@aws-solutions-constructs/aws-lambda-opensearch 2.51.0 → 2.52.0

package/test/integ.lamopn-no-arguments.js.snapshot/lamopn-no-arguments.template.json

@@ -0,0 +1,846 @@
+{
+ "Resources": {
+  "testlambdaopensearchLambdaFunctionServiceRole4722AB8A": {
+   "Type": "AWS::IAM::Role",
+   "Properties": {
+    "AssumeRolePolicyDocument": {
+     "Statement": [
+      {
+       "Action": "sts:AssumeRole",
+       "Effect": "Allow",
+       "Principal": {
+        "Service": "lambda.amazonaws.com"
+       }
+      }
+     ],
+     "Version": "2012-10-17"
+    },
+    "Policies": [
+     {
+      "PolicyDocument": {
+       "Statement": [
+        {
+         "Action": [
+          "logs:CreateLogGroup",
+          "logs:CreateLogStream",
+          "logs:PutLogEvents"
+         ],
+         "Effect": "Allow",
+         "Resource": {
+          "Fn::Join": [
+           "",
+           [
+            "arn:",
+            {
+             "Ref": "AWS::Partition"
+            },
+            ":logs:",
+            {
+             "Ref": "AWS::Region"
+            },
+            ":",
+            {
+             "Ref": "AWS::AccountId"
+            },
+            ":log-group:/aws/lambda/*"
+           ]
+          ]
+         }
+        }
+       ],
+       "Version": "2012-10-17"
+      },
+      "PolicyName": "LambdaFunctionServiceRolePolicy"
+     }
+    ]
+   }
+  },
+  "testlambdaopensearchLambdaFunctionServiceRoleDefaultPolicy78C56359": {
+   "Type": "AWS::IAM::Policy",
+   "Properties": {
+    "PolicyDocument": {
+     "Statement": [
+      {
+       "Action": [
+        "xray:PutTelemetryRecords",
+        "xray:PutTraceSegments"
+       ],
+       "Effect": "Allow",
+       "Resource": "*"
+      }
+     ],
+     "Version": "2012-10-17"
+    },
+    "PolicyName": "testlambdaopensearchLambdaFunctionServiceRoleDefaultPolicy78C56359",
+    "Roles": [
+     {
+      "Ref": "testlambdaopensearchLambdaFunctionServiceRole4722AB8A"
+     }
+    ]
+   },
+   "Metadata": {
+    "cfn_nag": {
+     "rules_to_suppress": [
+      {
+       "id": "W12",
+       "reason": "Lambda needs the following minimum required permissions to send trace data to X-Ray and access ENIs in a VPC."
+      }
+     ]
+    }
+   }
+  },
+  "testlambdaopensearchLambdaFunction93FD38F7": {
+   "Type": "AWS::Lambda::Function",
+   "Properties": {
+    "Code": {
+     "S3Bucket": {
+      "Fn::Sub": "cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}"
+     },
+     "S3Key": "abbc4eca9e7ddabc31da3ce83159e6eee8e72e2c358ab8af0711044514c41290.zip"
+    },
+    "Environment": {
+     "Variables": {
+      "AWS_NODEJS_CONNECTION_REUSE_ENABLED": "1",
+      "DOMAIN_ENDPOINT": {
+       "Fn::GetAtt": [
+        "testlambdaopensearchOpenSearchDomainF9CCC3D3",
+        "DomainEndpoint"
+       ]
+      }
+     }
+    },
+    "Handler": "index.handler",
+    "Role": {
+     "Fn::GetAtt": [
+      "testlambdaopensearchLambdaFunctionServiceRole4722AB8A",
+      "Arn"
+     ]
+    },
+    "Runtime": "nodejs16.x",
+    "TracingConfig": {
+     "Mode": "Active"
+    }
+   },
+   "DependsOn": [
+    "testlambdaopensearchLambdaFunctionServiceRoleDefaultPolicy78C56359",
+    "testlambdaopensearchLambdaFunctionServiceRole4722AB8A"
+   ],
+   "Metadata": {
+    "cfn_nag": {
+     "rules_to_suppress": [
+      {
+       "id": "W58",
+       "reason": "Lambda functions has the required permission to write CloudWatch Logs. It uses custom policy instead of arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole with tighter permissions."
+      },
+      {
+       "id": "W89",
+       "reason": "This is not a rule for the general case, just for specific use cases/industries"
+      },
+      {
+       "id": "W92",
+       "reason": "Impossible for us to define the correct concurrency for clients"
+      }
+     ]
+    }
+   }
+  },
+  "testlambdaopensearchCognitoUserPoolA09096F9": {
+   "Type": "AWS::Cognito::UserPool",
+   "Properties": {
+    "AccountRecoverySetting": {
+     "RecoveryMechanisms": [
+      {
+       "Name": "verified_phone_number",
+       "Priority": 1
+      },
+      {
+       "Name": "verified_email",
+       "Priority": 2
+      }
+     ]
+    },
+    "AdminCreateUserConfig": {
+     "AllowAdminCreateUserOnly": true
+    },
+    "EmailVerificationMessage": "The verification code to your new account is {####}",
+    "EmailVerificationSubject": "Verify your new account",
+    "SmsVerificationMessage": "The verification code to your new account is {####}",
+    "UserPoolAddOns": {
+     "AdvancedSecurityMode": "ENFORCED"
+    },
+    "VerificationMessageTemplate": {
+     "DefaultEmailOption": "CONFIRM_WITH_CODE",
+     "EmailMessage": "The verification code to your new account is {####}",
+     "EmailSubject": "Verify your new account",
+     "SmsMessage": "The verification code to your new account is {####}"
+    }
+   },
+   "UpdateReplacePolicy": "Retain",
+   "DeletionPolicy": "Retain"
+  },
+  "testlambdaopensearchCognitoUserPoolClient39C21D94": {
+   "Type": "AWS::Cognito::UserPoolClient",
+   "Properties": {
+    "AllowedOAuthFlows": [
+     "implicit",
+     "code"
+    ],
+    "AllowedOAuthFlowsUserPoolClient": true,
+    "AllowedOAuthScopes": [
+     "profile",
+     "phone",
+     "email",
+     "openid",
+     "aws.cognito.signin.user.admin"
+    ],
+    "CallbackURLs": [
+     "https://example.com"
+    ],
+    "SupportedIdentityProviders": [
+     "COGNITO"
+    ],
+    "UserPoolId": {
+     "Ref": "testlambdaopensearchCognitoUserPoolA09096F9"
+    }
+   }
+  },
+  "testlambdaopensearchCognitoIdentityPool0B1FB311": {
+   "Type": "AWS::Cognito::IdentityPool",
+   "Properties": {
+    "AllowUnauthenticatedIdentities": false,
+    "CognitoIdentityProviders": [
+     {
+      "ClientId": {
+       "Ref": "testlambdaopensearchCognitoUserPoolClient39C21D94"
+      },
+      "ProviderName": {
+       "Fn::GetAtt": [
+        "testlambdaopensearchCognitoUserPoolA09096F9",
+        "ProviderName"
+       ]
+      },
+      "ServerSideTokenCheck": true
+     }
+    ]
+   }
+  },
+  "testlambdaopensearchUserPoolDomain98864920": {
+   "Type": "AWS::Cognito::UserPoolDomain",
+   "Properties": {
+    "Domain": {
+     "Fn::Join": [
+      "-",
+      [
+       "dn",
+       {
+        "Fn::Select": [
+         4,
+         {
+          "Fn::Split": [
+           "-",
+           {
+            "Fn::Select": [
+             2,
+             {
+              "Fn::Split": [
+               "/",
+               {
+                "Ref": "AWS::StackId"
+               }
+              ]
+             }
+            ]
+           }
+          ]
+         }
+        ]
+       }
+      ]
+     ]
+    },
+    "UserPoolId": {
+     "Ref": "testlambdaopensearchCognitoUserPoolA09096F9"
+    }
+   },
+   "DependsOn": [
+    "testlambdaopensearchCognitoUserPoolA09096F9"
+   ]
+  },
+  "testlambdaopensearchCognitoAuthorizedRole58A1ED44": {
+   "Type": "AWS::IAM::Role",
+   "Properties": {
+    "AssumeRolePolicyDocument": {
+     "Statement": [
+      {
+       "Action": "sts:AssumeRoleWithWebIdentity",
+       "Condition": {
+        "StringEquals": {
+         "cognito-identity.amazonaws.com:aud": {
+          "Ref": "testlambdaopensearchCognitoIdentityPool0B1FB311"
+         }
+        },
+        "ForAnyValue:StringLike": {
+         "cognito-identity.amazonaws.com:amr": "authenticated"
+        }
+       },
+       "Effect": "Allow",
+       "Principal": {
+        "Federated": "cognito-identity.amazonaws.com"
+       }
+      }
+     ],
+     "Version": "2012-10-17"
+    },
+    "Policies": [
+     {
+      "PolicyDocument": {
+       "Statement": [
+        {
+         "Action": "es:ESHttp*",
+         "Effect": "Allow",
+         "Resource": {
+          "Fn::Join": [
+           "",
+           [
+            "arn:",
+            {
+             "Ref": "AWS::Partition"
+            },
+            ":es:",
+            {
+             "Ref": "AWS::Region"
+            },
+            ":",
+            {
+             "Ref": "AWS::AccountId"
+            },
+            ":domain/",
+            {
+             "Fn::Join": [
+              "-",
+              [
+               "dn",
+               {
+                "Fn::Select": [
+                 4,
+                 {
+                  "Fn::Split": [
+                   "-",
+                   {
+                    "Fn::Select": [
+                     2,
+                     {
+                      "Fn::Split": [
+                       "/",
+                       {
+                        "Ref": "AWS::StackId"
+                       }
+                      ]
+                     }
+                    ]
+                   }
+                  ]
+                 }
+                ]
+               }
+              ]
+             ]
+            },
+            "/*"
+           ]
+          ]
+         }
+        }
+       ],
+       "Version": "2012-10-17"
+      },
+      "PolicyName": "CognitoAccessPolicy"
+     }
+    ]
+   }
+  },
+  "testlambdaopensearchIdentityPoolRoleMappingD8C765B1": {
+   "Type": "AWS::Cognito::IdentityPoolRoleAttachment",
+   "Properties": {
+    "IdentityPoolId": {
+     "Ref": "testlambdaopensearchCognitoIdentityPool0B1FB311"
+    },
+    "Roles": {
+     "authenticated": {
+      "Fn::GetAtt": [
+       "testlambdaopensearchCognitoAuthorizedRole58A1ED44",
+       "Arn"
+      ]
+     }
+    }
+   }
+  },
+  "testlambdaopensearchCognitoDashboardConfigureRole1F2B7B7A": {
+   "Type": "AWS::IAM::Role",
+   "Properties": {
+    "AssumeRolePolicyDocument": {
+     "Statement": [
+      {
+       "Action": "sts:AssumeRole",
+       "Effect": "Allow",
+       "Principal": {
+        "Service": "es.amazonaws.com"
+       }
+      }
+     ],
+     "Version": "2012-10-17"
+    }
+   }
+  },
+  "testlambdaopensearchCognitoDashboardConfigureRolePolicyC9C6A6A2": {
+   "Type": "AWS::IAM::Policy",
+   "Properties": {
+    "PolicyDocument": {
+     "Statement": [
+      {
+       "Action": [
+        "cognito-identity:DescribeIdentityPool",
+        "cognito-identity:GetIdentityPoolRoles",
+        "cognito-identity:SetIdentityPoolRoles",
+        "cognito-identity:UpdateIdentityPool",
+        "cognito-idp:AdminInitiateAuth",
+        "cognito-idp:AdminUserGlobalSignOut",
+        "cognito-idp:CreateUserPoolClient",
+        "cognito-idp:DeleteUserPoolClient",
+        "cognito-idp:DescribeUserPool",
+        "cognito-idp:DescribeUserPoolClient",
+        "cognito-idp:ListUserPoolClients",
+        "es:UpdateDomainConfig"
+       ],
+       "Effect": "Allow",
+       "Resource": [
+        {
+         "Fn::GetAtt": [
+          "testlambdaopensearchCognitoUserPoolA09096F9",
+          "Arn"
+         ]
+        },
+        {
+         "Fn::Join": [
+          "",
+          [
+           "arn:",
+           {
+            "Ref": "AWS::Partition"
+           },
+           ":cognito-identity:",
+           {
+            "Ref": "AWS::Region"
+           },
+           ":",
+           {
+            "Ref": "AWS::AccountId"
+           },
+           ":identitypool/",
+           {
+            "Ref": "testlambdaopensearchCognitoIdentityPool0B1FB311"
+           }
+          ]
+         ]
+        },
+        {
+         "Fn::Join": [
+          "",
+          [
+           "arn:",
+           {
+            "Ref": "AWS::Partition"
+           },
+           ":es:",
+           {
+            "Ref": "AWS::Region"
+           },
+           ":",
+           {
+            "Ref": "AWS::AccountId"
+           },
+           ":domain/",
+           {
+            "Fn::Join": [
+             "-",
+             [
+              "dn",
+              {
+               "Fn::Select": [
+                4,
+                {
+                 "Fn::Split": [
+                  "-",
+                  {
+                   "Fn::Select": [
+                    2,
+                    {
+                     "Fn::Split": [
+                      "/",
+                      {
+                       "Ref": "AWS::StackId"
+                      }
+                     ]
+                    }
+                   ]
+                  }
+                 ]
+                }
+               ]
+              }
+             ]
+            ]
+           }
+          ]
+         ]
+        }
+       ]
+      },
+      {
+       "Action": "iam:PassRole",
+       "Condition": {
+        "StringLike": {
+         "iam:PassedToService": "cognito-identity.amazonaws.com"
+        }
+       },
+       "Effect": "Allow",
+       "Resource": {
+        "Fn::GetAtt": [
+         "testlambdaopensearchCognitoDashboardConfigureRole1F2B7B7A",
+         "Arn"
+        ]
+       }
+      }
+     ],
+     "Version": "2012-10-17"
+    },
+    "PolicyName": "testlambdaopensearchCognitoDashboardConfigureRolePolicyC9C6A6A2",
+    "Roles": [
+     {
+      "Ref": "testlambdaopensearchCognitoDashboardConfigureRole1F2B7B7A"
+     }
+    ]
+   }
+  },
+  "testlambdaopensearchOpenSearchDomainF9CCC3D3": {
+   "Type": "AWS::OpenSearchService::Domain",
+   "Properties": {
+    "AccessPolicies": {
+     "Statement": [
+      {
+       "Action": "es:ESHttp*",
+       "Effect": "Allow",
+       "Principal": {
+        "AWS": [
+         {
+          "Fn::GetAtt": [
+           "testlambdaopensearchCognitoAuthorizedRole58A1ED44",
+           "Arn"
+          ]
+         },
+         {
+          "Fn::GetAtt": [
+           "testlambdaopensearchLambdaFunctionServiceRole4722AB8A",
+           "Arn"
+          ]
+         }
+        ]
+       },
+       "Resource": {
+        "Fn::Join": [
+         "",
+         [
+          "arn:",
+          {
+           "Ref": "AWS::Partition"
+          },
+          ":es:",
+          {
+           "Ref": "AWS::Region"
+          },
+          ":",
+          {
+           "Ref": "AWS::AccountId"
+          },
+          ":domain/",
+          {
+           "Fn::Join": [
+            "-",
+            [
+             "dn",
+             {
+              "Fn::Select": [
+               4,
+               {
+                "Fn::Split": [
+                 "-",
+                 {
+                  "Fn::Select": [
+                   2,
+                   {
+                    "Fn::Split": [
+                     "/",
+                     {
+                      "Ref": "AWS::StackId"
+                     }
+                    ]
+                   }
+                  ]
+                 }
+                ]
+               }
+              ]
+             }
+            ]
+           ]
+          },
+          "/*"
+         ]
+        ]
+       }
+      }
+     ],
+     "Version": "2012-10-17"
+    },
+    "ClusterConfig": {
+     "DedicatedMasterCount": 3,
+     "DedicatedMasterEnabled": true,
+     "InstanceCount": 2,
+     "ZoneAwarenessConfig": {
+      "AvailabilityZoneCount": 2
+     },
+     "ZoneAwarenessEnabled": true
+    },
+    "CognitoOptions": {
+     "Enabled": true,
+     "IdentityPoolId": {
+      "Ref": "testlambdaopensearchCognitoIdentityPool0B1FB311"
+     },
+     "RoleArn": {
+      "Fn::GetAtt": [
+       "testlambdaopensearchCognitoDashboardConfigureRole1F2B7B7A",
+       "Arn"
+      ]
+     },
+     "UserPoolId": {
+      "Ref": "testlambdaopensearchCognitoUserPoolA09096F9"
+     }
+    },
+    "DomainEndpointOptions": {
+     "EnforceHTTPS": true,
+     "TLSSecurityPolicy": "Policy-Min-TLS-1-2-2019-07"
+    },
+    "DomainName": {
+     "Fn::Join": [
+      "-",
+      [
+       "dn",
+       {
+        "Fn::Select": [
+         4,
+         {
+          "Fn::Split": [
+           "-",
+           {
+            "Fn::Select": [
+             2,
+             {
+              "Fn::Split": [
+               "/",
+               {
+                "Ref": "AWS::StackId"
+               }
+              ]
+             }
+            ]
+           }
+          ]
+         }
+        ]
+       }
+      ]
+     ]
+    },
+    "EBSOptions": {
+     "EBSEnabled": true,
+     "VolumeSize": 10
+    },
+    "EncryptionAtRestOptions": {
+     "Enabled": true
+    },
+    "EngineVersion": "OpenSearch_1.3",
+    "NodeToNodeEncryptionOptions": {
+     "Enabled": true
+    },
+    "SnapshotOptions": {
+     "AutomatedSnapshotStartHour": 1
+    }
+   },
+   "Metadata": {
+    "cfn_nag": {
+     "rules_to_suppress": [
+      {
+       "id": "W28",
+       "reason": "The OpenSearch Service domain is passed dynamically as as parameter and explicitly specified to ensure that IAM policies are configured to lockdown access to this specific OpenSearch Service instance only"
+      },
+      {
+       "id": "W90",
+       "reason": "This is not a rule for the general case, just for specific use cases/industries"
+      }
+     ]
+    }
+   }
+  },
+  "testlambdaopensearchStatusRedAlarm1627144D": {
+   "Type": "AWS::CloudWatch::Alarm",
+   "Properties": {
+    "AlarmDescription": "At least one primary shard and its replicas are not allocated to a node. ",
+    "ComparisonOperator": "GreaterThanOrEqualToThreshold",
+    "EvaluationPeriods": 1,
+    "MetricName": "ClusterStatus.red",
+    "Namespace": "AWS/ES",
+    "Period": 60,
+    "Statistic": "Maximum",
+    "Threshold": 1
+   }
+  },
+  "testlambdaopensearchStatusYellowAlarm57139CF0": {
+   "Type": "AWS::CloudWatch::Alarm",
+   "Properties": {
+    "AlarmDescription": "At least one replica shard is not allocated to a node.",
+    "ComparisonOperator": "GreaterThanOrEqualToThreshold",
+    "EvaluationPeriods": 1,
+    "MetricName": "ClusterStatus.yellow",
+    "Namespace": "AWS/ES",
+    "Period": 60,
+    "Statistic": "Maximum",
+    "Threshold": 1
+   }
+  },
+  "testlambdaopensearchFreeStorageSpaceTooLowAlarm6A5E1E96": {
+   "Type": "AWS::CloudWatch::Alarm",
+   "Properties": {
+    "AlarmDescription": "A node in your cluster is down to 20 GiB of free storage space.",
+    "ComparisonOperator": "LessThanOrEqualToThreshold",
+    "EvaluationPeriods": 1,
+    "MetricName": "FreeStorageSpace",
+    "Namespace": "AWS/ES",
+    "Period": 60,
+    "Statistic": "Minimum",
+    "Threshold": 20000
+   }
+  },
+  "testlambdaopensearchIndexWritesBlockedTooHighAlarmD2E041A3": {
+   "Type": "AWS::CloudWatch::Alarm",
+   "Properties": {
+    "AlarmDescription": "Your cluster is blocking write requests.",
+    "ComparisonOperator": "GreaterThanOrEqualToThreshold",
+    "EvaluationPeriods": 1,
+    "MetricName": "ClusterIndexWritesBlocked",
+    "Namespace": "AWS/ES",
+    "Period": 300,
+    "Statistic": "Maximum",
+    "Threshold": 1
+   }
+  },
+  "testlambdaopensearchAutomatedSnapshotFailureTooHighAlarm9A4D0B1F": {
+   "Type": "AWS::CloudWatch::Alarm",
+   "Properties": {
+    "AlarmDescription": "An automated snapshot failed. This failure is often the result of a red cluster health status.",
+    "ComparisonOperator": "GreaterThanOrEqualToThreshold",
+    "EvaluationPeriods": 1,
+    "MetricName": "AutomatedSnapshotFailure",
+    "Namespace": "AWS/ES",
+    "Period": 60,
+    "Statistic": "Maximum",
+    "Threshold": 1
+   }
+  },
+  "testlambdaopensearchCPUUtilizationTooHighAlarmC4850758": {
+   "Type": "AWS::CloudWatch::Alarm",
+   "Properties": {
+    "AlarmDescription": "100% CPU utilization is not uncommon, but sustained high usage is problematic. Consider using larger instance types or adding instances.",
+    "ComparisonOperator": "GreaterThanOrEqualToThreshold",
+    "EvaluationPeriods": 3,
+    "MetricName": "CPUUtilization",
+    "Namespace": "AWS/ES",
+    "Period": 900,
+    "Statistic": "Average",
+    "Threshold": 80
+   }
+  },
+  "testlambdaopensearchJVMMemoryPressureTooHighAlarmEFB09A7C": {
+   "Type": "AWS::CloudWatch::Alarm",
+   "Properties": {
+    "AlarmDescription": "Average JVM memory pressure over last 15 minutes too high. Consider scaling vertically.",
+    "ComparisonOperator": "GreaterThanOrEqualToThreshold",
+    "EvaluationPeriods": 1,
+    "MetricName": "JVMMemoryPressure",
+    "Namespace": "AWS/ES",
+    "Period": 900,
+    "Statistic": "Average",
+    "Threshold": 80
+   }
+  },
+  "testlambdaopensearchMasterCPUUtilizationTooHighAlarm124D5748": {
+   "Type": "AWS::CloudWatch::Alarm",
+   "Properties": {
+    "AlarmDescription": "Average CPU utilization over last 45 minutes too high. Consider using larger instance types for your dedicated master nodes.",
+    "ComparisonOperator": "GreaterThanOrEqualToThreshold",
+    "EvaluationPeriods": 3,
+    "MetricName": "MasterCPUUtilization",
+    "Namespace": "AWS/ES",
+    "Period": 900,
+    "Statistic": "Average",
+    "Threshold": 50
+   }
+  },
+  "testlambdaopensearchMasterJVMMemoryPressureTooHighAlarmBC9524D3": {
+   "Type": "AWS::CloudWatch::Alarm",
+   "Properties": {
+    "AlarmDescription": "Average JVM memory pressure over last 15 minutes too high. Consider scaling vertically.",
+    "ComparisonOperator": "GreaterThanOrEqualToThreshold",
+    "EvaluationPeriods": 1,
+    "MetricName": "MasterJVMMemoryPressure",
+    "Namespace": "AWS/ES",
+    "Period": 900,
+    "Statistic": "Average",
+    "Threshold": 50
+   }
+  }
+ },
+ "Parameters": {
+  "BootstrapVersion": {
+   "Type": "AWS::SSM::Parameter::Value<String>",
+   "Default": "/cdk-bootstrap/hnb659fds/version",
+   "Description": "Version of the CDK Bootstrap resources in this environment, automatically retrieved from SSM Parameter Store. [cdk:skip]"
+  }
+ },
+ "Rules": {
+  "CheckBootstrapVersion": {
+   "Assertions": [
+    {
+     "Assert": {
+      "Fn::Not": [
+       {
+        "Fn::Contains": [
+         [
+          "1",
+          "2",
+          "3",
+          "4",
+          "5"
+         ],
+         {
+          "Ref": "BootstrapVersion"
+         }
+        ]
+       }
+      ]
+     },
+     "AssertDescription": "CDK bootstrap stack version 6 required. Please run 'cdk bootstrap' with a recent version of the CDK CLI."
+    }
+   ]
+  }
+ }
+}