{
  "tagging" : {
    "permissions" : [ "ecs:TagResource", "ecs:UntagResource", "ecs:ListTagsForResource" ],
    "taggable" : true,
    "tagOnCreate" : true,
    "tagUpdatable" : true,
    "tagProperty" : "/properties/Tags",
    "cloudFormationSystemTags" : true
  },
  "propertyTransform" : {
    "/properties/Configuration/ManagedStorageConfiguration/FargateEphemeralStorageKmsKeyId" : "FargateEphemeralStorageKmsKeyId $OR $join([\"arn:aws[-a-z]*:kms:[a-z0-9-]+:[0-9]{12}:key/\", FargateEphemeralStorageKmsKeyId])"
  },
  "handlers" : {
    "read" : {
      "permissions" : [ "ecs:DescribeClusters", "kms:DescribeKey" ]
    },
    "create" : {
      "permissions" : [ "ecs:CreateCluster", "ecs:DescribeClusters", "iam:CreateServiceLinkedRole", "ecs:TagResource", "kms:DescribeKey" ]
    },
    "update" : {
      "permissions" : [ "ecs:PutAccountSettingDefault", "ecs:DescribeClusters", "ecs:TagResource", "ecs:UntagResource", "ecs:PutAccountSetting", "ecs:ListTagsForResource", "ecs:UpdateCluster", "ecs:UpdateClusterSettings", "ecs:PutClusterCapacityProviders", "kms:DescribeKey" ]
    },
    "list" : {
      "permissions" : [ "ecs:DescribeClusters", "ecs:ListClusters" ]
    },
    "delete" : {
      "permissions" : [ "ecs:DeleteCluster", "ecs:DescribeClusters", "kms:DescribeKey" ]
    }
  },
  "typeName" : "AWS::ECS::Cluster",
  "readOnlyProperties" : [ "/properties/Arn" ],
  "description" : "The ``AWS::ECS::Cluster`` resource creates an Amazon Elastic Container Service (Amazon ECS) cluster.",
  "writeOnlyProperties" : [ "/properties/ServiceConnectDefaults" ],
  "createOnlyProperties" : [ "/properties/ClusterName" ],
  "additionalProperties" : false,
  "primaryIdentifier" : [ "/properties/ClusterName" ],
  "definitions" : {
    "CapacityProviderStrategyItem" : {
      "description" : "The ``CapacityProviderStrategyItem`` property specifies the details of the default capacity provider strategy for the cluster. When services or tasks are run in the cluster with no launch type or capacity provider strategy specified, the default capacity provider strategy is used.",
      "additionalProperties" : false,
      "type" : "object",
      "properties" : {
        "CapacityProvider" : {
          "description" : "The short name of the capacity provider. This can be either an AWS managed capacity provider (``FARGATE`` or ``FARGATE_SPOT``) or the name of a custom capacity provider that you created.",
          "type" : "string"
        },
        "Weight" : {
          "description" : "The *weight* value designates the relative percentage of the total number of tasks launched that should use the specified capacity provider. The ``weight`` value is taken into consideration after the ``base`` value, if defined, is satisfied.\n If no ``weight`` value is specified, the default value of ``0`` is used. When multiple capacity providers are specified within a capacity provider strategy, at least one of the capacity providers must have a weight value greater than zero and any capacity providers with a weight of ``0`` can't be used to place tasks. If you specify multiple capacity providers in a strategy that all have a weight of ``0``, any ``RunTask`` or ``CreateService`` actions using the capacity provider strategy will fail.\n Weight value characteristics:\n  +  Weight is considered after the base value is satisfied\n  +  The default value is ``0`` if not specified\n  +  The valid range is 0 to 1,000\n  +  At least one capacity provider must have a weight greater than zero\n  +  Capacity providers with weight of ``0`` cannot place tasks\n  \n Task distribution logic:\n  1.  Base satisfaction: The minimum number of tasks specified by the base value are placed on that capacity provider\n  1.  Weight distribution: After base requirements are met, additional tasks are distributed according to weight ratios\n  \n Examples:\n Equal Distribution: Two capacity providers both with weight ``1`` will split tasks evenly after base requirements are met.\n Weighted Distribution: If capacityProviderA has weight ``1`` and capacityProviderB has weight ``4``, then for every 1 task on A, 4 tasks will run on B.",
          "type" : "integer"
        },
        "Base" : {
          "description" : "The *base* value designates how many tasks, at a minimum, to run on the specified capacity provider for each service. Only one capacity provider in a capacity provider strategy can have a *base* defined. If no value is specified, the default value of ``0`` is used.\n Base value characteristics:\n  +  Only one capacity provider in a strategy can have a base defined\n  +  The default value is ``0`` if not specified\n  +  The valid range is 0 to 100,000\n  +  Base requirements are satisfied first before weight distribution",
          "type" : "integer"
        }
      }
    },
    "ExecuteCommandLogConfiguration" : {
      "description" : "The log configuration for the results of the execute command actions. The logs can be sent to CloudWatch Logs or an Amazon S3 bucket.",
      "additionalProperties" : false,
      "type" : "object",
      "properties" : {
        "S3EncryptionEnabled" : {
          "description" : "Determines whether to use encryption on the S3 logs. If not specified, encryption is not used.",
          "type" : "boolean"
        },
        "CloudWatchEncryptionEnabled" : {
          "description" : "Determines whether to use encryption on the CloudWatch logs. If not specified, encryption will be off.",
          "type" : "boolean"
        },
        "CloudWatchLogGroupName" : {
          "description" : "The name of the CloudWatch log group to send logs to.\n  The CloudWatch log group must already be created.",
          "type" : "string"
        },
        "S3KeyPrefix" : {
          "description" : "An optional folder in the S3 bucket to place logs in.",
          "type" : "string"
        },
        "S3BucketName" : {
          "description" : "The name of the S3 bucket to send logs to.\n  The S3 bucket must already be created.",
          "type" : "string"
        }
      }
    },
    "ClusterSettings" : {
      "description" : "The settings to use when creating a cluster. This parameter is used to turn on CloudWatch Container Insights with enhanced observability or CloudWatch Container Insights for a cluster.\n Container Insights with enhanced observability provides all the Container Insights metrics, plus additional task and container metrics. This version supports enhanced observability for Amazon ECS clusters using the Amazon EC2 and Fargate launch types. After you configure Container Insights with enhanced observability on Amazon ECS, Container Insights auto-collects detailed infrastructure telemetry from the cluster level down to the container level in your environment and displays these critical performance data in curated dashboards removing the heavy lifting in observability set-up. \n For more information, see [Monitor Amazon ECS containers using Container Insights with enhanced observability](https://docs.aws.amazon.com/AmazonECS/latest/developerguide/cloudwatch-container-insights.html) in the *Amazon Elastic Container Service Developer Guide*.",
      "additionalProperties" : false,
      "type" : "object",
      "properties" : {
        "Value" : {
          "description" : "The value to set for the cluster setting. The supported values are ``enhanced``, ``enabled``, and ``disabled``. \n To use Container Insights with enhanced observability, set the ``containerInsights`` account setting to ``enhanced``.\n To use Container Insights, set the ``containerInsights`` account setting to ``enabled``.\n If a cluster value is specified, it will override the ``containerInsights`` value set with [PutAccountSetting](https://docs.aws.amazon.com/AmazonECS/latest/APIReference/API_PutAccountSetting.html) or [PutAccountSettingDefault](https://docs.aws.amazon.com/AmazonECS/latest/APIReference/API_PutAccountSettingDefault.html).",
          "type" : "string"
        },
        "Name" : {
          "description" : "The name of the cluster setting. The value is ``containerInsights``.",
          "type" : "string"
        }
      }
    },
    "ManagedStorageConfiguration" : {
      "description" : "The managed storage configuration for the cluster.",
      "additionalProperties" : false,
      "type" : "object",
      "properties" : {
        "FargateEphemeralStorageKmsKeyId" : {
          "description" : "Specify the KMSlong key ID for Fargate ephemeral storage.\n When you specify a ``fargateEphemeralStorageKmsKeyId``, AWS Fargate uses the key to encrypt data at rest in ephemeral storage. For more information about Fargate ephemeral storage encryption, see [Customer managed keys for Fargate ephemeral storage for Amazon ECS](https://docs.aws.amazon.com/AmazonECS/latest/developerguide/fargate-storage-encryption.html) in the *Amazon Elastic Container Service Developer Guide*.\n The key must be a single Region key.",
          "type" : "string"
        },
        "KmsKeyId" : {
          "description" : "Specify a KMSlong key ID to encrypt Amazon ECS managed storage.\n  When you specify a ``kmsKeyId``, Amazon ECS uses the key to encrypt data volumes managed by Amazon ECS that are attached to tasks in the cluster. The following data volumes are managed by Amazon ECS: Amazon EBS. For more information about encryption of Amazon EBS volumes attached to Amazon ECS tasks, see [Encrypt data stored in Amazon EBS volumes for Amazon ECS](https://docs.aws.amazon.com/AmazonECS/latest/developerguide/ebs-kms-encryption.html) in the *Amazon Elastic Container Service Developer Guide*.\n The key must be a single Region key.",
          "type" : "string"
        }
      }
    },
    "ServiceConnectDefaults" : {
      "description" : "Use this parameter to set a default Service Connect namespace. After you set a default Service Connect namespace, any new services with Service Connect turned on that are created in the cluster are added as client services in the namespace. This setting only applies to new services that set the ``enabled`` parameter to ``true`` in the ``ServiceConnectConfiguration``. You can set the namespace of each service individually in the ``ServiceConnectConfiguration`` to override this default parameter.\n Tasks that run in a namespace can use short names to connect to services in the namespace. Tasks can connect to services across all of the clusters in the namespace. Tasks connect through a managed proxy container that collects logs and metrics for increased visibility. Only the tasks that Amazon ECS services create are supported with Service Connect. For more information, see [Service Connect](https://docs.aws.amazon.com/AmazonECS/latest/developerguide/service-connect.html) in the *Amazon Elastic Container Service Developer Guide*.",
      "additionalProperties" : false,
      "type" : "object",
      "properties" : {
        "Namespace" : {
          "description" : "The namespace name or full Amazon Resource Name (ARN) of the CMAPlong namespace that's used when you create a service and don't specify a Service Connect configuration. The namespace name can include up to 1024 characters. The name is case-sensitive. The name can't include greater than (>), less than (<), double quotation marks (\"), or slash (/).\n If you enter an existing namespace name or ARN, then that namespace will be used. Any namespace type is supported. The namespace must be in this account and this AWS Region.\n If you enter a new name, a CMAPlong namespace will be created. Amazon ECS creates a CMAP namespace with the \"API calls\" method of instance discovery only. This instance discovery method is the \"HTTP\" namespace type in the CLIlong. Other types of instance discovery aren't used by Service Connect.\n If you update the cluster with an empty string ``\"\"`` for the namespace name, the cluster configuration for Service Connect is removed. Note that the namespace will remain in CMAP and must be deleted separately.\n For more information about CMAPlong, see [Working with Services](https://docs.aws.amazon.com/cloud-map/latest/dg/working-with-services.html) in the *Developer Guide*.",
          "type" : "string"
        }
      }
    },
    "Tag" : {
      "description" : "The metadata that you apply to a resource to help you categorize and organize them. Each tag consists of a key and an optional value. You define them.\n The following basic restrictions apply to tags:\n  +  Maximum number of tags per resource - 50\n  +  For each resource, each tag key must be unique, and each tag key can have only one value.\n  +  Maximum key length - 128 Unicode characters in UTF-8\n  +  Maximum value length - 256 Unicode characters in UTF-8\n  +  If your tagging schema is used across multiple services and resources, remember that other services may have restrictions on allowed characters. Generally allowed characters are: letters, numbers, and spaces representable in UTF-8, and the following characters: + - = . _ : / @.\n  +  Tag keys and values are case-sensitive.\n  +  Do not use ``aws:``, ``AWS:``, or any upper or lowercase combination of such as a prefix for either keys or values as it is reserved for AWS use. You cannot edit or delete tag keys or values with this prefix. Tags with this prefix do not count against your tags per resource limit.",
      "additionalProperties" : false,
      "type" : "object",
      "properties" : {
        "Value" : {
          "description" : "The optional part of a key-value pair that make up a tag. A ``value`` acts as a descriptor within a tag category (key).",
          "type" : "string"
        },
        "Key" : {
          "description" : "One part of a key-value pair that make up a tag. A ``key`` is a general label that acts like a category for more specific tag values.",
          "type" : "string"
        }
      }
    },
    "ClusterConfiguration" : {
      "description" : "The execute command and managed storage configuration for the cluster.",
      "additionalProperties" : false,
      "type" : "object",
      "properties" : {
        "ManagedStorageConfiguration" : {
          "description" : "The details of the managed storage configuration.",
          "$ref" : "#/definitions/ManagedStorageConfiguration"
        },
        "ExecuteCommandConfiguration" : {
          "description" : "The details of the execute command configuration.",
          "$ref" : "#/definitions/ExecuteCommandConfiguration"
        }
      }
    },
    "ExecuteCommandConfiguration" : {
      "description" : "The details of the execute command configuration.",
      "additionalProperties" : false,
      "type" : "object",
      "properties" : {
        "Logging" : {
          "description" : "The log setting to use for redirecting logs for your execute command results. The following log settings are available.\n  +  ``NONE``: The execute command session is not logged.\n  +  ``DEFAULT``: The ``awslogs`` configuration in the task definition is used. If no logging parameter is specified, it defaults to this value. If no ``awslogs`` log driver is configured in the task definition, the output won't be logged.\n  +  ``OVERRIDE``: Specify the logging details as a part of ``logConfiguration``. If the ``OVERRIDE`` logging option is specified, the ``logConfiguration`` is required.",
          "type" : "string"
        },
        "KmsKeyId" : {
          "description" : "Specify an KMSlong key ID to encrypt the data between the local client and the container.",
          "type" : "string"
        },
        "LogConfiguration" : {
          "description" : "The log configuration for the results of the execute command actions. The logs can be sent to CloudWatch Logs or an Amazon S3 bucket. When ``logging=OVERRIDE`` is specified, a ``logConfiguration`` must be provided.",
          "$ref" : "#/definitions/ExecuteCommandLogConfiguration"
        }
      }
    }
  },
  "properties" : {
    "ClusterSettings" : {
      "description" : "The settings to use when creating a cluster. This parameter is used to turn on CloudWatch Container Insights with enhanced observability or CloudWatch Container Insights for a cluster.\n Container Insights with enhanced observability provides all the Container Insights metrics, plus additional task and container metrics. This version supports enhanced observability for Amazon ECS clusters using the Amazon EC2 and Fargate launch types. After you configure Container Insights with enhanced observability on Amazon ECS, Container Insights auto-collects detailed infrastructure telemetry from the cluster level down to the container level in your environment and displays these critical performance data in curated dashboards removing the heavy lifting in observability set-up. \n For more information, see [Monitor Amazon ECS containers using Container Insights with enhanced observability](https://docs.aws.amazon.com/AmazonECS/latest/developerguide/cloudwatch-container-insights.html) in the *Amazon Elastic Container Service Developer Guide*.",
      "type" : "array",
      "items" : {
        "$ref" : "#/definitions/ClusterSettings"
      }
    },
    "DefaultCapacityProviderStrategy" : {
      "description" : "The default capacity provider strategy for the cluster. When services or tasks are run in the cluster with no launch type or capacity provider strategy specified, the default capacity provider strategy is used.",
      "type" : "array",
      "items" : {
        "$ref" : "#/definitions/CapacityProviderStrategyItem"
      }
    },
    "Configuration" : {
      "description" : "The execute command and managed storage configuration for the cluster.",
      "$ref" : "#/definitions/ClusterConfiguration"
    },
    "ServiceConnectDefaults" : {
      "description" : "Use this parameter to set a default Service Connect namespace. After you set a default Service Connect namespace, any new services with Service Connect turned on that are created in the cluster are added as client services in the namespace. This setting only applies to new services that set the ``enabled`` parameter to ``true`` in the ``ServiceConnectConfiguration``. You can set the namespace of each service individually in the ``ServiceConnectConfiguration`` to override this default parameter.\n Tasks that run in a namespace can use short names to connect to services in the namespace. Tasks can connect to services across all of the clusters in the namespace. Tasks connect through a managed proxy container that collects logs and metrics for increased visibility. Only the tasks that Amazon ECS services create are supported with Service Connect. For more information, see [Service Connect](https://docs.aws.amazon.com/AmazonECS/latest/developerguide/service-connect.html) in the *Amazon Elastic Container Service Developer Guide*.",
      "$ref" : "#/definitions/ServiceConnectDefaults"
    },
    "CapacityProviders" : {
      "description" : "The short name of one or more capacity providers to associate with the cluster. A capacity provider must be associated with a cluster before it can be included as part of the default capacity provider strategy of the cluster or used in a capacity provider strategy when calling the [CreateService](https://docs.aws.amazon.com/AmazonECS/latest/APIReference/API_CreateService.html) or [RunTask](https://docs.aws.amazon.com/AmazonECS/latest/APIReference/API_RunTask.html) actions.\n If specifying a capacity provider that uses an Auto Scaling group, the capacity provider must be created but not associated with another cluster. New Auto Scaling group capacity providers can be created with the [CreateCapacityProvider](https://docs.aws.amazon.com/AmazonECS/latest/APIReference/API_CreateCapacityProvider.html) API operation.\n To use a FARGATElong capacity provider, specify either the ``FARGATE`` or ``FARGATE_SPOT`` capacity providers. The FARGATElong capacity providers are available to all accounts and only need to be associated with a cluster to be used.\n The [PutCapacityProvider](https://docs.aws.amazon.com/AmazonECS/latest/APIReference/API_PutCapacityProvider.html) API operation is used to update the list of available capacity providers for a cluster after the cluster is created.",
      "type" : "array",
      "items" : {
        "type" : "string"
      }
    },
    "ClusterName" : {
      "description" : "A user-generated string that you use to identify your cluster. If you don't specify a name, CFNlong generates a unique physical ID for the name.",
      "type" : "string"
    },
    "Arn" : {
      "description" : "",
      "type" : "string"
    },
    "Tags" : {
      "description" : "The metadata that you apply to the cluster to help you categorize and organize them. Each tag consists of a key and an optional value. You define both.\n The following basic restrictions apply to tags:\n  +  Maximum number of tags per resource - 50\n  +  For each resource, each tag key must be unique, and each tag key can have only one value.\n  +  Maximum key length - 128 Unicode characters in UTF-8\n  +  Maximum value length - 256 Unicode characters in UTF-8\n  +  If your tagging schema is used across multiple services and resources, remember that other services may have restrictions on allowed characters. Generally allowed characters are: letters, numbers, and spaces representable in UTF-8, and the following characters: + - = . _ : / @.\n  +  Tag keys and values are case-sensitive.\n  +  Do not use ``aws:``, ``AWS:``, or any upper or lowercase combination of such as a prefix for either keys or values as it is reserved for AWS use. You cannot edit or delete tag keys or values with this prefix. Tags with this prefix do not count against your tags per resource limit.",
      "type" : "array",
      "items" : {
        "$ref" : "#/definitions/Tag"
      }
    }
  }
}