lono 3.0.1 → 3.1.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: a7bf899e0c6e9dba34f0aff2e220325275f419fd
-  data.tar.gz: 47400300431d3be963f406faff2ce98b369021d9
+  metadata.gz: ab4d099f039afce1da99fa539e4f09d5297b8405
+  data.tar.gz: 3a566f0d7c3b68dca04bdf5b62e0bdb435ad5d39
 SHA512:
-  metadata.gz: 9e4b477af4147d519185b81ad26ad1489739d13ddc849dde311fdf3994862132c56e567f13cb18f0ccfe554042f4a044703c00e46a2d5601aaeb1045f7afa98a
-  data.tar.gz: 95b037ae178f17e914542ef48667fc4196235c8ce68a9b997fa1d339f6a2584841b0707c06b047318eb699052e2a00e9643726390dc6ff4eeb5072ee69be9151
+  metadata.gz: c40c0fe52867c7122464a6a2bd8d33f3a9508103b643d6a28f902c0fc965b60721264413c3faedf0ba8c898cd774b16f8aa1da14a0cd8c1565ab4923ea91f992
+  data.tar.gz: 3c2b37adac7f040ad08455c85d0326af2f64b743ca6a624d4c5c36512a33666fe7830008e78f8dd3863ec37c895bac882f983b5fc953e63f0ef11681e508cf88

data/.gitignore

@@ -7,3 +7,4 @@ pkg
 tmp
 output
 spec/project
+spec/fixtures/my_project/templates/aws-waf-security-automations.yml

data/CHANGELOG.md

@@ -3,6 +3,12 @@
 All notable changes to this project will be documented in this file.
 This project *tries* to adhere to [Semantic Versioning](http://semver.org/), even before v1.0.
 
+## [3.1.1]
+- update lono import and new cli help
+
+## [3.1.0]
+- lono import command
+
 ## [3.0.1]
 - update aws-sdk to version 3
 

data/lib/lono.rb

@@ -24,6 +24,7 @@ module Lono
   autoload :Param, 'lono/param'
   autoload :Clean, 'lono/clean'
   autoload :Settings, 'lono/settings'
+  autoload :Importer, 'lono/importer'
 end
 
 Lono::Env.setup!

data/lib/lono/cfn/diff.rb

@@ -43,6 +43,6 @@ class Lono::Cfn::Diff < Lono::Cfn::Base
   end
 
   def existing_template_path
-    "/tmp/existing_cfn_template.json"
+    "/tmp/existing_cfn_template.yml"
   end
 end

data/lib/lono/cfn/util.rb

@@ -14,7 +14,7 @@ module Lono::Cfn::Util
     end
 
     unless sure =~ /^y/
-      puts "Exiting without #{action}"
+      puts "Whew! Exiting without running #{action}."
       exit 0
     end
   end

data/lib/lono/cli.rb

@@ -6,7 +6,7 @@ module Lono
   class CLI < Lono::Command
 
     desc "new [NAME]", "Generates lono starter project"
-    Help.new_long_desc
+    long_desc Help.new_long_desc
     option :force, type: :boolean, aliases: "-f", desc: "override existing starter files"
     option :quiet, type: :boolean, aliases: "-q", desc: "silence the output"
     option :format, type: :string, default: "yaml", desc: "starter project template format: json or yaml"
@@ -14,6 +14,14 @@ module Lono
       Lono::New.new(options.clone.merge(project_root: project_root)).run
     end
 
+    desc "import [SOURCE]", "Imports raw CloudFormation template and lono-fies it"
+    long_desc Help.import
+    option :format, type: :string, default: "yaml", desc: "format for the final template"
+    option :project_root, default: ".", aliases: "-r", desc: "project root"
+    def import(source)
+      Importer.new(source, options).run
+    end
+
     desc "generate", "Generate both CloudFormation templates and parameters files"
     Help.generate
     option :clean, type: :boolean, aliases: "-c", desc: "remove all output files before generating"

data/lib/lono/help.rb

@@ -9,6 +9,20 @@ $ lono new lono
 EOL
   end
 
+  def import
+<<-EOL
+Examples:
+
+$ lono import /path/to/file
+
+$ lono import http://url.com/path/to/template.json
+
+$ lono import http://url.com/path/to/template.yml
+
+Imports a raw CloudFormation template and lono-fies it.
+EOL
+  end
+
   def generate
 <<-EOL
 Examples:
@@ -19,7 +33,6 @@ $ lono g -c # shortcut
 
 Builds both CloudFormation template and parameter files based on lono project and writes them to the output folder on the filesystem.
 EOL
-
   end
 
   def template

data/lib/lono/importer.rb

@@ -0,0 +1,60 @@
+require "open-uri"
+require "json"
+require "yaml"
+
+class Lono::Importer
+  attr_reader :options
+  def initialize(source, options)
+    @source = source
+    @options = options
+    @format = normalize_format(@options[:format])
+    @project_root = options[:project_root] || '.'
+  end
+
+  def run
+    download_template
+    add_template_definition
+    puts "Imported raw CloudFormation template and lono-fied it!"
+  end
+
+  def download_template
+    template =  open(@source).read
+
+    result = if @format == 'yml'
+                YAML.dump(YAML.load(template))
+              else
+                JSON.pretty_generate(JSON.load(template))
+              end
+
+    folder = File.dirname(dest_path)
+    FileUtils.mkdir_p(folder) unless File.exist?(folder)
+    IO.write(dest_path, result)
+    puts "Template downloaded to #{dest_path}."
+  end
+
+  # Add template definition to config/templates/base/stacks.rb.
+  def add_template_definition
+    path = "#{@project_root}/config/templates/base/stacks.rb"
+    lines = File.exist?(path) ? IO.readlines(path) : []
+    new_template_definition = %Q|template "#{template_name}"|
+    unless lines.detect { |l| l.include?(new_template_definition) }
+      lines << ["\n", new_template_definition]
+      result = lines.join('')
+      IO.write(path, result)
+    end
+    puts "Template definition added to #{path}."
+  end
+
+  def dest_path
+    "#{@project_root}/templates/#{template_name}.#{@format}"
+  end
+
+  def template_name
+    File.basename(@source, ".*")
+  end
+
+private
+  def normalize_format(format)
+    format == 'yaml' ? 'yml' : format
+  end
+end

data/lib/lono/template/upload.rb

@@ -1,6 +1,7 @@
 require 'erb'
 require 'json'
 require 'base64'
+require 'digest'
 
 class Lono::Template::Upload
   include Lono::Template::AwsServices
@@ -8,10 +9,13 @@ class Lono::Template::Upload
   def initialize(options={})
     @options = options
     @project_root = options[:project_root] || '.'
+    @checksums = {}
   end
 
   def run
     ensure_s3_setup!
+    load_checksums!
+
     paths = Dir.glob("#{@project_root}/output/**/*")
     paths.reject { |p| p =~ %r{output/params} }.
           select { |p| File.file?(p) }.each do |path|
@@ -20,11 +24,48 @@ class Lono::Template::Upload
     say "Templates uploaded to s3."
   end
 
+  # Read existing files on s3 to grab their md5 checksum.
+  # We do this so we can see if we should avoid re-uploading the s3 child template
+  # entirely. If we upload a new child template that does not change AWS CloudFormation
+  # is not smart enough to know that it not has changed. I think all AWS CloudFormation
+  # does is check if the file's timestamp.
+  #
+  # Thought this would result in better AWS Change Set info but AWS still reports child
+  # stacks being changed even though they should not be reported.  Leaving this s3 checksum
+  # in for now.
+  def load_checksums!
+    return if @options[:noop]
+
+    prefix = "#{s3_path}/#{LONO_ENV}" # s3://s3-bucket-and-path-from-settings/prod
+    resp = s3.list_objects(bucket: s3_bucket, prefix: prefix)
+    resp.contents.each do |object|
+      # key does not include the bucket name
+      #    full path = s3://my-bucket/cloudformation-templates/prod/my-template.yml
+      #    key = cloudformation-templates/prod/my-template.yml
+      # etag is the checksum as long as the file is not a multi-part file upload
+      # it has extra double quotes wrapped around it.
+      #    etag = "\"9cb437490cee2cc96101baf326e5ca81\""
+      @checksums[object.key] = strip_surrounding_quotes(object.etag)
+    end
+    @checksums
+  end
+
+  def strip_surrounding_quotes(string)
+    string.sub(/^"/,'').sub(/"$/,'')
+  end
+
   def upload(path)
     pretty_path = path.sub(/^\.\//, '')
     key = "#{s3_path}/#{LONO_ENV}/#{pretty_path.sub(/^output\//,'')}"
     s3_full_path = "s3://#{s3_bucket}/#{key}"
 
+    local_checksum = Digest::MD5.hexdigest(IO.read(path))
+    remote_checksum = remote_checksum(path)
+    if local_checksum == remote_checksum
+      say("Not modified: #{pretty_path} to #{s3_full_path}".colorize(:yellow)) unless @options[:noop]
+      return # do not upload unless the checksum has changed
+    end
+
     resp = s3.put_object(
       body: IO.read(path),
       bucket: s3_bucket,
@@ -32,11 +73,26 @@ class Lono::Template::Upload
       storage_class: "REDUCED_REDUNDANCY"
     ) unless @options[:noop]
 
-    message = "Uploaded: #{pretty_path} to #{s3_full_path}"
+    # Example output:
+    # Uploaded: output/docker.yml to s3://boltops-stag/cloudformation-templates/stag/docker.yml
+    # Uploaded: output/ecs/private.yml to s3://boltops-stag/cloudformation-templates/stag/ecs/private.yml
+    message = "Uploaded: #{pretty_path} to #{s3_full_path}".colorize(:green)
     message = "NOOP: #{message}" if @options[:noop]
     say message
   end
 
+  # @checksums map has a key format: cloudformation-templates/stag/docker.yml
+  #
+  # path = ./output/docker.yml
+  # s3_path = s3://boltops-stag/cloudformation-templates/stag/docker.yml
+  def remote_checksum(path)
+    # first convert the local path to the path format that is stored in @checksums keys
+    # ./output/docker.yml => cloudformation-templates/stag/docker.yml
+    pretty_path = path.sub(/^\.\//, '')
+    key = "#{s3_path}/#{LONO_ENV}/#{pretty_path.sub(/^output\//,'')}"
+    @checksums[key]
+  end
+
   # https://s3.amazonaws.com/mybucket/cloudformation-templates/prod/parent.yml
   def s3_https_url(template_path)
     ensure_s3_setup!

data/lib/lono/version.rb

@@ -1,3 +1,3 @@
 module Lono
-  VERSION = "3.0.1"
+  VERSION = "3.1.1"
 end

data/spec/fixtures/raw_templates/aws-waf-security-automations.template

@@ -0,0 +1,1575 @@
+{
+  "AWSTemplateFormatVersion": "2010-09-09",
+  "Description": "(SO0006-CloudFront) - AWS WAF Security Automations: This AWS CloudFormation template helps you provision the AWS WAF Security Automations stack without worrying about creating and configuring the underlying AWS infrastructure. **WARNING** This template creates an AWS Lambda function, an AWS WAF Web ACL, an Amazon S3 bucket, and an Amazon CloudWatch custom metric. You will be billed for the AWS resources used if you create a stack from this template. **NOTICE** Copyright 2016 Amazon.com, Inc. or its affiliates. All Rights Reserved. Licensed under the Amazon Software License (the License). You may not use this file except in compliance with the License. A copy of the License is located at http://aws.amazon.com/asl/ or in the license file accompanying this file. This file is distributed on an AS IS BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, express or implied. See the License for the specific language governing permissions and limitations under the License.",
+  "Metadata": {
+    "AWS::CloudFormation::Interface": {
+      "ParameterGroups": [{
+        "Label": {
+          "default": "Protection List"
+        },
+        "Parameters": ["SqlInjectionProtectionParam", "CrossSiteScriptingProtectionParam", "ActivateHttpFloodProtectionParam", "ActivateScansProbesProtectionParam", "ActivateReputationListsProtectionParam", "ActivateBadBotProtectionParam"]
+      }, {
+        "Label": {
+          "default": "Settings"
+        },
+        "Parameters": ["CloudFrontAccessLogBucket"]
+      }, {
+        "Label": {
+          "default": "Advanced Settings"
+        },
+        "Parameters": ["RequestThreshold", "ErrorThreshold", "WAFBlockPeriod"]
+      }, {
+        "Label": {
+          "default": "Anonymous Metrics Request"
+        },
+        "Parameters": ["SendAnonymousUsageData"]
+      }],
+      "ParameterLabels": {
+        "SqlInjectionProtectionParam": {
+          "default": "Activate SQL Injection Protection"
+        },
+        "CrossSiteScriptingProtectionParam": {
+          "default": "Activate Cross-site Scripting Protection"
+        },
+        "ActivateHttpFloodProtectionParam": {
+          "default": "Activate HTTP Flood Protection"
+        },
+        "ActivateScansProbesProtectionParam": {
+          "default": "Activate Scanner & Probe Protection"
+        },
+        "ActivateReputationListsProtectionParam": {
+          "default": "Activate Reputation List Protection"
+        },
+        "ActivateBadBotProtectionParam": {
+          "default": "Activate Bad Bot Protection"
+        },
+        "CloudFrontAccessLogBucket": {
+          "default": "CloudFront Access Log Bucket Name"
+        },
+        "SendAnonymousUsageData": {
+          "default": "Send Anonymous Usage Data"
+        },
+        "RequestThreshold": {
+          "default": "Request Threshold"
+        },
+        "ErrorThreshold": {
+          "default": "Error Threshold"
+        },
+        "WAFBlockPeriod": {
+          "default": "WAF Block Period"
+        }
+      }
+    }
+  },
+
+
+  "Parameters": {
+    "SqlInjectionProtectionParam": {
+      "Type": "String",
+      "Default": "yes",
+      "AllowedValues": ["yes", "no"],
+      "Description": "Choose yes to enable the component designed to block common SQL injection attacks."
+    },
+    "CrossSiteScriptingProtectionParam": {
+      "Type": "String",
+      "Default": "yes",
+      "AllowedValues": ["yes", "no"],
+      "Description": "Choose yes to enable the component designed to block common XSS attacks."
+    },
+    "ActivateHttpFloodProtectionParam": {
+      "Type": "String",
+      "Default": "yes",
+      "AllowedValues": ["yes", "no"],
+      "Description": "Choose yes to enable the component designed to block HTTP flood attacks."
+    },
+    "ActivateScansProbesProtectionParam": {
+      "Type": "String",
+      "Default": "yes",
+      "AllowedValues": ["yes", "no"],
+      "Description": "Choose yes to enable the component designed to block scanners and probes."
+    },
+    "ActivateReputationListsProtectionParam": {
+      "Type": "String",
+      "Default": "yes",
+      "AllowedValues": ["yes", "no"],
+      "Description": "Choose yes to block requests from IP addresses on third-party reputation lists (supported lists: spamhaus, torproject, and emergingthreats)."
+    },
+    "ActivateBadBotProtectionParam": {
+      "Type": "String",
+      "Default": "yes",
+      "AllowedValues": ["yes", "no"],
+      "Description": "Choose yes to enable the component designed to block bad bots and content scrapers."
+    },
+    "CloudFrontAccessLogBucket": {
+      "Type": "String",
+      "Default": "",
+      "AllowedPattern": "(^$|^([a-z]|(\\d(?!\\d{0,2}\\.\\d{1,3}\\.\\d{1,3}\\.\\d{1,3})))([a-z\\d]|(\\.(?!(\\.|-)))|(-(?!\\.))){1,61}[a-z\\d]$)",
+      "Description": "Enter a name for the Amazon S3 bucket where you want to store Amazon CloudFront access logs. This can be the name of either an existing S3 bucket, or a new bucket that the template will create during stack launch (if it does not find a matching bucket name). The solution will modify the bucket’s notification configuration to trigger the Log Parser AWS Lambda function whenever a new log file is saved in this bucket. More about bucket name restriction here: http://amzn.to/1p1YlU5"
+    },
+    "SendAnonymousUsageData": {
+      "Type": "String",
+      "Default": "yes",
+      "AllowedValues": ["yes", "no"],
+      "Description": "Send anonymous data to AWS to help us understand solution usage across our customer base as a whole. To opt out of this feature, select No."
+    },
+    "RequestThreshold": {
+      "Type": "Number",
+      "Default": "400",
+      "Description": "If you chose yes for the Activate HTTP Flood Protection parameter, enter the maximum acceptable requests per minute per IP address. If you chose to deactivate this protection, ignore this parameter."
+    },
+    "ErrorThreshold": {
+      "Type": "Number",
+      "Default": "50",
+      "Description": "If you chose yes for the Activate Scanners & Probes Protection parameter, enter the maximum acceptable bad requests per minute per IP. If you chose to deactivate Scanners & Probes protection, ignore this parameter."
+    },
+    "WAFBlockPeriod": {
+      "Type": "Number",
+      "Default": "240",
+      "Description": "If you chose yes for the Activate HTTP Flood Protection or Activate Scanners & Probes Protection parameters, enter the period (in minutes) to block applicable IP addresses. If you chose to deactivate both types of protection, ignore this parameter."
+    }
+  },
+
+
+  "Conditions": {
+    "SqlInjectionProtectionActivated": {
+      "Fn::Equals": [{
+        "Ref": "SqlInjectionProtectionParam"
+      }, "yes"]
+    },
+    "CrossSiteScriptingProtectionActivated": {
+      "Fn::Equals": [{
+        "Ref": "CrossSiteScriptingProtectionParam"
+      }, "yes"]
+    },
+    "HttpFloodProtectionActivated": {
+      "Fn::Equals": [{
+        "Ref": "ActivateHttpFloodProtectionParam"
+      }, "yes"]
+    },
+    "ScansProbesProtectionActivated": {
+      "Fn::Equals": [{
+        "Ref": "ActivateScansProbesProtectionParam"
+      }, "yes"]
+    },
+    "ReputationListsProtectionActivated": {
+      "Fn::Equals": [{
+        "Ref": "ActivateReputationListsProtectionParam"
+      }, "yes"]
+    },
+    "BadBotProtectionActivated": {
+      "Fn::Equals": [{
+        "Ref": "ActivateBadBotProtectionParam"
+      }, "yes"]
+    },
+    "LogParserActivated": {
+      "Fn::Or": [{
+        "Condition": "HttpFloodProtectionActivated"
+      }, {
+        "Condition": "ScansProbesProtectionActivated"
+      }]
+    },
+    "CreateWebACL": {
+      "Fn::Or": [{
+        "Condition": "SqlInjectionProtectionActivated"
+      }, {
+        "Condition": "CrossSiteScriptingProtectionActivated"
+      }, {
+        "Condition": "LogParserActivated"
+      }, {
+        "Condition": "ReputationListsProtectionActivated"
+      }, {
+        "Condition": "BadBotProtectionActivated"
+      }]
+    }
+  },
+  "Resources": {
+    "WAFWhitelistSet": {
+      "Type": "AWS::WAF::IPSet",
+      "Condition": "CreateWebACL",
+      "Properties": {
+        "Name": {
+          "Fn::Join": [" - ", [{
+            "Ref": "AWS::StackName"
+          }, "Whitelist Set"]]
+        }
+      }
+    },
+    "WAFBlacklistSet": {
+      "Type": "AWS::WAF::IPSet",
+      "Condition": "LogParserActivated",
+      "Properties": {
+        "Name": {
+          "Fn::Join": [" - ", [{
+            "Ref": "AWS::StackName"
+          }, "Blacklist Set"]]
+        }
+      }
+    },
+    "WAFAutoBlockSet": {
+      "Type": "AWS::WAF::IPSet",
+      "Condition": "LogParserActivated",
+      "Properties": {
+        "Name": {
+          "Fn::Join": [" - ", [{
+            "Ref": "AWS::StackName"
+          }, "Auto Block Set"]]
+        }
+      }
+    },
+    "WAFReputationListsSet1": {
+      "Type": "AWS::WAF::IPSet",
+      "Condition": "ReputationListsProtectionActivated",
+      "Properties": {
+        "Name": {
+          "Fn::Join": [" - ", [{
+            "Ref": "AWS::StackName"
+          }, "IP Reputation Lists Set #1"]]
+        }
+      }
+    },
+    "WAFReputationListsSet2": {
+      "Type": "AWS::WAF::IPSet",
+      "Condition": "ReputationListsProtectionActivated",
+      "Properties": {
+        "Name": {
+          "Fn::Join": [" - ", [{
+            "Ref": "AWS::StackName"
+          }, "IP Reputation Lists Set #2"]]
+        }
+      }
+    },
+    "WAFBadBotSet": {
+      "Type": "AWS::WAF::IPSet",
+      "Condition": "BadBotProtectionActivated",
+      "Properties": {
+        "Name": {
+          "Fn::Join": [" - ", [{
+            "Ref": "AWS::StackName"
+          }, "IP Bad Bot Set"]]
+        }
+      }
+    },
+    "WAFSqlInjectionDetection": {
+      "Type": "AWS::WAF::SqlInjectionMatchSet",
+      "Condition": "SqlInjectionProtectionActivated",
+      "Properties": {
+        "Name": {
+          "Fn::Join": [" - ", [{
+            "Ref": "AWS::StackName"
+          }, "SQL injection Detection"]]
+        },
+        "SqlInjectionMatchTuples": [{
+          "FieldToMatch": {
+            "Type": "QUERY_STRING"
+          },
+          "TextTransformation": "URL_DECODE"
+        }, {
+          "FieldToMatch": {
+            "Type": "QUERY_STRING"
+          },
+          "TextTransformation": "HTML_ENTITY_DECODE"
+        }, {
+          "FieldToMatch": {
+            "Type": "BODY"
+          },
+          "TextTransformation": "URL_DECODE"
+        }, {
+          "FieldToMatch": {
+            "Type": "BODY"
+          },
+          "TextTransformation": "HTML_ENTITY_DECODE"
+        }, {
+          "FieldToMatch": {
+            "Type": "URI"
+          },
+          "TextTransformation": "URL_DECODE"
+        }, {
+          "FieldToMatch": {
+            "Type": "URI"
+          },
+          "TextTransformation": "HTML_ENTITY_DECODE"
+        }]
+      }
+    },
+    "WAFXssDetection": {
+      "Type": "AWS::WAF::XssMatchSet",
+      "Condition": "CrossSiteScriptingProtectionActivated",
+      "Properties": {
+        "Name": {
+          "Fn::Join": [" - ", [{
+            "Ref": "AWS::StackName"
+          }, "XSS Detection Detection"]]
+        },
+        "XssMatchTuples": [{
+          "FieldToMatch": {
+            "Type": "QUERY_STRING"
+          },
+          "TextTransformation": "URL_DECODE"
+        }, {
+          "FieldToMatch": {
+            "Type": "QUERY_STRING"
+          },
+          "TextTransformation": "HTML_ENTITY_DECODE"
+        }, {
+          "FieldToMatch": {
+            "Type": "BODY"
+          },
+          "TextTransformation": "URL_DECODE"
+        }, {
+          "FieldToMatch": {
+            "Type": "BODY"
+          },
+          "TextTransformation": "HTML_ENTITY_DECODE"
+        }, {
+          "FieldToMatch": {
+            "Type": "URI"
+          },
+          "TextTransformation": "URL_DECODE"
+        }, {
+          "FieldToMatch": {
+            "Type": "URI"
+          },
+          "TextTransformation": "HTML_ENTITY_DECODE"
+        }]
+      }
+    },
+    "WAFWhitelistRule": {
+      "Type": "AWS::WAF::Rule",
+      "Condition": "CreateWebACL",
+      "DependsOn": "WAFWhitelistSet",
+      "Properties": {
+        "Name": {
+          "Fn::Join": [" - ", [{
+            "Ref": "AWS::StackName"
+          }, "Whitelist Rule"]]
+        },
+        "MetricName": "SecurityAutomationsWhitelistRule",
+        "Predicates": [{
+          "DataId": {
+            "Ref": "WAFWhitelistSet"
+          },
+          "Negated": false,
+          "Type": "IPMatch"
+        }]
+      }
+    },
+    "WAFBlacklistRule": {
+      "Type": "AWS::WAF::Rule",
+      "Condition": "LogParserActivated",
+      "DependsOn": "WAFBlacklistSet",
+      "Properties": {
+        "Name": {
+          "Fn::Join": [" - ", [{
+            "Ref": "AWS::StackName"
+          }, "Blacklist Rule"]]
+        },
+        "MetricName": "SecurityAutomationsBlacklistRule",
+        "Predicates": [{
+          "DataId": {
+            "Ref": "WAFBlacklistSet"
+          },
+          "Negated": false,
+          "Type": "IPMatch"
+        }]
+      }
+    },
+    "WAFAutoBlockRule": {
+      "Type": "AWS::WAF::Rule",
+      "Condition": "LogParserActivated",
+      "DependsOn": "WAFAutoBlockSet",
+      "Properties": {
+        "Name": {
+          "Fn::Join": [" - ", [{
+            "Ref": "AWS::StackName"
+          }, "Auto Block Rule"]]
+        },
+        "MetricName": "SecurityAutomationsAutoBlockRule",
+        "Predicates": [{
+          "DataId": {
+            "Ref": "WAFAutoBlockSet"
+          },
+          "Negated": false,
+          "Type": "IPMatch"
+        }]
+      }
+    },
+    "WAFIPReputationListsRule1": {
+      "Type": "AWS::WAF::Rule",
+      "Condition": "ReputationListsProtectionActivated",
+      "DependsOn": "WAFReputationListsSet1",
+      "Properties": {
+        "Name": {
+          "Fn::Join": [" - ", [{
+            "Ref": "AWS::StackName"
+          }, "WAF IP Reputation Lists Rule #1"]]
+        },
+        "MetricName": "SecurityAutomationsIPReputationListsRule1",
+        "Predicates": [{
+          "DataId": {
+            "Ref": "WAFReputationListsSet1"
+          },
+          "Type": "IPMatch",
+          "Negated": "false"
+        }]
+      }
+    },
+    "WAFIPReputationListsRule2": {
+      "Type": "AWS::WAF::Rule",
+      "Condition": "ReputationListsProtectionActivated",
+      "DependsOn": "WAFReputationListsSet2",
+      "Properties": {
+        "Name": {
+          "Fn::Join": [" - ", [{
+            "Ref": "AWS::StackName"
+          }, "WAF IP Reputation Lists Rule #2"]]
+        },
+        "MetricName": "SecurityAutomationsIPReputationListsRule2",
+        "Predicates": [{
+          "DataId": {
+            "Ref": "WAFReputationListsSet2"
+          },
+          "Type": "IPMatch",
+          "Negated": "false"
+        }]
+      }
+    },
+    "WAFBadBotRule": {
+      "Type": "AWS::WAF::Rule",
+      "Condition": "BadBotProtectionActivated",
+      "DependsOn": "WAFBadBotSet",
+      "Properties": {
+        "Name": {
+          "Fn::Join": [" - ", [{
+            "Ref": "AWS::StackName"
+          }, "Bad Bot Rule"]]
+        },
+        "MetricName": "SecurityAutomationsBadBotRule",
+        "Predicates": [{
+          "DataId": {
+            "Ref": "WAFBadBotSet"
+          },
+          "Type": "IPMatch",
+          "Negated": "false"
+        }]
+      }
+    },
+    "WAFSqlInjectionRule": {
+      "Type": "AWS::WAF::Rule",
+      "Condition": "SqlInjectionProtectionActivated",
+      "DependsOn": "WAFSqlInjectionDetection",
+      "Properties": {
+        "Name": {
+          "Fn::Join": [" - ", [{
+            "Ref": "AWS::StackName"
+          }, "SQL Injection Rule"]]
+        },
+        "MetricName": "SecurityAutomationsSqlInjectionRule",
+        "Predicates": [{
+          "DataId": {
+            "Ref": "WAFSqlInjectionDetection"
+          },
+          "Negated": false,
+          "Type": "SqlInjectionMatch"
+        }]
+      }
+    },
+    "WAFXssRule": {
+      "Type": "AWS::WAF::Rule",
+      "Condition": "CrossSiteScriptingProtectionActivated",
+      "DependsOn": "WAFXssDetection",
+      "Properties": {
+        "Name": {
+          "Fn::Join": [" - ", [{
+            "Ref": "AWS::StackName"
+          }, "XSS Rule"]]
+        },
+        "MetricName": "SecurityAutomationsXssRule",
+        "Predicates": [{
+          "DataId": {
+            "Ref": "WAFXssDetection"
+          },
+          "Negated": false,
+          "Type": "XssMatch"
+        }]
+      }
+    },
+    "WAFWebACL": {
+      "Type": "AWS::WAF::WebACL",
+      "Condition": "CreateWebACL",
+      "DependsOn": ["WAFWhitelistRule"],
+      "Properties": {
+        "Name": {
+          "Ref": "AWS::StackName"
+        },
+        "DefaultAction": {
+          "Type": "ALLOW"
+        },
+        "MetricName": "SecurityAutomationsMaliciousRequesters",
+        "Rules": [{
+          "Action": {
+            "Type": "ALLOW"
+          },
+          "Priority": 10,
+          "RuleId": {
+            "Ref": "WAFWhitelistRule"
+          }
+        }]
+      }
+    },
+    "LambdaRoleLogParser": {
+      "Type": "AWS::IAM::Role",
+      "Condition": "LogParserActivated",
+      "Properties": {
+        "AssumeRolePolicyDocument": {
+          "Version": "2012-10-17",
+          "Statement": [{
+            "Effect": "Allow",
+            "Principal": {
+              "Service": ["lambda.amazonaws.com"]
+            },
+            "Action": ["sts:AssumeRole"]
+          }]
+        },
+        "Path": "/",
+        "Policies": [{
+          "PolicyName": "S3Access",
+          "PolicyDocument": {
+            "Version": "2012-10-17",
+            "Statement": [{
+              "Effect": "Allow",
+              "Action": "s3:GetObject",
+              "Resource": {
+                "Fn::Join": ["", ["arn:aws:s3:::", {
+                  "Ref": "CloudFrontAccessLogBucket"
+                }, "/*"]]
+              }
+            }]
+          }
+        }, {
+          "PolicyName": "S3AccessPut",
+          "PolicyDocument": {
+            "Version": "2012-10-17",
+            "Statement": [{
+              "Effect": "Allow",
+              "Action": "s3:PutObject",
+              "Resource": {
+                "Fn::Join": ["", ["arn:aws:s3:::", {
+                  "Ref": "CloudFrontAccessLogBucket"
+                }, "/aws-waf-security-automations-current-blocked-ips.json"]]
+              }
+            }]
+          }
+        }, {
+          "PolicyName": "WAFGetChangeToken",
+          "PolicyDocument": {
+            "Statement": [{
+              "Effect": "Allow",
+              "Action": "waf:GetChangeToken",
+              "Resource": "*"
+            }]
+          }
+        }, {
+          "PolicyName": "WAFGetAndUpdateIPSet",
+          "PolicyDocument": {
+            "Statement": [{
+              "Effect": "Allow",
+              "Action": [
+                "waf:GetIPSet",
+                "waf:UpdateIPSet"
+              ],
+              "Resource": [{
+                "Fn::Join": [
+                  "", [
+                    "arn:aws:waf::", {
+                      "Ref": "AWS::AccountId"
+                    },
+                    ":ipset/", {
+                      "Ref": "WAFBlacklistSet"
+                    }
+                  ]
+                ]
+              }, {
+                "Fn::Join": [
+                  "", [
+                    "arn:aws:waf::", {
+                      "Ref": "AWS::AccountId"
+                    },
+                    ":ipset/", {
+                      "Ref": "WAFAutoBlockSet"
+                    }
+                  ]
+                ]
+              }]
+            }]
+          }
+        }, {
+          "PolicyName": "LogsAccess",
+          "PolicyDocument": {
+            "Version": "2012-10-17",
+            "Statement": [{
+              "Effect": "Allow",
+              "Action": ["logs:CreateLogGroup", "logs:CreateLogStream", "logs:PutLogEvents"],
+              "Resource": { "Fn::Join" : [":", ["arn:aws:logs",{"Ref" : "AWS::Region"},{ "Ref" : "AWS::AccountId" }, "log-group:/aws/lambda/*" ]]}
+            }]
+          }
+        }, {
+          "PolicyName": "CloudWatchAccess",
+          "PolicyDocument": {
+            "Version": "2012-10-17",
+            "Statement": [{
+              "Effect": "Allow",
+              "Action": "cloudwatch:GetMetricStatistics",
+              "Resource": "*"
+            }]
+          }
+        }]
+      }
+    },
+    "LambdaWAFLogParserFunction": {
+      "Type": "AWS::Lambda::Function",
+      "Condition": "LogParserActivated",
+      "DependsOn": ["LambdaRoleLogParser", "WAFBlacklistSet", "WAFAutoBlockSet"],
+      "Properties": {
+        "Description": {
+          "Fn::Join": ["", [
+            "This function parses CloudFront access logs to identify suspicious behavior, such as an abnormal amount of requests or errors. It then blocks those IP addresses for a customer-defined period of time. Parameters: ", {
+              "Ref": "RequestThreshold"
+            },
+            ",", {
+              "Ref": "ErrorThreshold"
+            },
+            ",", {
+              "Ref": "WAFBlockPeriod"
+            },
+            "."
+          ]]
+        },
+        "Handler": "log-parser.lambda_handler",
+        "Role": {
+          "Fn::GetAtt": ["LambdaRoleLogParser", "Arn"]
+        },
+        "Code": {
+          "S3Bucket": {
+            "Fn::Join": ["-", [
+              "solutions", {
+                "Ref": "AWS::Region"
+              }
+            ]]
+          },
+          "S3Key": "aws-waf-security-automations/v2/log-parser.zip"
+        },
+        "Environment": {
+          "Variables": {
+            "OUTPUT_BUCKET": {
+              "Ref": "CloudFrontAccessLogBucket"
+            },
+            "IP_SET_ID_BLACKLIST": {
+              "Ref": "WAFBlacklistSet"
+            },
+            "IP_SET_ID_AUTO_BLOCK": {
+              "Ref": "WAFAutoBlockSet"
+            },
+            "BLACKLIST_BLOCK_PERIOD": {
+              "Ref": "WAFBlockPeriod"
+            },
+            "REQUEST_PER_MINUTE_LIMIT": {
+              "Ref": "RequestThreshold"
+            },
+            "ERROR_PER_MINUTE_LIMIT": {
+              "Ref": "ErrorThreshold"
+            },
+            "SEND_ANONYMOUS_USAGE_DATA": {
+              "Ref": "SendAnonymousUsageData"
+            },
+            "UUID": {
+              "Fn::GetAtt": ["CreateUniqueID", "UUID"]
+            },
+            "LIMIT_IP_ADDRESS_RANGES_PER_IP_MATCH_CONDITION": "10000",
+            "MAX_AGE_TO_UPDATE": "30",
+            "REGION": {
+              "Ref": "AWS::Region"
+            },
+            "LOG_TYPE": "cloudfront"
+          }
+        },
+        "Runtime": "python2.7",
+        "MemorySize": "512",
+        "Timeout": "300"
+      }
+    },
+    "LambdaInvokePermissionLogParser": {
+      "Type": "AWS::Lambda::Permission",
+      "Condition": "LogParserActivated",
+      "DependsOn": "LambdaWAFLogParserFunction",
+      "Properties": {
+        "FunctionName": {
+          "Fn::GetAtt": ["LambdaWAFLogParserFunction", "Arn"]
+        },
+        "Action": "lambda:*",
+        "Principal": "s3.amazonaws.com",
+        "SourceAccount": {
+          "Ref": "AWS::AccountId"
+        }
+      }
+    },
+    "LambdaRoleReputationListsParser": {
+      "Type": "AWS::IAM::Role",
+      "Condition": "ReputationListsProtectionActivated",
+      "Properties": {
+        "AssumeRolePolicyDocument": {
+          "Statement": [{
+            "Effect": "Allow",
+            "Principal": {
+              "Service": [
+                "lambda.amazonaws.com"
+              ]
+            },
+            "Action": "sts:AssumeRole"
+          }]
+        },
+        "Policies": [{
+          "PolicyName": "CloudWatchLogs",
+          "PolicyDocument": {
+            "Statement": [{
+              "Effect": "Allow",
+              "Action": ["logs:CreateLogGroup", "logs:CreateLogStream", "logs:PutLogEvents"],
+              "Resource": { "Fn::Join" : [":", ["arn:aws:logs",{"Ref" : "AWS::Region"},{ "Ref" : "AWS::AccountId" }, "log-group:/aws/lambda/*" ]]}
+            }]
+          }
+        }, {
+          "PolicyName": "WAFGetChangeToken",
+          "PolicyDocument": {
+            "Statement": [{
+              "Effect": "Allow",
+              "Action": "waf:GetChangeToken",
+              "Resource": "*"
+            }]
+          }
+        }, {
+          "PolicyName": "WAFGetAndUpdateIPSet",
+          "PolicyDocument": {
+            "Statement": [{
+              "Effect": "Allow",
+              "Action": [
+                "waf:GetIPSet",
+                "waf:UpdateIPSet"
+              ],
+              "Resource": [{
+                "Fn::Join": [
+                  "", [
+                    "arn:aws:waf::", {
+                      "Ref": "AWS::AccountId"
+                    },
+                    ":ipset/", {
+                      "Ref": "WAFReputationListsSet1"
+                    }
+                  ]
+                ]
+              }, {
+                "Fn::Join": [
+                  "", [
+                    "arn:aws:waf::", {
+                      "Ref": "AWS::AccountId"
+                    },
+                    ":ipset/", {
+                      "Ref": "WAFReputationListsSet2"
+                    }
+                  ]
+                ]
+              }]
+            }]
+          }
+        }, {
+          "PolicyName": "CloudFormationAccess",
+          "PolicyDocument": {
+            "Version": "2012-10-17",
+            "Statement": [{
+              "Effect": "Allow",
+              "Action": "cloudformation:DescribeStacks",
+              "Resource": {
+                "Fn::Join": [
+                  "", [
+                    "arn:aws:cloudformation:", {
+                      "Ref": "AWS::Region"
+                    },
+                    ":", {
+                      "Ref": "AWS::AccountId"
+                    },
+                    ":stack/", {
+                      "Ref": "AWS::StackName"
+                    },
+                    "/*"
+                  ]
+                ]
+              }
+            }]
+          }
+        }, {
+          "PolicyName": "CloudWatchAccess",
+          "PolicyDocument": {
+            "Version": "2012-10-17",
+            "Statement": [{
+              "Effect": "Allow",
+              "Action": "cloudwatch:GetMetricStatistics",
+              "Resource": "*"
+            }]
+          }
+        }]
+      }
+    },
+    "LambdaWAFReputationListsParserFunction": {
+      "Type": "AWS::Lambda::Function",
+      "Condition": "ReputationListsProtectionActivated",
+      "DependsOn": "LambdaRoleReputationListsParser",
+      "Properties": {
+        "Description": "This lambda function checks third-party IP reputation lists hourly for new IP ranges to block. These lists include the Spamhaus Dont Route Or Peer (DROP) and Extended Drop (EDROP) lists, the Proofpoint Emerging Threats IP list, and the Tor exit node list.",
+        "Handler": "reputation-lists-parser.handler",
+        "Role": {
+          "Fn::GetAtt": [
+            "LambdaRoleReputationListsParser",
+            "Arn"
+          ]
+        },
+        "Code": {
+          "S3Bucket": {
+            "Fn::Join": ["-", [
+              "solutions", {
+                "Ref": "AWS::Region"
+              }
+            ]]
+          },
+          "S3Key": "aws-waf-security-automations/v3/reputation-lists-parser.zip"
+        },
+        "Runtime": "nodejs6.10",
+        "MemorySize": "128",
+        "Timeout": "300"
+      }
+    },
+    "LambdaWAFReputationListsParserEventsRule": {
+      "Type": "AWS::Events::Rule",
+      "Condition": "ReputationListsProtectionActivated",
+      "DependsOn": ["LambdaWAFReputationListsParserFunction", "WAFReputationListsSet1", "WAFReputationListsSet2"],
+      "Properties": {
+        "Description": "Security Automations - WAF Reputation Lists",
+        "ScheduleExpression": "rate(1 hour)",
+        "Targets": [{
+          "Arn": {
+            "Fn::GetAtt": [
+              "LambdaWAFReputationListsParserFunction",
+              "Arn"
+            ]
+          },
+          "Id": "LambdaWAFReputationListsParserFunction",
+          "Input": {
+            "Fn::Join": [
+              "", [
+                "{\"lists\":",
+                "[{\"url\":\"https://www.spamhaus.org/drop/drop.txt\"},{\"url\":\"https://check.torproject.org/exit-addresses\",\"prefix\":\"ExitAddress \"},{\"url\":\"https://rules.emergingthreats.net/fwrules/emerging-Block-IPs.txt\"}]",
+                ",\"logType\":\"cloudfront\"",
+                ",\"region\":\"", {
+                  "Ref": "AWS::Region"
+                }, "\",",
+                "\"ipSetIds\": [",
+                "\"", {
+                  "Ref": "WAFReputationListsSet1"
+                },
+                "\",",
+                "\"", {
+                  "Ref": "WAFReputationListsSet2"
+                },
+                "\"",
+                "]}"
+              ]
+            ]
+          }
+        }]
+      }
+    },
+    "LambdaInvokePermissionReputationListsParser": {
+      "Type": "AWS::Lambda::Permission",
+      "Condition": "ReputationListsProtectionActivated",
+      "DependsOn": ["LambdaWAFReputationListsParserFunction", "LambdaWAFReputationListsParserEventsRule"],
+      "Properties": {
+        "FunctionName": {
+          "Ref": "LambdaWAFReputationListsParserFunction"
+        },
+        "Action": "lambda:InvokeFunction",
+        "Principal": "events.amazonaws.com",
+        "SourceArn": {
+          "Fn::GetAtt": [
+            "LambdaWAFReputationListsParserEventsRule",
+            "Arn"
+          ]
+        }
+      }
+    },
+    "LambdaRoleBadBot": {
+      "Type": "AWS::IAM::Role",
+      "Condition": "BadBotProtectionActivated",
+      "Properties": {
+        "AssumeRolePolicyDocument": {
+          "Version": "2012-10-17",
+          "Statement": [{
+            "Effect": "Allow",
+            "Principal": {
+              "Service": ["lambda.amazonaws.com"]
+            },
+            "Action": ["sts:AssumeRole"]
+          }]
+        },
+        "Path": "/",
+        "Policies": [{
+          "PolicyName": "WAFGetChangeToken",
+          "PolicyDocument": {
+            "Statement": [{
+              "Effect": "Allow",
+              "Action": "waf:GetChangeToken",
+              "Resource": "*"
+            }]
+          }
+        }, {
+          "PolicyName": "WAFGetAndUpdateIPSet",
+          "PolicyDocument": {
+            "Statement": [{
+              "Effect": "Allow",
+              "Action": [
+                "waf:GetIPSet",
+                "waf:UpdateIPSet"
+              ],
+              "Resource": {
+                "Fn::Join": [
+                  "", [
+                    "arn:aws:waf::", {
+                      "Ref": "AWS::AccountId"
+                    },
+                    ":ipset/", {
+                      "Ref": "WAFBadBotSet"
+                    }
+                  ]
+                ]
+              }
+            }]
+          }
+        }, {
+          "PolicyName": "LogsAccess",
+          "PolicyDocument": {
+            "Version": "2012-10-17",
+            "Statement": [{
+              "Effect": "Allow",
+              "Action": ["logs:CreateLogGroup", "logs:CreateLogStream", "logs:PutLogEvents"],
+              "Resource": { "Fn::Join" : [":", ["arn:aws:logs",{"Ref" : "AWS::Region"},{ "Ref" : "AWS::AccountId" }, "log-group:/aws/lambda/*" ]]}
+            }]
+          }
+        }, {
+          "PolicyName": "CloudFormationAccess",
+          "PolicyDocument": {
+            "Version": "2012-10-17",
+            "Statement": [{
+              "Effect": "Allow",
+              "Action": "cloudformation:DescribeStacks",
+              "Resource": {
+                "Fn::Join": [
+                  "", [
+                    "arn:aws:cloudformation:", {
+                      "Ref": "AWS::Region"
+                    },
+                    ":", {
+                      "Ref": "AWS::AccountId"
+                    },
+                    ":stack/", {
+                      "Ref": "AWS::StackName"
+                    },
+                    "/*"
+                  ]
+                ]
+              }
+            }]
+          }
+        }, {
+          "PolicyName": "CloudWatchAccess",
+          "PolicyDocument": {
+            "Version": "2012-10-17",
+            "Statement": [{
+              "Effect": "Allow",
+              "Action": "cloudwatch:GetMetricStatistics",
+              "Resource": "*"
+            }]
+          }
+        }]
+      }
+    },
+    "LambdaWAFBadBotParserFunction": {
+      "Type": "AWS::Lambda::Function",
+      "Condition": "BadBotProtectionActivated",
+      "DependsOn": "LambdaRoleBadBot",
+      "Properties": {
+        "Description": "This lambda function will intercepts and inspects trap endpoint requests to extract its IP address, and then add it to an AWS WAF block list.",
+        "Handler": "access-handler.lambda_handler",
+        "Role": {
+          "Fn::GetAtt": ["LambdaRoleBadBot", "Arn"]
+        },
+        "Code": {
+          "S3Bucket": {
+            "Fn::Join": ["-", [
+              "solutions", {
+                "Ref": "AWS::Region"
+              }
+            ]]
+          },
+          "S3Key": "aws-waf-security-automations/v2/access-handler.zip"
+        },
+        "Environment": {
+          "Variables": {
+            "IP_SET_ID_BAD_BOT": {
+              "Ref": "WAFBadBotSet"
+            },
+            "SEND_ANONYMOUS_USAGE_DATA": {
+              "Ref": "SendAnonymousUsageData"
+            },
+            "UUID": {
+              "Fn::GetAtt": ["CreateUniqueID", "UUID"]
+            },
+            "REGION": {
+              "Ref": "AWS::Region"
+            },
+            "LOG_TYPE": "cloudfront"
+          }
+        },
+        "Runtime": "python2.7",
+        "MemorySize": "128",
+        "Timeout": "300"
+      }
+    },
+    "LambdaInvokePermissionBadBot": {
+      "Type": "AWS::Lambda::Permission",
+      "Condition": "BadBotProtectionActivated",
+      "DependsOn": "LambdaWAFBadBotParserFunction",
+      "Properties": {
+        "FunctionName": {
+          "Fn::GetAtt": ["LambdaWAFBadBotParserFunction", "Arn"]
+        },
+        "Action": "lambda:*",
+        "Principal": "apigateway.amazonaws.com"
+      }
+    },
+    "ApiGatewayBadBot": {
+      "Type": "AWS::ApiGateway::RestApi",
+      "Condition": "BadBotProtectionActivated",
+      "Properties": {
+        "Name": "Security Automations - WAF Bad Bot API",
+        "Description": "API created by AWS WAF Security Automations CloudFormation template. This endpoint will be used to capture bad bots."
+      }
+    },
+    "ApiGatewayBadBotResource": {
+      "Type": "AWS::ApiGateway::Resource",
+      "Properties": {
+        "RestApiId": {
+          "Ref": "ApiGatewayBadBot"
+        },
+        "ParentId": {
+          "Fn::GetAtt": ["ApiGatewayBadBot", "RootResourceId"]
+        },
+        "PathPart": "{proxy+}"
+      }
+    },
+    "ApiGatewayBadBotMethodRoot": {
+      "Type": "AWS::ApiGateway::Method",
+      "Condition": "BadBotProtectionActivated",
+      "DependsOn": ["LambdaWAFBadBotParserFunction", "LambdaInvokePermissionBadBot", "ApiGatewayBadBot"],
+      "Properties": {
+        "RestApiId": {
+          "Ref": "ApiGatewayBadBot"
+        },
+        "ResourceId": {
+          "Fn::GetAtt": ["ApiGatewayBadBot", "RootResourceId"]
+        },
+        "HttpMethod": "ANY",
+        "AuthorizationType": "NONE",
+        "RequestParameters": {
+          "method.request.header.X-Forwarded-For": false
+        },
+        "Integration": {
+          "Type": "AWS_PROXY",
+          "IntegrationHttpMethod": "POST",
+          "Uri": {
+            "Fn::Join": ["", [
+              "arn:aws:apigateway:", {
+                "Ref": "AWS::Region"
+              },
+              ":lambda:path/2015-03-31/functions/", {
+                "Fn::GetAtt": ["LambdaWAFBadBotParserFunction", "Arn"]
+              },
+              "/invocations"
+            ]]
+          }
+        }
+      }
+    },
+    "ApiGatewayBadBotMethod": {
+      "Type": "AWS::ApiGateway::Method",
+      "Condition": "BadBotProtectionActivated",
+      "DependsOn": ["LambdaWAFBadBotParserFunction", "LambdaInvokePermissionBadBot", "ApiGatewayBadBot"],
+      "Properties": {
+        "RestApiId": {
+          "Ref": "ApiGatewayBadBot"
+        },
+        "ResourceId": {
+          "Ref": "ApiGatewayBadBotResource"
+        },
+        "HttpMethod": "ANY",
+        "AuthorizationType": "NONE",
+        "RequestParameters": {
+          "method.request.header.X-Forwarded-For": false
+        },
+        "Integration": {
+          "Type": "AWS_PROXY",
+          "IntegrationHttpMethod": "POST",
+          "Uri": {
+            "Fn::Join": ["", [
+              "arn:aws:apigateway:", {
+                "Ref": "AWS::Region"
+              },
+              ":lambda:path/2015-03-31/functions/", {
+                "Fn::GetAtt": ["LambdaWAFBadBotParserFunction", "Arn"]
+              },
+              "/invocations"
+            ]]
+          }
+        }
+      }
+    },
+    "ApiGatewayBadBotDeployment": {
+      "Type": "AWS::ApiGateway::Deployment",
+      "Condition": "BadBotProtectionActivated",
+      "DependsOn": "ApiGatewayBadBotMethod",
+      "Properties": {
+        "RestApiId": {
+          "Ref": "ApiGatewayBadBot"
+        },
+        "Description": "CloudFormation Deployment Stage",
+        "StageName": "CFDeploymentStage"
+      }
+    },
+    "ApiGatewayBadBotStage": {
+      "Type": "AWS::ApiGateway::Stage",
+      "Condition": "BadBotProtectionActivated",
+      "DependsOn": "ApiGatewayBadBotDeployment",
+      "Properties": {
+        "DeploymentId": {
+          "Ref": "ApiGatewayBadBotDeployment"
+        },
+        "Description": "Production Stage",
+        "RestApiId": {
+          "Ref": "ApiGatewayBadBot"
+        },
+        "StageName": "ProdStage"
+      }
+    },
+    "LambdaRoleCustomResource": {
+      "Type": "AWS::IAM::Role",
+      "Condition": "CreateWebACL",
+      "DependsOn": "WAFWebACL",
+      "Properties": {
+        "AssumeRolePolicyDocument": {
+          "Version": "2012-10-17",
+          "Statement": [{
+            "Effect": "Allow",
+            "Principal": {
+              "Service": ["lambda.amazonaws.com"]
+            },
+            "Action": ["sts:AssumeRole"]
+          }]
+        },
+        "Path": "/",
+        "Policies": [{
+          "PolicyName": "S3Access",
+          "PolicyDocument": {
+            "Version": "2012-10-17",
+            "Statement": [{
+              "Effect": "Allow",
+              "Action": [
+                "s3:CreateBucket",
+                "s3:GetBucketLocation",
+                "s3:GetBucketNotification",
+                "s3:GetObject",
+                "s3:ListBucket",
+                "s3:PutBucketNotification"
+              ],
+              "Resource": {
+                "Fn::Join": ["", ["arn:aws:s3:::", {
+                  "Ref": "CloudFrontAccessLogBucket"
+                }]]
+              }
+            }]
+          }
+        }, {
+          "PolicyName": "LambdaAccess",
+          "PolicyDocument": {
+            "Version": "2012-10-17",
+            "Statement": [{
+              "Effect": "Allow",
+              "Action": "lambda:InvokeFunction",
+              "Resource": {
+                "Fn::Join": ["", ["arn:aws:lambda:", {
+                    "Ref": "AWS::Region"
+                  },
+                  ":", {
+                    "Ref": "AWS::AccountId"
+                  },
+                  ":function:", {
+                    "Ref": "AWS::StackName"
+                  },
+                  "-LambdaWAFReputationLists*"
+                ]]
+              }
+            }]
+          }
+        }, {
+          "PolicyName": "WAFAccess",
+          "PolicyDocument": {
+            "Version": "2012-10-17",
+            "Statement": [{
+              "Effect": "Allow",
+              "Action": [
+                "waf:GetWebACL",
+                "waf:UpdateWebACL"
+              ],
+              "Resource": {
+                "Fn::Join": ["", ["arn:aws:waf::", {
+                    "Ref": "AWS::AccountId"
+                  },
+                  ":webacl/", {
+                    "Ref": "WAFWebACL"
+                  }
+                ]]
+              }
+            }]
+          }
+        }, {
+          "PolicyName": "WAFRuleAccess",
+          "PolicyDocument": {
+            "Version": "2012-10-17",
+            "Statement": [{
+              "Effect": "Allow",
+              "Action": "waf:GetRule",
+              "Resource": {
+                "Fn::Join": ["", ["arn:aws:waf::", {
+                    "Ref": "AWS::AccountId"
+                  },
+                  ":rule/*"
+                ]]
+              }
+            }]
+          }
+        }, {
+          "PolicyName": "CloudFormationAccess",
+          "PolicyDocument": {
+            "Version": "2012-10-17",
+            "Statement": [{
+              "Effect": "Allow",
+              "Action": "cloudformation:DescribeStacks",
+              "Resource": {
+                "Fn::Join": [
+                  "", [
+                    "arn:aws:cloudformation:", {
+                      "Ref": "AWS::Region"
+                    },
+                    ":", {
+                      "Ref": "AWS::AccountId"
+                    },
+                    ":stack/", {
+                      "Ref": "AWS::StackName"
+                    },
+                    "/*"
+                  ]
+                ]
+              }
+            }]
+          }
+        }, {
+          "PolicyName": "WAFGetChangeToken",
+          "PolicyDocument": {
+            "Statement": [{
+              "Effect": "Allow",
+              "Action": "waf:GetChangeToken",
+              "Resource": "*"
+            }]
+          }
+        }, {
+          "PolicyName": "LogsAccess",
+          "PolicyDocument": {
+            "Version": "2012-10-17",
+            "Statement": [{
+              "Effect": "Allow",
+              "Action": ["logs:CreateLogGroup", "logs:CreateLogStream", "logs:PutLogEvents"],
+              "Resource": { "Fn::Join" : [":", ["arn:aws:logs",{"Ref" : "AWS::Region"},{ "Ref" : "AWS::AccountId" }, "log-group:/aws/lambda/*" ]]}
+            }]
+          }
+        }]
+      }
+    },
+    "LambdaWAFCustomResourceFunction": {
+      "Type": "AWS::Lambda::Function",
+      "Condition": "CreateWebACL",
+      "DependsOn": "LambdaRoleCustomResource",
+      "Properties": {
+        "Description": {
+          "Fn::Join": ["", [
+            "This lambda function configures the Web ACL rules based on the features enabled in the CloudFormation template. Parameters: ", {
+              "Ref": "SendAnonymousUsageData"
+            },
+            "."
+          ]]
+        },
+        "Handler": "custom-resource.lambda_handler",
+        "Role": {
+          "Fn::GetAtt": ["LambdaRoleCustomResource", "Arn"]
+        },
+        "Code": {
+          "S3Bucket": {
+            "Fn::Join": ["-", [
+              "solutions", {
+                "Ref": "AWS::Region"
+              }
+            ]]
+          },
+          "S3Key": "aws-waf-security-automations/v3/custom-resource.zip"
+        },
+        "Runtime": "python2.7",
+        "MemorySize": "128",
+        "Timeout": "300"
+      }
+    },
+    "WafWebAclRuleControler": {
+      "Type": "Custom::WafWebAclRuleControler",
+      "Condition": "CreateWebACL",
+      "DependsOn": ["LambdaWAFCustomResourceFunction", "WAFWebACL"],
+      "Properties": {
+        "ServiceToken": {
+          "Fn::GetAtt": ["LambdaWAFCustomResourceFunction", "Arn"]
+        },
+        "WAFWebACL": {
+          "Ref": "WAFWebACL"
+        },
+        "Region": {
+          "Ref": "AWS::Region"
+        },
+        "LambdaWAFReputationListsParserFunction": {
+          "Fn::If": ["ReputationListsProtectionActivated", {
+            "Fn::GetAtt": ["LambdaWAFReputationListsParserFunction", "Arn"]
+          }, {
+            "Ref": "AWS::NoValue"
+          }]
+        },
+        "WAFReputationListsSet1": {
+          "Fn::If": ["ReputationListsProtectionActivated", {
+            "Ref": "WAFReputationListsSet1"
+          }, {
+            "Ref": "AWS::NoValue"
+          }]
+        },
+        "WAFReputationListsSet2": {
+          "Fn::If": ["ReputationListsProtectionActivated", {
+            "Ref": "WAFReputationListsSet2"
+          }, {
+            "Ref": "AWS::NoValue"
+          }]
+        },
+        "CloudFrontAccessLogBucket": {
+          "Fn::If": ["LogParserActivated", {
+            "Ref": "CloudFrontAccessLogBucket"
+          }, {
+            "Ref": "AWS::NoValue"
+          }]
+        },
+        "LambdaWAFLogParserFunction": {
+          "Fn::If": ["LogParserActivated", {
+            "Fn::GetAtt": ["LambdaWAFLogParserFunction", "Arn"]
+          }, {
+            "Ref": "AWS::NoValue"
+          }]
+        },
+        "WAFWhitelistRule": {
+          "Fn::If": ["CreateWebACL", {
+            "Ref": "WAFWhitelistRule"
+          }, {
+            "Ref": "AWS::NoValue"
+          }]
+        },
+        "WAFBlacklistRule": {
+          "Fn::If": ["LogParserActivated", {
+            "Ref": "WAFBlacklistRule"
+          }, {
+            "Ref": "AWS::NoValue"
+          }]
+        },
+        "WAFAutoBlockRule": {
+          "Fn::If": ["LogParserActivated", {
+            "Ref": "WAFAutoBlockRule"
+          }, {
+            "Ref": "AWS::NoValue"
+          }]
+        },
+        "WAFIPReputationListsRule1": {
+          "Fn::If": ["ReputationListsProtectionActivated", {
+            "Ref": "WAFIPReputationListsRule1"
+          }, {
+            "Ref": "AWS::NoValue"
+          }]
+        },
+        "WAFIPReputationListsRule2": {
+          "Fn::If": ["ReputationListsProtectionActivated", {
+            "Ref": "WAFIPReputationListsRule2"
+          }, {
+            "Ref": "AWS::NoValue"
+          }]
+        },
+        "WAFBadBotRule": {
+          "Fn::If": ["BadBotProtectionActivated", {
+            "Ref": "WAFBadBotRule"
+          }, {
+            "Ref": "AWS::NoValue"
+          }]
+        },
+        "WAFSqlInjectionRule": {
+          "Fn::If": ["SqlInjectionProtectionActivated", {
+            "Ref": "WAFSqlInjectionRule"
+          }, {
+            "Ref": "AWS::NoValue"
+          }]
+        },
+        "WAFXssRule": {
+          "Fn::If": ["CrossSiteScriptingProtectionActivated", {
+            "Ref": "WAFXssRule"
+          }, {
+            "Ref": "AWS::NoValue"
+          }]
+        },
+        "SqlInjectionProtection": {
+          "Ref": "SqlInjectionProtectionParam"
+        },
+        "CrossSiteScriptingProtection": {
+          "Ref": "CrossSiteScriptingProtectionParam"
+        },
+        "ActivateHttpFloodProtection": {
+          "Ref": "ActivateHttpFloodProtectionParam"
+        },
+        "ActivateScansProbesProtection": {
+          "Ref": "ActivateScansProbesProtectionParam"
+        },
+        "ActivateReputationListsProtection": {
+          "Ref": "ActivateReputationListsProtectionParam"
+        },
+        "ActivateBadBotProtection": {
+          "Ref": "ActivateBadBotProtectionParam"
+        },
+        "RequestThreshold": {
+          "Ref": "RequestThreshold"
+        },
+        "ErrorThreshold": {
+          "Ref": "ErrorThreshold"
+        },
+        "WAFBlockPeriod": {
+          "Ref": "WAFBlockPeriod"
+        },
+        "SendAnonymousUsageData": {
+          "Ref": "SendAnonymousUsageData"
+        },
+        "UUID": {
+          "Fn::GetAtt": ["CreateUniqueID", "UUID"]
+        },
+        "LOG_TYPE": "cloudfront"
+      }
+    },
+    "SolutionHelperRole": {
+      "Type": "AWS::IAM::Role",
+      "Properties": {
+        "AssumeRolePolicyDocument": {
+          "Version": "2012-10-17",
+          "Statement": [{
+            "Effect": "Allow",
+            "Principal": {
+              "Service": "lambda.amazonaws.com"
+            },
+            "Action": "sts:AssumeRole"
+          }]
+        },
+        "Path": "/",
+        "Policies": [{
+          "PolicyName": "Solution_Helper_Permissions",
+          "PolicyDocument": {
+            "Version": "2012-10-17",
+            "Statement": [{
+              "Effect": "Allow",
+              "Action": ["logs:CreateLogGroup", "logs:CreateLogStream", "logs:PutLogEvents"],
+              "Resource": { "Fn::Join" : [":", ["arn:aws:logs",{"Ref" : "AWS::Region"},{ "Ref" : "AWS::AccountId" }, "log-group:/aws/lambda/*" ]]}
+            }]
+          }
+        }]
+      }
+    },
+    "SolutionHelper": {
+      "Type": "AWS::Lambda::Function",
+      "DependsOn": "SolutionHelperRole",
+      "Properties": {
+        "Handler": "solution-helper.lambda_handler",
+        "Role": {
+          "Fn::GetAtt": [
+            "SolutionHelperRole",
+            "Arn"
+          ]
+        },
+        "Description": "This lambda function executes generic common tasks to support this solution.",
+        "Code": {
+          "S3Bucket": {
+            "Fn::Join": [
+              "", [
+                "solutions-", {
+                  "Ref": "AWS::Region"
+                }
+              ]
+            ]
+          },
+          "S3Key": "library/solution-helper/v1/solution-helper.zip"
+        },
+        "Runtime": "python2.7",
+        "Timeout": "300"
+      }
+    },
+    "CreateUniqueID": {
+      "Type": "Custom::CreateUUID",
+      "DependsOn": "SolutionHelper",
+      "Properties": {
+        "ServiceToken": {
+          "Fn::GetAtt": [
+            "SolutionHelper",
+            "Arn"
+          ]
+        },
+        "Region": {
+          "Ref": "AWS::Region"
+        },
+        "CreateUniqueID": "true"
+      }
+    }
+  },
+  "Outputs": {
+    "BadBotHoneypotEndpoint": {
+      "Description": "Bad Bot Honeypot Endpoint",
+      "Value": {
+        "Fn::Join": ["", [
+          "https://", {
+            "Ref": "ApiGatewayBadBot"
+          },
+          ".execute-api.", {
+            "Ref": "AWS::Region"
+          },
+          ".amazonaws.com/", {
+            "Ref": "ApiGatewayBadBotStage"
+          }
+        ]]
+      },
+      "Condition": "BadBotProtectionActivated"
+    }
+  }
+}