                "Next": "Create Organization Unit"
              },
              "Create Organization Unit": {
                "Type": "Task",
                "Resource": "${StateMachineLambda.Arn}",
                "Next": "Account Choice"
              },
              "Account Choice": {
                "Type": "Choice",
                "Choices": [
                  {
                    "Variable": "$.ResourceProperties.AccountName",
                    "StringEquals": "",
                    "Next": "Describe Organization Pass"
                  },
                  {
                    "Variable": "$.AccountId",
                    "StringEquals": "None",
                    "Next": "Create Account Pass"
                  }
                ],
                "Default": "Get ParentId Pass"
              },
              "Create Account Pass": {
                "Type": "Pass",
                "Result": {
                  "ClassName": "Organizations",
                  "FunctionName": "create_account"
                },
                "ResultPath": "$.params",
                "Next": "Create Account"
              },
              "Create Account": {
                "Type": "Task",
                "Resource": "${StateMachineLambda.Arn}",
                "Next": "Organization initializing?"
              },
              "Organization initializing?": {
                "Type": "Choice",
                "Choices": [
                  {
                    "Variable": "$.OrganizationInitializing",
                    "StringEquals": "no",
                    "Next": "Wait On Create Account"
                  },
                  {
                    "Variable": "$.OrganizationInitializing",
                    "StringEquals": "yes",
                    "Next": "Wait on Organization initialization"
                  }
                ],
                "Default": "Wait On Create Account"
              },
              "Wait on Organization initialization": {
                "Type": "Wait",
                "Seconds": 300,
                "Next": "Create Account Pass"
              },
              "Create Account Status Pass": {
                "Type": "Pass",
                "Result": {
                  "ClassName": "Organizations",
                  "FunctionName": "describe_account_status"
                },
                "ResultPath": "$.params",
                "Next": "Create Account Status"
              },
              "Create Account Status": {
                "Type": "Task",
                "Resource": "${StateMachineLambda.Arn}",
                "Next": "Create Complete?"
              },
              "Create Complete?": {
                "Type": "Choice",
                "Choices": [
                  {
                    "Variable": "$.CreateAccountStatus",
                    "StringEquals": "FAILED",
                    "Next": "Account Create Failed"
                  },
                  {
                    "Variable": "$.CreateAccountStatus",
                    "StringEquals": "SUCCEEDED",
                    "Next": "Move Account Pass"
                  }
                ],
                "Default": "Wait On Create Account"
              },
              "Wait On Create Account": {
                "Type": "Wait",
                "Seconds": 10,
                "Next": "Create Account Status Pass"
              },
              "Account Create Failed": {
                "Type": "Pass",
                "Next": "Send Failed Pass"
              },
              "Account Id?": {
                "Type": "Choice",
                "Choices": [
                  {
                    "Variable": "$.AccountId",
                    "StringEquals": "None",
                    "Next": "Organization Unit Id?"
                  }
                ],
                "Default": "Get ParentId Pass"
              },
              "Get ParentId Pass": {
                "Type": "Pass",
                "Result": {
                  "ClassName": "Organizations",
                  "FunctionName": "list_parents"
                },
                "ResultPath": "$.params",
                "Next": "Get ParentId"
              },
              "Get ParentId": {
                "Type": "Task",
                "Resource": "${StateMachineLambda.Arn}",
                "Next": "Move Account Pass"
              },
              "Move Account Pass": {
                "Type": "Pass",
                "Result": {
                  "ClassName": "Organizations",
                  "FunctionName": "move_account"
                },
                "ResultPath": "$.params",
                "Next": "Move Account"
              },
              "Move Account": {
                "Type": "Task",
                "Resource": "${StateMachineLambda.Arn}",
                "Next": "Check Account Status Pass"
              },
              "Check Account Status Pass": {
                "Type": "Pass",
                "Result": {
                  "ClassName": "GeneralFunctions",
                  "FunctionName": "account_initialization_check"
                },
                "ResultPath": "$.params",
                "Next": "Check Account Status"
              },
              "Check Account Status": {
                "Type": "Task",
                "Resource": "${StateMachineLambda.Arn}",
                "TimeoutSeconds": 300,
                "HeartbeatSeconds": 60,
                "Next": "Is New Account Initialized?"
              },
              "Is New Account Initialized?": {
                "Type": "Choice",
                "Choices": [
                  {
                    "Variable": "$.AccountInitialized",
                    "StringEquals": "yes",
                    "Next": "Request Type Choice"
                  },
                  {
                    "Variable": "$.AccountInitialized",
                    "StringEquals": "no",
                    "Next": "Wait for 5 minutes"
                  }
                ],
                "Default": "Wait for 5 minutes"
              },
              "Wait for 5 minutes": {
                "Type": "Wait",
                "Seconds": 300,
                "Next": "Check Account Status Pass"
              },
              "Request Type Choice": {
                "Type": "Choice",
                "Choices": [
                  {
                    "Variable": "$.RequestType",
                    "StringEquals": "Create",
                    "Next": "Describe Organization Pass"
                  },
                  {
                    "Variable": "$.RequestType",
                    "StringEquals": "Update",
                    "Next": "Describe Organization Pass"
                  }
                ],
                "Default": "Organization Unit Id?"
              },
              "Organization Unit Id?": {
                "Type": "Choice",
                "Choices": [
                  {
                    "Variable": "$.OUId",
                    "StringEquals": "None",
                    "Next": "Organization Unit Not Found"
                  }
                ],
                "Default": "Check Organization Unit Is Empty Pass"
              },
              "Organization Unit Not Found": {
                "Type": "Pass",
                "Next": "Send Success Pass"
              },
              "Check Organization Unit Is Empty Pass": {
                "Type": "Pass",
                "Result": {
                  "ClassName": "Organizations",
                  "FunctionName": "list_accounts_for_parent"
                },
                "ResultPath": "$.params",
                "Next": "Check Organization Unit Is Empty"
              },
              "Check Organization Unit Is Empty": {
                "Type": "Task",
                "Resource": "${StateMachineLambda.Arn}",
                "Next": "Delete Organization Unit Choice"
              },
              "Delete Organization Unit Choice": {
                "Type": "Choice",
                "Choices": [
                  {
                    "Variable": "$.OrgUnitAccounts",
                    "NumericEquals": 0,
                    "Next": "Delete Organization Unit Pass"
                  }
                ],
                "Default": "Organization Unit Not Empty"
              },
              "Delete Organization Unit Pass": {
                "Type": "Pass",
                "Result": {
                  "ClassName": "Organizations",
                  "FunctionName": "delete_organization_unit"
                },
                "ResultPath": "$.params",
                "Next": "Delete Organization Unit"
              },
              "Delete Organization Unit": {
                "Type": "Task",
                "Resource": "${StateMachineLambda.Arn}",
                "Next": "Send Success Pass"
              },
              "Organization Unit Not Empty": {
                "Type": "Pass",
                "Next": "Send Success Pass"
              },
              "Describe Organization Pass": {
                "Type": "Pass",
                "Result": {
                  "ClassName": "Organizations",
                  "FunctionName": "describe_organization"
                },
                "ResultPath": "$.params",
                "Next": "Describe Organization"
              },
              "Describe Organization": {
                "Type": "Task",
                "Resource": "${StateMachineLambda.Arn}",
                "TimeoutSeconds": 300,
                "HeartbeatSeconds": 60,
                "Next": "SSM Parameter Store Pass"
              },
              "SSM Parameter Store Pass": {
                "Type": "Pass",
                "Result": {
                  "ClassName": "GeneralFunctions",
                  "FunctionName": "ssm_put_parameters"
                },
                "ResultPath": "$.params",
                "Next": "Put Parameters"
              },
              "Put Parameters": {
                "Type": "Task",
                "Resource": "${StateMachineLambda.Arn}",
                "TimeoutSeconds": 300,
                "HeartbeatSeconds": 60,
                "Next": "Update Stack Sets Assume Role Policy Pass"
              },
              "Update Stack Sets Assume Role Policy Pass": {
                "Type": "Pass",
                "Result": {
                  "ClassName": "Organizations",
                  "FunctionName": "lock_down_stack_sets_role"
                },
                "ResultPath": "$.params",
                "Next": "Update Stack Sets Assume Role Policy"
              },
              "Update Stack Sets Assume Role Policy": {
                "Type": "Task",
                "Resource": "${StateMachineLambda.Arn}",
                "TimeoutSeconds": 300,
                "HeartbeatSeconds": 60,
                "Next": "Send Success Pass"
              },
              "Send Success Pass": {
                "Type": "Pass",
                "Result": {
                  "ClassName": "GeneralFunctions",
                  "FunctionName": "send_success_to_cfn"
                },
                "ResultPath": "$.params",
                "Next": "Send Success Response"
              },
              "Send Success Response": {
                "Type": "Task",
                "Resource": "${StateMachineLambda.Arn}",
                "TimeoutSeconds": 300,
                "HeartbeatSeconds": 60,
                "Next": "Success"
              },
              "Success": {
                "Type": "Succeed"
              },
              "Send Failed Pass": {
                "Type": "Pass",
                "Result": {
                  "ClassName": "GeneralFunctions",
                  "FunctionName": "send_failure_to_cfn"
                },
                "ResultPath": "$.params",
                "Next": "Send Failed Response"
              },
              "Send Failed Response": {
                "Type": "Task",
                "Resource": "${StateMachineLambda.Arn}",
                "TimeoutSeconds": 300,
                "HeartbeatSeconds": 60,
                "Next": "Failed"
              },
              "Failed": {
                "Type": "Fail"
              }
            }
          }


  ServiceControlPolicyMachine:
    Type: 'AWS::StepFunctions::StateMachine'
    Properties:
      StateMachineName: LandingZoneServiceControlPolicyMachine
      RoleArn: !GetAtt 'StateMachineRole.Arn'
      DefinitionString:
        Fn::Sub: |-
          {
            "Comment": "A state machine that manages the Service Control Policies.",
             "StartAt": "Metrics Pass",
            "States": {
              "Metrics Pass": {
                "Type": "Pass",
                "Result": {
                  "ClassName": "GeneralFunctions",
                  "FunctionName": "send_execution_data"
                },
                "ResultPath": "$.params",
                "Next": "Metrics"
              },
              "Metrics": {
                "Type": "Task",
                "Resource": "${StateMachineLambda.Arn}",
                "TimeoutSeconds": 300,
                "HeartbeatSeconds": 60,
                "Next": "Create/Delete or Attach/Detach Policy?"
              },
              "Create/Delete or Attach/Detach Policy?": {
                "Type": "Choice",
                "Choices": [
                  {
                    "Variable": "$.ResourceProperties.AccountId",
                    "StringEquals": "",
                    "Next": "Enable Policy Type params"
                  },
                  {
                    "Variable": "$.ResourceProperties.AccountId",
                    "StringGreaterThan": "",
                    "Next": "Attach/Detach Policy params"
                  }
                ]
              },
              "Enable Policy Type params": {
                "Type": "Pass",
                "Result": {
                  "ClassName": "SCP",
                  "FunctionName": "enable_policy_type"
                },
                "ResultPath": "$.params",
                "Next": "Enable Policy Type"
              },
              "Enable Policy Type": {
                "Type": "Task",
                "Resource": "${StateMachineLambda.Arn}",
                "TimeoutSeconds": 300,
                "HeartbeatSeconds": 60,
                "Next": "Wait"
              },
              "Wait": {
                "Type": "Wait",
                "Seconds": 10,
                "Next": "Create/Delete Policy params"
              },
              "Create/Delete Policy params": {
                "Type": "Pass",
                "Result": {
                  "ClassName": "SCP",
                  "FunctionName": "list_policies"
                },
                "ResultPath": "$.params",
                "Next": "Check If Policy Exist?"
              },
              "Check If Policy Exist?": {
                "Type": "Task",
                "Resource": "${StateMachineLambda.Arn}",
                "TimeoutSeconds": 300,
                "HeartbeatSeconds": 60,
                "Next": "Create or Delete Policy?"
              },
              "Create or Delete Policy?": {
                "Type": "Choice",
                "Choices": [
                  {
                    "And": [
                      {
                        "Or": [
                          {
                            "Variable": "$.RequestType",
                            "StringEquals": "Create"
                          },
                          {
                            "Variable": "$.RequestType",
                            "StringEquals": "Update"
                          }
                        ]
                      },
                      {
                        "Variable": "$.PolicyExist",
                        "StringEquals": "no"
                      }
                    ],
                    "Next": "Create Policy Params"
                  },
                  {
                    "And": [
                      {
                        "Or": [
                          {
                            "Variable": "$.RequestType",
                            "StringEquals": "Create"
                          },
                          {
                            "Variable": "$.RequestType",
                            "StringEquals": "Update"
                          }
                        ]
                      },
                      {
                        "Variable": "$.PolicyExist",
                        "StringEquals": "yes"
                      }
                    ],
                    "Next": "Update Policy Params"
                  },
                  {
                    "And": [
                      {
                        "Variable": "$.RequestType",
                        "StringEquals": "Delete"
                      },
                      {
                        "Variable": "$.PolicyExist",
                        "StringEquals": "yes"
                      }
                    ],
                    "Next": "Detach Policy from All Accounts Params"
                  },
                  {
                    "And": [
                      {
                        "Variable": "$.RequestType",
                        "StringEquals": "Delete"
                      },
                      {
                        "Variable": "$.PolicyExist",
                        "StringEquals": "no"
                      }
                    ],
                    "Next": "Finish"
                  }
                ]
              },
              "Create Policy Params": {
                "Type": "Pass",
                "Result": {
                  "ClassName": "SCP",
                  "FunctionName": "create_policy"
                },
                "ResultPath": "$.params",
                "Next": "Create Policy"
              },
              "Create Policy": {
                "Type": "Task",
                "Resource": "${StateMachineLambda.Arn}",
                "TimeoutSeconds": 300,
                "HeartbeatSeconds": 60,
                "Next": "ConfigureCount2 params"
              },
              "Update Policy Params": {
                "Type": "Pass",
                "Result": {
                  "ClassName": "SCP",
                  "FunctionName": "update_policy"
                },
                "ResultPath": "$.params",
                "Next": "Update Policy"
              },
              "Update Policy": {
                "Type": "Task",
                "Resource": "${StateMachineLambda.Arn}",
                "TimeoutSeconds": 300,
                "HeartbeatSeconds": 60,
                "Next": "ConfigureCount2 params"
              },
              "ConfigureCount2 params": {
                "Type": "Pass",
                "Result": {
                  "ClassName": "SCP",
                  "FunctionName": "configure_count_2"
                },
                "ResultPath": "$.params",
                "Next": "ConfigureCount2"
              },
              "ConfigureCount2": {
                "Type": "Task",
                "Resource": "${StateMachineLambda.Arn}",
                "TimeoutSeconds": 300,
                "HeartbeatSeconds": 60,
                "Next": "Iterator2 params"
              },
              "Iterator2 params": {
                "Type": "Pass",
                "Result": {
                  "ClassName": "SCP",
                  "FunctionName": "iterator2"
                },
                "ResultPath": "$.params",
                "Next": "Iterator2"
              },
              "Iterator2": {
                "Type": "Task",
                "Resource": "${StateMachineLambda.Arn}",
                "Next": "IsCountReached2"
              },
              "IsCountReached2": {
                "Type": "Choice",
                "Choices": [
                  {
                    "Variable": "$.Continue",
                    "BooleanEquals": true,
                    "Next": "List Policies For OU Params"
                  }
                ],
                "Default": "Cloudformation Response Params"
              },
              "List Policies For OU Params": {
                "Type": "Pass",
                "Result": {
                  "ClassName": "SCP",
                  "FunctionName": "list_policies_for_ou"
                },
                "ResultPath": "$.params",
                "Next": "List Policies For OU"
              },
              "List Policies For OU": {
                "Type": "Task",
                "Resource": "${StateMachineLambda.Arn}",
                "TimeoutSeconds": 300,
                "HeartbeatSeconds": 60,
                "Next": "Attach or Detach Policy to OU Choice"
              },
              "Attach or Detach Policy to OU Choice": {
                "Type": "Choice",
                "Choices": [
                  {
                    "Variable": "$.Operation",
                    "StringEquals": "Attach",
                    "Next": "Check if Policy is attached to OU?"
                  },
                  {
                    "Variable": "$.Operation",
                    "StringEquals": "Detach",
                    "Next": "Check if Policy is detached from OU?"
                  }
                ],
                "Default": "Invalid Operation2"
              },
              "Invalid Operation2": {
                "Type": "Fail",
                "Cause": "Invalid Operation Type, valid choices are [Attach, Detach]",
                "Error": "Returning NULL in the response."
              },
              "Check if Policy is attached to OU?": {
                "Type": "Choice",
                "Choices": [
                  {
                    "Variable": "$.PolicyAttached",
                    "StringEquals": "yes",
                    "Next": "Iterator2 params"
                  },
                  {
                    "Variable": "$.PolicyAttached",
                    "StringEquals": "no",
                    "Next": "Attach Policy to OU Params"
                  }
                ],
                "Default": "Invalid Operation2"
              },
              "Attach Policy to OU Params": {
                "Type": "Pass",
                "Result": {
                  "ClassName": "SCP",
                  "FunctionName": "attach_policy"
                },
                "ResultPath": "$.params",
                "Next": "Attach Policy to OU"
              },
              "Attach Policy to OU": {
                "Type": "Task",
                "Resource": "${StateMachineLambda.Arn}",
                "TimeoutSeconds": 300,
                "HeartbeatSeconds": 60,
                "Next": "Iterator2 params"
              },
              "Check if Policy is detached from OU?": {
                "Type": "Choice",
                "Choices": [
                  {
                    "Variable": "$.PolicyAttached",
                    "StringEquals": "yes",
                    "Next": "Detach Policy from OU Params"
                  },
                  {
                    "Variable": "$.PolicyAttached",
                    "StringEquals": "no",
                    "Next": "Iterator2 params"
                  }
                ],
                "Default": "Invalid Operation2"
              },
              "Detach Policy from OU Params": {
                "Type": "Pass",
                "Result": {
                  "ClassName": "SCP",
                  "FunctionName": "detach_policy"
                },
                "ResultPath": "$.params",
                "Next": "Detach Policy from OU"
              },
              "Detach Policy from OU": {
                "Type": "Task",
                "Resource": "${StateMachineLambda.Arn}",
                "TimeoutSeconds": 300,
                "HeartbeatSeconds": 60,
                "Next": "Iterator2 params"
              },
              "Detach Policy from All Accounts Params": {
                "Type": "Pass",
                "Result": {
                  "ClassName": "SCP",
                  "FunctionName": "detach_policy_from_all_accounts"
                },
                "ResultPath": "$.params",
                "Next": "Detach Policy from All Accounts"
              },
              "Detach Policy from All Accounts": {
                "Type": "Task",
                "Resource": "${StateMachineLambda.Arn}",
                "TimeoutSeconds": 300,
                "HeartbeatSeconds": 60,
                "Next": "Delete Policy Params"
              },
              "Delete Policy Params": {
                "Type": "Pass",
                "Result": {
                  "ClassName": "SCP",
                  "FunctionName": "delete_policy"
                },
                "ResultPath": "$.params",
                "Next": "Delete Policy"
              },
              "Delete Policy": {
                "Type": "Task",
                "Resource": "${StateMachineLambda.Arn}",
                "TimeoutSeconds": 300,
                "HeartbeatSeconds": 60,
                "Next": "Cloudformation Response Params"
              },
              "Attach/Detach Policy params": {
                "Type": "Pass",
                "Result": {
                  "ClassName": "SCP",
                  "FunctionName": "configure_count"
                },
                "ResultPath": "$.params",
                "Next": "ConfigureCount"
              },
              "ConfigureCount": {
                "Type": "Task",
                "Resource": "${StateMachineLambda.Arn}",
                "TimeoutSeconds": 300,
                "HeartbeatSeconds": 60,
                "Next": "Iterator params"
              },
              "Iterator params": {
                "Type": "Pass",
                "Result": {
                  "ClassName": "SCP",
                  "FunctionName": "iterator"
                },
                "ResultPath": "$.params",
                "Next": "Iterator"
              },
              "Iterator": {
                "Type": "Task",
                "Resource": "${StateMachineLambda.Arn}",
                "Next": "IsCountReached"
              },
              "IsCountReached": {
                "Type": "Choice",
                "Choices": [
                  {
                    "Variable": "$.Continue",
                    "BooleanEquals": true,
                    "Next": "List Policy Params"
                  }
                ],
                "Default": "Cloudformation Response Params"
              },
              "List Policy Params": {
                "Type": "Pass",
                "Result": {
                  "ClassName": "SCP",
                  "FunctionName": "list_policies"
                },
                "ResultPath": "$.params",
                "Next": "List Policy"
              },
              "List Policy": {
                "Type": "Task",
                "Resource": "${StateMachineLambda.Arn}",
                "TimeoutSeconds": 300,
                "HeartbeatSeconds": 60,
                "Next": "List Policies For Account Params"
              },
              "List Policies For Account Params": {
                "Type": "Pass",
                "Result": {
                  "ClassName": "SCP",
                  "FunctionName": "list_policies_for_account"
                },
                "ResultPath": "$.params",
                "Next": "List Policies For Account"
              },
              "List Policies For Account": {
                "Type": "Task",
                "Resource": "${StateMachineLambda.Arn}",
                "TimeoutSeconds": 300,
                "HeartbeatSeconds": 60,
                "Next": "Attach or Detach Policy Choice"
              },
              "Attach or Detach Policy Choice": {
                "Type": "Choice",
                "Choices": [
                  {
                    "And": [
                      {
                        "Or": [
                          {
                            "Variable": "$.RequestType",
                            "StringEquals": "Create"
                          },
                          {
                            "Variable": "$.RequestType",
                            "StringEquals": "Update"
                          }
                        ]
                      },
                      {
                        "Variable": "$.ResourceProperties.Operation",
                        "StringEquals": "Attach"
                      }
                    ],
                    "Next": "Check if Policy is attached?"
                  },
                  {
                    "And": [
                      {
                        "Variable": "$.RequestType",
                        "StringEquals": "Delete"
                      },
                      {
                        "Variable": "$.ResourceProperties.Operation",
                        "StringEquals": "Attach"
                      }
                    ],
                    "Next": "Check if Policy is detached?"
                  },
                  {
                    "Variable": "$.ResourceProperties.Operation",
                    "StringEquals": "Detach",
                    "Next": "Check if Policy is detached?"
                  }
                ],
                "Default": "Invalid Operation"
              },
              "Invalid Operation": {
                "Type": "Fail",
                "Cause": "Invalid Operation Type, valid choices are [Attach, Detach]",
                "Error": "Returning NULL in the response."
              },
              "Check if Policy is attached?": {
                "Type": "Choice",
                "Choices": [
                  {
                    "Variable": "$.PolicyAttached",
                    "StringEquals": "yes",
                    "Next": "Iterator params"
                  },
                  {
                    "Variable": "$.PolicyAttached",
                    "StringEquals": "no",
                    "Next": "Attach Policy Params"
                  }
                ],
                "Default": "Invalid Operation"
              },
              "Attach Policy Params": {
                "Type": "Pass",
                "Result": {
                  "ClassName": "SCP",
                  "FunctionName": "attach_policy"
                },
                "ResultPath": "$.params",
                "Next": "Attach Policy"
              },
              "Attach Policy": {
                "Type": "Task",
                "Resource": "${StateMachineLambda.Arn}",
                "TimeoutSeconds": 300,
                "HeartbeatSeconds": 60,
                "Next": "Iterator params"
              },
              "Check if Policy is detached?": {
                "Type": "Choice",
                "Choices": [
                  {
                    "Variable": "$.PolicyAttached",
                    "StringEquals": "yes",
                    "Next": "Detach Policy Params"
                  },
                  {
                    "Variable": "$.PolicyAttached",
                    "StringEquals": "no",
                    "Next": "Iterator params"
                  }
                ],
                "Default": "Invalid Operation"
              },
              "Detach Policy Params": {
                "Type": "Pass",
                "Result": {
                  "ClassName": "SCP",
                  "FunctionName": "detach_policy"
                },
                "ResultPath": "$.params",
                "Next": "Detach Policy"
              },
              "Detach Policy": {
                "Type": "Task",
                "Resource": "${StateMachineLambda.Arn}",
                "TimeoutSeconds": 300,
                "HeartbeatSeconds": 60,
                "Next": "Iterator params"
              },
              "Cloudformation Response Params": {
                "Type": "Pass",
                "Result": {
                  "ClassName": "GeneralFunctions",
                  "FunctionName": "send_success_to_cfn"
                },
                "ResultPath": "$.params",
                "Next": "Send Response"
              },
              "Send Response": {
                "Type": "Task",
                "Resource": "${StateMachineLambda.Arn}",
                "TimeoutSeconds": 300,
                "HeartbeatSeconds": 60,
                "Next": "Finish"
              },
              "Finish": {
                "Type": "Succeed"
              }
            }
          }

  StackSetStateMachine:
    Type: 'AWS::StepFunctions::StateMachine'
    Properties:
      StateMachineName: LandingZoneStackSetStateMachine
      RoleArn: !GetAtt 'StateMachineRole.Arn'
      DefinitionString:
        Fn::Sub: |-
          {
            "Comment": "A state machine that manages the CloudFormation stacks in multiple accounts using StackSet APIs.",
            "StartAt": "Metrics Pass",
            "States": {
              "Metrics Pass": {
                "Type": "Pass",
                "Result": {
                  "ClassName": "GeneralFunctions",
                  "FunctionName": "send_execution_data"
                },
                "ResultPath": "$.params",
                "Next": "Metrics"
              },
              "Metrics": {
                "Type": "Task",
                "Resource": "${StateMachineLambda.Arn}",
                "TimeoutSeconds": 300,
                "HeartbeatSeconds": 60,
                "Next": "Describe StackSet Pass"
              },
              "Describe StackSet Pass": {
                "Type": "Pass",
                "Result": {
                  "ClassName": "CloudFormation",
                  "FunctionName": "describe_stack_set"
                },
                "ResultPath": "$.params",
                "Next": "Check StackSet Existence"
              },
              "Check StackSet Existence": {
                "Type": "Task",
                "Resource": "${StateMachineLambda.Arn}",
                "TimeoutSeconds": 300,
                "HeartbeatSeconds": 60,
                "Next": "StackSets: Create or Delete?"
              },
              "StackSets: Create or Delete?": {
                "Type": "Choice",
                "Choices": [
                  {
                    "Variable": "$.RequestType",
                    "StringEquals": "Create",
                    "Next": "Skip StackSets?"
                  },
                  {
                    "Variable": "$.RequestType",
                    "StringEquals": "Update",
                    "Next": "Skip StackSets?"
                  },
                  {
                    "Variable": "$.RequestType",
                    "StringEquals": "Delete",
                    "Next": "Describe StackSet"
                  }
                ],
                "Default": "Undefined Request Type"
              },
              "Undefined Request Type": {
                "Type": "Pass",
                "Next": "Send Failed Pass"
              },
              "Skip StackSets?": {
                "Type": "Choice",
                "Choices": [
                  {
                    "Variable": "$.ResourceProperties.TemplateURL",
                    "StringEquals": "",
                    "Next": "Check Instance Pass"
                  }
                ],
                "Default": "Does StackSet Exist?"
              },
              "Does StackSet Exist?": {
                "Type": "Choice",
                "Choices": [
                  {
                    "Variable": "$.StackSetExist",
                    "StringEquals": "no",
                    "Next": "Deploy StackSet Pass"
                  },
                  {
                    "Variable": "$.StackSetExist",
                    "StringEquals": "yes",
                    "Next": "Update StackSet Pass"
                  }
                ],
                "Default": "Unable to describe StackSet"
              },
              "Unable to describe StackSet": {
                "Type": "Pass",
                "Next": "Send Failed Pass"
              },
              "Deploy StackSet Pass": {
                "Type": "Pass",
                "Result": {
                  "ClassName": "CloudFormation",
                  "FunctionName": "create_stack_set"
                },
                "ResultPath": "$.params",
                "Next": "Deploy StackSet"
              },
              "Deploy StackSet": {
                "Type": "Task",
                "Resource": "${StateMachineLambda.Arn}",
                "TimeoutSeconds": 300,
                "HeartbeatSeconds": 60,
                "InputPath": "$",
                "Next": "StackSet Deployed?"
              },
              "StackSet Deployed?": {
                "Type": "Choice",
                "Choices": [
                  {
                    "Variable": "$.StackSetStatus",
                    "StringEquals": "success",
                    "Next": "Deploy Stack Instance?"
                  },
                  {
                    "Variable": "$.StackSetStatus",
                    "StringEquals": "failure",
                    "Next": "StackSet Deployment Failed"
                  }
                ],
                "Default": "StackSet Deployment Failed"
              },
              "StackSet Deployment Failed": {
                "Type": "Pass",
                "Next": "Send Failed Pass"
              },
              "Deploy Stack Instance?": {
                "Type": "Choice",
                "Choices": [
                  {
                    "And": [
                      {
                        "Variable": "$.ResourceProperties.AccountList",
                        "StringLessThan": "1"
                      },
                      {
                        "Variable": "$.ResourceProperties.RegionList",
                        "StringLessThan": "1"
                      }
                    ],
                    "Next": "StackSet Deployed"
                  }
                ],
                "Default": "Create or Delete Stack Instance?"
              },
              "Create or Delete Stack Instance?": {
                "Type": "Choice",
                "Choices": [
                  {
                    "And": [
                      {
                        "Variable": "$.CreateInstance",
                        "StringEquals": "no"
                      },
                      {
                        "Variable": "$.DeleteInstance",
                        "StringEquals": "yes"
                      }
                    ],
                    "Next": "Reroute to Delete Pass"
                  },
                  {
                    "Variable": "$.CreateInstance",
                    "StringEquals": "yes",
                    "Next": "Deploy Stack Instance Pass"
                  },
                  {
                    "And": [
                      {
                        "Variable": "$.CreateInstance",
                        "StringEquals": "no"
                      },
                      {
                        "Variable": "$.DeleteInstance",
                        "StringEquals": "no"
                      }
                    ],
                    "Next": "Export Stack Output Pass"
                  }
                ],
                "Default": "Deploy Stack Instance Pass"
              },
              "StackSet Deployed": {
                "Type": "Pass",
                "Next": "Export Stack Output Pass"
              },
              "Deploy Stack Instance Pass": {
                "Type": "Pass",
                "Result": {
                  "ClassName": "CloudFormation",
                  "FunctionName": "create_stack_instances"
                },
                "ResultPath": "$.params",
                "Next": "Deploy Stack Instance"
              },
              "Deploy Stack Instance": {
                "Type": "Task",
                "Resource": "${StateMachineLambda.Arn}",
                "TimeoutSeconds": 300,
                "HeartbeatSeconds": 60,
                "InputPath": "$",
                "Next": "Create Operation ID?"
              },
              "Create Operation ID?": {
                "Type": "Choice",
                "Choices": [
                  {
                    "Variable": "$.OperationId",
                    "StringEquals": "OperationInProgressException",
                    "Next": "Waiting on create... OperationInProgress"
                  }
                ],
                "Default": "Create Task Running"
              },
              "Waiting on create... OperationInProgress": {
                "Type": "Wait",
                "Seconds": 30,
                "Next": "Deploy Stack Instance"
              },
              "Create Task Running": {
                "Type": "Wait",
                "Seconds": 10,
                "Next": "Create Task Pass"
              },
              "Create Task Pass": {
                "Type": "Pass",
                "Result": {
                  "ClassName": "CloudFormation",
                  "FunctionName": "describe_stack_set_operation"
                },
                "ResultPath": "$.params",
                "Next": "Create Task Status?"
              },
              "Create Task Status?": {
                "Type": "Task",
                "Resource": "${StateMachineLambda.Arn}",
                "TimeoutSeconds": 300,
                "HeartbeatSeconds": 60,
                "InputPath": "$",
                "Next": "Create Task Completed?"
              },
              "Create Task Completed?": {
                "Type": "Choice",
                "Choices": [
                  {
                    "Variable": "$.OperationStatus",
                    "StringEquals": "SUCCEEDED",
                    "Next": "Create Task Completed"
                  },
                  {
                    "Variable": "$.OperationStatus",
                    "StringEquals": "RUNNING",
                    "Next": "Create Task Running"
                  },
                  {
                    "Variable": "$.OperationStatus",
                    "StringEquals": "FAILED",
                    "Next": "Create Task Failed"
                  }
                ],
                "Default": "Create Task Failed"
              },
              "Create Task Completed": {
                "Type": "Pass",
                "Next": "Export Stack Output Pass"
              },
              "Create Task Failed": {
                "Type": "Pass",
                "Next": "Send Failed Pass"
              },
              "Update StackSet Pass": {
                "Type": "Pass",
                "Result": {
                  "ClassName": "CloudFormation",
                  "FunctionName": "update_stack_set"
                },
                "ResultPath": "$.params",
                "Next": "Update StackSet"
              },
              "Update StackSet": {
                "Type": "Task",
                "Resource": "${StateMachineLambda.Arn}",
                "TimeoutSeconds": 300,
                "HeartbeatSeconds": 60,
                "InputPath": "$",
                "Next": "Update Operation ID?"
              },
              "Update Operation ID?": {
                "Type": "Choice",
                "Choices": [
                  {
                    "Variable": "$.OperationId",
                    "StringEquals": "OperationInProgressException",
                    "Next": "Waiting on update... OperationInProgress"
                  }
                ],
                "Default": "Update Task Running"
              },
              "Waiting on update... OperationInProgress": {
                "Type": "Wait",
                "Seconds": 30,
                "Next": "Update StackSet"
              },
              "Update Task Running": {
                "Type": "Wait",
                "Seconds": 10,
                "Next": "Update Task Pass"
              },
              "Update Task Pass": {
                "Type": "Pass",
                "Result": {
                  "ClassName": "CloudFormation",
                  "FunctionName": "describe_stack_set_operation"
                },
                "ResultPath": "$.params",
                "Next": "Update Task Status?"
              },
              "Update Task Status?": {
                "Type": "Task",
                "Resource": "${StateMachineLambda.Arn}",
                "TimeoutSeconds": 300,
                "HeartbeatSeconds": 60,
                "InputPath": "$",
                "Next": "Update Task Completed?"
              },
              "Update Task Completed?": {
                "Type": "Choice",
                "Choices": [
                  {
                    "Variable": "$.OperationStatus",
                    "StringEquals": "SUCCEEDED",
                    "Next": "Check Instance Pass"
                  },
                  {
                    "Variable": "$.OperationStatus",
                    "StringEquals": "RUNNING",
                    "Next": "Update Task Running"
                  },
                  {
                    "Variable": "$.OperationStatus",
                    "StringEquals": "STOPPED",
                    "Next": "Update Task Completed"
                  },
                  {
                    "Variable": "$.OperationStatus",
                    "StringEquals": "STOPPING",
                    "Next": "Update Task Running"
                  },
                  {
                    "Variable": "$.OperationStatus",
                    "StringEquals": "FAILED",
                    "Next": "Update Task Failed"
                  }
                ],
                "Default": "Update Task Failed"
              },
              "Update Task Completed": {
                "Type": "Pass",
                "Next": "Export Stack Output Pass"
              },
              "Update Task Failed": {
                "Type": "Pass",
                "Next": "Send Failed Pass"
              },
              "Check Instance Pass": {
                "Type": "Pass",
                "Result": {
                  "ClassName": "CloudFormation",
                  "FunctionName": "list_stack_instances"
                },
                "ResultPath": "$.params",
                "Next": "Check Instance"
              },
              "Check Instance": {
                "Type": "Task",
                "Resource": "${StateMachineLambda.Arn}",
                "Next": "Check Complete?"
              },
              "Check Complete?": {
                "Type": "Choice",
                "Choices": [
                  {
                    "Variable": "$.NextToken",
                    "StringEquals": "Complete",
                    "Next": "Create or Update Instance?"
                  }
                ],
                "Default": "Check Instance Wait"
              },
              "Check Instance Wait": {
                "Type": "Wait",
                "Seconds": 5,
                "Next": "Check Instance"
              },
              "Create or Update Instance?": {
                "Type": "Choice",
                "Choices": [
                  {
                    "Or": [
                      {
                        "Variable": "$.CreateInstance",
                        "StringEquals": "yes"
                      },
                      {
                        "Variable": "$.DeleteInstance",
                        "StringEquals": "yes"
                      }
                    ],
                    "Next": "Deploy Stack Instance?"
                  },
                  {
                    "And": [
                      {
                        "Variable": "$.CreateInstance",
                        "StringEquals": "no"
                      },
                      {
                        "Variable": "$.RequestType",
                        "StringEquals": "Create"
                      }
                    ],
                    "Next": "Export Stack Output Pass"
                  },
                  {
                    "And": [
                      {
                        "Variable": "$.CreateInstance",
                        "StringEquals": "no"
                      },
                      {
                        "Variable": "$.RequestType",
                        "StringEquals": "Update"
                      }
                    ],
                    "Next": "Update Stack Instance?"
                  }
                ],
                "Default": "Export Stack Output Pass"
              },
              "Update Stack Instance?": {
                "Type": "Choice",
                "Choices": [
                  {
                    "And": [
                      {
                        "Variable": "$.ResourceProperties.AccountList",
                        "StringLessThan": "1"
                      },
                      {
                        "Variable": "$.ResourceProperties.RegionList",
                        "StringLessThan": "1"
                      }
                    ],
                    "Next": "StackSet Updated"
                  },
                  {
                    "Variable": "$.OverrideParametersExist",
                    "StringEquals": "no",
                    "Next": "Override parameters do not exist in the event"
                  }
                ],
                "Default": "Update Stack Instance Pass"
              },
              "StackSet Updated": {
                "Type": "Pass",
                "Next": "Export Stack Output Pass"
              },
              "Override parameters do not exist in the event": {
                "Type": "Pass",
                "Next": "Export Stack Output Pass"
              },
              "Update Stack Instance Pass": {
                "Type": "Pass",
                "Result": {
                  "ClassName": "CloudFormation",
                  "FunctionName": "update_stack_instances"
                },
                "ResultPath": "$.params",
                "Next": "Update Stack Instance"
              },
              "Update Stack Instance": {
                "Type": "Task",
                "Resource": "${StateMachineLambda.Arn}",
                "TimeoutSeconds": 300,
                "HeartbeatSeconds": 60,
                "InputPath": "$",
                "Next": "Update Instance Operation ID?"
              },
              "Update Instance Operation ID?": {
                "Type": "Choice",
                "Choices": [
                  {
                    "Variable": "$.OperationId",
                    "StringEquals": "OperationInProgressException",
                    "Next": "Waiting on Update... OperationInProgress"
                  }
                ],
                "Default": "Update Instance Task Running"
              },
              "Waiting on Update... OperationInProgress": {
                "Type": "Wait",
                "Seconds": 30,
                "Next": "Update Stack Instance"
              },
              "Update Instance Task Running": {
                "Type": "Wait",
                "Seconds": 10,
                "Next": "Update Instance Task Pass"
              },
              "Update Instance Task Pass": {
                "Type": "Pass",
                "Result": {
                  "ClassName": "CloudFormation",
                  "FunctionName": "describe_stack_set_operation"
                },
                "ResultPath": "$.params",
                "Next": "Update Instance Task Status?"
              },
              "Update Instance Task Status?": {
                "Type": "Task",
                "Resource": "${StateMachineLambda.Arn}",
                "TimeoutSeconds": 300,
                "HeartbeatSeconds": 60,
                "InputPath": "$",
                "Next": "Update Instance Task Completed?"
              },
              "Update Instance Task Completed?": {
                "Type": "Choice",
                "Choices": [
                  {
                    "Variable": "$.OperationStatus",
                    "StringEquals": "SUCCEEDED",
                    "Next": "Update Instance Task Completed"
                  },
                  {
                    "Variable": "$.OperationStatus",
                    "StringEquals": "RUNNING",
                    "Next": "Update Instance Task Running"
                  },
                  {
                    "Variable": "$.OperationStatus",
                    "StringEquals": "FAILED",
                    "Next": "Update Instance Task Failed"
                  }
                ],
                "Default": "Update Task Failed"
              },
              "Update Instance Task Completed": {
                "Type": "Pass",
                "Next": "Export Stack Output Pass"
              },
              "Update Instance Task Failed": {
                "Type": "Pass",
                "Next": "Send Failed Pass"
              },
              "Describe StackSet": {
                "Type": "Pass",
                "Result": {
                  "ClassName": "CloudFormation",
                  "FunctionName": "describe_stack_set"
                },
                "ResultPath": "$.params",
                "Next": "Describe StackSet Function"
              },
              "Describe StackSet Function": {
                "Type": "Task",
                "Resource": "${StateMachineLambda.Arn}",
                "TimeoutSeconds": 300,
                "HeartbeatSeconds": 60,
                "Next": "Check StackSet Existence?"
              },
              "Check StackSet Existence?": {
                "Type": "Choice",
                "Choices": [
                  {
                    "Variable": "$.StackSetExist",
                    "StringEquals": "no",
                    "Next": "StackSet Not Found"
                  },
                  {
                    "Variable": "$.StackSetExist",
                    "StringEquals": "yes",
                    "Next": "List Stack Instances Pass"
                  }
                ],
                "Default": "Unable to find StackSet"
              },
              "Unable to find StackSet": {
                "Type": "Pass",
                "Next": "Send Failed Pass"
              },
              "StackSet Not Found": {
                "Type": "Pass",
                "Next": "Send Success Pass"
              },
              "List Stack Instances Pass": {
                "Type": "Pass",
                "Result": {
                  "ClassName": "CloudFormation",
                  "FunctionName": "list_stack_instances"
                },
                "ResultPath": "$.params",
                "Next": "List Stack Instances"
              },
              "List Stack Instances": {
                "Type": "Task",
                "Resource": "${StateMachineLambda.Arn}",
                "TimeoutSeconds": 300,
                "HeartbeatSeconds": 60,
                "InputPath": "$",
                "Next": "Does Stack Instance Exist?"
              },
              "Does Stack Instance Exist?": {
                "Type": "Choice",
                "Choices": [
                  {
                    "Variable": "$.InstanceExist",
                    "StringEquals": "yes",
                    "Next": "Delete Stack Instances Pass"
                  },
                  {
                    "Variable": "$.InstanceExist",
                    "StringEquals": "no",
                    "Next": "Event from CloudFormation?"
                  }
                ],
                "Default": "Unable to list stack instances"
              },
              "Event from CloudFormation?": {
                "Type": "Choice",
                "Choices": [
                  {
                    "Variable": "$.ResourceProperties.TemplateURL",
                    "StringEquals": "",
                    "Next": "Send Success Pass"
                  }
                ],
                "Default": "Delete StackSet Pass"
              },
              "Unable to list stack instances": {
                "Type": "Pass",
                "Next": "Send Failed Pass"
              },
              "Delete Stack Instances Pass": {
                "Type": "Pass",
                "Result": {
                  "ClassName": "CloudFormation",
                  "FunctionName": "delete_stack_instances"
                },
                "ResultPath": "$.params",
                "Next": "Delete Stack Instance Function"
              },
              "Delete Stack Instance Function": {
                "Type": "Task",
                "Resource": "${StateMachineLambda.Arn}",
                "TimeoutSeconds": 300,
                "HeartbeatSeconds": 60,
                "InputPath": "$",
                "Next": "Delete Operation ID?"
              },
              "Delete Operation ID?": {
                "Type": "Choice",
                "Choices": [
                  {
                    "Variable": "$.OperationId",
                    "StringEquals": "OperationInProgressException",
                    "Next": "Waiting on delete... OperationInProgress"
                  }
                ],
                "Default": "Delete Task Running"
              },
              "Waiting on delete... OperationInProgress": {
                "Type": "Wait",
                "Seconds": 30,
                "Next": "Delete Stack Instance Function"
              },
              "Delete Task Running": {
                "Type": "Wait",
                "Seconds": 10,
                "Next": "Delete Task Pass"
              },
              "Delete Task Pass": {
                "Type": "Pass",
                "Result": {
                  "ClassName": "CloudFormation",
                  "FunctionName": "describe_stack_set_operation"
                },
                "ResultPath": "$.params",
                "Next": "Delete Task Status?"
              },
              "Delete Task Status?": {
                "Type": "Task",
                "Resource": "${StateMachineLambda.Arn}",
                "TimeoutSeconds": 300,
                "HeartbeatSeconds": 60,
                "InputPath": "$",
                "Next": "Delete Task Completed?"
              },
              "Delete Task Completed?": {
                "Type": "Choice",
                "Choices": [
                  {
                    "Variable": "$.OperationStatus",
                    "StringEquals": "SUCCEEDED",
                    "Next": "List Stack Remaining Instances Pass"
                  },
                  {
                    "Variable": "$.OperationStatus",
                    "StringEquals": "RUNNING",
                    "Next": "Delete Task Running"
                  },
                  {
                    "And": [
                      {
                        "Variable": "$.RetryDeleteFlag",
                        "BooleanEquals": false
                      },
                      {
                        "Variable": "$.OperationStatus",
                        "StringEquals": "FAILED"
                      }
                    ],
                    "Next": "Delete Task Failed"
                  },
                  {
                    "And": [
                      {
                        "Variable": "$.RetryDeleteFlag",
                        "BooleanEquals": true
                      },
                      {
                        "Variable": "$.OperationStatus",
                        "StringEquals": "FAILED"
                      }
                    ],
                    "Next": "Delete Stack Instances Pass"
                  }
                ],
                "Default": "Delete Task Failed"
              },
              "List Stack Remaining Instances Pass": {
                "Type": "Pass",
                "Result": {
                  "ClassName": "CloudFormation",
                  "FunctionName": "list_stack_instances"
                },
                "ResultPath": "$.params",
                "Next": "List Stack Instances Again"
              },
              "List Stack Instances Again": {
                "Type": "Task",
                "Resource": "${StateMachineLambda.Arn}",
                "TimeoutSeconds": 300,
                "HeartbeatSeconds": 60,
                "InputPath": "$",
                "Next": "Check Remaining Stack Instance?"
              },
              "Check Remaining Stack Instance?": {
                "Type": "Choice",
                "Choices": [
                  {
                    "Or": [
                      {
                        "Variable": "$.InstanceExist",
                        "StringEquals": "yes"
                      },
                      {
                        "Variable": "$.ResourceProperties.TemplateURL",
                        "StringEquals": ""
                      }
                    ],
                    "Next": "Stack Instance Deleted"
                  },
                  {
                    "Variable": "$.InstanceExist",
                    "StringEquals": "no",
                    "Next": "Delete StackSet Pass"
                  }
                ],
                "Default": "Send Failed Pass"
              },
              "Stack Instance Deleted": {
                "Type": "Pass",
                "Next": "Send Success Pass"
              },
              "Delete Task Failed": {
                "Type": "Pass",
                "Next": "Send Failed Pass"
              },
              "Delete StackSet Pass": {
                "Type": "Pass",
                "Result": {
                  "ClassName": "CloudFormation",
                  "FunctionName": "delete_stack_set"
                },
                "ResultPath": "$.params",
                "Next": "Delete StackSet Function"
              },
              "Delete StackSet Function": {
                "Type": "Task",
                "Resource": "${StateMachineLambda.Arn}",
                "TimeoutSeconds": 300,
                "HeartbeatSeconds": 60,
                "InputPath": "$",
                "Next": "Deleted StackSet"
              },
              "Deleted StackSet": {
                "Type": "Pass",
                "Next": "Send Success Pass"
              },
              "Export Stack Output Pass": {
                "Type": "Pass",
                "Result": {
                  "ClassName": "GeneralFunctions",
                  "FunctionName": "export_cfn_output"
                },
                "ResultPath": "$.params",
                "Next": "Export Stack Output"
              },
              "Export Stack Output": {
                "Type": "Task",
                "Resource": "${StateMachineLambda.Arn}",
                "TimeoutSeconds": 300,
                "HeartbeatSeconds": 60,
                "Next": "SSM Parameter Store Pass"
              },
              "SSM Parameter Store Pass": {
                "Type": "Pass",
                "Result": {
                  "ClassName": "GeneralFunctions",
                  "FunctionName": "ssm_put_parameters"
                },
                "ResultPath": "$.params",
                "Next": "Put Parameters"
              },
              "Put Parameters": {
                "Type": "Task",
                "Resource": "${StateMachineLambda.Arn}",
                "TimeoutSeconds": 300,
                "HeartbeatSeconds": 60,
                "Next": "Delete Stack Instance or Finish?"
              },
              "Delete Stack Instance or Finish?": {
                "Type": "Choice",
                "Choices": [
                  {
                    "And": [
                      {
                        "Variable": "$.CreateInstance",
                        "StringEquals": "yes"
                      },
                      {
                        "Variable": "$.DeleteInstance",
                        "StringEquals": "yes"
                      }
                    ],
                    "Next": "Reroute to Delete Pass"
                  }
                ],
                "Default": "Send Success Pass"
              },
              "Reroute to Delete Pass": {
                "Type": "Pass",
                "Result": {
                  "ClassName": "CloudFormation",
                  "FunctionName": "reroute_to_delete_stack_instances"
                },
                "ResultPath": "$.params",
                "Next": "Reroute to Delete"
              },
              "Reroute to Delete": {
                "Type": "Task",
                "Resource": "${StateMachineLambda.Arn}",
                "TimeoutSeconds": 300,
                "HeartbeatSeconds": 60,
                "Next": "Delete Stack Instances Pass"
              },
              "Send Success Pass": {
                "Type": "Pass",
                "Result": {
                  "ClassName": "GeneralFunctions",
                  "FunctionName": "send_success_to_cfn"
                },
                "ResultPath": "$.params",
                "Next": "Send Success Response"
              },
              "Send Success Response": {
                "Type": "Task",
                "Resource": "${StateMachineLambda.Arn}",
                "TimeoutSeconds": 300,
                "HeartbeatSeconds": 60,
                "Next": "Success"
              },
              "Success": {
                "Type": "Succeed"
              },
              "Send Failed Pass": {
                "Type": "Pass",
                "Result": {
                  "ClassName": "GeneralFunctions",
                  "FunctionName": "send_failure_to_cfn"
                },
                "ResultPath": "$.params",
                "Next": "Send Failed Response"
              },
              "Send Failed Response": {
                "Type": "Task",
                "Resource": "${StateMachineLambda.Arn}",
                "TimeoutSeconds": 300,
                "HeartbeatSeconds": 60,
                "Next": "Failed"
              },
              "Failed": {
                "Type": "Fail"
              }
            }
          }


  ServiceCatalogStateMachine:
    Type: 'AWS::StepFunctions::StateMachine'
    Properties:
      StateMachineName: LandingZoneServiceCatalogStateMachine
      RoleArn: !GetAtt 'StateMachineRole.Arn'
      DefinitionString:
        Fn::Sub: |-
          {
            "Comment": "A state machine that manages the Service Catalog Portfolio and Products.",
            "StartAt": "Metrics Pass",
            "States": {
              "Metrics Pass": {
                "Type": "Pass",
                "Result": {
                  "ClassName": "GeneralFunctions",
                  "FunctionName": "send_execution_data"
                },
                "ResultPath": "$.params",
                "Next": "Metrics"
              },
              "Metrics": {
                "Type": "Task",
                "Resource": "${StateMachineLambda.Arn}",
                "TimeoutSeconds": 300,
                "HeartbeatSeconds": 60,
                "Next": "Service Catalog: Create or Delete?"
              },
              "Service Catalog: Create or Delete?": {
                "Type": "Choice",
                "Choices": [
                  {
                    "Variable": "$.RequestType",
                    "StringEquals": "Create",
                    "Next": "List Portfolio Pass"
                  },
                  {
                    "Variable": "$.RequestType",
                    "StringEquals": "Update",
                    "Next": "List Portfolio Pass"
                  },
                  {
                    "Variable": "$.RequestType",
                    "StringEquals": "Delete",
                    "Next": "Check Portfolio Pass"
                  }
                ],
                "Default": "Undefined Request Type"
              },
              "Undefined Request Type": {
                "Type": "Fail",
                "Cause": "Undefined Request Type",
                "Error": "Undefined Request Type"
              },
              "List Portfolio Pass": {
                "Type": "Pass",
                "Result": {
                  "ClassName": "ServiceCatalog",
                  "FunctionName": "list_portfolios"
                },
                "ResultPath": "$.params",
                "Next": "Check Portfolio Existence"
              },
              "Check Portfolio Existence": {
                "Type": "Task",
                "Resource": "${StateMachineLambda.Arn}",
                "TimeoutSeconds": 300,
                "HeartbeatSeconds": 60,
                "Next": "Does Portfolio Exist?"
              },
              "Does Portfolio Exist?": {
                "Type": "Choice",
                "Choices": [
                  {
                    "Variable": "$.PortfolioExist",
                    "BooleanEquals": false,
                    "Next": "Create Portfolio Pass"
                  },
                  {
                    "Variable": "$.PortfolioExist",
                    "BooleanEquals": true,
                    "Next": "Update Portfolio Pass"
                  }
                ],
                "Default": "Unable to find portfolio"
              },
              "Unable to find portfolio": {
                "Type": "Fail",
                "Cause": "Portfolio Name not found in the response",
                "Error": "Returning NULL in the response."
              },
              "Create Portfolio Pass": {
                "Type": "Pass",
                "Result": {
                  "ClassName": "ServiceCatalog",
                  "FunctionName": "create_portfolio"
                },
                "ResultPath": "$.params",
                "Next": "Create Portfolio"
              },
              "Create Portfolio": {
                "Type": "Task",
                "Resource": "${StateMachineLambda.Arn}",
                "TimeoutSeconds": 300,
                "HeartbeatSeconds": 60,
                "Next": "Associate Principal with Portfolio Pass"
              },
              "Update Portfolio Pass": {
                "Type": "Pass",
                "Result": {
                  "ClassName": "ServiceCatalog",
                  "FunctionName": "update_portfolio"
                },
                "ResultPath": "$.params",
                "Next": "Update Portfolio"
              },
              "Update Portfolio": {
                "Type": "Task",
                "Resource": "${StateMachineLambda.Arn}",
                "TimeoutSeconds": 300,
                "HeartbeatSeconds": 60,
                "Next": "Associate Principal with Portfolio Pass"
              },
              "Associate Principal with Portfolio Pass": {
                "Type": "Pass",
                "Result": {
                  "ClassName": "ServiceCatalog",
                  "FunctionName": "associate_principal_with_portfolio"
                },
                "ResultPath": "$.params",
                "Next": "Associate Principal with Portfolio"
              },
              "Associate Principal with Portfolio": {
                "Type": "Task",
                "Resource": "${StateMachineLambda.Arn}",
                "TimeoutSeconds": 300,
                "HeartbeatSeconds": 60,
                "Next": "Search Products Pass"
              },
              "Search Products Pass": {
                "Type": "Pass",
                "Result": {
                  "ClassName": "ServiceCatalog",
                  "FunctionName": "search_products_as_admin"
                },
                "ResultPath": "$.params",
                "Next": "Search Products"
              },
              "Search Products": {
                "Type": "Task",
                "Resource": "${StateMachineLambda.Arn}",
                "TimeoutSeconds": 300,
                "HeartbeatSeconds": 60,
                "Next": "Does Product Exist?"
              },
              "Does Product Exist?": {
                "Type": "Choice",
                "Choices": [
                  {
                    "Variable": "$.ProductExist",
                    "BooleanEquals": false,
                    "Next": "Create Product Pass"
                  },
                  {
                    "Variable": "$.ProductExist",
                    "BooleanEquals": true,
                    "Next": "Update Product Pass"
                  }
                ],
                "Default": "Unable to find product"
              },
              "Unable to find product": {
                "Type": "Fail",
                "Cause": "Product Name not found in the response"
              },
              "Create Product Pass": {
                "Type": "Pass",
                "Result": {
                  "ClassName": "ServiceCatalog",
                  "FunctionName": "create_product"
                },
                "ResultPath": "$.params",
                "Next": "Create Product"
              },
              "Create Product": {
                "Type": "Task",
                "Resource": "${StateMachineLambda.Arn}",
                "TimeoutSeconds": 300,
                "HeartbeatSeconds": 60,
                "Next": "List Portfolios for the Product Pass"
              },
              "Update Product Pass": {
                "Type": "Pass",
                "Result": {
                  "ClassName": "ServiceCatalog",
                  "FunctionName": "update_product"
                },
                "ResultPath": "$.params",
                "Next": "Update Product"
              },
              "Update Product": {
                "Type": "Task",
                "Resource": "${StateMachineLambda.Arn}",
                "TimeoutSeconds": 300,
                "HeartbeatSeconds": 60,
                "Next": "List Artifacts Pass"
              },
              "List Artifacts Pass": {
                "Type": "Pass",
                "Result": {
                  "ClassName": "ServiceCatalog",
                  "FunctionName": "list_provisioning_artifacts"
                },
                "ResultPath": "$.params",
                "Next": "List Artifacts"
              },
              "List Artifacts": {
                "Type": "Task",
                "Resource": "${StateMachineLambda.Arn}",
                "TimeoutSeconds": 300,
                "HeartbeatSeconds": 60,
                "Next": "Compare Templates Pass"
              },

                  "Compare Templates Pass": {
                "Type": "Pass",
                "Result": {
                  "ClassName": "ServiceCatalog",
                  "FunctionName": "compare_product_templates"
                },
                "ResultPath": "$.params",
                "Next": "Compare Product Templates"
              },
              "Compare Product Templates": {
                "Type": "Task",
                "Resource": "${StateMachineLambda.Arn}",
                "TimeoutSeconds": 300,
                "HeartbeatSeconds": 60,
                "Next": "Create New Artifact?"
              },


              "Create New Artifact?": {
                "Type": "Choice",
                "Choices": [
                  {
                    "Variable": "$.CreateNewArtifact",
                    "StringEquals": "no",
                    "Next": "List Portfolios for the Product Pass"
                  },
                  {
                    "Variable": "$.CreateNewArtifact",
                    "StringEquals": "yes",
                    "Next": "Reaching Version Limit?"
                  }
                ],
                "Default": "Reaching Version Limit?"
              },





              "Reaching Version Limit?": {
                "Type": "Choice",
                "Choices": [
                  {
                    "Variable": "$.DeleteOldestArtifact",
                    "StringEquals": "no",
                    "Next": "Create Artifact Pass"
                  },
                  {
                    "Variable": "$.DeleteOldestArtifact",
                    "StringEquals": "yes",
                    "Next": "Delete Artifact Pass"
                  }
                ],
                "Default": "Delete Artifact Pass"
              },
              "Delete Artifact Pass": {
                "Type": "Pass",
                "Result": {
                  "ClassName": "ServiceCatalog",
                  "FunctionName": "delete_provisioning_artifact"
                },
                "ResultPath": "$.params",
                "Next": "Delete Artifact"
              },
              "Delete Artifact": {
                "Type": "Task",
                "Resource": "${StateMachineLambda.Arn}",
                "TimeoutSeconds": 300,
                "HeartbeatSeconds": 60,
                "Next": "Create Artifact Pass"
              },
              "Create Artifact Pass": {
                "Type": "Pass",
                "Result": {
                  "ClassName": "ServiceCatalog",
                  "FunctionName": "create_provisioning_artifact"
                },
                "ResultPath": "$.params",
                "Next": "Create Artifact"
              },
              "Create Artifact": {
                "Type": "Task",
                "Resource": "${StateMachineLambda.Arn}",
                "TimeoutSeconds": 300,
                "HeartbeatSeconds": 60,
                "Next": "New Artifact Status Pass"
              },
              "New Artifact Status Pass": {
                "Type": "Pass",
                "Result": {
                  "ClassName": "ServiceCatalog",
                  "FunctionName": "describe_provisioning_artifact"
                },
                "ResultPath": "$.params",
                "Next": "New Artifact Status"
              },
              "New Artifact Status": {
                "Type": "Task",
                "Resource": "${StateMachineLambda.Arn}",
                "TimeoutSeconds": 300,
                "HeartbeatSeconds": 60,
                "Next": "Is New Artifact Available?"
              },
              "Is New Artifact Available?": {
                "Type": "Choice",
                "Choices": [
                  {
                    "Variable": "$.ProvisioningArtifactStatus",
                    "StringEquals": "AVAILABLE",
                    "Next": "Hide Previous Artifact?"
                  },
                  {
                    "Variable": "$.ProvisioningArtifactStatus",
                    "StringEquals": "FAILED",
                    "Next": "New Artifact Creation Failed"
                  },
                  {
                    "Variable": "$.ProvisioningArtifactStatus",
                    "StringEquals": "CREATING",
                    "Next": "New Artifact: Wait for 5 seconds"
                  }
                ],
                "Default": "New Artifact: Wait for 5 seconds"
              },
              "New Artifact: Wait for 5 seconds": {
                "Type": "Wait",
                "Seconds": 5,
                "Next": "New Artifact Status Pass"
              },
              "New Artifact Creation Failed": {
                "Type": "Fail",
                "Cause": "Unable to create the new version."
              },
              "Hide Previous Artifact?": {
                "Type": "Choice",
                "Choices": [
                  {
                    "Variable": "$.ResourceProperties.SCProduct.HideOldVersions",
                    "StringEquals": "Yes",
                    "Next": "Update Artifact Pass"
                  }
                ],
                "Default": "List Portfolios for the Product Pass"
              },
              "Update Artifact Pass": {
                "Type": "Pass",
                "Result": {
                  "ClassName": "ServiceCatalog",
                  "FunctionName": "update_provisioning_artifact"
                },
                "ResultPath": "$.params",
                "Next": "Update Artifact"
              },
              "Update Artifact": {
                "Type": "Task",
                "Resource": "${StateMachineLambda.Arn}",
                "TimeoutSeconds": 300,
                "HeartbeatSeconds": 60,
                "Next": "Update Artifact Status Pass"
              },
              "Update Artifact Status Pass": {
                "Type": "Pass",
                "Result": {
                  "ClassName": "ServiceCatalog",
                  "FunctionName": "describe_provisioning_artifact"
                },
                "ResultPath": "$.params",
                "Next": "Update Artifact Status"
              },
              "Update Artifact Status": {
                "Type": "Task",
                "Resource": "${StateMachineLambda.Arn}",
                "TimeoutSeconds": 300,
                "HeartbeatSeconds": 60,
                "Next": "Is Updated Artifact Available?"
              },
              "Is Updated Artifact Available?": {
                "Type": "Choice",
                "Choices": [
                  {
                    "Variable": "$.ProvisioningArtifactStatus",
                    "StringEquals": "AVAILABLE",
                    "Next": "List Portfolios for the Product Pass"
                  },
                  {
                    "Variable": "$.ProvisioningArtifactStatus",
                    "StringEquals": "FAILED",
                    "Next": "Artifact Update Failed"
                  },
                  {
                    "Variable": "$.ProvisioningArtifactStatus",
                    "StringEquals": "CREATING",
                    "Next": "Update Artifact: Wait for 5 seconds"
                  }
                ],
                "Default": "Update Artifact: Wait for 5 seconds"
              },
              "Update Artifact: Wait for 5 seconds": {
                "Type": "Wait",
                "Seconds": 5,
                "Next": "Update Artifact Status Pass"
              },
              "Artifact Update Failed": {
                "Type": "Fail",
                "Cause": "Unable to create the new version."
              },
              "List Portfolios for the Product Pass": {
                "Type": "Pass",
                "Result": {
                  "ClassName": "ServiceCatalog",
                  "FunctionName": "list_portfolios_for_product"
                },
                "ResultPath": "$.params",
                "Next": "List Portfolios for the Product"
              },
              "List Portfolios for the Product": {
                "Type": "Task",
                "Resource": "${StateMachineLambda.Arn}",
                "TimeoutSeconds": 300,
                "HeartbeatSeconds": 60,
                "Next": "Is Product already associated with the portfolio?"
              },
              "Is Product already associated with the portfolio?": {
                "Type": "Choice",
                "Choices": [
                  {
                    "Variable": "$.AlreadyAssociated",
                    "StringEquals": "no",
                    "Next": "Associate Product with Portfolio Pass"
                  },
                  {
                    "Variable": "$.AlreadyAssociated",
                    "StringEquals": "yes",
                    "Next": "List Launch Constraints Pass"
                  }
                ],
                "Default": "Unable to check"
              },
              "Unable to check": {
                "Type": "Fail",
                "Cause": "Unable to check if product is already associated"
              },
              "Associate Product with Portfolio Pass": {
                "Type": "Pass",
                "Result": {
                  "ClassName": "ServiceCatalog",
                  "FunctionName": "associate_product_with_portfolio"
                },
                "ResultPath": "$.params",
                "Next": "Associate Product with Portfolio"
              },
              "Associate Product with Portfolio": {
                "Type": "Task",
                "Resource": "${StateMachineLambda.Arn}",
                "TimeoutSeconds": 300,
                "HeartbeatSeconds": 60,
                "Next": "List Launch Constraints Pass"
              },
              "List Launch Constraints Pass": {
                "Type": "Pass",
                "Result": {
                  "ClassName": "ServiceCatalog",
                  "FunctionName": "list_constraints_for_portfolio"
                },
                "ResultPath": "$.params",
                "Next": "List Launch Constraints"
              },
              "List Launch Constraints": {
                "Type": "Task",
                "Resource": "${StateMachineLambda.Arn}",
                "TimeoutSeconds": 300,
                "HeartbeatSeconds": 60,
                "Next": "Does launch constraint exist?"
              },
              "Does launch constraint exist?": {
                "Type": "Choice",
                "Choices": [
                  {
                    "Variable": "$.LaunchConstraintExist",
                    "StringEquals": "yes",
                    "Next": "Describe Constraint Pass"
                  },
                  {
                    "Variable": "$.LaunchConstraintExist",
                    "StringEquals": "no",
                    "Next": "Create Constraint Pass"
                  }
                ],
                "Default": "Unable to find a launch constraint"
              },
              "Unable to find a launch constraint": {
                "Type": "Fail",
                "Cause": "Unable to check if launch constraint exist"
              },
              "Describe Constraint Pass": {
                "Type": "Pass",
                "Result": {
                  "ClassName": "ServiceCatalog",
                  "FunctionName": "describe_constraint"
                },
                "ResultPath": "$.params",
                "Next": "Describe Constraint"
              },
              "Describe Constraint": {
                "Type": "Task",
                "Resource": "${StateMachineLambda.Arn}",
                "TimeoutSeconds": 300,
                "HeartbeatSeconds": 60,
                "Next": "Does the role arn match?"
              },
              "Does the role arn match?": {
                "Type": "Choice",
                "Choices": [
                  {
                    "Variable": "$.RoleArnMatched",
                    "StringEquals": "yes",
                    "Next": "SSM Parameter Store Pass"
                  },
                  {
                    "Variable": "$.RoleArnMatched",
                    "StringEquals": "no",
                    "Next": "Delete Constraint Pass"
                  }
                ],
                "Default": "Unable to match"
              },
              "Unable to match": {
                "Type": "Fail",
                "Cause": "Unable to match the role arn"
              },
              "Delete Constraint Pass": {
                "Type": "Pass",
                "Result": {
                  "ClassName": "ServiceCatalog",
                  "FunctionName": "delete_constraint"
                },
                "ResultPath": "$.params",
                "Next": "Delete Constraint"
              },
              "Delete Constraint": {
                "Type": "Task",
                "Resource": "${StateMachineLambda.Arn}",
                "TimeoutSeconds": 300,
                "HeartbeatSeconds": 60,
                "Next": "Create Constraint Pass"
              },
              "Create Constraint Pass": {
                "Type": "Pass",
                "Result": {
                  "ClassName": "ServiceCatalog",
                  "FunctionName": "create_constraint"
                },
                "ResultPath": "$.params",
                "Next": "Create Constraint"
              },
              "Create Constraint": {
                "Type": "Task",
                "Resource": "${StateMachineLambda.Arn}",
                "TimeoutSeconds": 300,
                "HeartbeatSeconds": 60,
                "Next": "SSM Parameter Store Pass"
              },
              "SSM Parameter Store Pass": {
                "Type": "Pass",
                "Result": {
                  "ClassName": "GeneralFunctions",
                  "FunctionName": "ssm_put_parameters"
                },
                "ResultPath": "$.params",
                "Next": "Put Parameters"
              },
              "Put Parameters": {
                "Type": "Task",
                "Resource": "${StateMachineLambda.Arn}",
                "TimeoutSeconds": 300,
                "HeartbeatSeconds": 60,
                "Next": "Finish"
              },
              "Finish": {
                "Type": "Succeed"
              },
              "Check Portfolio Pass": {
                "Type": "Pass",
                "Result": {
                  "ClassName": "ServiceCatalog",
                  "FunctionName": "list_portfolios"
                },
                "ResultPath": "$.params",
                "Next": "Check Portfolio"
              },
              "Check Portfolio": {
                "Type": "Task",
                "Resource": "${StateMachineLambda.Arn}",
                "TimeoutSeconds": 300,
                "HeartbeatSeconds": 60,
                "Next": "Check Product Pass"
              },
              "Check Product Pass": {
                "Type": "Pass",
                "Result": {
                  "ClassName": "ServiceCatalog",
                  "FunctionName": "search_products_as_admin"
                },
                "ResultPath": "$.params",
                "Next": "Check Product"
              },
              "Check Product": {
                "Type": "Task",
                "Resource": "${StateMachineLambda.Arn}",
                "TimeoutSeconds": 300,
                "HeartbeatSeconds": 60,
                "Next": "Check Portfolios for the Product Pass"
              },
              "Check Portfolios for the Product Pass": {
                "Type": "Pass",
                "Result": {
                  "ClassName": "ServiceCatalog",
                  "FunctionName": "list_portfolios_for_product"
                },
                "ResultPath": "$.params",
                "Next": "Check Portfolios for the Product"
              },
              "Check Portfolios for the Product": {
                "Type": "Task",
                "Resource": "${StateMachineLambda.Arn}",
                "TimeoutSeconds": 300,
                "HeartbeatSeconds": 60,
                "Next": "Check Launch Constraints Pass"
              },
              "Check Launch Constraints Pass": {
                "Type": "Pass",
                "Result": {
                  "ClassName": "ServiceCatalog",
                  "FunctionName": "list_constraints_for_portfolio"
                },
                "ResultPath": "$.params",
                "Next": "Check Launch Constraints"
              },
              "Check Launch Constraints": {
                "Type": "Task",
                "Resource": "${StateMachineLambda.Arn}",
                "TimeoutSeconds": 300,
                "HeartbeatSeconds": 60,
                "Next": "Check Principals Pass"
              },
              "Check Principals Pass": {
                "Type": "Pass",
                "Result": {
                  "ClassName": "ServiceCatalog",
                  "FunctionName": "list_principals_for_portfolio"
                },
                "ResultPath": "$.params",
                "Next": "Check Principals"
              },
              "Check Principals": {
                "Type": "Task",
                "Resource": "${StateMachineLambda.Arn}",
                "TimeoutSeconds": 300,
                "HeartbeatSeconds": 60,
                "Next": "Does portfolio exist?"
              },
              "Does portfolio exist?": {
                "Type": "Choice",
                "Choices": [
                  {
                    "Variable": "$.PortfolioExist",
                    "BooleanEquals": true,
                    "Next": "Does Constraint Exist?"
                  }
                ],
                "Default": "Finish"
              },
              "Does Constraint Exist?": {
                "Type": "Choice",
                "Choices": [
                  {
                    "Variable": "$.LaunchConstraintExist",
                    "StringEquals": "yes",
                    "Next": "Delete Launch Constraint Pass"
                  }
                ],
                "Default": "Is product associated with the portfolio?"
              },
              "Delete Launch Constraint Pass": {
                "Type": "Pass",
                "Result": {
                  "ClassName": "ServiceCatalog",
                  "FunctionName": "delete_constraint"
                },
                "ResultPath": "$.params",
                "Next": "Delete Launch Constraint"
              },
              "Delete Launch Constraint": {
                "Type": "Task",
                "Resource": "${StateMachineLambda.Arn}",
                "TimeoutSeconds": 300,
                "HeartbeatSeconds": 60,
                "Next": "Is product associated with the portfolio?"
              },
              "Is product associated with the portfolio?": {
                "Type": "Choice",
                "Choices": [
                  {
                    "Variable": "$.AlreadyAssociated",
                    "StringEquals": "yes",
                    "Next": "Dissociate Product with Portfolio Pass"
                  }
                ],
                "Default": "Does launch product exist?"
              },
              "Dissociate Product with Portfolio Pass": {
                "Type": "Pass",
                "Result": {
                  "ClassName": "ServiceCatalog",
                  "FunctionName": "disassociate_product_from_portfolio"
                },
                "ResultPath": "$.params",
                "Next": "Dissociate Product with Portfolio"
              },
              "Dissociate Product with Portfolio": {
                "Type": "Task",
                "Resource": "${StateMachineLambda.Arn}",
                "TimeoutSeconds": 300,
                "HeartbeatSeconds": 60,
                "Next": "Does launch product exist?"
              },
              "Does launch product exist?": {
                "Type": "Choice",
                "Choices": [
                  {
                    "Variable": "$.ProductExist",
                    "BooleanEquals": true,
                    "Next": "Delete Product Pass"
                  }
                ],
                "Default": "Is principal associated with Portfolio?"
              },
              "Delete Product Pass": {
                "Type": "Pass",
                "Result": {
                  "ClassName": "ServiceCatalog",
                  "FunctionName": "delete_product"
                },
                "ResultPath": "$.params",
                "Next": "Delete Product"
              },
              "Delete Product": {
                "Type": "Task",
                "Resource": "${StateMachineLambda.Arn}",
                "TimeoutSeconds": 300,
                "HeartbeatSeconds": 60,
                "Next": "Is principal associated with Portfolio?"
              },
              "Is principal associated with Portfolio?": {
                "Type": "Choice",
                "Choices": [
                  {
                    "Variable": "$.PrincipalExist",
                    "StringEquals": "yes",
                    "Next": "Disassociate Principal Pass"
                  }
                ],
                "Default": "Delete Portfolio Pass"
              },
              "Disassociate Principal Pass": {
                "Type": "Pass",
                "Result": {
                  "ClassName": "ServiceCatalog",
                  "FunctionName": "disassociate_principal_from_portfolio"
                },
                "ResultPath": "$.params",
                "Next": "Disassociate Principal"
              },
              "Disassociate Principal": {
                "Type": "Task",
                "Resource": "${StateMachineLambda.Arn}",
                "TimeoutSeconds": 300,
                "HeartbeatSeconds": 60,
                "Next": "Delete Portfolio Pass"
              },
              "Delete Portfolio Pass": {
                "Type": "Pass",
                "Result": {
                  "ClassName": "ServiceCatalog",
                  "FunctionName": "delete_portfolio"
                },
                "ResultPath": "$.params",
                "Next": "Delete Portfolio"
              },
              "Delete Portfolio": {
                "Type": "Task",
                "Resource": "${StateMachineLambda.Arn}",
                "TimeoutSeconds": 300,
                "HeartbeatSeconds": 60,
                "Next": "Finish"
              }
            }
          }



  LaunchAVMStateMachine:
    Type: 'AWS::StepFunctions::StateMachine'
    Properties:
      StateMachineName: LandingZoneLaunchAVMStateMachine
      RoleArn: !GetAtt 'StateMachineRole.Arn'
      DefinitionString:
        Fn::Sub: |-
          {
            "Comment": "A state machine to launch or terminate Service Catalog Product",
             "StartAt": "Metrics Pass",
            "States": {
              "Metrics Pass": {
                "Type": "Pass",
                "Result": {
                  "ClassName": "GeneralFunctions",
                  "FunctionName": "send_execution_data"
                },
                "ResultPath": "$.params",
                "Next": "Metrics"
              },
              "Metrics": {
                "Type": "Task",
                "Resource": "${StateMachineLambda.Arn}",
                "TimeoutSeconds": 300,
                "HeartbeatSeconds": 60,
                "Next": "Iterator Pass"
              },
              "Iterator Pass": {
                "Type": "Pass",
                "Result": {
                  "ClassName": "LaunchAVM",
                  "FunctionName": "iterator"
                },
                "ResultPath": "$.params",
                "Next": "Iterator"
              },
              "Iterator": {
                "Type": "Task",
                "Resource": "${StateMachineLambda.Arn}",
                "Next": "IsCountReached"
              },
              "IsCountReached": {
                "Type": "Choice",
                "Choices": [
                  {
                    "Variable": "$.Continue",
                    "BooleanEquals": true,
                    "Next": "Does Provisioned Product Exist?"
                  }
                ],
                "Default": "Send Success Pass"
              },
              "Does Provisioned Product Exist?": {
                "Type": "Choice",
                "Choices": [
                  {
                    "And": [
                      {
                        "Variable": "$.ProvisionedProductExists",
                        "BooleanEquals": true
                      },
                      {
                        "Variable": "$.RequestType",
                        "StringEquals": "Create"
                      }
                    ],
                    "Next": "Update Provisioned Product Pass"
                  },
                  {
                    "And": [
                      {
                        "Variable": "$.ProvisionedProductExists",
                        "BooleanEquals": true
                      },
                      {
                        "Variable": "$.RequestType",
                        "StringEquals": "Delete"
                      }
                    ],
                    "Next": "Terminate Provisioned Product Pass"
                  },
                  {
                    "And": [
                      {
                        "Variable": "$.ProvisionedProductExists",
                        "BooleanEquals": false
                      },
                      {
                        "Variable": "$.RequestType",
                        "StringEquals": "Create"
                      }
                    ],
                    "Next": "Launch Product Pass"
                  },
                  {
                    "And": [
                      {
                        "Variable": "$.ProvisionedProductExists",
                        "BooleanEquals": false
                      },
                      {
                        "Variable": "$.RequestType",
                        "StringEquals": "Delete"
                      }
                    ],
                    "Next": "Iterator Pass"
                  }
                ]
              },
              "Update Provisioned Product Pass": {
                "Type": "Pass",
                "Result": {
                  "ClassName": "LaunchAVM",
                  "FunctionName": "update_provisioned_product"
                },
                "ResultPath": "$.params",
                "Next": "Update Provisioned Product"
              },
              "Update Provisioned Product": {
                "Type": "Task",
                "Resource": "${StateMachineLambda.Arn}",
                "Next": "Describe Provisioned Product Pass"
              },
              "Terminate Provisioned Product Pass": {
                "Type": "Pass",
                "Result": {
                  "ClassName": "LaunchAVM",
                  "FunctionName": "terminate_provisioned_product"
                },
                "ResultPath": "$.params",
                "Next": "Terminate Provisioned Product"
              },
              "Terminate Provisioned Product": {
                "Type": "Task",
                "Resource": "${StateMachineLambda.Arn}",
                "Next": "Describe Provisioned Product Pass"
              },
              "Launch Product Pass": {
                "Type": "Pass",
                "Result": {
                  "ClassName": "LaunchAVM",
                  "FunctionName": "provision_product"
                },
                "ResultPath": "$.params",
                "Next": "Launch Product"
              },
              "Launch Product": {
                "Type": "Task",
                "Resource": "${StateMachineLambda.Arn}",
                "Next": "Describe Provisioned Product Pass"
              },
              "Describe Provisioned Product Pass": {
                "Type": "Pass",
                "Result": {
                  "ClassName": "LaunchAVM",
                  "FunctionName": "describe_record"
                },
                "ResultPath": "$.params",
                "Next": "Describe Provisioned Product"
              },
              "Describe Provisioned Product": {
                "Type": "Task",
                "Resource": "${StateMachineLambda.Arn}",
                "Next": "Is Product Provisioned Or Terminated successfully?"
              },
              "Is Product Provisioned Or Terminated successfully?": {
                "Type": "Choice",
                "Choices": [
                  {
                    "Variable": "$.ProvisioningStatus",
                    "StringEquals": "FAILED",
                    "Next": "Send Failed Pass"
                  },
                  {
                    "Variable": "$.ProvisioningStatus",
                    "StringEquals": "SUCCEEDED",
                    "Next": "Iterator Pass"
                  },
                  {
                    "Variable": "$.ProvisioningStatus",
                    "StringEquals": "RETRY",
                    "Next": "Random Wait Pass"
                  }
                ],
                "Default": "Wait For Product To Provision"
              },
              "Random Wait Pass": {
                "Type": "Pass",
                "Result": {
                  "ClassName": "GeneralFunctions",
                  "FunctionName": "random_wait"
                },
                "ResultPath": "$.params",
                "Next": "Random Wait"
              },
              "Random Wait": {
                "Type": "Task",
                "Resource": "${StateMachineLambda.Arn}",
                "TimeoutSeconds": 900,
                "HeartbeatSeconds": 60,
                "Next": "Does Provisioned Product Exist?"
              },
              "Wait For Product To Provision": {
                "Type": "Wait",
                "Seconds": 10,
                "Next": "Describe Provisioned Product Pass"
              },
              "Send Success Pass": {
                "Type": "Pass",
                "Result": {
                  "ClassName": "GeneralFunctions",
                  "FunctionName": "send_success_to_cfn"
                },
                "ResultPath": "$.params",
                "Next": "Send Success Response"
              },
              "Send Success Response": {
                "Type": "Task",
                "Resource": "${StateMachineLambda.Arn}",
                "TimeoutSeconds": 300,
                "HeartbeatSeconds": 60,
                "Next": "Success"
              },
              "Success": {
                "Type": "Succeed"
              },
              "Send Failed Pass": {
                "Type": "Pass",
                "Result": {
                  "ClassName": "GeneralFunctions",
                  "FunctionName": "send_failure_to_cfn"
                },
                "ResultPath": "$.params",
                "Next": "Send Failed Response"
              },
              "Send Failed Response": {
                "Type": "Task",
                "Resource": "${StateMachineLambda.Arn}",
                "TimeoutSeconds": 300,
                "HeartbeatSeconds": 60,
                "Next": "Failed"
              },
              "Failed": {
                "Type": "Fail"
              }
            }
          }



  CheckAVMExistsStateMachine:
    Type: 'AWS::StepFunctions::StateMachine'
    Properties:
      StateMachineName: LandingZoneCheckAVMExistsStateMachine
      RoleArn: !GetAtt 'StateMachineRole.Arn'
      DefinitionString:
        Fn::Sub: |-
          {
            "Comment": "A state machine to check if the Provisioned product exists?",
            "StartAt": "Metrics Pass",
            "States": {
              "Metrics Pass": {
                "Type": "Pass",
                "Result": {
                  "ClassName": "GeneralFunctions",
                  "FunctionName": "send_execution_data"
                },
                "ResultPath": "$.params",
                "Next": "Metrics"
              },
              "Metrics": {
                "Type": "Task",
                "Resource": "${StateMachineLambda.Arn}",
                "TimeoutSeconds": 300,
                "HeartbeatSeconds": 60,
                "Next": "Create or Delete?"
              },
              "Create or Delete?": {
                "Type": "Choice",
                "Choices": [
                  {
                    "Variable": "$.RequestType",
                    "StringEquals": "Create",
                    "Next": "Lookup Service Catalog Product Pass"
                  },
                  {
                    "Variable": "$.RequestType",
                    "StringEquals": "Update",
                    "Next": "Lookup Service Catalog Product Pass"
                  },
                  {
                    "Variable": "$.RequestType",
                    "StringEquals": "Delete",
                    "Next": "Send Success Pass"
                  }
                ]
              },
              "Lookup Service Catalog Product Pass": {
                "Type": "Pass",
                "Result": {
                  "ClassName": "CheckAVMExists",
                  "FunctionName": "lookup_product"
                },
                "ResultPath": "$.params",
                "Next": "Lookup Service Catalog Product"
              },
              "Lookup Service Catalog Product": {
                "Type": "Task",
                "Resource": "${StateMachineLambda.Arn}",
                "TimeoutSeconds": 300,
                "HeartbeatSeconds": 60,
                "Next": "Search Provisioned Product Pass"
              },
              "Search Provisioned Product Pass": {
                "Type": "Pass",
                "Result": {
                  "ClassName": "CheckAVMExists",
                  "FunctionName": "search_provisioned_products"
                },
                "ResultPath": "$.params",
                "Next": "Search Provisioned Product"
              },
              "Search Provisioned Product": {
                  "Type": "Task",
                  "Resource": "${StateMachineLambda.Arn}",
                  "Next": "Search Complete?"
              },
              "Search Complete?": {
                "Type": "Choice",
                "Choices": [
                  {
                    "Variable": "$.NextPageToken",
                    "StringEquals": "Complete",
                    "Next": "Does Provisioned Product Exist?"
                  }
                ],
                "Default": "Search Provisioned Product Account Wait"
              },
              "Search Provisioned Product Account Wait": {
                "Type": "Wait",
                "Seconds": 1,
                "Next": "Search Provisioned Product Pass"
              },
              "Does Provisioned Product Exist?": {
                  "Type": "Choice",
                  "Choices": [
                    {
                      "Variable": "$.ProvisionedProductExists",
                      "BooleanEquals": true,
                      "Next": "Send Failed Pass"
                    },
                    {
                      "Variable": "$.ProvisionedProductExists",
                      "BooleanEquals": false,
                      "Next": "Send Success Pass"
                    }
                  ]
              },
              "Send Success Pass": {
                "Type": "Pass",
                "Result": {
                  "ClassName": "GeneralFunctions",
                  "FunctionName": "send_success_to_cfn"
                },
                "ResultPath": "$.params",
                "Next": "Send Success Response"
              },
              "Send Success Response": {
                "Type": "Task",
                "Resource": "${StateMachineLambda.Arn}",
                "TimeoutSeconds": 300,
                "HeartbeatSeconds": 60,
                "Next": "Success"
              },
              "Success": {
                "Type": "Succeed"
              },
              "Send Failed Pass": {
                "Type": "Pass",
                "Result": {
                  "ClassName": "GeneralFunctions",
                  "FunctionName": "send_failure_to_cfn"
                },
                "ResultPath": "$.params",
                "Next": "Send Failed Response"
              },
              "Send Failed Response": {
                "Type": "Task",
                "Resource": "${StateMachineLambda.Arn}",
                "TimeoutSeconds": 300,
                "HeartbeatSeconds": 60,
                "Next": "Failed"
              },
              "Failed": {
                "Type": "Fail"
              }
            }
          }


  HandshakeStateMachine:
    Type: 'AWS::StepFunctions::StateMachine'
    Properties:
      StateMachineName: LandingZoneHandshakeStateMachine
      RoleArn: !GetAtt 'StateMachineRole.Arn'
      DefinitionString:
        Fn::Sub: |-
          {
            "Comment": "A state machine that manages the handshakes between hub and spoke accounts for multiple AWS services",
            "StartAt": "Metrics Pass",
            "States": {
              "Metrics Pass": {
                "Type": "Pass",
                "Result": {
                  "ClassName": "GeneralFunctions",
                  "FunctionName": "send_execution_data"
                },
                "ResultPath": "$.params",
                "Next": "Metrics"
              },
              "Metrics": {
                "Type": "Task",
                "Resource": "${HandshakeSMLambda.Arn}",
                "TimeoutSeconds": 300,
                "HeartbeatSeconds": 60,
                "Next": "Describe Resources Hub Pass"
              },
              "Describe Resources Hub Pass": {
                "Type": "Pass",
                "Result": {
                  "PeerType": "Hub",
                  "ClassName": "Handshake",
                  "FunctionName": "describe_resources"
                },
                "ResultPath": "$.params",
                "Next": "Describe Resources Hub"
              },
              "Describe Resources Hub": {
                "Type": "Task",
                "Resource": "${HandshakeSMLambda.Arn}",
                "TimeoutSeconds": 300,
                "HeartbeatSeconds": 60,
                "Next": "Describe Resources Spoke Pass"
              },
              "Describe Resources Spoke Pass": {
                "Type": "Pass",
                "Result": {
                  "PeerType": "Spoke",
                  "ClassName": "Handshake",
                  "FunctionName": "describe_resources"
                },
                "ResultPath": "$.params",
                "Next": "Describe Resources Spoke"
              },
              "Describe Resources Spoke": {
                "Type": "Task",
                "Resource": "${HandshakeSMLambda.Arn}",
                "TimeoutSeconds": 300,
                "HeartbeatSeconds": 60,
                "Next": "Action: Create or Delete?"
              },
              "Action: Create or Delete?": {
                "Type": "Choice",
                "Choices": [
                  {
                    "Variable": "$.RequestType",
                    "StringEquals": "Delete",
                    "Next": "Delete Resources Spoke Pass"
                  },
                  {
                    "Variable": "$.RequestType",
                    "StringEquals": "Create",
                    "Next": "Create Resources Spoke Pass"
                  },
                  {
                    "Variable": "$.RequestType",
                    "StringEquals": "Update",
                    "Next": "Create Resources Spoke Pass"
                  }
                ],
                "Default": "Undefined Request Type"
              },
              "Create Resources Spoke Pass": {
                "Type": "Pass",
                "Result": {
                  "PeerType": "Spoke",
                  "ClassName": "Handshake",
                  "FunctionName": "create_resources"
                },
                "ResultPath": "$.params",
                "Next": "Create Resources Spoke"
              },
              "Create Resources Spoke": {
                "Type": "Task",
                "Resource": "${HandshakeSMLambda.Arn}",
                "TimeoutSeconds": 300,
                "HeartbeatSeconds": 60,
                "Next": "Create Resources Hub Pass"
              },
              "Create Resources Hub Pass": {
                "Type": "Pass",
                "Result": {
                  "PeerType": "Hub",
                  "ClassName": "Handshake",
                  "FunctionName": "create_resources"
                },
                "ResultPath": "$.params",
                "Next": "Create Resources Hub"
              },
              "Create Resources Hub": {
                "Type": "Task",
                "Resource": "${HandshakeSMLambda.Arn}",
                "TimeoutSeconds": 300,
                "HeartbeatSeconds": 60,
                "Next": "Send Invitation Pass"
              },
              "Send Invitation Pass": {
                "Type": "Pass",
                "Result": {
                  "PeerType": "Hub",
                  "ClassName": "Handshake",
                  "FunctionName": "send_invitation"
                },
                "ResultPath": "$.params",
                "Next": "Send Invitation"
              },
              "Send Invitation": {
                "Type": "Task",
                "Resource": "${HandshakeSMLambda.Arn}",
                "TimeoutSeconds": 300,
                "HeartbeatSeconds": 60,
                "Next": "Accept Invitation Pass"
              },
              "Accept Invitation Pass": {
                "Type": "Pass",
                "Result": {
                  "PeerType": "Spoke",
                  "ClassName": "Handshake",
                  "FunctionName": "accept_invitation"
                },
                "ResultPath": "$.params",
                "Next": "Accept Invitation"
              },
              "Accept Invitation": {
                "Type": "Task",
                "Resource": "${HandshakeSMLambda.Arn}",
                "TimeoutSeconds": 300,
                "HeartbeatSeconds": 60,
                "Next": "Invitation Status Pass"
              },
              "Invitation Status Pass": {
                "Type": "Pass",
                "Result": {
                  "PeerType": "Spoke",
                  "ClassName": "Handshake",
                  "FunctionName": "check_invitation_status"
                },
                "ResultPath": "$.params",
                "Next": "Invitation Status"
              },
              "Invitation Status": {
                "Type": "Task",
                "Resource": "${HandshakeSMLambda.Arn}",
                "TimeoutSeconds": 300,
                "HeartbeatSeconds": 60,
                "Next": "Handshake Completed?"
              },
              "Handshake Completed?": {
                "Type": "Choice",
                "Choices": [
                  {
                    "Variable": "$.RelationshipStatus",
                    "StringEquals": "active",
                    "Next": "Handshake Successful"
                  },
                  {
                    "Variable": "$.RelationshipStatus",
                    "StringEquals": "enabled",
                    "Next": "Handshake Successful"
                  },
                  {
                    "Variable": "$.RelationshipStatus",
                    "StringEquals": "created",
                    "Next": "Handshake Successful"
                  },
                  {
                    "Variable": "$.RelationshipStatus",
                    "StringEquals": "emailverification",
                    "Next": "Handshake Failed"
                  },
                  {
                    "Variable": "$.RelationshipStatus",
                    "StringEquals": "rejected",
                    "Next": "Handshake Failed"
                  },
                  {
                    "Variable": "$.RelationshipStatus",
                    "StringEquals": "expired",
                    "Next": "Handshake Failed"
                  },
                  {
                    "Variable": "$.RelationshipStatus",
                    "StringEquals": "MasterAcctIdEqualsMemberAcctId",
                    "Next": "Handshake Successful"
                  }
                ],
                "Default": "Processing Invitation"
              },
              "Handshake Successful": {
                "Type": "Pass",
                "Next": "SSM Parameter Store Pass"
              },
              "Handshake Failed": {
                "Type": "Pass",
                "Next": "Send Failed Pass"
              },
              "Processing Invitation": {
                "Type": "Wait",
                "Seconds": 10,
                "Next": "Invitation Status Pass"
              },
              "Delete Resources Spoke Pass": {
                "Type": "Pass",
                "Result": {
                  "PeerType": "Spoke",
                  "ClassName": "Handshake",
                  "FunctionName": "delete_resources"
                },
                "ResultPath": "$.params",
                "Next": "Delete Resources Spoke"
              },
              "Delete Resources Spoke": {
                "Type": "Task",
                "Resource": "${HandshakeSMLambda.Arn}",
                "TimeoutSeconds": 300,
                "HeartbeatSeconds": 60,
                "Next": "Delete Resources Hub Pass"
              },
              "Delete Resources Hub Pass": {
                "Type": "Pass",
                "Result": {
                  "PeerType": "Hub",
                  "ClassName": "Handshake",
                  "FunctionName": "delete_resources"
                },
                "ResultPath": "$.params",
                "Next": "Delete Resources Hub"
              },
              "Delete Resources Hub": {
                "Type": "Task",
                "Resource": "${HandshakeSMLambda.Arn}",
                "TimeoutSeconds": 300,
                "HeartbeatSeconds": 60,
                "Next": "Send Success Pass"
              },
              "Undefined Request Type": {
                "Type": "Pass",
                "Next": "Send Failed Pass"
              },
              "SSM Parameter Store Pass": {
                "Type": "Pass",
                "Result": {
                  "ClassName": "GeneralFunctions",
                  "FunctionName": "ssm_put_parameters"
                },
                "ResultPath": "$.params",
                "Next": "Put Parameters"
              },
              "Put Parameters": {
                "Type": "Task",
                "Resource": "${HandshakeSMLambda.Arn}",
                "TimeoutSeconds": 300,
                "HeartbeatSeconds": 60,
                "Next": "Send Success Pass"
              },
              "Send Success Pass": {
                "Type": "Pass",
                "Result": {
                  "ClassName": "GeneralFunctions",
                  "FunctionName": "send_success_to_cfn"
                },
                "ResultPath": "$.params",
                "Next": "Send Success Response"
              },
              "Send Success Response": {
                "Type": "Task",
                "Resource": "${HandshakeSMLambda.Arn}",
                "TimeoutSeconds": 300,
                "HeartbeatSeconds": 60,
                "Next": "Success"
              },
              "Success": {
                "Type": "Succeed"
              },
              "Send Failed Pass": {
                "Type": "Pass",
                "Result": {
                  "ClassName": "GeneralFunctions",
                  "FunctionName": "send_failure_to_cfn"
                },
                "ResultPath": "$.params",
                "Next": "Send Failed Response"
              },
              "Send Failed Response": {
                "Type": "Task",
                "Resource": "${HandshakeSMLambda.Arn}",
                "TimeoutSeconds": 300,
                "HeartbeatSeconds": 60,
                "Next": "Failed"
              },
              "Failed": {
                "Type": "Fail"
              }
            }
          }

# Add-On Publisher Resources

  # Permissions & Policies

  PublisherScheduleRulePermission:
    Type: AWS::Lambda::Permission
    Condition: IsAddonsManagedCondition
    Properties:
      FunctionName: !Ref PublishAddonsFunction
      Action: lambda:InvokeFunction
      Principal: events.amazonaws.com
      SourceArn: !GetAtt PublisherScheduleRule.Arn

  PublisherLambdaRole:
    Condition: IsAddonsManagedCondition
    Metadata:
      cfn_nag:
        rules_to_suppress:
          - id: W11
            reason: "Allow Resource * to allow updating resources defined by the customer."
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
        - Effect: Allow
          Principal:
            Service: lambda.amazonaws.com
          Action: sts:AssumeRole
      Path: "/"
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/AWSServiceCatalogAdminFullAccess
      Policies:
        - PolicyName: LambdaPublisherPolicy
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Effect: Allow
                Action:
                  - logs:CreateLogGroup
                  - logs:CreateLogStream
                  - logs:PutLogEvents
                Resource:
                  - Fn::Sub: 'arn:aws:logs:${AWS::Region}:${AWS::AccountId}:log-group:/aws/lambda/*'
              - Effect: Allow
                Action:
                  - cloudformation:GetTemplateSummary
                  - cloudformation:DescribeStacks
                  - cloudformation:ListStacks
                  - cloudformation:ValidateTemplate
                  - cloudformation:CreateUploadBucket
                Resource: '*'
              - Effect: Allow
                Action:
                  - xray:PutTraceSegments
                  - xray:PutTelemetryRecords
                Resource: '*'
              - Effect: Allow
                Action:
                  - cloudformation:UpdateStack
                Resource: !Sub ${AWS::StackId}
              - Effect: Allow
                Action:
                  - sns:Publish
                Resource: !Ref AddonSNSTopic

  # SNS Topic

  AddonSNSTopic:
    Type: AWS::SNS::Topic
    Metadata:
      cfn_nag:
        rules_to_suppress:
          - id: W47
            reason: "The SNS topic does not require a KMS Master Key."
    Condition: IsAddonsManagedCondition
    Properties:
      Subscription:
      - Endpoint: !If [IsAddonsEmailEmpty, 'no-notifications@email.com', !Ref NotificationAddonsEmailParameter]
        Protocol: email
      TopicName: 'LZ-Addon-Updates'

  # Lambda

  PublishAddonsFunction:
    Type: AWS::Lambda::Function
    Metadata:
      cfn_nag:
        rules_to_suppress:
          - id: W89
            reason: "This lambda function does not need access to VPC resources"
          - id: W92
            reason: "This use case does not need to set the ReservedConcurrentExecutions"
    Condition: IsAddonsManagedCondition
    Properties:
      Role: !GetAtt PublisherLambdaRole.Arn
      Description: AWS Landing Zone Addons Publisher
      Environment:
        Variables:
          AddonTemplate: !FindInMap [Solution, Data, "AddonTemplate"]
          AddonStack: !Sub ${AWS::StackId}
          AddonTopic: !If [IsAddonsManagedCondition, !Ref AddonSNSTopic, '']
          ReleaseNotes: https://solutions-reference.s3.amazonaws.com/aws-landing-zone/v2.4.6/release_notes.html
          log_level: !FindInMap [LambdaFunction, Logging, Level]
          SOLUTION_ID: !FindInMap [ Solution, Metrics, SolutionID ]
          SOLUTION_VERSION: v2.4.6
          METRICS_URL: !FindInMap [ Solution, Metrics, MetricsURL ]
      Code:
        S3Bucket: !Sub "solutions-${AWS::Region}"
        S3Key: aws-landing-zone/v2.4.6/aws-landing-zone-addon-publisher.zip
      FunctionName: LandingZoneAddonPublisher
      Handler: publish.lambda_handler
      Runtime: python3.9
      Timeout: 900

  # CloudWatch [start]

  PublisherScheduleRule:
    Type: AWS::Events::Rule
    Condition: IsAddonsManagedCondition
    Properties:
      Description: Rule to trigger Publisher function on a schedule.
      ScheduleExpression: cron(55 11 * * ? *)
      State: ENABLED
      Targets:
      - Arn: !GetAtt PublishAddonsFunction.Arn
        Id: PublishAddonsFunction

  # CloudWatch [end]

  # Addons Resources aov1.0

  #Service Catalog Portfolio for Add-On Products
  LandingZoneAddOnPortfolio:
    Type: "AWS::ServiceCatalog::Portfolio"
    Properties:
      ProviderName: AWS Solutions
      Description: Add-On Products for AWS Landing Zone
      DisplayName: AWS Landing Zone - Add-On Products
      Tags:
        - Key: AWS Solutions
          Value: Landing Zone Solution

  #Service Catalog Add-On Product1
  LandingZoneAddOnProduct1:
    Type: "AWS::ServiceCatalog::CloudFormationProduct"
    Properties:
      Name: AWS Centralized Logging Solution - Landing Zone Add-On
      Owner: AWS Solutions
      Description: Install the centralized log aggregation and monitoring solution
      ProvisioningArtifactParameters:
        - Info:
            LoadTemplateFromURL: https://s3.amazonaws.com/solutions-reference/aws-landing-zone/v2.4.6/add-on/aws-centralized-logging-solution.template
          Name: v1.3
          Description: Updated Lambda Function runtimes to Python 3.9 and NodeJs 14.x

  AddLandingZoneAddOnProduct1ToPortfolio:
    Type: "AWS::ServiceCatalog::PortfolioProductAssociation"
    Properties:
      PortfolioId: !Ref LandingZoneAddOnPortfolio
      ProductId: !Ref LandingZoneAddOnProduct1

  LandingZoneAddOnProduct1LaunchConstraint:
    Type: "AWS::ServiceCatalog::LaunchRoleConstraint"
    DependsOn:
      - AddLandingZoneAddOnProduct1ToPortfolio
    Properties:
      Description: !Sub Constraint for Product ID - ${LandingZoneAddOnProduct1}
      PortfolioId: !Ref LandingZoneAddOnPortfolio
      ProductId: !Ref LandingZoneAddOnProduct1
      RoleArn: !Sub ${LandingZoneSCProductConstraintRole.Arn}

  #Service Catalog Add-On Product2
  LandingZoneAddOnProduct2:
    Type: "AWS::ServiceCatalog::CloudFormationProduct"
    Properties:
      Name: AWS Managed AD and Directory Connector for AWS SSO - Landing Zone Add-On
      Owner: AWS Solutions
      Description: This AWS Landing Zone add-on will deploy Directory Connector for AWS SSO peered with AWS Managed Active Directory and a Remote Desktop Gateway in the shared service account. Use this add-on to provide an AWS managed AD infrastructure for controlling user access to AWS and your EC2 instances.
      ProvisioningArtifactParameters:
        - Info:
            LoadTemplateFromURL: https://s3.amazonaws.com/solutions-reference/aws-landing-zone/v2.4.6/add-on/aws-ad-with-rdgw-ad-connector.template
          Name: v1.4
          Description:  Updated Lambda Function runtimes to Python 3.9 and NodeJs 14.x

  AddLandingZoneAddOnProduct2ToPortfolio:
    Type: "AWS::ServiceCatalog::PortfolioProductAssociation"
    Properties:
      PortfolioId: !Ref LandingZoneAddOnPortfolio
      ProductId: !Ref LandingZoneAddOnProduct2

  LandingZoneAddOnProduct2LaunchConstraint:
    Type: "AWS::ServiceCatalog::LaunchRoleConstraint"
    DependsOn:
      - AddLandingZoneAddOnProduct2ToPortfolio
    Properties:
      Description: !Sub Constraint for Product ID - ${LandingZoneAddOnProduct2}
      PortfolioId: !Ref LandingZoneAddOnPortfolio
      ProductId: !Ref LandingZoneAddOnProduct2
      RoleArn: !Sub ${LandingZoneSCProductConstraintRole.Arn}

Outputs:
  LandingZoneCodePipeline:
    Description: AWS Landing Zone CodePipeline
    Value: !Ref LandingZoneCodePipeline
  LandingZonePipelineS3Bucket:
    Description: AWS Landing Zone Configuration Bucket
    Value: !Ref LandingZonePipelineS3Bucket
  LandingZoneSolutionVersion:
    Description: Version Number
    Value: "v2.4.6"
    Export:
      Name: AWS-Landing-Zone-Version
  LandingZoneAddonsVersion:
    Description: Addons Version Number
    Value: "aov1.0"
    Export:
      Name: AWS-Landing-Zone-Addons-Version