{
  "typeName" : "AWS::CloudFormation::GuardHook",
  "description" : "This is a CloudFormation resource for activating the first-party AWS::Hooks::GuardHook.",
  "sourceUrl" : "https://github.com/aws-cloudformation/aws-cloudformation-rpdk.git",
  "definitions" : {
    "S3Location" : {
      "description" : "S3 Source Location for the Guard files.",
      "type" : "object",
      "properties" : {
        "Uri" : {
          "description" : "S3 uri of Guard files.",
          "type" : "string"
        },
        "VersionId" : {
          "description" : "S3 object version",
          "type" : "string"
        }
      },
      "additionalProperties" : false,
      "required" : [ "Uri" ]
    },
    "Role" : {
      "description" : "IAM Role ARN",
      "pattern" : "arn:.+:iam::[0-9]{12}:role/.+",
      "type" : "string",
      "maxLength" : 256
    },
    "StackRole" : {
      "description" : "IAM Stack Role ARN filter",
      "type" : "string",
      "maxLength" : 256,
      "anyOf" : [ {
        "pattern" : "arn:.+:iam::[0-9]{12}:role/.+"
      }, {
        "pattern" : "^(arn:.+:iam::((?!\\*|\\?)[0-9]{12}|(?=.*\\*)[0-9*?]{1,12}|[0-9?]{12}):role/.+|\\*)$"
      } ]
    },
    "StackName" : {
      "pattern" : "^[a-zA-Z*?][-a-zA-Z0-9*?]*$",
      "description" : "CloudFormation Stack name",
      "type" : "string",
      "maxLength" : 128
    },
    "TargetOperation" : {
      "description" : "Which operations should this Hook run against? Resource changes, stacks or change sets.",
      "type" : "string",
      "enum" : [ "RESOURCE", "STACK", "CHANGE_SET", "CLOUD_CONTROL" ]
    },
    "TargetName" : {
      "description" : "Type name of hook target. Hook targets are the destination where hooks will be invoked against.",
      "type" : "string",
      "pattern" : "^(?!.*\\*\\?).*$",
      "minLength" : 1,
      "maxLength" : 256
    },
    "Action" : {
      "description" : "Target actions are the type of operation hooks will be executed at.",
      "type" : "string",
      "enum" : [ "CREATE", "UPDATE", "DELETE" ]
    },
    "InvocationPoint" : {
      "description" : "Invocation points are the point in provisioning workflow where hooks will be executed.",
      "type" : "string",
      "enum" : [ "PRE_PROVISION" ]
    },
    "HookTarget" : {
      "description" : "Hook targets are the destination where hooks will be invoked against.",
      "type" : "object",
      "properties" : {
        "TargetName" : {
          "$ref" : "#/definitions/TargetName"
        },
        "Action" : {
          "$ref" : "#/definitions/Action"
        },
        "InvocationPoint" : {
          "$ref" : "#/definitions/InvocationPoint"
        }
      },
      "additionalProperties" : false,
      "required" : [ "TargetName", "Action", "InvocationPoint" ]
    }
  },
  "properties" : {
    "RuleLocation" : {
      "$ref" : "#/definitions/S3Location"
    },
    "LogBucket" : {
      "description" : "S3 Bucket where the guard validate report will be uploaded to",
      "type" : "string"
    },
    "HookStatus" : {
      "default" : "DISABLED",
      "description" : "Attribute to specify which stacks this hook applies to or should get invoked for",
      "type" : "string",
      "enum" : [ "ENABLED", "DISABLED" ]
    },
    "TargetOperations" : {
      "description" : "Which operations should this Hook run against? Resource changes, stacks or change sets.",
      "type" : "array",
      "uniqueItems" : true,
      "items" : {
        "$ref" : "#/definitions/TargetOperation"
      }
    },
    "FailureMode" : {
      "default" : "WARN",
      "description" : "Attribute to specify CloudFormation behavior on hook failure.",
      "type" : "string",
      "enum" : [ "FAIL", "WARN" ]
    },
    "TargetFilters" : {
      "description" : "Attribute to specify which targets should invoke the hook",
      "type" : "object",
      "oneOf" : [ {
        "type" : "object",
        "minProperties" : 1,
        "properties" : {
          "TargetNames" : {
            "description" : "List of type names that the hook is going to target",
            "type" : "array",
            "minItems" : 1,
            "maxItems" : 50,
            "uniqueItems" : true,
            "insertionOrder" : false,
            "items" : {
              "$ref" : "#/definitions/TargetName"
            }
          },
          "Actions" : {
            "description" : "List of actions that the hook is going to target",
            "type" : "array",
            "minItems" : 1,
            "maxItems" : 50,
            "uniqueItems" : true,
            "insertionOrder" : false,
            "items" : {
              "$ref" : "#/definitions/Action"
            }
          },
          "InvocationPoints" : {
            "description" : "List of invocation points that the hook is going to target",
            "type" : "array",
            "minItems" : 1,
            "maxItems" : 50,
            "uniqueItems" : true,
            "insertionOrder" : false,
            "items" : {
              "$ref" : "#/definitions/InvocationPoint"
            }
          }
        },
        "additionalProperties" : false
      }, {
        "type" : "object",
        "properties" : {
          "Targets" : {
            "description" : "List of hook targets",
            "type" : "array",
            "minItems" : 1,
            "maxItems" : 50,
            "uniqueItems" : true,
            "items" : {
              "$ref" : "#/definitions/HookTarget"
            }
          }
        },
        "additionalProperties" : false,
        "required" : [ "Targets" ]
      } ]
    },
    "StackFilters" : {
      "description" : "Filters to allow hooks to target specific stack attributes",
      "type" : "object",
      "properties" : {
        "FilteringCriteria" : {
          "description" : "Attribute to specify the filtering behavior. ANY will make the Hook pass if one filter matches. ALL will make the Hook pass if all filters match",
          "type" : "string",
          "default" : "ALL",
          "enum" : [ "ALL", "ANY" ]
        },
        "StackNames" : {
          "description" : "List of stack names as filters",
          "type" : "object",
          "additionalProperties" : false,
          "minProperties" : 1,
          "properties" : {
            "Include" : {
              "description" : "List of stack names that the hook is going to target",
              "type" : "array",
              "maxItems" : 50,
              "minItems" : 1,
              "uniqueItems" : true,
              "insertionOrder" : false,
              "items" : {
                "$ref" : "#/definitions/StackName"
              }
            },
            "Exclude" : {
              "description" : "List of stack names that the hook is going to be excluded from",
              "type" : "array",
              "maxItems" : 50,
              "minItems" : 1,
              "uniqueItems" : true,
              "insertionOrder" : false,
              "items" : {
                "$ref" : "#/definitions/StackName"
              }
            }
          }
        },
        "StackRoles" : {
          "description" : "List of stack roles that are performing the stack operations.",
          "type" : "object",
          "additionalProperties" : false,
          "minProperties" : 1,
          "properties" : {
            "Include" : {
              "description" : "List of stack roles that the hook is going to target",
              "type" : "array",
              "maxItems" : 50,
              "minItems" : 1,
              "uniqueItems" : true,
              "insertionOrder" : false,
              "items" : {
                "$ref" : "#/definitions/StackRole"
              }
            },
            "Exclude" : {
              "description" : "List of stack roles that the hook is going to be excluded from",
              "type" : "array",
              "maxItems" : 50,
              "minItems" : 1,
              "uniqueItems" : true,
              "insertionOrder" : false,
              "items" : {
                "$ref" : "#/definitions/StackRole"
              }
            }
          }
        }
      },
      "required" : [ "FilteringCriteria" ],
      "additionalProperties" : false
    },
    "Alias" : {
      "description" : "The typename alias for the hook.",
      "pattern" : "^(?!(?i)aws)[A-Za-z0-9]{2,64}::[A-Za-z0-9]{2,64}::[A-Za-z0-9]{2,64}$",
      "type" : "string"
    },
    "HookArn" : {
      "description" : "The Amazon Resource Name (ARN) of the activated hook",
      "pattern" : "^arn:aws[A-Za-z0-9-]{0,64}:cloudformation:[A-Za-z0-9-]{1,64}:([0-9]{12})?:type/hook/.+$",
      "type" : "string"
    },
    "ExecutionRole" : {
      "description" : "The execution role ARN assumed by hooks to read Guard rules from S3 and write Guard outputs to S3.",
      "$ref" : "#/definitions/Role"
    },
    "Options" : {
      "properties" : {
        "InputParams" : {
          "description" : "Specifies the S3 location of input parameter files for your Guard rules. You can specify either a single S3 location or an array of up to 10 S3 locations.",
          "oneOf" : [ {
            "$ref" : "#/definitions/S3Location"
          }, {
            "type" : "array",
            "minItems" : 1,
            "maxItems" : 10,
            "items" : {
              "$ref" : "#/definitions/S3Location"
            }
          } ]
        }
      },
      "required" : [ ],
      "additionalProperties" : false
    }
  },
  "additionalProperties" : false,
  "readOnlyProperties" : [ "/properties/HookArn" ],
  "required" : [ "RuleLocation", "HookStatus", "TargetOperations", "FailureMode", "Alias", "ExecutionRole" ],
  "createOnlyProperties" : [ "/properties/ExecutionRole", "/properties/Alias" ],
  "primaryIdentifier" : [ "/properties/HookArn" ],
  "tagging" : {
    "taggable" : false,
    "tagOnCreate" : false,
    "tagUpdatable" : false,
    "cloudFormationSystemTags" : false
  },
  "handlers" : {
    "create" : {
      "permissions" : [ "cloudformation:ActivateType", "cloudformation:DescribeType", "cloudformation:ListTypes", "cloudformation:SetTypeConfiguration", "cloudformation:BatchDescribeTypeConfigurations", "iam:PassRole" ]
    },
    "read" : {
      "permissions" : [ "cloudformation:DescribeType", "cloudformation:BatchDescribeTypeConfigurations" ]
    },
    "update" : {
      "permissions" : [ "cloudformation:BatchDescribeTypeConfigurations", "cloudformation:DescribeType", "cloudformation:SetTypeConfiguration", "iam:PassRole" ]
    },
    "delete" : {
      "permissions" : [ "cloudformation:BatchDescribeTypeConfigurations", "cloudformation:DescribeType", "cloudformation:DeactivateType", "cloudformation:SetTypeConfiguration" ]
    },
    "list" : {
      "permissions" : [ "cloudformation:ListTypes", "cloudformation:DescribeType", "cloudformation:BatchDescribeTypeConfigurations" ]
    }
  }
}