AWSTemplateFormatVersion: '2010-09-09'
Transform: AWS::Serverless-2016-10-31
Description: Amazon S3 Find and Forget (uksb-1q2j8beb0) (version:v0.68) (tag:main)
Parameters:
  AccessControlAllowOriginOverride:
    Description: Overrides the default Allow-Control-Allow-Origin setting for the
      API and Reports Bucket. When "false" the only origin allowed is the Web UI url.
      This must be set to "*" if no restriction is required.
    Type: String
    Default: 'false'
  AccessLogsBucket:
    Description: Optional S3 Bucket to send access logs for the Web UI to. Incurs
      additional cost. Leave blank to disable
    Type: String
    Default: ''
  AdminEmail:
    Description: Creates a username to be used for authentication. It needs to be
      an e-mail address.
    Type: String
    AllowedPattern: ^[a-zA-Z0-9_.+-]+@[a-zA-Z0-9-]+\.[a-zA-Z0-9-.]+$
  AthenaConcurrencyLimit:
    Description: How many Athena queries should be scheduled concurrently
    Type: Number
    Default: 20
  AthenaQueryMaxRetries:
    Description: Max number of retries to each Athena query after a failure
    Type: Number
    Default: 2
    MinValue: 0
  AthenaWorkGroup:
    Description: WorkGroup to use for Athena queries
    Type: String
    Default: primary
  AuthMethod:
    Description: Authentication method to use for the API (and WebUI if deployed).
    Type: String
    Default: Cognito
    AllowedValues:
    - Cognito
    - IAM
  CreateCloudFrontDistribution:
    Description: Creates a CloudFront distribution for accessing the web interface
      of the solution. This must be enabled if S3 Block Public Access is enabled at
      an account level.
    Type: String
    Default: 'true'
    AllowedValues:
    - 'true'
    - 'false'
  DeletionTaskCPU:
    Description: The CPU to be allocated to the Deletion Fargate Task
    Type: String
    Default: '4096'
  DeletionTasksMaxNumber:
    Description: The maximum number of tasks to allocate for the Deletion Fargate
      job
    Type: Number
    Default: 3
    MinValue: 1
  DeletionTaskMemory:
    Description: The memory to be allocated to the Deletion Fargate Task
    Type: String
    Default: '30720'
  DeployVpc:
    Description: Deploy a new dedicated VPC for this solution. To use an existing
      VPC, set this to "false" and provide values for the VpcSecurityGroups and VpcSubnets
      parameters.
    Type: String
    Default: 'true'
    AllowedValues:
    - 'true'
    - 'false'
  DeployWebUI:
    Description: Specify whether you would like a Web User Interface deployed. (AuthMethod
      must be Cognito if WebUI is deployed).
    Type: String
    Default: 'true'
    AllowedValues:
    - 'true'
    - 'false'
  EnableAPIAccessLogging:
    Description: Whether to enable API Gateway access logging. Enabling access logging
      will incur additional CloudWatch Logs charges
    Type: String
    Default: 'false'
    AllowedValues:
    - 'true'
    - 'false'
  CognitoAdvancedSecurity:
    Description: The type of Cognito advanced security to enable. Disabled by default.
    Type: String
    Default: 'OFF'
    AllowedValues:
    - 'OFF'
    - AUDIT
    - ENFORCED
  EnableContainerInsights:
    Description: Enable ECS Container Insights
    Type: String
    Default: 'false'
    AllowedValues:
    - 'true'
    - 'false'
  EnableDynamoDBBackups:
    Description: Whether to enable point in time recovery for the DynamoDB tables
    Type: String
    Default: 'false'
    AllowedValues:
    - 'true'
    - 'false'
  FlowLogsGroup:
    Description: Optional CloudWatch Logs group to send VPC flow logs to. Flow Logs
      incur additional cost. Set to "" to disable. This parameter is ignored if the
      DeployVpc parameter is set to "false".
    Type: String
    Default: ''
  FlowLogsRoleArn:
    Description: Optional IAM role to use to send Flow Logs to CloudWatch. Flow Logs
      incur additional cost. Set to "" to disable. This parameter is ignored if the
      DeployVpc parameter is set to "false".
    Type: String
    Default: ''
  ForgetQueueWaitSeconds:
    Description: Wait interval for checking Forget progress
    Type: Number
    Default: 30
  JobDetailsRetentionDays:
    Description: How log to retain Job Record logs. Use 0 for indefinite. Default
      is 0
    Type: Number
    Default: 0
  KMSKeyArns:
    Description: Comma-delimited list of KMS Key Arns used for client-side Encryption.
      Leave empty if data is not client-side encrypted with KMS
    Type: String
    Default: ''
  LambdaAPIMemorySize:
    Description: The memory allocated to Lambda API handlers
    Type: Number
    Default: 128
    MinValue: 128
    MaxValue: 10240
  LambdaJobsMemorySize:
    Description: The memory allocated to Lambda Deletion Jobs tasks
    Type: Number
    Default: 512
    MinValue: 128
    MaxValue: 10240
  PreBuiltArtefactsBucketOverride:
    Description: Overrides the default Bucket containing Front-end and Back-end pre-built
      artefacts. When false, the default is used for the given region (for example
      solution-builders-us-west-1)
    Type: String
    Default: 'false'
  QueryExecutionWaitSeconds:
    Description: Wait interval for checking if a query has completed
    Type: Number
    Default: 3
  QueryQueueWaitSeconds:
    Description: Wait interval for checking Find progress
    Type: Number
    Default: 3
  ResourcePrefix:
    Description: The prefix used for uniquely named resources, such as State Machines,
      etc.
    Type: String
    Default: S3F2
    AllowedPattern: ^[a-zA-Z0-9]*$
  RetainDynamoDBTables:
    Description: Whether to retain the DynamoDB tables upon Stack Update and Stack
      Deletion
    Type: String
    Default: 'true'
    AllowedValues:
    - 'true'
    - 'false'
  VpcSecurityGroups:
    Description: Comma-delimited list of security groups to apply to Fargate tasks.
      This parameter must be set if the DeployVpc parameter is "false", otherwise
      it is ignored.
    Type: CommaDelimitedList
    Default: ''
  VpcSubnets:
    Description: Comma-delimited list of subnets to deploy Fargate tasks in. This
      parameter must be set if the DeployVpc parameter is "false", otherwise it is
      ignored.
    Type: CommaDelimitedList
    Default: ''
Rules:
  ValidateAuth:
    RuleCondition:
      Fn::Equals:
      - Ref: DeployWebUI
      - 'true'
    Assertions:
    - AssertDescription: IAM Auth cannot be chosen when deploying the WebUI.
      Assert:
        Fn::Equals:
        - Ref: AuthMethod
        - Cognito
  ValidateRegion:
    RuleCondition:
      Fn::Not:
      - Fn::Contains:
        - - ap-northeast-1
          - ap-northeast-2
          - ap-south-1
          - ap-southeast-1
          - ap-southeast-2
          - ca-central-1
          - eu-central-1
          - eu-north-1
          - eu-west-1
          - eu-west-2
          - eu-west-3
          - me-south-1
          - sa-east-1
          - us-east-1
          - us-east-2
          - us-gov-west-1
          - us-west-1
          - us-west-2
        - Ref: AWS::Region
    Assertions:
    - AssertDescription: Cognito is not supported in this region please select IAM
        authentication.
      Assert:
        Fn::Not:
        - Fn::Equals:
          - Ref: AuthMethod
          - Cognito
Conditions:
  DefaultPreBuiltArtefactsBucket:
    Fn::Equals:
    - Ref: PreBuiltArtefactsBucketOverride
    - 'false'
  ShouldDeployVpc:
    Fn::Equals:
    - Ref: DeployVpc
    - 'true'
  ShouldDeployWebUI:
    Fn::Equals:
    - Ref: DeployWebUI
    - 'true'
  ShouldDeployCognito:
    Fn::Equals:
    - Ref: AuthMethod
    - Cognito
Mappings:
  Solution:
    Constants:
      Version: v0.68
Resources:
  TempBucket:
    Type: AWS::S3::Bucket
    Properties:
      VersioningConfiguration:
        Status: Enabled
      BucketEncryption:
        ServerSideEncryptionConfiguration:
        - ServerSideEncryptionByDefault:
            SSEAlgorithm: AES256
      LifecycleConfiguration:
        Rules:
        - Id: ExpireContents
          Status: Enabled
          ExpirationInDays: 1
          NoncurrentVersionExpirationInDays: 1
  TempBucketPolicy:
    Type: AWS::S3::BucketPolicy
    Properties:
      Bucket:
        Ref: TempBucket
      PolicyDocument:
        Statement:
        - Sid: HttpsOnly
          Action: '*'
          Effect: Deny
          Resource:
          - Fn::Sub: arn:${AWS::Partition}:s3:::${TempBucket}
          - Fn::Sub: arn:${AWS::Partition}:s3:::${TempBucket}/*
          Principal: '*'
          Condition:
            Bool:
              aws:SecureTransport: 'false'
  ConfigParameter:
    Type: AWS::SSM::Parameter
    Properties:
      Name:
        Fn::Sub: /s3f2/${ResourcePrefix}-Configuration
      Type: String
      Value:
        Fn::Sub: "{\n  \"AthenaConcurrencyLimit\": ${AthenaConcurrencyLimit},\n  \"\
          AthenaQueryMaxRetries\": ${AthenaQueryMaxRetries},\n  \"DeletionTasksMaxNumber\"\
          : ${DeletionTasksMaxNumber},\n  \"JobDetailsRetentionDays\": ${JobDetailsRetentionDays},\n\
          \  \"QueryExecutionWaitSeconds\": ${QueryExecutionWaitSeconds},\n  \"QueryQueueWaitSeconds\"\
          : ${QueryQueueWaitSeconds},\n  \"ForgetQueueWaitSeconds\": ${ForgetQueueWaitSeconds}\n\
          }\n"
      Description: SSM Parameter for S3F2 configuration.
  CognitoUserPoolUser:
    Type: AWS::Cognito::UserPoolUser
    Condition: ShouldDeployCognito
    DependsOn:
    - APIStack
    - DDBStack
    - DelStack
    - DeployStack
    - LayersStack
    - StateMachineStack
    - StreamProcessorStack
    - WebUIStack
    Properties:
      Username:
        Ref: AdminEmail
      UserPoolId:
        Fn::GetAtt:
        - AuthStack
        - Outputs.CognitoUserPoolId
      DesiredDeliveryMediums:
      - EMAIL
      UserAttributes:
      - Name: email
        Value:
          Ref: AdminEmail
      - Name: email_verified
        Value: 'true'
  APIStack:
    Type: AWS::CloudFormation::Stack
    Properties:
      TemplateURL: https://s3.amazonaws.com/solution-builders-us-east-1/amazon-s3-find-and-forget/v0.68/82a9c463ac33aee87ac12cac380e453c.template
      Parameters:
        AccessControlAllowOriginOverride:
          Ref: AccessControlAllowOriginOverride
        ConfigParameter:
          Ref: ConfigParameter
        CognitoUserPoolArn:
          Fn::If:
          - ShouldDeployCognito
          - Fn::GetAtt:
            - AuthStack
            - Outputs.CognitoUserPoolArn
          - none
        CommonLayers:
          Fn::Join:
          - ','
          - - Fn::GetAtt:
              - LayersStack
              - Outputs.AWSSDKLayer
            - Fn::GetAtt:
              - LayersStack
              - Outputs.Decorators
            - Fn::GetAtt:
              - LayersStack
              - Outputs.BotoUtils
        DeletionQueueTableName:
          Fn::GetAtt:
          - DDBStack
          - Outputs.DeletionQueueTable
        DataMapperTableName:
          Fn::GetAtt:
          - DDBStack
          - Outputs.DataMapperTable
        EnableAccessLogging:
          Ref: EnableAPIAccessLogging
        JobTableDateGSI:
          Fn::GetAtt:
          - DDBStack
          - Outputs.JobTableDateGSI
        JobTableName:
          Fn::GetAtt:
          - DDBStack
          - Outputs.JobTable
        LambdaAPIMemorySize:
          Ref: LambdaAPIMemorySize
        WebUIOrigin:
          Fn::If:
          - ShouldDeployWebUI
          - Fn::GetAtt:
            - WebUIStack
            - Outputs.Origin
          - none
        DeployCognito:
          Fn::If:
          - ShouldDeployCognito
          - 'true'
          - 'false'
  AuthStack:
    Type: AWS::CloudFormation::Stack
    Condition: ShouldDeployCognito
    Properties:
      TemplateURL: https://s3.amazonaws.com/solution-builders-us-east-1/amazon-s3-find-and-forget/v0.68/854dcfb905e171f2f0e3abf085bed367.template
      Parameters:
        CognitoAdvancedSecurity:
          Ref: CognitoAdvancedSecurity
        ResourcePrefix:
          Ref: ResourcePrefix
  DDBStack:
    Type: AWS::CloudFormation::Stack
    Properties:
      TemplateURL: https://s3.amazonaws.com/solution-builders-us-east-1/amazon-s3-find-and-forget/v0.68/da8a114623875c478cbcca7faf7c9112.template
      Parameters:
        EnableBackups:
          Ref: EnableDynamoDBBackups
        RetainTables:
          Ref: RetainDynamoDBTables
  DelStack:
    Type: AWS::CloudFormation::Stack
    Properties:
      TemplateURL: https://s3.amazonaws.com/solution-builders-us-east-1/amazon-s3-find-and-forget/v0.68/bde8936be080e421f99feb287f754422.template
      Parameters:
        CommonLayers:
          Fn::Join:
          - ','
          - - Fn::GetAtt:
              - LayersStack
              - Outputs.AWSSDKLayer
            - Fn::GetAtt:
              - LayersStack
              - Outputs.BotoUtils
            - Fn::GetAtt:
              - LayersStack
              - Outputs.CustomResourceHelper
            - Fn::GetAtt:
              - LayersStack
              - Outputs.Decorators
        DeletionTaskCPU:
          Ref: DeletionTaskCPU
        DeletionTaskMemory:
          Ref: DeletionTaskMemory
        EnableContainerInsights:
          Ref: EnableContainerInsights
        JobTableName:
          Fn::GetAtt:
          - DDBStack
          - Outputs.JobTable
        KMSKeyArns:
          Ref: KMSKeyArns
        ManifestsBucket:
          Fn::GetAtt:
          - ManifestsStack
          - Outputs.ManifestsBucket
        ResourcePrefix:
          Ref: ResourcePrefix
        VpcSecurityGroups:
          Fn::If:
          - ShouldDeployVpc
          - Fn::GetAtt:
            - VpcStack
            - Outputs.SecurityGroup
          - Fn::Join:
            - ','
            - Ref: VpcSecurityGroups
        VpcSubnets:
          Fn::If:
          - ShouldDeployVpc
          - Fn::GetAtt:
            - VpcStack
            - Outputs.Subnets
          - Fn::Join:
            - ','
            - Ref: VpcSubnets
  DeployStack:
    Type: AWS::CloudFormation::Stack
    Properties:
      TemplateURL: https://s3.amazonaws.com/solution-builders-us-east-1/amazon-s3-find-and-forget/v0.68/291d070313cb9eb238d751e2ff544b91.template
      Parameters:
        ApiUrl:
          Fn::GetAtt:
          - APIStack
          - Outputs.ApiUrl
        AthenaExecutionRole:
          Fn::GetAtt:
          - StateMachineStack
          - Outputs.AthenaExecutionRole
        CloudFrontDistribution:
          Fn::If:
          - ShouldDeployWebUI
          - Fn::GetAtt:
            - WebUIStack
            - Outputs.CloudFrontDistribution
          - none
        CodeBuildArtefactBucket:
          Ref: TempBucket
        CognitoIdentityPoolId:
          Fn::If:
          - ShouldDeployCognito
          - Fn::GetAtt:
            - AuthStack
            - Outputs.CognitoIdentityPoolId
          - none
        CognitoUserPoolId:
          Fn::If:
          - ShouldDeployCognito
          - Fn::GetAtt:
            - AuthStack
            - Outputs.CognitoUserPoolId
          - none
        CognitoUserPoolClientId:
          Fn::If:
          - ShouldDeployCognito
          - Fn::GetAtt:
            - AuthStack
            - Outputs.CognitoUserPoolClientId
          - none
        CommonLayers:
          Fn::Join:
          - ','
          - - Fn::GetAtt:
              - LayersStack
              - Outputs.AWSSDKLayer
            - Fn::GetAtt:
              - LayersStack
              - Outputs.BotoUtils
            - Fn::GetAtt:
              - LayersStack
              - Outputs.CustomResourceHelper
            - Fn::GetAtt:
              - LayersStack
              - Outputs.Decorators
        DeployWebUI:
          Ref: DeployWebUI
        DeployCognito:
          Fn::If:
          - ShouldDeployCognito
          - 'true'
          - 'false'
        ECRRepository:
          Fn::GetAtt:
          - DelStack
          - Outputs.ECRRepository
        PreBuiltArtefactsBucket:
          Fn::If:
          - DefaultPreBuiltArtefactsBucket
          - Fn::Sub: solution-builders-${AWS::Region}
          - Ref: PreBuiltArtefactsBucketOverride
        ResourcePrefix:
          Ref: ResourcePrefix
        Version:
          Fn::FindInMap:
          - Solution
          - Constants
          - Version
        WebUIBucket:
          Fn::GetAtt:
          - WebUIStack
          - Outputs.WebUIBucket
  LayersStack:
    Type: AWS::CloudFormation::Stack
    Properties:
      TemplateURL: https://s3.amazonaws.com/solution-builders-us-east-1/amazon-s3-find-and-forget/v0.68/92c4bb0a7482df6a3367cfbb442d6159.template
  ManifestsStack:
    Type: AWS::CloudFormation::Stack
    Properties:
      TemplateURL: https://s3.amazonaws.com/solution-builders-us-east-1/amazon-s3-find-and-forget/v0.68/0f37fb22d1f1881e4cf1cf717182f23f.template
      Parameters:
        JobDetailsRetentionDays:
          Ref: JobDetailsRetentionDays
  StateMachineStack:
    Type: AWS::CloudFormation::Stack
    Properties:
      TemplateURL: https://s3.amazonaws.com/solution-builders-us-east-1/amazon-s3-find-and-forget/v0.68/61e87f3b68694942307da2e50dd33880.template
      Parameters:
        AthenaWorkGroup:
          Ref: AthenaWorkGroup
        CommonLayers:
          Fn::Join:
          - ','
          - - Fn::GetAtt:
              - LayersStack
              - Outputs.AWSSDKLayer
            - Fn::GetAtt:
              - LayersStack
              - Outputs.Decorators
            - Fn::GetAtt:
              - LayersStack
              - Outputs.BotoUtils
        DataMapperTableName:
          Fn::GetAtt:
          - DDBStack
          - Outputs.DataMapperTable
        DeleteServiceName:
          Fn::GetAtt:
          - DelStack
          - Outputs.DeleteServiceName
        DeleteQueueUrl:
          Fn::GetAtt:
          - DelStack
          - Outputs.DeleteObjectsQueueUrl
        DeletionQueueTableName:
          Fn::GetAtt:
          - DDBStack
          - Outputs.DeletionQueueTable
        ECSCluster:
          Fn::GetAtt:
          - DelStack
          - Outputs.ECSCluster
        GlueDatabase:
          Fn::GetAtt:
          - ManifestsStack
          - Outputs.GlueDatabase
        JobManifestsGlueTable:
          Fn::GetAtt:
          - ManifestsStack
          - Outputs.JobManifestsGlueTable
        JobTableName:
          Fn::GetAtt:
          - DDBStack
          - Outputs.JobTable
        LambdaJobsMemorySize:
          Ref: LambdaJobsMemorySize
        ManifestsBucket:
          Fn::GetAtt:
          - ManifestsStack
          - Outputs.ManifestsBucket
        ResultBucket:
          Ref: TempBucket
        StateMachinePrefix:
          Ref: ResourcePrefix
  StreamProcessorStack:
    Type: AWS::CloudFormation::Stack
    Properties:
      TemplateURL: https://s3.amazonaws.com/solution-builders-us-east-1/amazon-s3-find-and-forget/v0.68/eef17ca292c0ea53c0f56142e495639f.template
      Parameters:
        CommonLayers:
          Fn::Join:
          - ','
          - - Fn::GetAtt:
              - LayersStack
              - Outputs.AWSSDKLayer
            - Fn::GetAtt:
              - LayersStack
              - Outputs.Decorators
            - Fn::GetAtt:
              - LayersStack
              - Outputs.BotoUtils
        DeletionQueueTableName:
          Fn::GetAtt:
          - DDBStack
          - Outputs.DeletionQueueTable
        GlueDatabase:
          Fn::GetAtt:
          - ManifestsStack
          - Outputs.GlueDatabase
        JobManifestsGlueTable:
          Fn::GetAtt:
          - ManifestsStack
          - Outputs.JobManifestsGlueTable
        JobTableDateGSI:
          Fn::GetAtt:
          - DDBStack
          - Outputs.JobTableDateGSI
        JobTableName:
          Fn::GetAtt:
          - DDBStack
          - Outputs.JobTable
        JobTableStreamArn:
          Fn::GetAtt:
          - DDBStack
          - Outputs.JobTableStreamArn
        LambdaJobsMemorySize:
          Ref: LambdaJobsMemorySize
        ManifestsBucket:
          Fn::GetAtt:
          - ManifestsStack
          - Outputs.ManifestsBucket
        StateMachineArn:
          Fn::GetAtt:
          - StateMachineStack
          - Outputs.StateMachineArn
  VpcStack:
    Type: AWS::CloudFormation::Stack
    Condition: ShouldDeployVpc
    Properties:
      TemplateURL: https://s3.amazonaws.com/solution-builders-us-east-1/amazon-s3-find-and-forget/v0.68/12196cacecf2051fb732e0f33971d641.template
      Parameters:
        FlowLogsGroup:
          Ref: FlowLogsGroup
        FlowLogsRoleArn:
          Ref: FlowLogsRoleArn
        KMSKeyArns:
          Ref: KMSKeyArns
        CommonLayers:
          Fn::Join:
          - ','
          - - Fn::GetAtt:
              - LayersStack
              - Outputs.AWSSDKLayer
            - Fn::GetAtt:
              - LayersStack
              - Outputs.BotoUtils
            - Fn::GetAtt:
              - LayersStack
              - Outputs.CustomResourceHelper
            - Fn::GetAtt:
              - LayersStack
              - Outputs.Decorators
  WebUIStack:
    Type: AWS::CloudFormation::Stack
    Properties:
      TemplateURL: https://s3.amazonaws.com/solution-builders-us-east-1/amazon-s3-find-and-forget/v0.68/e2f616b3fc9efd2bdf12f9acdd260be1.template
      Parameters:
        AccessLogsBucket:
          Ref: AccessLogsBucket
        CreateCloudFrontDistribution:
          Ref: CreateCloudFrontDistribution
        DeployWebUI:
          Ref: DeployWebUI
        ResourcePrefix:
          Ref: ResourcePrefix
Outputs:
  APIAccessControlAllowOriginHeader:
    Value:
      Fn::GetAtt:
      - APIStack
      - Outputs.AccessControlAllowOriginHeader
  APIStack:
    Value:
      Ref: APIStack
  ApiUrl:
    Value:
      Fn::GetAtt:
      - APIStack
      - Outputs.ApiUrl
    Export:
      Name:
        Fn::Sub: ${ResourcePrefix}-ApiUrl
  ApiArn:
    Value:
      Fn::GetAtt:
      - APIStack
      - Outputs.ApiArn
  AthenaStateMachineArn:
    Value:
      Fn::GetAtt:
      - StateMachineStack
      - Outputs.AthenaStateMachineArn
  AthenaExecutionRoleArn:
    Value:
      Fn::GetAtt:
      - StateMachineStack
      - Outputs.AthenaExecutionRoleArn
  AuthMethod:
    Value:
      Ref: AuthMethod
  ConfigParameter:
    Value:
      Ref: ConfigParameter
  CognitoUserPoolClientId:
    Value:
      Fn::If:
      - ShouldDeployCognito
      - Fn::GetAtt:
        - AuthStack
        - Outputs.CognitoUserPoolClientId
      - none
  CognitoUserPoolId:
    Value:
      Fn::If:
      - ShouldDeployCognito
      - Fn::GetAtt:
        - AuthStack
        - Outputs.CognitoUserPoolId
      - none
  CognitoUserPoolName:
    Value:
      Fn::If:
      - ShouldDeployCognito
      - Fn::GetAtt:
        - AuthStack
        - Outputs.CognitoUserPoolName
      - none
  DataMapperTable:
    Value:
      Fn::GetAtt:
      - DDBStack
      - Outputs.DataMapperTable
  DDBStack:
    Value:
      Ref: DDBStack
  DeleteTaskRoleArn:
    Value:
      Fn::GetAtt:
      - DelStack
      - Outputs.DeleteTaskRoleArn
  DeletionQueueTable:
    Value:
      Fn::GetAtt:
      - DDBStack
      - Outputs.DeletionQueueTable
  DeletionQueueTableStreamArn:
    Value:
      Fn::GetAtt:
      - DDBStack
      - Outputs.DeletionQueueTableStreamArn
    Export:
      Name:
        Fn::Sub: ${ResourcePrefix}-DeletionQueueTableStreamArn
  DeletionQueueUrl:
    Value:
      Fn::GetAtt:
      - DelStack
      - Outputs.DeleteObjectsQueueUrl
  DeployWebUI:
    Value:
      Ref: DeployWebUI
  DLQUrl:
    Value:
      Fn::GetAtt:
      - DelStack
      - Outputs.DLQUrl
  ECRRepository:
    Value:
      Fn::GetAtt:
      - DelStack
      - Outputs.ECRRepository
  GenerateQueriesRole:
    Value:
      Fn::GetAtt:
      - StateMachineStack
      - Outputs.GenerateQueriesRole
  JobTable:
    Value:
      Fn::GetAtt:
      - DDBStack
      - Outputs.JobTable
  KMSKeyArns:
    Value:
      Ref: KMSKeyArns
  PutDataMapperRole:
    Value:
      Fn::GetAtt:
      - APIStack
      - Outputs.PutDataMapperRole
  QueryQueueUrl:
    Value:
      Fn::GetAtt:
      - StateMachineStack
      - Outputs.QueryQueueUrl
  SolutionVersion:
    Value:
      Fn::FindInMap:
      - Solution
      - Constants
      - Version
  StateMachineArn:
    Value:
      Fn::GetAtt:
      - StateMachineStack
      - Outputs.StateMachineArn
  StateMachineRoleArn:
    Value:
      Fn::GetAtt:
      - StateMachineStack
      - Outputs.StateMachineRoleArn
  TempBucket:
    Value:
      Ref: TempBucket
  WebUIBucket:
    Value:
      Fn::GetAtt:
      - WebUIStack
      - Outputs.WebUIBucket
  WebUIRole:
    Value:
      Fn::If:
      - ShouldDeployCognito
      - Fn::GetAtt:
        - AuthStack
        - Outputs.ServiceInvokeRole
      - none
  WebUIUrl:
    Value:
      Fn::If:
      - ShouldDeployWebUI
      - Fn::GetAtt:
        - WebUIStack
        - Outputs.Url
      - none
Metadata:
  AWS::CloudFormation::Interface:
    ParameterGroups:
    - Label:
        default: Required
      Parameters:
      - AdminEmail
      - DeployWebUI
      - AuthMethod
    - Label:
        default: Network Configuration
      Parameters:
      - DeployVpc
      - VpcSecurityGroups
      - VpcSubnets
      - FlowLogsGroup
      - FlowLogsRoleArn
      - CreateCloudFrontDistribution
      - AccessControlAllowOriginOverride
    - Label:
        default: Performance Configuration
      Parameters:
      - AthenaConcurrencyLimit
      - AthenaQueryMaxRetries
      - DeletionTasksMaxNumber
      - DeletionTaskCPU
      - DeletionTaskMemory
      - LambdaAPIMemorySize
      - LambdaJobsMemorySize
    - Label:
        default: Waiter Configuration
      Parameters:
      - QueryExecutionWaitSeconds
      - QueryQueueWaitSeconds
      - ForgetQueueWaitSeconds
    - Label:
        default: Auditing, Logging & Monitoring
      Parameters:
      - AccessLogsBucket
      - CognitoAdvancedSecurity
      - EnableAPIAccessLogging
      - EnableContainerInsights
      - JobDetailsRetentionDays
    - Label:
        default: Advanced Configuration
      Parameters:
      - EnableDynamoDBBackups
      - RetainDynamoDBTables
      - AthenaWorkGroup
      - PreBuiltArtefactsBucketOverride
      - ResourcePrefix
      - KMSKeyArns
