{
  "typeName" : "AWS::ControlTower::LandingZone",
  "description" : "Definition of AWS::ControlTower::LandingZone Resource Type",
  "definitions" : {
    "LandingZoneDriftStatus" : {
      "type" : "string",
      "enum" : [ "DRIFTED", "IN_SYNC" ]
    },
    "LandingZoneStatus" : {
      "type" : "string",
      "enum" : [ "ACTIVE", "PROCESSING", "FAILED" ]
    },
    "RemediationTypes" : {
      "type" : "array",
      "items" : {
        "type" : "string",
        "enum" : [ "INHERITANCE_DRIFT" ]
      }
    },
    "Tag" : {
      "type" : "object",
      "properties" : {
        "Key" : {
          "type" : "string",
          "maxLength" : 256,
          "minLength" : 1
        },
        "Value" : {
          "type" : "string",
          "maxLength" : 256,
          "minLength" : 0
        }
      },
      "additionalProperties" : false
    }
  },
  "properties" : {
    "LandingZoneIdentifier" : {
      "type" : "string"
    },
    "Arn" : {
      "type" : "string",
      "maxLength" : 2048,
      "minLength" : 20,
      "pattern" : "^arn:aws[0-9a-zA-Z_\\-:\\/]+$"
    },
    "Status" : {
      "$ref" : "#/definitions/LandingZoneStatus"
    },
    "LatestAvailableVersion" : {
      "type" : "string",
      "maxLength" : 10,
      "minLength" : 3,
      "pattern" : "\\d+.\\d+"
    },
    "DriftStatus" : {
      "$ref" : "#/definitions/LandingZoneDriftStatus"
    },
    "Manifest" : { },
    "Version" : {
      "type" : "string",
      "maxLength" : 10,
      "minLength" : 3,
      "pattern" : "\\d+.\\d+"
    },
    "RemediationTypes" : {
      "$ref" : "#/definitions/RemediationTypes"
    },
    "Tags" : {
      "type" : "array",
      "items" : {
        "$ref" : "#/definitions/Tag"
      }
    }
  },
  "required" : [ "Manifest", "Version" ],
  "readOnlyProperties" : [ "/properties/LandingZoneIdentifier", "/properties/Arn", "/properties/Status", "/properties/LatestAvailableVersion", "/properties/DriftStatus" ],
  "primaryIdentifier" : [ "/properties/LandingZoneIdentifier" ],
  "tagging" : {
    "taggable" : true,
    "tagOnCreate" : true,
    "tagUpdatable" : true,
    "cloudFormationSystemTags" : true,
    "tagProperty" : "/properties/Tags",
    "permissions" : [ "controltower:UntagResource", "controltower:TagResource", "controltower:ListTagsForResource" ]
  },
  "handlers" : {
    "create" : {
      "permissions" : [ "controltower:CreateLandingZone", "controltower:GetLandingZoneOperation", "controltower:ListTagsForResource", "controltower:TagResource", "controltower:GetLandingZone", "cloudformation:DescribeOrganizationsAccess", "servicecatalog:AssociatePrincipalWithPortfolio", "servicecatalog:AssociateProductWithPortfolio", "servicecatalog:CreatePortfolio", "servicecatalog:CreateProduct", "servicecatalog:CreateProvisioningArtifact", "servicecatalog:ListPortfolios", "servicecatalog:ListProvisioningArtifacts", "servicecatalog:SearchProductsAsAdmin", "servicecatalog:UpdatePortfolio", "servicecatalog:UpdateProvisioningArtifact", "servicecatalog:ListPrincipalsForPortfolio", "organizations:CreateOrganizationalUnit", "organizations:CreateOrganization", "organizations:UpdatePolicy", "organizations:CreatePolicy", "organizations:AttachPolicy", "organizations:DetachPolicy", "organizations:DeletePolicy", "organizations:EnablePolicyType", "organizations:EnableAWSServiceAccess", "organizations:ListRoots", "sso:GetPeregrineStatus", "sso:ListDirectoryAssociations", "sso:StartPeregrine", "iam:CreateServiceLinkedRole", "cloudformation:EnableOrganizationsAccess", "sso:RegisterRegion" ]
    },
    "read" : {
      "permissions" : [ "controltower:GetLandingZone", "controltower:ListTagsForResource" ]
    },
    "update" : {
      "permissions" : [ "controltower:UpdateLandingZone", "controltower:GetLandingZoneOperation", "controltower:ListTagsForResource", "controltower:TagResource", "controltower:GetLandingZone", "controltower:UntagResource", "cloudformation:DescribeOrganizationsAccess", "servicecatalog:AssociatePrincipalWithPortfolio", "servicecatalog:AssociateProductWithPortfolio", "servicecatalog:CreatePortfolio", "servicecatalog:CreateProduct", "servicecatalog:CreateProvisioningArtifact", "servicecatalog:ListPortfolios", "servicecatalog:ListProvisioningArtifacts", "servicecatalog:SearchProductsAsAdmin", "servicecatalog:UpdatePortfolio", "servicecatalog:UpdateProvisioningArtifact", "servicecatalog:ListPrincipalsForPortfolio", "organizations:CreateOrganizationalUnit", "organizations:CreateOrganization", "organizations:UpdatePolicy", "organizations:CreatePolicy", "organizations:AttachPolicy", "organizations:DetachPolicy", "organizations:DeletePolicy", "organizations:EnablePolicyType", "organizations:EnableAWSServiceAccess", "organizations:ListRoots", "sso:GetPeregrineStatus", "iam:CreateServiceLinkedRole", "cloudformation:EnableOrganizationsAccess", "sso:ListDirectoryAssociations", "sso:StartPeregrine", "sso:RegisterRegion" ]
    },
    "delete" : {
      "permissions" : [ "controltower:DeleteLandingZone", "controltower:GetLandingZone", "controltower:GetLandingZoneOperation", "cloudformation:DescribeOrganizationsAccess", "servicecatalog:ListPortfolios", "servicecatalog:ListProvisioningArtifacts", "servicecatalog:SearchProductsAsAdmin", "servicecatalog:DeleteProvisioningArtifact", "servicecatalog:ListPrincipalsForPortfolio", "servicecatalog:DeleteProduct", "servicecatalog:DisassociatePrincipalFromPortfolio", "servicecatalog:DisassociateProductFromPortfolio", "servicecatalog:DeletePortfolio", "organizations:AttachPolicy", "organizations:DetachPolicy", "organizations:DeletePolicy", "organizations:ListRoots", "sso:GetPeregrineStatus", "sso:ListDirectoryAssociations", "iam:CreateServiceLinkedRole", "iam:DeleteRolePolicy", "iam:DetachRolePolicy", "cloudformation:EnableOrganizationsAccess", "iam:DeleteRole" ]
    },
    "list" : {
      "permissions" : [ "controltower:ListLandingZones" ]
    }
  },
  "additionalProperties" : false
}