{
  "typeName" : "AWS::VerifiedPermissions::PolicyStore",
  "description" : "Represents a policy store that you can place schema, policies, and policy templates in to validate authorization requests",
  "definitions" : {
    "ValidationMode" : {
      "type" : "string",
      "enum" : [ "OFF", "STRICT" ]
    },
    "ValidationSettings" : {
      "type" : "object",
      "properties" : {
        "Mode" : {
          "$ref" : "#/definitions/ValidationMode"
        }
      },
      "required" : [ "Mode" ],
      "additionalProperties" : false
    },
    "SchemaJson" : {
      "type" : "string"
    },
    "SchemaDefinition" : {
      "type" : "object",
      "properties" : {
        "CedarJson" : {
          "$ref" : "#/definitions/SchemaJson"
        }
      },
      "additionalProperties" : false
    },
    "DeletionMode" : {
      "type" : "string",
      "default" : "DISABLED",
      "enum" : [ "ENABLED", "DISABLED" ]
    },
    "DeletionProtection" : {
      "type" : "object",
      "properties" : {
        "Mode" : {
          "$ref" : "#/definitions/DeletionMode"
        }
      },
      "required" : [ "Mode" ],
      "additionalProperties" : false
    },
    "Tag" : {
      "type" : "object",
      "additionalProperties" : false,
      "properties" : {
        "Key" : {
          "type" : "string"
        },
        "Value" : {
          "type" : "string"
        }
      },
      "required" : [ "Key", "Value" ]
    },
    "EncryptionSettings" : {
      "type" : "object",
      "oneOf" : [ {
        "type" : "object",
        "required" : [ "KmsEncryptionSettings" ],
        "properties" : {
          "KmsEncryptionSettings" : {
            "$ref" : "#/definitions/KmsEncryptionSettings"
          }
        },
        "additionalProperties" : false
      }, {
        "type" : "object",
        "required" : [ "Default" ],
        "properties" : {
          "Default" : {
            "$ref" : "#/definitions/Default"
          }
        },
        "additionalProperties" : false
      } ]
    },
    "Default" : {
      "type" : "object",
      "additionalProperties" : false
    },
    "KmsEncryptionState" : {
      "type" : "object",
      "properties" : {
        "Key" : {
          "$ref" : "#/definitions/KmsKey"
        },
        "EncryptionContext" : {
          "$ref" : "#/definitions/EncryptionContext"
        }
      },
      "required" : [ "Key", "EncryptionContext" ],
      "additionalProperties" : false
    },
    "KmsEncryptionSettings" : {
      "type" : "object",
      "properties" : {
        "Key" : {
          "$ref" : "#/definitions/KmsKey"
        },
        "EncryptionContext" : {
          "$ref" : "#/definitions/EncryptionContext"
        }
      },
      "required" : [ "Key" ],
      "additionalProperties" : false
    },
    "KmsKey" : {
      "type" : "string",
      "pattern" : "^[a-zA-Z0-9:/_-]+$"
    },
    "EncryptionContext" : {
      "type" : "object",
      "patternProperties" : {
        "^.+$" : {
          "type" : "string",
          "minLength" : 1
        }
      },
      "additionalProperties" : false
    }
  },
  "properties" : {
    "Arn" : {
      "type" : "string",
      "maxLength" : 2500,
      "minLength" : 1,
      "pattern" : "^arn:[^:]*:[^:]*:[^:]*:[^:]*:.*$"
    },
    "Description" : {
      "type" : "string",
      "maxLength" : 150,
      "minLength" : 0
    },
    "PolicyStoreId" : {
      "type" : "string",
      "maxLength" : 200,
      "minLength" : 1,
      "pattern" : "^[a-zA-Z0-9-]*$"
    },
    "ValidationSettings" : {
      "$ref" : "#/definitions/ValidationSettings"
    },
    "Schema" : {
      "$ref" : "#/definitions/SchemaDefinition"
    },
    "DeletionProtection" : {
      "$ref" : "#/definitions/DeletionProtection"
    },
    "EncryptionSettings" : {
      "$ref" : "#/definitions/EncryptionSettings"
    },
    "Tags" : {
      "description" : "The tags to add to the policy store",
      "type" : "array",
      "uniqueItems" : false,
      "insertionOrder" : false,
      "items" : {
        "$ref" : "#/definitions/Tag"
      }
    },
    "EncryptionState" : {
      "type" : "object",
      "oneOf" : [ {
        "type" : "object",
        "required" : [ "KmsEncryptionState" ],
        "properties" : {
          "KmsEncryptionState" : {
            "$ref" : "#/definitions/KmsEncryptionState"
          }
        },
        "additionalProperties" : false
      }, {
        "type" : "object",
        "required" : [ "Default" ],
        "properties" : {
          "Default" : {
            "$ref" : "#/definitions/Default"
          }
        },
        "additionalProperties" : false
      } ]
    }
  },
  "required" : [ "ValidationSettings" ],
  "writeOnlyProperties" : [ "/properties/EncryptionSettings" ],
  "readOnlyProperties" : [ "/properties/Arn", "/properties/PolicyStoreId", "/properties/EncryptionState" ],
  "primaryIdentifier" : [ "/properties/PolicyStoreId" ],
  "tagging" : {
    "taggable" : true,
    "tagOnCreate" : true,
    "tagUpdatable" : true,
    "cloudFormationSystemTags" : true,
    "tagProperty" : "/properties/Tags",
    "permissions" : [ "verifiedpermissions:TagResource", "verifiedpermissions:ListTagsForResource", "verifiedpermissions:UntagResource" ]
  },
  "sourceUrl" : "https://github.com/aws-cloudformation/aws-cloudformation-resource-providers-avp",
  "propertyTransform" : {
    "/properties/Schema/CedarJson" : "$join([CedarJson, \"{}\"])"
  },
  "handlers" : {
    "create" : {
      "permissions" : [ "verifiedpermissions:CreatePolicyStore", "verifiedpermissions:TagResource", "verifiedpermissions:GetPolicyStore", "verifiedpermissions:PutSchema", "kms:Decrypt", "kms:DescribeKey", "kms:Encrypt", "kms:GenerateDataKeyWithoutPlaintext", "kms:ReEncryptFrom", "kms:ReEncryptTo" ]
    },
    "read" : {
      "permissions" : [ "verifiedpermissions:GetPolicyStore", "verifiedpermissions:ListTagsForResource", "verifiedpermissions:GetSchema" ]
    },
    "update" : {
      "permissions" : [ "verifiedpermissions:UpdatePolicyStore", "verifiedpermissions:GetPolicyStore", "verifiedpermissions:TagResource", "verifiedpermissions:UntagResource", "verifiedpermissions:GetSchema", "verifiedpermissions:PutSchema", "kms:Decrypt" ]
    },
    "delete" : {
      "permissions" : [ "verifiedpermissions:DeletePolicyStore", "verifiedpermissions:GetPolicyStore" ]
    },
    "list" : {
      "permissions" : [ "verifiedpermissions:ListPolicyStores", "verifiedpermissions:GetPolicyStore", "verifiedpermissions:GetSchema" ]
    }
  },
  "additionalProperties" : false
}