@propulsionworks/cloudformation 0.0.2 → 0.1.0

package/out/exports/resources.generated/aws-ses-receiptrule.d.ts

@@ -0,0 +1,285 @@
+import type { ResourceDefinitionWithAttributes } from "../main.ts";
+export type SESReceiptRule = ResourceDefinitionWithAttributes<"AWS::SES::ReceiptRule", SESReceiptRuleProps, SESReceiptRuleAttribs>;
+/**
+ * Specifies a receipt rule.
+ */
+export type SESReceiptRuleProps = {
+    /**
+     * The name of an existing rule after which the new rule is placed. If this parameter is null, the new rule is inserted at the beginning of the rule list.
+     */
+    After?: string | undefined;
+    /**
+     * A data structure that contains the specified rule's name, actions, recipients, domains, enabled status, scan status, and TLS policy.
+     */
+    Rule: Rule;
+    /**
+     * The name of the rule set where the receipt rule is added.
+     */
+    RuleSetName: string;
+};
+export type SESReceiptRuleAttribs = {
+    Id: string;
+};
+/**
+ * An action that Amazon SES can take when it receives an email on behalf of one or more email addresses or domains that you own. An instance of this data type can represent only one action.
+ *
+ * For information about setting up receipt rules, see the [Amazon SES Developer Guide](https://docs.aws.amazon.com/ses/latest/dg/receiving-email-receipt-rules-console-walkthrough.html) .
+ */
+export type Action = {
+    /**
+     * Adds a header to the received email.
+     */
+    AddHeaderAction?: AddHeaderAction | undefined;
+    /**
+     * Rejects the received email by returning a bounce response to the sender and, optionally, publishes a notification to Amazon Simple Notification Service (Amazon SNS).
+     */
+    BounceAction?: BounceAction | undefined;
+    ConnectAction?: ConnectAction | undefined;
+    /**
+     * Calls an AWS Lambda function, and optionally, publishes a notification to Amazon SNS.
+     */
+    LambdaAction?: LambdaAction | undefined;
+    /**
+     * Saves the received message to an Amazon Simple Storage Service (Amazon S3) bucket and, optionally, publishes a notification to Amazon SNS.
+     */
+    S3Action?: S3Action | undefined;
+    /**
+     * Publishes the email content within a notification to Amazon SNS.
+     */
+    SNSAction?: SNSAction | undefined;
+    /**
+     * Terminates the evaluation of the receipt rule set and optionally publishes a notification to Amazon SNS.
+     */
+    StopAction?: StopAction | undefined;
+    /**
+     * Calls Amazon WorkMail and, optionally, publishes a notification to Amazon SNS.
+     */
+    WorkmailAction?: WorkmailAction | undefined;
+};
+/**
+ * When included in a receipt rule, this action adds a header to the received email.
+ *
+ * For information about adding a header using a receipt rule, see the [Amazon SES Developer Guide](https://docs.aws.amazon.com/ses/latest/dg/receiving-email-receipt-rules-console-walkthrough.html) .
+ */
+export type AddHeaderAction = {
+    /**
+     * The name of the header to add to the incoming message. The name must contain at least one character, and can contain up to 50 characters. It consists of alphanumeric ( `a–z, A–Z, 0–9` ) characters and dashes.
+     */
+    HeaderName: string;
+    /**
+     * The content to include in the header. This value can contain up to 2048 characters. It can't contain newline ( `\n` ) or carriage return ( `\r` ) characters.
+     */
+    HeaderValue: string;
+};
+/**
+ * When included in a receipt rule, this action rejects the received email by returning a bounce response to the sender and, optionally, publishes a notification to Amazon Simple Notification Service (Amazon SNS).
+ *
+ * For information about sending a bounce message in response to a received email, see the [Amazon SES Developer Guide](https://docs.aws.amazon.com/ses/latest/dg/receiving-email-action-bounce.html) .
+ */
+export type BounceAction = {
+    /**
+     * Human-readable text to include in the bounce message.
+     */
+    Message: string;
+    /**
+     * The email address of the sender of the bounced email. This is the address from which the bounce message is sent.
+     */
+    Sender: string;
+    /**
+     * The SMTP reply code, as defined by [RFC 5321](https://docs.aws.amazon.com/https://tools.ietf.org/html/rfc5321) .
+     */
+    SmtpReplyCode: string;
+    /**
+     * The SMTP enhanced status code, as defined by [RFC 3463](https://docs.aws.amazon.com/https://tools.ietf.org/html/rfc3463) .
+     */
+    StatusCode?: string | undefined;
+    /**
+     * The Amazon Resource Name (ARN) of the Amazon SNS topic to notify when the bounce action is taken. You can find the ARN of a topic by using the [ListTopics](https://docs.aws.amazon.com/sns/latest/api/API_ListTopics.html) operation in Amazon SNS.
+     *
+     * For more information about Amazon SNS topics, see the [Amazon SNS Developer Guide](https://docs.aws.amazon.com/sns/latest/dg/CreateTopic.html) .
+     */
+    TopicArn?: string | undefined;
+};
+/**
+ * When included in a receipt rule, this action parses the received message and starts an email contact in Amazon Connect on your behalf.
+ *
+ * > When you receive emails, the maximum email size (including headers) is 40 MB. Additionally, emails may only have up to 10 attachments. Emails larger than 40 MB or with more than 10 attachments will be bounced.
+ *
+ * We recommend that you configure this action via Amazon Connect.
+ */
+export type ConnectAction = {
+    /**
+     * The Amazon Resource Name (ARN) of the IAM role to be used by Amazon Simple Email Service while starting email contacts to the Amazon Connect instance. This role should have permission to invoke `connect:StartEmailContact` for the given Amazon Connect instance.
+     */
+    IAMRoleARN: string;
+    /**
+     * The Amazon Resource Name (ARN) for the Amazon Connect instance that Amazon SES integrates with for starting email contacts.
+     *
+     * For more information about Amazon Connect instances, see the [Amazon Connect Administrator Guide](https://docs.aws.amazon.com/connect/latest/adminguide/amazon-connect-instances.html)
+     */
+    InstanceARN: string;
+};
+/**
+ * When included in a receipt rule, this action calls an AWS Lambda function and, optionally, publishes a notification to Amazon Simple Notification Service (Amazon SNS).
+ *
+ * To enable Amazon SES to call your AWS Lambda function or to publish to an Amazon SNS topic of another account, Amazon SES must have permission to access those resources. For information about giving permissions, see the [Amazon SES Developer Guide](https://docs.aws.amazon.com/ses/latest/dg/receiving-email-permissions.html) .
+ *
+ * For information about using AWS Lambda actions in receipt rules, see the [Amazon SES Developer Guide](https://docs.aws.amazon.com/ses/latest/dg/receiving-email-action-lambda.html) .
+ */
+export type LambdaAction = {
+    /**
+     * The Amazon Resource Name (ARN) of the AWS Lambda function. An example of an AWS Lambda function ARN is `arn:aws:lambda:us-west-2:account-id:function:MyFunction` . For more information about AWS Lambda, see the [AWS Lambda Developer Guide](https://docs.aws.amazon.com/lambda/latest/dg/welcome.html) .
+     */
+    FunctionArn: string;
+    /**
+     * The invocation type of the AWS Lambda function. An invocation type of `RequestResponse` means that the execution of the function immediately results in a response, and a value of `Event` means that the function is invoked asynchronously. The default value is `Event` . For information about AWS Lambda invocation types, see the [AWS Lambda Developer Guide](https://docs.aws.amazon.com/lambda/latest/dg/API_Invoke.html) .
+     *
+     * > There is a 30-second timeout on `RequestResponse` invocations. You should use `Event` invocation in most cases. Use `RequestResponse` only to make a mail flow decision, such as whether to stop the receipt rule or the receipt rule set.
+     */
+    InvocationType?: string | undefined;
+    /**
+     * The Amazon Resource Name (ARN) of the Amazon SNS topic to notify when the Lambda action is executed. You can find the ARN of a topic by using the [ListTopics](https://docs.aws.amazon.com/sns/latest/api/API_ListTopics.html) operation in Amazon SNS.
+     *
+     * For more information about Amazon SNS topics, see the [Amazon SNS Developer Guide](https://docs.aws.amazon.com/sns/latest/dg/CreateTopic.html) .
+     */
+    TopicArn?: string | undefined;
+};
+/**
+ * Receipt rules enable you to specify which actions Amazon SES should take when it receives mail on behalf of one or more email addresses or domains that you own.
+ *
+ * Each receipt rule defines a set of email addresses or domains that it applies to. If the email addresses or domains match at least one recipient address of the message, Amazon SES executes all of the receipt rule's actions on the message.
+ *
+ * For information about setting up receipt rules, see the [Amazon SES Developer Guide](https://docs.aws.amazon.com/ses/latest/dg/receiving-email-receipt-rules-console-walkthrough.html) .
+ */
+export type Rule = {
+    /**
+     * An ordered list of actions to perform on messages that match at least one of the recipient email addresses or domains specified in the receipt rule.
+     */
+    Actions?: Action[] | undefined;
+    /**
+     * If `true` , the receipt rule is active. The default value is `false` .
+     */
+    Enabled?: boolean | undefined;
+    /**
+     * The name of the receipt rule. The name must meet the following requirements:
+     *
+     * - Contain only ASCII letters (a-z, A-Z), numbers (0-9), underscores (_), dashes (-), or periods (.).
+     * - Start and end with a letter or number.
+     * - Contain 64 characters or fewer.
+     */
+    Name?: string | undefined;
+    /**
+     * The recipient domains and email addresses that the receipt rule applies to. If this field is not specified, this rule matches all recipients on all verified domains.
+     */
+    Recipients?: string[] | undefined;
+    /**
+     * If `true` , then messages that this receipt rule applies to are scanned for spam and viruses. The default value is `false` .
+     */
+    ScanEnabled?: boolean | undefined;
+    /**
+     * Specifies whether Amazon SES should require that incoming email is delivered over a connection encrypted with Transport Layer Security (TLS). If this parameter is set to `Require` , Amazon SES bounces emails that are not received over TLS. The default is `Optional` .
+     *
+     * Valid Values: `Require | Optional`
+     */
+    TlsPolicy?: string | undefined;
+};
+/**
+ * When included in a receipt rule, this action saves the received message to an Amazon Simple Storage Service (Amazon S3) bucket and, optionally, publishes a notification to Amazon Simple Notification Service (Amazon SNS).
+ *
+ * To enable Amazon SES to write emails to your Amazon S3 bucket, use an AWS KMS key to encrypt your emails, or publish to an Amazon SNS topic of another account, Amazon SES must have permission to access those resources. For information about granting permissions, see the [Amazon SES Developer Guide](https://docs.aws.amazon.com/ses/latest/dg/receiving-email-permissions.html) .
+ *
+ * > When you save your emails to an Amazon S3 bucket, the maximum email size (including headers) is 30 MB. Emails larger than that bounces.
+ *
+ * For information about specifying Amazon S3 actions in receipt rules, see the [Amazon SES Developer Guide](https://docs.aws.amazon.com/ses/latest/dg/receiving-email-action-s3.html) .
+ */
+export type S3Action = {
+    /**
+     * The name of the Amazon S3 bucket for incoming email.
+     */
+    BucketName: string;
+    /**
+     * The ARN of the IAM role to be used by Amazon Simple Email Service while writing to the Amazon S3 bucket, optionally encrypting your mail via the provided customer managed key, and publishing to the Amazon SNS topic. This role should have access to the following APIs:
+     *
+     * - `s3:PutObject` , `kms:Encrypt` and `kms:GenerateDataKey` for the given Amazon S3 bucket.
+     * - `kms:GenerateDataKey` for the given AWS KMS customer managed key.
+     * - `sns:Publish` for the given Amazon SNS topic.
+     *
+     * > If an IAM role ARN is provided, the role (and only the role) is used to access all the given resources (Amazon S3 bucket, AWS KMS customer managed key and Amazon SNS topic). Therefore, setting up individual resource access permissions is not required.
+     */
+    IamRoleArn?: string | undefined;
+    /**
+     * The customer managed key that Amazon SES should use to encrypt your emails before saving them to the Amazon S3 bucket. You can use the AWS managed key or a customer managed key that you created in AWS KMS as follows:
+     *
+     * - To use the AWS managed key, provide an ARN in the form of `arn:aws:kms:REGION:ACCOUNT-ID-WITHOUT-HYPHENS:alias/aws/ses` . For example, if your AWS account ID is 123456789012 and you want to use the AWS managed key in the US West (Oregon) Region, the ARN of the AWS managed key would be `arn:aws:kms:us-west-2:123456789012:alias/aws/ses` . If you use the AWS managed key, you don't need to perform any extra steps to give Amazon SES permission to use the key.
+     * - To use a customer managed key that you created in AWS KMS, provide the ARN of the customer managed key and ensure that you add a statement to your key's policy to give Amazon SES permission to use it. For more information about giving permissions, see the [Amazon SES Developer Guide](https://docs.aws.amazon.com/ses/latest/dg/receiving-email-permissions.html) .
+     *
+     * For more information about key policies, see the [AWS KMS Developer Guide](https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html) . If you do not specify an AWS KMS key, Amazon SES does not encrypt your emails.
+     *
+     * > Your mail is encrypted by Amazon SES using the Amazon S3 encryption client before the mail is submitted to Amazon S3 for storage. It is not encrypted using Amazon S3 server-side encryption. This means that you must use the Amazon S3 encryption client to decrypt the email after retrieving it from Amazon S3, as the service has no access to use your AWS KMS keys for decryption. This encryption client is currently available with the [AWS SDK for Java](https://docs.aws.amazon.com/sdk-for-java/) and [AWS SDK for Ruby](https://docs.aws.amazon.com/sdk-for-ruby/) only. For more information about client-side encryption using AWS KMS managed keys, see the [Amazon S3 Developer Guide](https://docs.aws.amazon.com/AmazonS3/latest/dev/UsingClientSideEncryption.html) .
+     */
+    KmsKeyArn?: string | undefined;
+    /**
+     * The key prefix of the Amazon S3 bucket. The key prefix is similar to a directory name that enables you to store similar data under the same directory in a bucket.
+     */
+    ObjectKeyPrefix?: string | undefined;
+    /**
+     * The ARN of the Amazon SNS topic to notify when the message is saved to the Amazon S3 bucket. You can find the ARN of a topic by using the [ListTopics](https://docs.aws.amazon.com/sns/latest/api/API_ListTopics.html) operation in Amazon SNS.
+     *
+     * For more information about Amazon SNS topics, see the [Amazon SNS Developer Guide](https://docs.aws.amazon.com/sns/latest/dg/CreateTopic.html) .
+     */
+    TopicArn?: string | undefined;
+};
+/**
+ * The action to publish the email content to an Amazon SNS topic. When executed, this action will send the email as a notification to the specified SNS topic.
+ */
+export type SNSAction = {
+    /**
+     * The encoding to use for the email within the Amazon SNS notification. The default value is `UTF-8` . Use `BASE64` if you need to preserve all special characters, especially when the original message uses a different encoding format.
+     */
+    Encoding?: string | undefined;
+    /**
+     * The Amazon Resource Name (ARN) of the Amazon SNS Topic to which notification for the email received will be published.
+     */
+    TopicArn?: string | undefined;
+};
+/**
+ * When included in a receipt rule, this action terminates the evaluation of the receipt rule set and, optionally, publishes a notification to Amazon Simple Notification Service (Amazon SNS).
+ *
+ * For information about setting a stop action in a receipt rule, see the [Amazon SES Developer Guide](https://docs.aws.amazon.com/ses/latest/dg/receiving-email-action-stop.html) .
+ */
+export type StopAction = {
+    /**
+     * The scope of the StopAction. The only acceptable value is `RuleSet` .
+     */
+    Scope: string;
+    /**
+     * The Amazon Resource Name (ARN) of the Amazon SNS topic to notify when the stop action is taken. You can find the ARN of a topic by using the [ListTopics](https://docs.aws.amazon.com/sns/latest/api/API_ListTopics.html) Amazon SNS operation.
+     *
+     * For more information about Amazon SNS topics, see the [Amazon SNS Developer Guide](https://docs.aws.amazon.com/sns/latest/dg/CreateTopic.html) .
+     */
+    TopicArn?: string | undefined;
+};
+/**
+ * When included in a receipt rule, this action calls Amazon WorkMail and, optionally, publishes a notification to Amazon Simple Notification Service (Amazon SNS). It usually isn't necessary to set this up manually, because Amazon WorkMail adds the rule automatically during its setup procedure.
+ *
+ * For information using a receipt rule to call Amazon WorkMail, see the [Amazon SES Developer Guide](https://docs.aws.amazon.com/ses/latest/dg/receiving-email-action-workmail.html) .
+ */
+export type WorkmailAction = {
+    /**
+     * The Amazon Resource Name (ARN) of the Amazon WorkMail organization. Amazon WorkMail ARNs use the following format:
+     *
+     * `arn:aws:workmail:<region>:<awsAccountId>:organization/<workmailOrganizationId>`
+     *
+     * You can find the ID of your organization by using the [ListOrganizations](https://docs.aws.amazon.com/workmail/latest/APIReference/API_ListOrganizations.html) operation in Amazon WorkMail. Amazon WorkMail organization IDs begin with " `m-` ", followed by a string of alphanumeric characters.
+     *
+     * For information about Amazon WorkMail organizations, see the [Amazon WorkMail Administrator Guide](https://docs.aws.amazon.com/workmail/latest/adminguide/organizations_overview.html) .
+     */
+    OrganizationArn: string;
+    /**
+     * The Amazon Resource Name (ARN) of the Amazon SNS topic to notify when the WorkMail action is called. You can find the ARN of a topic by using the [ListTopics](https://docs.aws.amazon.com/sns/latest/api/API_ListTopics.html) operation in Amazon SNS.
+     *
+     * For more information about Amazon SNS topics, see the [Amazon SNS Developer Guide](https://docs.aws.amazon.com/sns/latest/dg/CreateTopic.html) .
+     */
+    TopicArn?: string | undefined;
+};
+//# sourceMappingURL=aws-ses-receiptrule.d.ts.map

package/out/exports/resources.generated/aws-ses-receiptruleset.d.ts

@@ -0,0 +1,19 @@
+import type { ResourceDefinitionWithAttributes } from "../main.ts";
+export type SESReceiptRuleSet = ResourceDefinitionWithAttributes<"AWS::SES::ReceiptRuleSet", SESReceiptRuleSetProps, SESReceiptRuleSetAttribs>;
+/**
+ * Creates an empty receipt rule set.
+ *
+ * For information about setting up receipt rule sets, see the [Amazon SES Developer Guide](https://docs.aws.amazon.com/ses/latest/dg/receiving-email-concepts.html#receiving-email-concepts-rules) .
+ *
+ * You can execute this operation no more than once per second.
+ */
+export type SESReceiptRuleSetProps = {
+    /**
+     * The name of the receipt rule set to make active. Setting this value to null disables all email receiving.
+     */
+    RuleSetName?: string | undefined;
+};
+export type SESReceiptRuleSetAttribs = {
+    Id: string;
+};
+//# sourceMappingURL=aws-ses-receiptruleset.d.ts.map

package/out/exports/resources.generated/aws-ses-template.d.ts

@@ -0,0 +1,39 @@
+import type { ResourceDefinitionWithAttributes } from "../main.ts";
+export type SESTemplate = ResourceDefinitionWithAttributes<"AWS::SES::Template", SESTemplateProps, SESTemplateAttribs>;
+/**
+ * Specifies an email template. Email templates enable you to send personalized email to one or more destinations in a single API operation.
+ */
+export type SESTemplateProps = {
+    /**
+     * The content of the email, composed of a subject line and either an HTML part or a text-only part.
+     */
+    Template?: Template | undefined;
+};
+export type SESTemplateAttribs = {
+    Id: string;
+};
+/**
+ * An object that defines the email template to use for an email message, and the values to use for any message variables in that template. An *email template* is a type of message template that contains content that you want to reuse in email messages that you send. You can specifiy the email template by providing the name or ARN of an *email template* previously saved in your Amazon SES account or by providing the full template content.
+ */
+export type Template = {
+    /**
+     * The HTML body of the email.
+     */
+    HtmlPart?: string | undefined;
+    /**
+     * The subject line of the email.
+     */
+    SubjectPart: string;
+    /**
+     * The name of the template. You will refer to this name when you send email using the `SendEmail` or `SendBulkEmail` operations.
+     * @minLength 1
+     * @maxLength 64
+     * @pattern ^[a-zA-Z0-9_-]{1,64}$
+     */
+    TemplateName?: string | undefined;
+    /**
+     * The email body that is visible to recipients whose email clients do not display HTML content.
+     */
+    TextPart?: string | undefined;
+};
+//# sourceMappingURL=aws-ses-template.d.ts.map

package/out/exports/resources.generated/aws-ses-vdmattributes.d.ts

@@ -0,0 +1,48 @@
+import type { ResourceDefinitionWithAttributes } from "../main.ts";
+export type SESVdmAttributes = ResourceDefinitionWithAttributes<"AWS::SES::VdmAttributes", SESVdmAttributesProps, SESVdmAttributesAttribs>;
+/**
+ * The Virtual Deliverability Manager (VDM) attributes that apply to your Amazon SES account.
+ */
+export type SESVdmAttributesProps = {
+    /**
+     * Specifies additional settings for your VDM configuration as applicable to the Dashboard.
+     */
+    DashboardAttributes?: DashboardAttributes | undefined;
+    /**
+     * Specifies additional settings for your VDM configuration as applicable to the Guardian.
+     */
+    GuardianAttributes?: GuardianAttributes | undefined;
+};
+export type SESVdmAttributesAttribs = {
+    /**
+     * Unique identifier for this resource
+     */
+    VdmAttributesResourceId: string;
+};
+/**
+ * An object containing additional settings for your VDM configuration as applicable to the Dashboard.
+ */
+export type DashboardAttributes = {
+    /**
+     * Specifies the status of your VDM engagement metrics collection. Can be one of the following:
+     *
+     * - `ENABLED` – Amazon SES enables engagement metrics for your account.
+     * - `DISABLED` – Amazon SES disables engagement metrics for your account.
+     * @pattern ENABLED|DISABLED
+     */
+    EngagementMetrics?: string | undefined;
+};
+/**
+ * An object containing additional settings for your VDM configuration as applicable to the Guardian.
+ */
+export type GuardianAttributes = {
+    /**
+     * Specifies the status of your VDM optimized shared delivery. Can be one of the following:
+     *
+     * - `ENABLED` – Amazon SES enables optimized shared delivery for your account.
+     * - `DISABLED` – Amazon SES disables optimized shared delivery for your account.
+     * @pattern ENABLED|DISABLED
+     */
+    OptimizedSharedDelivery?: string | undefined;
+};
+//# sourceMappingURL=aws-ses-vdmattributes.d.ts.map

package/out/exports/resources.generated/aws-shield-drtaccess.d.ts

@@ -0,0 +1,49 @@
+import type { ResourceDefinitionWithAttributes } from "../main.ts";
+export type ShieldDRTAccess = ResourceDefinitionWithAttributes<"AWS::Shield::DRTAccess", ShieldDRTAccessProps, ShieldDRTAccessAttribs>;
+/**
+ * Provides permissions for the AWS Shield Advanced Shield response team (SRT) to access your account and your resource protections, to help you mitigate potential distributed denial of service (DDoS) attacks.
+ *
+ * *Configure `AWS::Shield::DRTAccess` for one account*
+ *
+ * To configure this resource through AWS CloudFormation , you must be subscribed to AWS Shield Advanced . You can subscribe through the [Shield Advanced console](https://docs.aws.amazon.com/wafv2/shieldv2#/) and through the APIs. For more information, see [Subscribe to AWS Shield Advanced](https://docs.aws.amazon.com/waf/latest/developerguide/enable-ddos-prem.html) .
+ *
+ * See example templates for Shield Advanced in AWS CloudFormation at [aws-samples/aws-shield-advanced-examples](https://docs.aws.amazon.com/https://github.com/aws-samples/aws-shield-advanced-examples) .
+ *
+ * *Configure Shield Advanced using AWS CloudFormation and AWS Firewall Manager*
+ *
+ * You might be able to use Firewall Manager with AWS CloudFormation to configure Shield Advanced across multiple accounts and protected resources. To do this, your accounts must be part of an organization in AWS Organizations . You can use Firewall Manager to configure Shield Advanced protections for any resource types except for Amazon Route 53 or AWS Global Accelerator .
+ *
+ * For an example of this, see the one-click configuration guidance published by the AWS technical community at [One-click deployment of Shield Advanced](https://docs.aws.amazon.com/https://youtu.be/LCA3FwMk_QE) .
+ */
+export type ShieldDRTAccessProps = {
+    /**
+     * Authorizes the Shield Response Team (SRT) to access the specified Amazon S3 bucket containing log data such as Application Load Balancer access logs, CloudFront logs, or logs from third party sources. You can associate up to 10 Amazon S3 buckets with your subscription.
+     *
+     * Use this to share information with the SRT that's not available in AWS WAF logs.
+     *
+     * To use the services of the SRT, you must be subscribed to the [Business Support plan](https://docs.aws.amazon.com/premiumsupport/business-support/) or the [Enterprise Support plan](https://docs.aws.amazon.com/premiumsupport/enterprise-support/) .
+     */
+    LogBucketList?: string[] | undefined;
+    /**
+     * Authorizes the Shield Response Team (SRT) using the specified role, to access your AWS account to assist with DDoS attack mitigation during potential attacks. This enables the SRT to inspect your AWS WAF configuration and logs and to create or update AWS WAF rules and web ACLs.
+     *
+     * You can associate only one `RoleArn` with your subscription. If you submit this update for an account that already has an associated role, the new `RoleArn` will replace the existing `RoleArn` .
+     *
+     * This change requires the following:
+     *
+     * - You must be subscribed to the [Business Support plan](https://docs.aws.amazon.com/premiumsupport/business-support/) or the [Enterprise Support plan](https://docs.aws.amazon.com/premiumsupport/enterprise-support/) .
+     * - The `AWSShieldDRTAccessPolicy` managed policy must be attached to the role that you specify in the request. You can access this policy in the IAM console at [AWSShieldDRTAccessPolicy](https://docs.aws.amazon.com/iam/home?#/policies/arn:aws:iam::aws:policy/service-role/AWSShieldDRTAccessPolicy) . For information, see [Adding and removing IAM identity permissions](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_manage-attach-detach.html) .
+     * - The role must trust the service principal `drt.shield.amazonaws.com` . For information, see [IAM JSON policy elements: Principal](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_principal.html) .
+     *
+     * The SRT will have access only to your AWS WAF and Shield resources. By submitting this request, you provide permissions to the SRT to inspect your AWS WAF and Shield configuration and logs, and to create and update AWS WAF rules and web ACLs on your behalf. The SRT takes these actions only if explicitly authorized by you.
+     * @maxLength 2048
+     */
+    RoleArn: string;
+};
+export type ShieldDRTAccessAttribs = {
+    /**
+     * The ID of the account that submitted the template.
+     */
+    AccountId: string;
+};
+//# sourceMappingURL=aws-shield-drtaccess.d.ts.map

package/out/exports/resources.generated/aws-shield-proactiveengagement.d.ts

@@ -0,0 +1,77 @@
+import type { ResourceDefinitionWithAttributes } from "../main.ts";
+export type ShieldProactiveEngagement = ResourceDefinitionWithAttributes<"AWS::Shield::ProactiveEngagement", ShieldProactiveEngagementProps, ShieldProactiveEngagementAttribs>;
+/**
+ * Authorizes the Shield Response Team (SRT) to use email and phone to notify contacts about escalations to the SRT and to initiate proactive customer support.
+ *
+ * To enable proactive engagement, you must be subscribed to the [Business Support plan](https://docs.aws.amazon.com/premiumsupport/business-support/) or the [Enterprise Support plan](https://docs.aws.amazon.com/premiumsupport/enterprise-support/) .
+ *
+ * *Configure `AWS::Shield::ProactiveEngagement` for one account*
+ *
+ * To configure this resource through AWS CloudFormation , you must be subscribed to AWS Shield Advanced . You can subscribe through the [Shield Advanced console](https://docs.aws.amazon.com/wafv2/shieldv2#/) and through the APIs. For more information, see [Subscribe to AWS Shield Advanced](https://docs.aws.amazon.com/waf/latest/developerguide/enable-ddos-prem.html) .
+ *
+ * See example templates for Shield Advanced in AWS CloudFormation at [aws-samples/aws-shield-advanced-examples](https://docs.aws.amazon.com/https://github.com/aws-samples/aws-shield-advanced-examples) .
+ *
+ * *Configure Shield Advanced using AWS CloudFormation and AWS Firewall Manager*
+ *
+ * You might be able to use Firewall Manager with AWS CloudFormation to configure Shield Advanced across multiple accounts and protected resources. To do this, your accounts must be part of an organization in AWS Organizations . You can use Firewall Manager to configure Shield Advanced protections for any resource types except for Amazon Route 53 or AWS Global Accelerator .
+ *
+ * For an example of this, see the one-click configuration guidance published by the AWS technical community at [One-click deployment of Shield Advanced](https://docs.aws.amazon.com/https://youtu.be/LCA3FwMk_QE) .
+ */
+export type ShieldProactiveEngagementProps = {
+    /**
+     * The list of email addresses and phone numbers that the Shield Response Team (SRT) can use to contact you for escalations to the SRT and to initiate proactive customer support, plus any relevant notes.
+     *
+     * To enable proactive engagement, the contact list must include at least one phone number.
+     *
+     * If you provide more than one contact, in the notes, indicate the circumstances under which each contact should be used. Include primary and secondary contact designations, and provide the hours of availability and time zones for each contact.
+     *
+     * Example contact notes:
+     *
+     * - This is a hotline that's staffed 24x7x365. Please work with the responding analyst and they will get the appropriate person on the call.
+     * - Please contact the secondary phone number if the hotline doesn't respond within 5 minutes.
+     */
+    EmergencyContactList: EmergencyContact[];
+    /**
+     * Specifies whether proactive engagement is enabled or disabled.
+     *
+     * Valid values:
+     *
+     * `ENABLED` - The Shield Response Team (SRT) will use email and phone to notify contacts about escalations to the SRT and to initiate proactive customer support.
+     *
+     * `DISABLED` - The SRT will not proactively notify contacts about escalations or to initiate proactive customer support.
+     */
+    ProactiveEngagementStatus: "ENABLED" | "DISABLED";
+};
+export type ShieldProactiveEngagementAttribs = {
+    /**
+     * The ID of the account that submitted the template.
+     */
+    AccountId: string;
+};
+/**
+ * Contact information that the SRT can use to contact you if you have proactive engagement enabled, for escalations to the SRT and to initiate proactive customer support.
+ */
+export type EmergencyContact = {
+    /**
+     * Additional notes regarding the contact.
+     * @minLength 1
+     * @maxLength 1024
+     * @pattern ^[\w\s\.\-,:/()+@]*$
+     */
+    ContactNotes?: string | undefined;
+    /**
+     * The email address for the contact.
+     * @minLength 1
+     * @maxLength 150
+     * @pattern ^\S+@\S+\.\S+$
+     */
+    EmailAddress: string;
+    /**
+     * The phone number for the contact.
+     * @minLength 1
+     * @maxLength 16
+     * @pattern ^\+[1-9]\d{1,14}$
+     */
+    PhoneNumber?: string | undefined;
+};
+//# sourceMappingURL=aws-shield-proactiveengagement.d.ts.map

package/out/exports/resources.generated/aws-shield-protection.d.ts

@@ -0,0 +1,96 @@
+import type { ResourceDefinitionWithAttributes, Tag } from "../main.ts";
+export type ShieldProtection = ResourceDefinitionWithAttributes<"AWS::Shield::Protection", ShieldProtectionProps, ShieldProtectionAttribs>;
+/**
+ * Enables AWS Shield Advanced for a specific AWS resource. The resource can be an Amazon CloudFront distribution, Amazon Route 53 hosted zone, AWS Global Accelerator standard accelerator, Elastic IP Address, Application Load Balancer, or a Classic Load Balancer. You can protect Amazon EC2 instances and Network Load Balancers by association with protected Amazon EC2 Elastic IP addresses.
+ *
+ * *Configure a single `AWS::Shield::Protection`*
+ *
+ * Use this protection to protect a single resource at a time.
+ *
+ * To configure this Shield Advanced protection through AWS CloudFormation , you must be subscribed to Shield Advanced . You can subscribe through the [Shield Advanced console](https://docs.aws.amazon.com/wafv2/shieldv2#/) and through the APIs. For more information, see [Subscribe to AWS Shield Advanced](https://docs.aws.amazon.com/waf/latest/developerguide/enable-ddos-prem.html) .
+ *
+ * See example templates for Shield Advanced in AWS CloudFormation at [aws-samples/aws-shield-advanced-examples](https://docs.aws.amazon.com/https://github.com/aws-samples/aws-shield-advanced-examples) .
+ *
+ * *Configure Shield Advanced using AWS CloudFormation and AWS Firewall Manager*
+ *
+ * You might be able to use Firewall Manager with AWS CloudFormation to configure Shield Advanced across multiple accounts and protected resources. To do this, your accounts must be part of an organization in AWS Organizations . You can use Firewall Manager to configure Shield Advanced protections for any resource types except for Amazon Route 53 or AWS Global Accelerator .
+ *
+ * For an example of this, see the one-click configuration guidance published by the AWS technical community at [One-click deployment of Shield Advanced](https://docs.aws.amazon.com/https://youtu.be/LCA3FwMk_QE) .
+ *
+ * *Configure multiple protections through the Shield Advanced console*
+ *
+ * You can add protection to multiple resources at once through the [Shield Advanced console](https://docs.aws.amazon.com/wafv2/shieldv2#/) . For more information see [Getting Started with AWS Shield Advanced](https://docs.aws.amazon.com/waf/latest/developerguide/getting-started-ddos.html) and [Managing resource protections in AWS Shield Advanced](https://docs.aws.amazon.com/waf/latest/developerguide/ddos-manage-protected-resources.html) .
+ */
+export type ShieldProtectionProps = {
+    /**
+     * The automatic application layer DDoS mitigation settings for the protection. This configuration determines whether Shield Advanced automatically manages rules in the web ACL in order to respond to application layer events that Shield Advanced determines to be DDoS attacks.
+     *
+     * If you use AWS CloudFormation to manage the web ACLs that you use with Shield Advanced automatic mitigation, see the additional guidance about web ACL management in the `AWS::WAFv2::WebACL` resource description.
+     */
+    ApplicationLayerAutomaticResponseConfiguration?: ApplicationLayerAutomaticResponseConfiguration | undefined;
+    /**
+     * The ARN (Amazon Resource Name) of the health check to associate with the protection. Health-based detection provides improved responsiveness and accuracy in attack detection and mitigation.
+     *
+     * You can use this option with any resource type except for Route 53 hosted zones.
+     *
+     * For more information, see [Configuring health-based detection using health checks](https://docs.aws.amazon.com/waf/latest/developerguide/ddos-advanced-health-checks.html) in the *AWS Shield Advanced Developer Guide* .
+     */
+    HealthCheckArns?: string[] | undefined;
+    /**
+     * The name of the protection. For example, `My CloudFront distributions` .
+     *
+     * > If you change the name of an existing protection, Shield Advanced deletes the protection and replaces it with a new one. While this is happening, the protection isn't available on the AWS resource.
+     * @minLength 1
+     * @maxLength 128
+     * @pattern [ a-zA-Z0-9_\.\-]*
+     */
+    Name: string;
+    /**
+     * The ARN (Amazon Resource Name) of the AWS resource that is protected.
+     * @minLength 1
+     * @maxLength 2048
+     */
+    ResourceArn: string;
+    /**
+     * Key:value pairs associated with an AWS resource. The key:value pair can be anything you define. Typically, the tag key represents a category (such as "environment") and the tag value represents a specific value within that category (such as "test," "development," or "production"). You can add up to 50 tags to each AWS resource.
+     */
+    Tags?: Tag[] | undefined;
+};
+export type ShieldProtectionAttribs = {
+    /**
+     * The ARN (Amazon Resource Name) of the new protection.
+     */
+    ProtectionArn: string;
+    /**
+     * The ID of the new protection.
+     */
+    ProtectionId: string;
+};
+/**
+ * The automatic application layer DDoS mitigation settings for a `Protection` . This configuration determines whether Shield Advanced automatically manages rules in the web ACL in order to respond to application layer events that Shield Advanced determines to be DDoS attacks.
+ *
+ * If you use AWS CloudFormation to manage the web ACLs that you use with Shield Advanced automatic mitigation, see the guidance for the `AWS::WAFv2::WebACL` resource.
+ */
+export type ApplicationLayerAutomaticResponseConfiguration = {
+    /**
+     * Specifies the action setting that Shield Advanced should use in the AWS WAF rules that it creates on behalf of the protected resource in response to DDoS attacks. You specify this as part of the configuration for the automatic application layer DDoS mitigation feature, when you enable or update automatic mitigation. Shield Advanced creates the AWS WAF rules in a Shield Advanced-managed rule group, inside the web ACL that you have associated with the resource.
+     */
+    Action: {
+        /**
+         * Specifies that Shield Advanced should configure its AWS WAF rules with the AWS WAF `Count` action.
+         * You must specify exactly one action, either `Block` or `Count`.
+         */
+        Count?: Record<string, unknown> | undefined;
+    } | {
+        /**
+         * Specifies that Shield Advanced should configure its AWS WAF rules with the AWS WAF `Block` action.
+         * You must specify exactly one action, either `Block` or `Count`.
+         */
+        Block?: Record<string, unknown> | undefined;
+    };
+    /**
+     * Indicates whether automatic application layer DDoS mitigation is enabled for the protection.
+     */
+    Status: "ENABLED" | "DISABLED";
+};
+//# sourceMappingURL=aws-shield-protection.d.ts.map