template.yaml

AWSTemplateFormatVersion: "2010-09-09"
Description: "Create custom file processing step function for outbound file transfers using SFTP connectors"

Resources:

### Build Resources ###

  # Private ECR Repository to host Docker image that performs PGP encryption
  ECRRepo:
    Type: AWS::ECR::Repository
    Properties:
      EmptyOnDelete: true

  # Code Build Project role
  CodeBuildRole:
    Type: 'AWS::IAM::Role'
    Properties:
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: 'Allow'
            Principal:
              Service:
                - 'codebuild.amazonaws.com'
            Action:
              - 'sts:AssumeRole'
      ManagedPolicyArns:
        - 'arn:aws:iam::aws:policy/CloudWatchFullAccess'
      Policies:
        - PolicyName: 'ECRPolicy'
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Effect: 'Allow'
                Action:
                  - 'ecr:BatchCheckLayerAvailability'
                  - 'ecr:CompleteLayerUpload'
                  - 'ecr:InitiateLayerUpload'
                  - 'ecr:PutImage'
                  - 'ecr:UploadLayerPart'
                Resource:
                  - !GetAtt ECRRepo.Arn
              - Effect: 'Allow'
                Action:
                  - 'ecr:GetAuthorizationToken'
                Resource:
                  - '*'

  # Code Build Project to build Docker image that performs PGP encryption and push image to ECR
  CodeBuildProject:
    Type: AWS::CodeBuild::Project
    Properties:
      Source:
        Type: GITHUB
        Location: https://github.com/aws-samples/build-event-driven-managed-file-transfer-architectures-using-aws-transfer-family.git
        BuildSpec: 
          !Sub
            - |
              version: 0.2

              phases:
                pre_build:
                  commands:
                    - aws ecr get-login-password --region ${AWS::Region} | docker login --username AWS --password-stdin ${AWS::AccountId}.dkr.ecr.${AWS::Region}.amazonaws.com
                build:
                  commands:
                    - cd SFTP-Connectors/Send-Files
                    - docker build -t ${ECRRepo} .
                    - docker tag ${ECRRepo}:latest ${AWS::AccountId}.dkr.ecr.${AWS::Region}.amazonaws.com/${ECRRepo}:latest  
                post_build:
                  commands:
                    - docker push ${AWS::AccountId}.dkr.ecr.${AWS::Region}.amazonaws.com/${ECRRepo}:latest
            - {ECRRepo: !Ref ECRRepo}
      Environment:
        Type: LINUX_CONTAINER
        Image: aws/codebuild/standard:2.0
        ComputeType: BUILD_GENERAL1_SMALL
      ServiceRole: !GetAtt CodeBuildRole.Arn
      Artifacts:
        Type: NO_ARTIFACTS

### S3 Buckets ###

  # S3 Bucket that files will be uploaded to for outbound PGP encryption
  # (Bucket that starts the process when a file is uploaded) 
  LandingS3Bucket:
    Type: AWS::S3::Bucket
    Properties:
      BucketEncryption:
        ServerSideEncryptionConfiguration:
          - ServerSideEncryptionByDefault:
              SSEAlgorithm: AES256
      NotificationConfiguration:
        EventBridgeConfiguration:
          EventBridgeEnabled: true

  # S3 Bucket to temporarily store encrypted files before transferring them to remote SFTP server
  # (Where encrypted file is uploaded too, and then transferred out to remote SFTP server using connector)
  OutboundTransferS3Bucket:
    Type: AWS::S3::Bucket
    Properties:
      BucketEncryption:
        ServerSideEncryptionConfiguration:
          - ServerSideEncryptionByDefault:
              SSEAlgorithm: AES256

  # S3 Bucket to be used by Transfer Family server
  SFTPServerS3Bucket:
    Type: AWS::S3::Bucket
    Properties:
      Tags:
        - Key: Name
          Value: SFTP-Connector-Test-Server-S3-Bucket
      BucketEncryption:
        ServerSideEncryptionConfiguration:
          - ServerSideEncryptionByDefault:
              SSEAlgorithm: AES256

### SNS Topic ###

  # SNS Topic to send a message in case of a failed file transfer
  SNSTopic:
    Type: "AWS::SNS::Topic"
    Properties:
      DisplayName: "FailedSFTPConnectorTransferNotification"
      TopicName: "step-notification-failure"

### EventBridge ###

  # EventBridge rule to invoke step function once file is uploaded to LandingS3Bucket
  InvokeStepFunctionEventBridgeRule:
    Type: AWS::Events::Rule
    Properties:
      Description: Rule to invoke step function for SFTP connectors
      EventBusName: default
      EventPattern:
        source:
          - aws.s3
        detail-type:
          - Object Created
        detail:
          bucket:
            name:
              - !Ref LandingS3Bucket
      Name: s3-event-invoke-step-function
      State: ENABLED
      Targets:
        - Id: sftp-connectors-pgp-encryption-step-function
          Arn: !Ref CustomFileProcessingStateMachine
          RoleArn: !GetAtt EventBridgeInvokeStateMachineRole.Arn

  # EventBridge rule to publish SFTP Connector Transfer outbound file transfer status to SQS
  SFTPConnectorEventsToSQS:
    Type: "AWS::Events::Rule"
    Properties:
        Name: sftp-connector-events-to-sqs
        Description: Publish SFTP connector events to sqs
        EventPattern: "{\"source\":[\"aws.transfer\"],\"detail-type\":[\"SFTP Connector File Send Completed\",\"SFTP Connector File Send Failed\"]}"
        State: "ENABLED"
        Targets: 
          - 
            Id: "push-to-sqs"
            Arn: !GetAtt SFTPConnectorTransferQueue.Arn
        EventBusName: "default"

  # Event source mapping to invoke ReportFileTransferStatusLambdaFunction whenever new file transfer event is added to the SQS queue
  LambdaEventSourceMapping:
    Type: "AWS::Lambda::EventSourceMapping"
    Properties:
        EventSourceArn: !GetAtt SFTPConnectorTransferQueue.Arn
        FunctionName: !GetAtt ReportFileTransferStatusLambdaFunction.Arn
        Enabled: true

### DynamoDB Tables ###

  # DynamoDB Table to store custom processing job information 
  CustomFileProcessingTable:
    Type: AWS::DynamoDB::Table
    Properties:
      AttributeDefinitions: 
        - 
          AttributeName: "partnerId"
          AttributeType: "S"
      BillingMode: "PAY_PER_REQUEST"
      KeySchema: 
        - 
          AttributeName: "partnerId"
          KeyType: "HASH"

  # DynamoDB Table to store SFTP Connector Transfer information
  SFTPConnectorsTransfersTable:
    Type: AWS::DynamoDB::Table
    Properties:
      AttributeDefinitions: 
        - 
          AttributeName: "transfer-id"
          AttributeType: "S"
      BillingMode: "PAY_PER_REQUEST"
      TimeToLiveSpecification:
          AttributeName: 'expireAt'
          Enabled: true
      KeySchema: 
        - 
          AttributeName: "transfer-id"
          KeyType: "HASH"

### SQS Queue ###

  # SQS Queue which holds SFTP connector outbound transfer information
  SFTPConnectorTransferQueue:
    Type: "AWS::SQS::Queue"
    Properties:
      DelaySeconds: "0"
      MaximumMessageSize: "262144"
      MessageRetentionPeriod: "345600"
      ReceiveMessageWaitTimeSeconds: "0"
      VisibilityTimeout: "30"

  # Allow EventBridge to invoke SQS
  EventBridgeToToSqsPolicy:
    Type: AWS::SQS::QueuePolicy
    Properties:
      PolicyDocument:
        Statement:
        - Effect: Allow
          Principal:
            Service: events.amazonaws.com
          Action: SQS:SendMessage
          Resource:  !GetAtt SFTPConnectorTransferQueue.Arn
      Queues:
        - !Ref SFTPConnectorTransferQueue

### Secrets Manager Example Secret ###

  # Example PGP Public Key Secret to be used for outbound PGP encryption process
  PartnerExampleSecret:
    Type: "AWS::SecretsManager::Secret"
    Properties:
      Name: "aws/transfer/connector-partner_01"
      SecretString: '{"Username":"testuser","PrivateKey":"PASTE-SSH-PRIVATE-KEY-HERE","PGPPublicKey":"PASTE-PGP-PUBLIC-KEY-HERE"}'

### Lambda Execution Roles ###

  # IAM Policy to allow various AWS services to log events to CloudWatch logs
  LogsPolicy:
    Type: AWS::IAM::ManagedPolicy
    Properties:
      Path: /
      PolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: 'Allow'
            Action:
              - 'logs:CreateLogGroup'
              - 'logs:CreateLogStream'
              - 'logs:PutLogEvents'
            Resource: 'arn:aws:logs:*:*:*'

  # Encrypt Lambda Function IAM Execution Role
  PGPEncryptionLambdaExecutionRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - lambda.amazonaws.com
            Action:
              - 'sts:AssumeRole'
      Description: Role for PGP Encryption Lambda function
      ManagedPolicyArns:
        - !GetAtt LogsPolicy.PolicyArn
        - arn:aws:iam::aws:policy/service-role/AmazonEC2ContainerServiceEventsRole
      Policies:
        - PolicyName: PGPEncryptionLambdaPolicy
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
            - Effect: Allow
              Action:
                - ecr:GetAuthorizationToken
                - ecr:BatchCheckLayerAvailability
                - ecr:GetDownloadUrlForLayer
                - ecr:BatchGetImage
              Resource: !GetAtt ECRRepo.Arn
            - Effect: Allow
              Action:
                - 's3:Get*'
                - 's3:Put*'
              Resource: 
                - !Sub "arn:aws:s3:::${OutboundTransferS3Bucket}/*"
                - !Sub "arn:aws:s3:::${LandingS3Bucket}/*"
            - Effect: Allow
              Action:
                - 'secretsmanager:GetSecretValue'
              Resource: !Ref PartnerExampleSecret

  # Report File Status Lambda Function IAM Execution Role
  ReportFileTransferStatusExecutionRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - lambda.amazonaws.com
            Action:
              - 'sts:AssumeRole'
      Description: Role for Report File Status Lambda function
      ManagedPolicyArns:
        - !GetAtt LogsPolicy.PolicyArn
      Policies:
        - PolicyName: SQSAccessPolicy
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
            - Effect: Allow
              Action:
                - 'sqs:*'
              Resource: !GetAtt SFTPConnectorTransferQueue.Arn
        - PolicyName: DynamoDBAccess
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
            - Effect: Allow
              Action:
                - 'dynamodb:GetItem'
              Resource: !GetAtt SFTPConnectorsTransfersTable.Arn
        - PolicyName: StepFunctionAccess
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
            - Effect: Allow
              Action:
                - 'states:SendTask*'
              Resource: !GetAtt CustomFileProcessingStateMachine.Arn

  # Put Records in DynamoDB Lambda Function IAM Execution Role
  PutRecordsDynamoDBExecutionRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - lambda.amazonaws.com
            Action:
              - 'sts:AssumeRole'
      Description: Role for putting records into DynamoDB Lambda function
      ManagedPolicyArns:
        - !GetAtt LogsPolicy.PolicyArn
      Policies:
        - PolicyName: DynamoDBAccess
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
            - Effect: Allow
              Action:
                - "dynamodb:PutItem"
              Resource: !GetAtt SFTPConnectorsTransfersTable.Arn

  # Parse Input Lambda Function IAM Execution Role
  GetPartnerParametersLambdaExecutionRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - lambda.amazonaws.com
            Action:
              - 'sts:AssumeRole'
      Description: Role for Parse Input Lambda Function
      ManagedPolicyArns:
        - !GetAtt LogsPolicy.PolicyArn
      Policies:
        - PolicyName: DynamoDBReadAccess
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
            - Effect: Allow
              Action:
                - "dynamodb:GetItem"
              Resource: !GetAtt CustomFileProcessingTable.Arn

  # Convert CSV to JSON Lambda Function Execution Role
  CSVtoJSONLambdaExecutionRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - lambda.amazonaws.com
            Action:
              - 'sts:AssumeRole'
      Description: Role for CSV to JSON Lambda Function
      ManagedPolicyArns:
        - !GetAtt LogsPolicy.PolicyArn
      Policies:
        - PolicyName: CSVtoJSONPolicy
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
            - Effect: Allow
              Action:
                - 's3:Get*'
                - 's3:Put*'
                - 's3:ListBucket*'
              Resource: 
                - !Sub "arn:aws:s3:::${OutboundTransferS3Bucket}/*"
                - !Sub "arn:aws:s3:::${LandingS3Bucket}/*"
                - !Sub "arn:aws:s3:::${LandingS3Bucket}"

  # Delete S3 Object Lambda Function Execution Role
  DeleteS3ObjectLambdaExecutionRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - lambda.amazonaws.com
            Action:
              - 'sts:AssumeRole'
      Description: Role for Delete S3 Object Lambda Function
      ManagedPolicyArns:
        - !GetAtt LogsPolicy.PolicyArn
      Policies:
        - PolicyName: DeleteS3ObjectPolicy
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
            - Effect: Allow
              Action:
                - 's3:DeleteObject'
              Resource: 
                - !Sub "arn:aws:s3:::${OutboundTransferS3Bucket}/*"
                - !Sub "arn:aws:s3:::${LandingS3Bucket}/*"

### Lambda Functions ###

  # PGP Encryption Lambda Function - Runs Docker image created by CodeBuild project
  EncryptLambdaFunction:
    Type: "AWS::Lambda::Function"
    Properties:
      Code:
        ImageUri: !Sub "${AWS::AccountId}.dkr.ecr.${AWS::Region}.amazonaws.com/${ECRRepo}:latest"
      PackageType: Image
      Role: !GetAtt PGPEncryptionLambdaExecutionRole.Arn
      Timeout: 30
    DependsOn:
      - BuildCodeCustomResource

  # Lambda Function which puts transfer-id and step function task-token into DynamoDB table, sets TTL to delete items after 12 hours
  PutRecordsDynamoDBLambdaFunction:
    Type: "AWS::Lambda::Function"
    Properties:
      Description: "Puts transfer-id and step function task-token into DynamoDB table"
      Handler: "index.lambda_handler"
      Architectures: 
        - "x86_64"
      Environment:
        Variables:
          TableName: !Ref SFTPConnectorsTransfersTable   
      Code:
        ZipFile: |
          import boto3
          import botocore
          from botocore.exceptions import ClientError
          import json
          import os
          from datetime import datetime, timedelta

          def lambda_handler(event, context):
              dynamodb = boto3.resource('dynamodb')
              tablename = os.environ['TableName']
              table = dynamodb.Table(tablename)
              print(json.dumps(event))
              transfer_id = event["Event"]["TransferId"]
              taskToken = event["TaskToken"]
              # Calculate the TTL (12 hours from now)
              future_time = datetime.now() + timedelta(hours=12)
              ttl_timestamp = int(future_time.timestamp())
              item_data = {
                  'transfer-id': transfer_id,
                  'task-token': taskToken,
                  'expireAt': str(ttl_timestamp)
                  }
              # Put the item into the table
              try:
                  table.put_item(Item=item_data)
              except ClientError as error:
                  print(error)
                  return {
                      'statusCode': 500,
                      'body': 'Error putting item in DynamoDB: {}'.format(error)
                  }
              return {
                  'statusCode': 200
              }
      MemorySize: 128
      Role: !GetAtt PutRecordsDynamoDBExecutionRole.Arn
      Runtime: "python3.12"
      Timeout: 30
      TracingConfig: 
        Mode: "PassThrough"
      EphemeralStorage: 
        Size: 512

  # Lambda Function which resumes the step function from wait state, and reports if the SFTP connector outbound transfer succeeded or failed
  ReportFileTransferStatusLambdaFunction:
    Type: "AWS::Lambda::Function"
    Properties:
      Description: "Resumes the step function from wait state, and reports if the SFTP connector outbound transfer succeeded or failed"
      Handler: "index.lambda_handler"
      Architectures: 
        - "x86_64"
      Environment:
        Variables:
          TableName: !Ref SFTPConnectorsTransfersTable   
      Code:
        ZipFile: |
          import boto3
          import botocore
          from botocore.exceptions import ClientError
          import json
          import os

          def lambda_handler(event, context):
              # Extract data from the first SQS record
              message = json.loads(event['Records'][0]['body'])
              detail = message['detail']
              # Parse transfer ID and status code
              transfer_id = detail['transfer-id']
              status_code = detail['status-code']
              # Check DynamoDB for record
              dynamodb = boto3.resource("dynamodb")
              tablename = os.environ['TableName']
              table = dynamodb.Table(tablename)
              try:
                  response = table.get_item(Key={"transfer-id": transfer_id})
                  if "Item" in response:
                      item = response["Item"]
                      if status_code == "COMPLETED":
                          # Send task success
                          stepfunctions = boto3.client("stepfunctions")
                          task_token = item["task-token"] 
                          stepfunctions.send_task_success(
                              taskToken=task_token,
                              output = event['Records'][0]['body'])
                          # Delete SQS message if successful
                          sqs = boto3.client("sqs")
                          queue_url = event['Records'][0]['eventSourceARN']  # Extract queue URL from event ARN
                          receipt_handle = event['Records'][0]['receiptHandle']
                          sqs.delete_message(QueueUrl=queue_url, ReceiptHandle=receipt_handle)
                          return {
                              "statusCode": 200,
                              "body": "Task success sent and SQS message deleted for transfer ID: " + transfer_id
                          }
                      else:
                          # If file transfer was not successful, send failure status back to step function
                          stepfunctions.send_task_failure(
                              taskToken=task_token,
                              error = event['Records'][0]['body'],
                              cause = 'File transfer not completed'
                              )
                          # After reporting failure back to step function, delete message from SQS queue
                          sqs.delete_message(QueueUrl=queue_url, ReceiptHandle=receipt_handle)
                          return {
                              "statusCode": 200,
                              "body": "Transfer ID found but status code not COMPLETED"
                          }
                  else:
                      return {
                          "statusCode": 404,
                          "body": "Transfer ID not found in DynamoDB"
                      }
              except ClientError as error:
                  print(f"Error accessing DynamoDB: {error}")
                  return {
                      "statusCode": 500,
                      "body": "Error processing request"
                  }
      MemorySize: 128
      Role: !GetAtt ReportFileTransferStatusExecutionRole.Arn
      Runtime: "python3.12"
      Timeout: 30
      TracingConfig: 
        Mode: "PassThrough"
      EphemeralStorage: 
        Size: 512

  # Lambda function that deletes the originally uploaded file after file transfer process has completed successfully
  DeleteFileLambdaFunction:
    Type: "AWS::Lambda::Function"
    Properties:
      Description: "Deletes the originally uploaded file after file transfer process has completed successfully"
      Handler: "index.lambda_handler"
      Architectures: 
        - "x86_64"
      Code:
        ZipFile: |
          import json
          import boto3
          import time
          import urllib.parse
          import botocore
          from botocore.exceptions import ClientError

          # Declare global clients
          s3_client = boto3.client('s3')
          def delete_object(bucket, key):
              try:
                  print(f'Trying deleting key {key} from bucket {bucket}')
                  response = s3_client.delete_object(
                      Bucket=bucket,
                      Key=key
                  )
                  print(json.dumps(response))
                  print(f'Object {key} in bucket {bucket} deleted successfully')
              except ClientError as e:
                  print(json.dumps(e.response))
                  statusCode = e.response['ResponseMetadata']['HTTPStatusCode']
                  errorCode = e.response['Error']['Code']
                  errorMessage = e.response['Error']['Message']
                  body = {
                      'errorCode': errorCode,
                      'errorMessage': errorMessage
                  }
                  return {
                      'statusCode': statusCode,
                      'body': body
                  }
          def lambda_handler(event, context):
              print(json.dumps(event))
              # Get variables from event
              if 'Encrypt' in event:
                  key = event['Encrypt']['body']['key']
                  bucket = event['Encrypt']['body']['bucket']
                  print(f'Found output of encrypt step {key} in bucket {bucket}')
                  delete_object(bucket, key)
              if 'CustomStep' in event:
                  key = event['CustomStep']['body']['key']
                  bucket = event['CustomStep']['body']['bucket']
                  print(f'Found output of custom step {key} in bucket {bucket}')
                  delete_object(bucket, key)
              if 'fileLocation' in event:
                  key = event['fileLocation']['key']
                  bucket = event['fileLocation']['bucket']
                  print(f'Cleaning up source file {key} in bucket {bucket}')
                  delete_object(bucket, key)
              else:
                  key = event['key']
                  bucket = event['bucket']
                  print(f'Cleaning up source file {key} in bucket {bucket}')
                  delete_object(bucket, key)
              return {
                  'statusCode': 200,
                  'body': ''
              }
      MemorySize: 128
      Role: !GetAtt DeleteS3ObjectLambdaExecutionRole.Arn
      Runtime: "python3.12"
      Timeout: 3
      TracingConfig: 
        Mode: "PassThrough"
      EphemeralStorage: 
        Size: 512

  # Lambda function that converts CSV file -> JSON (Example of custom file processing)
  CSVtoJSONLambdaFunction:
    Type: "AWS::Lambda::Function"
    Properties:
      Description: "Convert a CSV file -> JSON"
      Handler: "index.lambda_handler"
      Architectures: 
        - "x86_64"
      Code:
        ZipFile: |
          import json
          import urllib.parse
          import boto3
          import datetime
          import pandas as pd
          import awswrangler as wr

          s3Client = boto3.client('s3')
          s3Resource = boto3.resource('s3')
          OUTPUT_FILE_EXTENSION = ".json"
          def lambda_handler(event, context):
              entryTimestamp = datetime.datetime.now().strftime("%Y-%m-%d %H-%M-%S-%f")
              print("eventTransformFromCSVtoJSON invoked at " + entryTimestamp)
              # Extract variables from event
              bucket = event['bucket']
              key = urllib.parse.unquote_plus(event['key'])
              outputBucket = event['JobParameters']['body']['outputBucket']                   
              # Get the prefix
              prefix = key.rsplit("/", 1)[0] + '/'
              print('Prefix is: ' + prefix)
              # Build output prefix
              output_prefix = prefix.rsplit("/", 2)[0] + "/transformed-to-csv/"
              print('Output prefix is: ' + output_prefix)
              # Get object name
              object_name = key.rsplit("/", 1)[1]
              print('Object name is: ' + object_name)
              # Build S3 URI for reading csv file
              s3InputString = "s3://" + bucket + "/" + prefix + object_name
              print("s3InputString is : " + s3InputString)
              try:
                  df = wr.s3.read_csv( s3InputString, sep=',', encoding="utf-8", na_values=['null', 'none'], skip_blank_lines=True)
                  print("df CSV read dtype: \n", df.dtypes)
                  # Following step just drops the .csv extension: input = app/provider1/SampleFile.csv, output = app/provider1/SampleFile
                  outputJSONFile = key.rsplit('.',1)[-2] + OUTPUT_FILE_EXTENSION
                  print("Output JSON file name is : " + outputJSONFile)
                  s3OutputString = "s3://" + outputBucket + "/" + outputJSONFile
                  print("s3OutputString is : " + s3OutputString)
                  wr.s3.to_json(df, s3OutputString)
                  body = {
                      'key': outputJSONFile,
                      'bucket': outputBucket
                  }        
                  response={'statusCode': 200, 'body': body}
              except Exception as error:
                  print(error)
                  print("S3 Object could not be opened. Check environment variable. ")
                  response={'statusCode': 500, 'body': 'Failure'}
              exitTimestamp = datetime.datetime.now().strftime("%Y-%m-%d %H-%M-%S-%f")
              print("Exiting eventTransformFromCSVToJSON at " + exitTimestamp)
              return response
      MemorySize: 128
      Role: !GetAtt CSVtoJSONLambdaExecutionRole.Arn
      Runtime: "python3.12"
      Timeout: 30
      TracingConfig: 
        Mode: "PassThrough"
      Layers: 
        - !FindInMap [RegionMap, !Ref "AWS::Region", PandasLambdaLayerArn]
      EphemeralStorage: 
        Size: 512

  # Lambda function that grabs the partners parameters from DynamoDB table (Example parameter: PGP Public Key Secret ARN)
  GetPartnerParametersLambdaFunction:
    Type: "AWS::Lambda::Function"
    Properties:
      Description: "Grab partner parameters from DynamoDB table for use in step function"
      Handler: "index.lambda_handler"
      Architectures: 
        - "x86_64"
      Code:
        ZipFile: |
          import urllib.parse
          import json
          import boto3
          import botocore
          from botocore.exceptions import ClientError

          ddb_client = boto3.client('dynamodb')
          def lambda_handler(event, context):              
              tableName = event['table']
              key = urllib.parse.unquote_plus(event['key'])
              objectName = key.split('/')[-1]
              partnerId = key.split('/')[0]              
              try:
                  print(f'Trying to get job parameters for partner {partnerId} from table {tableName}')
                  response = ddb_client.get_item(
                      TableName= tableName,
                      Key = {
                          "partnerId": {
                          'S': partnerId
                          }
                      }
                      )                  
                  item = response['Item']
                  body = {}
                  for key in item:
                      dic = {
                          key: item[key]['S']
                      }
                      body.update(dic)         
                  statusCode = 200
              except ClientError as e:
                  print(json.dumps(e.response))
                  statusCode = e.response['ResponseMetadata']['HTTPStatusCode']
                  errorCode = e.response['Error']['Code']
                  errorMessage = e.response['Error']['Message']
                  body = {
                      "errorCode": errorCode,
                      "errorMessage": errorMessage
                  }
                  return {
                      'statusCode': statusCode,
                      'body': body
                  } 
              return {
                  'statusCode': statusCode,
                  'body': body
              }
      MemorySize: 128
      Role: !GetAtt GetPartnerParametersLambdaExecutionRole.Arn
      Runtime: "python3.12"
      Timeout: 5
      TracingConfig: 
        Mode: "PassThrough"
      EphemeralStorage: 
        Size: 512

### Transfer Family Resources ###

  # SFTP Transfer Family server
  SFTPServer:
    Type: AWS::Transfer::Server
    Properties:
      EndpointType: PUBLIC
      Tags:
        - Key: Name
          Value: SFTP-Connector-Test-Server

  # IAM Role for Transfer Family User
  SFTPUserRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - transfer.amazonaws.com
            Action:
              - sts:AssumeRole
      Path: /
      Policies:
        - PolicyName: AllowListingOfUserFolder
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Effect: Allow
                Action:
                  - s3:ListBucket
                Resource: !Sub "arn:aws:s3:::${SFTPServerS3Bucket}"
        - PolicyName: HomeDirObjectAccess
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Effect: Allow
                Action:
                  - s3:PutObject
                  - s3:GetObject
                  - s3:GetObjectVersion
                  - s3:DeleteObject
                  - s3:DeleteObjectVersion
                Resource: !Sub "arn:aws:s3:::${SFTPServerS3Bucket}/*"

  # Test Transfer Family User (Will have to manually add your public SSH key to this user via the AWS Console)
  TestUser:
    Type: AWS::Transfer::User
    Properties:
      ServerId: !GetAtt SFTPServer.ServerId
      UserName: testuser
      HomeDirectory: !Sub "/${SFTPServerS3Bucket}/"
      Role: !GetAtt SFTPUserRole.Arn

  # IAM Role for SFTP Connector
  SFTPConnectorRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - transfer.amazonaws.com
            Action:
              - sts:AssumeRole
      Path: /
      ManagedPolicyArns:
        - !GetAtt LogsPolicy.PolicyArn
      Policies:
        - PolicyName: MyBucketAccessPolicy
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Sid: AllowListingOfUserFolder
                Effect: Allow
                Action:
                  - s3:ListBucket
                  - s3:GetBucketLocation
                Resource:
                  - !Sub "arn:aws:s3:::${OutboundTransferS3Bucket}" 
              - Sid: HomeDirObjectAccess
                Effect: Allow
                Action:
                  - s3:PutObject
                  - s3:GetObject
                  - s3:DeleteObject
                  - s3:DeleteObjectVersion
                  - s3:GetObjectVersion
                  - s3:GetObjectACL
                  - s3:PutObjectACL
                Resource: 
                  - !Sub "arn:aws:s3:::${OutboundTransferS3Bucket}/*"
                  - !Sub "arn:aws:s3:::${OutboundTransferS3Bucket}"
              - Sid: GetConnectorSecretValue
                Effect: Allow
                Action:
                  - secretsmanager:GetSecretValue
                Resource: !Sub "arn:aws:secretsmanager:${AWS::Region}:${AWS::AccountId}:secret:aws/transfer/*"

### Step Function Resources ###
  # Policy to allow Step Function to start
  ProcessingStartExecutionPolicy:
    Type: "AWS::IAM::ManagedPolicy"
    Properties:
      Path: /
      PolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Action:
              - 'states:StartExecution'
            Resource: !Sub arn:aws:states:${AWS::Region}:${AWS::AccountId}:stateMachine:CustomFileProcessingStateMachine*

  # Step Function Execution Role
  CustomFileProcessingStateMachineRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - states.amazonaws.com
            Action:
              - sts:AssumeRole
      Path: /
      ManagedPolicyArns:
        - !GetAtt LogsPolicy.PolicyArn
      Policies:
        - PolicyName: InvokeFunctionPolicy
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Effect: Allow
                Action:
                  - "lambda:InvokeFunction"
                Resource: [!GetAtt EncryptLambdaFunction.Arn, !GetAtt PutRecordsDynamoDBLambdaFunction.Arn, !GetAtt DeleteFileLambdaFunction.Arn, !GetAtt CSVtoJSONLambdaFunction.Arn, !GetAtt GetPartnerParametersLambdaFunction.Arn]
        - PolicyName: SNSAccessPolicy
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Effect: Allow
                Action:
                  - "sns:Publish"
                Resource: [!GetAtt SNSTopic.TopicArn]
        - PolicyName: XRayPolicy
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Effect: Allow
                Action:
                  - "xray:PutTraceSegments"
                  - "xray:PutTelemetryRecords"
                  - "xray:GetSamplingRules"
                  - "xray:GetSamplingTargets"
                Resource: '*'
        - PolicyName: TransferFamilyAccess
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Effect: Allow
                Action:
                  - 'transfer:StartFileTransfer'
                Resource: '*'

  # EventBridge Execution Role to execute state machine CustomFileProcessingStateMachine
  EventBridgeInvokeStateMachineRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - events.amazonaws.com
            Action:
              - sts:AssumeRole
      Path: /
      Policies:
        - PolicyName: InvokeStateMachine
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Effect: Allow
                Action:
                  - "states:StartExecution"
                Resource: [!GetAtt CustomFileProcessingStateMachine.Arn]

  # Step Function
  CustomFileProcessingStateMachine:
    Type: "AWS::StepFunctions::StateMachine"
    Properties:
      RoleArn: !GetAtt CustomFileProcessingStateMachineRole.Arn
      StateMachineType: "STANDARD"
      LoggingConfiguration: 
        IncludeExecutionData: false
        Level: "OFF"
      DefinitionString: 
        !Sub 
          - |
            {
              "Comment": "A description of my state machine",
              "StartAt": "Transform Input Message",
              "States": {
                "Transform Input Message": {
                  "Type": "Pass",
                  "Next": "Retrieve Custom File Processing Information",
                  "Parameters": {
                    "bucket.$": "$.detail.bucket.name",
                    "key.$": "$.detail.object.key",
                    "table": "${CustomFileProcessingTableName}"
                  },
                  "ResultPath": "$.Event",
                  "OutputPath": "$.Event"
                },
                "Retrieve Custom File Processing Information": {
                  "Type": "Task",
                  "Resource": "arn:aws:states:::lambda:invoke",
                  "Parameters": {
                    "FunctionName": "${GetPartnerParametersLambdaFunctionARN}",
                    "Payload.$": "$"
                  },
                  "Retry": [
                    {
                      "ErrorEquals": [
                        "Lambda.ServiceException",
                        "Lambda.AWSLambdaException",
                        "Lambda.SdkClientException",
                        "Lambda.TooManyRequestsException"
                      ],
                      "IntervalSeconds": 1,
                      "MaxAttempts": 3,
                      "BackoffRate": 2
                    }
                  ],
                  "Next": "Evaluate Custom File Processing Steps",
                  "ResultPath": "$.JobParameters",
                  "ResultSelector": {
                    "statusCode.$": "$.Payload.statusCode",
                    "body.$": "$.Payload.body"
                  }
                },
                "Evaluate Custom File Processing Steps": {
                  "Type": "Choice",
                  "Choices": [
                    {
                      "Variable": "$.JobParameters.statusCode",
                      "NumericEquals": 200,
                      "Next": "Custom File Processing Step?"
                    }
                  ],
                  "Default": "SNS Publish Failed"
                },
                "Custom File Processing Step?": {
                  "Type": "Choice",
                  "Choices": [
                    {
                      "Variable": "$.JobParameters.body.lambdaARN",
                      "IsPresent": true,
                      "Next": "Invoke Custom Step"
                    },
                    {
                      "Variable": "$.JobParameters.body.customLambda",
                      "IsPresent": false,
                      "Next": "Encrypt File?"
                    }
                  ],
                  "Default": "SNS Publish Failed"
                },
                "Invoke Custom Step": {
                  "Type": "Task",
                  "Resource": "arn:aws:states:::lambda:invoke",
                  "Parameters": {
                    "FunctionName.$": "$.JobParameters.body.lambdaARN",
                    "Payload.$": "$"
                  },
                  "Retry": [
                    {
                      "ErrorEquals": [
                        "Lambda.ServiceException",
                        "Lambda.AWSLambdaException",
                        "Lambda.SdkClientException",
                        "Lambda.TooManyRequestsException"
                      ],
                      "IntervalSeconds": 1,
                      "MaxAttempts": 3,
                      "BackoffRate": 2
                    }
                  ],
                  "Next": "Evaluate Custom Step Output",
                  "ResultPath": "$.CustomStep",
                  "ResultSelector": {
                    "statusCode.$": "$.Payload.statusCode",
                    "body.$": "$.Payload.body"
                  }
                },
                "Evaluate Custom Step Output": {
                  "Type": "Choice",
                  "Choices": [
                    {
                      "Variable": "$.CustomStep.statusCode",
                      "NumericEquals": 200,
                      "Next": "Encrypt File?"
                    }
                  ],
                  "Default": "SNS Publish Failed"
                },
                "Encrypt File?": {
                  "Type": "Choice",
                  "Choices": [
                    {
                      "Variable": "$.JobParameters.body.pgpSecret",
                      "IsPresent": true,
                      "Next": "PGP Encrypt File"
                    },
                    {
                      "Variable": "$.JobParameters.body.pgpSecret",
                      "IsPresent": false,
                      "Next": "Start File Transfer"
                    }
                  ],
                  "Default": "SNS Publish Failed"
                },
                "PGP Encrypt File": {
                  "Type": "Task",
                  "Resource": "arn:aws:states:::lambda:invoke",
                  "Parameters": {
                    "FunctionName": "${EncryptLambdaFunctionARN}",
                    "Payload.$": "$"
                  },
                  "Retry": [
                    {
                      "ErrorEquals": [
                        "Lambda.ServiceException",
                        "Lambda.AWSLambdaException",
                        "Lambda.SdkClientException",
                        "Lambda.TooManyRequestsException"
                      ],
                      "IntervalSeconds": 1,
                      "MaxAttempts": 3,
                      "BackoffRate": 2
                    }
                  ],
                  "Next": "Evaluate Encryption Status",
                  "ResultPath": "$.Encrypt",
                  "ResultSelector": {
                    "statusCode.$": "$.Payload.statusCode",
                    "body.$": "$.Payload.body"
                  }
                },
                "Evaluate Encryption Status": {
                  "Type": "Choice",
                  "Choices": [
                    {
                      "Variable": "$.Encrypt.statusCode",
                      "NumericEquals": 200,
                      "Next": "Start File Transfer"
                    }
                  ],
                  "Default": "SNS Publish Failed"
                },
                "Start File Transfer": {
                  "Type": "Task",
                  "Next": "Put TransferID & TaskToken into DynamoDB",
                  "Parameters": {
                    "ConnectorId.$": "$.JobParameters.body.connectorId",
                    "SendFilePaths.$": "$.Encrypt.body.s3_path"
                  },
                  "Resource": "arn:aws:states:::aws-sdk:transfer:startFileTransfer",
                  "OutputPath": "$",
                  "ResultPath": "$.Event"
                },
                "Put TransferID & TaskToken into DynamoDB": {
                  "Type": "Task",
                  "Resource": "arn:aws:states:::lambda:invoke.waitForTaskToken",
                  "HeartbeatSeconds": 600,
                  "Parameters": {
                    "Payload": {
                      "Event.$": "$.Event",
                      "TaskToken.$": "$$.Task.Token"
                    },
                    "FunctionName": "${PutRecordsDynamoDBFunctionARN}"
                  },
                  "Retry": [
                    {
                      "ErrorEquals": [
                        "Lambda.ServiceException",
                        "Lambda.AWSLambdaException",
                        "Lambda.SdkClientException",
                        "Lambda.TooManyRequestsException"
                      ],
                      "IntervalSeconds": 1,
                      "MaxAttempts": 3,
                      "BackoffRate": 2
                    }
                  ],
                  "Next": "Evaluate File Transfer Status",
                  "ResultPath": "$.Event"
                },
                "Evaluate File Transfer Status": {
                  "Type": "Choice",
                  "Choices": [
                    {
                      "Variable": "$.Event.detail.status-code",
                      "StringEquals": "COMPLETED",
                      "Next": "Delete Originally Uploaded File"
                    }
                  ],
                  "Default": "SNS Publish Failed"
                },
                "Delete Originally Uploaded File": {
                  "Type": "Task",
                  "Resource": "arn:aws:states:::lambda:invoke",
                  "OutputPath": "$.Payload",
                  "Parameters": {
                    "Payload.$": "$",
                    "FunctionName": "${DeleteFileLambdaFunctionARN}"
                  },
                  "Retry": [
                    {
                      "ErrorEquals": [
                        "Lambda.ServiceException",
                        "Lambda.AWSLambdaException",
                        "Lambda.SdkClientException",
                        "Lambda.TooManyRequestsException"
                      ],
                      "IntervalSeconds": 1,
                      "MaxAttempts": 3,
                      "BackoffRate": 2
                    }
                  ],
                  "Next": "Evaluate Deletion Status"
                },
                "Evaluate Deletion Status": {
                  "Type": "Choice",
                  "Choices": [
                    {
                      "Variable": "$.statusCode",
                      "NumericEquals": 200,
                      "Next": "Success"
                    }
                  ],
                  "Default": "SNS Publish Failed"
                },
                "Success": {
                  "Type": "Succeed"
                },
                "Fail": {
                  "Type": "Fail"
                },
                "SNS Publish Failed": {
                  "Type": "Task",
                  "Resource": "arn:aws:states:::sns:publish",
                  "Parameters": {
                    "Message.$": "$",
                    "TopicArn": "${SNSTopicARN}"
                  },
                  "Next": "Fail"
                }
              }
            }
          - {
              EncryptLambdaFunctionARN: !GetAtt [ EncryptLambdaFunction, Arn ],
              PutRecordsDynamoDBFunctionARN: !GetAtt [ PutRecordsDynamoDBLambdaFunction, Arn ],
              DeleteFileLambdaFunctionARN: !GetAtt [ DeleteFileLambdaFunction, Arn ],
              CSVtoJSONLambdaFunctionARN: !GetAtt [ CSVtoJSONLambdaFunction, Arn ],
              GetPartnerParametersLambdaFunctionARN: !GetAtt [ GetPartnerParametersLambdaFunction, Arn ],
              SNSTopicARN: !GetAtt [ SNSTopic, TopicArn ],
              CustomFileProcessingTableName: !Ref CustomFileProcessingTable
            }

### Custom Resource ###

  BuildCodeCustomResource:
    Type: Custom::BuildCode
    Properties:
      ServiceToken: !GetAtt BuildCodeCustomResourceFunction.Arn

  BuildCodeCustomResourceRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Statement:
        - Action:
          - sts:AssumeRole
          Effect: Allow
          Principal:
            Service:
            - lambda.amazonaws.com
        Version: '2012-10-17'
      Path: "/"
      ManagedPolicyArns:
        - !GetAtt LogsPolicy.PolicyArn
      Policies:
      - PolicyDocument:
          Statement:
          - Action:
            - codebuild:StartBuild
            - codebuild:BatchGetBuilds
            Effect: Allow
            Resource:
            - '*'
          Version: '2012-10-17'
        PolicyName: CodeBuildPolicy


  # Lambda function which builds Docker image and pushes it to ECR 
  BuildCodeCustomResourceFunction:
    Type: "AWS::Lambda::Function"
    Properties:
      Handler: index.handler
      Role: !GetAtt BuildCodeCustomResourceRole.Arn
      Timeout: 360
      Runtime: python3.9
      Environment:
        Variables:
          PROJECT: !Ref CodeBuildProject      
      Code:
        ZipFile: !Sub |
          import boto3
          import os
          from time import sleep
          import cfnresponse

          def handler(event, context):
              
              if event['RequestType'] == 'Create':

                client = boto3.client("codebuild")
                
                status = 'STARTING'
                while status != 'SUCCEEDED':
                  if status in ['STARTING', 'STOPPED', 'FAILED', 'TIMED_OUT', 'FAULT']:
                    build_id = client.start_build(projectName=os.environ['PROJECT'])['build']['id']
                    print(build_id)
                  sleep(30)
                  status = client.batch_get_builds(ids=[build_id])['builds'][0]['buildStatus']
                  print(status)

              cfnresponse.send(event, context, cfnresponse.SUCCESS, {})

### Pandas Lambda Layer Mapping ###
# Mapping for AWS Managed Pandas Lambda Layer (Layer ARN varies by region)
Mappings: 
  RegionMap: 
    us-east-1: 
      PandasLambdaLayerArn: arn:aws:lambda:us-east-1:336392948345:layer:AWSSDKPandas-Python312:2
    us-east-2: 
      PandasLambdaLayerArn: arn:aws:lambda:us-east-2:336392948345:layer:AWSSDKPandas-Python312:1
    us-west-1: 
      PandasLambdaLayerArn: arn:aws:lambda:us-west-1:336392948345:layer:AWSSDKPandas-Python312:2
    us-west-2: 
      PandasLambdaLayerArn: arn:aws:lambda:us-west-2:336392948345:layer:AWSSDKPandas-Python312:2
    eu-west-1: 
      PandasLambdaLayerArn: arn:aws:lambda:eu-west-1:336392948345:layer:AWSSDKPandas-Python312:2
    eu-west-2: 
      PandasLambdaLayerArn: arn:aws:lambda:eu-west-2:336392948345:layer:AWSSDKPandas-Python312:2
    eu-west-3: 
      PandasLambdaLayerArn: arn:aws:lambda:eu-west-3:336392948345:layer:AWSSDKPandas-Python312:2
    eu-central-1: 
      PandasLambdaLayerArn: arn:aws:lambda:eu-central-1:336392948345:layer:AWSSDKPandas-Python312:2
    eu-central-2: 
      PandasLambdaLayerArn: arn:aws:lambda:eu-central-2:956415814219:layer:AWSSDKPandas-Python312:2
    eu-south-1: 
      PandasLambdaLayerArn: arn:aws:lambda:eu-south-1:774444163449:layer:AWSSDKPandas-Python312:2
    eu-south-2: 
      PandasLambdaLayerArn: arn:aws:lambda:eu-south-2:982086096842:layer:AWSSDKPandas-Python312:2
    eu-north-1: 
      PandasLambdaLayerArn: arn:aws:lambda:eu-north-1:336392948345:layer:AWSSDKPandas-Python312:2
    ap-southeast-1: 
      PandasLambdaLayerArn: arn:aws:lambda:ap-southeast-1:336392948345:layer:AWSSDKPandas-Python312:2
    ap-southeast-2: 
      PandasLambdaLayerArn: arn:aws:lambda:ap-southeast-2:336392948345:layer:AWSSDKPandas-Python312:2
    ap-southeast-3: 
      PandasLambdaLayerArn: arn:aws:lambda:ap-southeast-3:258944054355:layer:AWSSDKPandas-Python312:2
    ap-southeast-4: 
      PandasLambdaLayerArn: arn:aws:lambda:ap-southeast-4:945386623051:layer:AWSSDKPandas-Python312:2
    ap-northeast-1: 
      PandasLambdaLayerArn: arn:aws:lambda:ap-northeast-1:336392948345:layer:AWSSDKPandas-Python312:2
    ap-northeast-2: 
      PandasLambdaLayerArn: arn:aws:lambda:ap-northeast-2:336392948345:layer:AWSSDKPandas-Python312:2
    ap-northeast-3: 
      PandasLambdaLayerArn: arn:aws:lambda:ap-northeast-3:336392948345:layer:AWSSDKPandas-Python312:2
    ap-south-1: 
      PandasLambdaLayerArn: arn:aws:lambda:ap-south-1:336392948345:layer:AWSSDKPandas-Python312:2
    ap-south-2: 
      PandasLambdaLayerArn: arn:aws:lambda:ap-south-2:246107603503:layer:AWSSDKPandas-Python312:2
    ap-east-1: 
      PandasLambdaLayerArn: arn:aws:lambda:ap-east-1:839552336658:layer:AWSSDKPandas-Python312:2    
    af-south-1:
      PandasLambdaLayerArn: arn:aws:lambda:af-south-1:336392948345:layer:AWSSDKPandas-Python312:2
    ca-central-1:
      PandasLambdaLayerArn: arn:aws:lambda:ca-central-1:336392948345:layer:AWSSDKPandas-Python312:2
    sa-east-1:
      PandasLambdaLayerArn: arn:aws:lambda:sa-east-1:336392948345:layer:AWSSDKPandas-Python312:2
    il-central-1:
      PandasLambdaLayerArn: arn:aws:lambda:il-central-1:263840725265:layer:AWSSDKPandas-Python312:2
    me-central-1:
      PandasLambdaLayerArn: arn:aws:lambda:me-central-1:593833071574:layer:AWSSDKPandas-Python312:2
    me-south-1:
      PandasLambdaLayerArn: arn:aws:lambda:me-south-1:938046470361:layer:AWSSDKPandas-Python312:2

### Outputs ###
Outputs:
  ServerURL:
    Value:
      Fn::Sub:
        - "sftp://${ServerId}.server.transfer.${AWS::Region}.amazonaws.com"
        - ServerId: !GetAtt SFTPServer.ServerId
  ServerID:
    Value: !GetAtt SFTPServer.ServerId
  CSVtoJSONLambdaFunctionARN:
    Value: !GetAtt CSVtoJSONLambdaFunction.Arn
  PartnerExampleSecret:
    Value: !Ref PartnerExampleSecret
  OutboundTransferS3Bucket:
    Value: !Ref OutboundTransferS3Bucket
  SFTPServerS3Bucket:
    Value: !Ref SFTPServerS3Bucket
  LandingS3Bucket:
    Value: !Ref LandingS3Bucket
  SFTPConnectorIAMRole:
    Value: !GetAtt SFTPConnectorRole.Arn