dbt-platform-helper 11.4.0__py3-none-any.whl → 12.0.1__py3-none-any.whl

dbt_platform_helper/templates/addons/env/aurora-postgres.yml

@@ -1,604 +0,0 @@
-# {% extra_header %}
-# {% version_info %}
-
-Parameters:
-  # Copilot required Parameters...
-  App:
-    Type: String
-    Description: Your application's name.
-  Env:
-    Type: String
-    Description: The environment name your service, job, or workflow is being deployed to.
-
-  # Parameters from the parent stack brought in via addons.parameters.yml...
-  EnvironmentSecurityGroup:
-    Type: String
-  DefaultPublicRoute:
-    Type: String
-  InternetGateway:
-    Type: String
-  InternetGatewayAttachment:
-    Type: String
-  PrivateSubnets:
-    Type: String
-  PublicRouteTable:
-    Type: String
-  PublicSubnet1RouteTableAssociation:
-    Type: String
-  PublicSubnet2RouteTableAssociation:
-    Type: String
-  VpcId:
-    Type: String
-
-  # Other parameters...
-  # Customize your Aurora Postgres cluster by setting the default value of the following parameters.
-  {{ addon_config.prefix }}DBName:
-    Type: String
-    Description: The name of the initial database to be created in the Aurora Serverless v2 cluster.
-    Default: main
-    # Cannot have special characters
-    # Naming constraints: https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/CHAP_Limits.html#RDS_Limits.Constraints
-
-Mappings:
-  {{ addon_config.prefix }}EnvironmentConfigMap:
-{%- for environment_name, config in addon_config.environments.items() %}
-    {{ environment_name }}:
-      DBMinCapacity: {{ config.min_capacity }}
-      DBMaxCapacity: {{ config.max_capacity }}
-      DeletionPolicy: {{ config.deletion_policy }}
-      SnapshotIdentifier: {{ config.snapshot_id if config.snapshot_id else '""' }}
-      DeletionProtection: {{ config.deletion_protection if config.deletion_protection else false }}
-{%- endfor %}
-
-Conditions:
-  {{ addon_config.prefix }}CreateProdSubFilter: !Or [!Equals [!Ref Env, prod], !Equals [!Ref Env, production], !Equals [!Ref Env, PROD], !Equals [!Ref Env, PRODUCTION]]
-  {{ addon_config.prefix }}UseSnapshot: !Not [!Equals [!FindInMap [{{ addon_config.prefix }}EnvironmentConfigMap, !Ref Env, SnapshotIdentifier], ""]]
-
-Resources:
-  {{ addon_config.prefix }}DBSubnetGroup:
-    Type: 'AWS::RDS::DBSubnetGroup'
-    DeletionPolicy: !FindInMap [{{ addon_config.prefix }}EnvironmentConfigMap, !Ref Env, DeletionPolicy]
-    UpdateReplacePolicy: Retain
-    Properties:
-      DBSubnetGroupDescription: Group of Copilot private subnets for Aurora Serverless v2 cluster.
-      SubnetIds: !Split [ ",", !Ref PrivateSubnets ]
-
-  {{ addon_config.prefix }}SecurityGroup:
-    Metadata:
-      'aws:copilot:description': 'A security group for your workload to access the Aurora Serverless v2 cluster {{ addon_config.prefix }}'
-    Type: 'AWS::EC2::SecurityGroup'
-    DeletionPolicy: !FindInMap [{{ addon_config.prefix }}EnvironmentConfigMap, !Ref Env, DeletionPolicy]
-    UpdateReplacePolicy: Retain
-    Properties:
-      GroupDescription: 'The Security Group for {{ addon_config.name }} to access Aurora Serverless v2 cluster {{ addon_config.prefix }}.'
-      VpcId: !Ref VpcId
-      Tags:
-        - Key: Name
-          Value: !Sub 'copilot-${App}-${Env}-{{ addon_config.name }}-Aurora'
-
-  {{ addon_config.prefix }}DBClusterSecurityGroup:
-    Metadata:
-      'aws:copilot:description': 'A security group for your Aurora Serverless v2 cluster {{ addon_config.prefix }}'
-    Type: AWS::EC2::SecurityGroup
-    DeletionPolicy: !FindInMap [{{ addon_config.prefix }}EnvironmentConfigMap, !Ref Env, DeletionPolicy]
-    UpdateReplacePolicy: Retain
-    Properties:
-      GroupDescription: The Security Group for the Aurora Serverless v2 cluster.
-      SecurityGroupIngress:
-        - ToPort: 5432
-          FromPort: 5432
-          IpProtocol: tcp
-          Description: 'From the Aurora Security Group of the workload {{ addon_config.name }}.'
-          SourceSecurityGroupId: !Ref {{ addon_config.prefix }}SecurityGroup
-      VpcId: !Ref VpcId
-
-  {{ addon_config.prefix }}AuroraSecret:
-    Metadata:
-      'aws:copilot:description': 'A Secrets Manager secret to store your DB credentials'
-    Type: AWS::SecretsManager::Secret
-    Properties:
-      Name: !Sub '/copilot/${App}/${Env}/secrets/{{ addon_config.name|upper|replace("-", "_") }}'
-      Description: !Sub Aurora main user secret for ${AWS::StackName}
-      GenerateSecretString:
-        SecretStringTemplate: '{"username": "postgres"}'
-        GenerateStringKey: "password"
-        ExcludePunctuation: true
-        IncludeSpace: false
-        PasswordLength: 16
-        ExcludeCharacters: '[]{}()"@/\;=?&`><:|#'
-
-  {{ addon_config.prefix }}DBClusterParameterGroup:
-    Metadata:
-      'aws:copilot:description': 'A DB parameter group for engine configuration values'
-    Type: 'AWS::RDS::DBClusterParameterGroup'
-    DeletionPolicy: !FindInMap [{{ addon_config.prefix }}EnvironmentConfigMap, !Ref Env, DeletionPolicy]
-    UpdateReplacePolicy: Retain
-    Properties:
-      Description: !Ref 'AWS::StackName'
-      Family: 'aurora-postgresql{{ addon_config.version|round(0, "floor")|int }}'
-      Parameters:
-        client_encoding: 'UTF8'
-        log_statement: ddl
-        log_statement_sample_rate: '1.0'
-
-  {{ addon_config.prefix }}KMSKey:
-    Type: "AWS::KMS::Key"
-    DeletionPolicy: !FindInMap [{{ addon_config.prefix }}EnvironmentConfigMap, !Ref Env, DeletionPolicy]
-    UpdateReplacePolicy: Retain
-    Properties:
-      Description: "KMS Key for Aurora encryption"
-      KeyPolicy:
-        Version: '2012-10-17'
-        Id: !Sub '${App}-${Env}-{{ addon_config.prefix }}-cluster-key'
-        Statement:
-        - Sid: Enable IAM User Permissions
-          Effect: Allow
-          Principal:
-            AWS: !Sub "arn:aws:iam::${AWS::AccountId}:root"
-          Action: kms:*
-          Resource: '*'
-
-  {{ addon_config.prefix }}KeyAlias:
-    Type: 'AWS::KMS::Alias'
-    Properties:
-      AliasName: !Sub 'alias/${App}-${Env}-{{ addon_config.prefix }}-cluster-key'
-      TargetKeyId: !Ref {{ addon_config.prefix }}KMSKey
-
-  {{ addon_config.prefix }}DBCluster:
-    Metadata:
-      'aws:copilot:description': 'The {{ addon_config.prefix }} Aurora Serverless v2 database cluster'
-    Type: 'AWS::RDS::DBCluster'
-    DeletionPolicy: !FindInMap [{{ addon_config.prefix }}EnvironmentConfigMap, !Ref Env, DeletionPolicy]
-    UpdateReplacePolicy: Retain
-    Properties:
-      AutoMinorVersionUpgrade: true
-      BackupRetentionPeriod: 8
-      MasterUsername:
-        !If [
-          {{ addon_config.prefix }}UseSnapshot,
-          !Ref AWS::NoValue,
-          !Join [ "",  [ '{% raw %}{{{% endraw %}resolve:secretsmanager:', !Ref {{ addon_config.prefix }}AuroraSecret, ":SecretString:username{% raw %}}}{% endraw %}" ]]
-        ]
-      MasterUserPassword:
-        !If [
-          {{ addon_config.prefix }}UseSnapshot,
-          !Ref AWS::NoValue,
-          !Join [ "",  [ '{% raw %}{{{% endraw %}resolve:secretsmanager:', !Ref {{ addon_config.prefix }}AuroraSecret, ":SecretString:password{% raw %}}}{% endraw %}" ]]
-        ]
-      DatabaseName: !Ref {{ addon_config.prefix }}DBName
-      Engine: 'aurora-postgresql'
-      EngineVersion: '{{ addon_config.version }}'
-      EnableCloudwatchLogsExports:
-        - postgresql
-      DBClusterParameterGroupName: !Ref {{ addon_config.prefix }}DBClusterParameterGroup
-      DBSubnetGroupName: !Ref {{ addon_config.prefix }}DBSubnetGroup
-      KmsKeyId: !Ref {{ addon_config.prefix }}KMSKey
-      Port: 5432
-      VpcSecurityGroupIds:
-        - !Ref {{ addon_config.prefix }}DBClusterSecurityGroup
-      ServerlessV2ScalingConfiguration:
-        MinCapacity: !FindInMap [{{ addon_config.prefix }}EnvironmentConfigMap, !Ref Env, DBMinCapacity]
-        MaxCapacity: !FindInMap [{{ addon_config.prefix }}EnvironmentConfigMap, !Ref Env, DBMaxCapacity]
-      SnapshotIdentifier: !If [{{ addon_config.prefix }}UseSnapshot, !FindInMap [{{ addon_config.prefix }}EnvironmentConfigMap, !Ref Env, SnapshotIdentifier], !Ref AWS::NoValue]
-      StorageEncrypted: true
-      DeletionProtection: !FindInMap [{{ addon_config.prefix }}EnvironmentConfigMap, !Ref Env, DeletionProtection]
-
-  {{ addon_config.prefix }}DBWriterInstance:
-    Metadata:
-      'aws:copilot:description': 'The {{ addon_config.prefix }} Aurora Serverless v2 writer instance'
-    Type: 'AWS::RDS::DBInstance'
-    DeletionPolicy: !FindInMap [{{ addon_config.prefix }}EnvironmentConfigMap, !Ref Env, DeletionPolicy]
-    UpdateReplacePolicy: Retain
-    Properties:
-      DBClusterIdentifier: !Ref {{ addon_config.prefix }}DBCluster
-      DBInstanceClass: db.serverless
-      EnablePerformanceInsights: true
-      Engine: 'aurora-postgresql'
-      PromotionTier: 1
-      AvailabilityZone: !Select
-        - 0
-        - !GetAZs
-          Ref: AWS::Region
-
-  {{ addon_config.prefix }}SecretAuroraClusterAttachment:
-    Type: AWS::SecretsManager::SecretTargetAttachment
-    Properties:
-      SecretId: !Ref {{ addon_config.prefix }}AuroraSecret
-      TargetId: !Ref {{ addon_config.prefix }}DBCluster
-      TargetType: AWS::RDS::DBCluster
-
-  # Enable ingress from other ECS services created within the environment.
-  {{ addon_config.prefix }}EnvironmentIngress:
-    Metadata:
-      'aws:copilot:description': 'Allow ingress from containers in my application to the OpenSearch cluster'
-    Type: AWS::EC2::SecurityGroupIngress
-    DeletionPolicy: !FindInMap [{{ addon_config.prefix }}EnvironmentConfigMap, !Ref Env, DeletionPolicy]
-    UpdateReplacePolicy: Retain
-    Properties:
-      Description: Ingress Security Group from Fargate containers
-      GroupId: !Ref '{{ addon_config.prefix }}DBClusterSecurityGroup'
-      IpProtocol: tcp
-      FromPort: 5432
-      ToPort: 5432
-      SourceSecurityGroupId: !Ref EnvironmentSecurityGroup
-
-  {{ addon_config.prefix }}LambdaIngress:
-    Metadata:
-      'aws:copilot:description': 'Allow ingress from Lambda Functions in my application to the DB cluster'
-    Type: AWS::EC2::SecurityGroupIngress
-    DeletionPolicy: !FindInMap [{{ addon_config.prefix }}EnvironmentConfigMap, !Ref Env, DeletionPolicy]
-    UpdateReplacePolicy: Retain
-    Properties:
-      Description: Ingress from Lambda Functions to DB
-      GroupId: !Ref '{{ addon_config.prefix }}DBClusterSecurityGroup'
-      IpProtocol: tcp
-      FromPort: 5432
-      ToPort: 5432
-      SourceSecurityGroupId: !Ref '{{ addon_config.prefix }}DBClusterSecurityGroup'
-
-  {{ addon_config.prefix }}SecretsManagerIngress:
-    Metadata:
-      'aws:copilot:description': 'Allow ingress from Lambda Functions in my application to the Secrets Manager'
-    Type: AWS::EC2::SecurityGroupIngress
-    DeletionPolicy: !FindInMap [{{ addon_config.prefix }}EnvironmentConfigMap, !Ref Env, DeletionPolicy]
-    UpdateReplacePolicy: Retain
-    Properties:
-      Description: Ingress from Lambda Functions to Secrets Manager
-      GroupId: !Ref '{{ addon_config.prefix }}DBClusterSecurityGroup'
-      IpProtocol: tcp
-      FromPort: 443
-      ToPort: 443
-      SourceSecurityGroupId: !Ref '{{ addon_config.prefix }}DBClusterSecurityGroup'
-
-  {{ addon_config.prefix }}LambdaEgress:
-    Metadata:
-      'aws:copilot:description': 'Allow egress from DB cluster in my application to the Lambda Function'
-    Type: AWS::EC2::SecurityGroupEgress
-    DeletionPolicy: !FindInMap [{{ addon_config.prefix }}EnvironmentConfigMap, !Ref Env, DeletionPolicy]
-    UpdateReplacePolicy: Retain
-    Properties:
-      Description: Egress from DB to Lambda Functions
-      GroupId: !Ref '{{ addon_config.prefix }}DBClusterSecurityGroup'
-      IpProtocol: tcp
-      FromPort: 5432
-      ToPort: 5432
-      DestinationSecurityGroupId: !Ref '{{ addon_config.prefix }}DBClusterSecurityGroup'
-
-  {{ addon_config.prefix }}SecretsManagerEgress:
-    Metadata:
-      'aws:copilot:description': 'Allow egress from Secrets Manager in my application to the Lambda Function'
-    Type: AWS::EC2::SecurityGroupEgress
-    DeletionPolicy: !FindInMap [{{ addon_config.prefix }}EnvironmentConfigMap, !Ref Env, DeletionPolicy]
-    UpdateReplacePolicy: Retain
-    Properties:
-      Description: Egress from Secrets Manager to Lambda Functions
-      GroupId: !Ref '{{ addon_config.prefix }}DBClusterSecurityGroup'
-      IpProtocol: tcp
-      FromPort: 443
-      ToPort: 443
-      DestinationSecurityGroupId: !Ref '{{ addon_config.prefix }}DBClusterSecurityGroup'
-
-  {{ addon_config.prefix }}HTTPSEgress:
-    Metadata:
-      'aws:copilot:description': 'Allow egress for HTTPS (so the Lambda Function can post a success response back to the Custom Resource)'
-    Type: AWS::EC2::SecurityGroupEgress
-    DeletionPolicy: !FindInMap [{{ addon_config.prefix }}EnvironmentConfigMap, !Ref Env, DeletionPolicy]
-    UpdateReplacePolicy: Retain
-    Properties:
-      CidrIp: 0.0.0.0/0
-      Description: Egress for HTTPS
-      GroupId: !Ref '{{ addon_config.prefix }}DBClusterSecurityGroup'
-      IpProtocol: tcp
-      FromPort: 443
-      ToPort: 443
-
-  {{ addon_config.prefix }}LambdaFunction:
-    Type: AWS::Lambda::Function
-    Properties:
-      FunctionName: !Sub "${App}-${Env}-{{ addon_config.prefix }}-aurora-create-user"
-      Handler: index.handler
-      Runtime: python3.11
-      Layers:
-        - arn:aws:lambda:eu-west-2:763451185160:layer:python-postgres:1
-      MemorySize: 128
-      Timeout: 10
-      Role: !GetAtt {{ addon_config.prefix }}LambdaFunctionExecutionRole.Arn
-      VpcConfig:
-        SecurityGroupIds:
-          - !Ref {{ addon_config.prefix }}DBClusterSecurityGroup
-        SubnetIds: !Split [ ",", !Ref PrivateSubnets ]
-      Code:
-        ZipFile: |
-          import json
-          import boto3
-          import cfnresponse
-          import psycopg2
-          from botocore.exceptions import ClientError
-
-
-          def drop_user(cursor, username):
-              cursor.execute(f"SELECT * FROM pg_catalog.pg_user WHERE usename = '{username}'")
-
-              if cursor.fetchone() is not None:
-                  cursor.execute(f"GRANT {username} TO postgres")
-                  cursor.execute(f"DROP OWNED BY {username}")
-                  cursor.execute(f"DROP USER {username}")
-
-
-          def create_db_user(conn, cursor, username, password, permissions):
-              drop_user(cursor, username)
-
-              cursor.execute(f"CREATE USER {username} WITH ENCRYPTED PASSWORD '%s'" % password)
-              cursor.execute(f"GRANT {username} to postgres;")
-              cursor.execute(f"GRANT {', '.join(permissions)} ON ALL TABLES IN SCHEMA public TO {username};")
-              cursor.execute(f"ALTER DEFAULT PRIVILEGES FOR USER {username} IN SCHEMA public GRANT {', '.join(permissions)} ON TABLES TO {username};")
-              conn.commit()
-
-
-          def create_or_update_user_secret(ssm, user_secret_name, user_secret_string, event):
-              user_secret_description = event['ResourceProperties']['SecretDescription']
-              copilot_application = event['ResourceProperties']['CopilotApplication']
-              copilot_environment = event['ResourceProperties']['CopilotEnvironment']
-
-              user_secret = None
-
-              try:
-                  user_secret = ssm.put_parameter(
-                      Name=user_secret_name,
-                      Description=user_secret_description,
-                      Value=json.dumps(user_secret_string),
-                      Tags=[
-                          {'Key': 'custom:cloudformation:stack-name', 'Value': event["StackId"].split('/')[1]},
-                          {'Key': 'custom:cloudformation:logical-id', 'Value': event["LogicalResourceId"]},
-                          {'Key': 'custom:cloudformation:stack-id', 'Value': event["StackId"]},
-                          {'Key': 'copilot-application', 'Value': copilot_application},
-                          {'Key': 'copilot-environment', 'Value': copilot_environment},
-                      ],
-                      Type="String",
-                  )
-              except ClientError as error:
-                  if error.response["Error"]["Code"] == "ParameterAlreadyExists":
-                      user_secret = ssm.put_parameter(
-                          Name=user_secret_name,
-                          Description=user_secret_description,
-                          Value=json.dumps(user_secret_string),
-                          Overwrite=True,
-                      )
-
-              return user_secret
-
-
-          def handler(event, context):
-              print("REQUEST RECEIVED:\n" + json.dumps(event))
-
-              db_master_user_secret = event['ResourceProperties']['MasterUserSecret']
-              user_secret_name = event['ResourceProperties']['SecretName']
-              username = event['ResourceProperties']['Username']
-              user_permissions = event['ResourceProperties']['Permissions']
-              
-              secrets_manager = boto3.client("secretsmanager")
-              ssm = boto3.client("ssm")
-
-              master_user = json.loads(secrets_manager.get_secret_value(SecretId=db_master_user_secret)["SecretString"])
-
-              user_password = secrets_manager.get_random_password(
-                  PasswordLength=16,
-                  ExcludeCharacters='[]{}()"@/\;=?&`><:|#',
-                  ExcludePunctuation=True,
-                  IncludeSpace=False,
-              )["RandomPassword"]
-
-              user_secret_string = {
-                  "username": username,
-                  "password": user_password,
-                  "engine": master_user["engine"],
-                  "port": master_user["port"],
-                  "dbname": master_user["dbname"],
-                  "host": master_user["host"],
-                  "dbClusterIdentifier": master_user["dbClusterIdentifier"]
-              }
-
-              conn = psycopg2.connect(
-                  dbname=master_user["dbname"],
-                  user=master_user["username"],
-                  password=master_user["password"],
-                  host=master_user["host"],
-                  port=master_user["port"]
-              )
-
-              cursor = conn.cursor()
-
-              response = {"Status": "SUCCESS"}
-
-              try:
-                  match event["RequestType"]:
-                      case "Create":
-                          create_db_user(conn, cursor, username, user_password, user_permissions)
-
-                          response = {
-                              **response,
-                              "Data": create_or_update_user_secret(ssm, user_secret_name, user_secret_string, event)
-                          }
-                      case "Update":
-                          create_db_user(conn, cursor, username, user_password, user_permissions)
-
-                          response = {
-                              **response,
-                              "Data": create_or_update_user_secret(ssm, user_secret_name, user_secret_string, event)
-                          }
-                      case "Delete":
-                          drop_user(cursor, username)
-
-                          response = {
-                              **response,
-                              "Data": ssm.delete_parameter(Name=user_secret_name)
-                          }
-                      case _:
-                          response = {"Status": "FAILED",
-                                      "Data": {"Error": f"""Invalid requestType of '${event["RequestType"]}'"""}}
-              except Exception as e:
-                  response = {"Status": "FAILED", "Data": {"Error": str(e)}}
-
-              cursor.close()
-              conn.close()
-
-              print(json.dumps(response, default=str))
-              cfnresponse.send(event, context, response["Status"], response["Data"], event["LogicalResourceId"])
-
-  {{ addon_config.prefix }}ApplicationUser:
-    Type: 'Custom::{{ addon_config.prefix }}ApplicationUser'
-    DeletionPolicy: !FindInMap [{{ addon_config.prefix }}EnvironmentConfigMap, !Ref Env, DeletionPolicy]
-    UpdateReplacePolicy: Retain
-    Properties:
-      ServiceToken: !GetAtt '{{ addon_config.prefix }}LambdaFunction.Arn'
-      CopilotApplication: !Sub "${App}"
-      CopilotEnvironment: !Sub "${Env}"
-      MasterUserSecret: !Ref {{ addon_config.prefix }}AuroraSecret
-      SecretDescription: !Sub Aurora application user secret for ${AWS::StackName}
-      SecretName: !Sub '/copilot/${App}/${Env}/secrets/{{ addon_config.name|upper|replace("-", "_") }}_APPLICATION_USER'
-      DefaultPublicRoute: !Ref DefaultPublicRoute
-      InternetGateway: !Ref InternetGateway
-      InternetGatewayAttachment: !Ref InternetGatewayAttachment
-      PublicRouteTable: !Ref PublicRouteTable
-      PublicSubnet1RouteTableAssociation: !Ref PublicSubnet1RouteTableAssociation
-      PublicSubnet2RouteTableAssociation: !Ref PublicSubnet2RouteTableAssociation
-      Snapshot: !If [{{ addon_config.prefix }}UseSnapshot, !FindInMap [{{ addon_config.prefix }}EnvironmentConfigMap, !Ref Env, SnapshotIdentifier], ""]
-      Username: 'application_user'
-      Permissions:
-        - 'SELECT'
-        - 'INSERT'
-        - 'UPDATE'
-        - 'DELETE'
-        - 'TRIGGER'
-    # Resource based metadata block to ignore reference to resources in other addon templates. Do not remove.
-    Metadata:
-      cfn-lint:
-        config:
-          ignore_checks:
-            # https://github.com/aws-cloudformation/cfn-lint/blob/main/docs/rules.md
-            - E3005
-    DependsOn:
-      - VpcEndpoint
-      - {{ addon_config.prefix }}DBWriterInstance
-      - AdditionalNatGateway1
-      - AdditionalNatGateway2
-      - AdditionalPrivateRoute1
-      - AdditionalPrivateRouteTable1
-      - AdditionalPrivateRouteTable1Association
-      - AdditionalPrivateRoute2
-      - AdditionalPrivateRouteTable2
-      - AdditionalPrivateRouteTable2Association
-      - {{ addon_config.prefix }}SecretAuroraClusterAttachment
-      - {{ addon_config.prefix }}EnvironmentIngress
-      - {{ addon_config.prefix }}SecretsManagerIngress
-      - {{ addon_config.prefix }}LambdaIngress
-      - {{ addon_config.prefix }}SecretsManagerEgress
-      - {{ addon_config.prefix }}LambdaEgress
-      - {{ addon_config.prefix }}HTTPSEgress
-      - {{ addon_config.prefix }}KeyAlias
-
-  {{ addon_config.prefix }}ReadOnlyUser:
-    Type: 'Custom::{{ addon_config.prefix }}ReadOnlyUser'
-    DeletionPolicy: !FindInMap [{{ addon_config.prefix }}EnvironmentConfigMap, !Ref Env, DeletionPolicy]
-    UpdateReplacePolicy: Retain
-    Properties:
-      ServiceToken: !GetAtt '{{ addon_config.prefix }}LambdaFunction.Arn'
-      CopilotApplication: !Sub "${App}"
-      CopilotEnvironment: !Sub "${Env}"
-      MasterUserSecret: !Ref {{ addon_config.prefix }}AuroraSecret
-      SecretDescription: !Sub Aurora read only user secret for ${AWS::StackName}
-      SecretName: !Sub '/copilot/${App}/${Env}/secrets/{{ addon_config.name|upper|replace("-", "_") }}_READ_ONLY_USER'
-      DefaultPublicRoute: !Ref DefaultPublicRoute
-      InternetGateway: !Ref InternetGateway
-      InternetGatewayAttachment: !Ref InternetGatewayAttachment
-      PublicRouteTable: !Ref PublicRouteTable
-      PublicSubnet1RouteTableAssociation: !Ref PublicSubnet1RouteTableAssociation
-      PublicSubnet2RouteTableAssociation: !Ref PublicSubnet2RouteTableAssociation
-      Snapshot: !If [{{ addon_config.prefix }}UseSnapshot, !FindInMap [{{ addon_config.prefix }}EnvironmentConfigMap, !Ref Env, SnapshotIdentifier], ""]
-      Username: 'read_only_user'
-      Permissions:
-        - 'SELECT'
-    # Resource based metadata block to ignore reference to resources in other addon templates. Do not remove.
-    Metadata:
-      cfn-lint:
-        config:
-          ignore_checks:
-            # https://github.com/aws-cloudformation/cfn-lint/blob/main/docs/rules.md
-            - E3005
-    DependsOn:
-      - VpcEndpoint
-      - {{ addon_config.prefix }}DBWriterInstance
-      - AdditionalNatGateway1
-      - AdditionalNatGateway2
-      - AdditionalPrivateRoute1
-      - AdditionalPrivateRouteTable1
-      - AdditionalPrivateRouteTable1Association
-      - AdditionalPrivateRoute2
-      - AdditionalPrivateRouteTable2
-      - AdditionalPrivateRouteTable2Association
-      - {{ addon_config.prefix }}SecretAuroraClusterAttachment
-      - {{ addon_config.prefix }}EnvironmentIngress
-      - {{ addon_config.prefix }}SecretsManagerIngress
-      - {{ addon_config.prefix }}LambdaIngress
-      - {{ addon_config.prefix }}SecretsManagerEgress
-      - {{ addon_config.prefix }}LambdaEgress
-      - {{ addon_config.prefix }}HTTPSEgress
-      - {{ addon_config.prefix }}KeyAlias
-
-  {{ addon_config.prefix }}LambdaFunctionExecutionRole:
-    Type: AWS::IAM::Role
-    Properties:
-      RoleName: !Sub "${App}-${Env}-{{ addon_config.prefix }}-aurora-user"
-      AssumeRolePolicyDocument:
-        Version: 2012-10-17
-        Statement:
-          - Effect: Allow
-            Action:
-              - 'sts:AssumeRole'
-            Principal:
-              Service:
-                - lambda.amazonaws.com
-      Policies:
-        - PolicyName: !Sub "${App}-${Env}-aurora-user"
-          PolicyDocument:
-            Version: '2012-10-17'
-            Statement:
-              - Effect: Allow
-                Action:
-                  - 'ec2:CreateNetworkInterface'
-                  - 'ec2:DescribeNetworkInterfaces'
-                  - 'ec2:DeleteNetworkInterface'
-                Resource:
-                  - '*'
-              - Effect: Allow
-                Action:
-                  - 'ssm:DeleteParameter'
-                  - 'ssm:PutParameter'
-                  - 'ssm:AddTagsToResource'
-                  - 'kms:Decrypt'
-                Resource:
-                  - '*'
-              - Effect: Allow
-                Action:
-                  - 'secretsmanager:DescribeSecret'
-                  - 'secretsmanager:GetRandomPassword'
-                  - 'secretsmanager:GetSecretValue'
-                Resource:
-                  - '*'
-              - Effect: Allow
-                Action:
-                  - 'logs:CreateLogGroup'
-                  - 'logs:CreateLogStream'
-                  - 'logs:PutLogEvents'
-                Resource: 'arn:aws:logs:*:*:*'
-
-  {{ addon_config.prefix }}SubscriptionFilter:
-    Type: AWS::Logs::SubscriptionFilter
-    DependsOn:
-      - {{ addon_config.prefix }}DBWriterInstance
-    Properties:
-      RoleArn: !Sub 'arn:aws:iam::${AWS::AccountId}:role/CWLtoSubscriptionFilterRole'
-      LogGroupName: !Sub '/aws/rds/cluster/${{ '{' }}{{ addon_config.prefix }}DBCluster}/postgresql'
-      FilterName: !Sub '/aws/rds/cluster/${App}/${Env}/${{ '{' }}{{ addon_config.prefix }}DBCluster}/postgresql'
-      FilterPattern: ''
-      DestinationArn: !If [{{ addon_config.prefix }}CreateProdSubFilter, '{{ log_destination.prod }}', '{{ log_destination.dev }}']