{
  "typeName" : "AWS::MSK::Replicator",
  "description" : "Resource Type definition for AWS::MSK::Replicator",
  "additionalProperties" : false,
  "tagging" : {
    "taggable" : true,
    "tagOnCreate" : true,
    "tagUpdatable" : true,
    "cloudFormationSystemTags" : true,
    "tagProperty" : "/properties/Tags",
    "permissions" : [ "kafka:UntagResource", "kafka:ListTagsForResource", "kafka:TagResource" ]
  },
  "sourceUrl" : "https://github.com/aws-cloudformation/aws-cloudformation-resource-providers-msk-replicator.git",
  "properties" : {
    "ReplicatorArn" : {
      "description" : "Amazon Resource Name for the created replicator.",
      "type" : "string",
      "pattern" : "arn:(aws|aws-us-gov|aws-cn):kafka:.*"
    },
    "ReplicatorName" : {
      "description" : "The name of the replicator.",
      "type" : "string",
      "minLength" : 1,
      "maxLength" : 128,
      "pattern" : "^[0-9A-Za-z][0-9A-Za-z-]{0,}$"
    },
    "CurrentVersion" : {
      "description" : "The current version of the MSK replicator.",
      "type" : "string"
    },
    "Description" : {
      "description" : "A summary description of the replicator.",
      "type" : "string",
      "maxLength" : 1024
    },
    "KafkaClusters" : {
      "description" : "Specifies a list of Kafka clusters which are targets of the replicator.",
      "type" : "array",
      "uniqueItems" : true,
      "insertionOrder" : false,
      "minItems" : 2,
      "maxItems" : 2,
      "items" : {
        "$ref" : "#/definitions/KafkaCluster"
      }
    },
    "ReplicationInfoList" : {
      "description" : "A list of replication configurations, where each configuration targets a given source cluster to target cluster replication flow.",
      "type" : "array",
      "uniqueItems" : true,
      "insertionOrder" : false,
      "minItems" : 1,
      "maxItems" : 1,
      "items" : {
        "$ref" : "#/definitions/ReplicationInfo"
      }
    },
    "ServiceExecutionRoleArn" : {
      "description" : "The Amazon Resource Name (ARN) of the IAM role used by the replicator to access external resources.",
      "type" : "string",
      "pattern" : "arn:(aws|aws-us-gov|aws-cn):iam:.*"
    },
    "Tags" : {
      "description" : "A collection of tags associated with a resource",
      "type" : "array",
      "uniqueItems" : true,
      "insertionOrder" : false,
      "items" : {
        "$ref" : "#/definitions/Tag"
      }
    },
    "LogDelivery" : {
      "description" : "Configuration for log delivery for the replicator.",
      "$ref" : "#/definitions/LogDelivery"
    }
  },
  "definitions" : {
    "Tag" : {
      "type" : "object",
      "properties" : {
        "Key" : {
          "type" : "string",
          "minLength" : 1,
          "maxLength" : 128
        },
        "Value" : {
          "type" : "string",
          "maxLength" : 256
        }
      },
      "required" : [ "Value", "Key" ],
      "additionalProperties" : false
    },
    "TopicReplication" : {
      "type" : "object",
      "additionalProperties" : false,
      "properties" : {
        "TopicsToReplicate" : {
          "description" : "List of regular expression patterns indicating the topics to copy.",
          "type" : "array",
          "uniqueItems" : true,
          "insertionOrder" : false,
          "minItems" : 1,
          "maxItems" : 100,
          "items" : {
            "type" : "string",
            "maxLength" : 249
          }
        },
        "TopicsToExclude" : {
          "description" : "List of regular expression patterns indicating the topics that should not be replicated.",
          "type" : "array",
          "uniqueItems" : true,
          "insertionOrder" : false,
          "minItems" : 1,
          "maxItems" : 100,
          "items" : {
            "type" : "string",
            "maxLength" : 249
          }
        },
        "CopyTopicConfigurations" : {
          "description" : "Whether to periodically configure remote topics to match their corresponding upstream topics.",
          "type" : "boolean"
        },
        "CopyAccessControlListsForTopics" : {
          "description" : "Whether to periodically configure remote topic ACLs to match their corresponding upstream topics.",
          "type" : "boolean"
        },
        "DetectAndCopyNewTopics" : {
          "description" : "Whether to periodically check for new topics and partitions.",
          "type" : "boolean"
        },
        "StartingPosition" : {
          "description" : "Configuration for specifying the position in the topics to start replicating from.",
          "$ref" : "#/definitions/ReplicationStartingPosition"
        },
        "TopicNameConfiguration" : {
          "description" : "Configuration for specifying replicated topic names should be the same as their corresponding upstream topics or prefixed with source cluster alias.",
          "$ref" : "#/definitions/ReplicationTopicNameConfiguration"
        }
      },
      "required" : [ "TopicsToReplicate" ]
    },
    "ReplicationStartingPosition" : {
      "description" : "Configuration for specifying the position in the topics to start replicating from.",
      "type" : "object",
      "additionalProperties" : false,
      "properties" : {
        "Type" : {
          "$ref" : "#/definitions/ReplicationStartingPositionType"
        }
      },
      "required" : [ ]
    },
    "ReplicationStartingPositionType" : {
      "description" : "The type of replication starting position.",
      "type" : "string",
      "enum" : [ "LATEST", "EARLIEST" ]
    },
    "ReplicationTopicNameConfiguration" : {
      "description" : "Configuration for specifying replicated topic names should be the same as their corresponding upstream topics or prefixed with source cluster alias.",
      "type" : "object",
      "additionalProperties" : false,
      "properties" : {
        "Type" : {
          "$ref" : "#/definitions/ReplicationTopicNameConfigurationType"
        }
      },
      "required" : [ ]
    },
    "ReplicationTopicNameConfigurationType" : {
      "description" : "The type of replicated topic name.",
      "type" : "string",
      "enum" : [ "PREFIXED_WITH_SOURCE_CLUSTER_ALIAS", "IDENTICAL" ]
    },
    "ConsumerGroupReplication" : {
      "description" : "Configuration relating to consumer group replication.",
      "type" : "object",
      "additionalProperties" : false,
      "properties" : {
        "ConsumerGroupsToReplicate" : {
          "description" : "List of regular expression patterns indicating the consumer groups to copy.",
          "type" : "array",
          "uniqueItems" : true,
          "insertionOrder" : false,
          "minItems" : 0,
          "maxItems" : 100,
          "items" : {
            "type" : "string",
            "maxLength" : 256
          }
        },
        "ConsumerGroupsToExclude" : {
          "description" : "List of regular expression patterns indicating the consumer groups that should not be replicated.",
          "type" : "array",
          "uniqueItems" : true,
          "insertionOrder" : false,
          "minItems" : 1,
          "maxItems" : 100,
          "items" : {
            "type" : "string",
            "maxLength" : 256
          }
        },
        "SynchroniseConsumerGroupOffsets" : {
          "description" : "Whether to periodically write the translated offsets to __consumer_offsets topic in target cluster.",
          "type" : "boolean"
        },
        "DetectAndCopyNewConsumerGroups" : {
          "description" : "Whether to periodically check for new consumer groups.",
          "type" : "boolean"
        },
        "ConsumerGroupOffsetSyncMode" : {
          "description" : "The consumer group offset synchronization mode.",
          "$ref" : "#/definitions/ConsumerGroupOffsetSyncMode"
        }
      },
      "required" : [ "ConsumerGroupsToReplicate" ]
    },
    "ConsumerGroupOffsetSyncMode" : {
      "description" : "The consumer group offset synchronization mode.",
      "type" : "string",
      "enum" : [ "LEGACY", "ENHANCED" ]
    },
    "ReplicationInfo" : {
      "description" : "Specifies configuration for replication between a source and target Kafka cluster.",
      "type" : "object",
      "additionalProperties" : false,
      "properties" : {
        "SourceKafkaClusterArn" : {
          "description" : "Amazon Resource Name of the source Kafka cluster.",
          "type" : "string",
          "pattern" : "arn:(aws|aws-us-gov|aws-cn):kafka:.*"
        },
        "SourceKafkaClusterId" : {
          "description" : "The ID of the source Kafka cluster.",
          "type" : "string"
        },
        "TargetKafkaClusterArn" : {
          "description" : "Amazon Resource Name of the target Kafka cluster.",
          "type" : "string",
          "pattern" : "arn:(aws|aws-us-gov|aws-cn):kafka:.*"
        },
        "TargetKafkaClusterId" : {
          "description" : "The ID of the target Kafka cluster.",
          "type" : "string"
        },
        "TargetCompressionType" : {
          "description" : "The type of compression to use writing records to target Kafka cluster.",
          "type" : "string",
          "enum" : [ "NONE", "GZIP", "SNAPPY", "LZ4", "ZSTD" ]
        },
        "TopicReplication" : {
          "description" : "Configuration relating to topic replication.",
          "$ref" : "#/definitions/TopicReplication"
        },
        "ConsumerGroupReplication" : {
          "description" : "Configuration relating to consumer group replication.",
          "$ref" : "#/definitions/ConsumerGroupReplication"
        }
      },
      "required" : [ "TopicReplication", "ConsumerGroupReplication", "TargetCompressionType" ]
    },
    "AmazonMskCluster" : {
      "description" : "Details of an Amazon MSK cluster.",
      "type" : "object",
      "additionalProperties" : false,
      "properties" : {
        "MskClusterArn" : {
          "description" : "The ARN of an Amazon MSK cluster.",
          "type" : "string",
          "pattern" : "arn:(aws|aws-us-gov|aws-cn):kafka:.*"
        }
      },
      "required" : [ "MskClusterArn" ]
    },
    "KafkaClusterClientVpcConfig" : {
      "description" : "Details of an Amazon VPC which has network connectivity to the Kafka cluster.",
      "type" : "object",
      "additionalProperties" : false,
      "properties" : {
        "SecurityGroupIds" : {
          "description" : "The AWS security groups to associate with the elastic network interfaces in order to specify what the replicator has access to. If a security group is not specified, the default security group associated with the VPC is used.",
          "type" : "array",
          "uniqueItems" : true,
          "insertionOrder" : false,
          "minItems" : 1,
          "maxItems" : 16,
          "items" : {
            "type" : "string"
          }
        },
        "SubnetIds" : {
          "description" : "The list of subnets to connect to in the virtual private cloud (VPC). AWS creates elastic network interfaces inside these subnets.",
          "type" : "array",
          "uniqueItems" : true,
          "insertionOrder" : false,
          "minItems" : 2,
          "maxItems" : 3,
          "items" : {
            "type" : "string"
          }
        }
      },
      "required" : [ "SubnetIds" ]
    },
    "KafkaCluster" : {
      "description" : "Details of a Kafka cluster for replication.",
      "type" : "object",
      "additionalProperties" : false,
      "properties" : {
        "AmazonMskCluster" : {
          "description" : "Details of an Amazon MSK cluster.",
          "$ref" : "#/definitions/AmazonMskCluster"
        },
        "ApacheKafkaCluster" : {
          "description" : "Details of an Apache Kafka cluster.",
          "$ref" : "#/definitions/ApacheKafkaCluster"
        },
        "VpcConfig" : {
          "description" : "Details of an Amazon VPC which has network connectivity to the Apache Kafka cluster.",
          "$ref" : "#/definitions/KafkaClusterClientVpcConfig"
        },
        "ClientAuthentication" : {
          "description" : "Details of the client authentication used by the Apache Kafka cluster.",
          "$ref" : "#/definitions/KafkaClusterClientAuthentication"
        },
        "EncryptionInTransit" : {
          "description" : "Details of encryption in transit to the Apache Kafka cluster.",
          "$ref" : "#/definitions/KafkaClusterEncryptionInTransit"
        }
      },
      "required" : [ ]
    },
    "ApacheKafkaCluster" : {
      "description" : "Details of an Apache Kafka cluster.",
      "type" : "object",
      "additionalProperties" : false,
      "properties" : {
        "ApacheKafkaClusterId" : {
          "description" : "The ID of the Apache Kafka cluster.",
          "type" : "string"
        },
        "BootstrapBrokerString" : {
          "description" : "The bootstrap broker string of the Apache Kafka cluster.",
          "type" : "string"
        }
      },
      "required" : [ "ApacheKafkaClusterId", "BootstrapBrokerString" ]
    },
    "KafkaClusterClientAuthentication" : {
      "description" : "Details of the client authentication used by the Apache Kafka cluster.",
      "type" : "object",
      "additionalProperties" : false,
      "properties" : {
        "SaslScram" : {
          "description" : "Details for SASL/SCRAM client authentication.",
          "$ref" : "#/definitions/KafkaClusterSaslScramAuthentication"
        },
        "MTLS" : {
          "description" : "Details for mTLS client authentication.",
          "$ref" : "#/definitions/KafkaClusterMtlsAuthentication"
        }
      }
    },
    "KafkaClusterMtlsAuthentication" : {
      "description" : "Details for mTLS client authentication.",
      "type" : "object",
      "additionalProperties" : false,
      "properties" : {
        "SecretArn" : {
          "description" : "The Amazon Resource Name (ARN) of the Secrets Manager secret.",
          "type" : "string"
        }
      },
      "required" : [ "SecretArn" ]
    },
    "KafkaClusterSaslScramAuthentication" : {
      "description" : "Details for SASL/SCRAM client authentication.",
      "type" : "object",
      "additionalProperties" : false,
      "properties" : {
        "Mechanism" : {
          "description" : "The SASL/SCRAM authentication mechanism.",
          "$ref" : "#/definitions/KafkaClusterSaslScramMechanism"
        },
        "SecretArn" : {
          "description" : "The Amazon Resource Name (ARN) of the Secrets Manager secret.",
          "type" : "string"
        }
      },
      "required" : [ "Mechanism", "SecretArn" ]
    },
    "KafkaClusterSaslScramMechanism" : {
      "description" : "The SASL/SCRAM authentication mechanism.",
      "type" : "string",
      "enum" : [ "SHA256", "SHA512" ]
    },
    "KafkaClusterEncryptionInTransit" : {
      "description" : "Details of encryption in transit to the Apache Kafka cluster.",
      "type" : "object",
      "additionalProperties" : false,
      "properties" : {
        "EncryptionType" : {
          "description" : "The type of encryption in transit to the Apache Kafka cluster.",
          "$ref" : "#/definitions/KafkaClusterEncryptionInTransitType"
        },
        "RootCaCertificate" : {
          "description" : "The root CA certificate.",
          "type" : "string"
        }
      },
      "required" : [ "EncryptionType" ]
    },
    "KafkaClusterEncryptionInTransitType" : {
      "description" : "The type of encryption in transit to the Apache Kafka cluster.",
      "type" : "string",
      "enum" : [ "TLS" ]
    },
    "LogDelivery" : {
      "description" : "Configuration for log delivery for the replicator.",
      "type" : "object",
      "additionalProperties" : false,
      "properties" : {
        "ReplicatorLogDelivery" : {
          "description" : "The replicator logs configuration.",
          "$ref" : "#/definitions/ReplicatorLogDelivery"
        }
      },
      "required" : [ ]
    },
    "ReplicatorLogDelivery" : {
      "description" : "Details of the log delivery for the replicator.",
      "type" : "object",
      "additionalProperties" : false,
      "properties" : {
        "CloudWatchLogs" : {
          "description" : "Details of the CloudWatch Logs destination for replicator logs.",
          "$ref" : "#/definitions/CloudWatchLogs"
        },
        "Firehose" : {
          "description" : "Details of the Kinesis Data Firehose delivery stream that is the destination for replicator logs.",
          "$ref" : "#/definitions/Firehose"
        },
        "S3" : {
          "description" : "Details of the Amazon S3 destination for replicator logs.",
          "$ref" : "#/definitions/S3"
        }
      },
      "required" : [ ]
    },
    "CloudWatchLogs" : {
      "description" : "Details about delivering logs to CloudWatch Logs.",
      "type" : "object",
      "additionalProperties" : false,
      "properties" : {
        "Enabled" : {
          "description" : "Whether log delivery to CloudWatch Logs is enabled.",
          "type" : "boolean"
        },
        "LogGroup" : {
          "description" : "The CloudWatch log group that is the destination for log delivery.",
          "type" : "string"
        }
      },
      "required" : [ "Enabled" ]
    },
    "Firehose" : {
      "description" : "Details about delivering logs to Firehose.",
      "type" : "object",
      "additionalProperties" : false,
      "properties" : {
        "Enabled" : {
          "description" : "Whether log delivery to Firehose is enabled.",
          "type" : "boolean"
        },
        "DeliveryStream" : {
          "description" : "The Firehose delivery stream that is the destination for log delivery.",
          "type" : "string"
        }
      },
      "required" : [ "Enabled" ]
    },
    "S3" : {
      "description" : "Details about delivering logs to S3.",
      "type" : "object",
      "additionalProperties" : false,
      "properties" : {
        "Enabled" : {
          "description" : "Whether log delivery to S3 is enabled.",
          "type" : "boolean"
        },
        "Bucket" : {
          "description" : "The S3 bucket that is the destination for log delivery.",
          "type" : "string"
        },
        "Prefix" : {
          "description" : "The S3 prefix that is the destination for log delivery.",
          "type" : "string"
        }
      },
      "required" : [ "Enabled" ]
    }
  },
  "required" : [ "ReplicatorName", "ReplicationInfoList", "KafkaClusters", "ServiceExecutionRoleArn" ],
  "primaryIdentifier" : [ "/properties/ReplicatorArn" ],
  "additionalIdentifiers" : [ [ "/properties/ReplicatorName" ] ],
  "readOnlyProperties" : [ "/properties/ReplicatorArn", "/properties/CurrentVersion" ],
  "createOnlyProperties" : [ "/properties/ReplicatorName", "/properties/Description", "/properties/KafkaClusters", "/properties/ServiceExecutionRoleArn", "/properties/ReplicationInfoList/*/SourceKafkaClusterArn", "/properties/ReplicationInfoList/*/SourceKafkaClusterId", "/properties/ReplicationInfoList/*/TargetKafkaClusterArn", "/properties/ReplicationInfoList/*/TargetKafkaClusterId", "/properties/ReplicationInfoList/*/TargetCompressionType", "/properties/ReplicationInfoList/*/ConsumerGroupReplication/ConsumerGroupOffsetSyncMode", "/properties/ReplicationInfoList/*/TopicReplication/StartingPosition", "/properties/ReplicationInfoList/*/TopicReplication/TopicNameConfiguration" ],
  "handlers" : {
    "create" : {
      "permissions" : [ "ec2:CreateNetworkInterface", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcs", "iam:CreateServiceLinkedRole", "iam:PassRole", "kafka:CreateReplicator", "kafka:CreateReplicatorReference", "kafka:DescribeClusterV2", "kafka:DescribeReplicator", "kafka:GetBootstrapBrokers", "kafka:ListTagsForResource", "kafka:TagResource", "logs:CreateLogDelivery", "logs:DescribeLogGroups", "logs:DescribeResourcePolicies", "logs:ListLogDeliveries", "logs:PutResourcePolicy", "s3:GetBucketPolicy", "s3:PutBucketPolicy", "firehose:TagDeliveryStream" ]
    },
    "read" : {
      "permissions" : [ "kafka:DescribeReplicator", "kafka:ListTagsForResource" ]
    },
    "update" : {
      "permissions" : [ "kafka:DescribeReplicator", "kafka:ListTagsForResource", "kafka:TagResource", "kafka:UntagResource", "kafka:UpdateReplicationInfo", "logs:CreateLogDelivery", "logs:DeleteLogDelivery", "logs:DescribeLogGroups", "logs:DescribeResourcePolicies", "logs:ListLogDeliveries", "logs:PutResourcePolicy", "s3:GetBucketPolicy", "s3:PutBucketPolicy", "firehose:TagDeliveryStream" ]
    },
    "delete" : {
      "permissions" : [ "kafka:DeleteReplicator", "kafka:DescribeReplicator", "kafka:ListTagsForResource", "kafka:UntagResource", "logs:DeleteLogDelivery", "logs:ListLogDeliveries" ]
    },
    "list" : {
      "permissions" : [ "kafka:ListReplicators" ]
    }
  }
}