template.yaml

# Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
# SPDX-License-Identifier: MIT-0

AWSTemplateFormatVersion: "2010-09-09"
Transform: AWS::Serverless-2016-10-31
Description: AWS GenAI IDP Accelerator (uksb-r8evguc4p9) (SO9027) (v<VERSION>)

Mappings:
  AppSyncLogLevelMap:
    DEBUG:
      FieldLogLevel: ALL
    INFO:
      FieldLogLevel: ALL
    WARN:
      FieldLogLevel: ERROR
    ERROR:
      FieldLogLevel: ERROR
    CRITICAL:
      FieldLogLevel: ERROR

  CrawlerScheduleMap:
    Manual:
      ScheduleExpression: ""
    Every15m:
      ScheduleExpression: "cron(0/15 * * * ? *)"
    EveryHour:
      ScheduleExpression: "cron(0 * * * ? *)"
    EveryDay:
      ScheduleExpression: "cron(0 0 * * ? *)"

  Pattern1ConfigurationMap:
    lending-package-sample:
      ConfigPath: "lending-package-sample"
    realkie-fcc-verified:
      ConfigPath: "realkie-fcc-verified"
    default:
      ConfigPath: "lending-package-sample"

  Pattern2ConfigurationMap:
    lending-package-sample:
      ConfigPath: "lending-package-sample"
    rvl-cdip-package-sample:
      ConfigPath: "rvl-cdip-package-sample"
    rvl-cdip-package-sample-with-few-shot-examples:
      ConfigPath: "rvl-cdip-package-sample-with-few-shot-examples"
    bank-statement-sample:
      ConfigPath: "bank-statement-sample"
    realkie-fcc-verified:
      ConfigPath: "realkie-fcc-verified"
    default:
      ConfigPath: "rvl-cdip-package-sample"

  Pattern3ConfigurationMap:
    rvl-cdip-package-sample:
      ConfigPath: "rvl-cdip-package-sample"
    default:
      ConfigPath: "rvl-cdip-package-sample"

Parameters:
  # Authorization params
  AdminEmail:
    Type: String
    Description: >-
      Email address of the admin user (e.g. jdoe+admin@example.com). 
      An initial temporary password is automatically sent to this user via email.
    AllowedPattern: '^[\w.+-]+@([\w-]+\.)+[\w-]{2,6}$'

  AllowedSignUpEmailDomain:
    Type: String
    Default: ""
    Description: >-
      Email address domain (example.com) or comma separated list of email domains (example1.com,
      example2.com) allowed to signup using the web UI.
      If left empty, signup via the web UI is disabled and users will have to be created
      using Cognito.
    AllowedPattern: '^(|([\w-]+\.)+[\w-]{2,6}(, *([\w-]+\.)+[\w-]{2,6})*)$'
    ConstraintDescription: >-
      Must be empty or a list of comma separated email domains (example1.com, example2.com)

  # Pattern selection
  IDPPattern:
    Type: String
    Default: Pattern1 - Packet or Media processing with Bedrock Data Automation (BDA)
    AllowedValues:
      - Pattern1 - Packet or Media processing with Bedrock Data Automation (BDA)
      - Pattern2 - Packet processing with Textract and Bedrock
      - Pattern3 - Packet processing with Textract, SageMaker(UDOP), and Bedrock
    Description: >-
      Built-in IDP workflow patterns - see README for pattern descriptions.

  # Custom Configuration Path

  CustomConfigPath:
    Type: String
    Default: ""
    Description: >-
      S3 URI pointing to your custom configuration YAML file. When provided, this configuration overrides the selected pattern preset and applies to all processing patterns. 
      Leave blank to use the selected pattern configuration preset. For example s3://my-bucket/custom-config/config.yaml
    AllowedPattern: '^(|s3://.*)$'
    ConstraintDescription: Must be empty or a valid S3 URI (e.g., s3://my-bucket/custom-config/config.yaml)

  # Pattern 1 Parameters

  Pattern1BDAProjectArn:
    Type: String
    Default: ""
    AllowedPattern: "^(|^arn:aws[a-z-]*:bedrock:[a-z0-9-]+:.+:data-automation-project/.+)$"
    Description: For Pattern-1, provide a Bedrock Data Automation (BDA) project ARN, or leave blank to create a sample project for processing the sample lending package.

  Pattern1Configuration:
    Type: String
    Default: "lending-package-sample"
    AllowedValues:
      - "lending-package-sample"
      - "realkie-fcc-verified"
      - "default"
    Description: >-
      Select the configuration preset for Pattern 1. Each configuration contains pre-tuned settings for specific document processing scenarios - see https://github.com/aws-samples/sample-genai-idp/blob/main/config_library/README.md. Note: This selected configuration will be replaced by the Custom Configuration Path if specified.

  # Pattern 2 Parameters

  Pattern2Configuration:
    Type: String
    Default: "lending-package-sample"
    AllowedValues:
      - "lending-package-sample"
      - "rvl-cdip-package-sample"
      - "rvl-cdip-package-sample-with-few-shot-examples"
      - "bank-statement-sample"
      - "realkie-fcc-verified"
      - "default"
    Description: >-
      Select the configuration preset for Pattern 2. Each configuration contains pre-tuned settings for specific document processing scenarios see https://github.com/aws-samples/sample-genai-idp/blob/main/config_library/README.md. Note: Custom configuration overrides the selected pattern configuration when provided.

  Pattern2CustomClassificationModelARN:
    Type: String
    Default: ""
    Description: Specify Custom Fine Tuned Classification Model ARN. Leave blank to use pretrained model specified in the selected configuration.

  Pattern2CustomExtractionModelARN:
    Type: String
    Default: ""
    Description: Specify Custom Fine Tuned Extraction Model ARN. Leave blank to use pretrained model specified in the selected configuration.

  Pattern3UDOPModelArtifactPath:
    Type: String
    Default: "<PUBLIC_SAMPLE_UDOP_MODEL>"
    AllowedPattern: "^(|s3://.*)$"
    Description: For Pattern-3, provide S3 path to the UDOP model.tar.gz file (e.g., s3://bucket-name/path/to/model.tar.gz)

  Pattern3Configuration:
    Type: String
    Default: "rvl-cdip-package-sample"
    AllowedValues:
      - "rvl-cdip-package-sample"
      - "default"
    Description: >-
      Select the configuration preset for Pattern 3. Each configuration contains pre-tuned settings for specific document processing scenarios - see https://github.com/aws-samples/sample-genai-idp/blob/main/config_library/README.md. Note: Custom configuration overrides the selected pattern configuration when provided.

  # HITL (A2I) Configuration

  EnableHITL:
    Type: String
    AllowedValues:
      - true
      - false
    Default: false
    Description: Enable Human In The Loop configuration to invoke HITL (SageMaker A2I) if the extraction confidence is less than configured threshold (applies to Pattern-1)

  ExistingPrivateWorkforceArn:
    Type: String
    Default: ""
    AllowedPattern: "^(|arn:aws[a-z-]*:sagemaker:[a-z0-9-]+:[0-9]{12}:workteam/private-crowd/.+)$"
    Description: >-
      ARN of an existing SageMaker private workforce workteam to use for Human In The Loop (HITL). 
      If you do not have existing Private workteam and leave it blank then solution will create one. 
      REQUIRED when deploying multiple patterns with HITL enabled, as only one private workteam can exist per AWS account.
      If you already have a GenAI-IDP deployment with HITL enabled, provide the existing workteam ARN here.
      Leave empty for first-time HITL deployment to create a new private workteam automatically.
      Find the ARN in your existing stack's CloudFormation outputs under 'PrivateWorkteamArn'.
      Format: arn:${AWS::Partition}:sagemaker:region:account-id:workteam/private-crowd/workteam-name

  # Evaluation
  EvaluationBaselineBucketName:
    Type: String
    Default: ""
    Description: >-
      (Optional) Existing bucket used for baseline (ground truth) data for processed documents. Baseline data is used to asess the accuracy 
      of the processing pattern outputs. 
      Provide the name of an existing bucket here. Hint: you can use the Output bucket of another GenAIIDP stack to compare the outputs from 
      different patterns and prompts. 
      Leave blank to automatically create an empty bucket where you can (optionally) place your validated baseline data later.

  ReportingBucketName:
    Type: String
    Default: ""
    Description: >-
      (Optional) Existing bucket used for analytics. (Currently used for evaluation analytics)
      Provide the name of an existing bucket here or leave blank to automatically create a new bucket.

  DocumentSectionsCrawlerFrequency:
    Type: String
    Default: "EveryDay"
    AllowedValues:
      - "Manual"
      - "Every15m"
      - "EveryHour"
      - "EveryDay"
    Description: >-
      Frequency for the Glue Crawler to run and discover new document section tables and partitions.
      Manual requires manual execution, other options run automatically at the specified interval.


  # X-Ray Tracing
  EnableXRayTracing:
    Type: String
    Default: 'true'
    AllowedValues: [ 'true', 'false' ]
    Description: Enable X-Ray tracing

  # MCP Integration
  EnableMCP:
    Type: String
    Default: 'true'
    AllowedValues: [ 'true', 'false' ]
    Description: Enable Model Context Protocol (MCP) integration for external application access via AWS Bedrock AgentCore Gateway

  # Optional Knowledge Base Configuration
  DocumentKnowledgeBase:
    Default: "BEDROCK_KNOWLEDGE_BASE (Create)"
    Type: String
    AllowedValues:
      - "DISABLED"
      - "BEDROCK_KNOWLEDGE_BASE (Create)"
    Description: Use document processing results as knowledge base content. Model access for amazon.titan-embed-text-v2:0 MUST be enabled in Amazon Bedrock.

  KnowledgeBaseVectorStore:
    Type: String
    Default: "S3_VECTORS"
    AllowedValues:
      - "OPENSEARCH_SERVERLESS"
      - "S3_VECTORS"
    Description: Choose vector store type for Bedrock Knowledge Base. S3 Vectors (default) for cost-effective storage with sub-second latency, OpenSearch Serverless for sub-millisecond queries.

  KnowledgeBaseModelId:
    Type: String
    Default: "us.amazon.nova-pro-v1:0"
    AllowedValues:
      - "us.amazon.nova-lite-v1:0"
      - "us.amazon.nova-pro-v1:0"
      - "us.amazon.nova-premier-v1:0"
      - "us.amazon.nova-2-lite-v1:0"
      - "us.anthropic.claude-3-haiku-20240307-v1:0"
      - "us.anthropic.claude-3-5-haiku-20241022-v1:0"
      - "us.anthropic.claude-3-5-sonnet-20241022-v2:0"
      - "us.anthropic.claude-3-7-sonnet-20250219-v1:0"
      - "us.anthropic.claude-sonnet-4-20250514-v1:0"
      - "us.anthropic.claude-sonnet-4-5-20250929-v1:0"
      - "eu.amazon.nova-lite-v1:0"
      - "eu.amazon.nova-pro-v1:0"
      - "eu.amazon.nova-2-lite-v1:0"
      - "eu.anthropic.claude-3-haiku-20240307-v1:0"
      - "eu.anthropic.claude-3-5-sonnet-20241022-v2:0"
      - "eu.anthropic.claude-3-7-sonnet-20250219-v1:0"
      - "eu.anthropic.claude-sonnet-4-20250514-v1:0"
      - "eu.anthropic.claude-sonnet-4-5-20250929-v1:0"
      - "qwen.qwen3-vl-235b-a22b"
    Description: Model to use for optional Document Knowledge Base. Model access MUST be enabled in Amazon Bedrock. Note - Nova Premier may not be available in all EU regions.

  # Optional - Post processing Lambda hook
  PostProcessingLambdaHookFunctionArn:
    Default: ""
    Type: String
    AllowedPattern: "^(|arn:aws[a-z-]*:lambda:.*)$"
    Description: >
      (Optional) The specified Lambda function is invoked by EventBridge after the document processing workflow is processed.
      This function can implement custom logic to initiate downstream processing on the output of the processing pattern.

  # Optional Bedrock Guardrail Configuration
  BedrockGuardrailId:
    Type: String
    Default: ""
    AllowedPattern: "^(|[a-z0-9]+)$"
    Description: >
      Optionally provide the *Id* (not name) of an *existing* Bedrock Guardrail (looks like: wxyz3ab12x34) to be used for all Bedrock and Bedrock Knowledge Base interactions.

  BedrockGuardrailVersion:
    Type: String
    Default: "DRAFT"
    AllowedPattern: "^(|(([1-9][0-9]{0,7})|(DRAFT)))$"
    Description: >
      If you provided a Bedrock Guardrail Id above, provide the corresponding Guardrail version here (e.g. DRAFT|1|2|...).

  # General Configuration
  MaxConcurrentWorkflows:
    Type: Number
    Default: 100
    Description: Maximum number of concurrent workflow executions allowed
    MinValue: 1

  DataRetentionInDays:
    Type: Number
    Default: 365
    Description: Number of days to retain documents (S3) and tracking records (DynamoDB)
    MinValue: 1

  ErrorThreshold:
    Type: Number
    Default: 1
    Description: Number of workflow errors that triggers an alert (per 5 minutes)
    MinValue: 1

  ExecutionTimeThresholdMs:
    Type: Number
    Default: 300000
    Description: Maximum acceptable execution time in milliseconds before alerting (default 300000 = 300 seconds)
    MinValue: 1000

  # Security Configuration
  PermissionsBoundaryArn:
    Type: String
    Default: ""
    Description: >-
      (Optional) ARN of an existing IAM Permissions Boundary policy to attach to all IAM roles.
      Required by some organizations with Service Control Policies (SCPs).
      Format: arn:${AWS::Partition}:iam::account-id:policy/policy-name
      Leave blank if no Permissions Boundary is required.
    AllowedPattern: "^(|arn:aws[a-z-]*:iam::[0-9]{12}:policy/.+)$"
    ConstraintDescription: Must be empty or a valid IAM policy ARN

  EnableECRImageScanning:
    Type: String
    Default: "false"
    AllowedValues:
      - "true"
      - "false"
    Description: >-
      Enable automatic vulnerability scanning for Lambda container images in ECR (applies to Pattern-1 and Pattern-2). 
      Disabling may improve deployment reliability but reduces security posture. 
      Recommended: true for production, false only if experiencing deployment issues.

  # Logging configuration
  LogLevel:
    Type: String
    Default: INFO
    AllowedValues:
      - DEBUG
      - INFO
      - WARN
      - ERROR
    Description: Default logging level for all logs

  LogRetentionDays:
    Type: Number
    Default: 30
    Description: Number of days to retain CloudWatch logs
    AllowedValues:
      [
        1,
        3,
        5,
        7,
        14,
        30,
        60,
        90,
        120,
        150,
        180,
        365,
        400,
        545,
        731,
        1827,
        3653,
      ]

  CloudFrontPriceClass:
    Type: String
    Default: PriceClass_100
    Description: >-
      Specify the CloudFront price class. See https://aws.amazon.com/cloudfront/pricing/
      for a
      description of each price class.
    AllowedValues:
      - PriceClass_100
      - PriceClass_200
      - PriceClass_All
    ConstraintDescription: >-
      Allowed Price Classes PriceClass_100 PriceClass_200 and PriceClass_All

  CloudFrontAllowedGeos:
    Type: String
    Default: ""
    Description: >-
      Specify a comma separated list of two letter country codes (uppercase ISO 3166-1)
      that are
      allowed to access the web user interface via CloudFront. For example: US,CA.
      Leave empty if
      you do not want geo restrictions to be applied.
    AllowedPattern: "^(|[A-Z]{2}(,[A-Z]{2})*)$"
    ConstraintDescription: >-
      Comma separated list of uppercase two letter country codes or empty

  WAFAllowedIPv4Ranges:
    Type: String
    Default: "0.0.0.0/0"
    Description: >-
      Comma-separated list of IPv4 CIDR ranges to allow. Default (0.0.0.0/0) disables WAF and allows all IPs.
      Example to restrict: "192.168.1.0/24, 10.0.0.0/16"
    AllowedPattern: '^([0-9]{1,3}\.){3}[0-9]{1,3}\/[0-9]{1,2}(,\s*([0-9]{1,3}\.){3}[0-9]{1,3}\/[0-9]{1,2})*$'
    ConstraintDescription: Must be valid comma-separated list of IPv4 CIDR ranges

Rules:
  Pattern3UDOPModelArtifactPath:
    RuleCondition:
      !Equals [
        !Ref IDPPattern,
        "Pattern3 - Packet processing with Textract, SageMaker(UDOP), and Bedrock",
      ]
    Assertions:
      - Assert: !Not [ !Equals [ !Ref Pattern3UDOPModelArtifactPath, "" ] ]
        AssertDescription: UDOP Model Artifact Path is required when IDPPattern is 'Pattern1'

Conditions:
  IsPattern1:
    !Equals [
      !Ref IDPPattern,
      "Pattern1 - Packet or Media processing with Bedrock Data Automation (BDA)",
    ]
  IsPattern2:
    !Equals [
      !Ref IDPPattern,
      "Pattern2 - Packet processing with Textract and Bedrock",
    ]

  IsPattern3:
    !Equals [
      !Ref IDPPattern,
      "Pattern3 - Packet processing with Textract, SageMaker(UDOP), and Bedrock",
    ]
  ShouldCreateBDASampleProject:
    !And [ !Condition IsPattern1, !Equals [ !Ref Pattern1BDAProjectArn, "" ] ]
  HasGuardrailConfig:
    !And [
      !Not [ !Equals [ !Ref BedrockGuardrailId, "" ] ],
      !Not [ !Equals [ !Ref BedrockGuardrailVersion, "" ] ],
    ]

  # HITL and Private Workforce conditions
  IsHITLEnabled: !Equals [ !Ref EnableHITL, "true" ]
  ShouldCreatePrivateWorkteam:
    !And [
      !Condition IsHITLEnabled,
      !Equals [ !Ref ExistingPrivateWorkforceArn, "" ],
    ]
  ShouldUseExistingPrivateWorkteam:
    !And [
      !Condition IsHITLEnabled,
      !Not [ !Equals [ !Ref ExistingPrivateWorkforceArn, "" ] ],
    ]

  # General rules
  ShouldAllowSignUpEmailDomain:
    !Not [ !Equals [ !Ref AllowedSignUpEmailDomain, "" ] ]
  ShouldEnableGeoRestriction: !Not [ !Equals [ !Ref CloudFrontAllowedGeos, "" ] ]
  ShouldEnablePostProcessingLambdaHook:
    !Not [ !Equals [ !Ref PostProcessingLambdaHookFunctionArn, "" ] ]
  ShouldCreateEvaluationBaselineBucket:
    !Equals [ !Ref EvaluationBaselineBucketName, "" ]
  ShouldCreateReportingBucket: !Equals [ !Ref ReportingBucketName, "" ]
  IsWafEnabled: !Not [ !Equals [ !Ref WAFAllowedIPv4Ranges, "0.0.0.0/0" ] ]
  ShouldCreateDocumentKnowledgeBase:
    !Equals [ !Ref DocumentKnowledgeBase, "BEDROCK_KNOWLEDGE_BASE (Create)" ]
  ShouldUseDocumentKnowledgeBase: !Condition ShouldCreateDocumentKnowledgeBase
  DocumentSectionsCrawlerScheduleEnabled:
    !Not [ !Equals [ !Ref DocumentSectionsCrawlerFrequency, "Manual" ] ]
  HasPermissionsBoundary: !Not [ !Equals [ !Ref PermissionsBoundaryArn, "" ] ]
  HasCustomConfigPath: !Not [ !Equals [ !Ref CustomConfigPath, "" ] ]
  IsS3VectorsVectorStore: !Equals [ !Ref KnowledgeBaseVectorStore, "S3_VECTORS" ]
  CreateAgentCoreLambda: !Equals [ !Ref EnableMCP, "true" ]
  CreateExternalAppClient: !Equals [ !Ref EnableMCP, "true" ]

Metadata:
  AWS::CloudFormation::Interface:
    ParameterGroups:
      - Label:
          default: "User Authentication"
        Parameters:
          - AdminEmail
          - AllowedSignUpEmailDomain
      - Label:
          default: "Workflow Pattern Selection"
        Parameters:
          - IDPPattern
      - Label:
          default: "Pattern 1 Configuration"
        Parameters:
          - Pattern1Configuration
          - Pattern1BDAProjectArn
      - Label:
          default: "Pattern 2 Configuration"
        Parameters:
          - Pattern2Configuration
          - Pattern2CustomClassificationModelARN
          - Pattern2CustomExtractionModelARN
      - Label:
          default: "Pattern 3 Configuration"
        Parameters:
          - Pattern3Configuration
          - Pattern3UDOPModelArtifactPath
      - Label:
          default: "Custom Configuration"
        Parameters:
          - CustomConfigPath
      - Label:
          default: "HITL (A2I) Configuration"
        Parameters:
          - EnableHITL
          - ExistingPrivateWorkforceArn
      - Label:
          default: "Evaluation"
        Parameters:
          - EvaluationBaselineBucketName
      - Label:
          default: "Reporting"
        Parameters:
          - ReportingBucketName
          - DocumentSectionsCrawlerFrequency
      - Label:
          default: "Document Knowledge Base"
        Parameters:
          - DocumentKnowledgeBase
          - KnowledgeBaseVectorStore
          - KnowledgeBaseModelId
      - Label:
          default: "Post Processing"
        Parameters:
          - PostProcessingLambdaHookFunctionArn
      - Label:
          default: "Bedrock Guardrails"
        Parameters:
          - BedrockGuardrailId
          - BedrockGuardrailVersion
      - Label:
          default: "Security Configuration"
        Parameters:
          - PermissionsBoundaryArn
          - WAFAllowedIPv4Ranges
      - Label:
          default: "MCP Integration"
        Parameters:
          - EnableMCP
      - Label:
          default: "General Configuration"
        Parameters:
          - MaxConcurrentWorkflows
          - DataRetentionInDays
          - ErrorThreshold
          - ExecutionTimeThresholdMs
          - LogLevel
          - LogRetentionDays
          - CloudFrontPriceClass
          - CloudFrontAllowedGeos

    ParameterLabels:
      AdminEmail:
        default: "Admin Email Address"
      AllowedSignUpEmailDomain:
        default: "Allowed Sign Up Email Domain"
      IDPPattern:
        default: "Document Processing Pattern"
      Pattern1BDAProjectArn:
        default: "Pattern1 - Packet or Media processing with Bedrock Data Automation (BDA) Project ARN"
      Pattern2CustomClassificationModelARN:
        default: "Pattern2 - Custom Classification Model ARN"
      Pattern2CustomExtractionModelARN:
        default: "Pattern2 - Custom Extraction Model ARN"
      Pattern1Configuration:
        default: "Pattern1 - Configuration Preset"
      EnableHITL:
        default: "Enable Human In The Loop"
      ExistingPrivateWorkforceArn:
        default: "Existing Private Workforce ARN"
      Pattern2Configuration:
        default: "Pattern2 - Configuration Preset"
      Pattern3UDOPModelArtifactPath:
        default: "Pattern3 - UDOP Model Artifact Path"
      Pattern3Configuration:
        default: "Pattern3 - Configuration Preset"
      CustomConfigPath:
        default: "Custom Configuration Path"
      PostProcessingLambdaHookFunctionArn:
        default: "Post Processing Lambda Hook Function ARN"
      EvaluationBaselineBucketName:
        default: "Evaluation Baseline Bucket Name"
      EvaluationAutoEnabled:
        default: "Evaluation Auto Enabled"
      ReportingBucketName:
        default: "Reporting Bucket Name"
      DocumentKnowledgeBase:
        default: "Document Knowledge Base Configuration"
      KnowledgeBaseModelId:
        default: "Knowledge Base Model Id"
      BedrockGuardrailId:
        default: "Bedrock Guardrail Id"
      BedrockGuardrailVersion:
        default: "Bedrock Guardrail Version"
      PermissionsBoundaryArn:
        default: "Permissions Boundary ARN"
      MaxConcurrentWorkflows:
        default: "Maximum Concurrent Workflows"
      DataRetentionInDays:
        default: "Data Retention Period (days)"
      ErrorThreshold:
        default: "Error Alert Threshold"
      ExecutionTimeThresholdMs:
        default: "Execution Time Threshold (ms)"
      LogLevel:
        default: "Logging Level"
      LogRetentionDays:
        default: "Log Retention Period (days)"
      CloudFrontPriceClass:
        default: "CloudFront Price Class"
      CloudFrontAllowedGeos:
        default: "CloudFront Allowed Geos"
      WAFAllowedIPv4Ranges:
        default: "WAF Allowed IPv4 Ranges"
      EnableMCP:
        default: "Enable MCP Integration"

Resources:
  # Custom resource to enforce max length of StackName - prevent downstream failures
  StacknameCheckFunction:
    Type: AWS::Serverless::Function
    Metadata:
      cfn_nag:
        rules_to_suppress:
          - id: W89
            reason: Function does not require VPC access as it has no network access
          - id: W92
            reason: Reserved concurrency not required
    # checkov:skip=CKV_AWS_116: "DLQ not required for Cfn Custom Resource function"
    # checkov:skip=CKV_AWS_117: "Function does not require VPC access as it only interacts with AWS services via APIs"
    # checkov:skip=CKV_AWS_115: "Function does not require reserved concurrency as it scales based on demand"
    # checkov:skip=CKV_AWS_173: "Environment variables do not contain sensitive data - only configuration values like feature flags and non-sensitive settings"
    Properties:
      PermissionsBoundary:
        !If [
          HasPermissionsBoundary,
          !Ref PermissionsBoundaryArn,
          !Ref AWS::NoValue,
        ]
      Handler: index.handler
      Runtime: python3.12
      InlineCode: |
        import cfnresponse
        import time
        import json
        def handler(event, context):
            print(json.dumps(event))
            input = event['ResourceProperties'].get('InputString', '')
            max_length = int(event['ResourceProperties'].get('MaxLength', 0))
            status = cfnresponse.SUCCESS
            reason = f"Stack Name Length under {max_length} - OK"
            if event['RequestType'] == "Create":
              if len(input) > max_length:
                status = cfnresponse.FAILED
                reason = f"Stack Name ({input}) length ({len(input)}) too long - max length {max_length} - FAILED"
            else:
              print(f"Request type is {event['RequestType']} - skipping")
            cfnresponse.send(event, context, status, {}, reason=reason)
      Environment:
        Variables:
          LOG_LEVEL: INFO
      LoggingConfig:
        LogGroup:
          Ref: StacknameCheckFunctionLogGroup

  StacknameCheckFunctionLogGroup:
    Metadata:
      cfn_nag:
        rules_to_suppress:
          - id: W84
            reason: "LogGroup does not require KMS Key Id, since it's only logging checks on stack name length"
    # checkov:skip=CKV_AWS_158: "LogGroup does not require KMS Key Id, since it's only logging checks on stack name length"
    Type: AWS::Logs::LogGroup
    Properties:
      RetentionInDays: !Ref LogRetentionDays

  IsStacknameLengthOK:
    Type: Custom::StacknameCheck
    Properties:
      ServiceToken: !GetAtt StacknameCheckFunction.Arn
      InputString: !Ref "AWS::StackName"
      MaxLength: 25

  ConfigurationCopyFunction:
    Type: AWS::Serverless::Function
    Metadata:
      cfn_nag:
        rules_to_suppress:
          - id: W89
            reason: Function does not require VPC access as it only interacts with S3
          - id: W92
            reason: Reserved concurrency not required
    # checkov:skip=CKV_AWS_116: "DLQ not required for Cfn Custom Resource function"
    # checkov:skip=CKV_AWS_117: "Function does not require VPC access as it only interacts with AWS services via APIs"
    # checkov:skip=CKV_AWS_115: "Function does not require reserved concurrency as it scales based on demand"
    # checkov:skip=CKV_AWS_173: "Environment variables do not contain sensitive data - only configuration values like feature flags and non-sensitive settings"
    Properties:
      PermissionsBoundary:
        !If [
          HasPermissionsBoundary,
          !Ref PermissionsBoundaryArn,
          !Ref AWS::NoValue,
        ]
      Handler: index.handler
      Runtime: python3.12
      Timeout: 300
      InlineCode: |
        import boto3
        import cfnresponse
        import json
        import logging

        logger = logging.getLogger()
        logger.setLevel(logging.INFO)

        def handler(event, context):
            logger.info(json.dumps(event))
        
            try:
                source_bucket = event['ResourceProperties']['SourceBucket']
                source_prefix = event['ResourceProperties']['SourcePrefix']
                target_bucket = event['ResourceProperties']['TargetBucket']
                target_prefix = event['ResourceProperties'].get('TargetPrefix', '')
        
                file_list = event['ResourceProperties'].get('FileList', [])
        
                s3_client = boto3.client('s3')
        
                if event['RequestType'] == 'Create' or event['RequestType'] == 'Update':
                    # Copy files explicitly from the provided list
                    copied_count = 0
        
                    for relative_file_path in file_list:
                        # Skip empty entries
                        if not relative_file_path.strip():
                            continue
        
                        # Construct source key
                        source_key = f"{source_prefix}/{relative_file_path}"
        
                        # Construct target key with optional target prefix
                        if target_prefix:
                            target_key = f"{target_prefix}/{relative_file_path}"
                        else:
                            target_key = relative_file_path
        
                        logger.info(f"Copying {source_bucket}/{source_key} to {target_bucket}/{target_key}")
        
                        try:
                            copy_source = {'Bucket': source_bucket, 'Key': source_key}
                            s3_client.copy_object(
                                CopySource=copy_source,
                                Bucket=target_bucket,
                                Key=target_key
                            )
                            copied_count += 1
                        except Exception as copy_error:
                            logger.warning(f"Failed to copy {source_key}: {str(copy_error)}")
                            # Continue with other files instead of failing the entire operation
        
                    logger.info(f"Successfully copied {copied_count} configuration files")
                    cfnresponse.send(event, context, cfnresponse.SUCCESS, {
                        'CopiedFiles': copied_count
                    }, reason=f"Successfully copied {copied_count} configuration files")
        
                elif event['RequestType'] == 'Delete':
                    # For delete, we don't need to clean up the configuration files
                    # as they may be needed by other resources
                    logger.info("Delete request - no action needed for configuration files")
                    cfnresponse.send(event, context, cfnresponse.SUCCESS, {}, 
                                   reason="Delete completed - configuration files retained")
        
            except Exception as e:
                logger.error(f"Error: {str(e)}")
                cfnresponse.send(event, context, cfnresponse.FAILED, {}, 
                               reason=f"Error copying configuration files: {str(e)}")

      Environment:
        Variables:
          LOG_LEVEL: INFO
      LoggingConfig:
        LogGroup:
          Ref: ConfigurationCopyFunctionLogGroup
      Policies:
        - S3ReadPolicy:
            BucketName: "<ARTIFACT_BUCKET_TOKEN>"
        - S3WritePolicy:
            BucketName: !Ref ConfigurationBucket
        - Statement:
            - Effect: Allow
              Action:
                - kms:Encrypt
                - kms:Decrypt
                - kms:ReEncrypt*
                - kms:GenerateDataKey*
                - kms:DescribeKey
              Resource: !GetAtt CustomerManagedEncryptionKey.Arn

  ConfigurationCopyFunctionLogGroup:
    Type: AWS::Logs::LogGroup
    Properties:
      RetentionInDays: !Ref LogRetentionDays
      KmsKeyId: !GetAtt CustomerManagedEncryptionKey.Arn

  CopyConfigurationFiles:
    Type: Custom::ConfigurationCopy
    DependsOn:
      - ConfigurationBucket
    Properties:
      ServiceToken: !GetAtt ConfigurationCopyFunction.Arn
      SourceBucket: "<ARTIFACT_BUCKET_TOKEN>"
      SourcePrefix: "<ARTIFACT_PREFIX_TOKEN>/config_library"
      TargetBucket: !Ref ConfigurationBucket
      TargetPrefix: "config_library"
      ConfigLibraryHash: "<CONFIG_LIBRARY_HASH_TOKEN>"
      FileList: <CONFIG_FILES_LIST_TOKEN>

  ##########################################################################
  # Nested stack for selected options
  ##########################################################################

  BDASAMPLEPROJECT:
    DependsOn:
      - IsStacknameLengthOK
    Type: AWS::CloudFormation::Stack
    Condition: ShouldCreateBDASampleProject
    Properties:
      TemplateURL: ./options/bda-lending-project/.aws-sam/packaged.yaml
      Parameters:
        ProjectName: !Sub "${AWS::StackName}-BDA-Lending-Sample-Project"
        ProjectDescription: !Sub "${AWS::StackName}-BDA-Lending-Sample-Project"
        LogLevel: !Ref LogLevel
        PermissionsBoundaryArn: !Ref PermissionsBoundaryArn

  DOCUMENTKB:
    DependsOn:
      - IsStacknameLengthOK
    Type: AWS::CloudFormation::Stack
    Condition: ShouldCreateDocumentKnowledgeBase
    Properties:
      TemplateURL: ./options/bedrockkb/.aws-sam/packaged.yaml
      Parameters:
        pKnowledgeBaseBucketName: !Ref OutputBucket
        pInputDocumentUploadFolderPrefix: ""
        pS3SyncScheduleExpression: "cron(0/30 * ? * * *)" # default is to sync documents every 30 minutes
        pCustomerManagedEncryptionKeyArn: !GetAtt CustomerManagedEncryptionKey.Arn
        pChunkingStrategy: "Fixed-size chunking"
        pMaxTokens: 8192
        pVectorStoreType: !Ref KnowledgeBaseVectorStore
        LogLevel: !Ref LogLevel
        PermissionsBoundaryArn: !Ref PermissionsBoundaryArn



  ##########################################################################
  # AgentCore Analytics Lambda Function
  ##########################################################################

  AgentCoreAnalyticsLambdaLogGroup:
    Type: AWS::Logs::LogGroup
    Condition: CreateAgentCoreLambda
    Properties:
      KmsKeyId: !GetAtt CustomerManagedEncryptionKey.Arn
      RetentionInDays: !Ref LogRetentionDays

  AgentCoreAnalyticsLambdaFunction:
    Type: AWS::Serverless::Function
    Condition: CreateAgentCoreLambda
    Metadata:
      cfn_nag:
        rules_to_suppress:
          - id: W89
            reason: "Function does not require VPC access as it only interacts with AWS services via APIs"
          - id: W92
            reason: "Function does not require reserved concurrency as it scales based on demand"
    # checkov:skip=CKV_AWS_116: "DLQ not required for AgentCore analytics function"
    # checkov:skip=CKV_AWS_117: "Function does not require VPC access as it only interacts with AWS services via APIs"
    # checkov:skip=CKV_AWS_115: "Function does not require reserved concurrency as it scales based on demand"
    # checkov:skip=CKV_AWS_173: "Environment variables do not contain sensitive data - only configuration values like feature flags and non-sensitive settings"
    Properties:
      FunctionName: !Sub "${AWS::StackName}-agentcore-analytics"
      CodeUri: src/lambda/agentcore_analytics_processor/
      Handler: index.lambda_handler
      Runtime: python3.12
      MemorySize: 1024
      Timeout: 900
      Environment:
        Variables:
          LOG_LEVEL: !Ref LogLevel
          CONFIGURATION_TABLE_NAME: !Ref ConfigurationTable
          TRACKING_TABLE_NAME: !Ref TrackingTable
          LOOKUP_FUNCTION_NAME: !Ref LookupFunction
          STRANDS_LOG_LEVEL: !Ref LogLevel
          AGENT_TABLE: !Ref AgentTable
          APPSYNC_API_URL: !GetAtt GraphQLApi.GraphQLUrl
          ATHENA_DATABASE: !Ref ReportingDatabase
          ATHENA_WORKGROUP: primary
          QUERY_RESULTS_BUCKET: !If
            - ShouldCreateReportingBucket
            - !Ref ReportingBucket
            - !Ref ReportingBucketName
          ATHENA_OUTPUT_LOCATION: !Sub
            - "s3://${Bucket}/athena-results/"
            - Bucket: !If
                - ShouldCreateReportingBucket
                - !Ref ReportingBucket
                - !Ref ReportingBucketName
          AWS_STACK_NAME: !Ref AWS::StackName
          GUARDRAIL_ID_AND_VERSION:
            !If [
              HasGuardrailConfig,
              !Sub "${BedrockGuardrailId}:${BedrockGuardrailVersion}",
              "",
            ]
          CLOUDWATCH_LOG_GROUP_PREFIX: !Sub "/aws/lambda/${AWS::StackName}"
          CLOUDWATCH_LOG_GROUPS: !Join
            - ","
            - - !Ref QueueSenderLogGroup
              - !Ref QueueProcessorLogGroup
              - !Ref WorkflowTrackerLogGroup
              - !Ref SaveReportingDataFunctionLogGroup
              - !If
                - IsPattern1
                - !GetAtt PATTERN1STACK.Outputs.PatternLogGroups
                - !If
                  - IsPattern2
                  - !GetAtt PATTERN2STACK.Outputs.PatternLogGroups
                  - !GetAtt PATTERN3STACK.Outputs.PatternLogGroups
      LoggingConfig:
        LogGroup: !Ref AgentCoreAnalyticsLambdaLogGroup
      Policies:
        - Statement:
            Effect: Allow
            Action: bedrock-agentcore:InvokeAgentRuntime
            Resource: "*"
        - Statement:
            Effect: Allow
            Action: appsync:GraphQL
            Resource: !Sub "arn:${AWS::Partition}:appsync:${AWS::Region}:${AWS::AccountId}:apis/${GraphQLApi.ApiId}/*"
        - DynamoDBCrudPolicy:
            TableName: !Ref ChatMessagesTable
        - DynamoDBCrudPolicy:
            TableName: !Ref IdHelperChatMemoryTable
        - DynamoDBReadPolicy:
            TableName: !Ref ConfigurationTable
        - S3CrudPolicy:
            BucketName: !If
              - ShouldCreateReportingBucket
              - !Ref ReportingBucket
              - !Ref ReportingBucketName
        - Statement:
            - Effect: Allow
              Action:
                - athena:StartQueryExecution
                - athena:GetQueryExecution
                - athena:GetQueryResults
                - athena:StopQueryExecution
              Resource:
                - !Sub "arn:${AWS::Partition}:athena:${AWS::Region}:${AWS::AccountId}:workgroup/primary"
                - !Sub "arn:${AWS::Partition}:athena:${AWS::Region}:${AWS::AccountId}:datacatalog/*"
            - Effect: Allow
              Action:
                - s3:ListBucket
                - s3:GetBucketLocation
                - s3:GetBucketVersioning
                - s3:GetObject
                - s3:PutObject
                - s3:DeleteObject
                - s3:AbortMultipartUpload
                - s3:ListMultipartUploadParts
              Resource: !Sub
                - "${BucketArn}/*"
                - BucketArn: !If
                    - ShouldCreateReportingBucket
                    - !GetAtt ReportingBucket.Arn
                    - !Sub "arn:${AWS::Partition}:s3:::${ReportingBucketName}"
            - Effect: Allow
              Action:
                - glue:GetTable
                - glue:GetTables
                - glue:GetDatabase
                - glue:GetDatabases
                - glue:GetPartitions
              Resource:
                - !Sub "arn:${AWS::Partition}:glue:${AWS::Region}:${AWS::AccountId}:catalog"
                - !Sub "arn:${AWS::Partition}:glue:${AWS::Region}:${AWS::AccountId}:database/${ReportingDatabase}"
                - !Sub "arn:${AWS::Partition}:glue:${AWS::Region}:${AWS::AccountId}:table/${ReportingDatabase}/*"
            - Effect: Allow
              Action:
                - bedrock:InvokeModel
                - bedrock:InvokeModelWithResponseStream
              Resource:
                - !Sub "arn:${AWS::Partition}:bedrock:*::foundation-model/*"
                - !Sub "arn:${AWS::Partition}:bedrock:${AWS::Region}:${AWS::AccountId}:inference-profile/*"
            - Effect: Allow
              Action:
                - aws-marketplace:Subscribe
                - aws-marketplace:Unsubscribe
                - aws-marketplace:ViewSubscriptions
              Resource: "*"
            - !If
              - HasGuardrailConfig
              - Effect: Allow
                Action:
                  - "bedrock:ApplyGuardrail"
                Resource:
                  - !Sub "arn:${AWS::Partition}:bedrock:${AWS::Region}:${AWS::AccountId}:guardrail/${BedrockGuardrailId}"
              - !Ref AWS::NoValue
            - Effect: Allow
              Action:
                - appsync:GraphQL
              Resource:
                - !Sub "${GraphQLApi.Arn}/types/Mutation/*"
            - Effect: Allow
              Action:
                - kms:Encrypt
                - kms:Decrypt
                - kms:ReEncrypt*
                - kms:GenerateDataKey*
                - kms:DescribeKey
              Resource: !GetAtt CustomerManagedEncryptionKey.Arn
            - Effect: Allow
              Action:
                - bedrock-agentcore:StartCodeInterpreterSession
                - bedrock-agentcore:StopCodeInterpreterSession
                - bedrock-agentcore:InvokeCodeInterpreter
                - bedrock-agentcore:GetCodeInterpreterSession
                - bedrock-agentcore:ListCodeInterpreterSessions
              Resource:
                - !Sub "arn:${AWS::Partition}:bedrock-agentcore:*:aws:code-interpreter/*"
            - Effect: Allow
              Action:
                - secretsmanager:GetSecretValue
              Resource:
                - !Ref ExternalMCPAgentsSecret
            - Effect: Allow
              Action:
                - logs:DescribeLogGroups
                - logs:DescribeLogStreams
                - logs:FilterLogEvents
                - logs:GetLogEvents
              Resource:
                - !Sub "arn:${AWS::Partition}:logs:${AWS::Region}:${AWS::AccountId}:log-group:/aws/lambda/${AWS::StackName}*"
                - !Sub "arn:${AWS::Partition}:logs:${AWS::Region}:${AWS::AccountId}:log-group:/aws/vendedlogs/states/${AWS::StackName}*"
                - !Sub "arn:${AWS::Partition}:logs:${AWS::Region}:${AWS::AccountId}:log-group:/${AWS::StackName}*"
                - !GetAtt QueueSenderLogGroup.Arn
                - !GetAtt QueueProcessorLogGroup.Arn
                - !GetAtt WorkflowTrackerLogGroup.Arn
                - !GetAtt SaveReportingDataFunctionLogGroup.Arn
            - Effect: Allow
              Action:
                - logs:DescribeLogGroups
              Resource:
                - "*"
            - Effect: Allow
              Action:
                - dynamodb:DescribeTable
                - dynamodb:Scan
                - dynamodb:Query
                - dynamodb:GetItem
                - dynamodb:Query
              Resource:
                - !GetAtt TrackingTable.Arn
                - !GetAtt ConfigurationTable.Arn
                - !GetAtt AgentTable.Arn
            - Effect: Allow
              Action:
                - cloudformation:DescribeStackResources
                - cloudformation:DescribeStacks
              Resource:
                - !Sub "arn:${AWS::Partition}:cloudformation:${AWS::Region}:${AWS::AccountId}:stack/${AWS::StackName}/*"
            - Effect: Allow
              Action:
                - lambda:InvokeFunction
              Resource:
                - !Sub "arn:${AWS::Partition}:lambda:${AWS::Region}:${AWS::AccountId}:function:${AWS::StackName}*"
            - Effect: Allow
              Action:
                - states:DescribeExecution
                - states:GetExecutionHistory
              Resource:
                - !Sub "arn:${AWS::Partition}:states:${AWS::Region}:${AWS::AccountId}:execution:${AWS::StackName}*"

  ##########################################################################
  # AgentCore Gateway Manager Lambda Function
  ##########################################################################

  AgentCoreGatewayManagerFunction:
    Type: AWS::Serverless::Function
    Condition: CreateAgentCoreLambda
    Metadata:
      cfn_nag:
        rules_to_suppress:
          - id: W89
            reason: "Function does not require VPC access as it only interacts with AWS services via APIs"
          - id: W92
            reason: "Function does not require reserved concurrency as it scales based on demand"
    # checkov:skip=CKV_AWS_116: "DLQ not required for Cfn Custom Resource function"
    # checkov:skip=CKV_AWS_117: "Function does not require VPC access as it only interacts with AWS services via APIs"
    # checkov:skip=CKV_AWS_115: "Function does not require reserved concurrency as it scales based on demand"
    # checkov:skip=CKV_AWS_173: "Environment variables do not contain sensitive data - only configuration values like feature flags and non-sensitive settings"
    Properties:
      PermissionsBoundary:
        !If [
          HasPermissionsBoundary,
          !Ref PermissionsBoundaryArn,
          !Ref AWS::NoValue,
        ]
      CodeUri: src/lambda/agentcore_gateway_manager/
      Handler: index.handler
      Runtime: python3.12
      Timeout: 900
      MemorySize: 512
      Environment:
        Variables:
          LOG_LEVEL: !Ref LogLevel
      LoggingConfig:
        LogGroup: !Ref AgentCoreGatewayManagerLogGroup
      Policies:
        - Statement:
            - Effect: Allow
              Action:
                - bedrock-agent:*
                - bedrock-agentcore:*
                - bedrock-agentcore-control:*
                - logs:CreateLogGroup
                - logs:PutLogEvents
                - logs:DeleteLogGroup
                - logs:PutDeliverySource
                - logs:DeleteDeliverySource
                - logs:PutDeliveryDestination
                - logs:DeleteDeliveryDestination
                - logs:DescribeDeliveryDestinations
                - logs:DescribeDeliverySources
                - iam:PassRole
                - iam:CreateRole
                - iam:AttachRolePolicy
                - iam:GetRole
                - cognito-idp:DescribeUserPool
              Resource: "*"
            - Effect: Allow
              Action:
                - kms:Encrypt
                - kms:Decrypt
                - kms:ReEncrypt*
                - kms:GenerateDataKey*
                - kms:DescribeKey
              Resource: !GetAtt CustomerManagedEncryptionKey.Arn

  AgentCoreGatewayManagerLogGroup:
    Type: AWS::Logs::LogGroup
    Condition: CreateAgentCoreLambda
    Properties:
      KmsKeyId: !GetAtt CustomerManagedEncryptionKey.Arn
      RetentionInDays: !Ref LogRetentionDays

  AgentCoreGatewayExecutionRole:
    Type: AWS::IAM::Role
    Condition: CreateAgentCoreLambda
    Properties:
      RoleName: !Sub "${AWS::StackName}-AgentCoreGatewayExecutionRole"
      Description: Execution role for AgentCore Gateway
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Principal:
              Service: !Sub "bedrock-agentcore.${AWS::URLSuffix}"
            Action: sts:AssumeRole
            Condition:
              StringEquals:
                aws:SourceAccount: !Ref AWS::AccountId
              ArnLike:
                aws:SourceArn: !Sub "arn:${AWS::Partition}:bedrock-agentcore:${AWS::Region}:${AWS::AccountId}:*"
      Policies:
        - PolicyName: InvokeLambdaPolicy
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Effect: Allow
                Action: lambda:InvokeFunction
                Resource: !GetAtt AgentCoreAnalyticsLambdaFunction.Arn
      ManagedPolicyArns:
        - !Sub "arn:${AWS::Partition}:iam::aws:policy/CloudWatchLogsFullAccess"
      Tags:
        - Key: Name
          Value: !Sub "${AWS::StackName}-AgentCoreGatewayExecutionRole"

  AgentCoreGateway:
    Type: Custom::AgentCoreGateway
    Condition: CreateAgentCoreLambda
    DependsOn:
      - AgentCoreAnalyticsLambdaFunction
      - ExternalAppClient
      - UserPool
      - AgentCoreGatewayExecutionRole
    Properties:
      ServiceToken: !GetAtt AgentCoreGatewayManagerFunction.Arn
      StackName: !Ref AWS::StackName
      Region: !Ref AWS::Region
      LambdaArn: !GetAtt AgentCoreAnalyticsLambdaFunction.Arn
      UserPoolId: !Ref UserPool
      ClientId: !Ref ExternalAppClient
      ClientSecret: !GetAtt ExternalAppClient.ClientSecret
      ExecutionRoleArn: !GetAtt AgentCoreGatewayExecutionRole.Arn
      SourceCodeHash: <LAMBDA_HASH_TOKEN>

  ##########################################################################
  # Nested stack for selected pattern
  ##########################################################################

  PATTERN1STACK:
    DependsOn:
      - IsStacknameLengthOK
      - CopyConfigurationFiles
    Type: AWS::CloudFormation::Stack
    Condition: IsPattern1
    Properties:
      TemplateURL: ./patterns/pattern-1/.aws-sam/packaged.yaml
      Parameters:
        StackName: !Ref AWS::StackName
        InputBucket: !Ref InputBucket
        DiscoveryBucket: !Ref DiscoveryBucket
        ConfigurationQueueArn: !GetAtt ConfigurationQueue.Arn
        DiscoveryTrackingTable: !Ref DiscoveryTrackingTable
        ConfigurationBucket: !Ref ConfigurationBucket
        WorkingBucket: !Ref WorkingBucket
        OutputBucket: !Ref OutputBucket
        TrackingTable: !Ref TrackingTable
        CustomerManagedEncryptionKeyArn: !GetAtt CustomerManagedEncryptionKey.Arn
        LogRetentionDays: !Ref LogRetentionDays
        LogLevel: !Ref LogLevel
        ExecutionTimeThresholdMs: !Ref ExecutionTimeThresholdMs
        BedrockGuardrailId: !Ref BedrockGuardrailId
        BedrockGuardrailVersion: !Ref BedrockGuardrailVersion
        BDAProjectArn: !If
          - ShouldCreateBDASampleProject
          - !GetAtt BDASAMPLEPROJECT.Outputs.ProjectArn
          - !Ref Pattern1BDAProjectArn
        UpdateConfigurationFunctionArn: !GetAtt UpdateConfigurationFunction.Arn
        ConfigurationTable: !Ref ConfigurationTable
        AppSyncApiUrl: !GetAtt GraphQLApi.GraphQLUrl
        AppSyncApiArn: !GetAtt GraphQLApi.Arn
        EnableHITL: !Ref EnableHITL
        ConfigurationDefaultS3Uri: !If
          - HasCustomConfigPath
          - !Ref CustomConfigPath
          - !Sub
            - "s3://${ConfigurationBucket}/config_library/pattern-1/${ConfigPath}/config.yaml"
            - ConfigPath:
                !FindInMap [
                  Pattern1ConfigurationMap,
                  !Ref Pattern1Configuration,
                  ConfigPath,
                ]
        ConfigLibraryHash: "<CONFIG_LIBRARY_HASH_TOKEN>"
        EnableXRayTracing: !Ref EnableXRayTracing
        PermissionsBoundaryArn: !Ref PermissionsBoundaryArn
        SageMakerA2IReviewPortalURL: !If
          - IsHITLEnabled
          - !GetAtt WorkforceURLResource.PortalURL
          - ""
        ReportingBucket: !If
          - ShouldCreateReportingBucket
          - !Ref ReportingBucket
          - !Ref ReportingBucketName
        BaselineBucket: !If
          - ShouldCreateEvaluationBaselineBucket
          - !Ref EvaluationBaselineBucket
          - !Ref EvaluationBaselineBucketName
        SaveReportingFunctionName: !Ref SaveReportingDataFunction
        ImageVersion: "<PATTERN1_IMAGE_VERSION>"
        ArtifactBucket: "<ARTIFACT_BUCKET_TOKEN>"
        ArtifactPrefix: "<ARTIFACT_PREFIX_TOKEN>"
        SourceZipfile: "<PATTERN1_SOURCE_ZIPFILE_TOKEN>"
        EnableECRImageScanning: !Ref EnableECRImageScanning

  PATTERN2STACK:
    DependsOn:
      - IsStacknameLengthOK
      - CopyConfigurationFiles
      - GraphQLApi
    Type: AWS::CloudFormation::Stack
    Condition: IsPattern2
    Properties:
      TemplateURL: ./patterns/pattern-2/.aws-sam/packaged.yaml
      Parameters:
        StackName: !Ref AWS::StackName
        InputBucket: !Ref InputBucket
        ConfigurationBucket: !Ref ConfigurationBucket
        OutputBucket: !Ref OutputBucket
        WorkingBucket: !Ref WorkingBucket
        TrackingTable: !Ref TrackingTable
        CustomerManagedEncryptionKeyArn: !GetAtt CustomerManagedEncryptionKey.Arn
        LogRetentionDays: !Ref LogRetentionDays
        LogLevel: !Ref LogLevel
        ExecutionTimeThresholdMs: !Ref ExecutionTimeThresholdMs
        BedrockGuardrailId: !Ref BedrockGuardrailId
        BedrockGuardrailVersion: !Ref BedrockGuardrailVersion
        CustomClassificationModelARN: !Ref Pattern2CustomClassificationModelARN
        CustomExtractionModelARN: !Ref Pattern2CustomExtractionModelARN
        UpdateConfigurationFunctionArn: !GetAtt UpdateConfigurationFunction.Arn
        AppSyncApiUrl: !GetAtt GraphQLApi.GraphQLUrl
        AppSyncApiArn: !GetAtt GraphQLApi.Arn
        ConfigurationTable: !Ref ConfigurationTable
        ConfigurationDefaultS3Uri: !If
          - HasCustomConfigPath
          - !Ref CustomConfigPath
          - !Sub
            - "s3://${ConfigurationBucket}/config_library/pattern-2/${ConfigPath}/config.yaml"
            - ConfigPath:
                !FindInMap [
                  Pattern2ConfigurationMap,
                  !Ref Pattern2Configuration,
                  ConfigPath,
                ]
        ConfigLibraryHash: "<CONFIG_LIBRARY_HASH_TOKEN>"
        EnableHITL: !Ref EnableHITL
        SageMakerA2IReviewPortalURL: !If
          - IsHITLEnabled
          - !GetAtt WorkforceURLResource.PortalURL
          - ""
        EnableXRayTracing: !Ref EnableXRayTracing
        PermissionsBoundaryArn: !Ref PermissionsBoundaryArn
        ImageVersion: "<PATTERN2_IMAGE_VERSION>"
        ArtifactBucket: "<ARTIFACT_BUCKET_TOKEN>"
        ArtifactPrefix: "<ARTIFACT_PREFIX_TOKEN>"
        SourceZipfile: "<PATTERN2_SOURCE_ZIPFILE_TOKEN>"
        ReportingBucket: !If
          - ShouldCreateReportingBucket
          - !Ref ReportingBucket
          - !Ref ReportingBucketName
        BaselineBucket: !If
          - ShouldCreateEvaluationBaselineBucket
          - !Ref EvaluationBaselineBucket
          - !Ref EvaluationBaselineBucketName
        SaveReportingFunctionName: !Ref SaveReportingDataFunction
        EnableECRImageScanning: !Ref EnableECRImageScanning

  PATTERN3STACK:
    DependsOn:
      - IsStacknameLengthOK
      - CopyConfigurationFiles
    Type: AWS::CloudFormation::Stack
    Condition: IsPattern3
    Properties:
      # yamllint disable rule:line-length
      TemplateURL: ./patterns/pattern-3/.aws-sam/packaged.yaml
      Parameters:
        StackName: !Ref AWS::StackName
        InputBucket: !Ref InputBucket
        ConfigurationBucket: !Ref ConfigurationBucket
        OutputBucket: !Ref OutputBucket
        WorkingBucket: !Ref WorkingBucket
        TrackingTable: !Ref TrackingTable
        CustomerManagedEncryptionKeyArn: !GetAtt CustomerManagedEncryptionKey.Arn
        LogRetentionDays: !Ref LogRetentionDays
        LogLevel: !Ref LogLevel
        ExecutionTimeThresholdMs: !Ref ExecutionTimeThresholdMs
        BedrockGuardrailId: !Ref BedrockGuardrailId
        BedrockGuardrailVersion: !Ref BedrockGuardrailVersion
        UDOPModelArtifactPath: !Ref Pattern3UDOPModelArtifactPath
        UpdateConfigurationFunctionArn: !GetAtt UpdateConfigurationFunction.Arn
        AppSyncApiUrl: !GetAtt GraphQLApi.GraphQLUrl
        AppSyncApiArn: !GetAtt GraphQLApi.Arn
        ConfigurationTable: !Ref ConfigurationTable
        ConfigurationDefaultS3Uri: !If
          - HasCustomConfigPath
          - !Ref CustomConfigPath
          - !Sub
            - "s3://${ConfigurationBucket}/config_library/pattern-3/${ConfigPath}/config.yaml"
            - ConfigPath:
                !FindInMap [
                  Pattern3ConfigurationMap,
                  !Ref Pattern3Configuration,
                  ConfigPath,
                ]
        ConfigLibraryHash: "<CONFIG_LIBRARY_HASH_TOKEN>"
        EnableHITL: !Ref EnableHITL
        SageMakerA2IReviewPortalURL: !If
          - IsHITLEnabled
          - !GetAtt WorkforceURLResource.PortalURL
          - ""
        EnableXRayTracing: !Ref EnableXRayTracing
        PermissionsBoundaryArn: !Ref PermissionsBoundaryArn
        ReportingBucket: !If
          - ShouldCreateReportingBucket
          - !Ref ReportingBucket
          - !Ref ReportingBucketName
        BaselineBucket: !If
          - ShouldCreateEvaluationBaselineBucket
          - !Ref EvaluationBaselineBucket
          - !Ref EvaluationBaselineBucketName
        SaveReportingFunctionName: !Ref SaveReportingDataFunction
        ImageVersion: "<PATTERN3_IMAGE_VERSION>"
        ArtifactBucket: "<ARTIFACT_BUCKET_TOKEN>"
        ArtifactPrefix: "<ARTIFACT_PREFIX_TOKEN>"
        SourceZipfile: "<PATTERN3_SOURCE_ZIPFILE_TOKEN>"
        EnableECRImageScanning: !Ref EnableECRImageScanning

  ##########################################################################
  # Encryption key
  ##########################################################################

  CustomerManagedEncryptionKey:
    DependsOn:
      - IsStacknameLengthOK
    Type: AWS::KMS::Key
    Metadata:
      security-matrix:
        rules_to_suppress:
          - id: IAM-005
            reason: "No cross-account access - only same account root and AWS services"
          - id: KMS-007
            reason: "KMS monitoring not required for this IDP solution - comprehensive CloudWatch monitoring already in place"
          - id: KMS-002
            reason: "kms:* permission for account root is standard pattern for administrative access to KMS keys"
    Properties:
      Description: KMS key for DynamoDB encryption
      EnableKeyRotation: true
      KeyPolicy:
        Version: "2012-10-17"
        Statement:
          - Sid: Enable IAM User Permissions
            Effect: Allow
            Principal:
              AWS: !Sub "arn:${AWS::Partition}:iam::${AWS::AccountId}:root"
            Action: kms:*
            Resource: "*"
          - Sid: Allow lambda to access the Keys
            Effect: Allow
            Principal:
              AWS: !Sub "arn:${AWS::Partition}:iam::${AWS::AccountId}:root"
            Action:
              - kms:Encrypt
              - kms:Decrypt
              - kms:ReEncrypt*
              - kms:GenerateDataKey*
              - kms:DescribeKey
            Resource: "*"
          - Sid: Allow DynamoDB to use the key
            Effect: Allow
            Principal:
              Service: !Sub "dynamodb.${AWS::URLSuffix}"
            Action:
              - kms:Encrypt
              - kms:Decrypt
              - kms:ReEncrypt*
              - kms:GenerateDataKey*
              - kms:DescribeKey
            Resource: "*"
          - Sid: Allow CloudWatch Logs to use the key
            Effect: Allow
            Principal:
              Service: !Sub "logs.${AWS::URLSuffix}"
            Action:
              - kms:Encrypt
              - kms:Decrypt
              - kms:ReEncrypt*
              - kms:GenerateDataKey*
              - kms:DescribeKey
            Resource: "*"
          - !If
            - IsS3VectorsVectorStore
            - Sid: Allow S3 Vectors indexing service to use the key
              Effect: Allow
              Principal:
                Service: !Sub "indexing.s3vectors.${AWS::URLSuffix}"
              Action:
                - kms:Encrypt
                - kms:Decrypt
                - kms:ReEncrypt*
                - kms:GenerateDataKey*
                - kms:DescribeKey
              Resource: "*"
            - !Ref AWS::NoValue

  CustomerManagedEncryptionKeyAlias:
    Type: AWS::KMS::Alias
    Properties:
      AliasName: !Sub "alias/${AWS::StackName}-customer-encryption-key"
      TargetKeyId: !Ref CustomerManagedEncryptionKey

  ##########################################################################
  # S3 buckets for data processing, webUI static assets, and logging
  ##########################################################################

  LoggingBucket:
    DependsOn:
      - IsStacknameLengthOK
    Type: AWS::S3::Bucket
    Metadata:
      cfn_nag:
        rules_to_suppress:
          - id: W35
            reason: "This is the logging destination bucket - does not require its own access logging"
      security-matrix:
        rules_to_suppress:
          - id: S3-001
            reason: "This is the logging destination bucket - does not require its own access logging"
    # checkov:skip=CKV_AWS_18: "This is the logging destination bucket - does not require its own access logging"
    DeletionPolicy: Retain
    Properties:
      BucketEncryption:
        ServerSideEncryptionConfiguration:
          - ServerSideEncryptionByDefault:
              SSEAlgorithm: AES256
      # see https://stackoverflow.com/questions/70645117/enable-s3-acl-access-for-cloudfront-logs
      # for configuration required by CloudFront logging
      PublicAccessBlockConfiguration:
        BlockPublicAcls: true
        BlockPublicPolicy: true
        IgnorePublicAcls: true
        RestrictPublicBuckets: true
      OwnershipControls:
        Rules:
          - ObjectOwnership: BucketOwnerPreferred # to enable CloudFront to write logs
      VersioningConfiguration:
        Status: Enabled
      LifecycleConfiguration:
        Rules:
          - Id: DeleteOldLogs
            Status: Enabled
            ExpirationInDays: 180
            Prefix: "" # Applies to all objects in the bucket
            AbortIncompleteMultipartUpload:
              DaysAfterInitiation: 7

  LoggingBucketPolicy:
    Type: AWS::S3::BucketPolicy
    Metadata:
      security-matrix:
        rules_to_suppress:
          - id: IAM-005
            reason: "Already has aws:SourceAccount condition for confused deputy prevention"
    Properties:
      Bucket: !Ref LoggingBucket
      PolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Sid: AllowS3ServerAccessLogs
            Effect: Allow
            Principal:
              Service: !Sub "logging.s3.${AWS::URLSuffix}"
            Action:
              - s3:PutObject
            Resource: !Sub "${LoggingBucket.Arn}/*"
            Condition:
              StringEquals:
                "aws:SourceAccount": !Ref "AWS::AccountId"
          - Sid: AllowCloudFrontLogs
            Effect: Allow
            Principal:
              Service: !Sub "cloudfront.${AWS::URLSuffix}"
            Action:
              - s3:PutObject
            Resource: !Sub "${LoggingBucket.Arn}/*"
            Condition:
              StringEquals:
                "AWS:SourceAccount": !Ref "AWS::AccountId"
          - Sid: EnforceSSLOnly
            Effect: Deny
            Principal: "*"
            Action: "s3:*"
            Resource:
              - !Sub "${LoggingBucket.Arn}/*"
              - !Sub "${LoggingBucket.Arn}"
            Condition:
              Bool:
                "aws:SecureTransport": false

  DiscoveryBucket:
    Type: AWS::S3::Bucket
    DeletionPolicy: RetainExceptOnCreate
    Properties:
      NotificationConfiguration:
        EventBridgeConfiguration:
          EventBridgeEnabled: true
      CorsConfiguration:
        CorsRules:
          - AllowedHeaders:
              - "Content-Type"
              - "x-amz-content-sha256"
              - "x-amz-date"
              - "Authorization"
              - "x-amz-security-token"
            AllowedMethods:
              - PUT
              - POST
            AllowedOrigins:
              - !Sub "https://${CloudFrontDistribution.DomainName}"
              # For local development only
              - "http://localhost:3000"
            ExposedHeaders:
              - "ETag"
              - "x-amz-server-side-encryption"
            MaxAge: 3000
      BucketEncryption:
        ServerSideEncryptionConfiguration:
          - ServerSideEncryptionByDefault:
              SSEAlgorithm: aws:kms
              KMSMasterKeyID: !Ref CustomerManagedEncryptionKey
      PublicAccessBlockConfiguration:
        BlockPublicAcls: true
        BlockPublicPolicy: true
        IgnorePublicAcls: true
        RestrictPublicBuckets: true
      VersioningConfiguration:
        Status: Enabled
      LoggingConfiguration:
        DestinationBucketName: !Ref LoggingBucket
        LogFilePrefix: discov-bucket-logs/
      LifecycleConfiguration:
        Rules:
          - Id: DeleteAfterNDays
            Status: Enabled
            ExpirationInDays: !Ref DataRetentionInDays
            AbortIncompleteMultipartUpload:
              DaysAfterInitiation: 1

  DiscoveryBucketPolicy:
    Type: AWS::S3::BucketPolicy
    Properties:
      Bucket: !Ref DiscoveryBucket
      PolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Sid: EnforceSSLOnly
            Effect: Deny
            Principal: "*"
            Action: "s3:*"
            Resource:
              - !Sub "${DiscoveryBucket.Arn}/*"
              - !Sub "${DiscoveryBucket.Arn}"
            Condition:
              Bool:
                "aws:SecureTransport": false

  InputBucket:
    Type: AWS::S3::Bucket
    DeletionPolicy: RetainExceptOnCreate
    Properties:
      NotificationConfiguration:
        EventBridgeConfiguration:
          EventBridgeEnabled: true
      CorsConfiguration:
        CorsRules:
          - AllowedHeaders:
              - "Content-Type"
              - "x-amz-content-sha256"
              - "x-amz-date"
              - "Authorization"
              - "x-amz-security-token"
            AllowedMethods:
              - PUT
              - POST
            AllowedOrigins:
              - !Sub "https://${CloudFrontDistribution.DomainName}"
              # For local development only
              - "http://localhost:3000"
            ExposedHeaders:
              - "ETag"
              - "x-amz-server-side-encryption"
            MaxAge: 3000
      BucketEncryption:
        ServerSideEncryptionConfiguration:
          - ServerSideEncryptionByDefault:
              SSEAlgorithm: aws:kms
              KMSMasterKeyID: !Ref CustomerManagedEncryptionKey
      PublicAccessBlockConfiguration:
        BlockPublicAcls: true
        BlockPublicPolicy: true
        IgnorePublicAcls: true
        RestrictPublicBuckets: true
      VersioningConfiguration:
        Status: Enabled
      LoggingConfiguration:
        DestinationBucketName: !Ref LoggingBucket
        LogFilePrefix: input-bucket-logs/
      LifecycleConfiguration:
        Rules:
          - Id: DeleteAfterNDays
            Status: Enabled
            ExpirationInDays: !Ref DataRetentionInDays
            AbortIncompleteMultipartUpload:
              DaysAfterInitiation: 1

  InputBucketPolicy:
    Type: AWS::S3::BucketPolicy
    Properties:
      Bucket: !Ref InputBucket
      PolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Sid: EnforceSSLOnly
            Effect: Deny
            Principal: "*"
            Action: "s3:*"
            Resource:
              - !Sub "${InputBucket.Arn}/*"
              - !Sub "${InputBucket.Arn}"
            Condition:
              Bool:
                "aws:SecureTransport": false

  TestSetBucket:
    Type: AWS::S3::Bucket
    DeletionPolicy: RetainExceptOnCreate
    Properties:
      CorsConfiguration:
        CorsRules:
          - AllowedHeaders:
              - "Content-Type"
              - "x-amz-content-sha256"
              - "x-amz-date"
              - "Authorization"
              - "x-amz-security-token"
            AllowedMethods:
              - PUT
              - POST
            AllowedOrigins:
              - !Sub "https://${CloudFrontDistribution.DomainName}"
              # For local development only
              - "http://localhost:3000"
            ExposedHeaders:
              - "ETag"
              - "x-amz-server-side-encryption"
            MaxAge: 3000
      BucketEncryption:
        ServerSideEncryptionConfiguration:
          - ServerSideEncryptionByDefault:
              SSEAlgorithm: aws:kms
              KMSMasterKeyID: !Ref CustomerManagedEncryptionKey
      PublicAccessBlockConfiguration:
        BlockPublicAcls: true
        BlockPublicPolicy: true
        IgnorePublicAcls: true
        RestrictPublicBuckets: true
      VersioningConfiguration:
        Status: Enabled
      LoggingConfiguration:
        DestinationBucketName: !Ref LoggingBucket
        LogFilePrefix: test-set-bucket-logs/
      LifecycleConfiguration:
        Rules:
          - Id: DeleteAfterNDays
            Status: Enabled
            ExpirationInDays: !Ref DataRetentionInDays
            AbortIncompleteMultipartUpload:
              DaysAfterInitiation: 1

  TestSetBucketPolicy:
    Type: AWS::S3::BucketPolicy
    Properties:
      Bucket: !Ref TestSetBucket
      PolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Sid: EnforceSSLOnly
            Effect: Deny
            Principal: "*"
            Action: "s3:*"
            Resource:
              - !Sub "${TestSetBucket.Arn}/*"
              - !Sub "${TestSetBucket.Arn}"
            Condition:
              Bool:
                "aws:SecureTransport": false

  ##########################################################################
  # FCC Dataset Deployer - Automatically deploys RealKIE-FCC-Verified dataset
  ##########################################################################

  FccDatasetDeployerLogGroup:
    Type: AWS::Logs::LogGroup
    Properties:
      KmsKeyId: !GetAtt CustomerManagedEncryptionKey.Arn
      RetentionInDays: !Ref LogRetentionDays

  FccDatasetDeployerFunction:
    Type: AWS::Serverless::Function
    Metadata:
      cfn_nag:
        rules_to_suppress:
          - id: W89
            reason: "Function does not require VPC access as it only interacts with AWS services via APIs"
          - id: W92
            reason: "Function does not require reserved concurrency as it scales based on demand"
    # checkov:skip=CKV_AWS_116: "DLQ not required for Cfn Custom Resource function"
    # checkov:skip=CKV_AWS_117: "Function does not require VPC access as it only interacts with AWS services via APIs"
    # checkov:skip=CKV_AWS_115: "Function does not require reserved concurrency as it scales based on demand"
    # checkov:skip=CKV_AWS_173: "Environment variables do not contain sensitive data - only configuration values like feature flags and non-sensitive settings"
    Properties:
      PermissionsBoundary:
        !If [
          HasPermissionsBoundary,
          !Ref PermissionsBoundaryArn,
          !Ref AWS::NoValue,
        ]
      FunctionName: !Sub "${AWS::StackName}-FccDatasetDeployer"
      CodeUri: src/lambda/fcc_dataset_deployer/
      Handler: index.handler
      Runtime: python3.12
      Timeout: 900
      MemorySize: 2048
      LoggingConfig:
        LogGroup: !Ref FccDatasetDeployerLogGroup
      Environment:
        Variables:
          LOG_LEVEL: !Ref LogLevel
          TESTSET_BUCKET: !Ref TestSetBucket
          TRACKING_TABLE: !Ref TrackingTable
      Policies:
        - S3CrudPolicy:
            BucketName: !Ref TestSetBucket
        - DynamoDBCrudPolicy:
            TableName: !Ref TrackingTable
        - Statement:
            - Effect: Allow
              Action:
                - kms:Encrypt
                - kms:Decrypt
                - kms:ReEncrypt*
                - kms:GenerateDataKey*
                - kms:DescribeKey
              Resource: !GetAtt CustomerManagedEncryptionKey.Arn

  FccDatasetDeployment:
    Type: Custom::FccDatasetDeployer
    DependsOn:
      - TestSetBucket
      - TrackingTable
      - FccDatasetDeployerFunction
    Properties:
      ServiceToken: !GetAtt FccDatasetDeployerFunction.Arn
      DatasetVersion: "1.0"
      DatasetName: "RealKIE-FCC-Verified"
      DatasetDescription: "Test set with single and multi-page invoices sourced from the Federal Communications Commission (FCC) to evaluate extraction performance."
      SourceCodeHash: <FCC_DATASET_DEPLOYER_HASH_TOKEN>

  ConfigurationBucket:
    Type: AWS::S3::Bucket
    DeletionPolicy: Retain
    Properties:
      NotificationConfiguration:
        EventBridgeConfiguration:
          EventBridgeEnabled: true
      CorsConfiguration:
        CorsRules:
          - AllowedHeaders:
              - "Content-Type"
              - "x-amz-content-sha256"
              - "x-amz-date"
              - "Authorization"
              - "x-amz-security-token"
            AllowedMethods:
              - PUT
              - POST
            AllowedOrigins:
              - !Sub "https://${CloudFrontDistribution.DomainName}"
              # For local development only
              - "http://localhost:3000"
            ExposedHeaders:
              - "ETag"
              - "x-amz-server-side-encryption"
            MaxAge: 3000
      BucketEncryption:
        ServerSideEncryptionConfiguration:
          - ServerSideEncryptionByDefault:
              SSEAlgorithm: aws:kms
              KMSMasterKeyID: !Ref CustomerManagedEncryptionKey
      PublicAccessBlockConfiguration:
        BlockPublicAcls: true
        BlockPublicPolicy: true
        IgnorePublicAcls: true
        RestrictPublicBuckets: true
      VersioningConfiguration:
        Status: Enabled
      LoggingConfiguration:
        DestinationBucketName: !Ref LoggingBucket
        LogFilePrefix: input-bucket-logs/
      LifecycleConfiguration:
        Rules:
          - Id: DeleteAfterNDays
            Status: Enabled
            ExpirationInDays: !Ref DataRetentionInDays
            AbortIncompleteMultipartUpload:
              DaysAfterInitiation: 1

  ConfigurationBucketPolicy:
    Type: AWS::S3::BucketPolicy
    Properties:
      Bucket: !Ref ConfigurationBucket
      PolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Sid: EnforceSSLOnly
            Effect: Deny
            Principal: "*"
            Action: "s3:*"
            Resource:
              - !Sub "${ConfigurationBucket.Arn}/*"
              - !Sub "${ConfigurationBucket.Arn}"
            Condition:
              Bool:
                "aws:SecureTransport": false

  WorkingBucket:
    Type: AWS::S3::Bucket
    DeletionPolicy: RetainExceptOnCreate
    Properties:
      BucketEncryption:
        ServerSideEncryptionConfiguration:
          - ServerSideEncryptionByDefault:
              SSEAlgorithm: aws:kms
              KMSMasterKeyID: !Ref CustomerManagedEncryptionKey
      PublicAccessBlockConfiguration:
        BlockPublicAcls: true
        BlockPublicPolicy: true
        IgnorePublicAcls: true
        RestrictPublicBuckets: true
      VersioningConfiguration:
        Status: Enabled
      LoggingConfiguration:
        DestinationBucketName: !Ref LoggingBucket
        LogFilePrefix: working-bucket-logs/
      LifecycleConfiguration:
        Rules:
          - Id: DeleteAfterNDays
            Status: Enabled
            # Since bucket is for intermediate storage only, use log retention rather than data retention period
            ExpirationInDays: !Ref LogRetentionDays
            AbortIncompleteMultipartUpload:
              DaysAfterInitiation: 1

  WorkingBucketPolicy:
    Type: AWS::S3::BucketPolicy
    Properties:
      Bucket: !Ref WorkingBucket
      PolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Sid: EnforceSSLOnly
            Effect: Deny
            Principal: "*"
            Action: "s3:*"
            Resource:
              - !Sub "${WorkingBucket.Arn}/*"
              - !Sub "${WorkingBucket.Arn}"
            Condition:
              Bool:
                "aws:SecureTransport": false

  OutputBucket:
    Type: AWS::S3::Bucket
    DeletionPolicy: RetainExceptOnCreate
    Properties:
      CorsConfiguration:
        CorsRules:
          - AllowedHeaders:
              - "Content-Type"
              - "x-amz-content-sha256"
              - "x-amz-date"
              - "Authorization"
              - "x-amz-security-token"
            AllowedMethods:
              - PUT
              - POST
            AllowedOrigins:
              - !Sub "https://${CloudFrontDistribution.DomainName}"
              # For local development only
              - "http://localhost:3000"
            ExposedHeaders:
              - "ETag"
              - "x-amz-server-side-encryption"
            MaxAge: 3000
      BucketEncryption:
        ServerSideEncryptionConfiguration:
          - ServerSideEncryptionByDefault:
              SSEAlgorithm: aws:kms
              KMSMasterKeyID: !Ref CustomerManagedEncryptionKey
      PublicAccessBlockConfiguration:
        BlockPublicAcls: true
        BlockPublicPolicy: true
        IgnorePublicAcls: true
        RestrictPublicBuckets: true
      VersioningConfiguration:
        Status: Enabled
      LoggingConfiguration:
        DestinationBucketName: !Ref LoggingBucket
        LogFilePrefix: output-bucket-logs/
      LifecycleConfiguration:
        Rules:
          - Id: DeleteAfterNDays
            Status: Enabled
            ExpirationInDays: !Ref DataRetentionInDays
            AbortIncompleteMultipartUpload:
              DaysAfterInitiation: 1

  OutputBucketPolicy:
    Type: AWS::S3::BucketPolicy
    Properties:
      Bucket: !Ref OutputBucket
      PolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Sid: EnforceSSLOnly
            Effect: Deny
            Principal: "*"
            Action: "s3:*"
            Resource:
              - !Sub "${OutputBucket.Arn}/*"
              - !Sub "${OutputBucket.Arn}"
            Condition:
              Bool:
                "aws:SecureTransport": false

  ReportingBucket:
    Type: AWS::S3::Bucket
    Condition: ShouldCreateReportingBucket
    DeletionPolicy: RetainExceptOnCreate
    Properties:
      CorsConfiguration:
        CorsRules:
          - AllowedHeaders:
              - "Content-Type"
              - "x-amz-content-sha256"
              - "x-amz-date"
              - "Authorization"
              - "x-amz-security-token"
            AllowedMethods:
              - PUT
              - POST
            AllowedOrigins:
              - !Sub "https://${CloudFrontDistribution.DomainName}"
              # For local development only
              - "http://localhost:3000"
            ExposedHeaders:
              - "ETag"
              - "x-amz-server-side-encryption"
            MaxAge: 3000
      BucketEncryption:
        ServerSideEncryptionConfiguration:
          - ServerSideEncryptionByDefault:
              SSEAlgorithm: aws:kms
              KMSMasterKeyID: !Ref CustomerManagedEncryptionKey
      PublicAccessBlockConfiguration:
        BlockPublicAcls: true
        BlockPublicPolicy: true
        IgnorePublicAcls: true
        RestrictPublicBuckets: true
      VersioningConfiguration:
        Status: Enabled
      LoggingConfiguration:
        DestinationBucketName: !Ref LoggingBucket
        LogFilePrefix: reporting-bucket-logs/
      LifecycleConfiguration:
        Rules:
          - Id: DeleteAfterNDays
            Status: Enabled
            ExpirationInDays: !Ref DataRetentionInDays
            AbortIncompleteMultipartUpload:
              DaysAfterInitiation: 1

  ReportingBucketPolicy:
    Type: AWS::S3::BucketPolicy
    Condition: ShouldCreateReportingBucket
    Properties:
      Bucket: !Ref ReportingBucket
      PolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Sid: EnforceSSLOnly
            Effect: Deny
            Principal: "*"
            Action: "s3:*"
            Resource:
              - !Sub "${ReportingBucket.Arn}/*"
              - !Sub "${ReportingBucket.Arn}"
            Condition:
              Bool:
                "aws:SecureTransport": false

  GetLowercase:
    Type: Custom::GetLowercase
    Properties:
      ServiceToken: !GetAtt GetDomainLambda.Arn
      InputString: !Ref AWS::StackName

  ReportingDatabase:
    Type: AWS::Glue::Database
    Properties:
      CatalogId: !Ref AWS::AccountId
      DatabaseInput:
        Name: !Sub "${GetLowercase.Lowercase}-reporting-db"
        Description: "Database for evaluation results"

  DocumentEvaluationsTable:
    Type: AWS::Glue::Table
    Properties:
      CatalogId: !Ref AWS::AccountId
      DatabaseName: !Ref ReportingDatabase
      TableInput:
        Name: "document_evaluations"
        Description: "Table for document-level evaluation metrics"
        TableType: "EXTERNAL_TABLE"
        Parameters:
          classification: "parquet"
          typeOfData: "file"
          projection.enabled: "true"
          projection.date.type: "date"
          projection.date.format: "yyyy-MM-dd"
          projection.date.range: "2024-01-01,2030-12-31"
          projection.date.interval: "1"
          projection.date.interval.unit: "DAYS"
          storage.location.template: !Sub
            - "s3://${Bucket}/evaluation_metrics/document_metrics/date=${date}/"
            - Bucket: !If
                - ShouldCreateReportingBucket
                - !Ref ReportingBucket
                - !Ref ReportingBucketName
              date: "${date}"
        StorageDescriptor:
          Location: !Sub
            - "s3://${Bucket}/evaluation_metrics/document_metrics/"
            - Bucket: !If
                - ShouldCreateReportingBucket
                - !Ref ReportingBucket
                - !Ref ReportingBucketName
          InputFormat: "org.apache.hadoop.hive.ql.io.parquet.MapredParquetInputFormat"
          OutputFormat: "org.apache.hadoop.hive.ql.io.parquet.MapredParquetOutputFormat"
          SerdeInfo:
            SerializationLibrary: "org.apache.hadoop.hive.ql.io.parquet.serde.ParquetHiveSerDe"
          Columns:
            - Name: document_id
              Type: string
            - Name: input_key
              Type: string
            - Name: evaluation_date
              Type: timestamp
            - Name: accuracy
              Type: double
            - Name: precision
              Type: double
            - Name: recall
              Type: double
            - Name: f1_score
              Type: double
            - Name: false_alarm_rate
              Type: double
            - Name: false_discovery_rate
              Type: double
            - Name: weighted_overall_score
              Type: double
            - Name: execution_time
              Type: double
            - Name: page_level_accuracy
              Type: double
            - Name: split_accuracy_without_order
              Type: double
            - Name: split_accuracy_with_order
              Type: double
            - Name: total_pages
              Type: int
            - Name: total_splits
              Type: int
            - Name: correctly_classified_pages
              Type: int
            - Name: correctly_split_without_order
              Type: int
            - Name: correctly_split_with_order
              Type: int
          Compressed: true
        PartitionKeys:
          - Name: date
            Type: string

  SectionEvaluationsTable:
    Type: AWS::Glue::Table
    Properties:
      CatalogId: !Ref AWS::AccountId
      DatabaseName: !Ref ReportingDatabase
      TableInput:
        Name: "section_evaluations"
        Description: "Table for section-level evaluation metrics"
        TableType: "EXTERNAL_TABLE"
        Parameters:
          classification: "parquet"
          typeOfData: "file"
          projection.enabled: "true"
          projection.date.type: "date"
          projection.date.format: "yyyy-MM-dd"
          projection.date.range: "2024-01-01,2030-12-31"
          projection.date.interval: "1"
          projection.date.interval.unit: "DAYS"
          storage.location.template: !Sub
            - "s3://${Bucket}/evaluation_metrics/section_metrics/date=${date}/"
            - Bucket: !If
                - ShouldCreateReportingBucket
                - !Ref ReportingBucket
                - !Ref ReportingBucketName
              date: "${date}"
        StorageDescriptor:
          Location: !Sub
            - "s3://${Bucket}/evaluation_metrics/section_metrics/"
            - Bucket: !If
                - ShouldCreateReportingBucket
                - !Ref ReportingBucket
                - !Ref ReportingBucketName
          InputFormat: "org.apache.hadoop.hive.ql.io.parquet.MapredParquetInputFormat"
          OutputFormat: "org.apache.hadoop.hive.ql.io.parquet.MapredParquetOutputFormat"
          SerdeInfo:
            SerializationLibrary: "org.apache.hadoop.hive.ql.io.parquet.serde.ParquetHiveSerDe"
          Columns:
            - Name: document_id
              Type: string
            - Name: section_id
              Type: string
            - Name: section_type
              Type: string
            - Name: accuracy
              Type: double
            - Name: precision
              Type: double
            - Name: recall
              Type: double
            - Name: f1_score
              Type: double
            - Name: false_alarm_rate
              Type: double
            - Name: false_discovery_rate
              Type: double
            - Name: weighted_overall_score
              Type: double
            - Name: evaluation_date
              Type: timestamp
          Compressed: true
        PartitionKeys:
          - Name: date
            Type: string

  AttributeEvaluationsTable:
    Type: AWS::Glue::Table
    Properties:
      CatalogId: !Ref AWS::AccountId
      DatabaseName: !Ref ReportingDatabase
      TableInput:
        Name: "attribute_evaluations"
        Description: "Table for attribute-level evaluation metrics"
        TableType: "EXTERNAL_TABLE"
        Parameters:
          classification: "parquet"
          typeOfData: "file"
          projection.enabled: "true"
          projection.date.type: "date"
          projection.date.format: "yyyy-MM-dd"
          projection.date.range: "2024-01-01,2030-12-31"
          projection.date.interval: "1"
          projection.date.interval.unit: "DAYS"
          storage.location.template: !Sub
            - "s3://${Bucket}/evaluation_metrics/attribute_metrics/date=${date}/"
            - Bucket: !If
                - ShouldCreateReportingBucket
                - !Ref ReportingBucket
                - !Ref ReportingBucketName
              date: "${date}"
        StorageDescriptor:
          Location: !Sub
            - "s3://${Bucket}/evaluation_metrics/attribute_metrics/"
            - Bucket: !If
                - ShouldCreateReportingBucket
                - !Ref ReportingBucket
                - !Ref ReportingBucketName
          InputFormat: "org.apache.hadoop.hive.ql.io.parquet.MapredParquetInputFormat"
          OutputFormat: "org.apache.hadoop.hive.ql.io.parquet.MapredParquetOutputFormat"
          SerdeInfo:
            SerializationLibrary: "org.apache.hadoop.hive.ql.io.parquet.serde.ParquetHiveSerDe"
          Columns:
            - Name: document_id
              Type: string
            - Name: section_id
              Type: string
            - Name: section_type
              Type: string
            - Name: attribute_name
              Type: string
            - Name: expected
              Type: string
            - Name: actual
              Type: string
            - Name: matched
              Type: boolean
            - Name: score
              Type: double
            - Name: reason
              Type: string
            - Name: evaluation_method
              Type: string
            - Name: confidence
              Type: string
            - Name: confidence_threshold
              Type: string
            - Name: weight
              Type: double
            - Name: evaluation_date
              Type: timestamp
          Compressed: true
        PartitionKeys:
          - Name: date
            Type: string

  MeteringTable:
    Type: AWS::Glue::Table
    Properties:
      CatalogId: !Ref AWS::AccountId
      DatabaseName: !Ref ReportingDatabase
      TableInput:
        Name: "metering"
        Description: "Table for document metering data"
        TableType: "EXTERNAL_TABLE"
        Parameters:
          classification: "parquet"
          typeOfData: "file"
          projection.enabled: "true"
          projection.date.type: "date"
          projection.date.format: "yyyy-MM-dd"
          projection.date.range: "2024-01-01,2030-12-31"
          projection.date.interval: "1"
          projection.date.interval.unit: "DAYS"
          storage.location.template: !Sub
            - "s3://${Bucket}/metering/date=${date}/"
            - Bucket: !If
                - ShouldCreateReportingBucket
                - !Ref ReportingBucket
                - !Ref ReportingBucketName
              date: "${date}"
        StorageDescriptor:
          Location: !Sub
            - "s3://${Bucket}/metering/"
            - Bucket: !If
                - ShouldCreateReportingBucket
                - !Ref ReportingBucket
                - !Ref ReportingBucketName
          InputFormat: "org.apache.hadoop.hive.ql.io.parquet.MapredParquetInputFormat"
          OutputFormat: "org.apache.hadoop.hive.ql.io.parquet.MapredParquetOutputFormat"
          SerdeInfo:
            SerializationLibrary: "org.apache.hadoop.hive.ql.io.parquet.serde.ParquetHiveSerDe"
          Columns:
            - Name: document_id
              Type: string
            - Name: context
              Type: string
            - Name: service_api
              Type: string
            - Name: unit
              Type: string
            - Name: value
              Type: double
            - Name: number_of_pages
              Type: int
            - Name: unit_cost
              Type: double
            - Name: estimated_cost
              Type: double
            - Name: timestamp
              Type: timestamp
          Compressed: true
        PartitionKeys:
          - Name: date
            Type: string

  DocumentSectionsCrawlerSecurityConfigurationV2:
    Type: AWS::Glue::SecurityConfiguration
    # checkov:skip=CKV_AWS_99:Encryption is already enabled with SSE-KMS
    Properties:
      Name: !Sub "${AWS::StackName}-document-sections-crawler-security-config-v2"
      EncryptionConfiguration:
        S3Encryptions:
          - S3EncryptionMode: SSE-KMS
            KmsKeyArn: !GetAtt CustomerManagedEncryptionKey.Arn

  DocumentSectionsCrawler:
    Type: AWS::Glue::Crawler
    Properties:
      Name: !Sub "${AWS::StackName}-document-sections-crawler"
      Description: "Crawler to discover document section tables in the reporting bucket with conservative schema handling"
      Role: !GetAtt DocumentSectionsCrawlerRole.Arn
      DatabaseName: !Ref ReportingDatabase
      CrawlerSecurityConfiguration: !Ref DocumentSectionsCrawlerSecurityConfigurationV2
      Targets:
        S3Targets:
          - Path: !Sub
              - "s3://${Bucket}/document_sections/"
              - Bucket: !If
                  - ShouldCreateReportingBucket
                  - !Ref ReportingBucket
                  - !Ref ReportingBucketName
      SchemaChangePolicy:
        UpdateBehavior: "UPDATE_IN_DATABASE"
        DeleteBehavior: "LOG"
      TablePrefix: "document_sections_"
      Configuration: |
        {
          "Version": 1.0,
          "CrawlerOutput": {
            "Partitions": { "AddOrUpdateBehavior": "InheritFromTable" },
            "Tables": { "AddOrUpdateBehavior": "MergeNewColumns" }
          },
          "Grouping": { "TableLevelConfiguration": 3 },
          "CreatePartitionIndex": true
        }
      Schedule: !If
        - DocumentSectionsCrawlerScheduleEnabled
        - ScheduleExpression:
            !FindInMap [
              CrawlerScheduleMap,
              !Ref DocumentSectionsCrawlerFrequency,
              ScheduleExpression,
            ]
        - !Ref AWS::NoValue

  DocumentSectionsCrawlerRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Principal:
              Service: !Sub "glue.${AWS::URLSuffix}"
            Action: sts:AssumeRole
      ManagedPolicyArns:
        - !Sub "arn:${AWS::Partition}:iam::aws:policy/service-role/AWSGlueServiceRole"
      PermissionsBoundary:
        !If [
          HasPermissionsBoundary,
          !Ref PermissionsBoundaryArn,
          !Ref AWS::NoValue,
        ]
      Policies:
        - PolicyName: DocumentSectionsCrawlerS3Access
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Effect: Allow
                Action:
                  - s3:GetObject
                  - s3:ListBucket
                Resource:
                  - !Sub
                    - "arn:${AWS::Partition}:s3:::${Bucket}"
                    - Bucket: !If
                        - ShouldCreateReportingBucket
                        - !Ref ReportingBucket
                        - !Ref ReportingBucketName
                  - !Sub
                    - "arn:${AWS::Partition}:s3:::${Bucket}/document_sections/*"
                    - Bucket: !If
                        - ShouldCreateReportingBucket
                        - !Ref ReportingBucket
                        - !Ref ReportingBucketName
              - Effect: Allow
                Action:
                  - kms:Decrypt
                  - kms:DescribeKey
                Resource: !GetAtt CustomerManagedEncryptionKey.Arn

  EvaluationBaselineBucket:
    Type: AWS::S3::Bucket
    Condition: ShouldCreateEvaluationBaselineBucket
    DeletionPolicy: RetainExceptOnCreate
    Properties:
      CorsConfiguration:
        CorsRules:
          - AllowedHeaders:
              - "Content-Type"
              - "x-amz-content-sha256"
              - "x-amz-date"
              - "Authorization"
              - "x-amz-security-token"
            AllowedMethods:
              - PUT
              - POST
            AllowedOrigins:
              - !Sub "https://${CloudFrontDistribution.DomainName}"
              # For local development only
              - "http://localhost:3000"
            ExposedHeaders:
              - "ETag"
              - "x-amz-server-side-encryption"
            MaxAge: 3000
      BucketEncryption:
        ServerSideEncryptionConfiguration:
          - ServerSideEncryptionByDefault:
              SSEAlgorithm: aws:kms
              KMSMasterKeyID: !Ref CustomerManagedEncryptionKey
      PublicAccessBlockConfiguration:
        BlockPublicAcls: true
        BlockPublicPolicy: true
        IgnorePublicAcls: true
        RestrictPublicBuckets: true
      VersioningConfiguration:
        Status: Enabled
      LoggingConfiguration:
        DestinationBucketName: !Ref LoggingBucket
        LogFilePrefix: output-bucket-logs/
      # No lifecycle policy - retain baseline data permanently

  EvaluationBaselineBucketPolicy:
    Type: AWS::S3::BucketPolicy
    Condition: ShouldCreateEvaluationBaselineBucket
    Properties:
      Bucket: !Ref EvaluationBaselineBucket
      PolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Sid: EnforceSSLOnly
            Effect: Deny
            Principal: "*"
            Action: "s3:*"
            Resource:
              - !Sub "${EvaluationBaselineBucket.Arn}/*"
              - !Sub "${EvaluationBaselineBucket.Arn}"
            Condition:
              Bool:
                "aws:SecureTransport": false

  WebUIBucket:
    Type: AWS::S3::Bucket
    DeletionPolicy: Retain
    Properties:
      AccessControl: Private
      BucketEncryption:
        ServerSideEncryptionConfiguration:
          - ServerSideEncryptionByDefault:
              SSEAlgorithm: AES256
      PublicAccessBlockConfiguration:
        BlockPublicAcls: true
        BlockPublicPolicy: true
        IgnorePublicAcls: true
        RestrictPublicBuckets: true
      VersioningConfiguration:
        Status: Enabled
      WebsiteConfiguration:
        IndexDocument: index.html
        ErrorDocument: index.html
      LoggingConfiguration:
        DestinationBucketName: !Ref LoggingBucket
        LogFilePrefix: webapp-bucket-logs/

  WebUIBucketPolicy:
    Type: AWS::S3::BucketPolicy
    Properties:
      Bucket: !Ref WebUIBucket
      PolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Principal:
              CanonicalUser: !GetAtt CloudFrontOriginAccessIdentity.S3CanonicalUserId
            Action: s3:GetObject
            Resource: !Sub "${WebUIBucket.Arn}/*"
          - Effect: "Deny"
            Action:
              - "s3:*"
            Principal: "*"
            Resource:
              - !GetAtt WebUIBucket.Arn
              - !Sub "${WebUIBucket.Arn}/*"
            Condition:
              Bool:
                "aws:SecureTransport": false

  ##########################################################################
  # DynamoDB table for process tracking
  ##########################################################################

  TrackingTable:
    Type: AWS::DynamoDB::Table
    Properties:
      PointInTimeRecoverySpecification:
        PointInTimeRecoveryEnabled: true
      BillingMode: PAY_PER_REQUEST
      AttributeDefinitions:
        - AttributeName: PK
          AttributeType: S
        - AttributeName: SK
          AttributeType: S
      KeySchema:
        - AttributeName: PK
          KeyType: HASH
        - AttributeName: SK
          KeyType: RANGE
      TimeToLiveSpecification:
        AttributeName: ExpiresAfter
        Enabled: true
      SSESpecification:
        SSEEnabled: true
        SSEType: KMS
        KMSMasterKeyId: !Ref CustomerManagedEncryptionKey

  ##############################################################################
  # DynamoDB table and initialization function for workflow concurrency counter
  ##############################################################################

  ConcurrencyTable:
    Type: AWS::DynamoDB::Table
    Metadata:
      cfn_nag:
        rules_to_suppress:
          - id: W78
            reason: "Point-in-time recovery not required for concurrency tracking table as data is transient"
    # checkov:skip=CKV_AWS_28: "Point-in-time recovery not required for concurrency tracking table as data is transient"
    Properties:
      BillingMode: PAY_PER_REQUEST
      AttributeDefinitions:
        - AttributeName: counter_id
          AttributeType: S
      KeySchema:
        - AttributeName: counter_id
          KeyType: HASH
      SSESpecification:
        SSEEnabled: true
        SSEType: KMS
        KMSMasterKeyId: !Ref CustomerManagedEncryptionKey

  InitializeConcurrencyTableLambda:
    Type: AWS::Serverless::Function
    Metadata:
      cfn_nag:
        rules_to_suppress:
          - id: W89
            reason: "Function does not require VPC access as it only interacts with AWS services via APIs"
          - id: W92
            reason: "Function does not require reserved concurrency as it scales based on demand"
    # checkov:skip=CKV_AWS_116: "DLQ not required for Cfn Custom Resource function"
    # checkov:skip=CKV_AWS_117: "Function does not require VPC access as it only interacts with AWS services via APIs"
    # checkov:skip=CKV_AWS_115: "Function does not require reserved concurrency as it scales based on demand"
    # checkov:skip=CKV_AWS_173: "Environment variables do not contain sensitive data - only configuration values like feature flags and non-sensitive settings"
    Properties:
      PermissionsBoundary:
        !If [
          HasPermissionsBoundary,
          !Ref PermissionsBoundaryArn,
          !Ref AWS::NoValue,
        ]
      Handler: index.handler
      Runtime: python3.12
      Timeout: 30
      CodeUri: src/lambda/initialize_counter
      Environment:
        Variables:
          LOG_LEVEL: !Ref LogLevel
          CONCURRENCY_TABLE: !Ref ConcurrencyTable
      Policies:
        - DynamoDBCrudPolicy:
            TableName: !Ref ConcurrencyTable
        - Statement:
            - Effect: Allow
              Action:
                - kms:Encrypt
                - kms:Decrypt
                - kms:ReEncrypt*
                - kms:GenerateDataKey*
                - kms:DescribeKey
              Resource: !GetAtt CustomerManagedEncryptionKey.Arn

  InitializeConcurrencyTableCustomResource:
    Type: AWS::CloudFormation::CustomResource
    Properties:
      ServiceToken: !GetAtt InitializeConcurrencyTableLambda.Arn
      TableName: !Ref ConcurrencyTable

  ##########################################################################
  # Configuration table, for pattern specific prompts and config
  ##########################################################################

  # Valid values for 'Configuration' (PK) are Schema, Default, Custom
  # Schema, and Default are set by pattern templates during stack deploy/update
  # Custom is left for user to define during stack deploy/update

  ConfigurationTable:
    Type: AWS::DynamoDB::Table
    Properties:
      PointInTimeRecoverySpecification:
        PointInTimeRecoveryEnabled: true
      BillingMode: PAY_PER_REQUEST
      KeySchema:
        - AttributeName: Configuration
          KeyType: HASH
      AttributeDefinitions:
        - AttributeName: Configuration
          AttributeType: S
      SSESpecification:
        SSEEnabled: true
        SSEType: KMS
        KMSMasterKeyId: !Ref CustomerManagedEncryptionKey
  ##########################################################################
  # Discovery tracking table for discovery jobs
  ##########################################################################

  DiscoveryTrackingTable:
    Type: AWS::DynamoDB::Table
    Properties:
      PointInTimeRecoverySpecification:
        PointInTimeRecoveryEnabled: true
      BillingMode: PAY_PER_REQUEST
      AttributeDefinitions:
        - AttributeName: jobId
          AttributeType: S
      KeySchema:
        - AttributeName: jobId
          KeyType: HASH
      TimeToLiveSpecification:
        AttributeName: ExpiresAfter
        Enabled: true

      SSESpecification:
        SSEEnabled: true
        SSEType: KMS
        KMSMasterKeyId: !Ref CustomerManagedEncryptionKey

  ##########################################################################
  # Discovery SQS queue for processing discovery jobs
  ##########################################################################

  DiscoveryQueue:
    Type: AWS::SQS::Queue
    Properties:
      VisibilityTimeout: 900
      MessageRetentionPeriod: 86400 # 1 day
      KmsMasterKeyId: !Ref CustomerManagedEncryptionKey
      RedrivePolicy:
        deadLetterTargetArn: !GetAtt DiscoveryDLQ.Arn
        maxReceiveCount: 1000

  DiscoveryDLQ:
    Type: AWS::SQS::Queue
    Properties:
      VisibilityTimeout: 900
      MessageRetentionPeriod: 345600 # 4 days
      KmsMasterKeyId: !Ref CustomerManagedEncryptionKey

  ConfigurationQueue:
    Type: AWS::SQS::Queue
    Properties:
      VisibilityTimeout: 900
      MessageRetentionPeriod: 86400 # 1 day
      KmsMasterKeyId: !Ref CustomerManagedEncryptionKey
      RedrivePolicy:
        deadLetterTargetArn: !GetAtt ConfigurationDLQ.Arn
        maxReceiveCount: 1000

  ConfigurationDLQ:
    Type: AWS::SQS::Queue
    Properties:
      VisibilityTimeout: 900
      MessageRetentionPeriod: 345600 # 4 days
      KmsMasterKeyId: !Ref CustomerManagedEncryptionKey

  UpdateConfigurationFunction:
    Type: AWS::Serverless::Function
    Metadata:
      cfn_nag:
        rules_to_suppress:
          - id: W89
            reason: "Function does not require VPC access as it only interacts with AWS services via APIs"
          - id: W92
            reason: "Function does not require reserved concurrency as it scales based on demand"
    # checkov:skip=CKV_AWS_117: "Function does not require VPC access as it only interacts with AWS services via APIs"
    # checkov:skip=CKV_AWS_115: "Function does not require reserved concurrency as it scales based on demand"
    # checkov:skip=CKV_AWS_116: "DLQ not required for Custom Resource function"
    # checkov:skip=CKV_AWS_173: "Environment variables do not contain sensitive data - only configuration values like feature flags and non-sensitive settings"
    Properties:
      PermissionsBoundary:
        !If [
          HasPermissionsBoundary,
          !Ref PermissionsBoundaryArn,
          !Ref AWS::NoValue,
        ]
      Handler: index.handler
      Runtime: python3.12
      Timeout: 30
      CodeUri: src/lambda/update_configuration
      Environment:
        Variables:
          LOG_LEVEL: !Ref LogLevel
          CONFIGURATION_TABLE_NAME: !Ref ConfigurationTable
      LoggingConfig:
        LogGroup: !Ref UpdateConfigurationFunctionLogGroup
      Policies:
        - DynamoDBCrudPolicy:
            TableName: !Ref ConfigurationTable
        - Statement:
            - Effect: Allow
              Action:
                - kms:Encrypt
                - kms:Decrypt
                - kms:ReEncrypt*
                - kms:GenerateDataKey*
                - kms:DescribeKey
              Resource: !GetAtt CustomerManagedEncryptionKey.Arn
            - Effect: Allow
              Action:
                - "s3:GetObject"
                - "s3:ListBucket"
              Resource:
                - !Sub "arn:${AWS::Partition}:s3:::<ARTIFACT_BUCKET_TOKEN>"
                - !Sub "arn:${AWS::Partition}:s3:::<ARTIFACT_BUCKET_TOKEN>/<ARTIFACT_PREFIX_TOKEN>/*"
                - !Sub "arn:${AWS::Partition}:s3:::${ConfigurationBucket}"
                - !Sub "arn:${AWS::Partition}:s3:::${ConfigurationBucket}/*"
            # Allow reading user-supplied config file only if CustomConfigPath is specified
            - !If
              - HasCustomConfigPath
              - Effect: Allow
                Action:
                  - "s3:GetObject"
                Resource: !Sub
                  - "arn:${AWS::Partition}:s3:::${Path}"
                  - Path: !Select [ 1, !Split [ "s3://", !Ref CustomConfigPath ] ]
              - !Ref AWS::NoValue
            # Allow listing the specific bucket containing the custom config file
            - !If
              - HasCustomConfigPath
              - Effect: Allow
                Action:
                  - "s3:ListBucket"
                Resource: !Sub
                  - "arn:${AWS::Partition}:s3:::${BucketName}"
                  - BucketName:
                      !Select [
                        0,
                        !Split [
                          "/",
                          !Select [ 1, !Split [ "s3://", !Ref CustomConfigPath ] ],
                        ],
                      ]
              - !Ref AWS::NoValue

  UpdateConfigurationFunctionLogGroup:
    Type: AWS::Logs::LogGroup
    Properties:
      KmsKeyId: !GetAtt CustomerManagedEncryptionKey.Arn
      RetentionInDays: !Ref LogRetentionDays

  # Pattern stacks can update the Configuration table with a CustomResource, using the
  # UpdateConfigurationFunctionArn parameter passed to them. See examples in provided
  # pattern templates.

  ##########################################################################
  # SSM Parameter for application settings
  ##########################################################################

  # Initialise SettingsParameter as empty (so it never gets replaced)
  # and use Custom Resource UpdateSettingsFunction to add/update values
  SettingsParameter:
    DependsOn:
      - IsStacknameLengthOK
    Type: AWS::SSM::Parameter
    Properties:
      Type: String
      Name: !Sub "${AWS::StackName}-Settings"
      Value: "{}"

  UpdateSettingsFunction:
    DependsOn:
      - IsStacknameLengthOK
    Type: AWS::Serverless::Function
    Metadata:
      cfn_nag:
        rules_to_suppress:
          - id: W89
            reason: "Function does not require VPC access as it only interacts with AWS services via APIs"
          - id: W92
            reason: "Function does not require reserved concurrency as it scales based on demand"
    # checkov:skip=CKV_AWS_117: "Function does not require VPC access as it only interacts with AWS services via APIs"
    # checkov:skip=CKV_AWS_115: "Function does not require reserved concurrency as it scales based on demand"
    # checkov:skip=CKV_AWS_116: "DLQ not required for Custom Resource function"
    Properties:
      PermissionsBoundary:
        !If [
          HasPermissionsBoundary,
          !Ref PermissionsBoundaryArn,
          !Ref AWS::NoValue,
        ]
      Handler: index.handler
      Runtime: python3.12
      Timeout: 30
      CodeUri: src/lambda/update_settings
      LoggingConfig:
        LogGroup: !Ref UpdateSettingsFunctionLogGroup
      Policies:
        - Statement:
            - Effect: Allow
              Action:
                - ssm:GetParameter
                - ssm:PutParameter
              Resource:
                - !Sub "arn:${AWS::Partition}:ssm:${AWS::Region}:${AWS::AccountId}:parameter/${SettingsParameter}"

  UpdateSettingsFunctionLogGroup:
    Type: AWS::Logs::LogGroup
    Properties:
      KmsKeyId: !GetAtt CustomerManagedEncryptionKey.Arn
      RetentionInDays: !Ref LogRetentionDays

  UpdateSettingsValues:
    Type: AWS::CloudFormation::CustomResource
    Properties:
      ServiceToken: !GetAtt UpdateSettingsFunction.Arn
      SettingsName: !Ref SettingsParameter
      SettingsKeyValuePairs:
        StackName: !Sub "${AWS::StackName}"
        Version: <VERSION>
        BuildDateTime: <BUILD_DATE_TIME>
        IDPPattern: !Ref IDPPattern
        InputBucket: !Ref InputBucket
        DiscoveryBucket: !Ref DiscoveryBucket
        ConfigurationBucket: !Ref ConfigurationBucket
        OutputBucket: !Ref OutputBucket
        ReportingBucket: !If
          - ShouldCreateReportingBucket
          - !Ref ReportingBucket
          - !Ref ReportingBucketName
        EvaluationBaselineBucket: !If
          - ShouldCreateEvaluationBaselineBucket
          - !Ref EvaluationBaselineBucket
          - !Ref EvaluationBaselineBucketName
        ShouldUseDocumentKnowledgeBase: !If
          - ShouldUseDocumentKnowledgeBase
          - True
          - False
    UpdateReplacePolicy: Delete
    DeletionPolicy: Delete

  ##########################################################################
  # SQS Queue for queueing pending documents in order
  ##########################################################################

  DocumentQueueDLQ:
    Type: AWS::SQS::Queue
    Properties:
      KmsMasterKeyId: !Ref CustomerManagedEncryptionKey
      VisibilityTimeout: 30
      MessageRetentionPeriod: 345600 # 4 days

  DocumentQueueDLQPolicy:
    Type: AWS::SQS::QueuePolicy
    Properties:
      Queues:
        - !Ref DocumentQueueDLQ
      PolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Sid: EnforceSSLOnly
            Effect: Deny
            Principal: "*"
            Action: "sqs:*"
            Resource: !GetAtt DocumentQueueDLQ.Arn
            Condition:
              Bool:
                "aws:SecureTransport": false

  DocumentQueue:
    Type: AWS::SQS::Queue
    Properties:
      KmsMasterKeyId: !Ref CustomerManagedEncryptionKey
      VisibilityTimeout: 30
      MessageRetentionPeriod: 86400 # 1 day
      RedrivePolicy:
        maxReceiveCount: 1000 # should retry up to 8hrs (1000 * 30 sec visibility) before moving to DLQ
        deadLetterTargetArn: !GetAtt DocumentQueueDLQ.Arn

  DocumentQueuePolicy:
    Type: AWS::SQS::QueuePolicy
    Properties:
      Queues:
        - !Ref DocumentQueue
      PolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Sid: EnforceSSLOnly
            Effect: Deny
            Principal: "*"
            Action: "sqs:*"
            Resource: !GetAtt DocumentQueue.Arn
            Condition:
              Bool:
                "aws:SecureTransport": false

  ##########################################################################
  # Event triggered Lambdas to publish and consume from the queue
  ##########################################################################

  QueueSenderDLQ:
    Type: AWS::SQS::Queue
    Properties:
      KmsMasterKeyId: !Ref CustomerManagedEncryptionKey
      VisibilityTimeout: 30
      MessageRetentionPeriod: 345600 # 4 days

  QueueSenderDLQPolicy:
    Type: AWS::SQS::QueuePolicy
    Properties:
      Queues:
        - !Ref QueueSenderDLQ
      PolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Sid: EnforceSSLOnly
            Effect: Deny
            Principal: "*"
            Action: "sqs:*"
            Resource: !GetAtt QueueSenderDLQ.Arn
            Condition:
              Bool:
                "aws:SecureTransport": false

  QueueSender:
    Type: AWS::Serverless::Function
    Metadata:
      cfn_nag:
        rules_to_suppress:
          - id: W89
            reason: "Function does not require VPC access as it only interacts with AWS services via APIs"
          - id: W92
            reason: "Function does not require reserved concurrency as it scales based on demand"
    # checkov:skip=CKV_AWS_117: "Function does not require VPC access as it only interacts with AWS services via APIs"
    # checkov:skip=CKV_AWS_115: "Function does not require reserved concurrency as it scales based on demand"
    # checkov:skip=CKV_AWS_173: "Environment variables do not contain sensitive data - only configuration values like feature flags and non-sensitive settings"
    Properties:
      PermissionsBoundary:
        !If [
          HasPermissionsBoundary,
          !Ref PermissionsBoundaryArn,
          !Ref AWS::NoValue,
        ]
      CodeUri: src/lambda/queue_sender/
      Handler: index.handler
      Runtime: python3.12
      Timeout: 30
      Tracing: Active
      DeadLetterQueue:
        Type: SQS
        TargetArn: !GetAtt QueueSenderDLQ.Arn
      LoggingConfig:
        LogGroup: !Ref QueueSenderLogGroup
      Environment:
        Variables:
          LOG_LEVEL: !Ref LogLevel
          QUEUE_URL: !Ref DocumentQueue
          APPSYNC_API_URL: !GetAtt GraphQLApi.GraphQLUrl
          DATA_RETENTION_IN_DAYS: !Ref DataRetentionInDays
          OUTPUT_BUCKET: !Ref OutputBucket
      Policies:
        - SQSSendMessagePolicy:
            QueueName: !GetAtt DocumentQueue.QueueName
        - Statement:
            - Effect: Allow
              Action:
                - appsync:GraphQL
              Resource:
                - !Sub "${GraphQLApi.Arn}/types/Mutation/*"
            - Effect: Allow
              Action:
                - kms:Encrypt
                - kms:Decrypt
                - kms:ReEncrypt*
                - kms:GenerateDataKey*
                - kms:DescribeKey
              Resource: !GetAtt CustomerManagedEncryptionKey.Arn
      Events:
        S3Event:
          Type: CloudWatchEvent
          Properties:
            Pattern:
              source:
                - aws.s3
              detail-type:
                - "Object Created"
              detail:
                bucket:
                  name:
                    - !Ref InputBucket

  QueueSenderLogGroup:
    Type: AWS::Logs::LogGroup
    Properties:
      KmsKeyId: !GetAtt CustomerManagedEncryptionKey.Arn
      RetentionInDays: !Ref LogRetentionDays

  QueueProcessor:
    Type: AWS::Serverless::Function
    Metadata:
      cfn_nag:
        rules_to_suppress:
          - id: W89
            reason: "Function does not require VPC access as it only interacts with AWS services via APIs"
          - id: W92
            reason: "Function does not require reserved concurrency as it scales based on demand"
    # checkov:skip=CKV_AWS_115: "Function does not require reserved concurrency as it scales based on demand"
    # checkov:skip=CKV_AWS_116: "DLQ not required for these functions as they are either idempotent or have error handling"
    # checkov:skip=CKV_AWS_117: "Function does not require VPC access as it only interacts with AWS services via APIs"
    # checkov:skip=CKV_AWS_173: "Environment variables do not contain sensitive data - only configuration values like feature flags and non-sensitive settings"
    Properties:
      PermissionsBoundary:
        !If [
          HasPermissionsBoundary,
          !Ref PermissionsBoundaryArn,
          !Ref AWS::NoValue,
        ]
      CodeUri: src/lambda/queue_processor/
      Handler: index.handler
      Runtime: python3.12
      Timeout: 30
      Tracing: Active
      LoggingConfig:
        LogGroup: !Ref QueueProcessorLogGroup
      Environment:
        Variables:
          LOG_LEVEL: !Ref LogLevel
          STATE_MACHINE_ARN: !If
            - IsPattern3
            - !GetAtt PATTERN3STACK.Outputs.StateMachineArn
            - !If
              - IsPattern2
              - !GetAtt PATTERN2STACK.Outputs.StateMachineArn
              - !GetAtt PATTERN1STACK.Outputs.StateMachineArn
          APPSYNC_API_URL: !GetAtt GraphQLApi.GraphQLUrl
          CONCURRENCY_TABLE: !Ref ConcurrencyTable
          MAX_CONCURRENT: !Ref MaxConcurrentWorkflows
          WORKING_BUCKET: !Ref WorkingBucket
      Policies:
        - SQSPollerPolicy:
            QueueName: !GetAtt DocumentQueue.QueueName
        - StepFunctionsExecutionPolicy:
            StateMachineName: !If
              - IsPattern3
              - !GetAtt PATTERN3STACK.Outputs.StateMachineName
              - !If
                - IsPattern2
                - !GetAtt PATTERN2STACK.Outputs.StateMachineName
                - !GetAtt PATTERN1STACK.Outputs.StateMachineName
        - DynamoDBCrudPolicy:
            TableName: !Ref TrackingTable
        - DynamoDBCrudPolicy:
            TableName: !Ref ConcurrencyTable
        - S3CrudPolicy:
            BucketName: !Ref WorkingBucket
        - Statement:
            - Effect: Allow
              Action:
                - appsync:GraphQL
              Resource:
                - !Sub "${GraphQLApi.Arn}/types/Mutation/*"
            - Effect: Allow
              Action:
                - kms:Encrypt
                - kms:Decrypt
                - kms:ReEncrypt*
                - kms:GenerateDataKey*
                - kms:DescribeKey
              Resource: !GetAtt CustomerManagedEncryptionKey.Arn
      Events:
        SQSEvent:
          Type: SQS
          Properties:
            Queue: !GetAtt DocumentQueue.Arn
            BatchSize: 50 # Process up to 50 messages at once
            # Per https://docs.aws.amazon.com/lambda/latest/dg/with-sqs.html
            # If you're using a batch window and your SQS queue contains very low traffic,
            # Lambda might wait for up to 20 seconds before invoking your function.
            # This is true even if you set a batch window lower than 20 seconds.
            MaximumBatchingWindowInSeconds: 1 # Minimize delay (see above caveat)
            FunctionResponseTypes:
              - ReportBatchItemFailures

  QueueProcessorLogGroup:
    Type: AWS::Logs::LogGroup
    Properties:
      KmsKeyId: !GetAtt CustomerManagedEncryptionKey.Arn
      RetentionInDays: !Ref LogRetentionDays

  ##########################################################################
  # Event triggered Lambda for statemachine workflow tracking updates
  ##########################################################################

  WorkflowTrackerDLQ:
    Type: AWS::SQS::Queue
    Properties:
      KmsMasterKeyId: !Ref CustomerManagedEncryptionKey
      VisibilityTimeout: 30
      MessageRetentionPeriod: 345600 # 4 days

  WorkflowTrackerDLQPolicy:
    Type: AWS::SQS::QueuePolicy
    Properties:
      Queues:
        - !Ref WorkflowTrackerDLQ
      PolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Sid: EnforceSSLOnly
            Effect: Deny
            Principal: "*"
            Action: "sqs:*"
            Resource: !GetAtt WorkflowTrackerDLQ.Arn
            Condition:
              Bool:
                "aws:SecureTransport": false

  WorkflowTracker:
    Type: AWS::Serverless::Function
    Metadata:
      cfn_nag:
        rules_to_suppress:
          - id: W11
            reason: "Role requires * resource access for CloudWatch Metrics and Logs"
          - id: W89
            reason: "Function does not require VPC access as it only interacts with AWS services via APIs"
          - id: W92
            reason: "Function does not require reserved concurrency as it scales based on demand"
    # checkov:skip=CKV_AWS_117: "Function does not require VPC access as it only interacts with AWS services via APIs"
    # checkov:skip=CKV_AWS_115: "Function does not require reserved concurrency as it scales based on demand"
    # checkov:skip=CKV_AWS_173: "Environment variables do not contain sensitive data - only configuration values like feature flags and non-sensitive settings"
    Properties:
      PermissionsBoundary:
        !If [
          HasPermissionsBoundary,
          !Ref PermissionsBoundaryArn,
          !Ref AWS::NoValue,
        ]
      CodeUri: src/lambda/workflow_tracker/
      Handler: index.handler
      Runtime: python3.12
      Timeout: 30
      Tracing: Active
      DeadLetterQueue:
        Type: SQS
        TargetArn: !GetAtt WorkflowTrackerDLQ.Arn
      LoggingConfig:
        LogGroup: !Ref WorkflowTrackerLogGroup
      Environment:
        Variables:
          LOG_LEVEL: !Ref LogLevel
          CONCURRENCY_TABLE: !Ref ConcurrencyTable
          METRIC_NAMESPACE: !Ref AWS::StackName
          APPSYNC_API_URL: !GetAtt GraphQLApi.GraphQLUrl
          OUTPUT_BUCKET: !Ref OutputBucket
          REPORTING_BUCKET:
            !If [
              ShouldCreateReportingBucket,
              !Ref ReportingBucket,
              !Ref ReportingBucketName,
            ]
          SAVE_REPORTING_FUNCTION_NAME: !Ref SaveReportingDataFunction
          WORKING_BUCKET: !Ref WorkingBucket
      Policies:
        - DynamoDBCrudPolicy:
            TableName: !Ref TrackingTable
        - DynamoDBCrudPolicy:
            TableName: !Ref ConcurrencyTable
        - S3CrudPolicy:
            BucketName: !Ref WorkingBucket
        - Statement:
            - Effect: Allow
              Action:
                - cloudwatch:PutMetricData
              Resource: "*"
            - Effect: Allow
              Action:
                - lambda:InvokeFunction
              Resource: !GetAtt SaveReportingDataFunction.Arn
            - Effect: Allow
              Action:
                - appsync:GraphQL
              Resource:
                - !Sub "${GraphQLApi.Arn}/types/Mutation/*"
            - Effect: Allow
              Action:
                - kms:Encrypt
                - kms:Decrypt
                - kms:ReEncrypt*
                - kms:GenerateDataKey*
                - kms:DescribeKey
              Resource: !GetAtt CustomerManagedEncryptionKey.Arn

  WorkflowTrackerLogGroup:
    Type: AWS::Logs::LogGroup
    Properties:
      KmsKeyId: !GetAtt CustomerManagedEncryptionKey.Arn
      RetentionInDays: !Ref LogRetentionDays

  WorkflowStateChangeRule:
    Type: AWS::Events::Rule
    Properties:
      EventPattern:
        source:
          - aws.states
        detail-type:
          - Step Functions Execution Status Change
        detail:
          stateMachineArn:
            - !If
              - IsPattern3
              - !GetAtt PATTERN3STACK.Outputs.StateMachineArn
              - !If
                - IsPattern2
                - !GetAtt PATTERN2STACK.Outputs.StateMachineArn
                - !GetAtt PATTERN1STACK.Outputs.StateMachineArn
          status:
            - FAILED
            - TIMED_OUT
            - ABORTED
            - SUCCEEDED
      State: ENABLED
      Targets:
        - Arn: !GetAtt WorkflowTracker.Arn
          Id: TrackWorkflowCompletion
          RetryPolicy:
            MaximumRetryAttempts: 3

  WorkflowTrackerPermission:
    Type: AWS::Lambda::Permission
    Properties:
      Action: lambda:InvokeFunction
      FunctionName: !Ref WorkflowTracker
      Principal: !Sub "events.${AWS::URLSuffix}"
      SourceArn: !GetAtt WorkflowStateChangeRule.Arn

  ##########################################################################
  # Optional Post Processing Lambda Hook
  ##########################################################################
  
  # Decompression Lambda - handles document decompression before invoking custom post-processor
  PostProcessingDecompressorDLQ:
    Type: AWS::SQS::Queue
    Condition: ShouldEnablePostProcessingLambdaHook
    Properties:
      KmsMasterKeyId: !Ref CustomerManagedEncryptionKey
      VisibilityTimeout: 30
      MessageRetentionPeriod: 345600 # 4 days

  PostProcessingDecompressorDLQPolicy:
    Type: AWS::SQS::QueuePolicy
    Condition: ShouldEnablePostProcessingLambdaHook
    Properties:
      Queues:
        - !Ref PostProcessingDecompressorDLQ
      PolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Sid: EnforceSSLOnly
            Effect: Deny
            Principal: "*"
            Action: "sqs:*"
            Resource: !GetAtt PostProcessingDecompressorDLQ.Arn
            Condition:
              Bool:
                "aws:SecureTransport": false

  PostProcessingDecompressor:
    Type: AWS::Serverless::Function
    Condition: ShouldEnablePostProcessingLambdaHook
    Metadata:
      cfn_nag:
        rules_to_suppress:
          - id: W89
            reason: "Function does not require VPC access as it only interacts with AWS services via APIs"
          - id: W92
            reason: "Function does not require reserved concurrency as it scales based on demand"
    # checkov:skip=CKV_AWS_117: "Function does not require VPC access as it only interacts with AWS services via APIs"
    # checkov:skip=CKV_AWS_115: "Function does not require reserved concurrency as it scales based on demand"
    # checkov:skip=CKV_AWS_173: "Environment variables do not contain sensitive data - only configuration values like feature flags and non-sensitive settings"
    Properties:
      PermissionsBoundary:
        !If [
          HasPermissionsBoundary,
          !Ref PermissionsBoundaryArn,
          !Ref AWS::NoValue,
        ]
      CodeUri: src/lambda/post_processing_decompressor/
      Handler: index.handler
      Runtime: python3.12
      Timeout: 300
      MemorySize: 512
      Tracing: Active
      DeadLetterQueue:
        Type: SQS
        TargetArn: !GetAtt PostProcessingDecompressorDLQ.Arn
      LoggingConfig:
        LogGroup: !Ref PostProcessingDecompressorLogGroup
      Environment:
        Variables:
          LOG_LEVEL: !Ref LogLevel
          CUSTOM_POST_PROCESSOR_ARN: !Ref PostProcessingLambdaHookFunctionArn
          WORKING_BUCKET: !Ref WorkingBucket
      Policies:
        - S3CrudPolicy:
            BucketName: !Ref WorkingBucket
        - Statement:
            - Effect: Allow
              Action:
                - lambda:InvokeFunction
              Resource: !Ref PostProcessingLambdaHookFunctionArn
            - Effect: Allow
              Action:
                - kms:Encrypt
                - kms:Decrypt
                - kms:ReEncrypt*
                - kms:GenerateDataKey*
                - kms:DescribeKey
              Resource: !GetAtt CustomerManagedEncryptionKey.Arn

  PostProcessingDecompressorLogGroup:
    Type: AWS::Logs::LogGroup
    Condition: ShouldEnablePostProcessingLambdaHook
    Properties:
      KmsKeyId: !GetAtt CustomerManagedEncryptionKey.Arn
      RetentionInDays: !Ref LogRetentionDays

  PostProcessingLambdaHookRule:
    Type: AWS::Events::Rule
    Condition: ShouldEnablePostProcessingLambdaHook
    Properties:
      EventPattern:
        source:
          - aws.states
        detail-type:
          - Step Functions Execution Status Change
        detail:
          stateMachineArn:
            - !If
              - IsPattern3
              - !GetAtt PATTERN3STACK.Outputs.StateMachineArn
              - !If
                - IsPattern2
                - !GetAtt PATTERN2STACK.Outputs.StateMachineArn
                - !GetAtt PATTERN1STACK.Outputs.StateMachineArn
          status:
            - SUCCEEDED
      State: ENABLED
      Targets:
        - Arn: !GetAtt PostProcessingDecompressor.Arn
          Id: PostProcessingDecompressor
          RetryPolicy:
            MaximumRetryAttempts: 3

  PostProcessingDecompressorPermission:
    Type: AWS::Lambda::Permission
    Condition: ShouldEnablePostProcessingLambdaHook
    Properties:
      Action: lambda:InvokeFunction
      FunctionName: !Ref PostProcessingDecompressor
      Principal: !Sub "events.${AWS::URLSuffix}"
      SourceArn: !GetAtt PostProcessingLambdaHookRule.Arn

  ##########################################################################
  # SaveReportingDataFunction Lambda, writes to ReportingBucket
  ##########################################################################

  SaveReportingDataFunction:
    Type: AWS::Serverless::Function
    Metadata:
      cfn_nag:
        rules_to_suppress:
          - id: W11
            reason: "Role requires * resource access for CloudWatch Metrics and Logs"
          - id: W89
            reason: "Function does not require VPC access as it only interacts with AWS services via APIs"
          - id: W92
            reason: "Function does not require reserved concurrency as it scales based on demand"
    # checkov:skip=CKV_AWS_117: "Function does not require VPC access as it only interacts with AWS services via APIs"
    # checkov:skip=CKV_AWS_115: "Function does not require reserved concurrency as it scales based on demand"
    # checkov:skip=CKV_AWS_173: "Environment variables do not contain sensitive data - only configuration values like feature flags and non-sensitive settings"
    # checkov:skip=CKV_AWS_116: "DLQ not required for this functions as it is called sychronously"
    Properties:
      PermissionsBoundary:
        !If [
          HasPermissionsBoundary,
          !Ref PermissionsBoundaryArn,
          !Ref AWS::NoValue,
        ]
      CodeUri: src/lambda/save_reporting_data/
      Handler: index.handler
      Runtime: python3.12
      Timeout: 300
      MemorySize: 1024
      Tracing: Active
      LoggingConfig:
        LogGroup: !Ref SaveReportingDataFunctionLogGroup
      Policies:
        - S3CrudPolicy:
            BucketName: !If
              - ShouldCreateReportingBucket
              - !Ref ReportingBucket
              - !Ref ReportingBucketName
        - S3ReadPolicy:
            BucketName: !Ref OutputBucket
        - DynamoDBReadPolicy:
            TableName: !Ref ConfigurationTable
        - Statement:
            - Effect: Allow
              Action:
                - cloudwatch:PutMetricData
              Resource: "*"
            - Effect: Allow
              Action:
                - kms:Encrypt
                - kms:Decrypt
                - kms:ReEncrypt*
                - kms:GenerateDataKey*
                - kms:DescribeKey
              Resource: !GetAtt CustomerManagedEncryptionKey.Arn
            - Effect: Allow
              Action:
                - glue:CreateTable
                - glue:GetTable
                - glue:UpdateTable
                - glue:GetDatabase
              Resource:
                - !Sub "arn:${AWS::Partition}:glue:${AWS::Region}:${AWS::AccountId}:catalog"
                - !Sub "arn:${AWS::Partition}:glue:${AWS::Region}:${AWS::AccountId}:database/${GetLowercase.Lowercase}-reporting-db"
                - !Sub "arn:${AWS::Partition}:glue:${AWS::Region}:${AWS::AccountId}:table/${GetLowercase.Lowercase}-reporting-db/document_sections_*"
                - !Sub "arn:${AWS::Partition}:glue:${AWS::Region}:${AWS::AccountId}:table/${GetLowercase.Lowercase}-reporting-db/metering"
                - !Sub "arn:${AWS::Partition}:glue:${AWS::Region}:${AWS::AccountId}:table/${GetLowercase.Lowercase}-reporting-db/document_evaluations"
                - !Sub "arn:${AWS::Partition}:glue:${AWS::Region}:${AWS::AccountId}:table/${GetLowercase.Lowercase}-reporting-db/section_evaluations"
                - !Sub "arn:${AWS::Partition}:glue:${AWS::Region}:${AWS::AccountId}:table/${GetLowercase.Lowercase}-reporting-db/attribute_evaluations"
      Environment:
        Variables:
          LOG_LEVEL: !Ref LogLevel
          METRIC_NAMESPACE: !Ref AWS::StackName
          STACK_NAME: !Ref AWS::StackName
          CONFIGURATION_TABLE_NAME: !Ref ConfigurationTable

  SaveReportingDataFunctionLogGroup:
    Type: AWS::Logs::LogGroup
    Properties:
      KmsKeyId: !GetAtt CustomerManagedEncryptionKey.Arn
      RetentionInDays: !Ref LogRetentionDays

  ##########################################################################
  # CloudWatch monitoring
  ##########################################################################

  AlertsTopic:
    Type: AWS::SNS::Topic
    Properties:
      DisplayName: Workflow Alerts
      KmsMasterKeyId: !Ref CustomerManagedEncryptionKey

  WorkflowErrorsAlarm:
    Type: AWS::CloudWatch::Alarm
    Properties:
      AlarmDescription: !Sub "Alert when workflow errors exceed ${ErrorThreshold} in 5 minutes"
      MetricName: ExecutionsFailedCount
      Namespace: AWS/States
      Statistic: Sum
      Period: 300
      EvaluationPeriods: 1
      Threshold: !Ref ErrorThreshold
      ComparisonOperator: GreaterThanOrEqualToThreshold
      Dimensions:
        - Name: StateMachineArn
          Value: !If
            - IsPattern3
            - !GetAtt PATTERN3STACK.Outputs.StateMachineArn
            - !If
              - IsPattern2
              - !GetAtt PATTERN2STACK.Outputs.StateMachineArn
              - !GetAtt PATTERN1STACK.Outputs.StateMachineArn
      AlarmActions:
        - !Ref AlertsTopic

  SlowExecutionsAlarm:
    Type: AWS::CloudWatch::Alarm
    Properties:
      AlarmDescription: !Sub "Alert when average execution time exceeds ${ExecutionTimeThresholdMs} milliseconds"
      MetricName: ExecutionTime
      Namespace: AWS/States
      Statistic: Average
      Period: 300
      EvaluationPeriods: 1
      Threshold: !Ref ExecutionTimeThresholdMs
      ComparisonOperator: GreaterThanThreshold
      Dimensions:
        - Name: StateMachineArn
          Value: !If
            - IsPattern3
            - !GetAtt PATTERN3STACK.Outputs.StateMachineArn
            - !If
              - IsPattern2
              - !GetAtt PATTERN2STACK.Outputs.StateMachineArn
              - !GetAtt PATTERN1STACK.Outputs.StateMachineArn
      AlarmActions:
        - !Ref AlertsTopic

  # This dasboard is merged with dashboard created by the pattern stack to create an overall dashboard
  MainTemplateSubsetDashboard:
    Type: AWS::CloudWatch::Dashboard
    Properties:
      DashboardName: !Sub "${AWS::StackName}-${AWS::Region}-MainTemplate-Subset"
      DashboardBody: !Sub
        - |
          {
            "widgets": [
              {
                "type": "metric",
                "x": 0,
                "y": 0,
                "width": 8,
                "height": 6,
                "properties": {
                  "metrics": [
                    [
                      "${AWS::StackName}",
                      "QueueLatencyMilliseconds",
                      {
                        "stat": "Average"
                      }
                    ],
                    [
                      ".",
                      "QueueLatencyMilliseconds",
                      {
                        "stat": "p90"
                      }
                    ],
                    [
                      ".",
                      "QueueLatencyMilliseconds",
                      {
                        "stat": "Maximum"
                      }
                    ]
                  ],
                  "region": "${AWS::Region}",
                  "title": "Queue Latency",
                  "period": 300,
                  "view": "timeSeries",
                  "annotations": {
                    "horizontal": [
                      {
                        "value": ${ExecutionTimeThresholdMs
                        },
                        "label": "Threshold (${ExecutionTimeThresholdMs}ms)",
                        "color": "#ff0000"
                      }
                    ]
                  }
                }
              },
              {
                "type": "metric",
                "x": 8,
                "y": 0,
                "width": 8,
                "height": 6,
                "properties": {
                  "metrics": [
                    [
                      "${AWS::StackName}",
                      "WorkflowLatencyMilliseconds",
                      {
                        "stat": "Average"
                      }
                    ],
                    [
                      ".",
                      "WorkflowLatencyMilliseconds",
                      {
                        "stat": "p90"
                      }
                    ],
                    [
                      ".",
                      "WorkflowLatencyMilliseconds",
                      {
                        "stat": "Maximum"
                      }
                    ]
                  ],
                  "region": "${AWS::Region}",
                  "title": "Workflow Latency",
                  "period": 300,
                  "view": "timeSeries",
                  "annotations": {
                    "horizontal": [
                      {
                        "value": ${ExecutionTimeThresholdMs
                        },
                        "label": "Threshold (${ExecutionTimeThresholdMs}ms)",
                        "color": "#ff0000"
                      }
                    ]
                  }
                }
              },
              {
                "type": "metric",
                "x": 16,
                "y": 0,
                "width": 8,
                "height": 6,
                "properties": {
                  "metrics": [
                    [
                      "${AWS::StackName}",
                      "TotalLatencyMilliseconds",
                      {
                        "stat": "Average"
                      }
                    ],
                    [
                      ".",
                      "TotalLatencyMilliseconds",
                      {
                        "stat": "p90"
                      }
                    ],
                    [
                      ".",
                      "TotalLatencyMilliseconds",
                      {
                        "stat": "Maximum"
                      }
                    ]
                  ],
                  "region": "${AWS::Region}",
                  "title": "Total Processing Latency",
                  "period": 300,
                  "view": "timeSeries",
                  "annotations": {
                    "horizontal": [
                      {
                        "value": ${ExecutionTimeThresholdMs
                        },
                        "label": "Threshold (${ExecutionTimeThresholdMs}ms)",
                        "color": "#ff0000"
                      }
                    ]
                  }
                }
              },
              {
                "type": "metric",
                "x": 0,
                "y": 6,
                "width": 8,
                "height": 6,
                "properties": {
                  "metrics": [
                    [
                      {
                        "expression": "m1/PERIOD(m1)*60",
                        "label": "Messages Received per Minute",
                        "id": "e1"
                      }
                    ],
                    [
                      {
                        "expression": "m2/PERIOD(m2)*60",
                        "label": "Messages Deleted per Minute",
                        "id": "e2"
                      }
                    ],
                    [
                      "AWS/SQS",
                      "NumberOfMessagesReceived",
                      "QueueName",
                      "${DocumentQueue.QueueName}",
                      {
                        "id": "m1",
                        "stat": "Sum",
                        "visible": false
                      }
                    ],
                    [
                      ".",
                      "NumberOfMessagesDeleted",
                      ".",
                      ".",
                      {
                        "id": "m2",
                        "stat": "Sum",
                        "visible": false
                      }
                    ]
                  ],
                  "region": "${AWS::Region}",
                  "title": "SQS Queue Metrics (per Minute)",
                  "view": "timeSeries",
                  "period": 60,
                  "yAxis": {
                    "left": {
                      "label": "Count per Minute"
                    }
                  }
                }
              },
              {
                "type": "metric",
                "x": 8,
                "y": 6,
                "width": 8,
                "height": 6,
                "properties": {
                  "metrics": [
                    [
                      {
                        "expression": "m1/PERIOD(m1)*60",
                        "label": "Started per Minute",
                        "id": "e1"
                      }
                    ],
                    [
                      {
                        "expression": "m2/PERIOD(m2)*60",
                        "label": "Succeeded per Minute",
                        "id": "e2"
                      }
                    ],
                    [
                      {
                        "expression": "m3/PERIOD(m3)*60",
                        "label": "Failed per Minute",
                        "id": "e3"
                      }
                    ],
                    [
                      "AWS/States",
                      "ExecutionsStarted",
                      "StateMachineArn",
                      "${StateMachineArn}",
                      {
                        "id": "m1",
                        "stat": "Sum",
                        "visible": false
                      }
                    ],
                    [
                      ".",
                      "ExecutionsSucceeded",
                      ".",
                      ".",
                      {
                        "id": "m2",
                        "stat": "Sum",
                        "visible": false
                      }
                    ],
                    [
                      ".",
                      "ExecutionsFailed",
                      ".",
                      ".",
                      {
                        "id": "m3",
                        "stat": "Sum",
                        "visible": false
                      }
                    ]
                  ],
                  "region": "${AWS::Region}",
                  "title": "Workflow Executions (per Minute)",
                  "view": "timeSeries",
                  "period": 60,
                  "yAxis": {
                    "left": {
                      "label": "Count per Minute"
                    }
                  }
                }
              },
              {
                "type": "log",
                "x": 18,
                "y": 6,
                "width": 8,
                "height": 6,
                "properties": {
                  "query": "SOURCE '${WorkflowTrackerLogGroup}' | fields @timestamp, @message | filter @message like /Publishing latency metrics/ | parse @message 'total: *ms' as totalTime |  filter totalTime > ${ExecutionTimeThresholdMs} |  stats count(*) as high_latency_count by bin(1m)",
                  "region": "${AWS::Region}",
                  "title": "Count of Workflow Executions over latency threshold (${ExecutionTimeThresholdMs}ms)",
                  "stacked": false,
                  "view": "timeSeries"
                }
              },
              {
                "type": "log",
                "x": 0,
                "y": 12,
                "width": 24,
                "height": 6,
                "properties": {
                  "query": "SOURCE '${StateMachineLogGroup}' | fields @timestamp, @message | filter @message like /ExecutionFailed/ or @message like /TimedOut/ | parse @message /execution: (?<execution_arn>[^ ]*)/ | parse @message /error: (?<error>[^\"]*)/| sort @timestamp desc | limit 20",
                  "region": "${AWS::Region}",
                  "title": "Step Functions Executions Failed",
                  "view": "table"
                }
              },
              {
                "type": "log",
                "x": 0,
                "y": 18,
                "width": 12,
                "height": 6,
                "properties": {
                  "query": "SOURCE '${QueueSenderLogGroup}' | fields @timestamp, @logStream, @message | filter @message like /ERROR/ | sort @timestamp desc | limit 20",
                  "region": "${AWS::Region}",
                  "title": "Queue Sender Lambda Errors",
                  "view": "table"
                }
              },
              {
                "type": "log",
                "x": 12,
                "y": 18,
                "width": 12,
                "height": 6,
                "properties": {
                  "query": "SOURCE '${QueueProcessorLogGroup}' | fields @timestamp, @logStream, @message | filter @message like /ERROR/ | sort @timestamp desc | limit 20",
                  "region": "${AWS::Region}",
                  "title": "Queue Processor Lambda Errors",
                  "view": "table"
                }
              },
              {
                "type": "log",
                "x": 0,
                "y": 24,
                "width": 12,
                "height": 6,
                "properties": {
                  "query": "SOURCE '${WorkflowTrackerLogGroup}' | fields @timestamp, @logStream, @message | filter @message like /ERROR/ | sort @timestamp desc | limit 20",
                  "region": "${AWS::Region}",
                  "title": "Workflow Tracker Lambda Errors",
                  "view": "table"
                }
              },
              {
                "type": "log",
                "x": 12,
                "y": 24,
                "width": 12,
                "height": 6,
                "properties": {
                  "query": "SOURCE '${SaveReportingDataFunctionLogGroup}' | fields @timestamp, @logStream, @message | filter @message like /ERROR/ | sort @timestamp desc | limit 20",
                  "region": "${AWS::Region}",
                  "title": "Save Reporting Data Tracker Lambda Errors",
                  "view": "table"
                }
              }
            ]
          }
        - StateMachineArn: !If
            - IsPattern3
            - !GetAtt PATTERN3STACK.Outputs.StateMachineArn
            - !If
              - IsPattern2
              - !GetAtt PATTERN2STACK.Outputs.StateMachineArn
              - !GetAtt PATTERN1STACK.Outputs.StateMachineArn
          StateMachineLogGroup: !If
            - IsPattern3
            - !GetAtt PATTERN3STACK.Outputs.StateMachineLogGroup
            - !If
              - IsPattern2
              - !GetAtt PATTERN2STACK.Outputs.StateMachineLogGroup
              - !GetAtt PATTERN1STACK.Outputs.StateMachineLogGroup

  DashboardMergerFunction:
    DependsOn:
      - IsStacknameLengthOK
    Type: AWS::Serverless::Function
    Metadata:
      cfn_nag:
        rules_to_suppress:
          - id: W11
            reason: "Role requires * resource access for CloudWatch Dashboards"
          - id: W89
            reason: "Function does not require VPC access as it only interacts with AWS services via APIs"
          - id: W92
            reason: "Function does not require reserved concurrency as it scales based on demand"
    # checkov:skip=CKV_AWS_116: "DLQ not required for Cfn Custom Resource function"
    # checkov:skip=CKV_AWS_117: "Function does not require VPC access as it only interacts with AWS services via APIs"
    # checkov:skip=CKV_AWS_115: "Function does not require reserved concurrency as it scales based on demand"
    # checkov:skip=CKV_AWS_173: "Environment variables do not contain sensitive data - only configuration values like feature flags and non-sensitive settings"
    Properties:
      PermissionsBoundary:
        !If [
          HasPermissionsBoundary,
          !Ref PermissionsBoundaryArn,
          !Ref AWS::NoValue,
        ]
      CodeUri: src/lambda/dashboard_merger
      Handler: index.handler
      Runtime: python3.12
      Timeout: 60
      MemorySize: 128
      Environment:
        Variables:
          LOG_LEVEL: !Ref LogLevel
          STACK_NAME: !Ref AWS::StackName
      Policies:
        - Version: "2012-10-17"
          Statement:
            - Effect: Allow
              Action:
                - cloudwatch:GetDashboard
                - cloudwatch:ListDashboards
                - cloudwatch:PutDashboard
                - cloudwatch:DeleteDashboards
              Resource: "*"

  MergedDashboard:
    Type: Custom::DashboardMerger
    Properties:
      ServiceToken: !GetAtt DashboardMergerFunction.Arn
      Dashboard1Name: !Ref MainTemplateSubsetDashboard
      Dashboard2Name: !If
        - IsPattern3
        - !GetAtt PATTERN3STACK.Outputs.DashboardName
        - !If
          - IsPattern2
          - !GetAtt PATTERN2STACK.Outputs.DashboardName
          - !GetAtt PATTERN1STACK.Outputs.DashboardName
      MergedDashboardName: !Sub "${AWS::StackName}-${AWS::Region}"
      ChangeToForceUpdate: <HASH_TOKEN> # Source code hash set by publish script

  ##########################################################################
  # Lambda function that retrieves status details for specified document
  ##########################################################################

  LookupFunction:
    Type: AWS::Serverless::Function
    Metadata:
      cfn_nag:
        rules_to_suppress:
          - id: W89
            reason: "Function does not require VPC access as it only interacts with AWS services via APIs"
          - id: W92
            reason: "Function does not require reserved concurrency as it scales based on demand"
    # checkov:skip=CKV_AWS_116: ""DLQ not required for Lookup function as it is called only from CLI"
    # checkov:skip=CKV_AWS_117: "Function does not require VPC access as it only interacts with AWS services via APIs"
    # checkov:skip=CKV_AWS_115: "Function does not require reserved concurrency as it scales based on demand"
    # checkov:skip=CKV_AWS_173: "Environment variables do not contain sensitive data - only configuration values like feature flags and non-sensitive settings"
    Properties:
      PermissionsBoundary:
        !If [
          HasPermissionsBoundary,
          !Ref PermissionsBoundaryArn,
          !Ref AWS::NoValue,
        ]
      CodeUri: src/lambda/lookup_function/
      Handler: index.handler
      Runtime: python3.12
      Timeout: 30
      LoggingConfig:
        LogGroup: !Ref LookupFunctionLogGroup
      Environment:
        Variables:
          LOG_LEVEL: !Ref LogLevel
          TRACKING_TABLE: !Ref TrackingTable
      Policies:
        - DynamoDBReadPolicy:
            TableName: !Ref TrackingTable
        - Statement:
            - Effect: Allow
              Action:
                - states:DescribeExecution
                - states:GetExecutionHistory
              Resource:
                - !Sub
                  - "arn:${AWS::Partition}:states:${AWS::Region}:${AWS::AccountId}:execution:${StateMachineName}*"
                  - StateMachineName: !If
                      - IsPattern3
                      - !GetAtt PATTERN3STACK.Outputs.StateMachineName
                      - !If
                        - IsPattern2
                        - !GetAtt PATTERN2STACK.Outputs.StateMachineName
                        - !GetAtt PATTERN1STACK.Outputs.StateMachineName
            - Effect: Allow
              Action:
                - kms:Encrypt
                - kms:Decrypt
                - kms:ReEncrypt*
                - kms:GenerateDataKey*
                - kms:DescribeKey
              Resource: !GetAtt CustomerManagedEncryptionKey.Arn

  LookupFunctionLogGroup:
    Type: AWS::Logs::LogGroup
    Properties:
      KmsKeyId: !GetAtt CustomerManagedEncryptionKey.Arn

      RetentionInDays: !Ref LogRetentionDays

  ##########################################################################
  # Agent resources for text-to-agent feature
  ##########################################################################
  # DynamoDB table for agent job tracking
  AgentTable:
    Type: AWS::DynamoDB::Table
    Properties:
      PointInTimeRecoverySpecification:
        PointInTimeRecoveryEnabled: true
      BillingMode: PAY_PER_REQUEST
      AttributeDefinitions:
        - AttributeName: PK
          AttributeType: S
        - AttributeName: SK
          AttributeType: S
      KeySchema:
        - AttributeName: PK
          KeyType: HASH
        - AttributeName: SK
          KeyType: RANGE
      TimeToLiveSpecification:
        AttributeName: ExpiresAfter
        Enabled: true
      SSESpecification:
        SSEEnabled: true
        SSEType: KMS
        KMSMasterKeyId: !Ref CustomerManagedEncryptionKey

  # Secrets Manager secret for External MCP Agent credentials
  ExternalMCPAgentsSecret:
    Type: AWS::SecretsManager::Secret
    Properties:
      Name: !Sub "${AWS::StackName}/external-mcp-agents/credentials"
      Description: "Credentials for External MCP Agents - JSON array with required fields: mcp_url, cognito_user_pool_id, cognito_client_id, cognito_username, cognito_password. Optional fields: agent_name, agent_description"
      SecretString: "[]"
      KmsKeyId: !Ref CustomerManagedEncryptionKey

  # Lambda function for agent chat resolver
  AgentChatResolverFunction:
    Type: AWS::Serverless::Function
    Metadata:
      cfn_nag:
        rules_to_suppress:
          - id: W89
            reason: "Function does not require VPC access as it only interacts with AWS services via APIs"
          - id: W92
            reason: "Function does not require reserved concurrency as it scales based on demand"
          - id: W58
            reason: "DLQ not required for AppSeync Resolver function"
          - id: W11
            reason: "Role requires * resource access for Marketplace, CloudWatch Metrics and Logs"
    # checkov:skip=CKV_AWS_116: "DLQ not required for analytics processor as it's invoked asynchronously by request handler with error handling and job status tracking in DynamoDB"
    # checkov:skip=CKV_AWS_117: "Function does not require VPC access as it only interacts with AWS services via APIs"
    # checkov:skip=CKV_AWS_115: "Function does not require reserved concurrency as it scales based on demand"
    # checkov:skip=CKV_AWS_173: "Environment variables do not contain sensitive data - only configuration values like feature flags and non-sensitive settings"
    Properties:
      PermissionsBoundary:
        !If [
          HasPermissionsBoundary,
          !Ref PermissionsBoundaryArn,
          !Ref AWS::NoValue,
        ]
      CodeUri: src/lambda/agent_chat_resolver/
      Handler: index.handler
      Runtime: python3.12
      Environment:
        Variables:
          LOG_LEVEL: !Ref LogLevel
          CHAT_MESSAGES_TABLE: !Ref ChatMessagesTable
          AGENT_CHAT_PROCESSOR_FUNCTION: !Ref AgentChatProcessorFunction
          DATA_RETENTION_DAYS: !Ref DataRetentionInDays
          CHAT_SESSIONS_TABLE: !Ref ChatSessionsTable
      LoggingConfig:
        LogGroup: !Ref AgentChatResolverLogGroup
      Policies:
        - Statement:
            Effect: Allow
            Action: lambda:InvokeFunction
            Resource: !GetAtt AgentChatProcessorFunction.Arn
        - DynamoDBCrudPolicy:
            TableName: !Ref ChatMessagesTable
        - DynamoDBCrudPolicy:
            TableName: !Ref ChatSessionsTable
        - LambdaInvokePolicy:
            FunctionName: !Ref AgentChatProcessorFunction
        - Statement:
            Effect: Allow
            Action:
              - kms:Encrypt
              - kms:Decrypt
              - kms:ReEncrypt*
              - kms:GenerateDataKey*
              - kms:DescribeKey
            Resource: !GetAtt CustomerManagedEncryptionKey.Arn

  AgentChatResolverLogGroup:
    Type: AWS::Logs::LogGroup
    Properties:
      KmsKeyId: !GetAtt CustomerManagedEncryptionKey.Arn
      RetentionInDays: !Ref LogRetentionDays

  # Lambda function for agent chat processor
  AgentChatProcessorFunction:
    Type: AWS::Serverless::Function
    Metadata:
      cfn_nag:
        rules_to_suppress:
          - id: W89
            reason: "Function does not require VPC access as it only interacts with AWS services via APIs"
          - id: W92
            reason: "Function does not require reserved concurrency as it scales based on demand"
          - id: W58
            reason: "DLQ not required for Cfn Custom Resource function"
          - id: W76
            reason: "Suppressing W76: SPCM for IAM policy document is higher than 25"
          - id: W11
            reason: "Role requires * resource access for CloudWatch Metrics and Logs"
    # checkov:skip=CKV_AWS_116: "DLQ not required for analytics processor as it's invoked asynchronously by request handler with error handling and job status tracking in DynamoDB"
    # checkov:skip=CKV_AWS_117: "Function does not require VPC access as it only interacts with AWS services via APIs"
    # checkov:skip=CKV_AWS_115: "Function does not require reserved concurrency as it scales based on demand"
    # checkov:skip=CKV_AWS_173: "Environment variables do not contain sensitive data - only configuration values like feature flags and non-sensitive settings"
    Properties:
      PermissionsBoundary:
        !If [
          HasPermissionsBoundary,
          !Ref PermissionsBoundaryArn,
          !Ref AWS::NoValue,
        ]
      CodeUri: src/lambda/agent_chat_processor/
      Handler: index.handler
      Runtime: python3.12
      Timeout: 600 # Increase timeout to handle longer Bedrock responses
      MemorySize: 1024 # Increase memory for agents with MCP clients and streaming
      Environment:
        Variables:
          LOG_LEVEL: !Ref LogLevel
          CONFIGURATION_TABLE_NAME: !Ref ConfigurationTable
          TRACKING_TABLE_NAME: !Ref TrackingTable
          LOOKUP_FUNCTION_NAME: !Ref LookupFunction
          STRANDS_LOG_LEVEL: !Ref LogLevel
          BEDROCK_REGION: !Ref AWS::Region
          CHAT_MESSAGES_TABLE: !Ref ChatMessagesTable
          ID_HELPER_CHAT_MEMORY_TABLE: !Ref IdHelperChatMemoryTable
          MEMORY_METHOD: dynamodb
          STREAMING_ENABLED: true
          MAX_CONVERSATION_TURNS: 20
          MAX_MESSAGE_SIZE_KB: 8.5
          DATA_RETENTION_DAYS: !Ref DataRetentionInDays
          APPSYNC_API_URL: !GetAtt GraphQLApi.GraphQLUrl
          ATHENA_DATABASE: !Ref ReportingDatabase
          ATHENA_OUTPUT_LOCATION: !Sub
            - "s3://${Bucket}/athena-results/"
            - Bucket: !If
                - ShouldCreateReportingBucket
                - !Ref ReportingBucket
                - !Ref ReportingBucketName
          AWS_STACK_NAME: !Ref AWS::StackName
          GUARDRAIL_ID_AND_VERSION:
            !If [
              HasGuardrailConfig,
              !Sub "${BedrockGuardrailId}:${BedrockGuardrailVersion}",
              "",
            ]
          CLOUDWATCH_LOG_GROUP_PREFIX: !Sub "/aws/lambda/${AWS::StackName}"
          CLOUDWATCH_LOG_GROUPS: !Join
            - ","
            - - !Ref QueueSenderLogGroup
              - !Ref QueueProcessorLogGroup
              - !Ref WorkflowTrackerLogGroup
              - !Ref SaveReportingDataFunctionLogGroup
              - !If
                - IsPattern1
                - !GetAtt PATTERN1STACK.Outputs.PatternLogGroups
                - !If
                  - IsPattern2
                  - !GetAtt PATTERN2STACK.Outputs.PatternLogGroups
                  - !GetAtt PATTERN3STACK.Outputs.PatternLogGroups
      LoggingConfig:
        LogGroup: !Ref AgentChatProcessorLogGroup
      Policies:
        - Statement:
            Effect: Allow
            Action: bedrock-agentcore:InvokeAgentRuntime
            Resource: "*"
        - Statement:
            Effect: Allow
            Action: appsync:GraphQL
            Resource: !Sub "arn:${AWS::Partition}:appsync:${AWS::Region}:${AWS::AccountId}:apis/${GraphQLApi.ApiId}/*"
        - DynamoDBCrudPolicy:
            TableName: !Ref ChatMessagesTable
        - DynamoDBCrudPolicy:
            TableName: !Ref IdHelperChatMemoryTable
        - DynamoDBReadPolicy:
            TableName: !Ref ConfigurationTable
        - S3CrudPolicy:
            BucketName: !If
              - ShouldCreateReportingBucket
              - !Ref ReportingBucket
              - !Ref ReportingBucketName
        - Statement:
            - Effect: Allow
              Action:
                - athena:StartQueryExecution
                - athena:GetQueryExecution
                - athena:GetQueryResults
              Resource:
                - !Sub "arn:${AWS::Partition}:athena:${AWS::Region}:${AWS::AccountId}:workgroup/primary"
                - !Sub "arn:${AWS::Partition}:athena:${AWS::Region}:${AWS::AccountId}:datacatalog/*"
            - Effect: Allow
              Action:
                - glue:GetTable
                - glue:GetTables
                - glue:GetDatabase
                - glue:GetDatabases
                - glue:GetPartitions
              Resource:
                - !Sub "arn:${AWS::Partition}:glue:${AWS::Region}:${AWS::AccountId}:catalog"
                - !Sub "arn:${AWS::Partition}:glue:${AWS::Region}:${AWS::AccountId}:database/${ReportingDatabase}"
                - !Sub "arn:${AWS::Partition}:glue:${AWS::Region}:${AWS::AccountId}:table/${ReportingDatabase}/*"
            - Effect: Allow
              Action:
                - bedrock:InvokeModel
                - bedrock:InvokeModelWithResponseStream
              Resource:
                - !Sub "arn:${AWS::Partition}:bedrock:*::foundation-model/*"
                - !Sub "arn:${AWS::Partition}:bedrock:${AWS::Region}:${AWS::AccountId}:inference-profile/*"
            - Effect: Allow
              Action:
                - aws-marketplace:Subscribe
                - aws-marketplace:Unsubscribe
                - aws-marketplace:ViewSubscriptions
              Resource: "*"
            - !If
              - HasGuardrailConfig
              - Effect: Allow
                Action:
                  - "bedrock:ApplyGuardrail"
                Resource:
                  - !Sub "arn:${AWS::Partition}:bedrock:${AWS::Region}:${AWS::AccountId}:guardrail/${BedrockGuardrailId}"
              - !Ref AWS::NoValue
            - Effect: Allow
              Action:
                - appsync:GraphQL
              Resource:
                - !Sub "${GraphQLApi.Arn}/types/Mutation/*"
            - Effect: Allow
              Action:
                - kms:Encrypt
                - kms:Decrypt
                - kms:ReEncrypt*
                - kms:GenerateDataKey*
                - kms:DescribeKey
              Resource: !GetAtt CustomerManagedEncryptionKey.Arn
            - Effect: Allow
              Action:
                - bedrock-agentcore:StartCodeInterpreterSession
                - bedrock-agentcore:StopCodeInterpreterSession
                - bedrock-agentcore:InvokeCodeInterpreter
                - bedrock-agentcore:GetCodeInterpreterSession
                - bedrock-agentcore:ListCodeInterpreterSessions
              Resource:
                - !Sub "arn:${AWS::Partition}:bedrock-agentcore:*:aws:code-interpreter/*"
            - Effect: Allow
              Action:
                - secretsmanager:GetSecretValue
              Resource:
                - !Ref ExternalMCPAgentsSecret
            - Effect: Allow
              Action:
                - logs:DescribeLogGroups
                - logs:DescribeLogStreams
                - logs:FilterLogEvents
                - logs:GetLogEvents
              Resource:
                - !Sub "arn:${AWS::Partition}:logs:${AWS::Region}:${AWS::AccountId}:log-group:/aws/lambda/${AWS::StackName}*"
                - !Sub "arn:${AWS::Partition}:logs:${AWS::Region}:${AWS::AccountId}:log-group:/aws/vendedlogs/states/${AWS::StackName}*"
                - !Sub "arn:${AWS::Partition}:logs:${AWS::Region}:${AWS::AccountId}:log-group:/${AWS::StackName}*"
                - !GetAtt QueueSenderLogGroup.Arn
                - !GetAtt QueueProcessorLogGroup.Arn
                - !GetAtt WorkflowTrackerLogGroup.Arn
                - !GetAtt SaveReportingDataFunctionLogGroup.Arn
            - Effect: Allow
              Action:
                - logs:DescribeLogGroups
              Resource:
                - "*"
            - Effect: Allow
              Action:
                - dynamodb:DescribeTable
                - dynamodb:Scan
                - dynamodb:Query
                - dynamodb:GetItem
                - dynamodb:Query
              Resource:
                - !GetAtt TrackingTable.Arn
            - Effect: Allow
              Action:
                - cloudformation:DescribeStackResources
                - cloudformation:DescribeStacks
              Resource:
                - !Sub "arn:${AWS::Partition}:cloudformation:${AWS::Region}:${AWS::AccountId}:stack/${AWS::StackName}/*"
            - Effect: Allow
              Action:
                - lambda:InvokeFunction
              Resource:
                - !Sub "arn:${AWS::Partition}:lambda:${AWS::Region}:${AWS::AccountId}:function:${AWS::StackName}*"
            - Effect: Allow
              Action:
                - states:DescribeExecution
                - states:GetExecutionHistory
              Resource:
                - !Sub "arn:${AWS::Partition}:states:${AWS::Region}:${AWS::AccountId}:execution:${AWS::StackName}*"
            - Effect: Allow
              Action:
                - xray:GetTraceSummaries
                - xray:BatchGetTraces
                - xray:GetServiceGraph
              Resource: "*"

  AgentChatProcessorLogGroup:
    Type: AWS::Logs::LogGroup
    Properties:
      KmsKeyId: !GetAtt CustomerManagedEncryptionKey.Arn
      RetentionInDays: !Ref LogRetentionDays

  ##########################################################################
  # DynamoDB Table for Agent Chat Session Metadata
  ##########################################################################

  ChatSessionsTable:
    Type: AWS::DynamoDB::Table
    Properties:
      PointInTimeRecoverySpecification:
        PointInTimeRecoveryEnabled: true
      BillingMode: PAY_PER_REQUEST
      AttributeDefinitions:
        - AttributeName: userId
          AttributeType: S
        - AttributeName: sessionId
          AttributeType: S
      KeySchema:
        - AttributeName: userId
          KeyType: HASH
        - AttributeName: sessionId
          KeyType: RANGE
      TimeToLiveSpecification:
        AttributeName: ExpiresAfter
        Enabled: true
      SSESpecification:
        SSEEnabled: true
        SSEType: KMS
        KMSMasterKeyId: !Ref CustomerManagedEncryptionKey

  ##########################################################################
  # Lambda Functions for Agent Chat Session Management
  ##########################################################################

  # Lambda function for listing agent chat sessions
  ListAgentChatSessionsFunction:
    Type: AWS::Serverless::Function
    Metadata:
      cfn_nag:
        rules_to_suppress:
          - id: W89
            reason: "Function does not require VPC access as it only interacts with AWS services via APIs"
          - id: W92
            reason: "Function does not require reserved concurrency as it scales based on demand"
    # checkov:skip=CKV_AWS_116: "DLQ not required for AppSync resolver function"
    # checkov:skip=CKV_AWS_117: "Function does not require VPC access as it only interacts with AWS services via APIs"
    # checkov:skip=CKV_AWS_115: "Function does not require reserved concurrency as it scales based on demand"
    # checkov:skip=CKV_AWS_173: "Environment variables do not contain sensitive data - only configuration values like feature flags and non-sensitive settings"
    Properties:
      PermissionsBoundary:
        !If [
          HasPermissionsBoundary,
          !Ref PermissionsBoundaryArn,
          !Ref AWS::NoValue,
        ]
      CodeUri: src/lambda/list_agent_chat_sessions_resolver/
      Handler: index.handler
      Runtime: python3.12
      Timeout: 60
      Environment:
        Variables:
          LOG_LEVEL: !Ref LogLevel
          CHAT_SESSIONS_TABLE: !Ref ChatSessionsTable
      LoggingConfig:
        LogGroup: !Ref ListAgentChatSessionsFunctionLogGroup
      Policies:
        - DynamoDBCrudPolicy:
            TableName: !Ref ChatSessionsTable
        - Statement:
            - Effect: Allow
              Action:
                - kms:Encrypt
                - kms:Decrypt
                - kms:ReEncrypt*
                - kms:GenerateDataKey*
                - kms:DescribeKey
              Resource: !GetAtt CustomerManagedEncryptionKey.Arn

  ListAgentChatSessionsFunctionLogGroup:
    Type: AWS::Logs::LogGroup
    Properties:
      KmsKeyId: !GetAtt CustomerManagedEncryptionKey.Arn
      RetentionInDays: !Ref LogRetentionDays

  # Lambda function for getting agent chat messages
  GetAgentChatMessagesFunction:
    Type: AWS::Serverless::Function
    Metadata:
      cfn_nag:
        rules_to_suppress:
          - id: W89
            reason: "Function does not require VPC access as it only interacts with AWS services via APIs"
          - id: W92
            reason: "Function does not require reserved concurrency as it scales based on demand"
    # checkov:skip=CKV_AWS_116: "DLQ not required for AppSync resolver function"
    # checkov:skip=CKV_AWS_117: "Function does not require VPC access as it only interacts with AWS services via APIs"
    # checkov:skip=CKV_AWS_115: "Function does not require reserved concurrency as it scales based on demand"
    # checkov:skip=CKV_AWS_173: "Environment variables do not contain sensitive data - only configuration values like feature flags and non-sensitive settings"
    Properties:
      PermissionsBoundary:
        !If [
          HasPermissionsBoundary,
          !Ref PermissionsBoundaryArn,
          !Ref AWS::NoValue,
        ]
      CodeUri: src/lambda/get_agent_chat_messages_resolver/
      Handler: index.handler
      Runtime: python3.12
      Timeout: 60
      Environment:
        Variables:
          LOG_LEVEL: !Ref LogLevel
          CHAT_MESSAGES_TABLE: !Ref ChatMessagesTable
      LoggingConfig:
        LogGroup: !Ref GetAgentChatMessagesFunctionLogGroup
      Policies:
        - DynamoDBCrudPolicy:
            TableName: !Ref ChatMessagesTable
        - Statement:
            - Effect: Allow
              Action:
                - kms:Encrypt
                - kms:Decrypt
                - kms:ReEncrypt*
                - kms:GenerateDataKey*
                - kms:DescribeKey
              Resource: !GetAtt CustomerManagedEncryptionKey.Arn

  GetAgentChatMessagesFunctionLogGroup:
    Type: AWS::Logs::LogGroup
    Properties:
      KmsKeyId: !GetAtt CustomerManagedEncryptionKey.Arn
      RetentionInDays: !Ref LogRetentionDays

  # Lambda function for deleting agent chat sessions
  DeleteAgentChatSessionFunction:
    Type: AWS::Serverless::Function
    Metadata:
      cfn_nag:
        rules_to_suppress:
          - id: W89
            reason: "Function does not require VPC access as it only interacts with AWS services via APIs"
          - id: W92
            reason: "Function does not require reserved concurrency as it scales based on demand"
    # checkov:skip=CKV_AWS_116: "DLQ not required for AppSync resolver function"
    # checkov:skip=CKV_AWS_117: "Function does not require VPC access as it only interacts with AWS services via APIs"
    # checkov:skip=CKV_AWS_115: "Function does not require reserved concurrency as it scales based on demand"
    # checkov:skip=CKV_AWS_173: "Environment variables do not contain sensitive data - only configuration values like feature flags and non-sensitive settings"
    Properties:
      PermissionsBoundary:
        !If [
          HasPermissionsBoundary,
          !Ref PermissionsBoundaryArn,
          !Ref AWS::NoValue,
        ]
      CodeUri: src/lambda/delete_agent_chat_session_resolver/
      Handler: index.handler
      Runtime: python3.12
      Timeout: 60
      Environment:
        Variables:
          LOG_LEVEL: !Ref LogLevel
          CHAT_MESSAGES_TABLE: !Ref ChatMessagesTable
          CHAT_SESSIONS_TABLE: !Ref ChatSessionsTable
      LoggingConfig:
        LogGroup: !Ref DeleteAgentChatSessionFunctionLogGroup
      Policies:
        - DynamoDBCrudPolicy:
            TableName: !Ref ChatMessagesTable
        - DynamoDBCrudPolicy:
            TableName: !Ref ChatSessionsTable
        - Statement:
            - Effect: Allow
              Action:
                - kms:Encrypt
                - kms:Decrypt
                - kms:ReEncrypt*
                - kms:GenerateDataKey*
                - kms:DescribeKey
              Resource: !GetAtt CustomerManagedEncryptionKey.Arn

  DeleteAgentChatSessionFunctionLogGroup:
    Type: AWS::Logs::LogGroup
    Properties:
      KmsKeyId: !GetAtt CustomerManagedEncryptionKey.Arn
      RetentionInDays: !Ref LogRetentionDays

  ##########################################################################
  # AppSync Data Sources for Agent Chat Session Management
  ##########################################################################

  ListAgentChatSessionsDataSource:
    Type: AWS::AppSync::DataSource
    Properties:
      ApiId: !GetAtt GraphQLApi.ApiId
      Name: ListAgentChatSessionsDataSource
      Description: Lambda function for listing agent chat sessions
      Type: AWS_LAMBDA
      ServiceRoleArn: !GetAtt AppSyncServiceRole.Arn
      LambdaConfig:
        LambdaFunctionArn: !GetAtt ListAgentChatSessionsFunction.Arn

  GetAgentChatMessagesDataSource:
    Type: AWS::AppSync::DataSource
    Properties:
      ApiId: !GetAtt GraphQLApi.ApiId
      Name: GetAgentChatMessagesDataSource
      Description: Lambda function for getting agent chat messages
      Type: AWS_LAMBDA
      ServiceRoleArn: !GetAtt AppSyncServiceRole.Arn
      LambdaConfig:
        LambdaFunctionArn: !GetAtt GetAgentChatMessagesFunction.Arn

  DeleteAgentChatSessionDataSource:
    Type: AWS::AppSync::DataSource
    Properties:
      ApiId: !GetAtt GraphQLApi.ApiId
      Name: DeleteAgentChatSessionDataSource
      Description: Lambda function for deleting agent chat sessions
      Type: AWS_LAMBDA
      ServiceRoleArn: !GetAtt AppSyncServiceRole.Arn
      LambdaConfig:
        LambdaFunctionArn: !GetAtt DeleteAgentChatSessionFunction.Arn

  ##########################################################################
  # AppSync Resolvers for Agent Chat Session Management
  ##########################################################################

  ListChatSessionsResolver:
    Type: AWS::AppSync::Resolver
    DependsOn: GraphQLSchema
    Properties:
      ApiId: !GetAtt GraphQLApi.ApiId
      TypeName: Query
      FieldName: listChatSessions
      DataSourceName: !GetAtt ListAgentChatSessionsDataSource.Name
      
  GetChatMessagesResolver:
    Type: AWS::AppSync::Resolver
    DependsOn: GraphQLSchema
    Properties:
      ApiId: !GetAtt GraphQLApi.ApiId
      TypeName: Query
      FieldName: getChatMessages
      DataSourceName: !GetAtt GetAgentChatMessagesDataSource.Name

  DeleteChatSessionResolver:
    Type: AWS::AppSync::Resolver
    DependsOn: GraphQLSchema
    Properties:
      ApiId: !GetAtt GraphQLApi.ApiId
      TypeName: Mutation
      FieldName: deleteChatSession
      DataSourceName: !GetAtt DeleteAgentChatSessionDataSource.Name

  # Lambda function for listing available agents
  ListAvailableAgentsFunction:
    Type: AWS::Serverless::Function
    Metadata:
      cfn_nag:
        rules_to_suppress:
          - id: W89
            reason: "Function does not require VPC access as it only interacts with local agent factory"
          - id: W92
            reason: "Function does not require reserved concurrency as it scales based on demand"
    # checkov:skip=CKV_AWS_116: "DLQ not required for AppSync resolver function"
    # checkov:skip=CKV_AWS_117: "Function does not require VPC access as it only interacts with local agent factory"
    # checkov:skip=CKV_AWS_115: "Function does not require reserved concurrency as it scales based on demand"
    # checkov:skip=CKV_AWS_173: "Environment variables do not contain sensitive data - only configuration values like feature flags and non-sensitive settings"
    Properties:
      PermissionsBoundary:
        !If [
          HasPermissionsBoundary,
          !Ref PermissionsBoundaryArn,
          !Ref AWS::NoValue,
        ]
      CodeUri: src/lambda/list_available_agents/
      Handler: index.handler
      Runtime: python3.12
      Timeout: 30
      Environment:
        Variables:
          LOG_LEVEL: !Ref LogLevel
          AWS_STACK_NAME: !Ref AWS::StackName
      Policies:
        - Version: "2012-10-17"
          Statement:
            - Effect: Allow
              Action:
                - secretsmanager:GetSecretValue
              Resource:
                - !Ref ExternalMCPAgentsSecret
            - Effect: Allow
              Action:
                - kms:Decrypt
                - kms:DescribeKey
              Resource: !GetAtt CustomerManagedEncryptionKey.Arn
      LoggingConfig:
        LogGroup: !Ref ListAvailableAgentsLogGroup

  ListAvailableAgentsLogGroup:
    Type: AWS::Logs::LogGroup
    Properties:
      KmsKeyId: !GetAtt CustomerManagedEncryptionKey.Arn
      RetentionInDays: !Ref LogRetentionDays

  # AppSync resolvers for agent operations
  ListAvailableAgentsResolver:
    Type: AWS::AppSync::Resolver
    DependsOn: GraphQLSchema
    Properties:
      ApiId: !GetAtt GraphQLApi.ApiId
      TypeName: Query
      FieldName: listAvailableAgents
      DataSourceName: !GetAtt ListAvailableAgentsDataSource.Name

  ListAvailableAgentsDataSource:
    Type: AWS::AppSync::DataSource
    Properties:
      ApiId: !GetAtt GraphQLApi.ApiId
      Name: ListAvailableAgentsDataSource
      Description: Lambda function for listing available agents
      Type: AWS_LAMBDA
      ServiceRoleArn: !GetAtt AppSyncServiceRole.Arn
      LambdaConfig:
        LambdaFunctionArn: !GetAtt ListAvailableAgentsFunction.Arn

  AgentChatDataSource:
    Type: AWS::AppSync::DataSource
    Properties:
      ApiId: !GetAtt GraphQLApi.ApiId
      Name: AgentChatDataSource
      Type: AWS_LAMBDA
      ServiceRoleArn: !GetAtt AppSyncServiceRole.Arn
      LambdaConfig:
        LambdaFunctionArn: !GetAtt AgentChatResolverFunction.Arn

  SendAgentChatMessageResolver:
    Type: AWS::AppSync::Resolver
    Properties:
      ApiId: !GetAtt GraphQLApi.ApiId
      TypeName: Mutation
      FieldName: sendAgentChatMessage
      DataSourceName: !GetAtt AgentChatDataSource.Name
      RequestMappingTemplate: |
        {
          "version": "2017-02-28",
          "operation": "Invoke",
          "payload": {
            "arguments": $util.toJson($context.arguments),
            "identity": {
              "username": $util.toJson($context.identity.username),
              "sub": $util.toJson($context.identity.sub),
              "sourceIp": $util.toJson($context.identity.sourceIp),
              "userArn": $util.toJson($context.identity.userArn),
              "accountId": $util.toJson($context.identity.accountId),  
              "cognitoIdentityPoolId": $util.toJson($context.identity.cognitoIdentityPoolId),
              "cognitoIdentityId": $util.toJson($context.identity.cognitoIdentityId),
              "userPoolUserId": $util.toJson($context.identity.claims.sub),
              "claims": $util.toJson($context.identity.claims)
            }
          }
        }
      ResponseMappingTemplate: |
        #if($ctx.error)
            $util.error($ctx.error.message, $ctx.error.type)
        #end
        #if($ctx.result)
            $util.toJson($ctx.result)
        #else
            $util.error("No response from Lambda")
        #end

  OnAgentChatMessageUpdateResolver:
    Type: AWS::AppSync::Resolver
    Properties:
      ApiId: !GetAtt GraphQLApi.ApiId
      TypeName: Subscription
      FieldName: onAgentChatMessageUpdate
      DataSourceName: !GetAtt NoneDataSource.Name
      RequestMappingTemplate: |
        {
          "version": "2018-05-29",
          "payload": {}
        }
      ResponseMappingTemplate: |
        #if($context.arguments.sessionId && $context.source.sessionId)
          #if($context.arguments.sessionId == $context.source.sessionId)
            $util.toJson($context.source)
          #else
            #set($result = $util.appendError("Session ID does not match", "Unauthorized"))
            $util.toJson(null)
          #end
        #else
          $util.toJson($context.source)
        #end     

  AgentChatResolverDataSource:
    Type: AWS::AppSync::DataSource
    Properties:
      ApiId: !GetAtt GraphQLApi.ApiId
      Name: AgentChatResolverDataSource
      Description: Lambda function for handling agent chat messages
      Type: AWS_LAMBDA
      ServiceRoleArn: !GetAtt AppSyncServiceRole.Arn
      LambdaConfig:
        LambdaFunctionArn: !GetAtt AgentChatResolverFunction.Arn

  GetAgentJobStatusResolver:
    Type: AWS::AppSync::Resolver
    DependsOn: GraphQLSchema
    Properties:
      ApiId: !GetAtt GraphQLApi.ApiId
      TypeName: Query
      FieldName: getAgentJobStatus
      DataSourceName: !GetAtt AgentTableDataSource.Name
      RequestMappingTemplate: |
        #set($userId = $context.identity.username)
        #if(!$userId)
          #set($userId = $context.identity.sub)
        #end
        #if(!$userId)
          #set($userId = "anonymous")
        #end
        {
          "version": "2018-05-29",
          "operation": "GetItem",
          "key": {
            "PK": $util.dynamodb.toDynamoDBJson("agent#${userId}"),
            "SK": $util.dynamodb.toDynamoDBJson($ctx.args.jobId)
          }
        }
      ResponseMappingTemplate: |
        #if(!$ctx.result)
          null
        #else
          {
            "jobId": $util.toJson($ctx.result.SK),
            "status": $util.toJson($ctx.result.status),
            "query": $util.toJson($ctx.result.query),
            "agentIds": $util.toJson($ctx.result.agentIds),
            "createdAt": $util.toJson($ctx.result.createdAt),
            "completedAt": $util.toJson($ctx.result.completedAt),
            "result": $util.toJson($ctx.result.result),
            "error": $util.toJson($ctx.result.error),
            "agent_messages": $util.toJson($ctx.result.agent_messages)
          }
        #end

  ListAgentJobsResolver:
    Type: AWS::AppSync::Resolver
    DependsOn: GraphQLSchema
    Properties:
      ApiId: !GetAtt GraphQLApi.ApiId
      TypeName: Query
      FieldName: listAgentJobs
      DataSourceName: !GetAtt AgentTableDataSource.Name
      RequestMappingTemplate: |
        #set($userId = $context.identity.username)
        #if(!$userId)
          #set($userId = $context.identity.sub)
        #end
        #if(!$userId)
          #set($userId = "anonymous")
        #end
        {
          "version": "2018-05-29",
          "operation": "Query",
          "query": {
            "expression": "PK = :pk",
            "expressionValues": {
              ":pk": $util.dynamodb.toDynamoDBJson("agent#${userId}")
            }
          },
          #if($ctx.args.limit)
            "limit": $ctx.args.limit,
          #end
          #if($ctx.args.nextToken)
            "nextToken": "$ctx.args.nextToken",
          #end
          "scanIndexForward": false
        }
      ResponseMappingTemplate: |
        {
          "items": [
            #foreach($item in $ctx.result.items)
              {
                "jobId": $util.toJson($item.SK),
                "status": $util.toJson($item.status),
                "query": $util.toJson($item.query),
                "agentIds": $util.toJson($item.agentIds),
                "createdAt": $util.toJson($item.createdAt),
                "completedAt": $util.toJson($item.completedAt),
                "result": $util.toJson($item.result),
                "error": $util.toJson($item.error)
              }#if($foreach.hasNext),#end
            #end
          ],
          "nextToken": $util.toJson($ctx.result.nextToken)
        }

  UpdateAgentJobStatusResolver:
    Type: AWS::AppSync::Resolver
    DependsOn: GraphQLSchema
    Properties:
      ApiId: !GetAtt GraphQLApi.ApiId
      TypeName: Mutation
      FieldName: updateAgentJobStatus
      DataSourceName: !GetAtt AgentTableDataSource.Name
      RequestMappingTemplate: |-
        #set($userId = $ctx.args.userId)
        #set($expNames = {})
        #set($expValues = {})

        ## Set status (required)
        $util.qr($expNames.put("#status", "status"))
        $util.qr($expValues.put(":status", $util.dynamodb.toDynamoDB($ctx.args.status)))
        #set($updateExpression = "SET #status = :status")

        ## Set result (optional)
        #if($ctx.args.result)
          $util.qr($expNames.put("#result", "result"))
          $util.qr($expValues.put(":result", $util.dynamodb.toDynamoDB($ctx.args.result)))
          #set($updateExpression = "${updateExpression}, #result = :result")
        #end

        ## Set completedAt to current timestamp when status is COMPLETED or FAILED
        #if($ctx.args.status == "COMPLETED" || $ctx.args.status == "FAILED")
          $util.qr($expNames.put("#completedAt", "completedAt"))
          $util.qr($expValues.put(":completedAt", $util.dynamodb.toDynamoDB($util.time.nowISO8601())))
          #set($updateExpression = "${updateExpression}, #completedAt = :completedAt")
        #end

        {
          "version": "2018-05-29",
          "operation": "UpdateItem",
          "key": {
            "PK": $util.dynamodb.toDynamoDBJson("agent#${userId}"),
            "SK": $util.dynamodb.toDynamoDBJson($ctx.args.jobId)
          },
          "update": {
            "expression": "$updateExpression",
            "expressionNames": $utils.toJson($expNames),
            "expressionValues": $utils.toJson($expValues)
          }
        }
      ResponseMappingTemplate: |-
        #if($ctx.error)
          $util.error($ctx.error.message, $ctx.error.type)
        #end

        ## Return false if no item was updated (item not found)
        #if(!$ctx.result)
          false
        #else
          true
        #end

  DeleteAgentJobResolver:
    Type: AWS::AppSync::Resolver
    DependsOn: GraphQLSchema
    Properties:
      ApiId: !GetAtt GraphQLApi.ApiId
      TypeName: Mutation
      FieldName: deleteAgentJob
      DataSourceName: !GetAtt AgentTableDataSource.Name
      RequestMappingTemplate: |-
        #set($userId = $context.identity.username)
        #if(!$userId)
          #set($userId = $context.identity.sub)
        #end
        #if(!$userId)
          #set($userId = "anonymous")
        #end
        {
          "version": "2018-05-29",
          "operation": "DeleteItem",
          "key": {
            "PK": $util.dynamodb.toDynamoDBJson("agent#${userId}"),
            "SK": $util.dynamodb.toDynamoDBJson($ctx.args.jobId)
          }
        }
      ResponseMappingTemplate: |-
        #if($ctx.error)
          $util.error($ctx.error.message, $ctx.error.type)
        #else
          true
        #end

  AgentTableDataSource:
    Type: AWS::AppSync::DataSource
    Properties:
      ApiId: !GetAtt GraphQLApi.ApiId
      Name: AgentTableDataSource
      Description: DynamoDB table for agent job tracking
      Type: AMAZON_DYNAMODB
      ServiceRoleArn: !GetAtt AppSyncServiceRole.Arn
      DynamoDBConfig:
        TableName: !Ref AgentTable
        AwsRegion: !Ref AWS::Region


  ChatMessagesTable:
    Type: AWS::DynamoDB::Table
    Properties:
      PointInTimeRecoverySpecification:
        PointInTimeRecoveryEnabled: true
      BillingMode: PAY_PER_REQUEST
      AttributeDefinitions:
        - AttributeName: PK
          AttributeType: S
        - AttributeName: SK
          AttributeType: S
      KeySchema:
        - AttributeName: PK
          KeyType: HASH
        - AttributeName: SK
          KeyType: RANGE
      TimeToLiveSpecification:
        AttributeName: ExpiresAfter
        Enabled: true
      SSESpecification:
        SSEEnabled: true
        SSEType: KMS
        KMSMasterKeyId: !Ref CustomerManagedEncryptionKey

  IdHelperChatMemoryTable:
    Type: AWS::DynamoDB::Table
    Properties:
      PointInTimeRecoverySpecification:
        PointInTimeRecoveryEnabled: true
      BillingMode: PAY_PER_REQUEST
      AttributeDefinitions:
        - AttributeName: PK
          AttributeType: S
        - AttributeName: SK
          AttributeType: S
      KeySchema:
        - AttributeName: PK
          KeyType: HASH
        - AttributeName: SK
          KeyType: RANGE
      TimeToLiveSpecification:
        AttributeName: ExpiresAfter
        Enabled: true
      SSESpecification:
        SSEEnabled: true
        SSEType: KMS
        KMSMasterKeyId: !Ref CustomerManagedEncryptionKey

  NoneDataSource:
    Type: AWS::AppSync::DataSource
    Properties:
      ApiId: !GetAtt GraphQLApi.ApiId
      Name: NoneDataSource
      Type: NONE

  ChatMessagesDataSource:
    Type: AWS::AppSync::DataSource
    Properties:
      ApiId: !GetAtt GraphQLApi.ApiId
      Name: ChatMessagesDataSource
      Type: AMAZON_DYNAMODB
      ServiceRoleArn: !GetAtt AppSyncServiceRole.Arn
      DynamoDBConfig:
        TableName: !Ref ChatMessagesTable
        AwsRegion: !Ref AWS::Region

  ##########################################################################
  # Backward Compatible for Error Anlayzer Agent 
  ##########################################################################

  AgentRequestHandlerLogGroup:
    Type: AWS::Logs::LogGroup
    Properties:
      LogGroupName: !Sub "/aws/lambda/${AWS::StackName}-AgentRequestHandler"
      RetentionInDays: !Ref LogRetentionDays
      KmsKeyId: !GetAtt CustomerManagedEncryptionKey.Arn
  
  AgentProcessorLogGroup:
    Type: AWS::Logs::LogGroup
    Properties:
      LogGroupName: !Sub "/aws/lambda/${AWS::StackName}-AgentProcessor"
      RetentionInDays: !Ref LogRetentionDays
      KmsKeyId: !GetAtt CustomerManagedEncryptionKey.Arn

  # Lambda function for agent request handler
  AgentRequestHandlerFunction:
    Type: AWS::Serverless::Function
    Metadata:
      cfn_nag:
        rules_to_suppress:
          - id: W89
            reason: "Function does not require VPC access as it only interacts with AWS services via APIs"
          - id: W92
            reason: "Function does not require reserved concurrency as it scales based on demand"
    # checkov:skip=CKV_AWS_116: "DLQ not required for analytics request handler as it's invoked synchronously via AppSync and errors are handled by the caller"
    # checkov:skip=CKV_AWS_117: "Function does not require VPC access as it only interacts with AWS services via APIs"
    # checkov:skip=CKV_AWS_115: "Function does not require reserved concurrency as it scales based on demand"
    # checkov:skip=CKV_AWS_173: "Environment variables do not contain sensitive data - only configuration values like feature flags and non-sensitive settings"
    Properties:
      PermissionsBoundary:
        !If [
          HasPermissionsBoundary,
          !Ref PermissionsBoundaryArn,
          !Ref AWS::NoValue,
        ]
      CodeUri: src/lambda/agent_request_handler/
      Handler: index.handler
      Runtime: python3.12
      Timeout: 30
      Environment:
        Variables:
          LOG_LEVEL: !Ref LogLevel
          AGENT_TABLE: !Ref AgentTable
          AGENT_PROCESSOR_FUNCTION: !Ref AgentProcessorFunction
          DATA_RETENTION_DAYS: !Ref DataRetentionInDays
      LoggingConfig:
        LogGroup: !Ref AgentRequestHandlerLogGroup
      Policies:
        - DynamoDBCrudPolicy:
            TableName: !Ref AgentTable
        - LambdaInvokePolicy:
            FunctionName: !Ref AgentProcessorFunction
        - Statement:
            - Effect: Allow
              Action:
                - kms:Encrypt
                - kms:Decrypt
                - kms:ReEncrypt*
                - kms:GenerateDataKey*
                - kms:DescribeKey
              Resource: !GetAtt CustomerManagedEncryptionKey.Arn

  # Lambda function for agent processor
  AgentProcessorFunction:
    Type: AWS::Serverless::Function
    Metadata:
      cfn_nag:
        rules_to_suppress:
          - id: W89
            reason: "Function does not require VPC access as it only interacts with AWS services via APIs"
          - id: W92
            reason: "Function does not require reserved concurrency as it scales based on demand"
          - id: W58
            reason: "DLQ not required for Cfn Custom Resource function"
          - id: W76
            reason: "Suppressing W76: SPCM for IAM policy document is higher than 25"
          - id: W11
            reason: "Role requires * resource access for CloudWatch Metrics and Logs"
    # checkov:skip=CKV_AWS_116: "DLQ not required for analytics processor as it's invoked asynchronously by request handler with error handling and job status tracking in DynamoDB"
    # checkov:skip=CKV_AWS_117: "Function does not require VPC access as it only interacts with AWS services via APIs"
    # checkov:skip=CKV_AWS_115: "Function does not require reserved concurrency as it scales based on demand"
    # checkov:skip=CKV_AWS_173: "Environment variables do not contain sensitive data - only configuration values like feature flags and non-sensitive settings"
    Properties:
      PermissionsBoundary:
        !If [
          HasPermissionsBoundary,
          !Ref PermissionsBoundaryArn,
          !Ref AWS::NoValue,
        ]
      CodeUri: src/lambda/agent_processor/
      Handler: index.handler
      Runtime: python3.12
      Timeout: 900
      MemorySize: 1024
      Environment:
        Variables:
          LOG_LEVEL: !Ref LogLevel
          CONFIGURATION_TABLE_NAME: !Ref ConfigurationTable
          TRACKING_TABLE_NAME: !Ref TrackingTable
          LOOKUP_FUNCTION_NAME: !Ref LookupFunction
          STRANDS_LOG_LEVEL: !Ref LogLevel
          AGENT_TABLE: !Ref AgentTable
          APPSYNC_API_URL: !GetAtt GraphQLApi.GraphQLUrl
          ATHENA_DATABASE: !Ref ReportingDatabase
          ATHENA_OUTPUT_LOCATION: !Sub
            - "s3://${Bucket}/athena-results/"
            - Bucket: !If
                - ShouldCreateReportingBucket
                - !Ref ReportingBucket
                - !Ref ReportingBucketName
          AWS_STACK_NAME: !Ref AWS::StackName
          GUARDRAIL_ID_AND_VERSION:
            !If [
              HasGuardrailConfig,
              !Sub "${BedrockGuardrailId}:${BedrockGuardrailVersion}",
              "",
            ]
          CLOUDWATCH_LOG_GROUP_PREFIX: !Sub "/aws/lambda/${AWS::StackName}"
          CLOUDWATCH_LOG_GROUPS: !Join
            - ","
            - - !Ref QueueSenderLogGroup
              - !Ref QueueProcessorLogGroup
              - !Ref WorkflowTrackerLogGroup
              - !Ref SaveReportingDataFunctionLogGroup
              - !If
                - IsPattern1
                - !GetAtt PATTERN1STACK.Outputs.PatternLogGroups
                - !If
                  - IsPattern2
                  - !GetAtt PATTERN2STACK.Outputs.PatternLogGroups
                  - !GetAtt PATTERN3STACK.Outputs.PatternLogGroups
      LoggingConfig:
        LogGroup: !Ref AgentProcessorLogGroup
      Policies:
        - DynamoDBCrudPolicy:
            TableName: !Ref AgentTable
        - DynamoDBReadPolicy:
            TableName: !Ref ConfigurationTable
        - S3CrudPolicy:
            BucketName: !If
              - ShouldCreateReportingBucket
              - !Ref ReportingBucket
              - !Ref ReportingBucketName
        - Statement:
            - Effect: Allow
              Action:
                - athena:StartQueryExecution
                - athena:GetQueryExecution
                - athena:GetQueryResults
              Resource:
                - !Sub "arn:${AWS::Partition}:athena:${AWS::Region}:${AWS::AccountId}:workgroup/primary"
                - !Sub "arn:${AWS::Partition}:athena:${AWS::Region}:${AWS::AccountId}:datacatalog/*"
            - Effect: Allow
              Action:
                - glue:GetTable
                - glue:GetTables
                - glue:GetDatabase
                - glue:GetDatabases
                - glue:GetPartitions
              Resource:
                - !Sub "arn:${AWS::Partition}:glue:${AWS::Region}:${AWS::AccountId}:catalog"
                - !Sub "arn:${AWS::Partition}:glue:${AWS::Region}:${AWS::AccountId}:database/${ReportingDatabase}"
                - !Sub "arn:${AWS::Partition}:glue:${AWS::Region}:${AWS::AccountId}:table/${ReportingDatabase}/*"
            - Effect: Allow
              Action:
                - bedrock:InvokeModel
                - bedrock:InvokeModelWithResponseStream
              Resource:
                - !Sub "arn:${AWS::Partition}:bedrock:*::foundation-model/*"
                - !Sub "arn:${AWS::Partition}:bedrock:${AWS::Region}:${AWS::AccountId}:inference-profile/*"
            - Effect: Allow
              Action:
                - aws-marketplace:Subscribe
                - aws-marketplace:Unsubscribe
                - aws-marketplace:ViewSubscriptions
              Resource: "*"
            - !If
              - HasGuardrailConfig
              - Effect: Allow
                Action:
                  - "bedrock:ApplyGuardrail"
                Resource:
                  - !Sub "arn:${AWS::Partition}:bedrock:${AWS::Region}:${AWS::AccountId}:guardrail/${BedrockGuardrailId}"
              - !Ref AWS::NoValue
            - Effect: Allow
              Action:
                - appsync:GraphQL
              Resource:
                - !Sub "${GraphQLApi.Arn}/types/Mutation/*"
            - Effect: Allow
              Action:
                - kms:Encrypt
                - kms:Decrypt
                - kms:ReEncrypt*
                - kms:GenerateDataKey*
                - kms:DescribeKey
              Resource: !GetAtt CustomerManagedEncryptionKey.Arn
            - Effect: Allow
              Action:
                - bedrock-agentcore:StartCodeInterpreterSession
                - bedrock-agentcore:StopCodeInterpreterSession
                - bedrock-agentcore:InvokeCodeInterpreter
                - bedrock-agentcore:GetCodeInterpreterSession
                - bedrock-agentcore:ListCodeInterpreterSessions
              Resource:
                - !Sub "arn:${AWS::Partition}:bedrock-agentcore:*:aws:code-interpreter/*"
            - Effect: Allow
              Action:
                - secretsmanager:GetSecretValue
              Resource:
                - !Ref ExternalMCPAgentsSecret
            - Effect: Allow
              Action:
                - logs:DescribeLogGroups
                - logs:DescribeLogStreams
                - logs:FilterLogEvents
                - logs:GetLogEvents
              Resource:
                - !Sub "arn:${AWS::Partition}:logs:${AWS::Region}:${AWS::AccountId}:log-group:/aws/lambda/${AWS::StackName}*"
                - !Sub "arn:${AWS::Partition}:logs:${AWS::Region}:${AWS::AccountId}:log-group:/aws/vendedlogs/states/${AWS::StackName}*"
                - !Sub "arn:${AWS::Partition}:logs:${AWS::Region}:${AWS::AccountId}:log-group:/${AWS::StackName}*"
                - !GetAtt QueueSenderLogGroup.Arn
                - !GetAtt QueueProcessorLogGroup.Arn
                - !GetAtt WorkflowTrackerLogGroup.Arn
                - !GetAtt SaveReportingDataFunctionLogGroup.Arn
            - Effect: Allow
              Action:
                - logs:DescribeLogGroups
              Resource:
                - "*"
            - Effect: Allow
              Action:
                - dynamodb:DescribeTable
                - dynamodb:Scan
                - dynamodb:Query
                - dynamodb:GetItem
                - dynamodb:Query
              Resource:
                - !GetAtt TrackingTable.Arn
            - Effect: Allow
              Action:
                - cloudformation:DescribeStackResources
                - cloudformation:DescribeStacks
              Resource:
                - !Sub "arn:${AWS::Partition}:cloudformation:${AWS::Region}:${AWS::AccountId}:stack/${AWS::StackName}/*"
            - Effect: Allow
              Action:
                - lambda:InvokeFunction
              Resource:
                - !Sub "arn:${AWS::Partition}:lambda:${AWS::Region}:${AWS::AccountId}:function:${AWS::StackName}*"
            - Effect: Allow
              Action:
                - states:DescribeExecution
                - states:GetExecutionHistory
              Resource:
                - !Sub "arn:${AWS::Partition}:states:${AWS::Region}:${AWS::AccountId}:execution:${AWS::StackName}*"
            - Effect: Allow
              Action:
                - xray:GetTraceSummaries
                - xray:BatchGetTraces
                - xray:GetServiceGraph
              Resource: "*"
  
  AgentRequestHandlerDataSource:
    Type: AWS::AppSync::DataSource
    Properties:
      ApiId: !GetAtt GraphQLApi.ApiId
      Name: AgentRequestHandlerDataSource
      Description: Lambda function for handling agent query requests
      Type: AWS_LAMBDA
      ServiceRoleArn: !GetAtt AppSyncServiceRole.Arn
      LambdaConfig:
        LambdaFunctionArn: !GetAtt AgentRequestHandlerFunction.Arn

  SubmitAgentQueryResolver:
    Type: AWS::AppSync::Resolver
    DependsOn: GraphQLSchema
    Properties:
      ApiId: !GetAtt GraphQLApi.ApiId
      TypeName: Query
      FieldName: submitAgentQuery
      DataSourceName: !GetAtt AgentRequestHandlerDataSource.Name

  ##########################################################################
  # External Client
  ##########################################################################

  ExternalAppClient:
    Type: AWS::Cognito::UserPoolClient
    Condition: CreateExternalAppClient
    Properties:
      ClientName: "External-App-Client"
      UserPoolId: !Ref UserPool
      GenerateSecret: true
      ExplicitAuthFlows:
        - ALLOW_ADMIN_USER_PASSWORD_AUTH
        - ALLOW_USER_PASSWORD_AUTH
        - ALLOW_REFRESH_TOKEN_AUTH
      SupportedIdentityProviders:
        - COGNITO
      AllowedOAuthFlows:
        - code
      AllowedOAuthFlowsUserPoolClient: true
      AllowedOAuthScopes:
        - openid
        - email
        - profile
      CallbackURLs:
        - !Sub "https://${GetDomain.OutputString}.auth.${AWS::Region}.amazoncognito.com"
        - !Sub "https://${CloudFrontDistribution.DomainName}/"
        - !Sub "https://${AWS::Region}.quicksight.aws.amazon.com/sn/oauthcallback"
        - https://us-east-1.quicksight.aws.amazon.com/sn/oauthcallback
        - https://us-west-2.quicksight.aws.amazon.com/sn/oauthcallback
        - https://eu-west-1.quicksight.aws.amazon.com/sn/oauthcallback
        - https://ap-southeast-2.quicksight.aws.amazon.com/sn/oauthcallback
      LogoutURLs:
        - !Sub "https://${GetDomain.OutputString}.auth.${AWS::Region}.amazoncognito.com"
        - !Sub "https://${CloudFrontDistribution.DomainName}/"
        - !Sub "https://${AWS::Region}.quicksight.aws.amazon.com/sn/oauthcallback"
        - https://us-east-1.quicksight.aws.amazon.com/sn/oauthcallback
        - https://us-west-2.quicksight.aws.amazon.com/sn/oauthcallback
        - https://eu-west-1.quicksight.aws.amazon.com/sn/oauthcallback
        - https://ap-southeast-2.quicksight.aws.amazon.com/sn/oauthcallback

  ##########################################################################
  # Cognoito user authentication for AppSync API and WebUI
  ##########################################################################

  UserPool:
    Type: AWS::Cognito::UserPool
    Metadata:
      cfn-nag:
        rules_to_suppress:
          - id: W57 # MFA warning
            reason: "MFA configurations specific to target environment - disabled by default"
    Properties:
      UserPoolName: !Sub ${AWS::StackName}-users
      AdminCreateUserConfig:
        AllowAdminCreateUserOnly: !If
          - ShouldAllowSignUpEmailDomain
          - false
          - true
        InviteMessageTemplate:
          EmailSubject: Welcome to GenAI-IDP!
          EmailMessage: !Sub |-
            <p>Hello {username},</p>
            <p>Welcome to the AWS GenAIIDP Solution! Your temporary password is: <strong>{####}</strong></p>
            <p>When the CloudFormation stack is COMPLETE, use the link below to log in and set your permanent password.
            <p>     https://${CloudFrontDistribution.DomainName}/
            <p>
            <p>Thanks,</p>
            <p>AWS GenAIIDP Team</p>
            <p>
            <p><em>Stack: ${AWS::StackName}, v<VERSION>, <BUILD_DATE_TIME></em>
      AutoVerifiedAttributes:
        - email
      EmailConfiguration:
        EmailSendingAccount: COGNITO_DEFAULT
      EmailVerificationMessage: >-
        Please verify your email to complete account registration. Confirmation Code
        {####}.
      EmailVerificationSubject: >-
        Account Verification
      LambdaConfig: !If
        - ShouldAllowSignUpEmailDomain
        - PreAuthentication: !GetAtt CognitoUserPoolEmailDomainVerifyFunction.Arn
          PreSignUp: !GetAtt CognitoUserPoolEmailDomainVerifyFunction.Arn
        - !Ref AWS::NoValue
      Policies:
        PasswordPolicy:
          MinimumLength: 8
          RequireLowercase: true
          RequireNumbers: true
          RequireSymbols: true
          RequireUppercase: true
      Schema:
        - Name: email
          AttributeDataType: String
          Mutable: false
          Required: true
      UsernameConfiguration:
        CaseSensitive: false

  UserPoolClient:
    Type: AWS::Cognito::UserPoolClient
    Properties:
      ClientName: !Sub "${AWS::StackName}-Client"
      AllowedOAuthFlows:
        - code
      AllowedOAuthFlowsUserPoolClient: true
      AllowedOAuthScopes:
        - openid
        - email
        - phone
        - profile
      CallbackURLs:
        - !Sub "https://${CloudFrontDistribution.DomainName}"
      AccessTokenValidity: 1
      EnableTokenRevocation: true
      ExplicitAuthFlows:
        - ALLOW_USER_SRP_AUTH
        - ALLOW_REFRESH_TOKEN_AUTH
      GenerateSecret: false # pragma: allowlist secret - CloudFormation parameter, not actual secret
      IdTokenValidity: 1
      PreventUserExistenceErrors: ENABLED
      ReadAttributes:
        - email
        - email_verified
        - preferred_username
      RefreshTokenValidity: 30
      SupportedIdentityProviders:
        - COGNITO
      UserPoolId: !Ref UserPool

  GetDomainLambda:
    DependsOn:
      - IsStacknameLengthOK
    Type: AWS::Serverless::Function
    Metadata:
      cfn_nag:
        rules_to_suppress:
          - id: W89
            reason: "Function does not require VPC access as it only interacts with AWS services via APIs"
          - id: W92
            reason: "Function does not require reserved concurrency as it scales based on demand"
    # checkov:skip=CKV_AWS_116: "DLQ not required for Cfn Custom Resource function"
    # checkov:skip=CKV_AWS_117: "Function does not require VPC access as it only interacts with AWS services via APIs"
    # checkov:skip=CKV_AWS_115: "Function does not require reserved concurrency as it scales based on demand"
    Properties:
      PermissionsBoundary:
        !If [
          HasPermissionsBoundary,
          !Ref PermissionsBoundaryArn,
          !Ref AWS::NoValue,
        ]
      Description: Converts Stackname to lowercase and adds unique timestamp
      Handler: index.handler
      Runtime: python3.12
      Timeout: 30
      MemorySize: 128
      LoggingConfig:
        LogGroup: !Ref GetDomainLambdaLogGroup
      InlineCode: |
        import cfnresponse
        import time
        def handler(event, context):                                                    
            lowercase = event['ResourceProperties'].get('InputString', '').lower()
            lowercaseWithTimestamp = f"{lowercase}-{time.time_ns()}" # make unique
            responseData = {
              'Lowercase': lowercase, 
              'OutputString': lowercaseWithTimestamp, # don't change key - avoid UserPool update errors
            }                                            
            cfnresponse.send(event, context, cfnresponse.SUCCESS, responseData)

  GetDomainLambdaLogGroup:
    Type: AWS::Logs::LogGroup
    Properties:
      KmsKeyId: !GetAtt CustomerManagedEncryptionKey.Arn
      RetentionInDays: !Ref LogRetentionDays

  # Preserve CR name - avoid forcing UserPoolDomain update.
  GetDomain:
    Type: Custom::GetDomain
    Properties:
      ServiceToken: !GetAtt GetDomainLambda.Arn
      InputString: !Ref AWS::StackName

  UserPoolDomain:
    Type: "AWS::Cognito::UserPoolDomain"
    Properties:
      Domain: !GetAtt GetDomain.OutputString
      UserPoolId: !Ref UserPool

  IdentityPool:
    Type: AWS::Cognito::IdentityPool
    Properties:
      IdentityPoolName: !Sub "${AWS::StackName}-IdentityPool"
      AllowUnauthenticatedIdentities: false
      CognitoIdentityProviders:
        - ClientId: !Ref UserPoolClient
          ProviderName: !GetAtt UserPool.ProviderName

  CognitoIdentityPoolSetRole:
    Type: AWS::Cognito::IdentityPoolRoleAttachment
    Properties:
      IdentityPoolId: !Ref IdentityPool
      Roles:
        authenticated: !GetAtt CognitoAuthorizedRole.Arn

  CognitoAuthorizedRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Principal:
              Federated: cognito-identity.amazonaws.com
            Action:
              - sts:AssumeRoleWithWebIdentity
            Condition:
              StringEquals:
                "cognito-identity.amazonaws.com:aud": !Ref IdentityPool
              "ForAnyValue:StringLike":
                "cognito-identity.amazonaws.com:amr": authenticated
      PermissionsBoundary:
        !If [
          HasPermissionsBoundary,
          !Ref PermissionsBoundaryArn,
          !Ref AWS::NoValue,
        ]
      Policies:
        - PolicyName: S3
          PolicyDocument:
            Version: 2012-10-17
            Statement:
              - Effect: Allow
                Action:
                  - "s3:GetObject"
                  - "s3:ListBucket"
                Resource:
                  - !Sub "arn:${AWS::Partition}:s3:::${OutputBucket}"
                  - !Sub "arn:${AWS::Partition}:s3:::${OutputBucket}/*"
                  - !Sub "arn:${AWS::Partition}:s3:::${InputBucket}"
                  - !Sub "arn:${AWS::Partition}:s3:::${InputBucket}/*"
                  - !Sub "arn:${AWS::Partition}:s3:::${ConfigurationBucket}"
                  - !Sub "arn:${AWS::Partition}:s3:::${ConfigurationBucket}/*"
              - Effect: Allow
                Action:
                  - kms:Encrypt
                  - kms:Decrypt
                  - kms:ReEncrypt*
                  - kms:GenerateDataKey*
                  - kms:DescribeKey
                Resource: !GetAtt CustomerManagedEncryptionKey.Arn
        - PolicyName: ParameterStore
          PolicyDocument:
            Version: 2012-10-17
            Statement:
              - Effect: Allow
                Action:
                  - "ssm:GetParameter"
                Resource:
                  - !Sub "arn:${AWS::Partition}:ssm:${AWS::Region}:${AWS::AccountId}:parameter/${SettingsParameter}"
        - PolicyName: GraphQL
          PolicyDocument:
            Version: 2012-10-17
            Statement:
              - Effect: Allow
                Action:
                  - appsync:GraphQL
                Resource:
                  - !Sub "${GraphQLApi.Arn}/types/Query/*"
                  - !Sub "${GraphQLApi.Arn}/types/Subscription/*"

  AdminUser:
    Type: AWS::Cognito::UserPoolUser
    DependsOn: CognitoUserPoolEmailDomainVerifyPermissionReady
    Properties:
      DesiredDeliveryMediums:
        - EMAIL
      UserAttributes:
        - Name: email
          Value: !Ref AdminEmail
      Username: !Ref AdminEmail
      UserPoolId: !Ref UserPool

  # Create conditional dependency on CognitoUserPoolEmailDomainVerifyPermission
  CognitoUserPoolEmailDomainVerifyPermissionReady:
    Type: AWS::CloudFormation::WaitConditionHandle
    Metadata:
      ConditionalDependency:
        !If [
          ShouldAllowSignUpEmailDomain,
          !Ref CognitoUserPoolEmailDomainVerifyPermission,
          "",
        ]

  AdminGroup:
    Type: AWS::Cognito::UserPoolGroup
    Properties:
      Description: Administrators
      GroupName: Admin
      Precedence: 0
      UserPoolId: !Ref UserPool

  AdminUserToGroupAttachment:
    Type: AWS::Cognito::UserPoolUserToGroupAttachment
    Properties:
      GroupName: !Ref AdminGroup
      Username: !Ref AdminUser
      UserPoolId: !Ref UserPool

  CognitoUserPoolEmailDomainVerifyFunction:
    DependsOn:
      - IsStacknameLengthOK
    Type: AWS::Serverless::Function
    Metadata:
      cfn_nag:
        rules_to_suppress:
          - id: W89
            reason: "Function does not require VPC access as it only interacts with AWS services via APIs"
          - id: W92
            reason: "Function does not require reserved concurrency as it scales based on demand"
    # checkov:skip=CKV_AWS_115: "Function does not require reserved concurrency as it scales based on demand"
    # checkov:skip=CKV_AWS_116: "DLQ not required for email verifier function"
    # checkov:skip=CKV_AWS_117: "Function does not require VPC access as it only interacts with AWS services via APIs"
    # checkov:skip=CKV_AWS_173: "Environment variables do not contain sensitive data - only configuration values like feature flags and non-sensitive settings"
    Condition: ShouldAllowSignUpEmailDomain
    Properties:
      PermissionsBoundary:
        !If [
          HasPermissionsBoundary,
          !Ref PermissionsBoundaryArn,
          !Ref AWS::NoValue,
        ]
      Description: Verifies email address is in allowed domain
      Handler: index.lambda_handler
      Runtime: python3.12
      Timeout: 10
      Environment:
        Variables:
          LOG_LEVEL: !Ref LogLevel
          ALLOWED_SIGNUP_EMAIL_DOMAINS: !Ref AllowedSignUpEmailDomain
      InlineCode: |
        import os
        import boto3
        import json
        def lambda_handler(event, context):
            print(json.dumps(event))
            allowed_domains = [
                domain.strip() 
                for domain in os.environ.get('ALLOWED_SIGNUP_EMAIL_DOMAINS', '').split(',')
            ]
            user_attributes = event.get('request', {}).get('userAttributes', {})
            email = user_attributes.get('email')
            if not email or '@' not in email:
                raise ValueError('Username does not exist or invalid email address')
            email_domain = email.split('@')[1]
            if not email_domain or not allowed_domains:
                raise ValueError('Server error - invalid configuration')
            if email_domain not in allowed_domains:
                raise ValueError('Invalid email address domain')
            return event
      LoggingConfig:
        LogGroup: !Ref CognitoUserPoolEmailDomainVerifyFunctionLogGroup

  CognitoUserPoolEmailDomainVerifyFunctionLogGroup:
    Type: AWS::Logs::LogGroup
    Properties:
      KmsKeyId: !GetAtt CustomerManagedEncryptionKey.Arn
      RetentionInDays: !Ref LogRetentionDays

  CognitoUserPoolEmailDomainVerifyPermission:
    Type: AWS::Lambda::Permission
    Condition: ShouldAllowSignUpEmailDomain
    Properties:
      Action: lambda:InvokeFunction
      FunctionName: !Ref CognitoUserPoolEmailDomainVerifyFunction
      Principal: !Sub "cognito-idp.${AWS::URLSuffix}"
      SourceAccount: !Ref AWS::AccountId
      SourceArn: !GetAtt UserPool.Arn

  ##########################################################################
  # HITL resource deployment (SageMaker A2I)
  ##########################################################################

  # Cognito user pool client with generate secret as true (HITL)
  UserPoolClienta2i:
    Type: AWS::Cognito::UserPoolClient
    Condition: IsHITLEnabled
    Properties:
      ClientName:
        Fn::Sub: ${AWS::StackName}-A2I-Client
      GenerateSecret: true # pragma: allowlist secret - CloudFormation parameter, not actual secret
      UserPoolId:
        Ref: UserPool

  #SageMaker A2I (HITL) Labelling workforce Private Work Team
  PrivateWorkteam:
    Type: AWS::SageMaker::Workteam
    Condition: ShouldCreatePrivateWorkteam
    Properties:
      WorkteamName:
        Fn::Sub: ${AWS::StackName}-Private-WorkTeam
      Description: "Private workteam for working on A2I tasks"
      MemberDefinitions:
        - CognitoMemberDefinition:
            CognitoUserPool:
              Ref: UserPool
            CognitoUserGroup:
              Ref: AdminGroup
            CognitoClientId:
              Ref: UserPoolClienta2i

  # Cognito Client Update with lambda function to resolve circular dependency with SageMaker A2I resources
  CognitoClientUpdaterRole:
    Type: AWS::IAM::Role
    Condition: ShouldCreatePrivateWorkteam
    Metadata:
      cfn_nag:
        rules_to_suppress:
          - id: W11
            reason: "Write access required for Cognito client updates and SageMaker workteam integration - resource constraints not applicable for these service operations"
    # checkov:skip=CKV_AWS_111: "Write access required for Cognito client updates and SageMaker workteam integration"
    Properties:
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Principal:
              Service: !Sub "lambda.${AWS::URLSuffix}"
            Action: sts:AssumeRole
      ManagedPolicyArns:
        - !Sub "arn:${AWS::Partition}:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"
      PermissionsBoundary:
        !If [
          HasPermissionsBoundary,
          !Ref PermissionsBoundaryArn,
          !Ref AWS::NoValue,
        ]
      Policies:
        - PolicyName: CognitoClientUpdaterPolicy
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Effect: Allow
                Action:
                  - cognito-idp:UpdateUserPoolClient
                  - cognito-idp:DescribeUserPoolClient
                  - sagemaker:DescribeWorkteam
                Resource: "*"

  CognitoClientUpdaterFunctionLogGroup:
    Type: AWS::Logs::LogGroup
    Condition: ShouldCreatePrivateWorkteam
    Properties:
      KmsKeyId: !GetAtt CustomerManagedEncryptionKey.Arn
      LogGroupName:
        Fn::Sub: /${AWS::StackName}/lambda/CognitoClientUpdaterFunction
      RetentionInDays:
        Ref: LogRetentionDays

  CognitoClientUpdaterFunction:
    DependsOn:
      - UserPoolClienta2i
    Type: AWS::Serverless::Function
    Condition: ShouldCreatePrivateWorkteam
    Metadata:
      cfn_nag:
        rules_to_suppress:
          - id: W89
            reason: "Function does not require VPC access as it only interacts with AWS services via APIs"
          - id: W92
            reason: "Function does not require reserved concurrency as it scales based on demand"
          - id: W58
            reason: "DLQ not required for Cfn Custom Resource function"
    # checkov:skip=CKV_AWS_116: "DLQ not required for Cfn Custom Resource function"
    # checkov:skip=CKV_AWS_117: "Function does not require VPC access as it only interacts with AWS services via APIs"
    # checkov:skip=CKV_AWS_115: "Function does not require reserved concurrency as it scales based on demand"
    # checkov:skip=CKV_AWS_173: "Environment variables do not contain sensitive data - only configuration values like feature flags and non-sensitive settings"
    Properties:
      PermissionsBoundary:
        !If [
          HasPermissionsBoundary,
          !Ref PermissionsBoundaryArn,
          !Ref AWS::NoValue,
        ]
      Description: Update Cognito App Client with SageMaker GroundTruth Labelling WorkForce Private Work Team
      CodeUri: src/lambda/cognito_updater_hitl
      Handler: index.handler
      Runtime: python3.12
      Timeout: 300
      MemorySize: 4096
      LoggingConfig:
        LogGroup: !Ref CognitoClientUpdaterFunctionLogGroup
      Role: !GetAtt CognitoClientUpdaterRole.Arn
      Environment:
        Variables:
          USER_POOL_ID:
            Ref: UserPool
          CLIENT_ID:
            Ref: UserPoolClienta2i
          WORKTEAM_NAME:
            Fn::GetAtt: PrivateWorkteam.WorkteamName

  CognitoClientCustomResource:
    Type: Custom::CognitoClientUpdater
    Condition: ShouldCreatePrivateWorkteam
    Properties:
      ServiceToken: !GetAtt CognitoClientUpdaterFunction.Arn
      SourceCodeHash: <COGNITO_CLIENT_HASH_TOKEN>
    DependsOn:
      - UserPoolClienta2i
      - PrivateWorkteam
      - CognitoClientUpdaterFunction

  ##########################################################################
  # SageMaker A2I (HITL) Resources with Comprehensive Cleanup
  #
  # Resource Responsibilities:
  # - CreateA2IResourcesLambda: Handles complete A2I lifecycle
  #   * Create: Flow Definition and Human Task UI
  #   * Update: Flow Definition and Human Task UI (delete old, create new)
  #   * Delete: Flow Definition, Human Task UI, AND comprehensive workforce cleanup
  #
  # Benefits of Single Function Approach:
  # - Simpler architecture with fewer resources
  # - No inter-function dependencies
  # - Comprehensive cleanup in single operation
  # - Reduced complexity and maintenance overhead
  ##########################################################################

  # Separate role for SageMaker Flow Definition with minimal permissions
  A2IFlowDefinitionRole:
    Type: AWS::IAM::Role
    Condition: IsHITLEnabled
    Properties:
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Principal:
              Service: !Sub "sagemaker.${AWS::URLSuffix}"
            Action: sts:AssumeRole
      PermissionsBoundary:
        !If [
          HasPermissionsBoundary,
          !Ref PermissionsBoundaryArn,
          !Ref AWS::NoValue,
        ]
      Policies:
        - PolicyName: A2IFlowDefinitionAccess
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Effect: Allow
                Action:
                  - s3:GetObject
                  - s3:GetObjectVersion
                  - s3:PutObject
                Resource:
                  - !Sub "${OutputBucket.Arn}/*"
                  - !Sub "${InputBucket.Arn}/*"
              - Effect: Allow
                Action:
                  - s3:GetBucketLocation
                  - s3:ListBucket
                Resource:
                  - !GetAtt OutputBucket.Arn
                  - !GetAtt InputBucket.Arn
              - Effect: Allow
                Action:
                  - logs:CreateLogGroup
                  - logs:CreateLogStream
                  - logs:PutLogEvents
                Resource: !Sub "arn:${AWS::Partition}:logs:${AWS::Region}:${AWS::AccountId}:log-group:/aws/sagemaker/*"
              - Effect: Allow
                Action:
                  - kms:Encrypt
                  - kms:Decrypt
                  - kms:ReEncrypt*
                  - kms:GenerateDataKey*
                  - kms:DescribeKey
                Resource: !GetAtt CustomerManagedEncryptionKey.Arn

  A2IHumanTaskUILambdaRole:
    Type: AWS::IAM::Role
    Condition: IsHITLEnabled
    Metadata:
      cfn_nag:
        rules_to_suppress:
          - id: W11
            reason: "Role requires * resource access for SageMaker A2I operations as resource name is not available"
    Properties:
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Principal:
              Service: !Sub "lambda.${AWS::URLSuffix}"
            Action: sts:AssumeRole
      ManagedPolicyArns:
        - !Sub "arn:${AWS::Partition}:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"
      PermissionsBoundary:
        !If [
          HasPermissionsBoundary,
          !Ref PermissionsBoundaryArn,
          !Ref AWS::NoValue,
        ]
      Policies:
        - PolicyName: SageMakerA2IAccess
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Effect: Allow
                Action:
                  - sagemaker:CreateHumanTaskUi
                  - sagemaker:DeleteHumanTaskUi
                  - sagemaker:DescribeHumanTaskUi
                  - sagemaker:CreateFlowDefinition
                  - sagemaker:DeleteFlowDefinition
                  - sagemaker:DescribeFlowDefinition
                  - sagemaker:ListHumanLoops
                  - sagemaker:StopHumanLoop
                  - sagemaker:DescribeWorkteam
                  - sagemaker:DeleteWorkteam
                  - sagemaker:ListWorkforces
                  - sagemaker:DescribeWorkforce
                  - sagemaker:DeleteWorkforce
                Resource: "*"
              - Effect: Allow
                Action:
                  - iam:PassRole
                Resource: !GetAtt A2IFlowDefinitionRole.Arn
        - PolicyName: S3Access
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Effect: Allow
                Action:
                  - s3:PutObject
                  - s3:GetBucketLocation
                  - s3:GetObject
                Resource:
                  - Fn::Sub: arn:${AWS::Partition}:s3:::${OutputBucket}
                  - Fn::Sub: arn:${AWS::Partition}:s3:::${OutputBucket}/*
                  - Fn::Sub: arn:${AWS::Partition}:s3:::${InputBucket}
                  - Fn::Sub: arn:${AWS::Partition}:s3:::${InputBucket}/*
        - PolicyName: LambdaSSMAccess
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Effect: Allow
                Action:
                  - ssm:PutParameter
                Resource:
                  - !Sub "arn:${AWS::Partition}:ssm:${AWS::Region}:${AWS::AccountId}:parameter/${AWS::StackName}/FlowDefinitionArn"
        - PolicyName: KMSAccess
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Effect: Allow
                Action:
                  - kms:Encrypt
                  - kms:Decrypt
                  - kms:ReEncrypt*
                  - kms:GenerateDataKey*
                  - kms:DescribeKey
                Resource: !GetAtt CustomerManagedEncryptionKey.Arn
        - PolicyName: CFNCustomAccess
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Effect: Allow
                Action:
                  - s3:PutObject
                Resource:
                  - !Sub "arn:${AWS::Partition}:s3:::cloudformation-custom-resource-response-*"
                  - !Sub "arn:${AWS::Partition}:s3:::cloudformation-custom-resource-response-*/*"

  CreateA2IResourcesLambda:
    Type: AWS::Serverless::Function
    Condition: IsHITLEnabled
    Metadata:
      cfn_nag:
        rules_to_suppress:
          - id: W89
            reason: "Function does not require VPC access as it only interacts with AWS services via APIs"
          - id: W92
            reason: "Function does not require reserved concurrency as it scales based on demand"
          - id: W58
            reason: "DLQ not required for Cfn Custom Resource function"
    # checkov:skip=CKV_AWS_116: "DLQ not required for Cfn Custom Resource function"
    # checkov:skip=CKV_AWS_117: "Function does not require VPC access as it only interacts with AWS services via APIs"
    # checkov:skip=CKV_AWS_115: "Function does not require reserved concurrency as it scales based on demand"
    Properties:
      PermissionsBoundary:
        !If [
          HasPermissionsBoundary,
          !Ref PermissionsBoundaryArn,
          !Ref AWS::NoValue,
        ]
      CodeUri: src/lambda/create_a2i_resources
      Handler: index.handler
      Role: !GetAtt A2IHumanTaskUILambdaRole.Arn
      Runtime: python3.12
      Timeout: 900 # 15 minutes - Increased timeout for enhanced deletion verification and wait logic
      Environment:
        Variables:
          STACK_NAME: !Ref AWS::StackName
          A2I_WORKTEAM_ARN: !If
            - ShouldCreatePrivateWorkteam
            - !Sub "arn:${AWS::Partition}:sagemaker:${AWS::Region}:${AWS::AccountId}:workteam/private-crowd/${PrivateWorkteam.WorkteamName}"
            - !Ref ExistingPrivateWorkforceArn
          A2I_FLOW_DEFINITION_ROLE_ARN: !GetAtt A2IFlowDefinitionRole.Arn
          BDA_OUTPUT_BUCKET: !Ref OutputBucket #Pass the IDP Output Bucket

  A2IResourcesCustomResource:
    Type: Custom::A2IResources
    Condition: IsHITLEnabled
    Properties:
      ServiceToken:
        Fn::GetAtt: CreateA2IResourcesLambda.Arn
      StackName: !Ref AWS::StackName
      SourceCodeHash: <A2I_RESOURCES_HASH_TOKEN>

  GetWorkforceURLFunction:
    Type: AWS::Serverless::Function
    Condition: IsHITLEnabled
    Metadata:
      cfn_nag:
        rules_to_suppress:
          - id: W89
            reason: "Function does not require VPC access as it only interacts with AWS services via APIs"
          - id: W92
            reason: "Function does not require reserved concurrency as it scales based on demand"
    # checkov:skip=CKV_AWS_116: "DLQ not required for Cfn Custom Resource function"
    # checkov:skip=CKV_AWS_117: "Function does not require VPC access as it only interacts with AWS services via APIs"
    # checkov:skip=CKV_AWS_115: "Function does not require reserved concurrency as it scales based on demand"
    Properties:
      PermissionsBoundary:
        !If [
          HasPermissionsBoundary,
          !Ref PermissionsBoundaryArn,
          !Ref AWS::NoValue,
        ]
      Handler: index.handler
      Runtime: python3.12
      CodeUri: src/lambda/get-workforce-url
      Description: Lambda function to get the SageMaker Ground Truth workforce portal URL
      MemorySize: 128
      Timeout: 30
      Environment:
        Variables:
          REGION:
            Ref: AWS::Region
          LOG_LEVEL: INFO
      Policies:
        - Version: "2012-10-17"
          Statement:
            - Effect: Allow
              Action:
                - sagemaker:DescribeWorkteam
              Resource: !If
                - ShouldCreatePrivateWorkteam
                - !Sub "arn:${AWS::Partition}:sagemaker:${AWS::Region}:${AWS::AccountId}:workteam/private-crowd/${PrivateWorkteam.WorkteamName}"
                - !Ref ExistingPrivateWorkforceArn

  WorkforceURLResource:
    Type: Custom::WorkforceURL
    Condition: IsHITLEnabled
    Properties:
      ServiceToken:
        Fn::GetAtt:
          - GetWorkforceURLFunction
          - Arn
      WorkteamName: !If
        - ShouldCreatePrivateWorkteam
        - !GetAtt PrivateWorkteam.WorkteamName
        - !Select [ 2, !Split [ "/", !Ref ExistingPrivateWorkforceArn ] ]
      SourceCodeHash: <WORKFORCE_URL_HASH_TOKEN>

  ##########################################################################
  # AppSync GraphQL API
  ##########################################################################

  GraphQLApi:
    Type: AWS::AppSync::GraphQLApi
    # checkov:skip=CKV_AWS_194: AppSync has Field-Level logging is determined by LogLevel parameter
    Properties:
      Name: !Sub ${AWS::StackName}-api
      AuthenticationType: AMAZON_COGNITO_USER_POOLS
      UserPoolConfig:
        UserPoolId: !Ref UserPool
        AwsRegion: !Ref AWS::Region
        DefaultAction: ALLOW
      AdditionalAuthenticationProviders:
        - AuthenticationType: AWS_IAM
      LogConfig:
        CloudWatchLogsRoleArn: !GetAtt AppSyncCwlRole.Arn
        ExcludeVerboseContent: false
        FieldLogLevel:
          !FindInMap [ AppSyncLogLevelMap, !Ref LogLevel, FieldLogLevel ]
      # Disable introspection for security purposes
      IntrospectionConfig: DISABLED

  GraphQLApiLogGroup:
    Type: AWS::Logs::LogGroup
    Properties:
      KmsKeyId: !GetAtt CustomerManagedEncryptionKey.Arn
      LogGroupName: !Sub "/aws/appsync/apis/${GraphQLApi.ApiId}"
      RetentionInDays: !Ref LogRetentionDays

  AppSyncCwlRole:
    DependsOn:
      - IsStacknameLengthOK
    Type: AWS::IAM::Role
    Properties:
      ManagedPolicyArns:
        - !Sub "arn:${AWS::Partition}:iam::aws:policy/service-role/AWSAppSyncPushToCloudWatchLogs"
      PermissionsBoundary:
        !If [
          HasPermissionsBoundary,
          !Ref PermissionsBoundaryArn,
          !Ref AWS::NoValue,
        ]
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Action:
              - sts:AssumeRole
            Principal:
              Service:
                - !Sub "appsync.${AWS::URLSuffix}"

  # Optionally Secure API with WAF

  WAFIPV4Set:
    Type: AWS::WAFv2::IPSet
    Condition: IsWafEnabled
    Properties:
      Name: !Sub ${AWS::StackName}-allowed-ips
      Description: IP ranges allowed to access the AppSync API
      Scope: REGIONAL
      IPAddressVersion: IPV4
      Addresses: !Split [ ", ", !Ref WAFAllowedIPv4Ranges ]

  WAFLambdaServiceIPSet:
    Type: AWS::WAFv2::IPSet
    Condition: IsWafEnabled
    Properties:
      Name: !Sub ${AWS::StackName}-lambda-service-ips
      Description: IP ranges used by AWS Lambda service
      Scope: REGIONAL
      IPAddressVersion: IPV4
      Addresses: [ "0.0.0.0/32" ] # Placeholder - will be updated by IPSetUpdaterFunction

  IPSetUpdaterFunction:
    Type: AWS::Serverless::Function
    Condition: IsWafEnabled
    Metadata:
      cfn_nag:
        rules_to_suppress:
          - id: W89
            reason: "Function does not require VPC access as it only interacts with AWS services via APIs"
          - id: W92
            reason: "Function does not require reserved concurrency as it scales based on demand"
    # checkov:skip=CKV_AWS_116: "DLQ not required for Cfn Custom Resource function"
    # checkov:skip=CKV_AWS_117: "Function does not require VPC access as it only interacts with AWS services via APIs"
    # checkov:skip=CKV_AWS_115: "Function does not require reserved concurrency as it scales based on demand"
    # checkov:skip=CKV_AWS_173: "Environment variables do not contain sensitive data
    Properties:
      PermissionsBoundary:
        !If [
          HasPermissionsBoundary,
          !Ref PermissionsBoundaryArn,
          !Ref AWS::NoValue,
        ]
      CodeUri: ./src/lambda/ipset_updater
      Handler: index.lambda_handler
      Runtime: python3.12
      Timeout: 300
      MemorySize: 256
      Environment:
        Variables:
          LOG_LEVEL: !Ref LogLevel
          IPSET_NAME: !Sub ${AWS::StackName}-lambda-service-ips
      Policies:
        - Version: "2012-10-17"
          Statement:
            - Effect: Allow
              Action:
                - wafv2:GetIPSet
                - wafv2:UpdateIPSet
              Resource: !GetAtt WAFLambdaServiceIPSet.Arn
            - Effect: Allow
              Action:
                - wafv2:ListIPSets
              Resource: !Sub "arn:${AWS::Partition}:wafv2:${AWS::Region}:${AWS::AccountId}:regional/ipset/*"
      Events:
        Schedule:
          Type: Schedule
          Properties:
            Schedule: rate(1 day)
            Description: Update Lambda IP ranges daily
            Enabled: true

  IPSetUpdaterCustomResource:
    Type: Custom::IPSetUpdater
    Condition: IsWafEnabled
    Properties:
      ServiceToken: !GetAtt IPSetUpdaterFunction.Arn
      UpdateTime: <BUILD_DATE_TIME> # To force an update when stack is updated

  WAFWebACL:
    Type: AWS::WAFv2::WebACL
    Condition: IsWafEnabled
    Properties:
      Name: !Sub ${AWS::StackName}-appsync-acl
      Description: Web ACL for AppSync API
      Scope: REGIONAL
      DefaultAction:
        Block: { }
      Rules:
        - Name: AllowLambdaServiceIPs
          Priority: 1
          Statement:
            IPSetReferenceStatement:
              Arn: !GetAtt WAFLambdaServiceIPSet.Arn
          Action:
            Allow: { }
          VisibilityConfig:
            SampledRequestsEnabled: true
            CloudWatchMetricsEnabled: true
            MetricName: AllowLambdaServiceIPsRule
        - Name: AllowListedIPs
          Priority: 2
          Statement:
            IPSetReferenceStatement:
              Arn: !GetAtt WAFIPV4Set.Arn
          Action:
            Allow: { }
          VisibilityConfig:
            SampledRequestsEnabled: true
            CloudWatchMetricsEnabled: true
            MetricName: AllowListedIPsRule
      VisibilityConfig:
        SampledRequestsEnabled: true
        CloudWatchMetricsEnabled: true
        MetricName: APIAccessControl

  WAFWebACLAssociation:
    Type: AWS::WAFv2::WebACLAssociation
    Condition: IsWafEnabled
    Properties:
      ResourceArn: !GetAtt GraphQLApi.Arn
      WebACLArn: !GetAtt WAFWebACL.Arn

  # Api Schema, datasource, resolvers

  GraphQLSchema:
    Type: AWS::AppSync::GraphQLSchema
    Properties:
      ApiId: !GetAtt GraphQLApi.ApiId
      DefinitionS3Location: ./src/api/schema.graphql

  TrackingTableDataSource:
    Type: AWS::AppSync::DataSource
    Properties:
      ApiId: !GetAtt GraphQLApi.ApiId
      Name: TrackingTableDataSource
      Type: AMAZON_DYNAMODB
      ServiceRoleArn: !GetAtt AppSyncServiceRole.Arn
      DynamoDBConfig:
        TableName: !Ref TrackingTable
        AwsRegion: !Ref AWS::Region

  DiscoveryTableDataSource:
    Type: AWS::AppSync::DataSource
    Properties:
      ApiId: !GetAtt GraphQLApi.ApiId
      Name: DiscoveryTableDataSource
      Type: AMAZON_DYNAMODB
      ServiceRoleArn: !GetAtt AppSyncServiceRole.Arn
      DynamoDBConfig:
        TableName: !Ref DiscoveryTrackingTable
        AwsRegion: !Ref AWS::Region

  AppSyncServiceRole:
    Type: AWS::IAM::Role
    Metadata:
      cfn_nag:
        rules_to_suppress:
          - id: W76
            reason: "Suppressing W76: SPCM for IAM policy document is higher than 25"
    Properties:
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Principal:
              Service: !Sub "appsync.${AWS::URLSuffix}"
            Action: sts:AssumeRole
      ManagedPolicyArns:
        - !Sub "arn:${AWS::Partition}:iam::aws:policy/service-role/AWSAppSyncPushToCloudWatchLogs"
      PermissionsBoundary:
        !If [
          HasPermissionsBoundary,
          !Ref PermissionsBoundaryArn,
          !Ref AWS::NoValue,
        ]
      Policies:
        - PolicyName: DynamoDBAccess
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Effect: Allow
                Action:
                  - dynamodb:GetItem
                  - dynamodb:PutItem
                  - dynamodb:UpdateItem
                  - dynamodb:DeleteItem
                  - dynamodb:Query
                  - dynamodb:Scan
                Resource:
                  - !Sub "arn:${AWS::Partition}:dynamodb:${AWS::Region}:${AWS::AccountId}:table/${TrackingTable}"
                  - !Sub "arn:${AWS::Partition}:dynamodb:${AWS::Region}:${AWS::AccountId}:table/${AgentTable}"
                  - !Sub "arn:${AWS::Partition}:dynamodb:${AWS::Region}:${AWS::AccountId}:table/${DiscoveryTrackingTable}"
                  - !Sub "arn:${AWS::Partition}:dynamodb:${AWS::Region}:${AWS::AccountId}:table/${ChatMessagesTable}"
                  - !Sub "arn:${AWS::Partition}:dynamodb:${AWS::Region}:${AWS::AccountId}:table/${ChatSessionsTable}"
              - Effect: Allow
                Action:
                  - kms:Encrypt
                  - kms:Decrypt
                  - kms:ReEncrypt*
                  - kms:GenerateDataKey*
                  - kms:DescribeKey
                Resource: !GetAtt CustomerManagedEncryptionKey.Arn
              - Effect: Allow
                Action:
                  - lambda:InvokeFunction
                Resource:
                  - !GetAtt GetFileContentsResolverFunction.Arn
                  - !GetAtt GetStepFunctionExecutionResolverFunction.Arn
                  - !GetAtt ConfigurationResolverFunction.Arn
                  - !GetAtt UploadResolverFunction.Arn
                  - !GetAtt CopyToBaselineResolverFunction.Arn
                  - !GetAtt CreateDocumentResolverFunction.Arn
                  - !GetAtt DeleteDocumentResolverFunction.Arn
                  - !GetAtt DeleteTestsResolverFunction.Arn
                  - !GetAtt QueryKnowledgeBaseResolverFunction.Arn
                  - !GetAtt ReprocessDocumentResolverFunction.Arn
                  - !GetAtt ProcessChangesResolverFunction.Arn
                  - !GetAtt AgentChatResolverFunction.Arn
                  - !GetAtt ListAvailableAgentsFunction.Arn
                  - !GetAtt ChatWithDocumentResolverFunction.Arn
                  - !GetAtt DiscoveryUploadResolverFunction.Arn
                  - !GetAtt TestRunnerFunction.Arn
                  - !GetAtt TestResultsResolverFunction.Arn
                  - !GetAtt TestSetResolverFunction.Arn
                  - !GetAtt AgentRequestHandlerFunction.Arn  # <-- Backward Compatibility for error analyzer agent
                  - !GetAtt ListAgentChatSessionsFunction.Arn
                  - !GetAtt GetAgentChatMessagesFunction.Arn
                  - !GetAtt DeleteAgentChatSessionFunction.Arn

  # Lambda function for Create Document resolver
  CreateDocumentResolverFunction:
    Type: AWS::Serverless::Function
    Metadata:
      cfn_nag:
        rules_to_suppress:
          - id: W89
            reason: "Function does not require VPC access as it only interacts with AWS services via APIs"
          - id: W92
            reason: "Function does not require reserved concurrency as it scales based on demand"
          - id: W12
            reason: "Lambda requires CloudWatch logs permissions"
    # checkov:skip=CKV_AWS_116: "DLQ not required for AppSync resolver function"
    # checkov:skip=CKV_AWS_117: "Function does not require VPC access as it only interacts with AWS services via APIs"
    # checkov:skip=CKV_AWS_115: "Function does not require reserved concurrency as it scales based on demand"
    # checkov:skip=CKV_AWS_173: "Environment variables do not contain sensitive data - only configuration values like feature flags and non-sensitive settings"
    Properties:
      PermissionsBoundary:
        !If [
          HasPermissionsBoundary,
          !Ref PermissionsBoundaryArn,
          !Ref AWS::NoValue,
        ]
      Handler: index.handler
      Runtime: python3.12
      CodeUri: ./src/lambda/create_document_resolver
      Description: Lambda function to create document tracking via GraphQL API
      MemorySize: 512
      Timeout: 60
      Environment:
        Variables:
          LOG_LEVEL: !Ref LogLevel
          TRACKING_TABLE_NAME: !Ref TrackingTable
      LoggingConfig:
        LogGroup: !Ref CreateDocumentResolverFunctionLogGroup
      Policies:
        - DynamoDBCrudPolicy:
            TableName: !Ref TrackingTable
        - Statement:
            - Effect: Allow
              Action:
                - kms:Encrypt
                - kms:Decrypt
                - kms:ReEncrypt*
                - kms:GenerateDataKey*
                - kms:DescribeKey
              Resource: !GetAtt CustomerManagedEncryptionKey.Arn

  CreateDocumentResolverFunctionLogGroup:
    Type: AWS::Logs::LogGroup
    Properties:
      KmsKeyId: !GetAtt CustomerManagedEncryptionKey.Arn
      RetentionInDays: !Ref LogRetentionDays

  # Create Document resolver configuration
  CreateDocumentResolver:
    Type: AWS::AppSync::Resolver
    Properties:
      ApiId: !GetAtt GraphQLApi.ApiId
      TypeName: Mutation
      FieldName: createDocument
      DataSourceName: !GetAtt CreateDocumentDataSource.Name

  # Data source for Create Document resolver
  CreateDocumentDataSource:
    Type: AWS::AppSync::DataSource
    Properties:
      ApiId: !GetAtt GraphQLApi.ApiId
      Name: CreateDocumentDataSource
      Description: Lambda function for creating document tracking records
      Type: AWS_LAMBDA
      ServiceRoleArn: !GetAtt AppSyncServiceRole.Arn
      LambdaConfig:
        LambdaFunctionArn: !GetAtt CreateDocumentResolverFunction.Arn

  UpdateDocumentResolver:
    Type: AWS::AppSync::Resolver
    Properties:
      ApiId: !GetAtt GraphQLApi.ApiId
      TypeName: Mutation
      FieldName: updateDocument
      DataSourceName: !GetAtt TrackingTableDataSource.Name
      RequestMappingTemplate: |-
        #set( $PK = "doc#${ctx.args.input.ObjectKey}" )
        #set( $expNames = {} )
        #set( $expValues = {} )
        #set( $expSet = {} )
        ## Iterate through each argument with values and update expression variables **
        #foreach( $entry in $ctx.args.input.entrySet() )
            ## skip empty values **
            #if( !$util.isNullOrBlank($entry.value)  )
                $util.qr( $expSet.put("#${entry.key}", ":${entry.key}") )
                $util.qr( $expNames.put("#${entry.key}", "${entry.key}") )
                $util.qr( $expValues.put(":${entry.key}", $util.dynamodb.toDynamoDB($entry.value)) )
            #end
        #end
        ## Start building the update expression, starting with attributes we're going to SET **
        #set( $expression = "" )
        #if( !${expSet.isEmpty()} )
            #set( $expression = "SET" )
            #foreach( $entry in $expSet.entrySet() )
                #set( $expression = "${expression} ${entry.key} = ${entry.value}" )
                #if ( $foreach.hasNext )
                    #set( $expression = "${expression}," )
                #end
            #end
        #end
        {
            "version" : "2018-05-29",
            "operation" : "UpdateItem",
            "key" : {
              "PK": $util.dynamodb.toDynamoDBJson($PK),
              "SK": $util.dynamodb.toDynamoDBJson("none"),
            },
            "update" : {
                "expression": "$expression"
                #if( !${expNames.isEmpty()} )
                , "expressionNames": $utils.toJson($expNames)
                #end
                #if( !${expValues.isEmpty()} )
                , "expressionValues": $utils.toJson($expValues)
                #end
            }
        }
      ResponseMappingTemplate: |
        $util.toJson($ctx.result)

  GetDocumentResolver:
    Type: AWS::AppSync::Resolver
    Properties:
      ApiId: !GetAtt GraphQLApi.ApiId
      TypeName: Query
      FieldName: getDocument
      DataSourceName: !GetAtt TrackingTableDataSource.Name
      RequestMappingTemplate: |
        #set( $PK = "doc#${context.arguments.ObjectKey}" )
        {
          "version": "2018-05-29",
          "operation": "GetItem",
          "key" : {
            "PK": $util.dynamodb.toDynamoDBJson($PK),
            "SK": $util.dynamodb.toDynamoDBJson("none"),
          }
        }
      ResponseMappingTemplate: |
        $util.toJson($ctx.result)

  ListDocumentResolver:
    Type: AWS::AppSync::Resolver
    Properties:
      ApiId: !GetAtt GraphQLApi.ApiId
      TypeName: Query
      FieldName: listDocuments
      DataSourceName: !GetAtt TrackingTableDataSource.Name
      RequestMappingTemplate: |
        {
            "version": "2018-05-29",
            "operation": "Scan",
            "filter": {
                #if($context.arguments.startDateTime && $context.arguments.endDateTime)
                    "expression": "InitialEventTime BETWEEN :startDateTime AND :endDateTime",
                    "expressionValues": {
                        ":startDateTime": { "S": "$context.arguments.startDateTime" },
                        ":endDateTime": { "S": "$context.arguments.endDateTime" }
                    }
                #elseif($context.arguments.startDateTime)
                    "expression": "InitialEventTime >= :startDateTime",
                    "expressionValues": {
                        ":startDateTime": { "S": "$context.arguments.startDateTime" }
                    }
                #elseif($context.arguments.endDateTime)
                    "expression": "InitialEventTime <= :endDateTime",
                    "expressionValues": {
                        ":endDateTime": { "S": "$context.arguments.endDateTime" }
                    }
                #end
            },
            #if($context.prev.result)
                "nextToken": "$context.prev.result.nextToken",
            #end
            "limit": 50,
            "consistentRead": false,
            "select": "ALL_ATTRIBUTES"
        }
      ResponseMappingTemplate: |
        {
            "Documents": $util.toJson($ctx.result.items),
            "nextToken": $util.toJson($ctx.result.nextToken)
        }

  ListDocumentDateHourResolver:
    Type: AWS::AppSync::Resolver
    Properties:
      ApiId: !GetAtt GraphQLApi.ApiId
      TypeName: Query
      FieldName: listDocumentsDateHour
      DataSourceName: !GetAtt TrackingTableDataSource.Name
      RequestMappingTemplate: |
        #set( $shardsInDay = 6 )
        #set( $shardDivider = 24 / $shardsInDay )
        #set( $Integer = 0 )
        #set( $now = $util.time.nowISO8601() )
        #set( $hourNow = $Integer.parseInt($now.substring(11, 13)) )
        #set( $date = $util.defaultIfNullOrBlank($ctx.args.date, $now.substring(0, 10)) )
        #set( $hour = $util.defaultIfNull($ctx.args.hour, $hourNow) )
        #if( $hour < 0 || $hour > 23 )
          $util.error("Invalid hour parameter - value should be between 0 and 23")
        #end
        #set( $hourPad = $date.format("%02d", $hour) )
        #set( $hourShard = $hour / $shardDivider )
        #set( $shardPad = $date.format("%02d", $hourShard) )

        #set( $PK = "list#${date}#s#${shardPad}" )
        #set( $skPrefix = "ts#${date}T${hourPad}" )

        {
          "version" : "2018-05-29",
          "operation" : "Query",
          "query" : {
            "expression": "PK = :PK and begins_with(SK, :prefix)",
            "expressionValues": {
              ":PK": $util.dynamodb.toDynamoDBJson($PK),
              ":prefix": $util.dynamodb.toDynamoDBJson($skPrefix),
            },
          },
        }
      ResponseMappingTemplate: |
        {
            "Documents": $util.toJson($ctx.result.items),
            "nextToken": $util.toJson($ctx.result.nextToken)
        }

  ListDocumentDateShardResolver:
    Type: AWS::AppSync::Resolver
    Properties:
      ApiId: !GetAtt GraphQLApi.ApiId
      TypeName: Query
      FieldName: listDocumentsDateShard
      DataSourceName: !GetAtt TrackingTableDataSource.Name
      RequestMappingTemplate: |
        #set( $shardsInDay = 6 )
        #set( $shardDivider = 24 / $shardsInDay )
        #set( $Integer = 0 )
        #set( $now = $util.time.nowISO8601() )
        #set( $hourNow = $Integer.parseInt($now.substring(11, 13)) )
        #set( $shardNow = $hourNow / $shardDivider )
        #set( $date = $util.defaultIfNullOrBlank($ctx.args.date, $now.substring(0, 10)) )
        #set( $shard = $util.defaultIfNull($ctx.args.shard, $shardNow) )
        #if( $shard >= $shardsInDay )
          $util.error("Invalid shard parameter value - must positive and less than ${shardsInDay}")
        #end
        #set( $hourShard = $hour / $shardDivider )
        #set( $shardPad = $date.format("%02d", $shard) )

        #set( $PK = "list#${date}#s#${shardPad}" )

        {
          "version" : "2018-05-29",
          "operation" : "Query",
          "query" : {
            "expression": "PK = :PK",
            "expressionValues": {
              ":PK": $util.dynamodb.toDynamoDBJson($PK),
            }
          }
        }
      ResponseMappingTemplate: |
        {
            "Documents": $util.toJson($ctx.result.items),
            "nextToken": $util.toJson($ctx.result.nextToken)
        }

  GetFileContentsResolverFunction:
    Type: AWS::Serverless::Function
    Metadata:
      cfn_nag:
        rules_to_suppress:
          - id: W89
            reason: "Function does not require VPC access as it only interacts with AWS services via APIs"
          - id: W92
            reason: "Function does not require reserved concurrency as it scales based on demand"
          - id: W12
            reason: "Lambda requires CloudWatch logs permissions"
    # checkov:skip=CKV_AWS_116: "DLQ not required for AppSync resolver function"
    # checkov:skip=CKV_AWS_117: "Function does not require VPC access as it only interacts with AWS services via APIs"
    # checkov:skip=CKV_AWS_115: "Function does not require reserved concurrency as it scales based on demand"
    Properties:
      PermissionsBoundary:
        !If [
          HasPermissionsBoundary,
          !Ref PermissionsBoundaryArn,
          !Ref AWS::NoValue,
        ]
      Handler: index.handler
      Runtime: python3.12
      CodeUri: ./src/lambda/get_file_contents_resolver
      Description: Lambda function to return file contents via GraphQL API
      MemorySize: 512
      Timeout: 60
      LoggingConfig:
        LogGroup: !Ref GetFileContentsResolverFunctionLogGroup
      Policies:
        - S3ReadPolicy:
            BucketName: !If
              - ShouldCreateEvaluationBaselineBucket
              - !Ref EvaluationBaselineBucket
              - !Ref EvaluationBaselineBucketName
        - S3ReadPolicy:
            BucketName: !Ref InputBucket
        - S3ReadPolicy:
            BucketName: !Ref ConfigurationBucket
        - S3ReadPolicy:
            BucketName: !Ref OutputBucket
        - Statement:
            - Effect: Allow
              Action:
                - kms:Encrypt
                - kms:Decrypt
                - kms:ReEncrypt*
                - kms:GenerateDataKey*
                - kms:DescribeKey
              Resource: !GetAtt CustomerManagedEncryptionKey.Arn

  GetFileContentsResolverFunctionLogGroup:
    Type: AWS::Logs::LogGroup
    Properties:
      KmsKeyId: !GetAtt CustomerManagedEncryptionKey.Arn
      RetentionInDays: !Ref LogRetentionDays

  GetFileContentsDataSource:
    Type: AWS::AppSync::DataSource
    Properties:
      ApiId: !GetAtt GraphQLApi.ApiId
      Name: GetFileContents
      Description: Lambda function to return file contents via GraphQL API
      Type: AWS_LAMBDA
      ServiceRoleArn: !GetAtt AppSyncServiceRole.Arn
      LambdaConfig:
        LambdaFunctionArn: !GetAtt GetFileContentsResolverFunction.Arn

  GetFileContentsResolver:
    Type: AWS::AppSync::Resolver
    DependsOn: GraphQLSchema
    Properties:
      ApiId: !GetAtt GraphQLApi.ApiId
      DataSourceName: !GetAtt GetFileContentsDataSource.Name
      TypeName: Query
      FieldName: getFileContents

  GetStepFunctionExecutionResolverFunction:
    Type: AWS::Serverless::Function
    Metadata:
      cfn_nag:
        rules_to_suppress:
          - id: W89
            reason: "Function does not require VPC access as it only interacts with AWS services via APIs"
          - id: W92
            reason: "Function does not require reserved concurrency as it scales based on demand"
          - id: W58
            reason: "DLQ not required for AppSync resolver function as GraphQL handles retries"
    # checkov:skip=CKV_AWS_116: "DLQ not required for AppSync resolver function as GraphQL handles retries"
    # checkov:skip=CKV_AWS_117: "Function does not require VPC access as it only interacts with AWS services via APIs"
    # checkov:skip=CKV_AWS_115: "Function does not require reserved concurrency as it scales based on demand"
    # checkov:skip=CKV_AWS_173: "Environment variables do not contain sensitive data - only configuration values like feature flags and non-sensitive settings"
    Properties:
      PermissionsBoundary:
        !If [
          HasPermissionsBoundary,
          !Ref PermissionsBoundaryArn,
          !Ref AWS::NoValue,
        ]
      CodeUri: src/lambda/get_stepfunction_execution_resolver/
      Handler: index.lambda_handler
      Runtime: python3.12
      Architectures:
        - x86_64
      MemorySize: 512
      Timeout: 60
      LoggingConfig:
        LogGroup: !Ref GetStepFunctionExecutionResolverFunctionLogGroup
      Policies:
        - Statement:
            - Effect: Allow
              Action:
                - states:DescribeExecution
                - states:GetExecutionHistory
              Resource:
                - !Sub
                  - "arn:${AWS::Partition}:states:${AWS::Region}:${AWS::AccountId}:execution:${StateMachineName}*"
                  - StateMachineName: !If
                      - IsPattern3
                      - !GetAtt PATTERN3STACK.Outputs.StateMachineName
                      - !If
                        - IsPattern2
                        - !GetAtt PATTERN2STACK.Outputs.StateMachineName
                        - !GetAtt PATTERN1STACK.Outputs.StateMachineName
        - KMSDecryptPolicy:
            KeyId: !GetAtt CustomerManagedEncryptionKey.Arn
        - Statement:
            - Effect: Allow
              Action:
                - kms:Encrypt
                - kms:Decrypt
                - kms:ReEncrypt*
                - kms:GenerateDataKey*
                - kms:DescribeKey
              Resource: !GetAtt CustomerManagedEncryptionKey.Arn

  GetStepFunctionExecutionResolverFunctionLogGroup:
    Type: AWS::Logs::LogGroup
    Properties:
      KmsKeyId: !GetAtt CustomerManagedEncryptionKey.Arn
      RetentionInDays: !Ref LogRetentionDays

  GetStepFunctionExecutionDataSource:
    Type: AWS::AppSync::DataSource
    Properties:
      ApiId: !GetAtt GraphQLApi.ApiId
      Name: GetStepFunctionExecution
      Description: Lambda function to return Step Functions execution details via GraphQL API
      Type: AWS_LAMBDA
      ServiceRoleArn: !GetAtt AppSyncServiceRole.Arn
      LambdaConfig:
        LambdaFunctionArn: !GetAtt GetStepFunctionExecutionResolverFunction.Arn

  GetStepFunctionExecutionResolver:
    Type: AWS::AppSync::Resolver
    DependsOn: GraphQLSchema
    Properties:
      ApiId: !GetAtt GraphQLApi.ApiId
      DataSourceName: !GetAtt GetStepFunctionExecutionDataSource.Name
      TypeName: Query
      FieldName: getStepFunctionExecution

  ConfigurationResolverFunction:
    Type: AWS::Serverless::Function
    Metadata:
      cfn_nag:
        rules_to_suppress:
          - id: W89
            reason: "Function does not require VPC access as it only interacts with AWS services via APIs"
          - id: W92
            reason: "Function does not require reserved concurrency as it scales based on demand"
          - id: W12
            reason: "Lambda requires CloudWatch logs permissions"
    # checkov:skip=CKV_AWS_116: "DLQ not required for AppSync resolver function"
    # checkov:skip=CKV_AWS_117: "Function does not require VPC access as it only interacts with AWS services via APIs"
    # checkov:skip=CKV_AWS_115: "Function does not require reserved concurrency as it scales based on demand"
    # checkov:skip=CKV_AWS_173: "Environment variables do not contain sensitive data - only configuration values like feature flags and non-sensitive settings"
    Properties:
      PermissionsBoundary:
        !If [
          HasPermissionsBoundary,
          !Ref PermissionsBoundaryArn,
          !Ref AWS::NoValue,
        ]
      Handler: index.handler
      Runtime: python3.12
      CodeUri: ./src/lambda/configuration_resolver
      Description: Lambda function to manage configuration through GraphQL API
      MemorySize: 512
      Timeout: 60
      Environment:
        Variables:
          LOG_LEVEL: !Ref LogLevel
          CONFIGURATION_TABLE_NAME: !Ref ConfigurationTable
          CONFIGURATION_QUEUE_URL: !Ref ConfigurationQueue
          STACK_NAME: !Ref AWS::StackName
          CONFIGURATION_BUCKET: !Ref ConfigurationBucket
      LoggingConfig:
        LogGroup: !Ref ConfigurationResolverFunctionLogGroup
      Policies:
        - DynamoDBCrudPolicy:
            TableName: !Ref ConfigurationTable
        - SQSSendMessagePolicy:
            QueueName: !GetAtt ConfigurationQueue.QueueName
        - S3ReadPolicy:
            BucketName: !Ref ConfigurationBucket
        - Statement:
            - Effect: Allow
              Action:
                - kms:Encrypt
                - kms:Decrypt
                - kms:ReEncrypt*
                - kms:GenerateDataKey*
                - kms:DescribeKey
              Resource: !GetAtt CustomerManagedEncryptionKey.Arn
            - Effect: Allow
              Action:
                - ssm:GetParameter
                - ssm:PutParameter
              Resource: !Sub "arn:${AWS::Partition}:ssm:${AWS::Region}:${AWS::AccountId}:parameter/${AWS::StackName}/FlowDefinitionArn"

  ConfigurationResolverFunctionLogGroup:
    Type: AWS::Logs::LogGroup
    Properties:
      KmsKeyId: !GetAtt CustomerManagedEncryptionKey.Arn
      RetentionInDays: !Ref LogRetentionDays

  ConfigurationDataSource:
    Type: AWS::AppSync::DataSource
    Properties:
      ApiId: !GetAtt GraphQLApi.ApiId
      Name: ConfigurationDataSource
      Description: Lambda function to manage configuration via GraphQL API
      Type: AWS_LAMBDA
      ServiceRoleArn: !GetAtt AppSyncServiceRole.Arn
      LambdaConfig:
        LambdaFunctionArn: !GetAtt ConfigurationResolverFunction.Arn

  GetConfigurationResolver:
    Type: AWS::AppSync::Resolver
    DependsOn: GraphQLSchema
    Properties:
      ApiId: !GetAtt GraphQLApi.ApiId
      DataSourceName: !GetAtt ConfigurationDataSource.Name
      TypeName: Query
      FieldName: getConfiguration

  UpdateConfigurationResolver:
    Type: AWS::AppSync::Resolver
    DependsOn: GraphQLSchema
    Properties:
      ApiId: !GetAtt GraphQLApi.ApiId
      DataSourceName: !GetAtt ConfigurationDataSource.Name
      TypeName: Mutation
      FieldName: updateConfiguration

  ListConfigurationLibraryResolver:
    Type: AWS::AppSync::Resolver
    DependsOn: GraphQLSchema
    Properties:
      ApiId: !GetAtt GraphQLApi.ApiId
      DataSourceName: !GetAtt ConfigurationDataSource.Name
      TypeName: Query
      FieldName: listConfigurationLibrary

  GetConfigurationLibraryFileResolver:
    Type: AWS::AppSync::Resolver
    DependsOn: GraphQLSchema
    Properties:
      ApiId: !GetAtt GraphQLApi.ApiId
      DataSourceName: !GetAtt ConfigurationDataSource.Name
      TypeName: Query
      FieldName: getConfigurationLibraryFile

  CopyToBaselineResolverFunction:
    Type: AWS::Serverless::Function
    Metadata:
      cfn_nag:
        rules_to_suppress:
          - id: W89
            reason: "Function does not require VPC access as it only interacts with AWS services via APIs"
          - id: W92
            reason: "Function does not require reserved concurrency as it scales based on demand"
          - id: W12
            reason: "Lambda requires CloudWatch logs permissions"
    # checkov:skip=CKV_AWS_116: "DLQ not required for AppSync resolver function"
    # checkov:skip=CKV_AWS_117: "Function does not require VPC access as it only interacts with AWS services via APIs"
    # checkov:skip=CKV_AWS_115: "Function does not require reserved concurrency as it scales based on demand"
    # checkov:skip=CKV_AWS_173: "Environment variables do not contain sensitive data - only configuration values like feature flags and non-sensitive settings"
    Properties:
      PermissionsBoundary:
        !If [
          HasPermissionsBoundary,
          !Ref PermissionsBoundaryArn,
          !Ref AWS::NoValue,
        ]
      Handler: index.handler
      Runtime: python3.12
      CodeUri: ./src/lambda/copy_to_baseline_resolver
      Description: Lambda function to copy files to baseline bucket via GraphQL API
      MemorySize: 512
      Timeout: 300
      Environment:
        Variables:
          LOG_LEVEL: !Ref LogLevel
          OUTPUT_BUCKET: !Ref OutputBucket
          EVALUATION_BASELINE_BUCKET: !If
            - ShouldCreateEvaluationBaselineBucket
            - !Ref EvaluationBaselineBucket
            - !Ref EvaluationBaselineBucketName
          APPSYNC_API_URL: !GetAtt GraphQLApi.GraphQLUrl
      LoggingConfig:
        LogGroup: !Ref CopyToBaselineResolverFunctionLogGroup
      Policies:
        - S3CrudPolicy:
            BucketName: !Ref OutputBucket
        - S3CrudPolicy:
            BucketName: !If
              - ShouldCreateEvaluationBaselineBucket
              - !Ref EvaluationBaselineBucket
              - !Ref EvaluationBaselineBucketName
        - Statement:
            - Effect: Allow
              Action:
                - kms:Encrypt
                - kms:Decrypt
                - kms:ReEncrypt*
                - kms:GenerateDataKey*
                - kms:DescribeKey
              Resource: !GetAtt CustomerManagedEncryptionKey.Arn
        # Allow the function to invoke itself asynchronously
        - Statement:
            - Effect: Allow
              Action:
                - lambda:InvokeFunction
              Resource: !Sub "arn:${AWS::Partition}:lambda:${AWS::Region}:${AWS::AccountId}:function:${AWS::StackName}-CopyToBaseline*"
        # Allow AppSync access for document updates
        - Statement:
            - Effect: Allow
              Action:
                - appsync:GraphQL
              Resource:
                - !Sub "${GraphQLApi.Arn}/types/Mutation/*"

  CopyToBaselineResolverFunctionLogGroup:
    Type: AWS::Logs::LogGroup
    Properties:
      KmsKeyId: !GetAtt CustomerManagedEncryptionKey.Arn
      RetentionInDays: !Ref LogRetentionDays

  CopyToBaselineDataSource:
    Type: AWS::AppSync::DataSource
    Properties:
      ApiId: !GetAtt GraphQLApi.ApiId
      Name: CopyToBaselineDataSource
      Description: Lambda function for copying files to baseline bucket
      Type: AWS_LAMBDA
      ServiceRoleArn: !GetAtt AppSyncServiceRole.Arn
      LambdaConfig:
        LambdaFunctionArn: !GetAtt CopyToBaselineResolverFunction.Arn

  CopyToBaselineResolver:
    Type: AWS::AppSync::Resolver
    DependsOn: GraphQLSchema
    Properties:
      ApiId: !GetAtt GraphQLApi.ApiId
      DataSourceName: !GetAtt CopyToBaselineDataSource.Name
      TypeName: Mutation
      FieldName: copyToBaseline

  DeleteDocumentResolverFunction:
    Type: AWS::Serverless::Function
    Metadata:
      cfn_nag:
        rules_to_suppress:
          - id: W89
            reason: "Function does not require VPC access as it only interacts with AWS services via APIs"
          - id: W92
            reason: "Function does not require reserved concurrency as it scales based on demand"
          - id: W12
            reason: "Lambda requires CloudWatch logs permissions"
    # checkov:skip=CKV_AWS_116: "DLQ not required for AppSync resolver function"
    # checkov:skip=CKV_AWS_117: "Function does not require VPC access as it only interacts with AWS services via APIs"
    # checkov:skip=CKV_AWS_115: "Function does not require reserved concurrency as it scales based on demand"
    # checkov:skip=CKV_AWS_173: "Environment variables do not contain sensitive data - only configuration values like feature flags and non-sensitive settings"
    Properties:
      PermissionsBoundary:
        !If [
          HasPermissionsBoundary,
          !Ref PermissionsBoundaryArn,
          !Ref AWS::NoValue,
        ]
      Handler: index.handler
      Runtime: python3.12
      CodeUri: ./src/lambda/delete_document_resolver
      Description: Lambda function to delete documents via GraphQL API
      MemorySize: 512
      Timeout: 60
      Environment:
        Variables:
          LOG_LEVEL: !Ref LogLevel
          TRACKING_TABLE_NAME: !Ref TrackingTable
          INPUT_BUCKET: !Ref InputBucket
          OUTPUT_BUCKET: !Ref OutputBucket
      LoggingConfig:
        LogGroup: !Ref DeleteDocumentResolverFunctionLogGroup
      Policies:
        - DynamoDBCrudPolicy:
            TableName: !Ref TrackingTable
        - S3CrudPolicy:
            BucketName: !Ref InputBucket
        - S3CrudPolicy:
            BucketName: !Ref OutputBucket
        - Statement:
            - Effect: Allow
              Action:
                - kms:Encrypt
                - kms:Decrypt
                - kms:ReEncrypt*
                - kms:GenerateDataKey*
                - kms:DescribeKey
              Resource: !GetAtt CustomerManagedEncryptionKey.Arn

  DeleteDocumentResolverFunctionLogGroup:
    Type: AWS::Logs::LogGroup
    Properties:
      KmsKeyId: !GetAtt CustomerManagedEncryptionKey.Arn
      RetentionInDays: !Ref LogRetentionDays

  DeleteTestsResolverFunction:
    Type: AWS::Serverless::Function
    Metadata:
      cfn_nag:
        rules_to_suppress:
          - id: W89
            reason: "Function does not require VPC access as it only interacts with AWS services via APIs"
          - id: W92
            reason: "Function does not require reserved concurrency as it scales based on demand"
          - id: W12
            reason: "Lambda requires CloudWatch logs permissions"
    Properties:
      PermissionsBoundary: !If [HasPermissionsBoundary, !Ref PermissionsBoundaryArn, !Ref AWS::NoValue]
      Handler: index.lambda_handler
      Runtime: python3.12
      CodeUri: ./src/lambda/delete_tests
      Description: Lambda function to delete test runs via GraphQL API
      MemorySize: 512
      Timeout: 60
      Environment:
        Variables:
          LOG_LEVEL: !Ref LogLevel
          TRACKING_TABLE_NAME: !Ref TrackingTable
          DELETE_DOCUMENT_FUNCTION_NAME: !Ref DeleteDocumentResolverFunction
          BASELINE_BUCKET: !If
            - ShouldCreateEvaluationBaselineBucket
            - !Ref EvaluationBaselineBucket
            - !Ref EvaluationBaselineBucketName
      LoggingConfig:
        LogGroup: !Ref DeleteTestsResolverFunctionLogGroup
      Policies:
        - DynamoDBCrudPolicy:
            TableName: !Ref TrackingTable
        - S3CrudPolicy:
            BucketName: !If
              - ShouldCreateEvaluationBaselineBucket
              - !Ref EvaluationBaselineBucket
              - !Ref EvaluationBaselineBucketName
        - Statement:
            - Effect: Allow
              Action:
                - lambda:InvokeFunction
              Resource: !GetAtt DeleteDocumentResolverFunction.Arn
        - Statement:
            - Effect: Allow
              Action:
                - kms:Encrypt
                - kms:Decrypt
                - kms:ReEncrypt*
                - kms:GenerateDataKey*
                - kms:DescribeKey
              Resource: !GetAtt CustomerManagedEncryptionKey.Arn

  DeleteTestsResolverFunctionLogGroup:
    Type: AWS::Logs::LogGroup
    Properties:
      KmsKeyId: !GetAtt CustomerManagedEncryptionKey.Arn
      RetentionInDays: !Ref LogRetentionDays

  DeleteDocumentDataSource:
    Type: AWS::AppSync::DataSource
    Properties:
      ApiId: !GetAtt GraphQLApi.ApiId
      Name: DeleteDocumentDataSource
      Description: Lambda function for deleting documents
      Type: AWS_LAMBDA
      ServiceRoleArn: !GetAtt AppSyncServiceRole.Arn
      LambdaConfig:
        LambdaFunctionArn: !GetAtt DeleteDocumentResolverFunction.Arn

  DeleteDocumentResolver:
    Type: AWS::AppSync::Resolver
    DependsOn: GraphQLSchema
    Properties:
      ApiId: !GetAtt GraphQLApi.ApiId
      DataSourceName: !GetAtt DeleteDocumentDataSource.Name
      TypeName: Mutation
      FieldName: deleteDocument

  DeleteTestsDataSource:
    Type: AWS::AppSync::DataSource
    Properties:
      ApiId: !GetAtt GraphQLApi.ApiId
      Name: DeleteTestsDataSource
      Description: Lambda function for deleting test runs
      Type: AWS_LAMBDA
      ServiceRoleArn: !GetAtt AppSyncServiceRole.Arn
      LambdaConfig:
        LambdaFunctionArn: !GetAtt DeleteTestsResolverFunction.Arn

  DeleteTestsResolver:
    Type: AWS::AppSync::Resolver
    DependsOn: GraphQLSchema
    Properties:
      ApiId: !GetAtt GraphQLApi.ApiId
      DataSourceName: !GetAtt DeleteTestsDataSource.Name
      TypeName: Mutation
      FieldName: deleteTests

  AddTestSetResolver:
    Type: AWS::AppSync::Resolver
    DependsOn: GraphQLSchema
    Properties:
      ApiId: !GetAtt GraphQLApi.ApiId
      DataSourceName: !GetAtt TestSetDataSource.Name
      TypeName: Mutation
      FieldName: addTestSet

  AddTestSetFromUploadResolver:
    Type: AWS::AppSync::Resolver
    DependsOn: GraphQLSchema
    Properties:
      ApiId: !GetAtt GraphQLApi.ApiId
      DataSourceName: !GetAtt TestSetDataSource.Name
      TypeName: Mutation
      FieldName: addTestSetFromUpload

  DeleteTestSetsResolver:
    Type: AWS::AppSync::Resolver
    DependsOn: GraphQLSchema
    Properties:
      ApiId: !GetAtt GraphQLApi.ApiId
      DataSourceName: !GetAtt TestSetDataSource.Name
      TypeName: Mutation
      FieldName: deleteTestSets

  GetTestSetsResolver:
    Type: AWS::AppSync::Resolver
    DependsOn: GraphQLSchema
    Properties:
      ApiId: !GetAtt GraphQLApi.ApiId
      DataSourceName: !GetAtt TestSetDataSource.Name
      TypeName: Query
      FieldName: getTestSets

  ListBucketFilesResolver:
    Type: AWS::AppSync::Resolver
    DependsOn: GraphQLSchema
    Properties:
      ApiId: !GetAtt GraphQLApi.ApiId
      DataSourceName: !GetAtt TestSetDataSource.Name
      TypeName: Query
      FieldName: listBucketFiles

  ValidateTestFileNameResolver:
    Type: AWS::AppSync::Resolver
    DependsOn: GraphQLSchema
    Properties:
      ApiId: !GetAtt GraphQLApi.ApiId
      DataSourceName: !GetAtt TestSetDataSource.Name
      TypeName: Query
      FieldName: validateTestFileName
      
  TestRunnerFunction:
    Type: AWS::Serverless::Function
    Metadata:
      cfn_nag:
        rules_to_suppress:
          - id: W89
            reason: "Function does not require VPC access as it only interacts with AWS services via APIs"
          - id: W92
            reason: "Function does not require reserved concurrency as it scales based on demand"
          - id: W12
            reason: "Lambda requires CloudWatch logs permissions"
    # checkov:skip=CKV_AWS_116: "DLQ not required for AppSync resolver function"
    # checkov:skip=CKV_AWS_117: "Function does not require VPC access as it only interacts with AWS services via APIs"
    # checkov:skip=CKV_AWS_115: "Function does not require reserved concurrency as it scales based on demand"
    # checkov:skip=CKV_AWS_173: "Environment variables do not contain sensitive data - only configuration values like feature flags and non-sensitive settings"
    Properties:
      PermissionsBoundary: !If [HasPermissionsBoundary, !Ref PermissionsBoundaryArn, !Ref AWS::NoValue]
      Handler: index.handler
      Runtime: python3.12
      CodeUri: ./src/lambda/test_runner
      Description: Lambda function to run test sets via GraphQL API
      MemorySize: 256
      Timeout: 300
      Environment:
        Variables:
          LOG_LEVEL: !Ref LogLevel
          INPUT_BUCKET: !Ref InputBucket
          BASELINE_BUCKET: !If
            - ShouldCreateEvaluationBaselineBucket
            - !Ref EvaluationBaselineBucket
            - !Ref EvaluationBaselineBucketName
          CONFIG_TABLE: !Ref ConfigurationTable
          TRACKING_TABLE: !Ref TrackingTable
          FILE_COPY_QUEUE_URL: !Ref TestFileCopyQueue
      LoggingConfig:
        LogGroup: !Ref TestRunnerFunctionLogGroup
      Policies:
        - DynamoDBCrudPolicy:
            TableName: !Ref TrackingTable
        - DynamoDBCrudPolicy:
            TableName: !Ref ConfigurationTable
        - S3CrudPolicy:
            BucketName: !Ref InputBucket
        - S3CrudPolicy:
            BucketName: !If
              - ShouldCreateEvaluationBaselineBucket
              - !Ref EvaluationBaselineBucket
              - !Ref EvaluationBaselineBucketName
        - SQSSendMessagePolicy:
            QueueName: !GetAtt TestFileCopyQueue.QueueName
        - Statement:
            - Effect: Allow
              Action:
                - kms:Encrypt
                - kms:Decrypt
                - kms:ReEncrypt*
                - kms:GenerateDataKey*
                - kms:DescribeKey
              Resource: !GetAtt CustomerManagedEncryptionKey.Arn

  TestRunnerFunctionLogGroup:
    Type: AWS::Logs::LogGroup
    Properties:
      KmsKeyId: !GetAtt CustomerManagedEncryptionKey.Arn
      RetentionInDays: !Ref LogRetentionDays

  ##########################################################################
  # SQS Queue for test file copying jobs
  ##########################################################################

  TestFileCopyQueueDLQ:
    Type: AWS::SQS::Queue
    Properties:
      KmsMasterKeyId: !Ref CustomerManagedEncryptionKey
      MessageRetentionPeriod: 1209600 # 14 days
      VisibilityTimeout: 900

  TestFileCopyQueueDLQPolicy:
    Type: AWS::SQS::QueuePolicy
    Properties:
      Queues:
        - !Ref TestFileCopyQueueDLQ
      PolicyDocument:
        Statement:
          - Sid: DenyInsecureConnections
            Effect: Deny
            Principal: "*"
            Action: "sqs:*"
            Resource: !GetAtt TestFileCopyQueueDLQ.Arn
            Condition:
              Bool:
                "aws:SecureTransport": "false"

  TestFileCopyQueue:
    Type: AWS::SQS::Queue
    Properties:
      KmsMasterKeyId: !Ref CustomerManagedEncryptionKey
      VisibilityTimeout: 900
      RedrivePolicy:
        deadLetterTargetArn: !GetAtt TestFileCopyQueueDLQ.Arn
        maxReceiveCount: 3

  TestFileCopyQueuePolicy:
    Type: AWS::SQS::QueuePolicy
    Properties:
      Queues:
        - !Ref TestFileCopyQueue
      PolicyDocument:
        Statement:
          - Sid: DenyInsecureConnections
            Effect: Deny
            Principal: "*"
            Action: "sqs:*"
            Resource: !GetAtt TestFileCopyQueue.Arn
            Condition:
              Bool:
                "aws:SecureTransport": "false"

  ##########################################################################
  # SQS Queue for test set file copying jobs
  ##########################################################################

  TestSetFileCopyQueueDLQ:
    Type: AWS::SQS::Queue
    Properties:
      KmsMasterKeyId: !Ref CustomerManagedEncryptionKey
      MessageRetentionPeriod: 1209600 # 14 days
      VisibilityTimeout: 900

  TestSetFileCopyQueueDLQPolicy:
    Type: AWS::SQS::QueuePolicy
    Properties:
      Queues:
        - !Ref TestSetFileCopyQueueDLQ
      PolicyDocument:
        Statement:
          - Sid: DenyInsecureConnections
            Effect: Deny
            Principal: "*"
            Action: "sqs:*"
            Resource: !GetAtt TestSetFileCopyQueueDLQ.Arn
            Condition:
              Bool:
                "aws:SecureTransport": "false"

  TestSetFileCopyQueue:
    Type: AWS::SQS::Queue
    Properties:
      KmsMasterKeyId: !Ref CustomerManagedEncryptionKey
      VisibilityTimeout: 900
      RedrivePolicy:
        deadLetterTargetArn: !GetAtt TestSetFileCopyQueueDLQ.Arn
        maxReceiveCount: 3

  TestSetFileCopyQueuePolicy:
    Type: AWS::SQS::QueuePolicy
    Properties:
      Queues:
        - !Ref TestSetFileCopyQueue
      PolicyDocument:
        Statement:
          - Sid: DenyInsecureConnections
            Effect: Deny
            Principal: "*"
            Action: "sqs:*"
            Resource: !GetAtt TestSetFileCopyQueue.Arn
            Condition:
              Bool:
                "aws:SecureTransport": "false"

  ##########################################################################
  # Lambda function to copy test set files
  ##########################################################################

  TestSetFileCopierFunctionDLQ:
    Type: AWS::SQS::Queue
    Properties:
      KmsMasterKeyId: !Ref CustomerManagedEncryptionKey

  TestSetFileCopierFunction:
    Type: AWS::Serverless::Function
    Metadata:
      cfn_nag:
        rules_to_suppress:
          - id: W89
            reason: "Function does not require VPC access as it only interacts with AWS services via APIs"
          - id: W92
            reason: "Function does not require reserved concurrency as it scales based on demand"
          - id: W12
            reason: "Lambda requires CloudWatch logs permissions"
    # checkov:skip=CKV_AWS_116: "DLQ not required for SQS triggered function"
    # checkov:skip=CKV_AWS_117: "Function does not require VPC access as it only interacts with AWS services via APIs"
    # checkov:skip=CKV_AWS_115: "Function does not require reserved concurrency as it scales based on demand"
    # checkov:skip=CKV_AWS_173: "Environment variables do not contain sensitive data - only configuration values like feature flags and non-sensitive settings"
    Properties:
      PermissionsBoundary: !If [HasPermissionsBoundary, !Ref PermissionsBoundaryArn, !Ref AWS::NoValue]
      Handler: index.handler
      Runtime: python3.12
      CodeUri: ./src/lambda/test_set_file_copier
      Description: Lambda function to copy test set files from SQS queue
      MemorySize: 1024
      Timeout: 900
      DeadLetterQueue:
        Type: SQS
        TargetArn: !GetAtt TestSetFileCopierFunctionDLQ.Arn
      LoggingConfig:
        LogGroup: !Ref TestSetFileCopierFunctionLogGroup
      Environment:
        Variables:
          LOG_LEVEL: !Ref LogLevel
          INPUT_BUCKET: !Ref InputBucket
          TEST_SET_BUCKET: !Ref TestSetBucket
          BASELINE_BUCKET: !If
            - ShouldCreateEvaluationBaselineBucket
            - !Ref EvaluationBaselineBucket
            - !Ref EvaluationBaselineBucketName
          TRACKING_TABLE: !Ref TrackingTable
      Policies:
        - DynamoDBCrudPolicy:
            TableName: !Ref TrackingTable
        - S3ReadPolicy:
            BucketName: !Ref InputBucket
        - S3ReadPolicy:
            BucketName: !If
              - ShouldCreateEvaluationBaselineBucket
              - !Ref EvaluationBaselineBucket
              - !Ref EvaluationBaselineBucketName
        - S3CrudPolicy:
            BucketName: !Ref TestSetBucket
        - Statement:
            - Effect: Allow
              Action:
                - kms:Encrypt
                - kms:Decrypt
                - kms:ReEncrypt*
                - kms:GenerateDataKey*
                - kms:DescribeKey
              Resource: !GetAtt CustomerManagedEncryptionKey.Arn
      Events:
        SQSEvent:
          Type: SQS
          Properties:
            Queue: !GetAtt TestSetFileCopyQueue.Arn
            BatchSize: 1

  TestSetFileCopierFunctionLogGroup:
    Type: AWS::Logs::LogGroup
    Properties:
      KmsKeyId: !GetAtt CustomerManagedEncryptionKey.Arn
      RetentionInDays: !Ref LogRetentionDays

  ##########################################################################
  # Lambda function to extract uploaded ZIP files for test sets
  ##########################################################################

  TestSetZipExtractorFunction:
    Type: AWS::Serverless::Function
    Metadata:
      cfn_nag:
        rules_to_suppress:
          - id: W89
            reason: "Lambda function does not need to be in VPC"
          - id: W92
            reason: "Lambda function does not need reserved concurrency"
    Properties:
      PermissionsBoundary:
        !If [
          HasPermissionsBoundary,
          !Ref PermissionsBoundaryArn,
          !Ref AWS::NoValue,
        ]
      CodeUri: src/lambda/test_set_zip_extractor/
      Handler: index.handler
      Runtime: python3.12
      Timeout: 300
      MemorySize: 1024
      Environment:
        Variables:
          LOG_LEVEL: !Ref LogLevel
          TRACKING_TABLE: !Ref TrackingTable
          TEST_SET_BUCKET: !Ref TestSetBucket
      LoggingConfig:
        LogGroup: !Ref TestSetZipExtractorFunctionLogGroup
      Policies:
        - DynamoDBCrudPolicy:
            TableName: !Ref TrackingTable
        - Statement:
            - Effect: Allow
              Action:
                - kms:Encrypt
                - kms:Decrypt
                - kms:ReEncrypt*
                - kms:GenerateDataKey*
                - kms:DescribeKey
              Resource: !GetAtt CustomerManagedEncryptionKey.Arn

  TestSetZipExtractorFunctionInvokePermission:
    Type: AWS::Lambda::Permission
    Properties:
      FunctionName: !Ref TestSetZipExtractorFunction
      Action: lambda:InvokeFunction
      Principal: !Sub "s3.${AWS::URLSuffix}"
      SourceArn: !GetAtt TestSetBucket.Arn

  TestSetZipExtractorFunctionLogGroup:
    Type: AWS::Logs::LogGroup
    Properties:
      KmsKeyId: !GetAtt CustomerManagedEncryptionKey.Arn
      RetentionInDays: !Ref LogRetentionDays

  # Separate policies to break circular dependency
  TestSetZipExtractorS3Policy:
    Type: AWS::IAM::Policy
    Properties:
      PolicyName: TestSetZipExtractorS3Access
      PolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Action:
              - s3:GetObject
              - s3:PutObject
              - s3:DeleteObject
              - s3:ListBucket
            Resource:
              - !Sub "${TestSetBucket.Arn}/*"
              - !GetAtt TestSetBucket.Arn
      Roles:
        - !Ref TestSetZipExtractorFunctionRole

  # Custom resource to configure S3 bucket notification after both bucket and function exist
  TestSetBucketNotificationFunction:
    Type: AWS::Serverless::Function
    Metadata:
      cfn_nag:
        rules_to_suppress:
          - id: W89
            reason: "Function does not require VPC access as it only interacts with AWS services via APIs"
          - id: W92
            reason: "Function does not require reserved concurrency as it scales based on demand"
    # checkov:skip=CKV_AWS_116: "DLQ not required for Cfn Custom Resource function"
    # checkov:skip=CKV_AWS_117: "Function does not require VPC access as it only interacts with AWS services via APIs"
    # checkov:skip=CKV_AWS_115: "Function does not require reserved concurrency as it scales based on demand"
    Properties:
      PermissionsBoundary:
        !If [
          HasPermissionsBoundary,
          !Ref PermissionsBoundaryArn,
          !Ref AWS::NoValue,
        ]
      Handler: index.handler
      Runtime: python3.12
      Timeout: 60
      InlineCode: |
        import boto3
        import cfnresponse
        import json
        import logging

        logger = logging.getLogger()
        logger.setLevel(logging.INFO)

        def handler(event, context):
            logger.info(json.dumps(event))
            
            try:
                s3_client = boto3.client('s3')
                bucket_name = event['ResourceProperties']['BucketName']
                function_arn = event['ResourceProperties']['FunctionArn']
                
                if event['RequestType'] == 'Create' or event['RequestType'] == 'Update':
                    # Configure bucket notification
                    notification_config = {
                        'LambdaFunctionConfigurations': [
                            {
                                'Id': 'TestSetZipExtractor',
                                'LambdaFunctionArn': function_arn,
                                'Events': ['s3:ObjectCreated:*'],
                                'Filter': {
                                    'Key': {
                                        'FilterRules': [
                                            {
                                                'Name': 'suffix',
                                                'Value': '.zip'
                                            }
                                        ]
                                    }
                                }
                            }
                        ]
                    }
                    
                    s3_client.put_bucket_notification_configuration(
                        Bucket=bucket_name,
                        NotificationConfiguration=notification_config
                    )
                    
                elif event['RequestType'] == 'Delete':
                    # Remove bucket notification
                    s3_client.put_bucket_notification_configuration(
                        Bucket=bucket_name,
                        NotificationConfiguration={}
                    )
                
                cfnresponse.send(event, context, cfnresponse.SUCCESS, {})
                
            except Exception as e:
                logger.error(f"Error: {str(e)}")
                cfnresponse.send(event, context, cfnresponse.FAILED, {}, 
                               reason=f"Error configuring bucket notification: {str(e)}")
      Policies:
        - Statement:
            - Effect: Allow
              Action:
                - s3:PutBucketNotification
                - s3:GetBucketNotification
              Resource: !GetAtt TestSetBucket.Arn

  TestSetBucketNotificationConfiguration:
    Type: Custom::S3BucketNotification
    DependsOn:
      - TestSetBucket
      - TestSetZipExtractorFunction
      - TestSetZipExtractorFunctionInvokePermission
      - TestSetZipExtractorS3Policy
    Properties:
      ServiceToken: !GetAtt TestSetBucketNotificationFunction.Arn
      BucketName: !Ref TestSetBucket
      FunctionArn: !GetAtt TestSetZipExtractorFunction.Arn

  TestSetResolverS3Policy:
    Type: AWS::IAM::Policy
    Properties:
      PolicyName: TestSetResolverS3Access
      PolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Action:
              - s3:GetObject
              - s3:PutObject
              - s3:DeleteObject
              - s3:ListBucket
            Resource:
              - !Sub "${TestSetBucket.Arn}/*"
              - !GetAtt TestSetBucket.Arn
      Roles:
        - !Ref TestSetResolverFunctionRole

  ##########################################################################
  # Lambda function to copy test files
  ##########################################################################

  TestFileCopierFunctionDLQ:
    Type: AWS::SQS::Queue
    Properties:
      KmsMasterKeyId: !Ref CustomerManagedEncryptionKey

  TestFileCopierFunction:
    Type: AWS::Serverless::Function
    Metadata:
      cfn_nag:
        rules_to_suppress:
          - id: W89
            reason: "Function does not require VPC access as it only interacts with AWS services via APIs"
          - id: W92
            reason: "Function does not require reserved concurrency as it scales based on demand"
          - id: W12
            reason: "Lambda requires CloudWatch logs permissions"
    # checkov:skip=CKV_AWS_116: "DLQ configured for SQS triggered function"
    # checkov:skip=CKV_AWS_117: "Function does not require VPC access as it only interacts with AWS services via APIs"
    # checkov:skip=CKV_AWS_115: "Function does not require reserved concurrency as it scales based on demand"
    Properties:
      PermissionsBoundary: !If [HasPermissionsBoundary, !Ref PermissionsBoundaryArn, !Ref AWS::NoValue]
      Handler: index.handler
      Runtime: python3.12
      CodeUri: ./src/lambda/test_file_copier
      Description: Lambda function to copy test files from SQS queue
      MemorySize: 1024
      Timeout: 900
      DeadLetterQueue:
        Type: SQS
        TargetArn: !GetAtt TestFileCopierFunctionDLQ.Arn
      LoggingConfig:
        LogGroup: !Ref TestFileCopierFunctionLogGroup
      Environment:
        Variables:
          LOG_LEVEL: !Ref LogLevel
          INPUT_BUCKET: !Ref InputBucket
          TEST_SET_BUCKET: !Ref TestSetBucket
          BASELINE_BUCKET: !If
            - ShouldCreateEvaluationBaselineBucket
            - !Ref EvaluationBaselineBucket
            - !Ref EvaluationBaselineBucketName
          TRACKING_TABLE: !Ref TrackingTable
      Policies:
        - DynamoDBCrudPolicy:
            TableName: !Ref TrackingTable
        - S3ReadPolicy:
            BucketName: !Ref TestSetBucket
        - S3CrudPolicy:
            BucketName: !Ref InputBucket
        - S3CrudPolicy:
            BucketName: !If
              - ShouldCreateEvaluationBaselineBucket
              - !Ref EvaluationBaselineBucket
              - !Ref EvaluationBaselineBucketName
        - Statement:
            - Effect: Allow
              Action:
                - kms:Encrypt
                - kms:Decrypt
                - kms:ReEncrypt*
                - kms:GenerateDataKey*
                - kms:DescribeKey
              Resource: !GetAtt CustomerManagedEncryptionKey.Arn
      Events:
        SQSEvent:
          Type: SQS
          Properties:
            Queue: !GetAtt TestFileCopyQueue.Arn
            BatchSize: 1

  TestFileCopierFunctionLogGroup:
    Type: AWS::Logs::LogGroup
    Properties:
      KmsKeyId: !GetAtt CustomerManagedEncryptionKey.Arn
      RetentionInDays: !Ref LogRetentionDays

  TestResultCacheUpdateQueue:
    Type: AWS::SQS::Queue
    Properties:
      QueueName: !Sub "${AWS::StackName}-test-result-cache-update"
      VisibilityTimeout: 900
      MessageRetentionPeriod: 1209600
      KmsMasterKeyId: !Ref CustomerManagedEncryptionKey

  TestResultsResolverFunction:
    Type: AWS::Serverless::Function
    Metadata:
      cfn_nag:
        rules_to_suppress:
          - id: W89
            reason: "Function does not require VPC access as it only interacts with AWS services via APIs"
          - id: W92
            reason: "Function does not require reserved concurrency as it scales based on demand"
          - id: W12
            reason: "Lambda requires CloudWatch logs permissions"
    Properties:
      PermissionsBoundary: !If [HasPermissionsBoundary, !Ref PermissionsBoundaryArn, !Ref AWS::NoValue]
      Handler: index.handler
      Runtime: python3.12
      CodeUri: ./src/lambda/test_results_resolver
      Description: GraphQL resolver for test results queries
      MemorySize: 512
      Timeout: 300
      Environment:
        Variables:
          LOG_LEVEL: !Ref LogLevel
          TRACKING_TABLE: !Ref TrackingTable
          BASELINE_BUCKET: !Ref EvaluationBaselineBucket
          OUTPUT_BUCKET: !Ref OutputBucket
          REPORTING_BUCKET: !If [ShouldCreateReportingBucket, !Ref ReportingBucket, !Ref ReportingBucketName]
          TEST_RESULT_CACHE_UPDATE_QUEUE_URL: !Ref TestResultCacheUpdateQueue
      Events:
        SQSEvent:
          Type: SQS
          Properties:
            Queue: !GetAtt TestResultCacheUpdateQueue.Arn
            BatchSize: 1
      LoggingConfig:
        LogGroup: !Ref TestResultsResolverFunctionLogGroup
      Policies:
        - DynamoDBCrudPolicy:
            TableName: !Ref TrackingTable
        - S3ReadPolicy:
            BucketName: !Ref EvaluationBaselineBucket
        - S3ReadPolicy:
            BucketName: !Ref OutputBucket
        - S3ReadPolicy:
            BucketName: !If [ShouldCreateReportingBucket, !Ref ReportingBucket, !Ref ReportingBucketName]
        - Statement:
            - Effect: Allow
              Action:
                - sqs:SendMessage
              Resource: !GetAtt TestResultCacheUpdateQueue.Arn
        - Statement:
            - Effect: Allow
              Action:
                - kms:Encrypt
                - kms:Decrypt
                - kms:ReEncrypt*
                - kms:GenerateDataKey*
                - kms:DescribeKey
              Resource: !GetAtt CustomerManagedEncryptionKey.Arn

  TestResultsResolverFunctionLogGroup:
    Type: AWS::Logs::LogGroup
    Properties:
      KmsKeyId: !GetAtt CustomerManagedEncryptionKey.Arn
      RetentionInDays: !Ref LogRetentionDays

  TestSetResolverFunction:
    Type: AWS::Serverless::Function
    Metadata:
      cfn_nag:
        rules_to_suppress:
          - id: W89
            reason: "Function does not require VPC access as it only interacts with AWS services via APIs"
          - id: W92
            reason: "Function does not require reserved concurrency as it scales based on demand"
          - id: W12
            reason: "Lambda requires CloudWatch logs permissions"
    Properties:
      PermissionsBoundary: !If [HasPermissionsBoundary, !Ref PermissionsBoundaryArn, !Ref AWS::NoValue]
      Handler: index.handler
      Runtime: python3.12
      CodeUri: ./src/lambda/test_set_resolver
      Description: GraphQL resolver for test set mutations
      MemorySize: 256
      Timeout: 60
      Environment:
        Variables:
          LOG_LEVEL: !Ref LogLevel
          TRACKING_TABLE: !Ref TrackingTable
          INPUT_BUCKET: !Ref InputBucket
          TEST_SET_BUCKET: !Ref TestSetBucket
          TEST_SET_COPY_QUEUE_URL: !Ref TestSetFileCopyQueue
          BASELINE_BUCKET: !If
            - ShouldCreateEvaluationBaselineBucket
            - !Ref EvaluationBaselineBucket
            - !Ref EvaluationBaselineBucketName
      LoggingConfig:
        LogGroup: !Ref TestSetResolverFunctionLogGroup
      Policies:
        - DynamoDBCrudPolicy:
            TableName: !Ref TrackingTable
        - S3ReadPolicy:
            BucketName: !Ref InputBucket
        - S3ReadPolicy:
            BucketName: !If
              - ShouldCreateEvaluationBaselineBucket
              - !Ref EvaluationBaselineBucket
              - !Ref EvaluationBaselineBucketName
        - SQSSendMessagePolicy:
            QueueName: !GetAtt TestSetFileCopyQueue.QueueName
        - Statement:
            - Effect: Allow
              Action:
                - kms:Encrypt
                - kms:Decrypt
                - kms:ReEncrypt*
                - kms:GenerateDataKey*
                - kms:DescribeKey
              Resource: !GetAtt CustomerManagedEncryptionKey.Arn

  TestSetResolverFunctionLogGroup:
    Type: AWS::Logs::LogGroup
    Properties:
      KmsKeyId: !GetAtt CustomerManagedEncryptionKey.Arn
      RetentionInDays: !Ref LogRetentionDays

  TestResultsDataSource:
    Type: AWS::AppSync::DataSource
    Properties:
      ApiId: !GetAtt GraphQLApi.ApiId
      Name: TestResultsDataSource
      Description: Lambda function for test results queries
      Type: AWS_LAMBDA
      ServiceRoleArn: !GetAtt AppSyncServiceRole.Arn
      LambdaConfig:
        LambdaFunctionArn: !GetAtt TestResultsResolverFunction.Arn

  TestSetDataSource:
    Type: AWS::AppSync::DataSource
    Properties:
      ApiId: !GetAtt GraphQLApi.ApiId
      Name: TestSetDataSource
      Description: Lambda function for test set mutations
      Type: AWS_LAMBDA
      ServiceRoleArn: !GetAtt AppSyncServiceRole.Arn
      LambdaConfig:
        LambdaFunctionArn: !GetAtt TestSetResolverFunction.Arn

  GetTestRunsResolver:
    Type: AWS::AppSync::Resolver
    DependsOn: GraphQLSchema
    Properties:
      ApiId: !GetAtt GraphQLApi.ApiId
      DataSourceName: !GetAtt TestResultsDataSource.Name
      TypeName: Query
      FieldName: getTestRuns

  CompareTestRunsResolver:
    Type: AWS::AppSync::Resolver
    DependsOn: GraphQLSchema
    Properties:
      ApiId: !GetAtt GraphQLApi.ApiId
      DataSourceName: !GetAtt TestResultsDataSource.Name
      TypeName: Query
      FieldName: compareTestRuns

  GetTestRunResolver:
    Type: AWS::AppSync::Resolver
    DependsOn: GraphQLSchema
    Properties:
      ApiId: !GetAtt GraphQLApi.ApiId
      DataSourceName: !GetAtt TestResultsDataSource.Name
      TypeName: Query
      FieldName: getTestRun

  GetTestRunStatusResolver:
    Type: AWS::AppSync::Resolver
    DependsOn: GraphQLSchema
    Properties:
      ApiId: !GetAtt GraphQLApi.ApiId
      DataSourceName: !GetAtt TestResultsDataSource.Name
      TypeName: Query
      FieldName: getTestRunStatus

  TestRunnerDataSource:
    Type: AWS::AppSync::DataSource
    Properties:
      ApiId: !GetAtt GraphQLApi.ApiId
      Name: TestRunnerDataSource
      Description: Lambda function for running test sets
      Type: AWS_LAMBDA
      ServiceRoleArn: !GetAtt AppSyncServiceRole.Arn
      LambdaConfig:
        LambdaFunctionArn: !GetAtt TestRunnerFunction.Arn

  TestRunnerResolver:
    Type: AWS::AppSync::Resolver
    DependsOn: GraphQLSchema
    Properties:
      ApiId: !GetAtt GraphQLApi.ApiId
      DataSourceName: !GetAtt TestRunnerDataSource.Name
      TypeName: Mutation
      FieldName: startTestRun

  ReprocessDocumentResolverFunction:
    Type: AWS::Serverless::Function
    Metadata:
      cfn_nag:
        rules_to_suppress:
          - id: W89
            reason: "Function does not require VPC access as it only interacts with AWS services via APIs"
          - id: W92
            reason: "Function does not require reserved concurrency as it scales based on demand"
          - id: W12
            reason: "Lambda requires CloudWatch logs permissions"
    # checkov:skip=CKV_AWS_116: "DLQ not required for AppSync resolver function"
    # checkov:skip=CKV_AWS_117: "Function does not require VPC access as it only interacts with AWS services via APIs"
    # checkov:skip=CKV_AWS_115: "Function does not require reserved concurrency as it scales based on demand"
    # checkov:skip=CKV_AWS_173: "Environment variables do not contain sensitive data - only configuration values like feature flags and non-sensitive settings"
    Properties:
      PermissionsBoundary:
        !If [
          HasPermissionsBoundary,
          !Ref PermissionsBoundaryArn,
          !Ref AWS::NoValue,
        ]
      Handler: index.handler
      Runtime: python3.12
      CodeUri: ./src/lambda/reprocess_document_resolver
      Description: Lambda function to reprocess documents via GraphQL API
      MemorySize: 512
      Timeout: 60
      Environment:
        Variables:
          LOG_LEVEL: !Ref LogLevel
          INPUT_BUCKET: !Ref InputBucket
          OUTPUT_BUCKET: !Ref OutputBucket
          QUEUE_URL: !Ref DocumentQueue
          APPSYNC_API_URL: !GetAtt GraphQLApi.GraphQLUrl
          DATA_RETENTION_IN_DAYS: !Ref DataRetentionInDays
      LoggingConfig:
        LogGroup: !Ref ReprocessDocumentResolverFunctionLogGroup
      Policies:
        - DynamoDBCrudPolicy:
            TableName: !Ref TrackingTable
        - SQSSendMessagePolicy:
            QueueName: !GetAtt DocumentQueue.QueueName
        - S3ReadPolicy:
            BucketName: !Ref InputBucket
        - Statement:
            - Effect: Allow
              Action:
                - appsync:GraphQL
              Resource:
                - !Sub "${GraphQLApi.Arn}/types/Mutation/*"
            - Effect: Allow
              Action:
                - kms:Encrypt
                - kms:Decrypt
                - kms:ReEncrypt*
                - kms:GenerateDataKey*
                - kms:DescribeKey
              Resource: !GetAtt CustomerManagedEncryptionKey.Arn

  ReprocessDocumentResolverFunctionLogGroup:
    Type: AWS::Logs::LogGroup
    Properties:
      KmsKeyId: !GetAtt CustomerManagedEncryptionKey.Arn
      RetentionInDays: !Ref LogRetentionDays

  ReprocessDocumentDataSource:
    Type: AWS::AppSync::DataSource
    Properties:
      ApiId: !GetAtt GraphQLApi.ApiId
      Name: ReprocessDocumentDataSource
      Description: Lambda function for reprocessing documents
      Type: AWS_LAMBDA
      ServiceRoleArn: !GetAtt AppSyncServiceRole.Arn
      LambdaConfig:
        LambdaFunctionArn: !GetAtt ReprocessDocumentResolverFunction.Arn

  ReprocessDocumentResolver:
    Type: AWS::AppSync::Resolver
    DependsOn: GraphQLSchema
    Properties:
      ApiId: !GetAtt GraphQLApi.ApiId
      DataSourceName: !GetAtt ReprocessDocumentDataSource.Name
      TypeName: Mutation
      FieldName: reprocessDocument

  UploadResolverFunction:
    Type: AWS::Serverless::Function
    Metadata:
      cfn_nag:
        rules_to_suppress:
          - id: W12
            reason: "Lambda requires CloudWatch logs permissions"
          - id: W89
            reason: "Function does not require VPC access as it only interacts with AWS services via APIs"
          - id: W92
            reason: "Function does not require reserved concurrency as it scales based on demand"
    # checkov:skip=CKV_AWS_115: "Function does not require reserved concurrency as it scales based on demand"
    # checkov:skip=CKV_AWS_116: "DLQ not required for AppSync resolver function"
    # checkov:skip=CKV_AWS_117: "Function does not require VPC access as it only interacts with AWS services via APIs"
    # checkov:skip=CKV_AWS_173: "Environment variables do not contain sensitive data - only configuration values like feature flags and non-sensitive settings"
    Properties:
      PermissionsBoundary:
        !If [
          HasPermissionsBoundary,
          !Ref PermissionsBoundaryArn,
          !Ref AWS::NoValue,
        ]
      Handler: index.handler
      Runtime: python3.12
      CodeUri: ./src/lambda/upload_resolver
      Description: Lambda function to return signed upload URL via GraphQL API
      MemorySize: 512
      Timeout: 60
      Environment:
        Variables:
          LOG_LEVEL: !Ref LogLevel
          INPUT_BUCKET: !Ref InputBucket
      LoggingConfig:
        LogGroup: !Ref UploadResolverFunctionLogGroup
      Policies:
        - S3WritePolicy:
            BucketName: !Ref InputBucket
        - S3WritePolicy:
            BucketName: !Ref ConfigurationBucket
        - S3WritePolicy:
            BucketName: !Ref OutputBucket
        - S3WritePolicy:
            BucketName: !If
              - ShouldCreateEvaluationBaselineBucket
              - !Ref EvaluationBaselineBucket
              - !Ref EvaluationBaselineBucketName
        - Statement:
            - Effect: Allow
              Action:
                - kms:Encrypt
                - kms:Decrypt
                - kms:ReEncrypt*
                - kms:GenerateDataKey*
                - kms:DescribeKey
              Resource: !GetAtt CustomerManagedEncryptionKey.Arn

  UploadResolverFunctionLogGroup:
    Type: AWS::Logs::LogGroup
    Properties:
      KmsKeyId: !GetAtt CustomerManagedEncryptionKey.Arn
      RetentionInDays: !Ref LogRetentionDays

  # AppSync resolver data source
  UploadResolverDataSource:
    Type: AWS::AppSync::DataSource
    Properties:
      ApiId: !GetAtt GraphQLApi.ApiId
      Name: UploadResolverDataSource
      Description: Lambda function for generating presigned URLs
      Type: AWS_LAMBDA
      ServiceRoleArn: !GetAtt AppSyncServiceRole.Arn
      LambdaConfig:
        LambdaFunctionArn: !GetAtt UploadResolverFunction.Arn

  # AppSync resolver
  UploadDocumentResolver:
    Type: AWS::AppSync::Resolver
    DependsOn: GraphQLSchema
    Properties:
      ApiId: !GetAtt GraphQLApi.ApiId
      DataSourceName: !GetAtt UploadResolverDataSource.Name
      TypeName: Mutation
      FieldName: uploadDocument

  ##########################################################################
  # Discovery Upload Resolver
  ##########################################################################

  DiscoveryUploadResolverFunction:
    Type: AWS::Serverless::Function
    Metadata:
      cfn_nag:
        rules_to_suppress:
          - id: W12
            reason: "Lambda requires CloudWatch logs permissions"
          - id: W89
            reason: "Function does not require VPC access as it only interacts with AWS services via APIs"
          - id: W92
            reason: "Function does not require reserved concurrency as it scales based on demand"
    # checkov:skip=CKV_AWS_115: "Function does not require reserved concurrency as it scales based on demand"
    # checkov:skip=CKV_AWS_116: "DLQ not required for AppSync resolver function"
    # checkov:skip=CKV_AWS_117: "Function does not require VPC access as it only interacts with AWS services via APIs"
    # checkov:skip=CKV_AWS_173: "Environment variables do not contain sensitive data - only configuration values like feature flags and non-sensitive settings"
    Properties:
      PermissionsBoundary:
        !If [
          HasPermissionsBoundary,
          !Ref PermissionsBoundaryArn,
          !Ref AWS::NoValue,
        ]
      Handler: index.handler
      Runtime: python3.12
      CodeUri: ./src/lambda/discovery_upload_resolver
      Description: Lambda function to handle discovery document uploads via GraphQL API
      MemorySize: 512
      Timeout: 120
      Environment:
        Variables:
          LOG_LEVEL: !Ref LogLevel
          DISCOVERY_BUCKET: !Ref DiscoveryBucket
          DISCOVERY_TRACKING_TABLE: !Ref DiscoveryTrackingTable
          DISCOVERY_QUEUE_URL: !Ref DiscoveryQueue
      LoggingConfig:
        LogGroup: !Ref DiscoveryUploadResolverFunctionLogGroup
      Policies:
        - S3WritePolicy:
            BucketName: !Ref DiscoveryBucket
        - DynamoDBCrudPolicy:
            TableName: !Ref DiscoveryTrackingTable
        - SQSSendMessagePolicy:
            QueueName: !GetAtt DiscoveryQueue.QueueName
        - Statement:
            - Effect: Allow
              Action:
                - kms:Encrypt
                - kms:Decrypt
                - kms:ReEncrypt*
                - kms:GenerateDataKey*
                - kms:DescribeKey
              Resource: !GetAtt CustomerManagedEncryptionKey.Arn

  DiscoveryUploadResolverFunctionLogGroup:
    Type: AWS::Logs::LogGroup
    Properties:
      KmsKeyId: !GetAtt CustomerManagedEncryptionKey.Arn
      RetentionInDays: !Ref LogRetentionDays

  DiscoveryUploadResolverDataSource:
    Type: AWS::AppSync::DataSource
    Properties:
      ApiId: !GetAtt GraphQLApi.ApiId
      Name: DiscoveryUploadResolverDataSource
      Description: Lambda function for discovery document uploads
      Type: AWS_LAMBDA
      ServiceRoleArn: !GetAtt AppSyncServiceRole.Arn
      LambdaConfig:
        LambdaFunctionArn: !GetAtt DiscoveryUploadResolverFunction.Arn

  DiscoveryUploadDocumentResolver:
    Type: AWS::AppSync::Resolver
    DependsOn: GraphQLSchema
    Properties:
      ApiId: !GetAtt GraphQLApi.ApiId
      DataSourceName: !GetAtt DiscoveryUploadResolverDataSource.Name
      TypeName: Mutation
      FieldName: uploadDiscoveryDocument

  ##########################################################################
  # Discovery Jobs List Resolver
  ##########################################################################
  DiscoveryJobsResolver:
    Type: AWS::AppSync::Resolver
    DependsOn: GraphQLSchema
    Properties:
      ApiId: !GetAtt GraphQLApi.ApiId
      TypeName: Query
      FieldName: listDiscoveryJobs
      DataSourceName: !GetAtt DiscoveryTableDataSource.Name
      RequestMappingTemplate: |
        {
            "version": "2018-05-29",
            "operation": "Scan",
            "limit": 50,
            "consistentRead": false,
            "select": "ALL_ATTRIBUTES"
        }
      ResponseMappingTemplate: |
        {
            "DiscoveryJobs": $util.toJson($ctx.result.items),
            "nextToken": $util.toJson($ctx.result.nextToken)
        }

  ##########################################################################
  # Update Discovery Job Status Resolver
  ##########################################################################
  UpdateDiscoveryJobStatusResolver:
    Type: AWS::AppSync::Resolver
    DependsOn: GraphQLSchema
    Properties:
      ApiId: !GetAtt GraphQLApi.ApiId
      TypeName: Mutation
      FieldName: updateDiscoveryJobStatus
      DataSourceName: !GetAtt DiscoveryTableDataSource.Name
      RequestMappingTemplate: |-
        ## Validate status is one of the allowed values
        #set($validStatuses = ["PENDING", "IN_PROGRESS", "COMPLETED", "FAILED"])
        #if(!$validStatuses.contains($ctx.args.status))
          $util.error("Invalid status value. Status must be one of: PENDING, IN_PROGRESS, COMPLETED, FAILED", "ValidationException")
        #end

        #set($expNames = {})
        #set($expValues = {})

        ## Set status (required)
        $util.qr($expNames.put("#status", "status"))
        $util.qr($expValues.put(":status", $util.dynamodb.toDynamoDB($ctx.args.status)))
        #set($updateExpression = "SET #status = :status")

        ## Set errorMessage (optional)
        #if($ctx.args.errorMessage)
          $util.qr($expNames.put("#errorMessage", "errorMessage"))
          $util.qr($expValues.put(":errorMessage", $util.dynamodb.toDynamoDB($ctx.args.errorMessage)))
          #set($updateExpression = "${updateExpression}, #errorMessage = :errorMessage")
        #end

        ## Set updatedAt to current timestamp
        $util.qr($expNames.put("#updatedAt", "updatedAt"))
        $util.qr($expValues.put(":updatedAt", $util.dynamodb.toDynamoDB($util.time.nowISO8601())))
        #set($updateExpression = "${updateExpression}, #updatedAt = :updatedAt")

        ## Set completedAt when status is COMPLETED or FAILED
        #if($ctx.args.status == "COMPLETED" || $ctx.args.status == "FAILED")
          $util.qr($expNames.put("#completedAt", "completedAt"))
          $util.qr($expValues.put(":completedAt", $util.dynamodb.toDynamoDB($util.time.nowISO8601())))
          #set($updateExpression = "${updateExpression}, #completedAt = :completedAt")
        #end

        {
          "version": "2018-05-29",
          "operation": "UpdateItem",
          "key": {
            "jobId": $util.dynamodb.toDynamoDBJson($ctx.args.jobId)
          },
          "update": {
            "expression": "$updateExpression",
            "expressionNames": $utils.toJson($expNames),
            "expressionValues": $utils.toJson($expValues)
          }
        }
      ResponseMappingTemplate: |-
        $util.toJson($ctx.result)

  ##########################################################################
  # Discovery Processor Function
  ##########################################################################

  DiscoveryProcessorFunction:
    Type: AWS::Serverless::Function
    Metadata:
      cfn_nag:
        rules_to_suppress:
          - id: W89
            reason: "Function does not require VPC access as it only interacts with AWS services via APIs"
          - id: W92
            reason: "Function does not require reserved concurrency as it scales based on demand"
          - id: W12
            reason: "Lambda requires CloudWatch logs permissions"
          - id: W11
            reason: "Role requires * resource access for CloudWatch Metrics and Logs"
    # checkov:skip=CKV_AWS_116: "DLQ not required for SQS triggered function"
    # checkov:skip=CKV_AWS_117: "Function does not require VPC access as it only interacts with AWS services via APIs"
    # checkov:skip=CKV_AWS_115: "Function does not require reserved concurrency as it scales based on demand"
    # checkov:skip=CKV_AWS_173: "Environment variables do not contain sensitive data - only configuration values like feature flags and non-sensitive settings"
    Properties:
      PermissionsBoundary:
        !If [
          HasPermissionsBoundary,
          !Ref PermissionsBoundaryArn,
          !Ref AWS::NoValue,
        ]
      Handler: index.handler
      Runtime: python3.12
      CodeUri: ./src/lambda/discovery_processor
      Description: Lambda function to process discovery jobs from SQS queue
      MemorySize: 1024
      Timeout: 900
      Environment:
        Variables:
          LOG_LEVEL: !Ref LogLevel
          DISCOVERY_BUCKET: !Ref DiscoveryBucket
          DISCOVERY_TRACKING_TABLE: !Ref DiscoveryTrackingTable
          CONFIGURATION_TABLE_NAME: !Ref ConfigurationTable
          APPSYNC_API_URL: !GetAtt GraphQLApi.GraphQLUrl
      LoggingConfig:
        LogGroup: !Ref DiscoveryProcessorFunctionLogGroup
      Events:
        SQSEvent:
          Type: SQS
          Properties:
            Queue: !GetAtt DiscoveryQueue.Arn
            BatchSize: 1
            FunctionResponseTypes:
              - ReportBatchItemFailures
      Policies:
        - S3ReadPolicy:
            BucketName: !Ref DiscoveryBucket
        - DynamoDBCrudPolicy:
            TableName: !Ref DiscoveryTrackingTable
        - DynamoDBCrudPolicy:
            TableName: !Ref ConfigurationTable
        - Statement:
            - Effect: Allow
              Action:
                - cloudwatch:PutMetricData
              Resource: "*"
            - Effect: Allow
              Action:
                - appsync:GraphQL
              Resource:
                - !Sub "${GraphQLApi.Arn}/types/Mutation/*"
            - Effect: Allow
              Action:
                - kms:Encrypt
                - kms:Decrypt
                - kms:ReEncrypt*
                - kms:GenerateDataKey*
                - kms:DescribeKey
              Resource: !GetAtt CustomerManagedEncryptionKey.Arn
            - Effect: Allow
              Action:
                - bedrock:InvokeModel
              Resource:
                - !Sub "arn:${AWS::Partition}:bedrock:*::foundation-model/*"
                - !Sub "arn:${AWS::Partition}:bedrock:${AWS::Region}:${AWS::AccountId}:inference-profile/*"
            - Effect: Allow
              Action:
                - aws-marketplace:Subscribe
                - aws-marketplace:Unsubscribe
                - aws-marketplace:ViewSubscriptions
              Resource: "*"

  DiscoveryProcessorFunctionLogGroup:
    Type: AWS::Logs::LogGroup
    Properties:
      KmsKeyId: !GetAtt CustomerManagedEncryptionKey.Arn
      RetentionInDays: !Ref LogRetentionDays

  ##########################################################################
  # Knowledge Base Query Resolver
  ##########################################################################

  QueryKnowledgeBaseResolverFunction:
    Type: AWS::Serverless::Function
    Metadata:
      cfn_nag:
        rules_to_suppress:
          - id: W89
            reason: "Function does not require VPC access as it only interacts with AWS services via APIs"
          - id: W92
            reason: "Function does not require reserved concurrency as it scales based on demand"
          - id: W12
            reason: "Lambda requires CloudWatch logs permissions"
          - id: W11
            reason: "Role requires * resource access for Marketplace and CloudWatch Metrics and Logs"
    # checkov:skip=CKV_AWS_116: "DLQ not required for AppSync resolver function"
    # checkov:skip=CKV_AWS_117: "Function does not require VPC access as it only interacts with AWS services via APIs"
    # checkov:skip=CKV_AWS_115: "Function does not require reserved concurrency as it scales based on demand"
    # checkov:skip=CKV_AWS_173: "Environment variables do not contain sensitive data - only configuration values like feature flags and non-sensitive settings"
    Properties:
      PermissionsBoundary:
        !If [
          HasPermissionsBoundary,
          !Ref PermissionsBoundaryArn,
          !Ref AWS::NoValue,
        ]
      Handler: index.handler
      Runtime: python3.12
      CodeUri: ./src/lambda/query_knowledgebase_resolver
      Description: Lambda function to query Bedrock Knowledge Base via GraphQL API
      MemorySize: 512
      Timeout: 60
      Environment:
        Variables:
          LOG_LEVEL: !Ref LogLevel
          KB_ID: !If
            - ShouldUseDocumentKnowledgeBase
            - !GetAtt DOCUMENTKB.Outputs.KnowledgeBaseID
            - ""
          KB_ACCOUNT_ID: !Ref AWS::AccountId
          KB_REGION: !Ref AWS::Region
          MODEL_ID: !Ref KnowledgeBaseModelId
          GUARDRAIL_ID_AND_VERSION:
            !If [
              HasGuardrailConfig,
              !Sub "${BedrockGuardrailId}:${BedrockGuardrailVersion}",
              "",
            ]
      LoggingConfig:
        LogGroup: !Ref QueryKnowledgeBaseResolverFunctionLogGroup
      Policies:
        - Statement:
            - !If
              - ShouldUseDocumentKnowledgeBase
              - Effect: Allow
                Action:
                  - bedrock:Retrieve
                  - bedrock:RetrieveAndGenerate
                Resource: !Sub "arn:${AWS::Partition}:bedrock:${AWS::Region}:${AWS::AccountId}:knowledge-base/${DOCUMENTKB.Outputs.KnowledgeBaseID}"
              - !Ref AWS::NoValue
            - Effect: Allow
              Action:
                - "bedrock:InvokeModel"
              Resource:
                - !Sub "arn:${AWS::Partition}:bedrock:*::foundation-model/*"
                - !Sub "arn:${AWS::Partition}:bedrock:${AWS::Region}:${AWS::AccountId}:inference-profile/*"
            - Effect: Allow
              Action:
                - "bedrock:GetInferenceProfile"
              Resource:
                - !Sub "arn:${AWS::Partition}:bedrock:${AWS::Region}:${AWS::AccountId}:inference-profile/*"
            - Effect: Allow
              Action:
                - aws-marketplace:Subscribe
                - aws-marketplace:Unsubscribe
                - aws-marketplace:ViewSubscriptions
              Resource: "*"
            - !If
              - HasGuardrailConfig
              - Effect: Allow
                Action:
                  - "bedrock:ApplyGuardrail"
                Resource:
                  - !Sub "arn:${AWS::Partition}:bedrock:${AWS::Region}:${AWS::AccountId}:guardrail/${BedrockGuardrailId}"
              - !Ref AWS::NoValue
            - Effect: Allow
              Action:
                - kms:Encrypt
                - kms:Decrypt
                - kms:ReEncrypt*
                - kms:GenerateDataKey*
                - kms:DescribeKey
              Resource: !GetAtt CustomerManagedEncryptionKey.Arn

  QueryKnowledgeBaseResolverFunctionLogGroup:
    Type: AWS::Logs::LogGroup
    Properties:
      KmsKeyId: !GetAtt CustomerManagedEncryptionKey.Arn
      RetentionInDays: !Ref LogRetentionDays

  QueryKnowledgeBaseDataSource:
    Type: AWS::AppSync::DataSource
    Properties:
      ApiId: !GetAtt GraphQLApi.ApiId
      Name: QueryKnowledgeBase
      Description: Lambda function to query Bedrock Knowledge Base
      Type: AWS_LAMBDA
      ServiceRoleArn: !GetAtt AppSyncServiceRole.Arn
      LambdaConfig:
        LambdaFunctionArn: !GetAtt QueryKnowledgeBaseResolverFunction.Arn

  QueryKnowledgeBaseResolver:
    Type: AWS::AppSync::Resolver
    DependsOn: GraphQLSchema
    Properties:
      ApiId: !GetAtt GraphQLApi.ApiId
      DataSourceName: !GetAtt QueryKnowledgeBaseDataSource.Name
      TypeName: Query
      FieldName: queryKnowledgeBase

  ##########################################################################
  # Chat With Document Resolver
  ##########################################################################

  ChatWithDocumentResolverFunction:
    Type: AWS::Serverless::Function
    Metadata:
      cfn_nag:
        rules_to_suppress:
          - id: W89
            reason: "Function does not require VPC access as it only interacts with AWS services via APIs"
          - id: W92
            reason: "Function does not require reserved concurrency as it scales based on demand"
          - id: W12
            reason: "Lambda requires CloudWatch logs permissions"
          - id: W11
            reason: "Role requires * resource access for CloudWatch Metrics and Logs"
    # checkov:skip=CKV_AWS_116: "DLQ not required for AppSync resolver function"
    # checkov:skip=CKV_AWS_117: "Function does not require VPC access as it only interacts with AWS services via APIs"
    # checkov:skip=CKV_AWS_115: "Function does not require reserved concurrency as it scales based on demand"
    # checkov:skip=CKV_AWS_173: "Environment variables do not contain sensitive data - only configuration values like feature flags and non-sensitive settings"
    Properties:
      PermissionsBoundary:
        !If [
          HasPermissionsBoundary,
          !Ref PermissionsBoundaryArn,
          !Ref AWS::NoValue,
        ]
      Handler: index.handler
      Runtime: python3.12
      CodeUri: ./src/lambda/chat_with_document_resolver
      Description: Lambda function to chat with the document via GraphQL API
      MemorySize: 512
      Timeout: 120
      Environment:
        Variables:
          LOG_LEVEL: !Ref LogLevel
          OUTPUT_BUCKET: !Ref OutputBucket
          CONFIGURATION_TABLE_NAME: !Ref ConfigurationTable
          TRACKING_TABLE_NAME: !Ref TrackingTable
          GUARDRAIL_ID_AND_VERSION:
            !If [
              HasGuardrailConfig,
              !Sub "${BedrockGuardrailId}:${BedrockGuardrailVersion}",
              "",
            ]
      LoggingConfig:
        LogGroup: !Ref ChatWithDocumentResolverFunctionLogGroup
      Policies:
        - S3CrudPolicy:
            BucketName: !Ref OutputBucket
        - DynamoDBCrudPolicy:
            TableName: !Ref ConfigurationTable
        - DynamoDBCrudPolicy:
            TableName: !Ref TrackingTable
        - Statement:
            - !If
              - ShouldUseDocumentKnowledgeBase
              - Effect: Allow
                Action:
                  - bedrock:Retrieve
                  - bedrock:RetrieveAndGenerate
                Resource: !Sub "arn:${AWS::Partition}:bedrock:${AWS::Region}:${AWS::AccountId}:knowledge-base/${DOCUMENTKB.Outputs.KnowledgeBaseID}"
              - !Ref AWS::NoValue
            - Effect: Allow
              Action:
                - "bedrock:InvokeModel"
              Resource:
                - !Sub "arn:${AWS::Partition}:bedrock:*::foundation-model/*"
                - !Sub "arn:${AWS::Partition}:bedrock:${AWS::Region}:${AWS::AccountId}:inference-profile/*"
            - Effect: Allow
              Action:
                - aws-marketplace:Subscribe
                - aws-marketplace:Unsubscribe
                - aws-marketplace:ViewSubscriptions
              Resource: "*"
            - Effect: Allow
              Action:
                - cloudwatch:PutMetricData
              Resource: "*"
            - Effect: Allow
              Action:
                - "bedrock:GetInferenceProfile"
              Resource:
                - !Sub "arn:${AWS::Partition}:bedrock:${AWS::Region}:${AWS::AccountId}:inference-profile/*"
            - !If
              - HasGuardrailConfig
              - Effect: Allow
                Action:
                  - "bedrock:ApplyGuardrail"
                Resource:
                  - !Sub "arn:${AWS::Partition}:bedrock:${AWS::Region}:${AWS::AccountId}:guardrail/${BedrockGuardrailId}"
              - !Ref AWS::NoValue
            - Effect: Allow
              Action:
                - kms:Encrypt
                - kms:Decrypt
                - kms:ReEncrypt*
                - kms:GenerateDataKey*
                - kms:DescribeKey
              Resource: !GetAtt CustomerManagedEncryptionKey.Arn

  ChatWithDocumentResolverFunctionLogGroup:
    Type: AWS::Logs::LogGroup
    Properties:
      KmsKeyId: !GetAtt CustomerManagedEncryptionKey.Arn
      RetentionInDays: !Ref LogRetentionDays

  ProcessChangesResolverFunction:
    Type: AWS::Serverless::Function
    Metadata:
      cfn_nag:
        rules_to_suppress:
          - id: W89
            reason: "Function does not require VPC access as it only interacts with AWS services via APIs"
          - id: W92
            reason: "Function does not require reserved concurrency as it scales based on demand"
          - id: W12
            reason: "Lambda requires CloudWatch logs permissions"
    # checkov:skip=CKV_AWS_116: "DLQ not required for AppSync resolver function"
    # checkov:skip=CKV_AWS_117: "Function does not require VPC access as it only interacts with AWS services via APIs"
    # checkov:skip=CKV_AWS_115: "Function does not require reserved concurrency as it scales based on demand"
    # checkov:skip=CKV_AWS_173: "Environment variables do not contain sensitive data - only configuration values like feature flags and non-sensitive settings"
    Properties:
      PermissionsBoundary:
        !If [
          HasPermissionsBoundary,
          !Ref PermissionsBoundaryArn,
          !Ref AWS::NoValue,
        ]
      Handler: index.handler
      Runtime: python3.12
      CodeUri: ./src/lambda/process_changes_resolver
      Description: Lambda function to process section changes via GraphQL API
      MemorySize: 512
      Timeout: 60
      Environment:
        Variables:
          LOG_LEVEL: !Ref LogLevel
          TRACKING_TABLE: !Ref TrackingTable
          QUEUE_URL: !Ref DocumentQueue
          DATA_RETENTION_IN_DAYS: !Ref DataRetentionInDays
          WORKING_BUCKET: !Ref WorkingBucket
          INPUT_BUCKET: !Ref InputBucket
          OUTPUT_BUCKET: !Ref OutputBucket
          APPSYNC_API_URL: !GetAtt GraphQLApi.GraphQLUrl
      LoggingConfig:
        LogGroup: !Ref ProcessChangesResolverFunctionLogGroup
      Policies:
        - DynamoDBCrudPolicy:
            TableName: !Ref TrackingTable
        - SQSSendMessagePolicy:
            QueueName: !GetAtt DocumentQueue.QueueName
        - S3CrudPolicy:
            BucketName: !Ref OutputBucket
        - S3CrudPolicy:
            BucketName: !Ref WorkingBucket
        - Statement:
            - Effect: Allow
              Action:
                - appsync:GraphQL
              Resource:
                - !Sub "${GraphQLApi.Arn}/types/Mutation/*"
            - Effect: Allow
              Action:
                - kms:Encrypt
                - kms:Decrypt
                - kms:ReEncrypt*
                - kms:GenerateDataKey*
                - kms:DescribeKey
              Resource: !GetAtt CustomerManagedEncryptionKey.Arn

  ProcessChangesResolverFunctionLogGroup:
    Type: AWS::Logs::LogGroup
    Properties:
      KmsKeyId: !GetAtt CustomerManagedEncryptionKey.Arn
      RetentionInDays: !Ref LogRetentionDays

  ProcessChangesDataSource:
    Type: AWS::AppSync::DataSource
    Properties:
      ApiId: !GetAtt GraphQLApi.ApiId
      Name: ProcessChangesDataSource
      Description: Lambda function for processing section changes
      Type: AWS_LAMBDA
      ServiceRoleArn: !GetAtt AppSyncServiceRole.Arn
      LambdaConfig:
        LambdaFunctionArn: !GetAtt ProcessChangesResolverFunction.Arn

  ProcessChangesResolver:
    Type: AWS::AppSync::Resolver
    DependsOn: GraphQLSchema
    Properties:
      ApiId: !GetAtt GraphQLApi.ApiId
      DataSourceName: !GetAtt ProcessChangesDataSource.Name
      TypeName: Mutation
      FieldName: processChanges

  ChatWithDocumentDataSource:
    Type: AWS::AppSync::DataSource
    Properties:
      ApiId: !GetAtt GraphQLApi.ApiId
      Name: ChatWithDocument
      Description: Lambda function to chat with document
      Type: AWS_LAMBDA
      ServiceRoleArn: !GetAtt AppSyncServiceRole.Arn
      LambdaConfig:
        LambdaFunctionArn: !GetAtt ChatWithDocumentResolverFunction.Arn

  ChatWithDocumentResolver:
    Type: AWS::AppSync::Resolver
    DependsOn: GraphQLSchema
    Properties:
      ApiId: !GetAtt GraphQLApi.ApiId
      DataSourceName: !GetAtt ChatWithDocumentDataSource.Name
      TypeName: Query
      FieldName: chatWithDocument

  ##########################################################################
  # WebUI build and deployment
  ##########################################################################

  CloudFrontOriginAccessIdentity:
    Type: AWS::CloudFront::CloudFrontOriginAccessIdentity
    Properties:
      CloudFrontOriginAccessIdentityConfig:
        Comment: !Sub "${AWS::StackName} CloudFront OAI for ${WebUIBucket}"

  # Define a custom response headers policy for security headers
  SecurityHeadersPolicy:
    Type: AWS::CloudFront::ResponseHeadersPolicy
    Properties:
      ResponseHeadersPolicyConfig:
        Name: !Sub "${AWS::StackName}-security-headers-policy"
        Comment: "Security headers policy"
        SecurityHeadersConfig:
          ContentSecurityPolicy:
            Override: true
            ContentSecurityPolicy: "script-src 'self' 'unsafe-inline' 'unsafe-eval' https:; object-src 'self' blob: data: https:; base-uri 'none'; frame-ancestors 'self'; form-action 'self'; img-src 'self' data: https:; style-src 'self' 'unsafe-inline' https:; connect-src 'self' https: wss://*.amazonaws.com wss://*.appsync-realtime-api.*.amazonaws.com wss://*.execute-api.*.amazonaws.com ws://localhost:*;"
          StrictTransportSecurity:
            Override: true
            AccessControlMaxAgeSec: 31536000
            IncludeSubdomains: true
            Preload: false
          ContentTypeOptions:
            Override: true
          FrameOptions:
            Override: true
            FrameOption: SAMEORIGIN
          ReferrerPolicy:
            Override: true
            ReferrerPolicy: strict-origin-when-cross-origin

  CloudFrontDistribution:
    Type: AWS::CloudFront::Distribution
    Metadata:
      cfn_nag:
        rules_to_suppress:
          - id: W70
            reason: "Minimum TLS version is determined by CloudFrontDefaultCertificate true"
    # checkov:skip=CKV_AWS_68: "WAF is optional and can be enabled by customer based on their security requirements and budget. WAF must be created in us-east-1 for CLOUDFRONT."
    # checkov:skip=CKV_AWS_174: "Minimum TLS version is determined by CloudFrontDefaultCertificate true"
    Properties:
      DistributionConfig:
        Comment: !Sub "Web app cloudfront distribution ${AWS::StackName}"
        ViewerCertificate:
          CloudFrontDefaultCertificate: true
          MinimumProtocolVersion: TLSv1.2_2021
        Logging:
          Bucket: !Sub "${LoggingBucket}.s3.${AWS::URLSuffix}"
          Prefix: "cloudfront-logs"
          IncludeCookies: true
        CustomErrorResponses:
          # Send errors to index file
          - ErrorCachingMinTTL: 300
            ErrorCode: 403
            ResponseCode: 200
            ResponsePagePath: /index.html
          - ErrorCachingMinTTL: 300
            ErrorCode: 404
            ResponseCode: 200
            ResponsePagePath: /index.html
        DefaultCacheBehavior:
          AllowedMethods:
            - GET
            - HEAD
            - OPTIONS
          Compress: true
          ForwardedValues:
            QueryString: false
            Cookies:
              Forward: none
          TargetOriginId: webapp-s3-bucket
          ViewerProtocolPolicy: redirect-to-https
          DefaultTTL: 600
          MinTTL: 300
          MaxTTL: 900
          ResponseHeadersPolicyId: !Ref SecurityHeadersPolicy
        DefaultRootObject: index.html
        Enabled: true
        HttpVersion: http2
        IPV6Enabled: true
        Origins:
          - Id: webapp-s3-bucket
            DomainName: !GetAtt WebUIBucket.RegionalDomainName
            S3OriginConfig:
              OriginAccessIdentity: !Sub "origin-access-identity/cloudfront/${CloudFrontOriginAccessIdentity}"
        PriceClass: !Ref CloudFrontPriceClass
        Restrictions: !If
          - ShouldEnableGeoRestriction
          - GeoRestriction:
              RestrictionType: whitelist
              Locations: !Split [ ",", !Ref CloudFrontAllowedGeos ]
          - GeoRestriction:
              RestrictionType: none

  UICodeBuildServiceRole:
    Type: AWS::IAM::Role
    Properties:
      Path: /
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Action: sts:AssumeRole
            Effect: Allow
            Principal:
              Service: !Sub "codebuild.${AWS::URLSuffix}"
      PermissionsBoundary:
        !If [
          HasPermissionsBoundary,
          !Ref PermissionsBoundaryArn,
          !Ref AWS::NoValue,
        ]
      Policies:
        - PolicyName: ecs-service
          PolicyDocument:
            Version: 2012-10-17
            Statement:
              - Resource:
                  - !Sub "arn:${AWS::Partition}:s3:::<ARTIFACT_BUCKET_TOKEN>"
                  - !Sub "arn:${AWS::Partition}:s3:::<ARTIFACT_BUCKET_TOKEN>/<ARTIFACT_PREFIX_TOKEN>/*"
                Effect: Allow
                Action:
                  - s3:GetObject
                  - s3:GetObjectVersion
                  - s3:GetBucketAcl
                  - s3:GetBucketLocation
                  - s3:PutObject
                  - s3:ListBucket
              - Resource:
                  - !Sub "arn:${AWS::Partition}:logs:${AWS::Region}:${AWS::AccountId}:log-group:/aws/codebuild/*"
                  - !Sub "arn:${AWS::Partition}:logs:${AWS::Region}:${AWS::AccountId}:log-group:/aws/codebuild/*:*"
                Effect: Allow
                Action:
                  - logs:CreateLogGroup
                  - logs:CreateLogStream
                  - logs:PutLogEvents
              - Effect: Allow
                Action:
                  - s3:PutObject
                  - s3:DeleteObject
                Resource:
                  - !Sub "arn:${AWS::Partition}:s3:::${WebUIBucket}/*"
              - Effect: Allow
                Action:
                  - cloudfront:CreateInvalidation
                Resource:
                  - !Sub "arn:${AWS::Partition}:cloudfront::${AWS::AccountId}:distribution/${CloudFrontDistribution}"

  UICodeBuildProject:
    Type: AWS::CodeBuild::Project
    Properties:
      Name: !Sub ${AWS::StackName}-webui-build
      Description: !Sub >-
        Web UI build for GenAIIDP stack - ${AWS::StackName}
      ServiceRole: !Ref UICodeBuildServiceRole
      EncryptionKey: alias/aws/s3
      Artifacts:
        Type: NO_ARTIFACTS
      Source:
        # Publish script substitutes the tokens in the filename here during package build
        Location: !Sub "arn:${AWS::Partition}:s3:::<ARTIFACT_BUCKET_TOKEN>/<ARTIFACT_PREFIX_TOKEN>/<WEBUI_ZIPFILE_TOKEN>"
        Type: S3
        BuildSpec: |
          version: 0.2
          phases:
            pre_build:
              commands:
                - echo ${SOURCE_CODE_LOCATION}
                - echo `ls -altr`
                - echo `pwd`
                - echo Installing NodeJS
                - n 22.14.0
                - npm install -g npm@11.1.0
                - echo Installing Web UI dependencies
                - npm ci
            build:
              commands:
                - echo Build started on `date`
                - cd $CODEBUILD_SRC_DIR
                - echo Building Web UI
                - npm run build
                - >
                  printf '{"RepositoryUri":"%s","ProjectName":"%s","ArtifactBucket":"%s"}'
                  $REPOSITORY_URI $PROJECT_NAME $ARTIFACT_BUCKET > build.json
            post_build:
              commands:
                - echo Build completed on `date`
                - echo Copying Web UI
                - find build -ls
                - aws s3 cp --recursive build s3://${WEBAPP_BUCKET}/
                - echo Invalidating CloudFront Distribution
                - >
                  aws cloudfront create-invalidation
                  --distribution-id "$CLOUDFRONT_DISTRIBUTION_ID" --paths '/*'
          artifacts:
            files:
              - build.json
      Environment:
        ComputeType: BUILD_GENERAL1_MEDIUM
        Image: aws/codebuild/amazonlinux2-x86_64-standard:5.0
        Type: LINUX_CONTAINER
        PrivilegedMode: true
        EnvironmentVariables:
          - Name: AWS_DEFAULT_REGION
            Value: !Ref AWS::Region
          - Name: AWS_ACCOUNT_ID
            Value: !Ref AWS::AccountId
          - Name: SOURCE_CODE_LOCATION
            Value: !Sub "<ARTIFACT_BUCKET_TOKEN>/<ARTIFACT_PREFIX_TOKEN>"
          - Name: WEBAPP_BUCKET
            Value: !Ref WebUIBucket
          - Name: CLOUDFRONT_DISTRIBUTION_ID
            Value: !Ref CloudFrontDistribution
            # These VITE variables are used by the web ui in the
            # aws-exports.js Amplify config. The values are embedded in the
            # code at build time.
          - Name: VITE_SETTINGS_PARAMETER
            Value: !Ref SettingsParameter
          - Name: VITE_USER_POOL_ID
            Value: !Ref UserPool
          - Name: VITE_USER_POOL_CLIENT_ID
            Value: !Ref UserPoolClient
          - Name: VITE_IDENTITY_POOL_ID
            Value: !Ref IdentityPool
          - Name: VITE_APPSYNC_GRAPHQL_URL
            Value: !GetAtt GraphQLApi.GraphQLUrl
          - Name: VITE_AWS_REGION
            Value: !Ref AWS::Region
          - Name: VITE_SHOULD_HIDE_SIGN_UP
            Value: !If
              - ShouldAllowSignUpEmailDomain
              - "false"
              - "true"
          - Name: VITE_CLOUDFRONT_DOMAIN
            Value: !Sub "https://${CloudFrontDistribution.DomainName}/"
      TimeoutInMinutes: 30

  StartUICodeBuildExecutionRole:
    Type: AWS::IAM::Role
    Metadata:
      cfn_nag:
        rules_to_suppress:
          - id: W11
            reason: "Role requires * resource access for CloudWatch Logs and CloudFormation custom resource operations"
    # checkov:skip=CKV_AWS_111: "Write access required for CloudWatch Logs and CloudFormation custom resource operations"
    Properties:
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - !Sub "lambda.${AWS::URLSuffix}"
            Action:
              - sts:AssumeRole
      Path: "/"
      PermissionsBoundary:
        !If [
          HasPermissionsBoundary,
          !Ref PermissionsBoundaryArn,
          !Ref AWS::NoValue,
        ]
      Policies:
        - PolicyName: root
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Effect: Allow
                Action:
                  - codebuild:StartBuild
                  - codebuild:BatchGetBuilds
                Resource:
                  - !GetAtt UICodeBuildProject.Arn
              - Effect: Allow
                Action:
                  - logs:CreateLogGroup
                  - logs:CreateLogStream
                  - logs:PutLogEvents
                Resource: "*"
          # Used by custom resource helper poller
          # https://github.com/aws-cloudformation/custom-resource-helper
        - PolicyName: CustomResourcePoller
          PolicyDocument:
            Version: 2012-10-17
            Statement:
              - Effect: Allow
                Action:
                  - events:PutRule
                  - events:DeleteRule
                  - events:PutTargets
                  - events:RemoveTargets
                Resource:
                  - !Sub "arn:${AWS::Partition}:events:${AWS::Region}:${AWS::AccountId}:rule/*"
              - Effect: Allow
                Action:
                  - lambda:AddPermission
                  - lambda:RemovePermission
                Resource:
                  - !Sub "arn:${AWS::Partition}:lambda:${AWS::Region}:${AWS::AccountId}:function:*"

  StartUICodeBuild:
    Type: AWS::Serverless::Function
    Metadata:
      cfn_nag:
        rules_to_suppress:
          - id: W89
            reason: "Function does not require VPC access as it only interacts with AWS services via APIs"
          - id: W92
            reason: "Function does not require reserved concurrency as it scales based on demand"
    # checkov:skip=CKV_AWS_116: "DLQ not required for Cfn Custom Resource function"
    # checkov:skip=CKV_AWS_117: "Function does not require VPC access as it only interacts with AWS services via APIs"
    # checkov:skip=CKV_AWS_115: "Function does not require reserved concurrency as it scales based on demand"
    Properties:
      PermissionsBoundary:
        !If [
          HasPermissionsBoundary,
          !Ref PermissionsBoundaryArn,
          !Ref AWS::NoValue,
        ]
      Role: !GetAtt StartUICodeBuildExecutionRole.Arn
      Runtime: python3.12
      Timeout: 60
      MemorySize: 128
      Handler: index.handler
      CodeUri: src/lambda/start_codebuild
      Description: This AWS Lambda Function kicks off a code build job.
      LoggingConfig:
        LogGroup: !Ref StartUICodeBuildLogGroup

  StartUICodeBuildLogGroup:
    Type: AWS::Logs::LogGroup
    Properties:
      KmsKeyId: !GetAtt CustomerManagedEncryptionKey.Arn
      RetentionInDays: !Ref LogRetentionDays

  CodeBuildRun:
    Type: Custom::CodeBuildRun
    Properties:
      ServiceToken: !GetAtt StartUICodeBuild.Arn
      BuildProjectName: !Ref UICodeBuildProject
      SettingsParameter: !Ref SettingsParameter
      # Force codebuild to rerun when source code changes (filename will change), and to correctly roll back to
      # previous version if build fails.
      CodeLocation: !Sub "arn:${AWS::Partition}:s3:::<ARTIFACT_BUCKET_TOKEN>/<ARTIFACT_PREFIX_TOKEN>/<WEBUI_ZIPFILE_TOKEN>"

Outputs:
  ApplicationWebURL:
    Description: Application Web URL
    Value: !Sub "https://${CloudFrontDistribution.DomainName}/"
  SageMakerA2IReviewPortalURL:
    Description: SageMaker HITL Review portal URL
    Condition: IsHITLEnabled
    Value:
      Fn::GetAtt:
        - WorkforceURLResource
        - PortalURL
  PrivateWorkteamArn:
    Description: SageMaker A2I Private Workteam ARN (use this ARN when deploying additional patterns with HITL enabled)
    Condition: IsHITLEnabled
    Value: !If
      - ShouldCreatePrivateWorkteam
      - !Sub "arn:${AWS::Partition}:sagemaker:${AWS::Region}:${AWS::AccountId}:workteam/private-crowd/${PrivateWorkteam.WorkteamName}"
      - !Ref ExistingPrivateWorkforceArn
  LabelingConsoleURL:
    Description: SageMaker Ground Truth console URL
    Condition: IsHITLEnabled
    Value:
      Fn::GetAtt:
        - WorkforceURLResource
        - ConsoleURL
  S3InstallBucket:
    Description: Install S3 bucket name
    Value: !Ref InputBucket
  S3LoggingBucket:
    Description: Logging S3 bucket name
    Value: !Ref LoggingBucket
  S3WebUIBucket:
    Description: WebUI S3 bucket name
    Value: !Ref WebUIBucket
  S3InputBucketName:
    Description: Input S3 bucket name
    Value: !Ref InputBucket
  S3DiscoveryBucketName:
    Description: Discovery S3 bucket name
    Value: !Ref DiscoveryBucket
  S3InputBucketConsoleURL:
    Description: Input S3 bucket console URL
    Value: !Sub https://s3.console.aws.amazon.com/s3/buckets/${InputBucket}
  S3DiscoveryBucketConsoleURL:
    Description: Discovery S3 bucket console URL
    Value: !Sub https://s3.console.aws.amazon.com/s3/buckets/${DiscoveryBucket}
  S3OutputBucketName:
    Description: Output S3 bucket name
    Value: !Ref OutputBucket
  S3OutputBucketConsoleURL:
    Description: Output S3 bucket console URL
    Value: !Sub https://s3.console.aws.amazon.com/s3/buckets/${OutputBucket}
  S3ReportingBucketName:
    Description: Reporting S3 bucket name
    Value: !If
      - ShouldCreateReportingBucket
      - !Ref ReportingBucket
      - !Ref ReportingBucketName
  S3ReportingBucketConsoleURL:
    Description: Reporting S3 bucket console URL
    Value: !Sub
      - https://s3.console.aws.amazon.com/s3/buckets/${Bucket}
      - Bucket: !If
          - ShouldCreateReportingBucket
          - !Ref ReportingBucket
          - !Ref ReportingBucketName
  ReportingDatabase:
    Description: "AWS Glue database containing evaluation metrics tables (document_evaluations, section_evaluations, attribute_evaluations) that can be queried with Amazon Athena for analytics and reporting"
    Value: !Ref ReportingDatabase
  S3EvaluationBaselineBucketName:
    Description: Evaluation Baseline S3 bucket name
    Value: !If
      - ShouldCreateEvaluationBaselineBucket
      - !Ref EvaluationBaselineBucket
      - !Ref EvaluationBaselineBucketName
  S3EvaluationBaselineBucketConsoleURL:
    Description: Evaluation Baseline S3 bucket console URL
    Value: !Sub
      - https://s3.console.aws.amazon.com/s3/buckets/${Bucket}
      - Bucket: !If
          - ShouldCreateEvaluationBaselineBucket
          - !Ref EvaluationBaselineBucket
          - !Ref EvaluationBaselineBucketName
  S3ConfigurationBucketName:
    Description: Configuration S3 bucket name
    Value: !Ref ConfigurationBucket
  S3ConfigurationBucketConsoleURL:
    Description: Configuration S3 bucket console URL
    Value: !Sub https://s3.console.aws.amazon.com/s3/buckets/${ConfigurationBucket}
  S3TestSetBucketName:
    Description: Test Set S3 bucket name
    Value: !Ref TestSetBucket
  S3TestSetBucketConsoleURL:
    Description: Test Set S3 bucket console URL
    Value: !Sub https://s3.console.aws.amazon.com/s3/buckets/${TestSetBucket}
  StateMachineArn:
    Description: Step Functions State machine ARN
    Value: !If
      - IsPattern3
      - !GetAtt PATTERN3STACK.Outputs.StateMachineArn
      - !If
        - IsPattern2
        - !GetAtt PATTERN2STACK.Outputs.StateMachineArn
        - !GetAtt PATTERN1STACK.Outputs.StateMachineArn
  StateMachineConsoleURL:
    Description: Step Functions State machine console URL
    Value: !Sub
      - https://${AWS::Region}.console.aws.amazon.com/states/home?region=${AWS::Region}#/statemachines/view/${StateMachineArn}
      - StateMachineArn: !If
          - IsPattern3
          - !GetAtt PATTERN3STACK.Outputs.StateMachineArn
          - !If
            - IsPattern2
            - !GetAtt PATTERN2STACK.Outputs.StateMachineArn
            - !GetAtt PATTERN1STACK.Outputs.StateMachineArn

  CWDashboardConsoleName:
    Description: Name of the merged CloudWatch dashboard
    Value: !GetAtt MergedDashboard.DashboardName
  CWDashboardConsoleURL:
    Description: URL of the merged CloudWatch dashboard
    Value: !Sub "https://${AWS::Region}.console.aws.amazon.com/cloudwatch/home?region=${AWS::Region}#dashboards:name=${MergedDashboard.DashboardName}"
  SNSAlertsTopicARN:
    Description: SNS Topic ARN for alerts
    Value: !Ref AlertsTopic
  SNSAlertsTopicConsoleURL:
    Description: SNS Topic console URL
    Value: !Sub https://${AWS::Region}.console.aws.amazon.com/sns/v3/home?region=${AWS::Region}#/topic/${AlertsTopic}
  DynamoDBTrackingTableConsoleURL:
    Description: DynamoDB table console URL
    Value: !Sub https://${AWS::Region}.console.aws.amazon.com/dynamodbv2/home?region=${AWS::Region}#item-explorer?maximize=true&operation=QUERY&table=${TrackingTable}
  DynamoDBConcurrencyTableConsoleURL:
    Description: DynamoDB table console URL
    Value: !Sub https://${AWS::Region}.console.aws.amazon.com/dynamodbv2/home?region=${AWS::Region}#item-explorer?maximize=true&operation=QUERY&table=${ConcurrencyTable}
  DynamoDBConfigurationTableConsoleURL:
    Description: DynamoDB table console URL
    Value: !Sub https://${AWS::Region}.console.aws.amazon.com/dynamodbv2/home?region=${AWS::Region}#item-explorer?maximize=true&operation=QUERY&table=${ConfigurationTable}
  DynamoDBAgentTableName:
    Description: Name of the DynamoDB table for agent job tracking
    Value: !Ref AgentTable
  DynamoDBAgentTableConsoleURL:
    Description: DynamoDB table console URL for agent job tracking
    Value: !Sub https://${AWS::Region}.console.aws.amazon.com/dynamodbv2/home?region=${AWS::Region}#item-explorer?maximize=true&operation=QUERY&table=${AgentTable}
  LambdaLookupFunctionName:
    Description: Name of the Lookup function
    Value: !Ref LookupFunction
  LambdaLookupFunctionConsoleURL:
    Description: Lambda function console URL
    Value: !Sub https://${AWS::Region}.console.aws.amazon.com/lambda/home?region=${AWS::Region}#/functions/${LookupFunction}
  SQSDocumentQueueUrl:
    Description: SQS Queue URL
    Value: !Ref DocumentQueue
  SQSDocumentQueueConsoleURL:
    Description: SQS Queue console URL
    Value: !Sub https://${AWS::Region}.console.aws.amazon.com/sqs/v2/home?region=${AWS::Region}#/queues/${DocumentQueue}
  WebUITestEnvFile:
    Description: Copy to create .env file for local UI testing
    Value: !Sub |-
      VITE_USER_POOL_ID=${UserPool}
      VITE_USER_POOL_CLIENT_ID=${UserPoolClient}
      VITE_IDENTITY_POOL_ID=${IdentityPool}
      VITE_APPSYNC_GRAPHQL_URL=${GraphQLApi.GraphQLUrl}
      VITE_AWS_REGION=${AWS::Region}
      VITE_SETTINGS_PARAMETER=${SettingsParameter}
  ExternalMCPAgentsSecretConsoleURL:
    Description: External MCP Agents secret console URL - configure MCP server credentials here (JSON array format)
    Value: !Sub "https://${AWS::Region}.console.aws.amazon.com/secretsmanager/secret?name=${AWS::StackName}/external-mcp-agents/credentials&region=${AWS::Region}"
  MCPServerEndpoint:
    Condition: CreateAgentCoreLambda
    Description: MCP Server Endpoint
    Value: !GetAtt AgentCoreGateway.GatewayUrl
  MCPClientId:
    Condition: CreateAgentCoreLambda
    Description: MCP Client ID
    Value: !Ref ExternalAppClient
  MCPClientSecret:
    Condition: CreateAgentCoreLambda
    Description: MCP Client Secret
    Value: !GetAtt ExternalAppClient.ClientSecret
  MCPUserPool:
    Condition: CreateAgentCoreLambda
    Description: MCP User Pool ID
    Value: !Ref UserPool
  MCPTokenURL:
    Condition: CreateAgentCoreLambda
    Description: MCP Token URL
    Value: !Sub "https://${GetDomain.OutputString}.auth.${AWS::Region}.amazoncognito.com/oauth2/token"
  MCPAuthorizationURL:
    Condition: CreateAgentCoreLambda
    Description: MCP Authorization URL
    Value: !Sub "https://${GetDomain.OutputString}.auth.${AWS::Region}.amazoncognito.com/oauth2/authorize"