@mavogel/cdk-vscode-server 0.0.62 → 0.0.64

package/integ-tests/integ.ubuntu24.ts.snapshot/IntegTestStackUbuntu24.template.json

@@ -0,0 +1,2725 @@
+{
+ "Description": "This stack includes the application's resources for integration testing.",
+ "Resources": {
+  "IntegVSCodeServerpasswordsecret202A5DB3": {
+   "Type": "AWS::SecretsManager::Secret",
+   "Properties": {
+    "GenerateSecretString": {
+     "ExcludePunctuation": true,
+     "GenerateStringKey": "password",
+     "IncludeSpace": false,
+     "PasswordLength": 16,
+     "SecretStringTemplate": "{\"username\":\"participant\"}"
+    },
+    "Tags": [
+     {
+      "Key": "app",
+      "Value": "vscode-server"
+     }
+    ]
+   },
+   "UpdateReplacePolicy": "Delete",
+   "DeletionPolicy": "Delete",
+   "Metadata": {
+    "cdk_nag": {
+     "rules_to_suppress": [
+      {
+       "reason": "For this tmp vc code server we do not need password rotation",
+       "id": "AwsSolutions-SMG4"
+      }
+     ]
+    }
+   }
+  },
+  "IntegVSCodeServerSecretRetrieverOnEventHandlerServiceRoleBEF8D4D2": {
+   "Type": "AWS::IAM::Role",
+   "Properties": {
+    "AssumeRolePolicyDocument": {
+     "Statement": [
+      {
+       "Action": "sts:AssumeRole",
+       "Effect": "Allow",
+       "Principal": {
+        "Service": "lambda.amazonaws.com"
+       }
+      }
+     ],
+     "Version": "2012-10-17"
+    },
+    "ManagedPolicyArns": [
+     {
+      "Fn::Join": [
+       "",
+       [
+        "arn:",
+        {
+         "Ref": "AWS::Partition"
+        },
+        ":iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"
+       ]
+      ]
+     }
+    ]
+   },
+   "Metadata": {
+    "cdk_nag": {
+     "rules_to_suppress": [
+      {
+       "reason": "For this event handler we do not need to restrict managed policies",
+       "id": "AwsSolutions-IAM4"
+      },
+      {
+       "reason": "For this lambda the latest runtime is not needed",
+       "id": "AwsSolutions-L1"
+      }
+     ]
+    }
+   }
+  },
+  "IntegVSCodeServerSecretRetrieverOnEventHandlerServiceRoleDefaultPolicy2641E2C6": {
+   "Type": "AWS::IAM::Policy",
+   "Properties": {
+    "PolicyDocument": {
+     "Statement": [
+      {
+       "Action": "secretsmanager:GetSecretValue",
+       "Effect": "Allow",
+       "Resource": {
+        "Ref": "IntegVSCodeServerpasswordsecret202A5DB3"
+       }
+      }
+     ],
+     "Version": "2012-10-17"
+    },
+    "PolicyName": "IntegVSCodeServerSecretRetrieverOnEventHandlerServiceRoleDefaultPolicy2641E2C6",
+    "Roles": [
+     {
+      "Ref": "IntegVSCodeServerSecretRetrieverOnEventHandlerServiceRoleBEF8D4D2"
+     }
+    ]
+   }
+  },
+  "IntegVSCodeServerSecretRetrieverOnEventHandlerDD084AE3": {
+   "Type": "AWS::Lambda::Function",
+   "Properties": {
+    "Code": {
+     "S3Bucket": {
+      "Fn::Sub": "cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}"
+     },
+     "S3Key": "781ab0ab74634cdaf61539ab208ab777829ef07097ac21f95b9e15a3b1eedc1b.zip"
+    },
+    "Description": "src/secret-retriever/secret-retriever.lambda.ts",
+    "Handler": "index.handler",
+    "MemorySize": 128,
+    "Role": {
+     "Fn::GetAtt": [
+      "IntegVSCodeServerSecretRetrieverOnEventHandlerServiceRoleBEF8D4D2",
+      "Arn"
+     ]
+    },
+    "Runtime": "nodejs22.x",
+    "Timeout": 10
+   },
+   "DependsOn": [
+    "IntegVSCodeServerSecretRetrieverOnEventHandlerServiceRoleDefaultPolicy2641E2C6",
+    "IntegVSCodeServerSecretRetrieverOnEventHandlerServiceRoleBEF8D4D2"
+   ],
+   "Metadata": {
+    "cdk_nag": {
+     "rules_to_suppress": [
+      {
+       "reason": "For this event handler we do not need to restrict managed policies",
+       "id": "AwsSolutions-IAM4"
+      },
+      {
+       "reason": "For this lambda the latest runtime is not needed",
+       "id": "AwsSolutions-L1"
+      }
+     ]
+    }
+   }
+  },
+  "IntegVSCodeServerSecretRetrieveProviderframeworkonEventServiceRole0F156B64": {
+   "Type": "AWS::IAM::Role",
+   "Properties": {
+    "AssumeRolePolicyDocument": {
+     "Statement": [
+      {
+       "Action": "sts:AssumeRole",
+       "Effect": "Allow",
+       "Principal": {
+        "Service": "lambda.amazonaws.com"
+       }
+      }
+     ],
+     "Version": "2012-10-17"
+    },
+    "ManagedPolicyArns": [
+     {
+      "Fn::Join": [
+       "",
+       [
+        "arn:",
+        {
+         "Ref": "AWS::Partition"
+        },
+        ":iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"
+       ]
+      ]
+     }
+    ]
+   },
+   "Metadata": {
+    "cdk_nag": {
+     "rules_to_suppress": [
+      {
+       "reason": "For this provider we do not need to restrict managed policies",
+       "id": "AwsSolutions-IAM4"
+      },
+      {
+       "reason": "For this provider wildcards are fine",
+       "id": "AwsSolutions-IAM5"
+      },
+      {
+       "reason": "For this provider the latest runtime is not needed",
+       "id": "AwsSolutions-L1"
+      }
+     ]
+    }
+   }
+  },
+  "IntegVSCodeServerSecretRetrieveProviderframeworkonEventServiceRoleDefaultPolicyEC4DCEA0": {
+   "Type": "AWS::IAM::Policy",
+   "Properties": {
+    "PolicyDocument": {
+     "Statement": [
+      {
+       "Action": "lambda:InvokeFunction",
+       "Effect": "Allow",
+       "Resource": [
+        {
+         "Fn::GetAtt": [
+          "IntegVSCodeServerSecretRetrieverOnEventHandlerDD084AE3",
+          "Arn"
+         ]
+        },
+        {
+         "Fn::Join": [
+          "",
+          [
+           {
+            "Fn::GetAtt": [
+             "IntegVSCodeServerSecretRetrieverOnEventHandlerDD084AE3",
+             "Arn"
+            ]
+           },
+           ":*"
+          ]
+         ]
+        }
+       ]
+      },
+      {
+       "Action": "lambda:GetFunction",
+       "Effect": "Allow",
+       "Resource": {
+        "Fn::GetAtt": [
+         "IntegVSCodeServerSecretRetrieverOnEventHandlerDD084AE3",
+         "Arn"
+        ]
+       }
+      }
+     ],
+     "Version": "2012-10-17"
+    },
+    "PolicyName": "IntegVSCodeServerSecretRetrieveProviderframeworkonEventServiceRoleDefaultPolicyEC4DCEA0",
+    "Roles": [
+     {
+      "Ref": "IntegVSCodeServerSecretRetrieveProviderframeworkonEventServiceRole0F156B64"
+     }
+    ]
+   },
+   "Metadata": {
+    "cdk_nag": {
+     "rules_to_suppress": [
+      {
+       "reason": "For this provider we do not need to restrict managed policies",
+       "id": "AwsSolutions-IAM4"
+      },
+      {
+       "reason": "For this provider wildcards are fine",
+       "id": "AwsSolutions-IAM5"
+      },
+      {
+       "reason": "For this provider the latest runtime is not needed",
+       "id": "AwsSolutions-L1"
+      }
+     ]
+    }
+   }
+  },
+  "IntegVSCodeServerSecretRetrieveProviderframeworkonEventCF035CA3": {
+   "Type": "AWS::Lambda::Function",
+   "Properties": {
+    "Code": {
+     "S3Bucket": {
+      "Fn::Sub": "cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}"
+     },
+     "S3Key": "bdc104ed9cab1b5b6421713c8155f0b753380595356f710400609664d3635eca.zip"
+    },
+    "Description": "AWS CDK resource provider framework - onEvent (IntegTestStackUbuntu24/IntegVSCodeServer/SecretRetrieveProvider)",
+    "Environment": {
+     "Variables": {
+      "USER_ON_EVENT_FUNCTION_ARN": {
+       "Fn::GetAtt": [
+        "IntegVSCodeServerSecretRetrieverOnEventHandlerDD084AE3",
+        "Arn"
+       ]
+      }
+     }
+    },
+    "Handler": "framework.onEvent",
+    "Role": {
+     "Fn::GetAtt": [
+      "IntegVSCodeServerSecretRetrieveProviderframeworkonEventServiceRole0F156B64",
+      "Arn"
+     ]
+    },
+    "Runtime": {
+     "Fn::FindInMap": [
+      "LatestNodeRuntimeMap",
+      {
+       "Ref": "AWS::Region"
+      },
+      "value"
+     ]
+    },
+    "Timeout": 900
+   },
+   "DependsOn": [
+    "IntegVSCodeServerSecretRetrieveProviderframeworkonEventServiceRoleDefaultPolicyEC4DCEA0",
+    "IntegVSCodeServerSecretRetrieveProviderframeworkonEventServiceRole0F156B64"
+   ],
+   "Metadata": {
+    "cdk_nag": {
+     "rules_to_suppress": [
+      {
+       "reason": "For this provider we do not need to restrict managed policies",
+       "id": "AwsSolutions-IAM4"
+      },
+      {
+       "reason": "For this provider wildcards are fine",
+       "id": "AwsSolutions-IAM5"
+      },
+      {
+       "reason": "For this provider the latest runtime is not needed",
+       "id": "AwsSolutions-L1"
+      }
+     ]
+    }
+   }
+  },
+  "IntegVSCodeServerSecretRetrieverCustomResource2F3DB8BD": {
+   "Type": "AWS::CloudFormation::CustomResource",
+   "Properties": {
+    "ServiceToken": {
+     "Fn::GetAtt": [
+      "IntegVSCodeServerSecretRetrieveProviderframeworkonEventCF035CA3",
+      "Arn"
+     ]
+    },
+    "ServiceTimeout": 305,
+    "SecretArn": {
+     "Ref": "IntegVSCodeServerpasswordsecret202A5DB3"
+    }
+   },
+   "UpdateReplacePolicy": "Delete",
+   "DeletionPolicy": "Delete"
+  },
+  "IntegVSCodeServervpc93DDE887": {
+   "Type": "AWS::EC2::VPC",
+   "Properties": {
+    "CidrBlock": "10.0.0.0/16",
+    "EnableDnsHostnames": true,
+    "EnableDnsSupport": true,
+    "InstanceTenancy": "default",
+    "Tags": [
+     {
+      "Key": "app",
+      "Value": "vscode-server"
+     },
+     {
+      "Key": "Name",
+      "Value": "IntegTestStackUbuntu24/IntegVSCodeServer/vpc"
+     }
+    ]
+   },
+   "Metadata": {
+    "cdk_nag": {
+     "rules_to_suppress": [
+      {
+       "reason": "For this tmp vpc we do not need flow logs",
+       "id": "AwsSolutions-VPC7"
+      }
+     ]
+    }
+   }
+  },
+  "IntegVSCodeServervpcpublicSubnet1Subnet928029A1": {
+   "Type": "AWS::EC2::Subnet",
+   "Properties": {
+    "AvailabilityZone": {
+     "Fn::Select": [
+      0,
+      {
+       "Fn::GetAZs": ""
+      }
+     ]
+    },
+    "CidrBlock": "10.0.0.0/17",
+    "MapPublicIpOnLaunch": true,
+    "Tags": [
+     {
+      "Key": "app",
+      "Value": "vscode-server"
+     },
+     {
+      "Key": "aws-cdk:subnet-name",
+      "Value": "public"
+     },
+     {
+      "Key": "aws-cdk:subnet-type",
+      "Value": "Public"
+     },
+     {
+      "Key": "Name",
+      "Value": "IntegTestStackUbuntu24/IntegVSCodeServer/vpc/publicSubnet1"
+     }
+    ],
+    "VpcId": {
+     "Ref": "IntegVSCodeServervpc93DDE887"
+    }
+   },
+   "Metadata": {
+    "cdk_nag": {
+     "rules_to_suppress": [
+      {
+       "reason": "For this tmp vpc we do not need flow logs",
+       "id": "AwsSolutions-VPC7"
+      }
+     ]
+    }
+   }
+  },
+  "IntegVSCodeServervpcpublicSubnet1RouteTableFD418D0B": {
+   "Type": "AWS::EC2::RouteTable",
+   "Properties": {
+    "Tags": [
+     {
+      "Key": "app",
+      "Value": "vscode-server"
+     },
+     {
+      "Key": "Name",
+      "Value": "IntegTestStackUbuntu24/IntegVSCodeServer/vpc/publicSubnet1"
+     }
+    ],
+    "VpcId": {
+     "Ref": "IntegVSCodeServervpc93DDE887"
+    }
+   },
+   "Metadata": {
+    "cdk_nag": {
+     "rules_to_suppress": [
+      {
+       "reason": "For this tmp vpc we do not need flow logs",
+       "id": "AwsSolutions-VPC7"
+      }
+     ]
+    }
+   }
+  },
+  "IntegVSCodeServervpcpublicSubnet1RouteTableAssociation599AB80D": {
+   "Type": "AWS::EC2::SubnetRouteTableAssociation",
+   "Properties": {
+    "RouteTableId": {
+     "Ref": "IntegVSCodeServervpcpublicSubnet1RouteTableFD418D0B"
+    },
+    "SubnetId": {
+     "Ref": "IntegVSCodeServervpcpublicSubnet1Subnet928029A1"
+    }
+   },
+   "Metadata": {
+    "cdk_nag": {
+     "rules_to_suppress": [
+      {
+       "reason": "For this tmp vpc we do not need flow logs",
+       "id": "AwsSolutions-VPC7"
+      }
+     ]
+    }
+   }
+  },
+  "IntegVSCodeServervpcpublicSubnet1DefaultRoute36845B30": {
+   "Type": "AWS::EC2::Route",
+   "Properties": {
+    "DestinationCidrBlock": "0.0.0.0/0",
+    "GatewayId": {
+     "Ref": "IntegVSCodeServervpcIGW960F6D83"
+    },
+    "RouteTableId": {
+     "Ref": "IntegVSCodeServervpcpublicSubnet1RouteTableFD418D0B"
+    }
+   },
+   "DependsOn": [
+    "IntegVSCodeServervpcVPCGWA7CDED90"
+   ],
+   "Metadata": {
+    "cdk_nag": {
+     "rules_to_suppress": [
+      {
+       "reason": "For this tmp vpc we do not need flow logs",
+       "id": "AwsSolutions-VPC7"
+      }
+     ]
+    }
+   }
+  },
+  "IntegVSCodeServervpcpublicSubnet2SubnetE381654D": {
+   "Type": "AWS::EC2::Subnet",
+   "Properties": {
+    "AvailabilityZone": {
+     "Fn::Select": [
+      1,
+      {
+       "Fn::GetAZs": ""
+      }
+     ]
+    },
+    "CidrBlock": "10.0.128.0/17",
+    "MapPublicIpOnLaunch": true,
+    "Tags": [
+     {
+      "Key": "app",
+      "Value": "vscode-server"
+     },
+     {
+      "Key": "aws-cdk:subnet-name",
+      "Value": "public"
+     },
+     {
+      "Key": "aws-cdk:subnet-type",
+      "Value": "Public"
+     },
+     {
+      "Key": "Name",
+      "Value": "IntegTestStackUbuntu24/IntegVSCodeServer/vpc/publicSubnet2"
+     }
+    ],
+    "VpcId": {
+     "Ref": "IntegVSCodeServervpc93DDE887"
+    }
+   },
+   "Metadata": {
+    "cdk_nag": {
+     "rules_to_suppress": [
+      {
+       "reason": "For this tmp vpc we do not need flow logs",
+       "id": "AwsSolutions-VPC7"
+      }
+     ]
+    }
+   }
+  },
+  "IntegVSCodeServervpcpublicSubnet2RouteTableC264EFB4": {
+   "Type": "AWS::EC2::RouteTable",
+   "Properties": {
+    "Tags": [
+     {
+      "Key": "app",
+      "Value": "vscode-server"
+     },
+     {
+      "Key": "Name",
+      "Value": "IntegTestStackUbuntu24/IntegVSCodeServer/vpc/publicSubnet2"
+     }
+    ],
+    "VpcId": {
+     "Ref": "IntegVSCodeServervpc93DDE887"
+    }
+   },
+   "Metadata": {
+    "cdk_nag": {
+     "rules_to_suppress": [
+      {
+       "reason": "For this tmp vpc we do not need flow logs",
+       "id": "AwsSolutions-VPC7"
+      }
+     ]
+    }
+   }
+  },
+  "IntegVSCodeServervpcpublicSubnet2RouteTableAssociationC62A1999": {
+   "Type": "AWS::EC2::SubnetRouteTableAssociation",
+   "Properties": {
+    "RouteTableId": {
+     "Ref": "IntegVSCodeServervpcpublicSubnet2RouteTableC264EFB4"
+    },
+    "SubnetId": {
+     "Ref": "IntegVSCodeServervpcpublicSubnet2SubnetE381654D"
+    }
+   },
+   "Metadata": {
+    "cdk_nag": {
+     "rules_to_suppress": [
+      {
+       "reason": "For this tmp vpc we do not need flow logs",
+       "id": "AwsSolutions-VPC7"
+      }
+     ]
+    }
+   }
+  },
+  "IntegVSCodeServervpcpublicSubnet2DefaultRouteEAD8BC23": {
+   "Type": "AWS::EC2::Route",
+   "Properties": {
+    "DestinationCidrBlock": "0.0.0.0/0",
+    "GatewayId": {
+     "Ref": "IntegVSCodeServervpcIGW960F6D83"
+    },
+    "RouteTableId": {
+     "Ref": "IntegVSCodeServervpcpublicSubnet2RouteTableC264EFB4"
+    }
+   },
+   "DependsOn": [
+    "IntegVSCodeServervpcVPCGWA7CDED90"
+   ],
+   "Metadata": {
+    "cdk_nag": {
+     "rules_to_suppress": [
+      {
+       "reason": "For this tmp vpc we do not need flow logs",
+       "id": "AwsSolutions-VPC7"
+      }
+     ]
+    }
+   }
+  },
+  "IntegVSCodeServervpcIGW960F6D83": {
+   "Type": "AWS::EC2::InternetGateway",
+   "Properties": {
+    "Tags": [
+     {
+      "Key": "app",
+      "Value": "vscode-server"
+     },
+     {
+      "Key": "Name",
+      "Value": "IntegTestStackUbuntu24/IntegVSCodeServer/vpc"
+     }
+    ]
+   },
+   "Metadata": {
+    "cdk_nag": {
+     "rules_to_suppress": [
+      {
+       "reason": "For this tmp vpc we do not need flow logs",
+       "id": "AwsSolutions-VPC7"
+      }
+     ]
+    }
+   }
+  },
+  "IntegVSCodeServervpcVPCGWA7CDED90": {
+   "Type": "AWS::EC2::VPCGatewayAttachment",
+   "Properties": {
+    "InternetGatewayId": {
+     "Ref": "IntegVSCodeServervpcIGW960F6D83"
+    },
+    "VpcId": {
+     "Ref": "IntegVSCodeServervpc93DDE887"
+    }
+   },
+   "Metadata": {
+    "cdk_nag": {
+     "rules_to_suppress": [
+      {
+       "reason": "For this tmp vpc we do not need flow logs",
+       "id": "AwsSolutions-VPC7"
+      }
+     ]
+    }
+   }
+  },
+  "IntegVSCodeServervpcRestrictDefaultSecurityGroupCustomResourceF6EA8ED1": {
+   "Type": "Custom::VpcRestrictDefaultSG",
+   "Properties": {
+    "ServiceToken": {
+     "Fn::GetAtt": [
+      "CustomVpcRestrictDefaultSGCustomResourceProviderHandlerDC833E5E",
+      "Arn"
+     ]
+    },
+    "DefaultSecurityGroupId": {
+     "Fn::GetAtt": [
+      "IntegVSCodeServervpc93DDE887",
+      "DefaultSecurityGroup"
+     ]
+    },
+    "Account": {
+     "Ref": "AWS::AccountId"
+    }
+   },
+   "UpdateReplacePolicy": "Delete",
+   "DeletionPolicy": "Delete",
+   "Metadata": {
+    "cdk_nag": {
+     "rules_to_suppress": [
+      {
+       "reason": "For this tmp vpc we do not need flow logs",
+       "id": "AwsSolutions-VPC7"
+      }
+     ]
+    }
+   }
+  },
+  "IntegVSCodeServercftoserversgFFE586B0": {
+   "Type": "AWS::EC2::SecurityGroup",
+   "Properties": {
+    "GroupDescription": "SG for VSCodeServer - only allow CloudFront ingress",
+    "GroupName": "cloudfront-to-vscode-server",
+    "SecurityGroupEgress": [
+     {
+      "CidrIp": "0.0.0.0/0",
+      "Description": "Allow all outbound traffic by default",
+      "IpProtocol": "-1"
+     }
+    ],
+    "Tags": [
+     {
+      "Key": "app",
+      "Value": "vscode-server"
+     }
+    ],
+    "VpcId": {
+     "Ref": "IntegVSCodeServervpc93DDE887"
+    }
+   }
+  },
+  "IntegVSCodeServercftoserversgfromIndirectPeer80C4F51713": {
+   "Type": "AWS::EC2::SecurityGroupIngress",
+   "Properties": {
+    "Description": "Allow HTTP from com.amazonaws.global.cloudfront.origin-facing",
+    "FromPort": 80,
+    "GroupId": {
+     "Fn::GetAtt": [
+      "IntegVSCodeServercftoserversgFFE586B0",
+      "GroupId"
+     ]
+    },
+    "IpProtocol": "tcp",
+    "SourcePrefixListId": {
+     "Fn::GetAtt": [
+      "IntegVSCodeServercfprefixlistIdGetPrefixListIdF0821FFC",
+      "PrefixLists.0.PrefixListId"
+     ]
+    },
+    "ToPort": 80
+   }
+  },
+  "IntegVSCodeServercfprefixlistIdGetPrefixListIdLogGroup171C2803": {
+   "Type": "AWS::Logs::LogGroup",
+   "Properties": {
+    "RetentionInDays": 1,
+    "Tags": [
+     {
+      "Key": "app",
+      "Value": "vscode-server"
+     }
+    ]
+   },
+   "UpdateReplacePolicy": "Delete",
+   "DeletionPolicy": "Delete",
+   "Metadata": {
+    "cdk_nag": {
+     "rules_to_suppress": [
+      {
+       "reason": "For this provider wildcards are fine",
+       "id": "AwsSolutions-IAM5"
+      }
+     ]
+    }
+   }
+  },
+  "IntegVSCodeServercfprefixlistIdGetPrefixListIdRole1302B3E1": {
+   "Type": "AWS::IAM::Role",
+   "Properties": {
+    "AssumeRolePolicyDocument": {
+     "Statement": [
+      {
+       "Action": "sts:AssumeRole",
+       "Effect": "Allow",
+       "Principal": {
+        "Service": "lambda.amazonaws.com"
+       }
+      }
+     ],
+     "Version": "2012-10-17"
+    }
+   },
+   "Metadata": {
+    "cdk_nag": {
+     "rules_to_suppress": [
+      {
+       "reason": "For this provider wildcards are fine",
+       "id": "AwsSolutions-IAM5"
+      }
+     ]
+    }
+   }
+  },
+  "IntegVSCodeServercfprefixlistIdGetPrefixListIdF0821FFC": {
+   "Type": "Custom::AWS",
+   "Properties": {
+    "ServiceToken": {
+     "Fn::GetAtt": [
+      "AWS679f53fac002430cb0da5b7982bd22872D164C4C",
+      "Arn"
+     ]
+    },
+    "Create": "{\"service\":\"@aws-sdk/client-ec2\",\"action\":\"DescribeManagedPrefixListsCommand\",\"parameters\":{\"Filters\":[{\"Name\":\"prefix-list-name\",\"Values\":[\"com.amazonaws.global.cloudfront.origin-facing\"]}]},\"physicalResourceId\":{\"id\":\"cf-prefixlistId-c82b0dc88067ef7a\"}}",
+    "Update": "{\"service\":\"@aws-sdk/client-ec2\",\"action\":\"DescribeManagedPrefixListsCommand\",\"parameters\":{\"Filters\":[{\"Name\":\"prefix-list-name\",\"Values\":[\"com.amazonaws.global.cloudfront.origin-facing\"]}]},\"physicalResourceId\":{\"id\":\"cf-prefixlistId-c82b0dc88067ef7a\"}}",
+    "InstallLatestAwsSdk": false
+   },
+   "DependsOn": [
+    "IntegVSCodeServercfprefixlistIdGetPrefixListIdCustomResourcePolicyAB3F4958"
+   ],
+   "UpdateReplacePolicy": "Delete",
+   "DeletionPolicy": "Delete",
+   "Metadata": {
+    "cdk_nag": {
+     "rules_to_suppress": [
+      {
+       "reason": "For this provider wildcards are fine",
+       "id": "AwsSolutions-IAM5"
+      }
+     ]
+    }
+   }
+  },
+  "IntegVSCodeServercfprefixlistIdGetPrefixListIdCustomResourcePolicyAB3F4958": {
+   "Type": "AWS::IAM::Policy",
+   "Properties": {
+    "PolicyDocument": {
+     "Statement": [
+      {
+       "Action": "ec2:DescribeManagedPrefixLists",
+       "Effect": "Allow",
+       "Resource": "*"
+      }
+     ],
+     "Version": "2012-10-17"
+    },
+    "PolicyName": "IntegVSCodeServercfprefixlistIdGetPrefixListIdCustomResourcePolicyAB3F4958",
+    "Roles": [
+     {
+      "Ref": "IntegVSCodeServercfprefixlistIdGetPrefixListIdRole1302B3E1"
+     }
+    ]
+   },
+   "Metadata": {
+    "cdk_nag": {
+     "rules_to_suppress": [
+      {
+       "reason": "For this provider wildcards are fine",
+       "id": "AwsSolutions-IAM5"
+      }
+     ]
+    }
+   }
+  },
+  "IntegVSCodeServerserverinstancerole7745B5BB": {
+   "Type": "AWS::IAM::Role",
+   "Properties": {
+    "AssumeRolePolicyDocument": {
+     "Statement": [
+      {
+       "Action": "sts:AssumeRole",
+       "Effect": "Allow",
+       "Principal": {
+        "Service": [
+         "ec2.amazonaws.com",
+         "ssm.amazonaws.com"
+        ]
+       }
+      }
+     ],
+     "Version": "2012-10-17"
+    },
+    "ManagedPolicyArns": [
+     {
+      "Fn::Join": [
+       "",
+       [
+        "arn:",
+        {
+         "Ref": "AWS::Partition"
+        },
+        ":iam::aws:policy/AmazonSSMManagedInstanceCore"
+       ]
+      ]
+     },
+     {
+      "Fn::Join": [
+       "",
+       [
+        "arn:",
+        {
+         "Ref": "AWS::Partition"
+        },
+        ":iam::aws:policy/CloudWatchAgentServerPolicy"
+       ]
+      ]
+     },
+     {
+      "Fn::Join": [
+       "",
+       [
+        "arn:",
+        {
+         "Ref": "AWS::Partition"
+        },
+        ":iam::aws:policy/AmazonQDeveloperAccess"
+       ]
+      ]
+     },
+     {
+      "Fn::Join": [
+       "",
+       [
+        "arn:",
+        {
+         "Ref": "AWS::Partition"
+        },
+        ":iam::aws:policy/ReadOnlyAccess"
+       ]
+      ]
+     }
+    ],
+    "Policies": [
+     {
+      "PolicyDocument": {
+       "Statement": [
+        {
+         "Action": [
+          "iam:AddRoleToInstanceProfile",
+          "iam:AttachRolePolicy",
+          "iam:CreateRole",
+          "iam:CreateServiceLinkedRole",
+          "iam:DeleteRole",
+          "iam:DeleteRolePermissionsBoundary",
+          "iam:DeleteRolePolicy",
+          "iam:DeleteServiceLinkedRole",
+          "iam:DetachRolePolicy",
+          "iam:GetRole",
+          "iam:GetRolePolicy",
+          "iam:GetServiceLinkedRoleDeletionStatus",
+          "iam:ListAttachedRolePolicies",
+          "iam:ListInstanceProfilesForRole",
+          "iam:ListRolePolicies",
+          "iam:ListRoleTags",
+          "iam:ListRoles",
+          "iam:PutRolePermissionsBoundary",
+          "iam:PutRolePolicy",
+          "iam:RemoveRoleFromInstanceProfile",
+          "iam:TagRole",
+          "iam:UntagRole",
+          "iam:UpdateAssumeRolePolicy",
+          "iam:UpdateRole",
+          "iam:UpdateRoleDescription",
+          "sts:AssumeRole"
+         ],
+         "Effect": "Allow",
+         "Resource": {
+          "Fn::Join": [
+           "",
+           [
+            "arn:aws:iam::",
+            {
+             "Ref": "AWS::AccountId"
+            },
+            ":role/cdk-*"
+           ]
+          ]
+         },
+         "Sid": "StsAccess"
+        },
+        {
+         "Action": "iam:PassRole",
+         "Condition": {
+          "StringLike": {
+           "iam:PassedToService": "cloudformation.amazonaws.com"
+          }
+         },
+         "Effect": "Allow",
+         "Resource": {
+          "Fn::Join": [
+           "",
+           [
+            "arn:aws:iam::",
+            {
+             "Ref": "AWS::AccountId"
+            },
+            ":role/cdk-*"
+           ]
+          ]
+         }
+        },
+        {
+         "Action": "cloudformation:*",
+         "Effect": "Allow",
+         "Resource": {
+          "Fn::Join": [
+           "",
+           [
+            "arn:aws:cloudformation:*:",
+            {
+             "Ref": "AWS::AccountId"
+            },
+            ":stack/CDKToolkit/*"
+           ]
+          ]
+         }
+        },
+        {
+         "Action": [
+          "cloudformation:CreateChangeSet",
+          "cloudformation:DeleteChangeSet",
+          "cloudformation:ExecuteChangeSet",
+          "ec2:DescribeInstances",
+          "ec2:DescribeVolumesModifications*",
+          "ec2:ModifyVolume"
+         ],
+         "Effect": "Allow",
+         "Resource": "*"
+        },
+        {
+         "Action": "s3:*",
+         "Effect": "Allow",
+         "Resource": "*",
+         "Sid": "S3Access"
+        },
+        {
+         "Action": [
+          "ecr:CreateRepository",
+          "ecr:DeleteRepository",
+          "ecr:DescribeRepositories",
+          "ecr:GetLifecyclePolicy",
+          "ecr:PutImageScanningConfiguration",
+          "ecr:PutLifecyclePolicy",
+          "ecr:SetRepositoryPolicy"
+         ],
+         "Effect": "Allow",
+         "Resource": {
+          "Fn::Join": [
+           "",
+           [
+            "arn:aws:ecr:*:",
+            {
+             "Ref": "AWS::AccountId"
+            },
+            ":repository/cdk-*"
+           ]
+          ]
+         },
+         "Sid": "ECRAccess"
+        },
+        {
+         "Action": [
+          "ssm:DeleteParameter*",
+          "ssm:GetParameter*",
+          "ssm:PutParameter*"
+         ],
+         "Effect": "Allow",
+         "Resource": {
+          "Fn::Join": [
+           "",
+           [
+            "arn:aws:ssm:*:",
+            {
+             "Ref": "AWS::AccountId"
+            },
+            ":parameter/cdk-bootstrap/*"
+           ]
+          ]
+         }
+        },
+        {
+         "Action": [
+          "codepipeline:DisableStageTransition",
+          "codepipeline:EnableStageTransition",
+          "codepipeline:StartPipelineExecution",
+          "codepipeline:StopPipelineExecution",
+          "codepipeline:UpdatePipeline"
+         ],
+         "Effect": "Allow",
+         "Resource": {
+          "Fn::Join": [
+           "",
+           [
+            "arn:aws:codepipeline:*:",
+            {
+             "Ref": "AWS::AccountId"
+            },
+            ":*/*"
+           ]
+          ]
+         }
+        },
+        {
+         "Action": "kms:Decrypt",
+         "Effect": "Allow",
+         "Resource": {
+          "Fn::Join": [
+           "",
+           [
+            "arn:aws:kms:*:",
+            {
+             "Ref": "AWS::AccountId"
+            },
+            ":key/*"
+           ]
+          ]
+         }
+        }
+       ],
+       "Version": "2012-10-17"
+      },
+      "PolicyName": "VSCodeInstanceInlinePolicy"
+     }
+    ]
+   },
+   "Metadata": {
+    "cdk_nag": {
+     "rules_to_suppress": [
+      {
+       "reason": "For this tmp role we do not need to restrict managed policies",
+       "id": "AwsSolutions-IAM4"
+      },
+      {
+       "reason": "For this tmp role the wildcards are fine",
+       "id": "AwsSolutions-IAM5"
+      }
+     ]
+    }
+   }
+  },
+  "IntegVSCodeServerserverinstanceInstanceProfile6130979E": {
+   "Type": "AWS::IAM::InstanceProfile",
+   "Properties": {
+    "Roles": [
+     {
+      "Ref": "IntegVSCodeServerserverinstancerole7745B5BB"
+     }
+    ]
+   },
+   "Metadata": {
+    "cdk_nag": {
+     "rules_to_suppress": [
+      {
+       "reason": "For this tmp instance we do not need an asg",
+       "id": "AwsSolutions-EC29"
+      }
+     ]
+    }
+   }
+  },
+  "IntegVSCodeServerserverinstance0A3D62D7": {
+   "Type": "AWS::EC2::Instance",
+   "Properties": {
+    "AvailabilityZone": {
+     "Fn::Select": [
+      0,
+      {
+       "Fn::GetAZs": ""
+      }
+     ]
+    },
+    "BlockDeviceMappings": [
+     {
+      "DeviceName": "/dev/sda1",
+      "Ebs": {
+       "DeleteOnTermination": true,
+       "Encrypted": true,
+       "VolumeSize": 40,
+       "VolumeType": "gp3"
+      }
+     }
+    ],
+    "IamInstanceProfile": {
+     "Ref": "IntegVSCodeServerserverinstanceInstanceProfile6130979E"
+    },
+    "ImageId": {
+     "Ref": "SsmParameterValueawsservicecanonicalubuntuservernoblestablecurrentarm64hvmebsgp3amiidC96584B6F00A464EAD1953AFF4B05118Parameter"
+    },
+    "InstanceType": "m7g.xlarge",
+    "LaunchTemplate": {
+     "LaunchTemplateName": "IntegTestStackUbuntu24IntegVSCodeServerserverinstanceLaunchTemplateDC7D96D8",
+     "Version": {
+      "Fn::GetAtt": [
+       "IntegVSCodeServerserverinstanceLaunchTemplate43932ED3",
+       "LatestVersionNumber"
+      ]
+     }
+    },
+    "Monitoring": true,
+    "NetworkInterfaces": [
+     {
+      "AssociatePublicIpAddress": true,
+      "DeviceIndex": "0",
+      "GroupSet": [
+       {
+        "Fn::GetAtt": [
+         "IntegVSCodeServercftoserversgFFE586B0",
+         "GroupId"
+        ]
+       }
+      ],
+      "SubnetId": {
+       "Ref": "IntegVSCodeServervpcpublicSubnet1Subnet928029A1"
+      }
+     }
+    ],
+    "Tags": [
+     {
+      "Key": "app",
+      "Value": "vscode-server"
+     },
+     {
+      "Key": "Name",
+      "Value": "VSCodeServer"
+     }
+    ],
+    "UserData": {
+     "Fn::Base64": "\n        #cloud-config\n          hostname: VSCodeServer\n          runcmd:\n            - mkdir -p /Workshop && chown -R participant:participant /Workshop\n      "
+    }
+   },
+   "DependsOn": [
+    "IntegVSCodeServerserverinstancerole7745B5BB",
+    "IntegVSCodeServervpcpublicSubnet1DefaultRoute36845B30",
+    "IntegVSCodeServervpcpublicSubnet1RouteTableAssociation599AB80D",
+    "IntegVSCodeServervpcpublicSubnet2DefaultRouteEAD8BC23",
+    "IntegVSCodeServervpcpublicSubnet2RouteTableAssociationC62A1999"
+   ],
+   "Metadata": {
+    "cdk_nag": {
+     "rules_to_suppress": [
+      {
+       "reason": "For this tmp instance we do not need an asg",
+       "id": "AwsSolutions-EC29"
+      }
+     ]
+    }
+   }
+  },
+  "IntegVSCodeServerserverinstanceLaunchTemplate43932ED3": {
+   "Type": "AWS::EC2::LaunchTemplate",
+   "Properties": {
+    "LaunchTemplateData": {
+     "MetadataOptions": {
+      "HttpTokens": "required"
+     }
+    },
+    "LaunchTemplateName": "IntegTestStackUbuntu24IntegVSCodeServerserverinstanceLaunchTemplateDC7D96D8"
+   }
+  },
+  "IntegVSCodeServercfcachepolicy8F5F1F69": {
+   "Type": "AWS::CloudFront::CachePolicy",
+   "Properties": {
+    "CachePolicyConfig": {
+     "Comment": "Cache policy for VSCodeServer",
+     "DefaultTTL": 86400,
+     "MaxTTL": 31536000,
+     "MinTTL": 1,
+     "Name": "cf-cache-policy-vscodeserver-IntegTestStackUbuntu24",
+     "ParametersInCacheKeyAndForwardedToOrigin": {
+      "CookiesConfig": {
+       "CookieBehavior": "all"
+      },
+      "EnableAcceptEncodingBrotli": false,
+      "EnableAcceptEncodingGzip": false,
+      "HeadersConfig": {
+       "HeaderBehavior": "whitelist",
+       "Headers": [
+        "Accept-Charset",
+        "Authorization",
+        "Origin",
+        "Accept",
+        "Referer",
+        "Host",
+        "Accept-Language",
+        "Accept-Encoding",
+        "Accept-Datetime"
+       ]
+      },
+      "QueryStringsConfig": {
+       "QueryStringBehavior": "all"
+      }
+     }
+    }
+   }
+  },
+  "IntegVSCodeServercfdistributionFDBE873F": {
+   "Type": "AWS::CloudFront::Distribution",
+   "Properties": {
+    "DistributionConfig": {
+     "CacheBehaviors": [
+      {
+       "AllowedMethods": [
+        "GET",
+        "HEAD",
+        "OPTIONS",
+        "PUT",
+        "PATCH",
+        "POST",
+        "DELETE"
+       ],
+       "CachePolicyId": "4135ea2d-6df8-44a3-9df3-4b5a84be39ad",
+       "Compress": false,
+       "OriginRequestPolicyId": "216adef6-5c7f-47e4-b989-5492eafa07d3",
+       "PathPattern": "/proxy/*",
+       "TargetOriginId": "Cloudfront-IntegTestStackUbuntu24-IntegTestStackUbuntu24",
+       "ViewerProtocolPolicy": "allow-all"
+      }
+     ],
+     "Comment": "Distribution for VSCodeServer",
+     "DefaultCacheBehavior": {
+      "AllowedMethods": [
+       "GET",
+       "HEAD",
+       "OPTIONS",
+       "PUT",
+       "PATCH",
+       "POST",
+       "DELETE"
+      ],
+      "CachePolicyId": {
+       "Ref": "IntegVSCodeServercfcachepolicy8F5F1F69"
+      },
+      "Compress": true,
+      "OriginRequestPolicyId": "216adef6-5c7f-47e4-b989-5492eafa07d3",
+      "TargetOriginId": "Cloudfront-IntegTestStackUbuntu24-IntegTestStackUbuntu24",
+      "ViewerProtocolPolicy": "allow-all"
+     },
+     "Enabled": true,
+     "HttpVersion": "http2and3",
+     "IPV6Enabled": true,
+     "Origins": [
+      {
+       "CustomOriginConfig": {
+        "OriginProtocolPolicy": "http-only",
+        "OriginSSLProtocols": [
+         "TLSv1.2"
+        ]
+       },
+       "DomainName": {
+        "Fn::GetAtt": [
+         "IntegVSCodeServerserverinstance0A3D62D7",
+         "PublicDnsName"
+        ]
+       },
+       "Id": "Cloudfront-IntegTestStackUbuntu24-IntegTestStackUbuntu24"
+      }
+     ],
+     "PriceClass": "PriceClass_All"
+    },
+    "Tags": [
+     {
+      "Key": "app",
+      "Value": "vscode-server"
+     }
+    ]
+   },
+   "Metadata": {
+    "cdk_nag": {
+     "rules_to_suppress": [
+      {
+       "reason": "For this tmp distribution we do not need geo restrictions",
+       "id": "AwsSolutions-CFR1"
+      },
+      {
+       "reason": "For this tmp distribution we do not need waf integration",
+       "id": "AwsSolutions-CFR2"
+      },
+      {
+       "reason": "For this tmp distribution we do not need access logging enabled",
+       "id": "AwsSolutions-CFR3"
+      },
+      {
+       "reason": "For this tmp distribution we do not need limit SSL protocols as we use the default viewer cert",
+       "id": "AwsSolutions-CFR4"
+      },
+      {
+       "reason": "For this tmp distribution we do not need limit SSL protocols as we use the default viewer cert",
+       "id": "AwsSolutions-CFR5"
+      }
+     ]
+    }
+   }
+  },
+  "IntegVSCodeServerssmdocumentubuntuED32BACB": {
+   "Type": "AWS::SSM::Document",
+   "Properties": {
+    "Content": {
+     "schemaVersion": "2.2",
+     "description": "Bootstrap VSCode code-server instance",
+     "parameters": {
+      "VSCodePassword": {
+       "type": "String",
+       "default": {
+        "Ref": "AWS::StackId"
+       }
+      },
+      "NodeVersion": {
+       "type": "String",
+       "default": "22",
+       "allowedValues": [
+        "24",
+        "22",
+        "20",
+        "18"
+       ]
+      },
+      "RepoUrl": {
+       "type": "String",
+       "default": "https://github.com/aws-samples/fleet-management-on-amazon-eks-workshop.git"
+      },
+      "AssetZipS3Path": {
+       "type": "String",
+       "default": ""
+      },
+      "BranchZipS3Path": {
+       "type": "String",
+       "default": ""
+      },
+      "FolderZipS3Path": {
+       "type": "String",
+       "default": ""
+      }
+     },
+     "mainSteps": [
+      {
+       "action": "aws:configurePackage",
+       "name": "InstallCloudWatchAgent",
+       "inputs": {
+        "name": "AmazonCloudWatchAgent",
+        "action": "Install"
+       }
+      },
+      {
+       "action": "aws:runDocument",
+       "name": "ConfigureCloudWatchAgent",
+       "inputs": {
+        "documentType": "SSMDocument",
+        "documentPath": "AmazonCloudWatch-ManageAgent",
+        "documentParameters": {
+         "action": "configure",
+         "mode": "ec2",
+         "optionalConfigurationSource": "default",
+         "optionalRestart": "yes"
+        }
+       }
+      },
+      {
+       "action": "aws:runShellScript",
+       "name": "InstallAptPackagesApt",
+       "inputs": {
+        "runCommand": [
+         "#!/bin/bash",
+         "dpkg --configure -a",
+         "apt-get -q update && DEBIAN_FRONTEND=noninteractive apt-get install -y -q apt-utils",
+         "apt-get -q update && DEBIAN_FRONTEND=noninteractive apt-get install -y -q needrestart unattended-upgrades",
+         "sed -i 's/#$nrconf{kernelhints} = -1;/$nrconf{kernelhints} = 0;/' /etc/needrestart/needrestart.conf",
+         "sed -i 's/#$nrconf{verbosity} = 2;/$nrconf{verbosity} = 0;/' /etc/needrestart/needrestart.conf",
+         "sed -i \"s/#$nrconf{restart} = 'i';/$nrconf{restart} = 'a';/\" /etc/needrestart/needrestart.conf",
+         "echo \"Apt helper packages added. Checking configuration\"",
+         "cat /etc/needrestart/needrestart.conf"
+        ]
+       }
+      },
+      {
+       "action": "aws:runShellScript",
+       "name": "InstallBasePackagesApt",
+       "inputs": {
+        "runCommand": [
+         "#!/bin/bash",
+         "dpkg --configure -a",
+         "apt-get -q update && DEBIAN_FRONTEND=noninteractive apt-get install -y -q curl gnupg whois argon2 unzip nginx openssl locales locales-all apt-transport-https ca-certificates software-properties-common"
+        ]
+       }
+      },
+      {
+       "action": "aws:runShellScript",
+       "name": "AddUserApt",
+       "inputs": {
+        "runCommand": [
+         "#!/bin/bash",
+         "dpkg --configure -a",
+         "if [[ \"participant\" == \"ubuntu\" ]]\nthen\n  echo 'Using existing user: participant'\nelse\n  echo 'Adding user: participant'\n  adduser --disabled-password --gecos '' participant\n  echo \"participant:{{ VSCodePassword }}\" | chpasswd\n  usermod -aG sudo participant\nfi",
+         "tee /etc/sudoers.d/91-vscode-user <<EOF\nparticipant ALL=(ALL) NOPASSWD:ALL\nEOF",
+         "mkdir -p /home/participant && chown -R participant:participant /home/participant",
+         "mkdir -p /home/participant/.local/bin && chown -R participant:participant /home/participant",
+         "echo \"User added. Checking configuration\"",
+         "getent passwd participant"
+        ]
+       }
+      },
+      {
+       "action": "aws:runShellScript",
+       "name": "UpdateProfile",
+       "inputs": {
+        "runCommand": [
+         "#!/bin/bash",
+         "echo LANG=en_US.utf-8 >> /etc/environment",
+         "echo LC_ALL=en_US.UTF-8 >> /etc/environment",
+         "echo 'PATH=$PATH:/home/participant/.local/bin' >> /home/participant/.bashrc",
+         "echo 'export PATH' >> /home/participant/.bashrc",
+         {
+          "Fn::Join": [
+           "",
+           [
+            "echo 'export AWS_REGION=",
+            {
+             "Ref": "AWS::Region"
+            },
+            "' >> /home/participant/.bashrc"
+           ]
+          ]
+         },
+         {
+          "Fn::Join": [
+           "",
+           [
+            "echo 'export AWS_ACCOUNTID=",
+            {
+             "Ref": "AWS::AccountId"
+            },
+            "' >> /home/participant/.bashrc"
+           ]
+          ]
+         },
+         "echo 'export NEXT_TELEMETRY_DISABLED=1' >> /home/participant/.bashrc",
+         "echo \"export PS1='\\[\\033[01;32m\\]\\u:\\[\\033[01;34m\\]\\w\\[\\033[00m\\]\\$ '\" >> /home/participant/.bashrc",
+         "chown -R participant:participant /home/participant"
+        ]
+       }
+      },
+      {
+       "action": "aws:runShellScript",
+       "name": "InstallAWSCLI",
+       "inputs": {
+        "runCommand": [
+         "#!/bin/bash",
+         "mkdir -p /tmp",
+         "curl -fsSL https://awscli.amazonaws.com/awscli-exe-linux-$(uname -m).zip -o /tmp/aws-cli.zip",
+         "chown -R participant:participant /tmp/aws-cli.zip",
+         "unzip -q -d /tmp /tmp/aws-cli.zip",
+         "sudo /tmp/aws/install",
+         "rm -rf /tmp/aws",
+         "echo \"AWS CLI installed. Checking configuration\"",
+         "aws --version"
+        ]
+       }
+      },
+      {
+       "action": "aws:runShellScript",
+       "name": "InstallGitApt",
+       "inputs": {
+        "runCommand": [
+         "#!/bin/bash",
+         "dpkg --configure -a",
+         "add-apt-repository ppa:git-core/ppa",
+         "apt-get -q update && DEBIAN_FRONTEND=noninteractive apt-get install -y -q git",
+         "sudo -u participant git config --global user.email \"participant@example.com\"",
+         "sudo -u participant git config --global user.name \"Workshop Participant\"",
+         "sudo -u participant git config --global init.defaultBranch \"main\"",
+         "echo \"Git installed. Checking configuration\"",
+         "git --version"
+        ]
+       }
+      },
+      {
+       "action": "aws:runShellScript",
+       "name": "CloneRepo",
+       "inputs": {
+        "runCommand": [
+         "#!/bin/bash",
+         "if [[ -z \"{{ RepoUrl }}\" ]]\nthen\n  echo \"No Repo\"\nelse\n  mkdir -p /Workshop && chown -R participant:participant /Workshop\n  sudo -u participant git clone {{ RepoUrl }} /Workshop\n  echo \"Repo {{ RepoUrl }} cloned. Checking configuration\"\n  ls -la /Workshop\n  sudo -u participant git -C /Workshop remote -v\nfi"
+        ]
+       }
+      },
+      {
+       "action": "aws:runShellScript",
+       "name": "DownloadAssets",
+       "inputs": {
+        "runCommand": [
+         "#!/bin/bash",
+         "if [[ -z \"{{ AssetZipS3Path }}\" ]]\nthen\n  echo \"No assets\"\nelse\n  mkdir -p /Workshop && chown -R participant:participant /Workshop\n  mkdir -p /tmp\n  aws s3 cp s3://{{ AssetZipS3Path }} /tmp/asset.zip\n  chown -R participant:participant /tmp/asset.zip\n  unzip -o /tmp/asset.zip -d /Workshop\n  chown -R participant:participant /Workshop\n  if  [[ -d /Workshop/.git ]]\n  then\n    sudo -u participant git -C /Workshop add .\n    sudo -u participant git -C /Workshop commit -m 'chore: workshop commit'\n  else\n    sudo -u participant git -C /Workshop init\n    sudo -u participant git -C /Workshop add .\n    sudo -u participant git -C /Workshop commit -m 'chore: initial commit'\n  fi\n  echo \"Assets downloaded. Checking configuration: /Workshop\"\n  ls -la /Workshop\n  sudo -u participant git -C /Workshop branch\nfi"
+        ]
+       }
+      },
+      {
+       "action": "aws:runShellScript",
+       "name": "DownloadFolders",
+       "inputs": {
+        "runCommand": [
+         "#!/bin/bash",
+         "if [[ -z \"{{ FolderZipS3Path }}\" ]]\nthen\n  echo \"No folders\"\nelse\n  rm -rf /tmp/folder\n  mkdir -p /tmp/folder && chown -R participant:participant /tmp/folder\n  aws s3 cp s3://{{ FolderZipS3Path }} /tmp/asset-folder.zip\n  chown -R participant:participant /tmp/asset-folder.zip\n  unzip -o /tmp/asset-folder.zip -d /tmp/folder\n  chown -R participant:participant /tmp/folder\n  mkdir -p /Workshop && chown -R participant:participant /Workshop\n  cd \"/Workshop\" && cd ..\n  if [[ $(pwd) ==  \"/\" ]]\n  then\n    targetRootFolder=\"\"\n  else\n    targetRootFolder=$(pwd)\n    chown -R participant:participant .\n  fi\n  find \"/tmp/folder\" -maxdepth 1 -mindepth 1 -type d | while read sourceFolder; do\n    folder=\"$(basename $sourceFolder)\"\n    echo \"Processing folder: $folder\"\n    targetFolder=$targetRootFolder/$folder\n    if [[ $targetRootFolder == \"\" ]]\n    then\n      mv $sourceFolder /\n    else\n      mv $sourceFolder $targetRootFolder\n    fi\n    chown -R participant:participant $targetFolder\n    sudo -u participant git -C $targetFolder init\n    sudo -u participant git -C $targetFolder add .\n    sudo -u participant git -C $targetFolder commit -m \"chore: initial commit\"\n    echo \"Folder downloaded. Checking configuration: $targetFolder\"\n    ls -la $targetFolder\n  done\n  rm -rf /tmp/folder\nfi"
+        ]
+       }
+      },
+      {
+       "action": "aws:runShellScript",
+       "name": "DownloadBranches",
+       "inputs": {
+        "runCommand": [
+         "#!/bin/bash",
+         "if [[ -z \"{{ BranchZipS3Path }}\" ]]\nthen\n  echo \"No branches\"\nelse\n  rm -rf /tmp/branch\n  rm -rf /tmp/git\n  mkdir -p /tmp/branch && chown -R participant:participant /tmp/branch\n  mkdir -p /tmp/git && chown -R participant:participant /tmp/git\n  aws s3 cp s3://{{ BranchZipS3Path }} /tmp/asset-branch.zip\n  chown -R participant:participant /tmp/asset-branch.zip\n  unzip -o /tmp/asset-branch.zip -d /tmp/branch\n  chown -R participant:participant /tmp/branch\n  mkdir -p /Workshop && chown -R participant:participant /Workshop\n  sudo -u participant git -C /Workshop init\n  mv /Workshop/.git /tmp/git\n  rm -rf /Workshop\n  mkdir -p /Workshop && chown -R participant:participant /Workshop\n  mv /tmp/git/.git /Workshop\n  find /tmp/branch -maxdepth 1 -mindepth 1 -type d | while read sourceFolder; do\n    branch=\"$(basename $sourceFolder)\"\n    echo \"Processing branch: $branch\"\n    sudo -u participant git -C /Workshop checkout -b $branch 2>&1\n    cp -a $sourceFolder/. /Workshop\n    sudo -u participant git -C /Workshop add .\n    sudo -u participant git -C /Workshop commit -m \"chore: initial commit $branch\"\n    mv /Workshop/.git /tmp/git\n    rm -rf /Workshop\n    mkdir /Workshop && chown -R participant:participant /Workshop\n    mv /tmp/git/.git /Workshop\n  done\n  sudo -u participant git -C /Workshop checkout main 2>&1\n  sudo -u participant git -C /Workshop restore .\n  rm -rf /tmp/branch\n  rm -rf /tmp/git\n  echo \"Branches downloaded. Checking configuration: /Workshop\"\n  sudo -u participant git -C /Workshop branch\n  ls -la /Workshop\nfi"
+        ]
+       }
+      },
+      {
+       "action": "aws:runShellScript",
+       "name": "ConfigureCodeServer",
+       "inputs": {
+        "runCommand": [
+         "#!/bin/bash",
+         "export HOME=/home/participant",
+         "curl -fsSL https://code-server.dev/install.sh | sh -s -- --version 4.100.3",
+         "systemctl enable --now code-server@participant 2>&1",
+         "tee /etc/nginx/conf.d/code-server.conf <<EOF\nserver {\n    listen 80;\n    listen [::]:80;\n    # server_name \\$\\{CloudFrontDistribution.DomainName\\};\n    server_name *.cloudfront.net;\n    location / {\n      proxy_pass http://localhost:8080/;\n      proxy_set_header Host \\$host;\n      proxy_set_header Upgrade \\$http_upgrade;\n      proxy_set_header Connection upgrade;\n      proxy_set_header Accept-Encoding gzip;\n    }\n    location /app {\n      proxy_pass http://localhost:8081/app;\n      proxy_set_header Host \\$host;\n      proxy_set_header Upgrade \\$http_upgrade;\n      proxy_set_header Connection upgrade;\n      proxy_set_header Accept-Encoding gzip;\n    }\n}\nEOF",
+         "mkdir -p /home/participant/.config/code-server",
+         "tee /home/participant/.config/code-server/config.yaml <<EOF\ncert: false\nauth: password\nhashed-password: \"$(echo -n {{ VSCodePassword }} | argon2 $(openssl rand -base64 12) -e)\"\nEOF",
+         "mkdir -p /home/participant/.local/share/code-server/User/",
+         "touch /home/participant/.hushlogin",
+         "mkdir -p /Workshop && chown -R participant:participant /Workshop",
+         "tee /home/participant/.local/share/code-server/User/settings.json <<EOF\n{\n  \"extensions.autoUpdate\": false,\n  \"extensions.autoCheckUpdates\": false,\n  \"telemetry.telemetryLevel\": \"off\",\n  \"security.workspace.trust.startupPrompt\": \"never\",\n  \"security.workspace.trust.enabled\": false,\n  \"security.workspace.trust.banner\": \"never\",\n  \"security.workspace.trust.emptyWindow\": false,\n  \"auto-run-command.rules\": [\n    {\n      \"command\": \"workbench.action.terminal.new\"\n    }\n  ]\n}\nEOF",
+         "chown -R participant:participant /home/participant",
+         "systemctl restart code-server@participant",
+         "systemctl restart nginx",
+         "sudo -u participant --login code-server --install-extension AmazonWebServices.aws-toolkit-vscode --force",
+         "sudo -u participant --login code-server --install-extension AmazonWebServices.amazon-q-vscode --force",
+         "sudo -u participant --login code-server --install-extension ms-vscode.live-server --force",
+         "sudo -u participant --login code-server --install-extension synedra.auto-run-command --force",
+         "chown -R participant:participant /home/participant",
+         "echo \"Nginx installed. Checking configuration\"",
+         "nginx -t 2>&1",
+         "systemctl status nginx",
+         "echo \"CodeServer installed. Checking configuration\"",
+         "code-server -v",
+         "systemctl status code-server@participant"
+        ]
+       }
+      },
+      {
+       "action": "aws:runShellScript",
+       "name": "InstallNodeApt",
+       "inputs": {
+        "runCommand": [
+         "#!/bin/bash",
+         "curl -fsSL https://deb.nodesource.com/gpgkey/nodesource-repo.gpg.key | gpg --dearmor -o /usr/share/keyrings/nodesource.gpg",
+         "echo \"deb [arch=$(dpkg --print-architecture) signed-by=/usr/share/keyrings/nodesource.gpg] https://deb.nodesource.com/node_{{ NodeVersion }}.x nodistro main\" > /etc/apt/sources.list.d/nodesource.list",
+         "apt-get -q update && DEBIAN_FRONTEND=noninteractive apt-get install -y -q nodejs",
+         "npm install -g npm@latest",
+         "echo \"Node and npm installed. Checking configuration\"",
+         "node -v",
+         "npm -v"
+        ]
+       }
+      },
+      {
+       "action": "aws:runShellScript",
+       "name": "InstallCDK",
+       "inputs": {
+        "runCommand": [
+         "#!/bin/bash",
+         "npm install -g aws-cdk",
+         "echo \"AWS CDK installed. Checking configuration\"",
+         "cdk --version"
+        ]
+       }
+      },
+      {
+       "action": "aws:runShellScript",
+       "name": "InstallQCLI",
+       "inputs": {
+        "runCommand": [
+         "#!/bin/bash",
+         "curl --proto '=https' --tlsv1.2 -sSf \"https://desktop-release.q.us-east-1.amazonaws.com/latest/q-$(uname -m)-linux.zip\" -o /tmp/q.zip",
+         "chown -R participant:participant /tmp/q.zip",
+         "unzip -q -d /tmp /tmp/q.zip",
+         "chown -R participant:participant /tmp/q",
+         "chmod +x /tmp/q/install.sh",
+         "sudo -u participant /tmp/q/install.sh --no-confirm",
+         "rm -rf /tmp/q",
+         "q --version",
+         "echo \"Amazon Q CLI installed\""
+        ]
+       }
+      },
+      {
+       "action": "aws:runShellScript",
+       "name": "Installuv",
+       "inputs": {
+        "runCommand": [
+         "#!/bin/bash",
+         "sudo -u participant --login curl -fsSL https://astral.sh/uv/install.sh -o /tmp/uv_install.sh",
+         "sudo -u participant --login bash /tmp/uv_install.sh",
+         "if uv generate-shell-completion bash &>/dev/null; then\n  echo 'eval \"$(uv generate-shell-completion bash)\"' >> /home/participant/.bashrc\nfi",
+         "if uvx generate-shell-completion bash &>/dev/null; then\n  echo 'eval \"$(uvx generate-shell-completion bash)\"' >> /home/participant/.bashrc\nfi",
+         "echo \"uv installed. Checking configuration\"",
+         "sudo -u participant --login uv --version"
+        ]
+       }
+      },
+      {
+       "action": "aws:runShellScript",
+       "name": "InstallPythonApt",
+       "inputs": {
+        "runCommand": [
+         "#!/bin/bash",
+         "dpkg --configure -a",
+         "apt-get -q update && DEBIAN_FRONTEND=noninteractive apt-get install -y -q python3-pip python3-venv python3-boto3 python3-pytest",
+         "echo 'alias pytest=pytest-3' >> /home/participant/.bashrc",
+         "systemctl start multipathd.service packagekit.service",
+         "systemctl restart unattended-upgrades.service",
+         "systemctl restart networkd-dispatcher.service",
+         "sudo -u participant --login code-server --install-extension ms-python.python --force",
+         "if [ -f /home/participant/.local/share/code-server/User/settings.json ]; then\n  sed -i \"2i\\\\  \\\"python.testing.pytestEnabled\\\": true,\" /home/participant/.local/share/code-server/User/settings.json\nelse\n  echo '{\n    \"python.testing.pytestEnabled\": true\n  }' > /home/participant/.local/share/code-server/User/settings.json\nfi",
+         "echo \"Python and Pip installed. Checking configuration\"",
+         "python3 --version",
+         "pip3 --version"
+        ]
+       }
+      },
+      {
+       "action": "aws:runShellScript",
+       "name": "InstallJavaApt",
+       "inputs": {
+        "runCommand": [
+         "#!/bin/bash",
+         "dpkg --configure -a",
+         "curl -fsSL https://apt.corretto.aws/corretto.key | gpg --dearmor -o /usr/share/keyrings/corretto-keyring.gpg",
+         "echo \"deb [signed-by=/usr/share/keyrings/corretto-keyring.gpg] https://apt.corretto.aws stable main\" > /etc/apt/sources.list.d/corretto.list",
+         "DEBIAN_FRONTEND=noninteractive apt-get update",
+         "DEBIAN_FRONTEND=noninteractive apt-get install -y -q java-21-amazon-corretto-jdk java-17-amazon-corretto-jdk java-1.8.0-amazon-corretto-jdk maven",
+         "echo 'export JAVA_8_HOME=$(update-alternatives --list java | grep \"java-1.8.0-amazon-corretto\" | head -1)' >> /home/participant/.bashrc",
+         "echo 'export JAVA_8_PATH=$(update-alternatives --list java | grep \"java-1.8.0-amazon-corretto\" | head -1)' >> /home/participant/.bashrc",
+         "echo 'export JAVA_17_PATH=$(update-alternatives --list java | grep \"java-17-amazon-corretto\" | head -1)' >> /home/participant/.bashrc",
+         "echo 'export JAVA_17_HOME=$(update-alternatives --list java | grep \"java-17-amazon-corretto\" | head -1)' >> /home/participant/.bashrc",
+         "echo 'export JAVA_21_PATH=$(update-alternatives --list java | grep \"java-21-amazon-corretto\" | head -1)' >> /home/participant/.bashrc",
+         "echo 'export JAVA_21_HOME=$(update-alternatives --list java | grep \"java-21-amazon-corretto\" | head -1)' >> /home/participant/.bashrc",
+         "echo 'export JAVA_HOME=$(update-alternatives --list java | grep \"java-21-amazon-corretto\" | head -1)' >> /home/participant/.bashrc",
+         "echo 'export PATH=$PATH:$JAVA_HOME/bin:/usr/share/maven/bin' >> /home/participant/.bashrc",
+         "sudo -u participant --login code-server --install-extension vscjava.vscode-java-pack --force",
+         "echo \"Java and Maven installed. Checking configuration\"",
+         "java -version 2>&1",
+         "mvn --version",
+         "update-alternatives --list java"
+        ]
+       }
+      },
+      {
+       "action": "aws:runShellScript",
+       "name": "InstallDotnetApt",
+       "inputs": {
+        "runCommand": [
+         "#!/bin/bash",
+         "dpkg --configure -a",
+         "apt-get -q update && DEBIAN_FRONTEND=noninteractive apt-get install -y -q dotnet-sdk-8.0",
+         "dotnet tool install -g Microsoft.Web.LibraryManager.Cli",
+         "echo 'PATH=$PATH:/home/participant/.dotnet/tools' >> /home/participant/.bashrc",
+         "chown -R participant:participant /home/participant",
+         "echo \"Dotnet installed. Checking configuration\"",
+         "dotnet --list-sdks"
+        ]
+       }
+      },
+      {
+       "action": "aws:runShellScript",
+       "name": "InstallDockerApt",
+       "inputs": {
+        "runCommand": [
+         "#!/bin/bash",
+         "curl -fsSL https://download.docker.com/linux/ubuntu/gpg | gpg --dearmor -o /usr/share/keyrings/docker-archive-keyring.gpg",
+         "echo \"deb [signed-by=/usr/share/keyrings/docker-archive-keyring.gpg] https://download.docker.com/linux/ubuntu $(lsb_release --codename --short) stable\" > /etc/apt/sources.list.d/docker.list",
+         "apt-get -q update && DEBIAN_FRONTEND=noninteractive apt-get install -y -q docker-ce docker-ce-cli containerd.io",
+         "usermod -aG docker participant",
+         "systemctl restart code-server@participant.service",
+         "systemctl start docker.service",
+         "echo \"Docker installed. Checking configuration\"",
+         "docker --version",
+         "systemctl status docker.service"
+        ]
+       }
+      },
+      {
+       "action": "aws:runShellScript",
+       "name": "InstallGolangApt",
+       "inputs": {
+        "runCommand": [
+         "#!/bin/bash",
+         "apt-get -q update && DEBIAN_FRONTEND=noninteractive apt-get install -y -q golang",
+         "echo 'PATH=$PATH:/home/participant/go/bin' >> /home/participant/.bashrc",
+         "echo \"Golang installed. Checking configuration\"",
+         "go version"
+        ]
+       }
+      }
+     ]
+    },
+    "DocumentType": "Command",
+    "Name": "vscode-server-ubuntu-IntegTestStackUbuntu24",
+    "Tags": [
+     {
+      "Key": "app",
+      "Value": "vscode-server"
+     }
+    ]
+   }
+  },
+  "IntegVSCodeServerInstallerOnEventHandlerServiceRole59651FEF": {
+   "Type": "AWS::IAM::Role",
+   "Properties": {
+    "AssumeRolePolicyDocument": {
+     "Statement": [
+      {
+       "Action": "sts:AssumeRole",
+       "Effect": "Allow",
+       "Principal": {
+        "Service": "lambda.amazonaws.com"
+       }
+      }
+     ],
+     "Version": "2012-10-17"
+    },
+    "ManagedPolicyArns": [
+     {
+      "Fn::Join": [
+       "",
+       [
+        "arn:",
+        {
+         "Ref": "AWS::Partition"
+        },
+        ":iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"
+       ]
+      ]
+     }
+    ]
+   },
+   "Metadata": {
+    "cdk_nag": {
+     "rules_to_suppress": [
+      {
+       "reason": "For this event handler we do not need to restrict managed policies",
+       "id": "AwsSolutions-IAM4"
+      },
+      {
+       "reason": "For this lambda the latest runtime is not needed",
+       "id": "AwsSolutions-L1"
+      },
+      {
+       "reason": "ssm:GetCommandInvocation and ssm:ListCommandInvocations do not support resource-level permissions and require wildcard resources",
+       "id": "AwsSolutions-IAM5",
+       "applies_to": [
+        "Resource::*"
+       ]
+      }
+     ]
+    }
+   }
+  },
+  "IntegVSCodeServerInstallerOnEventHandlerServiceRoleDefaultPolicy1CAD86C2": {
+   "Type": "AWS::IAM::Policy",
+   "Properties": {
+    "PolicyDocument": {
+     "Statement": [
+      {
+       "Action": "ssm:SendCommand",
+       "Effect": "Allow",
+       "Resource": [
+        {
+         "Fn::Join": [
+          "",
+          [
+           "arn:",
+           {
+            "Ref": "AWS::Partition"
+           },
+           ":ec2:",
+           {
+            "Ref": "AWS::Region"
+           },
+           ":",
+           {
+            "Ref": "AWS::AccountId"
+           },
+           ":instance/",
+           {
+            "Ref": "IntegVSCodeServerserverinstance0A3D62D7"
+           }
+          ]
+         ]
+        },
+        {
+         "Fn::Join": [
+          "",
+          [
+           "arn:",
+           {
+            "Ref": "AWS::Partition"
+           },
+           ":ssm:",
+           {
+            "Ref": "AWS::Region"
+           },
+           ":",
+           {
+            "Ref": "AWS::AccountId"
+           },
+           ":document/AmazonCloudWatch-ManageAgent"
+          ]
+         ]
+        },
+        {
+         "Fn::Join": [
+          "",
+          [
+           "arn:",
+           {
+            "Ref": "AWS::Partition"
+           },
+           ":ssm:",
+           {
+            "Ref": "AWS::Region"
+           },
+           ":",
+           {
+            "Ref": "AWS::AccountId"
+           },
+           ":document/vscode-server-ubuntu-IntegTestStackUbuntu24"
+          ]
+         ]
+        }
+       ]
+      },
+      {
+       "Action": [
+        "ssm:GetCommandInvocation",
+        "ssm:ListCommandInvocations"
+       ],
+       "Effect": "Allow",
+       "Resource": "*"
+      }
+     ],
+     "Version": "2012-10-17"
+    },
+    "PolicyName": "IntegVSCodeServerInstallerOnEventHandlerServiceRoleDefaultPolicy1CAD86C2",
+    "Roles": [
+     {
+      "Ref": "IntegVSCodeServerInstallerOnEventHandlerServiceRole59651FEF"
+     }
+    ]
+   },
+   "Metadata": {
+    "cdk_nag": {
+     "rules_to_suppress": [
+      {
+       "reason": "ssm:GetCommandInvocation and ssm:ListCommandInvocations do not support resource-level permissions and require wildcard resources",
+       "id": "AwsSolutions-IAM5",
+       "applies_to": [
+        "Resource::*"
+       ]
+      }
+     ]
+    }
+   }
+  },
+  "IntegVSCodeServerInstallerOnEventHandler6FF91542": {
+   "Type": "AWS::Lambda::Function",
+   "Properties": {
+    "Code": {
+     "S3Bucket": {
+      "Fn::Sub": "cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}"
+     },
+     "S3Key": "2f99f38311da357eaaea1284d67c759759324dec4a1cd11621d9c59eea9e81df.zip"
+    },
+    "Description": "src/installer/installer.lambda.ts",
+    "Handler": "index.handler",
+    "MemorySize": 512,
+    "Role": {
+     "Fn::GetAtt": [
+      "IntegVSCodeServerInstallerOnEventHandlerServiceRole59651FEF",
+      "Arn"
+     ]
+    },
+    "Runtime": "nodejs22.x",
+    "Timeout": 900
+   },
+   "DependsOn": [
+    "IntegVSCodeServerInstallerOnEventHandlerServiceRoleDefaultPolicy1CAD86C2",
+    "IntegVSCodeServerInstallerOnEventHandlerServiceRole59651FEF"
+   ],
+   "Metadata": {
+    "cdk_nag": {
+     "rules_to_suppress": [
+      {
+       "reason": "For this event handler we do not need to restrict managed policies",
+       "id": "AwsSolutions-IAM4"
+      },
+      {
+       "reason": "For this lambda the latest runtime is not needed",
+       "id": "AwsSolutions-L1"
+      },
+      {
+       "reason": "ssm:GetCommandInvocation and ssm:ListCommandInvocations do not support resource-level permissions and require wildcard resources",
+       "id": "AwsSolutions-IAM5",
+       "applies_to": [
+        "Resource::*"
+       ]
+      }
+     ]
+    }
+   }
+  },
+  "IntegVSCodeServerInstallerProviderframeworkonEventServiceRoleA509851F": {
+   "Type": "AWS::IAM::Role",
+   "Properties": {
+    "AssumeRolePolicyDocument": {
+     "Statement": [
+      {
+       "Action": "sts:AssumeRole",
+       "Effect": "Allow",
+       "Principal": {
+        "Service": "lambda.amazonaws.com"
+       }
+      }
+     ],
+     "Version": "2012-10-17"
+    },
+    "ManagedPolicyArns": [
+     {
+      "Fn::Join": [
+       "",
+       [
+        "arn:",
+        {
+         "Ref": "AWS::Partition"
+        },
+        ":iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"
+       ]
+      ]
+     }
+    ]
+   },
+   "Metadata": {
+    "cdk_nag": {
+     "rules_to_suppress": [
+      {
+       "reason": "For this provider we do not need to restrict managed policies",
+       "id": "AwsSolutions-IAM4"
+      },
+      {
+       "reason": "For this provider wildcards are fine",
+       "id": "AwsSolutions-IAM5"
+      },
+      {
+       "reason": "For this provider the latest runtime is not needed",
+       "id": "AwsSolutions-L1"
+      }
+     ]
+    }
+   }
+  },
+  "IntegVSCodeServerInstallerProviderframeworkonEventServiceRoleDefaultPolicy3E54FC3A": {
+   "Type": "AWS::IAM::Policy",
+   "Properties": {
+    "PolicyDocument": {
+     "Statement": [
+      {
+       "Action": "lambda:InvokeFunction",
+       "Effect": "Allow",
+       "Resource": [
+        {
+         "Fn::GetAtt": [
+          "IntegVSCodeServerInstallerOnEventHandler6FF91542",
+          "Arn"
+         ]
+        },
+        {
+         "Fn::Join": [
+          "",
+          [
+           {
+            "Fn::GetAtt": [
+             "IntegVSCodeServerInstallerOnEventHandler6FF91542",
+             "Arn"
+            ]
+           },
+           ":*"
+          ]
+         ]
+        }
+       ]
+      },
+      {
+       "Action": "lambda:GetFunction",
+       "Effect": "Allow",
+       "Resource": {
+        "Fn::GetAtt": [
+         "IntegVSCodeServerInstallerOnEventHandler6FF91542",
+         "Arn"
+        ]
+       }
+      }
+     ],
+     "Version": "2012-10-17"
+    },
+    "PolicyName": "IntegVSCodeServerInstallerProviderframeworkonEventServiceRoleDefaultPolicy3E54FC3A",
+    "Roles": [
+     {
+      "Ref": "IntegVSCodeServerInstallerProviderframeworkonEventServiceRoleA509851F"
+     }
+    ]
+   },
+   "Metadata": {
+    "cdk_nag": {
+     "rules_to_suppress": [
+      {
+       "reason": "For this provider we do not need to restrict managed policies",
+       "id": "AwsSolutions-IAM4"
+      },
+      {
+       "reason": "For this provider wildcards are fine",
+       "id": "AwsSolutions-IAM5"
+      },
+      {
+       "reason": "For this provider the latest runtime is not needed",
+       "id": "AwsSolutions-L1"
+      }
+     ]
+    }
+   }
+  },
+  "IntegVSCodeServerInstallerProviderframeworkonEvent7B6C1190": {
+   "Type": "AWS::Lambda::Function",
+   "Properties": {
+    "Code": {
+     "S3Bucket": {
+      "Fn::Sub": "cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}"
+     },
+     "S3Key": "bdc104ed9cab1b5b6421713c8155f0b753380595356f710400609664d3635eca.zip"
+    },
+    "Description": "AWS CDK resource provider framework - onEvent (IntegTestStackUbuntu24/IntegVSCodeServer/InstallerProvider)",
+    "Environment": {
+     "Variables": {
+      "USER_ON_EVENT_FUNCTION_ARN": {
+       "Fn::GetAtt": [
+        "IntegVSCodeServerInstallerOnEventHandler6FF91542",
+        "Arn"
+       ]
+      }
+     }
+    },
+    "Handler": "framework.onEvent",
+    "Role": {
+     "Fn::GetAtt": [
+      "IntegVSCodeServerInstallerProviderframeworkonEventServiceRoleA509851F",
+      "Arn"
+     ]
+    },
+    "Runtime": {
+     "Fn::FindInMap": [
+      "LatestNodeRuntimeMap",
+      {
+       "Ref": "AWS::Region"
+      },
+      "value"
+     ]
+    },
+    "Timeout": 900
+   },
+   "DependsOn": [
+    "IntegVSCodeServerInstallerProviderframeworkonEventServiceRoleDefaultPolicy3E54FC3A",
+    "IntegVSCodeServerInstallerProviderframeworkonEventServiceRoleA509851F"
+   ],
+   "Metadata": {
+    "cdk_nag": {
+     "rules_to_suppress": [
+      {
+       "reason": "For this provider we do not need to restrict managed policies",
+       "id": "AwsSolutions-IAM4"
+      },
+      {
+       "reason": "For this provider wildcards are fine",
+       "id": "AwsSolutions-IAM5"
+      },
+      {
+       "reason": "For this provider the latest runtime is not needed",
+       "id": "AwsSolutions-L1"
+      }
+     ]
+    }
+   }
+  },
+  "IntegVSCodeServerSSMInstallerCustomResource9F9AFE68": {
+   "Type": "AWS::CloudFormation::CustomResource",
+   "Properties": {
+    "ServiceToken": {
+     "Fn::GetAtt": [
+      "IntegVSCodeServerInstallerProviderframeworkonEvent7B6C1190",
+      "Arn"
+     ]
+    },
+    "ServiceTimeout": 905,
+    "InstanceId": {
+     "Ref": "IntegVSCodeServerserverinstance0A3D62D7"
+    },
+    "DocumentName": "vscode-server-ubuntu-IntegTestStackUbuntu24",
+    "CloudWatchLogGroupName": "/aws/ssm/vscode-server-ubuntu-IntegTestStackUbuntu24",
+    "VSCodePassword": {
+     "Fn::GetAtt": [
+      "IntegVSCodeServerSecretRetrieverCustomResource2F3DB8BD",
+      "secretPasswordValue"
+     ]
+    }
+   },
+   "UpdateReplacePolicy": "Delete",
+   "DeletionPolicy": "Delete"
+  },
+  "CustomVpcRestrictDefaultSGCustomResourceProviderRole26592FE0": {
+   "Type": "AWS::IAM::Role",
+   "Properties": {
+    "AssumeRolePolicyDocument": {
+     "Version": "2012-10-17",
+     "Statement": [
+      {
+       "Action": "sts:AssumeRole",
+       "Effect": "Allow",
+       "Principal": {
+        "Service": "lambda.amazonaws.com"
+       }
+      }
+     ]
+    },
+    "ManagedPolicyArns": [
+     {
+      "Fn::Sub": "arn:${AWS::Partition}:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"
+     }
+    ],
+    "Policies": [
+     {
+      "PolicyName": "Inline",
+      "PolicyDocument": {
+       "Version": "2012-10-17",
+       "Statement": [
+        {
+         "Effect": "Allow",
+         "Action": [
+          "ec2:AuthorizeSecurityGroupIngress",
+          "ec2:AuthorizeSecurityGroupEgress",
+          "ec2:RevokeSecurityGroupIngress",
+          "ec2:RevokeSecurityGroupEgress"
+         ],
+         "Resource": [
+          {
+           "Fn::Join": [
+            "",
+            [
+             "arn:",
+             {
+              "Ref": "AWS::Partition"
+             },
+             ":ec2:",
+             {
+              "Ref": "AWS::Region"
+             },
+             ":",
+             {
+              "Ref": "AWS::AccountId"
+             },
+             ":security-group/",
+             {
+              "Fn::GetAtt": [
+               "IntegVSCodeServervpc93DDE887",
+               "DefaultSecurityGroup"
+              ]
+             }
+            ]
+           ]
+          }
+         ]
+        }
+       ]
+      }
+     }
+    ]
+   }
+  },
+  "CustomVpcRestrictDefaultSGCustomResourceProviderHandlerDC833E5E": {
+   "Type": "AWS::Lambda::Function",
+   "Properties": {
+    "Code": {
+     "S3Bucket": {
+      "Fn::Sub": "cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}"
+     },
+     "S3Key": "7fa1e366ee8a9ded01fc355f704cff92bfd179574e6f9cfee800a3541df1b200.zip"
+    },
+    "Timeout": 900,
+    "MemorySize": 128,
+    "Handler": "__entrypoint__.handler",
+    "Role": {
+     "Fn::GetAtt": [
+      "CustomVpcRestrictDefaultSGCustomResourceProviderRole26592FE0",
+      "Arn"
+     ]
+    },
+    "Runtime": {
+     "Fn::FindInMap": [
+      "LatestNodeRuntimeMap",
+      {
+       "Ref": "AWS::Region"
+      },
+      "value"
+     ]
+    },
+    "Description": "Lambda function for removing all inbound/outbound rules from the VPC default security group"
+   },
+   "DependsOn": [
+    "CustomVpcRestrictDefaultSGCustomResourceProviderRole26592FE0"
+   ]
+  },
+  "AWS679f53fac002430cb0da5b7982bd22872D164C4C": {
+   "Type": "AWS::Lambda::Function",
+   "Properties": {
+    "Code": {
+     "S3Bucket": {
+      "Fn::Sub": "cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}"
+     },
+     "S3Key": "9d043014be736e8162bcc7ec5590cc6d2ff24fd0d9c73a5c5d595151c5fdad00.zip"
+    },
+    "Handler": "index.handler",
+    "LoggingConfig": {
+     "LogGroup": {
+      "Ref": "IntegVSCodeServercfprefixlistIdGetPrefixListIdLogGroup171C2803"
+     }
+    },
+    "Role": {
+     "Fn::GetAtt": [
+      "IntegVSCodeServercfprefixlistIdGetPrefixListIdRole1302B3E1",
+      "Arn"
+     ]
+    },
+    "Runtime": {
+     "Fn::FindInMap": [
+      "LatestNodeRuntimeMap",
+      {
+       "Ref": "AWS::Region"
+      },
+      "value"
+     ]
+    },
+    "Timeout": 120
+   },
+   "DependsOn": [
+    "IntegVSCodeServercfprefixlistIdGetPrefixListIdRole1302B3E1"
+   ]
+  },
+  "loginhandlerServiceRole330B0B32": {
+   "Type": "AWS::IAM::Role",
+   "Properties": {
+    "AssumeRolePolicyDocument": {
+     "Statement": [
+      {
+       "Action": "sts:AssumeRole",
+       "Effect": "Allow",
+       "Principal": {
+        "Service": "lambda.amazonaws.com"
+       }
+      }
+     ],
+     "Version": "2012-10-17"
+    },
+    "ManagedPolicyArns": [
+     {
+      "Fn::Join": [
+       "",
+       [
+        "arn:",
+        {
+         "Ref": "AWS::Partition"
+        },
+        ":iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"
+       ]
+      ]
+     }
+    ]
+   }
+  },
+  "loginhandler99CCCCFD": {
+   "Type": "AWS::Lambda::Function",
+   "Properties": {
+    "Code": {
+     "S3Bucket": {
+      "Fn::Sub": "cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}"
+     },
+     "S3Key": "efac30c7091c58fed492058fa6403c14f7e58aab8cf4fd595d838b8d5eeec2b9.zip"
+    },
+    "Handler": "index.handler",
+    "Role": {
+     "Fn::GetAtt": [
+      "loginhandlerServiceRole330B0B32",
+      "Arn"
+     ]
+    },
+    "Runtime": "nodejs20.x",
+    "Timeout": 30
+   },
+   "DependsOn": [
+    "loginhandlerServiceRole330B0B32"
+   ]
+  },
+  "loginhandlerLogRetentionFD323A9B": {
+   "Type": "Custom::LogRetention",
+   "Properties": {
+    "ServiceToken": {
+     "Fn::GetAtt": [
+      "LogRetentionaae0aa3c5b4d4f87b02d85b201efdd8aFD4BFC8A",
+      "Arn"
+     ]
+    },
+    "LogGroupName": {
+     "Fn::Join": [
+      "",
+      [
+       "/aws/lambda/",
+       {
+        "Ref": "loginhandler99CCCCFD"
+       }
+      ]
+     ]
+    },
+    "RetentionInDays": 1
+   }
+  },
+  "LogRetentionaae0aa3c5b4d4f87b02d85b201efdd8aServiceRole9741ECFB": {
+   "Type": "AWS::IAM::Role",
+   "Properties": {
+    "AssumeRolePolicyDocument": {
+     "Statement": [
+      {
+       "Action": "sts:AssumeRole",
+       "Effect": "Allow",
+       "Principal": {
+        "Service": "lambda.amazonaws.com"
+       }
+      }
+     ],
+     "Version": "2012-10-17"
+    },
+    "ManagedPolicyArns": [
+     {
+      "Fn::Join": [
+       "",
+       [
+        "arn:",
+        {
+         "Ref": "AWS::Partition"
+        },
+        ":iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"
+       ]
+      ]
+     }
+    ]
+   }
+  },
+  "LogRetentionaae0aa3c5b4d4f87b02d85b201efdd8aServiceRoleDefaultPolicyADDA7DEB": {
+   "Type": "AWS::IAM::Policy",
+   "Properties": {
+    "PolicyDocument": {
+     "Statement": [
+      {
+       "Action": [
+        "logs:DeleteRetentionPolicy",
+        "logs:PutRetentionPolicy"
+       ],
+       "Effect": "Allow",
+       "Resource": "*"
+      }
+     ],
+     "Version": "2012-10-17"
+    },
+    "PolicyName": "LogRetentionaae0aa3c5b4d4f87b02d85b201efdd8aServiceRoleDefaultPolicyADDA7DEB",
+    "Roles": [
+     {
+      "Ref": "LogRetentionaae0aa3c5b4d4f87b02d85b201efdd8aServiceRole9741ECFB"
+     }
+    ]
+   }
+  },
+  "LogRetentionaae0aa3c5b4d4f87b02d85b201efdd8aFD4BFC8A": {
+   "Type": "AWS::Lambda::Function",
+   "Properties": {
+    "Handler": "index.handler",
+    "Runtime": {
+     "Fn::FindInMap": [
+      "LatestNodeRuntimeMap",
+      {
+       "Ref": "AWS::Region"
+      },
+      "value"
+     ]
+    },
+    "Timeout": 900,
+    "Code": {
+     "S3Bucket": {
+      "Fn::Sub": "cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}"
+     },
+     "S3Key": "2819175352ad1ce0dae768e83fc328fb70fb5f10b4a8ff0ccbcb791f02b0716d.zip"
+    },
+    "Role": {
+     "Fn::GetAtt": [
+      "LogRetentionaae0aa3c5b4d4f87b02d85b201efdd8aServiceRole9741ECFB",
+      "Arn"
+     ]
+    }
+   },
+   "DependsOn": [
+    "LogRetentionaae0aa3c5b4d4f87b02d85b201efdd8aServiceRoleDefaultPolicyADDA7DEB",
+    "LogRetentionaae0aa3c5b4d4f87b02d85b201efdd8aServiceRole9741ECFB"
+   ]
+  }
+ },
+ "Outputs": {
+  "IntegVSCodeServerdomainName6B9F2604": {
+   "Description": "The domain name of the distribution",
+   "Value": {
+    "Fn::Join": [
+     "",
+     [
+      "https://",
+      {
+       "Fn::GetAtt": [
+        "IntegVSCodeServercfdistributionFDBE873F",
+        "DomainName"
+       ]
+      },
+      "/?folder=/Workshop"
+     ]
+    ]
+   }
+  },
+  "IntegVSCodeServerpasswordE38D3B2C": {
+   "Description": "The password for the VSCode server",
+   "Value": {
+    "Fn::GetAtt": [
+     "IntegVSCodeServerSecretRetrieverCustomResource2F3DB8BD",
+     "secretPasswordValue"
+    ]
+   }
+  },
+  "ExportsOutputRefloginhandler99CCCCFD29CE21C0": {
+   "Value": {
+    "Ref": "loginhandler99CCCCFD"
+   },
+   "Export": {
+    "Name": "IntegTestStackUbuntu24:ExportsOutputRefloginhandler99CCCCFD29CE21C0"
+   }
+  },
+  "ExportsOutputFnGetAttIntegVSCodeServercfdistributionFDBE873FDomainName3CB40F9D": {
+   "Value": {
+    "Fn::GetAtt": [
+     "IntegVSCodeServercfdistributionFDBE873F",
+     "DomainName"
+    ]
+   },
+   "Export": {
+    "Name": "IntegTestStackUbuntu24:ExportsOutputFnGetAttIntegVSCodeServercfdistributionFDBE873FDomainName3CB40F9D"
+   }
+  },
+  "ExportsOutputFnGetAttIntegVSCodeServerSecretRetrieverCustomResource2F3DB8BDsecretPasswordValue1223507B": {
+   "Value": {
+    "Fn::GetAtt": [
+     "IntegVSCodeServerSecretRetrieverCustomResource2F3DB8BD",
+     "secretPasswordValue"
+    ]
+   },
+   "Export": {
+    "Name": "IntegTestStackUbuntu24:ExportsOutputFnGetAttIntegVSCodeServerSecretRetrieverCustomResource2F3DB8BDsecretPasswordValue1223507B"
+   }
+  }
+ },
+ "Mappings": {
+  "LatestNodeRuntimeMap": {
+   "af-south-1": {
+    "value": "nodejs20.x"
+   },
+   "ap-east-1": {
+    "value": "nodejs20.x"
+   },
+   "ap-northeast-1": {
+    "value": "nodejs20.x"
+   },
+   "ap-northeast-2": {
+    "value": "nodejs20.x"
+   },
+   "ap-northeast-3": {
+    "value": "nodejs20.x"
+   },
+   "ap-south-1": {
+    "value": "nodejs20.x"
+   },
+   "ap-south-2": {
+    "value": "nodejs20.x"
+   },
+   "ap-southeast-1": {
+    "value": "nodejs20.x"
+   },
+   "ap-southeast-2": {
+    "value": "nodejs20.x"
+   },
+   "ap-southeast-3": {
+    "value": "nodejs20.x"
+   },
+   "ap-southeast-4": {
+    "value": "nodejs20.x"
+   },
+   "ap-southeast-5": {
+    "value": "nodejs20.x"
+   },
+   "ap-southeast-7": {
+    "value": "nodejs20.x"
+   },
+   "ca-central-1": {
+    "value": "nodejs20.x"
+   },
+   "ca-west-1": {
+    "value": "nodejs20.x"
+   },
+   "cn-north-1": {
+    "value": "nodejs20.x"
+   },
+   "cn-northwest-1": {
+    "value": "nodejs20.x"
+   },
+   "eu-central-1": {
+    "value": "nodejs20.x"
+   },
+   "eu-central-2": {
+    "value": "nodejs20.x"
+   },
+   "eu-isoe-west-1": {
+    "value": "nodejs18.x"
+   },
+   "eu-north-1": {
+    "value": "nodejs20.x"
+   },
+   "eu-south-1": {
+    "value": "nodejs20.x"
+   },
+   "eu-south-2": {
+    "value": "nodejs20.x"
+   },
+   "eu-west-1": {
+    "value": "nodejs20.x"
+   },
+   "eu-west-2": {
+    "value": "nodejs20.x"
+   },
+   "eu-west-3": {
+    "value": "nodejs20.x"
+   },
+   "il-central-1": {
+    "value": "nodejs20.x"
+   },
+   "me-central-1": {
+    "value": "nodejs20.x"
+   },
+   "me-south-1": {
+    "value": "nodejs20.x"
+   },
+   "mx-central-1": {
+    "value": "nodejs20.x"
+   },
+   "sa-east-1": {
+    "value": "nodejs20.x"
+   },
+   "us-east-1": {
+    "value": "nodejs20.x"
+   },
+   "us-east-2": {
+    "value": "nodejs20.x"
+   },
+   "us-gov-east-1": {
+    "value": "nodejs20.x"
+   },
+   "us-gov-west-1": {
+    "value": "nodejs20.x"
+   },
+   "us-iso-east-1": {
+    "value": "nodejs18.x"
+   },
+   "us-iso-west-1": {
+    "value": "nodejs18.x"
+   },
+   "us-isob-east-1": {
+    "value": "nodejs18.x"
+   },
+   "us-west-1": {
+    "value": "nodejs20.x"
+   },
+   "us-west-2": {
+    "value": "nodejs20.x"
+   }
+  }
+ },
+ "Parameters": {
+  "SsmParameterValueawsservicecanonicalubuntuservernoblestablecurrentarm64hvmebsgp3amiidC96584B6F00A464EAD1953AFF4B05118Parameter": {
+   "Type": "AWS::SSM::Parameter::Value<AWS::EC2::Image::Id>",
+   "Default": "/aws/service/canonical/ubuntu/server/noble/stable/current/arm64/hvm/ebs-gp3/ami-id"
+  },
+  "BootstrapVersion": {
+   "Type": "AWS::SSM::Parameter::Value<String>",
+   "Default": "/cdk-bootstrap/hnb659fds/version",
+   "Description": "Version of the CDK Bootstrap resources in this environment, automatically retrieved from SSM Parameter Store. [cdk:skip]"
+  }
+ },
+ "Rules": {
+  "CheckBootstrapVersion": {
+   "Assertions": [
+    {
+     "Assert": {
+      "Fn::Not": [
+       {
+        "Fn::Contains": [
+         [
+          "1",
+          "2",
+          "3",
+          "4",
+          "5"
+         ],
+         {
+          "Ref": "BootstrapVersion"
+         }
+        ]
+       }
+      ]
+     },
+     "AssertDescription": "CDK bootstrap stack version 6 required. Please run 'cdk bootstrap' with a recent version of the CDK CLI."
+    }
+   ]
+  }
+ }
+}