{
  "typeName" : "AWS::EC2::Subnet",
  "description" : "Specifies a subnet for the specified VPC.\n For an IPv4 only subnet, specify an IPv4 CIDR block. If the VPC has an IPv6 CIDR block, you can create an IPv6 only subnet or a dual stack subnet instead. For an IPv6 only subnet, specify an IPv6 CIDR block. For a dual stack subnet, specify both an IPv4 CIDR block and an IPv6 CIDR block.\n For more information, see [Subnets for your VPC](https://docs.aws.amazon.com/vpc/latest/userguide/configure-subnets.html) in the *Amazon VPC User Guide*.",
  "additionalProperties" : false,
  "propertyTransform" : {
    "/properties/Ipv6CidrBlock" : "Ipv6CidrBlock~>function($c){$split($c,\"/\")~>function($p){$number($p[1])~>function($n){$split($p[0],\":\")~>function($r){($map([0,1,2,3,4,5,6,7],function($i){$pad($r[$i],-4,\"0\")~>function($h){($i<$floor($n/16)?$h:($i=$floor($n/16)?$floor(($n%16)/4)~>function($k){($h~>$substring(0,$k))&$substring(\"0000\",0,4-$k)}:\"0000\"))~>$replace(/^0{1,3}/,\"\")}})~>$join(\":\")~>$replace(/(:0)+$/,\"::\"))&\"/\"&$p[1]}}}}",
    "/properties/CidrBlock" : "CidrBlock~>function($cidr){$split($cidr,\"/\")~>function($split_cidr){$number($split_cidr[1])~>function($sub_mask){$split($split_cidr[0],/[.]/).$number()~>function($octets){($octets.$formatBase($,2).$pad(-8,\"0\")~>$join())~>function($ip_bin_str){$substring($ip_bin_str,0,$sub_mask).$pad(32,\"0\")~>function($canon_ip_bin_str){$map($map([0..3],function($i){$substring($canon_ip_bin_str,$i*8,8)}),function($s){$split($s,\"\")})~>function($canon_octet_arrs){$map($canon_octet_arrs,function($section){$sum($map([0..7],function($bit){$number($section[$bit])*$power(2,7-$bit)}))})~>function($canon_octets){($canon_octets.$string()~>$join(\".\"))&\"/\"&$sub_mask}}}}}}}}"
  },
  "properties" : {
    "AssignIpv6AddressOnCreation" : {
      "type" : "boolean",
      "description" : "Indicates whether a network interface created in this subnet receives an IPv6 address. The default value is ``false``.\n If you specify ``AssignIpv6AddressOnCreation``, you must also specify an IPv6 CIDR block."
    },
    "VpcId" : {
      "type" : "string",
      "description" : "The ID of the VPC the subnet is in.\n If you update this property, you must also update the ``CidrBlock`` property."
    },
    "MapPublicIpOnLaunch" : {
      "type" : "boolean",
      "description" : "Indicates whether instances launched in this subnet receive a public IPv4 address. The default value is ``false``.\n AWS charges for all public IPv4 addresses, including public IPv4 addresses associated with running instances and Elastic IP addresses. For more information, see the *Public IPv4 Address* tab on the [VPC pricing page](https://docs.aws.amazon.com/vpc/pricing/)."
    },
    "EnableLniAtDeviceIndex" : {
      "type" : "integer",
      "description" : "Indicates the device position for local network interfaces in this subnet. For example, ``1`` indicates local network interfaces in this subnet are the secondary network interface (eth1)."
    },
    "NetworkAclAssociationId" : {
      "type" : "string",
      "description" : ""
    },
    "AvailabilityZone" : {
      "type" : "string",
      "description" : "The Availability Zone of the subnet.\n If you update this property, you must also update the ``CidrBlock`` property."
    },
    "AvailabilityZoneId" : {
      "type" : "string",
      "description" : "The AZ ID of the subnet."
    },
    "CidrBlock" : {
      "type" : "string",
      "description" : "The IPv4 CIDR block assigned to the subnet.\n If you update this property, we create a new subnet, and then delete the existing one."
    },
    "SubnetId" : {
      "type" : "string",
      "description" : ""
    },
    "Ipv6CidrBlocks" : {
      "type" : "array",
      "uniqueItems" : false,
      "items" : {
        "type" : "string"
      },
      "description" : ""
    },
    "Ipv6CidrBlock" : {
      "type" : "string",
      "description" : "The IPv6 CIDR block.\n If you specify ``AssignIpv6AddressOnCreation``, you must also specify an IPv6 CIDR block."
    },
    "OutpostArn" : {
      "type" : "string",
      "description" : "The Amazon Resource Name (ARN) of the Outpost."
    },
    "Ipv6Native" : {
      "type" : "boolean",
      "description" : "Indicates whether this is an IPv6 only subnet. For more information, see [Subnet basics](https://docs.aws.amazon.com/vpc/latest/userguide/VPC_Subnets.html#subnet-basics) in the *User Guide*."
    },
    "EnableDns64" : {
      "type" : "boolean",
      "description" : "Indicates whether DNS queries made to the Amazon-provided DNS Resolver in this subnet should return synthetic IPv6 addresses for IPv4-only destinations.\n  You must first configure a NAT gateway in a public subnet (separate from the subnet containing the IPv6-only workloads). For example, the subnet containing the NAT gateway should have a ``0.0.0.0/0`` route pointing to the internet gateway. For more information, see [Configure DNS64 and NAT64](https://docs.aws.amazon.com/vpc/latest/userguide/nat-gateway-nat64-dns64.html#nat-gateway-nat64-dns64-walkthrough) in the *User Guide*."
    },
    "PrivateDnsNameOptionsOnLaunch" : {
      "type" : "object",
      "additionalProperties" : false,
      "properties" : {
        "HostnameType" : {
          "type" : "string"
        },
        "EnableResourceNameDnsARecord" : {
          "type" : "boolean"
        },
        "EnableResourceNameDnsAAAARecord" : {
          "type" : "boolean"
        }
      },
      "description" : "The hostname type for EC2 instances launched into this subnet and how DNS A and AAAA record queries to the instances should be handled. For more information, see [Amazon EC2 instance hostname types](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-instance-naming.html) in the *User Guide*.\n Available options:\n  +  EnableResourceNameDnsAAAARecord (true | false)\n  +  EnableResourceNameDnsARecord (true | false)\n  +  HostnameType (ip-name | resource-name)"
    },
    "Tags" : {
      "type" : "array",
      "uniqueItems" : false,
      "items" : {
        "$ref" : "#/definitions/Tag"
      },
      "description" : "Any tags assigned to the subnet."
    },
    "Ipv4IpamPoolId" : {
      "type" : "string",
      "description" : "An IPv4 IPAM pool ID for the subnet."
    },
    "Ipv4NetmaskLength" : {
      "type" : "integer",
      "description" : "An IPv4 netmask length for the subnet."
    },
    "Ipv6IpamPoolId" : {
      "type" : "string",
      "description" : "An IPv6 IPAM pool ID for the subnet."
    },
    "Ipv6NetmaskLength" : {
      "type" : "integer",
      "description" : "An IPv6 netmask length for the subnet."
    },
    "BlockPublicAccessStates" : {
      "type" : "object",
      "additionalProperties" : false,
      "description" : "",
      "properties" : {
        "InternetGatewayBlockMode" : {
          "type" : "string",
          "description" : "The mode of VPC BPA. Options here are off, block-bidirectional, block-ingress "
        }
      }
    }
  },
  "tagging" : {
    "taggable" : true,
    "tagOnCreate" : true,
    "tagUpdatable" : true,
    "cloudFormationSystemTags" : true,
    "tagProperty" : "/properties/Tags",
    "permissions" : [ "ec2:CreateTags", "ec2:DeleteTags" ]
  },
  "definitions" : {
    "Tag" : {
      "type" : "object",
      "additionalProperties" : false,
      "properties" : {
        "Value" : {
          "type" : "string",
          "description" : "The tag value."
        },
        "Key" : {
          "type" : "string",
          "description" : "The tag key."
        }
      },
      "required" : [ "Value", "Key" ],
      "description" : "Specifies a tag. For more information, see [Resource tags](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-resource-tags.html)."
    }
  },
  "required" : [ "VpcId" ],
  "createOnlyProperties" : [ "/properties/VpcId", "/properties/AvailabilityZone", "/properties/AvailabilityZoneId", "/properties/CidrBlock", "/properties/OutpostArn", "/properties/Ipv6Native", "/properties/Ipv4IpamPoolId", "/properties/Ipv4NetmaskLength", "/properties/Ipv6IpamPoolId", "/properties/Ipv6NetmaskLength" ],
  "conditionalCreateOnlyProperties" : [ "/properties/Ipv6CidrBlock" ],
  "primaryIdentifier" : [ "/properties/SubnetId" ],
  "readOnlyProperties" : [ "/properties/NetworkAclAssociationId", "/properties/SubnetId", "/properties/Ipv6CidrBlocks", "/properties/BlockPublicAccessStates" ],
  "writeOnlyProperties" : [ "/properties/EnableLniAtDeviceIndex", "/properties/Ipv4IpamPoolId", "/properties/Ipv4NetmaskLength", "/properties/Ipv6IpamPoolId", "/properties/Ipv6NetmaskLength" ],
  "handlers" : {
    "create" : {
      "permissions" : [ "ec2:DescribeSubnets", "ec2:CreateSubnet", "ec2:CreateTags", "ec2:ModifySubnetAttribute" ]
    },
    "read" : {
      "permissions" : [ "ec2:DescribeSubnets", "ec2:DescribeNetworkAcls" ]
    },
    "update" : {
      "permissions" : [ "ec2:DescribeSubnets", "ec2:ModifySubnetAttribute", "ec2:CreateTags", "ec2:DeleteTags", "ec2:AssociateSubnetCidrBlock", "ec2:DisassociateSubnetCidrBlock" ]
    },
    "delete" : {
      "permissions" : [ "ec2:DescribeSubnets", "ec2:DeleteSubnet" ]
    },
    "list" : {
      "permissions" : [ "ec2:DescribeSubnets", "ec2:DescribeNetworkAcls" ]
    }
  }
}