template.yml

# // Copyright 2020 Amazon.com, Inc. or its affiliates. All Rights Reserved.
# // SPDX-License-Identifier: Apache-2.0

AWSTemplateFormatVersion: '2010-09-09'
Transform: 'AWS::Serverless-2016-10-31'
Description: ADF CloudFormation Initial Base Stack for the Master Account in the us-east-1 region.
Metadata:
  AWS::ServerlessRepo::Application:
    Name: aws-deployment-framework
    Description: The AWS Deployment Framework (ADF) is an extensive and flexible framework to manage and deploy resources across multiple AWS accounts and regions based on AWS Organizations.
    Author: AWS ADF Builders Team
    SpdxLicenseId: Apache-2.0
    LicenseUrl: ../LICENSE.txt
    ReadmeUrl: ../docs/serverless-application-repo.md
    Labels: ['adf', 'aws-deployment-framework', 'multi-account', 'cicd', 'devops']
    HomePageUrl: https://github.com/awslabs/aws-deployment-framework
    SemanticVersion: 3.1.2
    SourceCodeUrl: https://github.com/awslabs/aws-deployment-framework
Mappings:
  Metadata:
    ADF:
      Version: 3.1.2
Parameters:
  CrossAccountAccessRoleName:
    Type: String
    Default: OrganizationAccountAccessRole
  MainNotificationEndpoint:
    Type: String
    Default: ""
    Description: "Example -> jon@smith.com"
  DeploymentAccountName:
    Type: String
    Default: ""
    Description: "The name of the new or existing deployment account"
  DeploymentAccountEmailAddress:
    Type: String
    Default: ""
    Description: "The email address for the new or existing deployment account"
  DeploymentAccountAlias:
    Type: String
    Default: ""
    Description: "(Optional) Example -> companyname-deployment (must be globally unique)"
  DeploymentAccountId:
    Type: String
    Default: ""
    Description: "Example -> 123456789101 (Only required if you have an existing AWS Account that you wish to use as the deployment account.)"
  DeploymentAccountMainRegion:
    Type: String
    Default: ""
    Description: "Example -> eu-west-1"
  DeploymentAccountTargetRegions:
    Type: CommaDelimitedList
    Default: ""
    Description: "(Optional) Example -> us-west-1,eu-west-3"
  ProtectedOUs:
    Description: "(Optional) Example -> ou-123,ou-234"
    Type: CommaDelimitedList
    Default: ""
Resources:
  BootstrapTemplatesBucketPolicy:
    Type: AWS::S3::BucketPolicy
    Properties:
      Bucket: !Ref "BootstrapTemplatesBucket"
      PolicyDocument:
        Statement:
          - Action:
              - s3:Get*
              - s3:PutReplicationConfiguration
              - s3:List*
            Effect: Allow
            Condition:
              StringEquals:
                aws:PrincipalOrgID: !GetAtt Organization.OrganizationId
            Resource:
              - !Sub arn:aws:s3:::${BootstrapTemplatesBucket}
              - !Sub arn:aws:s3:::${BootstrapTemplatesBucket}/*
            Principal:
              AWS: "*"
          - Action:
              - s3:PutObject*
            Effect: Allow
            Resource:
              - !Sub arn:aws:s3:::${BootstrapTemplatesBucket}
              - !Sub arn:aws:s3:::${BootstrapTemplatesBucket}/*
            Principal:
              AWS: !Ref AWS::AccountId
  BootstrapArtifactStorageBucket:
    DeletionPolicy: Retain
    Type: AWS::S3::Bucket
    Properties:
      AccessControl: BucketOwnerFullControl
      BucketEncryption:
        ServerSideEncryptionConfiguration:
          - ServerSideEncryptionByDefault:
              SSEAlgorithm: AES256
      VersioningConfiguration:
        Status: Enabled
      PublicAccessBlockConfiguration:
        BlockPublicAcls: true
        BlockPublicPolicy: true
        IgnorePublicAcls: true
        RestrictPublicBuckets: true
  BootstrapTemplatesBucket:
    Type: "AWS::S3::Bucket"
    DeletionPolicy: Retain
    Properties:
      AccessControl: BucketOwnerFullControl
      BucketEncryption:
        ServerSideEncryptionConfiguration:
          - ServerSideEncryptionByDefault:
              SSEAlgorithm: AES256
      VersioningConfiguration:
        Status: Enabled
      PublicAccessBlockConfiguration:
        BlockPublicAcls: true
        BlockPublicPolicy: true
        IgnorePublicAcls: true
        RestrictPublicBuckets: true
  LambdaLayerVersion:
    Type: "AWS::Serverless::LayerVersion"
    Properties:
      ContentUri: "./lambda_codebase/initial_commit/bootstrap_repository/adf-build/shared/"
      CompatibleRuntimes:
        - python3.7
        - python3.8
      Description: "Shared Lambda Layer between master and deployment account"
      LayerName: shared_layer
  LambdaLayerVersionPermission:
    Type: "AWS::Lambda::LayerVersionPermission"
    Properties:
      Action: lambda:GetLayerVersion
      LayerVersionArn: !Ref LambdaLayerVersion
      OrganizationId: !GetAtt Organization.OrganizationId
      Principal: "*"
  LambdaRole:
    Type: "AWS::IAM::Role"
    Properties:
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: "Allow"
            Principal:
              Service:
                - "states.amazonaws.com"
                - "lambda.amazonaws.com"
            Action:
              - "sts:AssumeRole"
  LambdaPolicy:
    Type: "AWS::IAM::ManagedPolicy"
    Properties:
      Description: "Policy to allow Lambda to perform actions"
      PolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: "Allow"
            Action:
              - "sts:AssumeRole"
              - "lambda:GetLayerVersion"
              - "logs:CreateLogGroup"
              - "logs:CreateLogStream"
              - "logs:PutLogEvents"
              - "organizations:DescribeOrganizationalUnit"
              - "organizations:ListParents"
              - "cloudformation:*"
              - "iam:GetRole"
              - "iam:PassRole"
              - "iam:CreateRole"
              - "iam:PutRolePolicy"
              - "organizations:DescribeOrganization"
              - "organizations:DescribeAccount"
              - "ssm:*"
              - "states:StartExecution"
            Resource: "*"
          - Effect: "Allow"
            Action: "s3:ListBucket"
            Resource: !GetAtt BootstrapTemplatesBucket.Arn
          - Effect: "Allow"
            Action: "s3:GetObject"
            Resource:
              !Join
                - ''
                - - !GetAtt BootstrapTemplatesBucket.Arn
                  - '/*'
      Roles:
        - !Ref LambdaRole
  StackWaiterFunction:
    Type: 'AWS::Serverless::Function'
    Properties:
      Handler: wait_until_complete.lambda_handler
      CodeUri: lambda_codebase/
      Layers:
          - !Ref LambdaLayerVersion
      Description: "ADF Lambda Function - StackWaiterFunction"
      Environment:
        Variables:
          S3_BUCKET_NAME: !Ref BootstrapTemplatesBucket
          TERMINATION_PROTECTION: false
          MASTER_ACCOUNT_ID: !Ref AWS::AccountId
          ORGANIZATION_ID: !GetAtt Organization.OrganizationId
          ADF_VERSION: !FindInMap ['Metadata', 'ADF', 'Version']
          ADF_LOG_LEVEL: INFO
      FunctionName: StackWaiter
      Role: !GetAtt LambdaRole.Arn
      Runtime: python3.8
      Timeout: 300
  DetermineEventFunction:
    Type: 'AWS::Serverless::Function'
    Properties:
      Handler: determine_event.lambda_handler
      CodeUri: lambda_codebase/
      Layers:
          - !Ref LambdaLayerVersion
      Description: "ADF Lambda Function - DetermineEvent"
      Environment:
        Variables:
          S3_BUCKET_NAME: !Ref BootstrapTemplatesBucket
          TERMINATION_PROTECTION: false
          DEPLOYMENT_ACCOUNT_BUCKET: !GetAtt SharedModulesBucketName.Value
          MASTER_ACCOUNT_ID: !Ref AWS::AccountId
          ORGANIZATION_ID: !GetAtt Organization.OrganizationId
          ADF_VERSION: !FindInMap ['Metadata', 'ADF', 'Version']
          ADF_LOG_LEVEL: INFO
      FunctionName: DetermineEventFunction
      Role: !GetAtt LambdaRole.Arn
      Runtime: python3.8
      Timeout: 300
  CrossAccountExecuteFunction:
    Type: 'AWS::Serverless::Function'
    Properties:
      Handler: account_bootstrap.lambda_handler
      CodeUri: lambda_codebase/
      Layers:
          - !Ref LambdaLayerVersion
      Description: "ADF Lambda Function - CrossAccountExecuteFunction"
      Environment:
        Variables:
          S3_BUCKET_NAME: !Ref BootstrapTemplatesBucket
          TERMINATION_PROTECTION: false
          DEPLOYMENT_ACCOUNT_BUCKET: !GetAtt SharedModulesBucketName.Value
          MASTER_ACCOUNT_ID: !Ref AWS::AccountId
          ORGANIZATION_ID: !GetAtt Organization.OrganizationId
          ADF_VERSION: !FindInMap ['Metadata', 'ADF', 'Version']
          ADF_LOG_LEVEL: INFO
      FunctionName: CrossAccountExecuteFunction
      Role: !GetAtt LambdaRole.Arn
      Runtime: python3.8
      Timeout: 600
  RoleStackDeploymentFunction:
    Type: 'AWS::Serverless::Function'
    Properties:
      Handler: deployment_account_config.lambda_handler
      CodeUri: lambda_codebase/
      Layers:
          - !Ref LambdaLayerVersion
      Description: "ADF Lambda Function - RoleStackDeploymentFunction"
      Environment:
        Variables:
          S3_BUCKET_NAME: !Ref BootstrapTemplatesBucket
          TERMINATION_PROTECTION: false
          MASTER_ACCOUNT_ID: !Ref AWS::AccountId
          ADF_VERSION: !FindInMap ['Metadata', 'ADF', 'Version']
          ADF_LOG_LEVEL: INFO
      FunctionName: RoleStackDeploymentFunction
      Role: !GetAtt LambdaRole.Arn
      Runtime: python3.8
      Timeout: 300
  MovedToRootActionFunction:
    Type: 'AWS::Serverless::Function'
    Properties:
      Handler: moved_to_root.lambda_handler
      CodeUri: lambda_codebase/
      Layers:
          - !Ref LambdaLayerVersion
      Description: "ADF Lambda Function - MovedToRootActionFunction"
      Environment:
        Variables:
          S3_BUCKET_NAME: !Ref BootstrapTemplatesBucket
          TERMINATION_PROTECTION: false
          MASTER_ACCOUNT_ID: !Ref AWS::AccountId
          ADF_VERSION: !FindInMap ['Metadata', 'ADF', 'Version']
          ADF_LOG_LEVEL: INFO
      FunctionName: MovedToRootActionFunction
      Role: !GetAtt LambdaRole.Arn
      Runtime: python3.8
      Timeout: 900
  UpdateResourcePoliciesFunction:
    Type: 'AWS::Serverless::Function'
    Properties:
      Handler: generic_account_config.lambda_handler
      CodeUri: lambda_codebase/
      Layers:
          - !Ref LambdaLayerVersion
      Description: "ADF Lambda Function - UpdateResourcePoliciesFunction"
      Environment:
        Variables:
          S3_BUCKET_NAME: !Ref BootstrapTemplatesBucket
          TERMINATION_PROTECTION: false
          MASTER_ACCOUNT_ID: !Ref AWS::AccountId
          ADF_VERSION: !FindInMap ['Metadata', 'ADF', 'Version']
          ADF_LOG_LEVEL: INFO
      FunctionName: UpdateResourcePoliciesFunction
      Role: !GetAtt LambdaRole.Arn
      Runtime: python3.8
      Timeout: 300
  CloudWatchEventsRule:
    Type: "AWS::Events::Rule"
    Properties:
      Description: Triggers StateMachine on Move OU
      EventPattern:
        source:
          - aws.organizations
        detail:
          eventSource:
            - organizations.amazonaws.com
          eventName:
            - MoveAccount
      Targets:
        - Arn: !Ref StateMachine
          RoleArn: !GetAtt StatesExecutionRole.Arn
          Id: CreateStackLinkedAccountV1
  CodeCommitRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: "adf-codecommit-role-base"
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Principal:
              Service: codecommit.amazonaws.com
            Action:
              - sts:AssumeRole
      Path: /
  CodeCommitPolicy:
    Type: AWS::IAM::Policy
    Properties:
      PolicyName: "adf-organizations-codecommit-role-policy"
      PolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Action:
              - "codecommit:BatchGetRepositories"
              - "codecommit:Get*"
              - "codecommit:GitPull"
              - "codecommit:List*"
              - "codecommit:CancelUploadArchive"
              - "codecommit:UploadArchive"
              - "s3:Get"
            Resource: "*"
      Roles:
        - !Ref CodeCommitRole
  CodeBuildRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
        - Effect: "Allow"
          Principal:
            Service:
              - "codebuild.amazonaws.com"
          Action:
            - "sts:AssumeRole"
      ManagedPolicyArns:
        - !Ref "CodeBuildPolicy"
      RoleName: "adf-codebuild-role"
  CodeBuildPolicy:
    Type: "AWS::IAM::ManagedPolicy"
    Properties:
      Description: "Policy to allow codebuild to perform actions"
      PolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: "Allow"
            Action:
              - "logs:CreateLogGroup"
              - "logs:CreateLogStream"
              - "logs:PutLogEvents"
              - "organizations:AttachPolicy"
              - "organizations:CreatePolicy"
              - "organizations:DeletePolicy"
              - "organizations:DescribeAccount"
              - "organizations:DescribeOrganization"
              - "organizations:DescribeOrganizationalUnit"
              - "organizations:DescribePolicy"
              - "organizations:DetachPolicy"
              - "organizations:EnablePolicyType"
              - "organizations:ListAccounts"
              - "organizations:ListAccountsForParent"
              - "organizations:ListOrganizationalUnitsForParent"
              - "organizations:ListChildren"
              - "organizations:ListParents"
              - "organizations:ListPolicies"
              - "organizations:ListPoliciesForTarget"
              - "organizations:ListRoots"
              - "organizations:UpdatePolicy"
              - "organizations:CreateAccount"
              - "organizations:MoveAccount"
              - "organizations:DescribeCreateAccountStatus"
              - "organizations:TagResource"
              - "ssm:GetParameter"
              - "ssm:GetParameters"
              - "ssm:PutParameter"
              - "states:Describe*"
              - "states:StartExecution"
              - "sts:GetCallerIdentity"
              - "sts:assumeRole"
              - "cloudformation:ValidateTemplate"
            Resource: "*"
          - Effect: "Allow"
            Action:
              - "cloudformation:CreateStack"
              - "cloudformation:DescribeChangeSet"
              - "cloudformation:DeleteStack"
              - "cloudformation:UpdateStack"
              - "cloudformation:CancelUpdateStack"
              - "cloudformation:ContinueUpdateRollback"
              - "cloudformation:CreateChangeSet"
              - "cloudformation:DeleteChangeSet"
              - "cloudformation:DescribeStacks"
              - "cloudformation:CreateUploadBucket"
              - "cloudformation:ExecuteChangeSet"
              - "cloudformation:SetStackPolicy"
              - "cloudformation:SignalResource"
              - "cloudformation:UpdateTerminationProtection"
            Resource:
              - "arn:aws:cloudformation:*:*:stack/adf-global-base-*/*"
              - "arn:aws:cloudformation:*:*:stack/adf-regional-base-*/*"
              - !Sub "arn:aws:cloudformation:*:${AWS::AccountId}:stack/adf-global-base-adf-build/*"
          - Effect: "Allow"
            Action:
              - "s3:DeleteObject"
              - "s3:GetBucketPolicy"
              - "s3:GetObject"
              - "s3:ListBucket"
              - "s3:PutObject"
            Resource:
              - "arn:aws:s3:::serverlessrepo-aws-deplo-bootstraptemplatesbucket-*"
              - "arn:aws:s3:::serverlessrepo-aws-deplo-bootstraptemplatesbucket-*/*"
              - !GetAtt BootstrapArtifactStorageBucket.Arn
              - !Sub "${BootstrapArtifactStorageBucket.Arn}/*"
              - "arn:aws:s3:::adf-shared-modules-*-*"
              - "arn:aws:s3:::adf-shared-modules-*-*/*"
          - Effect: "Allow"
            Action:
              - "codebuild:*"
            Resource:
              - !Sub "arn:aws:codebuild:${AWS::Region}:${AWS::AccountId}:project/aws-deployment-framework-base-templates"
          - Effect: "Allow"
            Action:
              - "iam:CreatePolicy"
              - "iam:CreateRole"
              - "iam:DeleteRole"
              - "iam:DeleteRolePolicy"
              - "iam:GetRole"
              - "iam:PutRolePolicy"
              - "iam:UpdateAssumeRolePolicy"
            Resource:
              - !Sub "arn:aws:iam::${AWS::AccountId}:role/${CrossAccountAccessRoleName}"
              - !Sub "arn:aws:iam::${AWS::AccountId}:role/${CrossAccountAccessRoleName}-readonly"
  CodeCommitRepository:
    Type: AWS::CodeCommit::Repository
    Properties:
      RepositoryName: 'aws-deployment-framework-bootstrap'
      RepositoryDescription: !Sub "CodeCommit Repo for AWS Deployment Framework base in ${AWS::AccountId}"
  CodeBuildProject:
    Type: AWS::CodeBuild::Project
    Properties:
      TimeoutInMinutes: 40
      Artifacts:
        Type: CODEPIPELINE
      Environment:
        ComputeType: "BUILD_GENERAL1_LARGE"
        PrivilegedMode: false
        Image: "aws/codebuild/standard:5.0"
        EnvironmentVariables:
          - Name: ADF_VERSION
            Value: !FindInMap ['Metadata', 'ADF', 'Version']
          - Name: TERMINATION_PROTECTION
            Value: false
          - Name: PYTHONPATH
            Value: './adf-build/shared/python'
          - Name: S3_BUCKET
            Value: !Ref BootstrapTemplatesBucket
          - Name: MASTER_ACCOUNT_ID
            Value: !Ref AWS::AccountId
          - Name: DEPLOYMENT_ACCOUNT_BUCKET
            Value: !GetAtt SharedModulesBucketName.Value
          - Name: ORGANIZATION_ID
            Value: !GetAtt Organization.OrganizationId
          - Name: ADF_LOG_LEVEL
            Value: INFO
        Type: LINUX_CONTAINER
      Name: 'aws-deployment-framework-base-templates'
      ServiceRole: !Ref CodeBuildRole
      Source:
        BuildSpec: !Sub |
          version: 0.2
          phases:
            install:
              runtime-versions:
                python: 3.8
            pre_build:
              commands:
                - pip install -r adf-build/requirements.txt --quiet
                - pytest -vvv
            build:
              commands:
                - sam build -t adf-bootstrap/deployment/global.yml
                - sam package --output-template-file adf-bootstrap/deployment/global.yml --s3-prefix adf-bootstrap/deployment --s3-bucket $DEPLOYMENT_ACCOUNT_BUCKET
                - aws s3 sync ./adf-build/shared s3://$DEPLOYMENT_ACCOUNT_BUCKET/adf-build --quiet # Shared Modules to be used with AWS CodeBuild
                - aws s3 sync . s3://$S3_BUCKET --quiet --delete # Base Templates
                - python adf-build/main.py  # Updates config, updates (or creates) base stacks.
                - python adf-build/provisioner/main.py # Ensures/Creates AWS Accounts based on accounts definitions files.
        Type: CODEPIPELINE
      Tags:
        - Key: "Name"
          Value: "aws-deployment-framework-base-templates"
  CodePipeline:
    Type: AWS::CodePipeline::Pipeline
    Properties:
      ArtifactStore:
        Type: S3
        Location: !Ref BootstrapArtifactStorageBucket
      RoleArn: !GetAtt CodePipelineRole.Arn
      Name: 'aws-deployment-framework-bootstrap-pipeline'
      Stages:
        - Name: CodeCommit
          Actions:
            - Name: Source
              ActionTypeId:
                Category: Source
                Owner: AWS
                Version: '1'
                Provider: CodeCommit
              OutputArtifacts:
                - Name: "TemplateSource"
              Configuration:
                BranchName: "master"
                RepositoryName: 'aws-deployment-framework-bootstrap'
                PollForSourceChanges: false
              RunOrder: 1
        - Name: UploadAndUpdateBaseStacks
          Actions:
            - Name: UploadAndUpdateBaseStacks
              ActionTypeId:
                  Category: Build
                  Owner: AWS
                  Version: '1'
                  Provider: CodeBuild
              OutputArtifacts:
                - Name: "aws-deployment-framework-bootstrap-build"
              InputArtifacts:
                - Name: "TemplateSource"
              Configuration:
                  ProjectName: !Ref CodeBuildProject
              RunOrder: 1
  CodePipelineRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: "adf-codepipeline-role"
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - codepipeline.amazonaws.com
            Action:
              - sts:AssumeRole
      Path: /
  CodePipelineRolePolicy:
    Type: "AWS::IAM::ManagedPolicy"
    Properties:
      Description: "Policy to allow codepipeline to perform actions"
      PolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: "Allow"
            Action:
              - "codebuild:*"
              - "codecommit:*"
              - "s3:GetBucketPolicy"
              - "s3:GetObject"
              - "s3:ListBucket"
              - "s3:PutObject"
            Resource: "*"
      Roles:
        - !Ref CodePipelineRole
  OrgEventCodePipelineRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: "adf-org-event-codepipeline"
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Principal:
              Service: events.amazonaws.com
            Action:
              - sts:AssumeRole
      Path: /
  OrgEventCodePipelinePolicy:
    Type: AWS::IAM::Policy
    Properties:
      PolicyName: "adf-org-event-codepipeline-policy"
      PolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Action:
              - "codepipeline:StartPipelineExecution"
            Resource: !Sub arn:aws:codepipeline:${AWS::Region}:${AWS::AccountId}:${CodePipeline}
      Roles:
        - !Ref OrgEventCodePipelineRole
  StatesExecutionRole:
    Type: "AWS::IAM::Role"
    Properties:
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: "Allow"
            Principal:
              Service:
                - events.amazonaws.com
                - lambda.amazonaws.com
                - states.amazonaws.com
            Action: "sts:AssumeRole"
      Path: "/"
      Policies:
        - PolicyName: "adf-state-machine-role-policy"
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Effect: Allow
                Action:
                  - "lambda:InvokeFunction"
                  - "states:StartExecution"
                Resource: "*"
  StateMachine:
    Type: "AWS::StepFunctions::StateMachine"
    Properties:
      DefinitionString: !Sub |-
            {
                "Comment": "ADF Account Bootstrapping Process",
                "StartAt": "DetermineEvent",
                "States": {
                    "DetermineEvent": {
                        "Type": "Task",
                        "Resource": "${DetermineEventFunction.Arn}",
                        "Next": "MovedToRootOrProtected?",
                        "TimeoutSeconds": 300
                    },
                    "MovedToRootOrProtected?": {
                        "Type": "Choice",
                        "Choices": [{
                                "Variable": "$.moved_to_protected",
                                "NumericEquals": 1,
                                "Next": "ExecuteDeploymentAccountStateMachine"
                            },
                            {
                                "Variable": "$.moved_to_root",
                                "NumericEquals": 1,
                                "Next": "MovedToRootAction"
                            }
                        ],
                        "Default": "CreateOrUpdateBaseStack"
                    },
                    "CreateOrUpdateBaseStack": {
                        "Type": "Task",
                        "Resource": "${CrossAccountExecuteFunction.Arn}",
                        "Next": "WaitUntilBootstrapComplete",
                        "Catch": [{
                            "ErrorEquals": ["States.ALL"],
                            "Next": "ExecuteDeploymentAccountStateMachine",
                            "ResultPath": "$.error"
                        }],
                        "TimeoutSeconds": 600
                    },
                    "MovedToRootAction": {
                        "Type": "Task",
                        "Resource": "${MovedToRootActionFunction.Arn}",
                        "Retry": [{
                            "ErrorEquals": ["RetryError"],
                            "IntervalSeconds": 10,
                            "BackoffRate": 1.0,
                            "MaxAttempts": 20
                        }],
                        "Catch": [{
                            "ErrorEquals": ["States.ALL"],
                            "Next": "ExecuteDeploymentAccountStateMachine",
                            "ResultPath": "$.error"
                        }],
                        "Next": "ExecuteDeploymentAccountStateMachine",
                        "TimeoutSeconds": 900
                    },
                    "WaitUntilBootstrapComplete": {
                        "Type": "Task",
                        "Resource": "${StackWaiterFunction.Arn}",
                        "Retry": [{
                            "ErrorEquals": ["RetryError"],
                            "IntervalSeconds": 10,
                            "BackoffRate": 1.0,
                            "MaxAttempts": 500
                        }],
                        "Catch": [{
                            "ErrorEquals": ["States.ALL"],
                            "Next": "ExecuteDeploymentAccountStateMachine",
                            "ResultPath": "$.error"
                        }],
                        "Next": "DeploymentAccount?",
                        "TimeoutSeconds": 900
                    },
                    "DeploymentAccount?": {
                        "Type": "Choice",
                        "Choices": [{
                            "Variable": "$.is_deployment_account",
                            "NumericEquals": 1,
                            "Next": "DeploymentAccountConfig"
                        }],
                        "Default": "ExecuteDeploymentAccountStateMachine"
                    },
                    "DeploymentAccountConfig": {
                        "Type": "Task",
                        "Resource": "${RoleStackDeploymentFunction.Arn}",
                        "End": true,
                        "TimeoutSeconds": 900
                    },
                    "ExecuteDeploymentAccountStateMachine": {
                        "Type": "Task",
                        "Resource": "${UpdateResourcePoliciesFunction.Arn}",
                        "End": true,
                        "TimeoutSeconds": 900
                    }
                }
            }
      RoleArn: !GetAtt StatesExecutionRole.Arn
  InitialCommit:
    Type: Custom::InitialCommit
    Properties:
      ServiceToken: !GetAtt InitialCommitHandler.Arn
      Version: !FindInMap ['Metadata', 'ADF', 'Version']
      RepositoryArn: !GetAtt CodeCommitRepository.Arn
      DirectoryName: bootstrap_repository
      ExistingAccountId: !Ref DeploymentAccountId
      DeploymentAccountRegion: !Ref DeploymentAccountMainRegion
      DeploymentAccountFullName: !Ref DeploymentAccountName
      DeploymentAccountEmailAddress: !Ref DeploymentAccountEmailAddress
      DeploymentAccountAlias: !Ref DeploymentAccountAlias
      CrossAccountAccessRole: !Ref CrossAccountAccessRoleName
      TargetRegions: !Ref DeploymentAccountTargetRegions
      ProtectedOUs: !Ref ProtectedOUs
      NotificationEndpoint: !Ref MainNotificationEndpoint
  InitialCommitHandler:
    Type: AWS::Serverless::Function
    Properties:
      Handler: handler.lambda_handler
      CodeUri: lambda_codebase/initial_commit
      Description: "ADF Lambda Function - BootstrapCreateInitialCommitFunction"
      Policies:
        - Version: "2012-10-17"
          Statement:
            - Effect: Allow
              Action:
                - codecommit:CreateBranch
                - codecommit:CreateCommit
                - codecommit:CreatePullRequest
                - codecommit:DeleteBranch
                - codecommit:GetBranch
                - codecommit:GetDifferences
              Resource: !GetAtt CodeCommitRepository.Arn
      FunctionName: BootstrapCreateInitialCommitFunction
      Runtime: python3.8
      Timeout: 300
  SharedModulesBucket:
    Type: Custom::CrossRegionBucket
    Properties:
      ServiceToken: !GetAtt CrossRegionBucketHandler.Arn
      Region: !Ref DeploymentAccountMainRegion
      BucketNamePrefix: !Sub "adf-shared-modules-${DeploymentAccountMainRegion}"
      Version: !FindInMap ['Metadata', 'ADF', 'Version']
      PolicyDocument:
        Statement:
          - Action:
              - s3:Get*
              - s3:List*
              - s3:PutObject
            Effect: Allow
            Principal:
              AWS:
                - Fn::Join:
                  - ""
                  - - "arn:aws:iam::"
                    - !GetAtt DeploymentAccount.AccountId
                    - ":root"
              Service:
                - codebuild.amazonaws.com
                - lambda.amazonaws.com
                - cloudformation.amazonaws.com
  SharedModulesBucketName:
    Type: AWS::SSM::Parameter
    Properties:
      Description: DO NOT EDIT - Used by The AWS Deployment Framework
      Name: shared_modules_bucket
      Type: String
      Value: !GetAtt SharedModulesBucket.BucketName
  LogLevelSetting:
    Type: AWS::SSM::Parameter
    Properties:
      Description: DO NOT EDIT - Used by The AWS Deployment Framework
      Name: adf_log_level
      Type: String
      Value: INFO
  CrossRegionBucketHandler:
    Type: AWS::Serverless::Function
    Properties:
      Handler: handler.lambda_handler
      CodeUri: lambda_codebase/cross_region_bucket
      Description: "ADF Lambda Function - Create Deployment Bucket in Main Deployment Region"
      Policies:
        - Version: "2012-10-17"
          Statement:
            - Effect: Allow
              Action: s3:CreateBucket
              Resource: "*"
            - Effect: Allow
              Action:
                - s3:DeleteBucket
                - s3:PutEncryptionConfiguration
                - s3:PutBucketPolicy
                - s3:PutBucketPublicAccessBlock
              Resource: "arn:aws:s3:::adf-shared-modules-*"
            - Effect: Allow
              Action: ssm:GetParameter
              Resource:
                - !Sub "arn:aws:ssm:${AWS::Region}:${AWS::AccountId}:parameter/shared_modules_bucket"
                - !Sub "arn:aws:ssm:${AWS::Region}:${AWS::AccountId}:parameter/deployment_account_region"
      FunctionName: CrossRegionBucketHandler
      Runtime: python3.8
      Timeout: 300
  Organization:
    Type: Custom::Organization
    Properties:
      ServiceToken: !GetAtt OrganizationHandler.Arn
  OrganizationHandler:
    Type: AWS::Serverless::Function
    Properties:
      Handler: handler.lambda_handler
      CodeUri: lambda_codebase/organization
      Description: "ADF Lambda Function - Enable AWS Organizations"
      Policies:
        - Version: "2012-10-17"
          Statement:
            - Effect: Allow
              Action:
                - "organizations:CreateOrganization"
                - "organizations:DeleteOrganization"
                - "organizations:DescribeOrganization"
                - "organizations:ListRoots"
              Resource: "*"
            - Effect: Allow
              Action: "iam:CreateServiceLinkedRole"
              Resource: "arn:aws:iam::*:role/aws-service-role/*"
      FunctionName: AwsOrganizationsHandler
      Runtime: python3.8
      Timeout: 300
  DeploymentOrganizationUnit:
    Type: Custom::OrganizationUnit
    Properties:
      ServiceToken: !GetAtt OrganizationUnitHandler.Arn
      ParentId: !GetAtt Organization.OrganizationRootId
      OrganizationUnitName: deployment
  OrganizationUnitHandler:
    Type: AWS::Serverless::Function
    Properties:
      Handler: handler.lambda_handler
      CodeUri: lambda_codebase/organization_unit
      Description: "ADF Lambda Function - Create Organization Unit"
      Policies:
        - Version: "2012-10-17"
          Statement:
            - Effect: Allow
              Action:
                - "organizations:CreateOrganizationalUnit"
                - "organizations:DeleteOrganizationalUnit"
                - "organizations:ListOrganizationalUnitsForParent"
              Resource: "*"
      FunctionName: OrganizationUnitHandler
      Runtime: python3.8
      Timeout: 300
  DeploymentAccount:
    Type: Custom::Account
    DependsOn: Organization
    Properties:
      ServiceToken: !GetAtt AccountHandler.Arn
      AccountName: !Ref DeploymentAccountName
      AccountEmailAddress: !Ref DeploymentAccountEmailAddress
      CrossAccountAccessRoleName: !Ref CrossAccountAccessRoleName
      ExistingAccountId: !Ref DeploymentAccountId
  AccountHandler:
    Type: AWS::Serverless::Function
    Properties:
      Handler: handler.lambda_handler
      CodeUri: lambda_codebase/account
      Description: "ADF Lambda Function - Create Account"
      Policies:
        - Version: "2012-10-17"
          Statement:
            - Effect: Allow
              Action:
                - "organizations:CreateAccount"
                - "organizations:DescribeCreateAccountStatus"
              Resource: "*"
            - Effect: Allow
              Action: ssm:GetParameter
              Resource: !Sub "arn:aws:ssm:${AWS::Region}:${AWS::AccountId}:parameter/deployment_account_id"
      FunctionName: AccountHandler
      Runtime: python3.8
      Timeout: 300
  PipelineCloudWatchEventRole:
      Type: AWS::IAM::Role
      Properties:
        AssumeRolePolicyDocument:
          Version: 2012-10-17
          Statement:
            - Effect: Allow
              Principal:
                Service:
                  - events.amazonaws.com
              Action: sts:AssumeRole
        Path: /
        Policies:
          - PolicyName: adf-bootstrap-execute-cwe
            PolicyDocument:
              Version: 2012-10-17
              Statement:
                - Effect: Allow
                  Action: codepipeline:StartPipelineExecution
                  Resource: !Join [ '', [ 'arn:aws:codepipeline:', !Ref 'AWS::Region', ':', !Ref 'AWS::AccountId', ':', !Ref CodePipeline ] ]
  PipelineCloudWatchEventRule:
    Type: AWS::Events::Rule
    Properties:
      EventPattern:
        source:
          - aws.codecommit
        detail-type:
          - 'CodeCommit Repository State Change'
        resources:
          - !Join [ '', [ 'arn:aws:codecommit:', !Ref 'AWS::Region', ':', !Ref 'AWS::AccountId', ':', !GetAtt CodeCommitRepository.Name ] ]
        detail:
          event:
            - referenceCreated
            - referenceUpdated
          referenceType:
            - branch
          referenceName:
            - master
      Targets:
        - Arn:
            !Join [ '', [ 'arn:aws:codepipeline:', !Ref 'AWS::Region', ':', !Ref 'AWS::AccountId', ':', !Ref CodePipeline ] ]
          RoleArn: !GetAtt PipelineCloudWatchEventRole.Arn
          Id: adf-codepipeline-trigger-bootstrap
Outputs:
  ADFVersionNumber:
    Value: !FindInMap ['Metadata', 'ADF', 'Version']
    Export:
      Name: "ADFVersionNumber"
  LayerArn:
    Description: "The Shared modules Lambda Layer Arn"
    Value: !Ref LambdaLayerVersion
    Export:
      Name: "SharedLayerArn"
  CodeCommitHttpURL:
    Description: "The CodeCommit HTTP Url"
    Value: !GetAtt CodeCommitRepository.CloneUrlHttp
    Export:
      Name: "BaseTemplatesRepoHttpURL"
  CodeCommitSshURL:
    Description: "The CodeCommit SSH Url"
    Value: !GetAtt CodeCommitRepository.CloneUrlSsh
    Export:
      Name: "BaseTemplatesRepoSSHURL"