template.yaml

AWSTemplateFormatVersion: '2010-09-09'
Transform: AWS::Serverless-2016-10-31
Description: Allow TICF analysts to view the results of Athena queries on TxMA audit data

Parameters:
  CodeSigningConfigArn:
    Description: The ARN of the Code Signing Config to use, provided by the deployment pipeline
    Type: String
    Default: none
  Environment:
    Description: The environment type
    Type: String
    AllowedValues:
      - dev
      - build
      - staging
      - integration
      - production
  PermissionsBoundary:
    Description: The ARN of the permissions boundary to apply to any role created by the template
    Type: String
    Default: none
  TestRoleArn:
    Type: String
    Description: The ARN of the role that will used for integration tests
    Default: none
  VpcStackName:
    Type: String
    Description: The name of the stack containing the VPC
    Default: none

Conditions:
  ApiCustomDomain: !Not [!Equals [!Ref Environment, dev]]
  CslsEgress:
    !Or [
      !Equals [!Ref Environment, production],
      !Equals [!Ref Environment, integration],
      !Equals [!Ref Environment, staging]
    ]
  TestEnvironment:
    !Not [
      !Or [
        !Equals [!Ref Environment, production],
        !Equals [!Ref Environment, integration]
      ]
    ]
  UseCodeSigning: !Not [!Equals [!Ref CodeSigningConfigArn, none]]
  UsePermissionsBoundary: !Not [!Equals [!Ref PermissionsBoundary, none]]
  IsStubbedEnvironment:
    !Or [!Equals [!Ref Environment, dev], !Equals [!Ref Environment, build]]
  TestRoleResources:
    !And [Condition: TestEnvironment, !Not [!Equals [!Ref TestRoleArn, none]]]

Mappings:
  EnvironmentConfiguration:
    dev:
      dynatraceSecretArn: arn:aws:secretsmanager:eu-west-2:216552277552:secret:DynatraceNonProductionVariables
    build:
      dynatraceSecretArn: arn:aws:secretsmanager:eu-west-2:216552277552:secret:DynatraceNonProductionVariables
    staging:
      dynatraceSecretArn: arn:aws:secretsmanager:eu-west-2:216552277552:secret:DynatraceNonProductionVariables
    integration:
      dynatraceSecretArn: arn:aws:secretsmanager:eu-west-2:216552277552:secret:DynatraceNonProductionVariables
    production:
      dynatraceSecretArn: arn:aws:secretsmanager:eu-west-2:216552277552:secret:DynatraceProductionVariables

Globals:
  Function:
    Architectures:
      - 'arm64'
    CodeSigningConfigArn:
      !If [UseCodeSigning, !Ref CodeSigningConfigArn, !Ref AWS::NoValue]
    Environment:
      Variables:
        NODE_OPTIONS: --enable-source-maps
        AWS_LAMBDA_EXEC_WRAPPER: /opt/dynatrace
        DT_CONNECTION_AUTH_TOKEN: !Sub
          - '{{resolve:secretsmanager:${SecretArn}:SecretString:DT_CONNECTION_AUTH_TOKEN}}'
          - SecretArn:
              !FindInMap [
                EnvironmentConfiguration,
                !Ref Environment,
                dynatraceSecretArn
              ]
        DT_CONNECTION_BASE_URL: !Sub
          - '{{resolve:secretsmanager:${SecretArn}:SecretString:DT_CONNECTION_BASE_URL}}'
          - SecretArn:
              !FindInMap [
                EnvironmentConfiguration,
                !Ref Environment,
                dynatraceSecretArn
              ]
        DT_CLUSTER_ID: !Sub
          - '{{resolve:secretsmanager:${SecretArn}:SecretString:DT_CLUSTER_ID}}'
          - SecretArn:
              !FindInMap [
                EnvironmentConfiguration,
                !Ref Environment,
                dynatraceSecretArn
              ]
        DT_LOG_COLLECTION_AUTH_TOKEN: !Sub
          - '{{resolve:secretsmanager:${SecretArn}:SecretString:DT_LOG_COLLECTION_AUTH_TOKEN}}'
          - SecretArn:
              !FindInMap [
                EnvironmentConfiguration,
                !Ref Environment,
                dynatraceSecretArn
              ]
        DT_TENANT: !Sub
          - '{{resolve:secretsmanager:${SecretArn}:SecretString:DT_TENANT}}'
          - SecretArn:
              !FindInMap [
                EnvironmentConfiguration,
                !Ref Environment,
                dynatraceSecretArn
              ]
        DT_OPEN_TELEMETRY_ENABLE_INTEGRATION: 'true'
    PermissionsBoundary:
      !If [UsePermissionsBoundary, !Ref PermissionsBoundary, !Ref AWS::NoValue]
    ReservedConcurrentExecutions: 10
    Runtime: nodejs18.x
    Timeout: 15
    VpcConfig:
      SecurityGroupIds:
        - Fn::ImportValue: !Sub ${VpcStackName}-AWSServicesEndpointSecurityGroupId
    Layers:
      - !Sub
        - '{{resolve:secretsmanager:${SecretArn}:SecretString:NODEJS_LAYER}}'
        - SecretArn:
            !FindInMap [
              EnvironmentConfiguration,
              !Ref Environment,
              dynatraceSecretArn
            ]
    AutoPublishAlias: live
  Api:
    OpenApiVersion: 3.0.1

Resources:
  ResultsApi:
    #checkov:skip=CKV_AWS_120:We explicitly don't want caching
    Type: AWS::Serverless::Api
    Properties:
      AccessLogSetting:
        DestinationArn: !GetAtt ResultsApiAccessLogs.Arn
        Format: >-
          {
          "requestId": "$context.requestId",
          "ip": "$context.identity.sourceIp",
          "requestTime": "$context.requestTime",
          "httpMethod": "$context.httpMethod",
          "path": "$context.path",
          "routeKey": "$context.routeKey",
          "status": "$context.status",
          "protocol": "$context.protocol",
          "responseLatency": "$context.responseLatency",
          "responseLength": "$context.responseLength"
          }
      Description: API used by TICF analysts to access the results of Athena queries on the raw audit data
      DisableExecuteApiEndpoint: !If [ApiCustomDomain, true, false]
      EndpointConfiguration:
        Type: REGIONAL
      GatewayResponses:
        ACCESS_DENIED:
          ResponseTemplates:
            application/json: '{"message": "Access Denied: if you think you should have access to this URL, make sure you are connected to the VPN"}'
      Name: !Sub ${AWS::StackName}-secure-fraud-site-api
      StageName: !Ref Environment
      TracingEnabled: true

  ResultsApiBasePathMapping:
    Condition: ApiCustomDomain
    Type: AWS::ApiGateway::BasePathMapping
    Properties:
      DomainName: '{{resolve:ssm:ResultsApiDomainName}}'
      RestApiId: !Ref ResultsApi
      Stage: !Ref ResultsApi.Stage

  ResultsApiAccessLogs:
    Type: AWS::Logs::LogGroup
    Properties:
      KmsKeyId: '{{resolve:ssm:LogsKmsKeyArn}}'
      LogGroupName: !Sub /aws/apigateway/${ResultsApi}-access-logs
      RetentionInDays: 30

  ResultsApiCslsSubscriptionFilter:
    Type: AWS::Logs::SubscriptionFilter
    Condition: CslsEgress
    Properties:
      LogGroupName: !Ref ResultsApiAccessLogs
      FilterPattern: ''
      DestinationArn: '{{resolve:ssm:CSLSLogsDestination}}'

  SecureFraudApiWafAssociation:
    Type: AWS::WAFv2::WebACLAssociation
    Properties:
      ResourceArn: !Sub arn:${AWS::Partition}:apigateway:${AWS::Region}::/restapis/${ResultsApi}/stages/${ResultsApi.Stage}
      WebACLArn: '{{resolve:ssm:SecureFraudApiWafAclArn}}'

  ConfirmDownloadFunction:
    #checkov:skip=CKV_AWS_115:Defined in Globals
    #checkov:skip=CKV_AWS_117:Defined in Globals
    Type: AWS::Serverless::Function
    Properties:
      CodeUri: dist/confirmDownload/
      Handler: handler.handler
      Environment:
        Variables:
          SECURE_DOWNLOAD_TABLE_NAME: '{{resolve:ssm:SecureFraudSiteDataTableName}}'
          LINK_EXPIRY_TIME: '{{resolve:ssm:LINK_EXPIRY_TIME}}'
          AUDIT_DATA_REQUEST_EVENTS_QUEUE_URL: '{{resolve:ssm:AuditDataRequestEventsQueueUrl}}'
      FunctionName: !Sub ${AWS::StackName}-confirm-download-page
      MemorySize: 256
      KmsKeyArn: '{{resolve:ssm:LambdaKmsKeyArn}}'
      Role: !GetAtt ConfirmDownloadFunctionRole.Arn
      Events:
        ConfirmDownload:
          Type: Api
          Properties:
            RestApiId: !Ref ResultsApi
            Method: post
            Path: /secure/{downloadHash}
      VpcConfig:
        SubnetIds:
          - Fn::ImportValue: !Sub ${VpcStackName}-PrivateSubnetIdA
          - Fn::ImportValue: !Sub ${VpcStackName}-PrivateSubnetIdB
          - Fn::ImportValue: !Sub ${VpcStackName}-PrivateSubnetIdC

  ConfirmDownloadFunctionRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: !Sub ${AWS::StackName}-confirm-download-role
      PermissionsBoundary:
        Fn::If:
          - UsePermissionsBoundary
          - Ref: PermissionsBoundary
          - Ref: AWS::NoValue
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Sid: AllowLambdaToAssumeRole
            Effect: Allow
            Principal:
              Service:
                - lambda.amazonaws.com
            Action: sts:AssumeRole
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/service-role/AWSLambdaVPCAccessExecutionRole
        - !Ref ConfirmDownloadFunctionPolicy

  ConfirmDownloadFunctionPolicy:
    Type: AWS::IAM::ManagedPolicy
    Properties:
      ManagedPolicyName: !Sub ${AWS::StackName}-confirm-download-policy
      PolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Sid: SecureFraudSiteDataTableReadWrite
            Effect: Allow
            Action:
              - dynamodb:GetItem
              - dynamodb:UpdateItem
            Resource: '{{resolve:ssm:SecureFraudSiteDataTableArn}}'
          - Sid: DecryptKmsKeys
            Effect: Allow
            Action:
              - kms:Decrypt
            Resource: '{{resolve:ssm:DatabaseKmsKeyArn}}'
          - Sid: S3ResultsBucketRead
            Effect: Allow
            Action:
              - s3:GetObject
            Resource: '{{resolve:ssm:QueryResultsBucketArn}}/*'
          - Sid: AllowSqsAuditEventsSend
            Effect: Allow
            Action:
              - sqs:SendMessage
            Resource: '{{resolve:ssm:AuditDataRequestEventsQueueArn}}'
          - Sid: AllowQueueKmsKeyAccess
            Effect: Allow
            Action:
              - kms:Decrypt
              - kms:GenerateDataKey*
              - kms:ReEncrypt*
            Resource: '{{resolve:ssm:AuditDataRequestEventsQueueKmsKeyArn}}'

  ConfirmDownloadFunctionLogs:
    Type: AWS::Logs::LogGroup
    Properties:
      KmsKeyId: '{{resolve:ssm:LogsKmsKeyArn}}'
      LogGroupName: !Sub '/aws/lambda/${AWS::StackName}-confirm-download-page'
      RetentionInDays: 30

  ConfirmDownloadCslsSubscriptionFilter:
    Type: AWS::Logs::SubscriptionFilter
    Condition: CslsEgress
    Properties:
      LogGroupName: !Ref ConfirmDownloadFunctionLogs
      FilterPattern: ''
      DestinationArn: '{{resolve:ssm:CSLSLogsDestination}}'

  DownloadWarningFunction:
    #checkov:skip=CKV_AWS_115:Defined in Globals
    #checkov:skip=CKV_AWS_117:Defined in Globals
    Type: AWS::Serverless::Function
    Properties:
      CodeUri: dist/downloadWarning/
      Handler: handler.handler
      Environment:
        Variables:
          SECURE_DOWNLOAD_TABLE_NAME: '{{resolve:ssm:SecureFraudSiteDataTableName}}'
          LINK_EXPIRY_TIME: '{{resolve:ssm:LINK_EXPIRY_TIME}}'
      Events:
        DownloadWarning:
          Type: Api
          Properties:
            RestApiId: !Ref ResultsApi
            Method: get
            Path: /secure/{downloadHash}
      FunctionName: !Sub ${AWS::StackName}-download-warning-page
      MemorySize: 512
      KmsKeyArn: '{{resolve:ssm:LambdaKmsKeyArn}}'
      Role: !GetAtt DownloadWarningFunctionRole.Arn
      VpcConfig:
        SubnetIds:
          - Fn::ImportValue: !Sub ${VpcStackName}-PrivateSubnetIdA
          - Fn::ImportValue: !Sub ${VpcStackName}-PrivateSubnetIdB
          - Fn::ImportValue: !Sub ${VpcStackName}-PrivateSubnetIdC

  DownloadWarningFunctionRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: !Sub ${AWS::StackName}-download-warning-role
      PermissionsBoundary:
        Fn::If:
          - UsePermissionsBoundary
          - Ref: PermissionsBoundary
          - Ref: AWS::NoValue
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Sid: AllowLambdaToAssumeRole
            Effect: Allow
            Principal:
              Service:
                - lambda.amazonaws.com
            Action: sts:AssumeRole
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/service-role/AWSLambdaVPCAccessExecutionRole
        - !Ref DownloadWarningFunctionPolicy

  DownloadWarningFunctionPolicy:
    Type: AWS::IAM::ManagedPolicy
    Properties:
      ManagedPolicyName: !Sub ${AWS::StackName}-download-warning-policy
      PolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Sid: SecureFraudSiteDataTableRead
            Effect: Allow
            Action:
              - dynamodb:GetItem
            Resource: '{{resolve:ssm:SecureFraudSiteDataTableArn}}'
          - Sid: DecryptDatabaseKmsKey
            Effect: Allow
            Action:
              - kms:Decrypt
            Resource: '{{resolve:ssm:DatabaseKmsKeyArn}}'

  DownloadWarningFunctionLogs:
    Type: AWS::Logs::LogGroup
    Properties:
      KmsKeyId: '{{resolve:ssm:LogsKmsKeyArn}}'
      LogGroupName: !Sub '/aws/lambda/${AWS::StackName}-download-warning-page'
      RetentionInDays: 30

  DownloadWarningCslsSubscriptionFilter:
    Type: AWS::Logs::SubscriptionFilter
    Condition: CslsEgress
    Properties:
      LogGroupName: !Ref DownloadWarningFunctionLogs
      FilterPattern: ''
      DestinationArn: '{{resolve:ssm:CSLSLogsDestination}}'

  SendEmailRequestToNotifyFunction:
    #checkov:skip=CKV_AWS_115:Defined in Globals
    #checkov:skip=CKV_AWS_117:Defined in Globals
    Type: AWS::Serverless::Function
    Properties:
      CodeUri: dist/sendEmailRequestToNotify/
      Handler: handler.handler
      Environment:
        Variables:
          ENVIRONMENT: !Ref Environment
          NOTIFY_API_SECRETS_ARN: '{{resolve:ssm:NotifySecretSetArn}}'
          CLOSE_TICKET_QUEUE_URL: '{{resolve:ssm:CloseZendeskTicketQueueUrl}}'
          USE_NOTIFY_MOCK_SERVER: !If [IsStubbedEnvironment, 'true', 'false']
          MOCK_SERVER_BASE_URL: 'https://mockserver.transaction.build.account.gov.uk'
      FunctionName: !Sub ${AWS::StackName}-send-email-request-to-notify
      MemorySize: 256
      KmsKeyArn: '{{resolve:ssm:LambdaKmsKeyArn}}'
      Role: !GetAtt SendEmailRequestToNotifyFunctionRole.Arn
      Events:
        SendEmailEvent:
          Type: SQS
          Properties:
            Queue: !GetAtt SendEmailQueue.Arn
            BatchSize: 1
      VpcConfig:
        SubnetIds:
          - Fn::ImportValue: !Sub ${VpcStackName}-ProtectedSubnetIdA
          - Fn::ImportValue: !Sub ${VpcStackName}-ProtectedSubnetIdB
          - Fn::ImportValue: !Sub ${VpcStackName}-ProtectedSubnetIdC

  SendEmailRequestToNotifyFunctionRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: !Sub ${AWS::StackName}-email-request-to-notify-role
      PermissionsBoundary:
        Fn::If:
          - UsePermissionsBoundary
          - Ref: PermissionsBoundary
          - Ref: AWS::NoValue
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Sid: AllowLambdaToAssumeRole
            Effect: Allow
            Principal:
              Service:
                - lambda.amazonaws.com
            Action: sts:AssumeRole
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/service-role/AWSLambdaVPCAccessExecutionRole
        - !Ref SendEmailRequestToNotifyFunctionPolicy

  SendEmailRequestToNotifyFunctionPolicy:
    Type: AWS::IAM::ManagedPolicy
    Properties:
      ManagedPolicyName: !Sub ${AWS::StackName}-email-request-to-notify-policy
      PolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Sid: ReadSecrets
            Effect: Allow
            Action:
              - secretsmanager:GetSecretValue
            Resource:
              - '{{resolve:ssm:NotifySecretSetArn}}'
          - Sid: AllowCloseTicketQueueSend
            Effect: Allow
            Action:
              - sqs:SendMessage
            Resource: '{{resolve:ssm:CloseZendeskTicketQueueArn}}'
          - Sid: AllowSendEmailQueueRead
            Effect: Allow
            Action:
              - sqs:ReceiveMessage
              - sqs:DeleteMessage
              - sqs:GetQueueAttributes
            Resource: !GetAtt SendEmailQueue.Arn
          - Sid: UseSqsKmsKey
            Effect: Allow
            Action:
              - kms:Decrypt
              - kms:GenerateDataKey*
              - kms:ReEncrypt*
            Resource:
              - '{{resolve:ssm:CloseZendeskTicketQueueKmsKeyArn}}'
          - Sid: DecryptKmsKeys
            Effect: Allow
            Action:
              - kms:Decrypt
            Resource:
              - '{{resolve:ssm:SecretsKmsKeyArn}}'
              - '{{resolve:ssm:SqsKmsKeyArn}}'

  SendEmailRequestToNotifyLogs:
    Type: AWS::Logs::LogGroup
    Properties:
      KmsKeyId: '{{resolve:ssm:LogsKmsKeyArn}}'
      LogGroupName: !Sub '/aws/lambda/${AWS::StackName}-send-email-request-to-notify'
      RetentionInDays: 30

  SendEmailRequestToNotifyCslsSubscriptionFilter:
    Type: AWS::Logs::SubscriptionFilter
    Condition: CslsEgress
    Properties:
      LogGroupName: !Ref SendEmailRequestToNotifyLogs
      FilterPattern: ''
      DestinationArn: '{{resolve:ssm:CSLSLogsDestination}}'

  SendEmailQueue:
    Type: AWS::SQS::Queue
    Properties:
      QueueName: !Sub ${AWS::StackName}-${Environment}-send-email-queue
      KmsMasterKeyId: '{{resolve:ssm:SqsKmsKeyArn}}'
      RedrivePolicy:
        deadLetterTargetArn: !GetAtt SendEmailDeadLetterQueue.Arn
        maxReceiveCount: 5

  SendEmailDeadLetterQueue:
    Type: AWS::SQS::Queue
    Properties:
      QueueName: !Sub ${AWS::StackName}-${Environment}-send-email-dead-letter-queue
      KmsMasterKeyId: '{{resolve:ssm:SqsKmsKeyArn}}'

  GenerateDownloadFunction:
    #checkov:skip=CKV_AWS_115:Defined in Globals
    #checkov:skip=CKV_AWS_117:Defined in Globals
    Type: AWS::Serverless::Function
    Properties:
      CodeUri: dist/generateDownload/
      Handler: handler.handler
      Role: !GetAtt GenerateDownloadFunctionRole.Arn
      Environment:
        Variables:
          ATHENA_OUTPUT_LOCATION: !Sub txma-data-analysis-${Environment}-athena-query-output-bucket/ticf-automated-audit-data-queries
          QUERY_RESULTS_BUCKET_NAME: '{{resolve:ssm:QueryResultsBucketName}}'
          SECURE_DOWNLOAD_LINK_BASE_URL:
            !If [
              ApiCustomDomain,
              'https://{{resolve:ssm:ResultsApiDomainName}}/secure',
              !Sub 'https://${ResultsApi}.execute-api.${AWS::Region}.amazonaws.com/${ResultsApi.Stage}/secure'
            ]
          SECURE_DOWNLOAD_TABLE_NAME: '{{resolve:ssm:SecureFraudSiteDataTableName}}'
          SEND_TO_EMAIL_QUEUE_URL: !Ref SendEmailQueue
          DATABASE_TTL_HOURS: '{{resolve:ssm:DatabaseTtlHours}}'
      Events:
        QueryCompleteEvent:
          Type: SQS
          Properties:
            Queue: !Sub 'arn:aws:sqs:${AWS::Region}:{{resolve:ssm:AuditAccountNumber}}:txma-data-analysis-${Environment}-query-completed-queue'
            BatchSize: 1
      FunctionName: !Sub ${AWS::StackName}-generate-download
      MemorySize: 512
      KmsKeyArn: '{{resolve:ssm:LambdaKmsKeyArn}}'
      VpcConfig:
        SubnetIds:
          - Fn::ImportValue: !Sub ${VpcStackName}-PrivateSubnetIdA
          - Fn::ImportValue: !Sub ${VpcStackName}-PrivateSubnetIdB
          - Fn::ImportValue: !Sub ${VpcStackName}-PrivateSubnetIdC

  GenerateDownloadFunctionRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: !Sub ${AWS::StackName}-${Environment}-generate-download-role
      PermissionsBoundary:
        !If [
          UsePermissionsBoundary,
          !Ref PermissionsBoundary,
          !Ref AWS::NoValue
        ]
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - lambda.amazonaws.com
            Action: sts:AssumeRole
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/service-role/AWSLambdaVPCAccessExecutionRole
        - !Ref GenerateDownloadFunctionPolicy

  GenerateDownloadFunctionPolicy:
    Type: AWS::IAM::ManagedPolicy
    Properties:
      ManagedPolicyName: !Sub ${AWS::StackName}-generate-download-policy
      PolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Sid: SecureFraudSiteDataTableWrite
            Effect: Allow
            Action:
              - dynamodb:PutItem
            Resource: '{{resolve:ssm:SecureFraudSiteDataTableArn}}'
          - Sid: DecryptDatabaseKmsKey
            Effect: Allow
            Action:
              - kms:Decrypt
            Resource: '{{resolve:ssm:DatabaseKmsKeyArn}}'
          - Sid: AllowQueryCompletedQueueRead
            Effect: Allow
            Action:
              - sqs:ReceiveMessage
              - sqs:DeleteMessage
              - sqs:GetQueueAttributes
            Resource: !Sub 'arn:aws:sqs:${AWS::Region}:{{resolve:ssm:AuditAccountNumber}}:txma-data-analysis-${Environment}-query-completed-queue'
          - Sid: AllowAccessAthenaOutputBucket
            Effect: Allow
            Action:
              - s3:GetObject
            Resource: !Sub 'arn:aws:s3:::txma-data-analysis-${Environment}-athena-query-output-bucket/*'
          - Sid: AllowDecryptOfAuditAccountKmsKeys
            Effect: Allow
            Action:
              - kms:Decrypt
            Resource: !Sub 'arn:aws:kms:${AWS::Region}:{{resolve:ssm:AuditAccountNumber}}:*'
          - Sid: S3ResultsBucketWrite
            Effect: Allow
            Action:
              - s3:PutObject
            Resource: '{{resolve:ssm:QueryResultsBucketArn}}/*'
          - Sid: AllowSqsSendToEmailQueue
            Effect: Allow
            Action:
              - sqs:SendMessage
            Resource:
              - !GetAtt SendEmailQueue.Arn
          - Sid: UseSQSKmsKeyForSendToEmailQueue
            Effect: Allow
            Action:
              - kms:Decrypt
              - kms:GenerateDataKey
            Resource: '{{resolve:ssm:SqsKmsKeyArn}}'

  GenerateDownloadFunctionLogs:
    Type: AWS::Logs::LogGroup
    Properties:
      KmsKeyId: '{{resolve:ssm:LogsKmsKeyArn}}'
      LogGroupName: !Sub '/aws/lambda/${AWS::StackName}-generate-download'
      RetentionInDays: 30

  GenerateDownloadCslsSubscriptionFilter:
    Type: AWS::Logs::SubscriptionFilter
    Condition: CslsEgress
    Properties:
      LogGroupName: !Ref GenerateDownloadFunctionLogs
      FilterPattern: ''
      DestinationArn: '{{resolve:ssm:CSLSLogsDestination}}'

  # Query results integration test resources
  IntegrationTestsSqsOperationsFunctionNameParameter:
    Condition: TestEnvironment
    Type: AWS::SSM::Parameter
    Properties:
      Name: !Sub /tests/${AWS::StackName}/SqsOperationsFunctionName
      Type: String
      Value: '{{resolve:ssm:/tests/SqsOperationsFunctionName}}'

  IntegrationTestsWriteTestDataToAthenaBucketQueueUrlParameter:
    Condition: TestEnvironment
    Type: AWS::SSM::Parameter
    Properties:
      Name: !Sub /tests/${AWS::StackName}/WriteTestDataToAthenaBucketQueueUrl
      Type: String
      Value: '{{resolve:ssm:/tests/WriteTestDataToAthenaBucketQueueUrl}}'

  IntegrationTestsNotifySecretSet:
    Condition: TestEnvironment
    Type: AWS::SecretsManager::Secret
    Properties:
      Name: !Sub tests/${AWS::StackName}/NotifySecrets
      KmsKeyId: '{{resolve:ssm:SecretsKmsKeyArn}}'

  IntegrationTestsSecureDownloadWebsiteBaseUrlParameter:
    Condition: TestEnvironment
    Type: AWS::SSM::Parameter
    Properties:
      Name: !Sub /tests/${AWS::StackName}/SecureDownloadWebsiteBaseUrl
      Type: String
      Value:
        !If [
          ApiCustomDomain,
          'https://{{resolve:ssm:ResultsApiDomainName}}/secure',
          !Sub 'https://${ResultsApi}.execute-api.${AWS::Region}.amazonaws.com/${ResultsApi.Stage}/secure'
        ]

  SqsOperationsLambdaPolicy:
    Condition: TestRoleResources
    Type: AWS::Lambda::Permission
    Properties:
      Action: lambda:InvokeFunction
      FunctionName: !GetAtt IntegrationTestsSqsOperationsFunctionNameParameter.Value
      Principal: !Ref TestRoleArn

  ConfirmDownloadRequestLambdaFilter:
    Type: AWS::Logs::MetricFilter
    Properties:
      FilterPattern: 'Error while handling confirm download request'
      LogGroupName: !Ref ConfirmDownloadFunctionLogs
      MetricTransformations:
        - MetricValue: '1'
          MetricNamespace: TxMA/TICFIntegration/Logs
          MetricName: 'ConfirmDownloadRequestLambdaMetric'

  DownloadWarningLambdaFilter:
    Type: AWS::Logs::MetricFilter
    Properties:
      FilterPattern: 'Error while handling download warning request'
      LogGroupName: !Ref DownloadWarningFunctionLogs
      MetricTransformations:
        - MetricValue: '1'
          MetricNamespace: TxMA/TICFIntegration/Logs
          MetricName: 'DownloadWarningLambdaMetric'

  SendEmailRequestToNotifyLambdaFilter:
    Type: AWS::Logs::MetricFilter
    Properties:
      FilterPattern: 'requestNotSentToNotify'
      LogGroupName: !Ref SendEmailRequestToNotifyLogs
      MetricTransformations:
        - MetricValue: '1'
          MetricNamespace: TxMA/TICFIntegration/Logs
          MetricName: 'SendEmailRequestToNotifyLambdaMetric'

  ConfirmDownloadRequestLambdaAlarm:
    Type: AWS::CloudWatch::Alarm
    Properties:
      AlarmActions:
        - !ImportValue txma-alarms-slack-alerts-BuildNotificationTopicArn
      AlarmDescription: 'An alarm that is triggered by an error within the ConfirmDownloadRequestFunction lambda.'
      AlarmName: !Sub ${AWS::StackName}-confirm-download-lambda-alarm
      ComparisonOperator: GreaterThanOrEqualToThreshold
      DatapointsToAlarm: 1
      EvaluationPeriods: 1
      MetricName: ConfirmDownloadRequestLambdaMetric
      Namespace: TxMA/TICFIntegration/Logs
      Period: 3600
      Statistic: Sum
      Threshold: 1
      TreatMissingData: notBreaching

  DownloadWarningLambdaAlarm:
    Type: AWS::CloudWatch::Alarm
    Properties:
      AlarmActions:
        - !ImportValue txma-alarms-slack-alerts-BuildNotificationTopicArn
      AlarmDescription: 'An alarm that is triggered by an error within the DownloadWarningFunction lambda.'
      AlarmName: !Sub ${AWS::StackName}-download-warning-lambda-alarm
      ComparisonOperator: GreaterThanOrEqualToThreshold
      DatapointsToAlarm: 1
      EvaluationPeriods: 1
      MetricName: DownloadWarningLambdaMetric
      Namespace: TxMA/TICFIntegration/Logs
      Period: 3600
      Statistic: Sum
      Threshold: 1
      TreatMissingData: notBreaching

  SendEmailRequestToNotifyLambdaAlarm:
    Type: AWS::CloudWatch::Alarm
    Properties:
      AlarmActions:
        - !ImportValue txma-alarms-slack-alerts-BuildNotificationTopicArn
      AlarmDescription: 'An alarm that is triggered by an error with the event body or with trying to send the email in the SendEmailRequestToNotifyFunction lambda.'
      AlarmName: !Sub ${AWS::StackName}-send-email-request-to-notify-lambda-alarm
      ComparisonOperator: GreaterThanOrEqualToThreshold
      DatapointsToAlarm: 1
      EvaluationPeriods: 1
      MetricName: SendEmailRequestToNotifyLambdaMetric
      Namespace: TxMA/TICFIntegration/Logs
      Period: 3600
      Statistic: Sum
      Threshold: 1
      TreatMissingData: notBreaching