{
  "typeName" : "AWS::DataSync::LocationSMB",
  "description" : "Resource Type definition for AWS::DataSync::LocationSMB.",
  "sourceUrl" : "https://github.com/aws-cloudformation/aws-cloudformation-resource-providers-datasync.git",
  "definitions" : {
    "MountOptions" : {
      "additionalProperties" : false,
      "description" : "The mount options used by DataSync to access the SMB server.",
      "type" : "object",
      "properties" : {
        "Version" : {
          "description" : "The specific SMB version that you want DataSync to use to mount your SMB share.",
          "type" : "string",
          "enum" : [ "AUTOMATIC", "SMB1", "SMB2_0", "SMB2", "SMB3" ]
        }
      }
    },
    "Tag" : {
      "additionalProperties" : false,
      "description" : "A key-value pair to associate with a resource.",
      "type" : "object",
      "properties" : {
        "Key" : {
          "type" : "string",
          "description" : "The key for an AWS resource tag.",
          "pattern" : "^[a-zA-Z0-9\\s+=._:/-]+$",
          "maxLength" : 256,
          "minLength" : 1
        },
        "Value" : {
          "type" : "string",
          "description" : "The value for an AWS resource tag.",
          "pattern" : "^[a-zA-Z0-9\\s+=._:@/-]+$",
          "maxLength" : 256,
          "minLength" : 1
        }
      },
      "required" : [ "Key", "Value" ]
    },
    "CmkSecretConfig" : {
      "additionalProperties" : false,
      "description" : "Specifies configuration information for a DataSync-managed secret, such as a password or set of credentials that DataSync uses to access a specific transfer location, and a customer-managed AWS KMS key.",
      "type" : "object",
      "properties" : {
        "SecretArn" : {
          "description" : "Specifies the ARN for an AWS Secrets Manager secret, managed by DataSync.",
          "type" : "string",
          "pattern" : "^(arn:(aws|aws-cn|aws-us-gov|aws-eusc|aws-iso|aws-iso-b):secretsmanager:[a-z-0-9]+:[0-9]{12}:secret:.*|)$",
          "maxLength" : 2048
        },
        "KmsKeyArn" : {
          "description" : "Specifies the ARN for the customer-managed AWS KMS key used to encrypt the secret specified for SecretArn. DataSync provides this key to AWS Secrets Manager.",
          "type" : "string",
          "pattern" : "^(arn:(aws|aws-cn|aws-us-gov|aws-eusc|aws-iso|aws-iso-b):kms:[a-z-0-9]+:[0-9]{12}:key/.*|)$",
          "maxLength" : 2048
        }
      }
    },
    "CustomSecretConfig" : {
      "additionalProperties" : false,
      "description" : "Specifies configuration information for a customer-managed secret, such as a password or set of credentials that DataSync uses to access a specific transfer location, and an IAM role that DataSync can assume and access the customer-managed secret.",
      "type" : "object",
      "properties" : {
        "SecretArn" : {
          "description" : "Specifies the ARN for a customer created AWS Secrets Manager secret.",
          "type" : "string",
          "pattern" : "^(arn:(aws|aws-cn|aws-us-gov|aws-eusc|aws-iso|aws-iso-b):secretsmanager:[a-z-0-9]+:[0-9]{12}:secret:.*|)$",
          "maxLength" : 2048
        },
        "SecretAccessRoleArn" : {
          "description" : "Specifies the ARN for the AWS Identity and Access Management role that DataSync uses to access the secret specified for SecretArn.",
          "type" : "string",
          "pattern" : "^(arn:(aws|aws-cn|aws-us-gov|aws-eusc|aws-iso|aws-iso-b):iam::[0-9]{12}:role/.*|)$",
          "maxLength" : 2048
        }
      },
      "required" : [ "SecretArn", "SecretAccessRoleArn" ]
    },
    "ManagedSecretConfig" : {
      "additionalProperties" : false,
      "description" : "Specifies configuration information for a DataSync-managed secret, such as a password or set of credentials that DataSync uses to access a specific transfer location. DataSync uses the default AWS-managed KMS key to encrypt this secret in AWS Secrets Manager.",
      "type" : "object",
      "properties" : {
        "SecretArn" : {
          "description" : "Specifies the ARN for an AWS Secrets Manager secret.",
          "type" : "string",
          "pattern" : "^(arn:(aws|aws-cn|aws-us-gov|aws-eusc|aws-iso|aws-iso-b):secretsmanager:[a-z-0-9]+:[0-9]{12}:secret:.*|)$",
          "maxLength" : 2048
        }
      },
      "required" : [ "SecretArn" ]
    }
  },
  "properties" : {
    "AgentArns" : {
      "description" : "The Amazon Resource Names (ARNs) of agents to use for a Simple Message Block (SMB) location.",
      "type" : "array",
      "items" : {
        "type" : "string",
        "pattern" : "^arn:(aws|aws-cn|aws-us-gov|aws-eusc|aws-iso|aws-iso-b):datasync:[a-z\\-0-9]+:[0-9]{12}:agent/agent-[0-9a-z]{17}$",
        "maxLength" : 128
      },
      "minItems" : 1,
      "maxItems" : 8,
      "insertionOrder" : false
    },
    "Domain" : {
      "description" : "The name of the Windows domain that the SMB server belongs to.",
      "type" : "string",
      "maxLength" : 253,
      "pattern" : "^([A-Za-z0-9]+[A-Za-z0-9-.]*)*[A-Za-z0-9-]*[A-Za-z0-9]$"
    },
    "MountOptions" : {
      "$ref" : "#/definitions/MountOptions",
      "default" : {
        "Version" : "AUTOMATIC"
      }
    },
    "Password" : {
      "description" : "The password of the user who can mount the share and has the permissions to access files and folders in the SMB share.",
      "type" : "string",
      "maxLength" : 104,
      "pattern" : "^.{0,104}$"
    },
    "ServerHostname" : {
      "description" : "The name of the SMB server. This value is the IP address or Domain Name Service (DNS) name of the SMB server.",
      "type" : "string",
      "maxLength" : 255,
      "pattern" : "^(([a-zA-Z0-9\\-]*[a-zA-Z0-9])\\.)*([A-Za-z0-9\\-]*[A-Za-z0-9])$"
    },
    "Subdirectory" : {
      "description" : "The subdirectory in the SMB file system that is used to read data from the SMB source location or write data to the SMB destination",
      "type" : "string",
      "maxLength" : 4096,
      "pattern" : "^[a-zA-Z0-9_\\-\\+\\./\\(\\)\\$\\p{Zs}]+$"
    },
    "User" : {
      "description" : "The user who can mount the share, has the permissions to access files and folders in the SMB share.",
      "type" : "string",
      "maxLength" : 104,
      "pattern" : "^[^\\x5B\\x5D\\\\/:;|=,+*?]{1,104}$"
    },
    "Tags" : {
      "description" : "An array of key-value pairs to apply to this resource.",
      "type" : "array",
      "maxItems" : 50,
      "uniqueItems" : true,
      "insertionOrder" : false,
      "items" : {
        "$ref" : "#/definitions/Tag"
      }
    },
    "LocationArn" : {
      "description" : "The Amazon Resource Name (ARN) of the SMB location that is created.",
      "type" : "string",
      "pattern" : "^arn:(aws|aws-cn|aws-us-gov|aws-eusc|aws-iso|aws-iso-b):datasync:[a-z\\-0-9]+:[0-9]{12}:location/loc-[0-9a-z]{17}$",
      "maxLength" : 128
    },
    "LocationUri" : {
      "description" : "The URL of the SMB location that was described.",
      "type" : "string",
      "pattern" : "^(efs|nfs|s3|smb|fsxw)://[a-zA-Z0-9./\\-]+$",
      "maxLength" : 4356
    },
    "AuthenticationType" : {
      "description" : "The authentication mode used to determine identity of user.",
      "type" : "string",
      "enum" : [ "NTLM", "KERBEROS" ]
    },
    "DnsIpAddresses" : {
      "description" : "Specifies the IPv4 addresses for the DNS servers that your SMB file server belongs to. This parameter applies only if AuthenticationType is set to KERBEROS. If you have multiple domains in your environment, configuring this parameter makes sure that DataSync connects to the right SMB file server.",
      "type" : "array",
      "items" : {
        "type" : "string",
        "pattern" : "\\A(25[0-5]|2[0-4]\\d|[0-1]?\\d?\\d)(\\.(25[0-5]|2[0-4]\\d|[0-1]?\\d?\\d)){3}\\z",
        "minLength" : 7,
        "maxLength" : 15
      },
      "insertionOrder" : true,
      "default" : null,
      "maxItems" : 2
    },
    "KerberosPrincipal" : {
      "description" : "Specifies a service principal name (SPN), which is an identity in your Kerberos realm that has permission to access the files, folders, and file metadata in your SMB file server. SPNs are case sensitive and must include a prepended cifs/. For example, an SPN might look like cifs/kerberosuser@EXAMPLE.COM. Your task execution will fail if the SPN that you provide for this parameter doesn't match exactly what's in your keytab or krb5.conf files.",
      "type" : "string",
      "pattern" : "^.+$",
      "minLength" : 1,
      "maxLength" : 256
    },
    "KerberosKeytab" : {
      "description" : "The Base64 string representation of the Keytab file. Specifies your Kerberos key table (keytab) file, which includes mappings between your service principal name (SPN) and encryption keys. To avoid task execution errors, make sure that the SPN in the keytab file matches exactly what you specify for KerberosPrincipal and in your krb5.conf file.",
      "type" : "string",
      "maxLength" : 87384
    },
    "KerberosKrb5Conf" : {
      "description" : "The string representation of the Krb5Conf file, or the presigned URL to access the Krb5.conf file within an S3 bucket. Specifies a Kerberos configuration file (krb5.conf) that defines your Kerberos realm configuration. To avoid task execution errors, make sure that the service principal name (SPN) in the krb5.conf file matches exactly what you specify for KerberosPrincipal and in your keytab file.",
      "type" : "string",
      "maxLength" : 174764
    },
    "CmkSecretConfig" : {
      "$ref" : "#/definitions/CmkSecretConfig"
    },
    "CustomSecretConfig" : {
      "$ref" : "#/definitions/CustomSecretConfig"
    },
    "ManagedSecretConfig" : {
      "$ref" : "#/definitions/ManagedSecretConfig"
    }
  },
  "tagging" : {
    "taggable" : true,
    "tagOnCreate" : true,
    "tagUpdatable" : true,
    "cloudFormationSystemTags" : true,
    "tagProperty" : "/properties/Tags",
    "permissions" : [ "datasync:TagResource", "datasync:UntagResource", "datasync:ListTagsForResource" ]
  },
  "additionalProperties" : false,
  "required" : [ "AgentArns" ],
  "readOnlyProperties" : [ "/properties/LocationArn", "/properties/LocationUri", "/properties/ManagedSecretConfig", "/properties/CmkSecretConfig/SecretArn" ],
  "primaryIdentifier" : [ "/properties/LocationArn" ],
  "writeOnlyProperties" : [ "/properties/Password", "/properties/Subdirectory", "/properties/ServerHostname", "/properties/KerberosKeytab", "/properties/KerberosKrb5Conf" ],
  "handlers" : {
    "create" : {
      "permissions" : [ "datasync:CreateLocationSmb", "datasync:DescribeLocationSmb", "datasync:ListTagsForResource", "datasync:TagResource", "secretsmanager:CreateSecret", "secretsmanager:PutSecretValue", "secretsmanager:DeleteSecret", "iam:CreateServiceLinkedRole", "iam:PassRole", "kms:Encrypt", "kms:Decrypt", "kms:GenerateDataKey" ]
    },
    "read" : {
      "permissions" : [ "datasync:DescribeLocationSmb", "datasync:ListTagsForResource" ]
    },
    "update" : {
      "permissions" : [ "datasync:DescribeLocationSmb", "datasync:ListTagsForResource", "datasync:TagResource", "datasync:UntagResource", "datasync:UpdateLocationSmb", "secretsmanager:UpdateSecret", "secretsmanager:DeleteSecret", "secretsmanager:PutSecretValue", "secretsmanager:CreateSecret", "iam:CreateServiceLinkedRole", "iam:PassRole", "kms:Encrypt", "kms:Decrypt", "kms:GenerateDataKey" ]
    },
    "delete" : {
      "permissions" : [ "datasync:DeleteLocation", "secretsmanager:DeleteSecret" ]
    },
    "list" : {
      "permissions" : [ "datasync:ListLocations" ]
    }
  }
}