{
  "typeName" : "AWS::SecurityLake::DataLake",
  "description" : "Resource Type definition for AWS::SecurityLake::DataLake",
  "sourceUrl" : "https://github.com/aws-cloudformation/aws-cloudformation-resource-providers-securitylake.git",
  "additionalProperties" : false,
  "definitions" : {
    "EncryptionConfiguration" : {
      "description" : "Provides encryption details of Amazon Security Lake object.",
      "type" : "object",
      "additionalProperties" : false,
      "properties" : {
        "KmsKeyId" : {
          "description" : "The id of KMS encryption key used by Amazon Security Lake to encrypt the Security Lake object.",
          "type" : "string"
        }
      }
    },
    "LifecycleConfiguration" : {
      "description" : "Provides lifecycle details of Amazon Security Lake object.",
      "type" : "object",
      "additionalProperties" : false,
      "properties" : {
        "Expiration" : {
          "$ref" : "#/definitions/Expiration"
        },
        "Transitions" : {
          "description" : "Provides data storage transition details of Amazon Security Lake object.",
          "type" : "array",
          "uniqueItems" : false,
          "insertionOrder" : false,
          "items" : {
            "$ref" : "#/definitions/Transitions"
          }
        }
      }
    },
    "Expiration" : {
      "description" : "Provides data expiration details of Amazon Security Lake object.",
      "type" : "object",
      "additionalProperties" : false,
      "properties" : {
        "Days" : {
          "$ref" : "#/definitions/Days"
        }
      }
    },
    "Days" : {
      "description" : "Number of days before data expires in the Amazon Security Lake object.",
      "type" : "integer",
      "minimum" : 1
    },
    "Transitions" : {
      "type" : "object",
      "additionalProperties" : false,
      "properties" : {
        "Days" : {
          "description" : "Number of days before data transitions to a different S3 Storage Class in the Amazon Security Lake object.",
          "type" : "integer",
          "minimum" : 1
        },
        "StorageClass" : {
          "description" : "The range of storage classes that you can choose from based on the data access, resiliency, and cost requirements of your workloads.",
          "type" : "string"
        }
      }
    },
    "ReplicationConfiguration" : {
      "description" : "Provides replication details of Amazon Security Lake object.",
      "type" : "object",
      "additionalProperties" : false,
      "properties" : {
        "Regions" : {
          "$ref" : "#/definitions/Regions"
        },
        "RoleArn" : {
          "description" : "Replication settings for the Amazon S3 buckets. This parameter uses the AWS Identity and Access Management (IAM) role you created that is managed by Security Lake, to ensure the replication setting is correct.",
          "type" : "string",
          "pattern" : "^arn:.*$"
        }
      }
    },
    "Regions" : {
      "description" : "Replication enables automatic, asynchronous copying of objects across Amazon S3 buckets. Amazon S3 buckets that are configured for object replication can be owned by the same AWS account or by different accounts. You can replicate objects to a single destination bucket or to multiple destination buckets. The destination buckets can be in different AWS Regions or within the same Region as the source bucket.",
      "type" : "array",
      "uniqueItems" : true,
      "insertionOrder" : false,
      "items" : {
        "type" : "string",
        "pattern" : "^(us(-gov)?|af|ap|ca|eu|me|sa)-(central|north|(north(?:east|west))|south|south(?:east|west)|east|west)-\\d+$"
      }
    },
    "Tag" : {
      "description" : "A key-value pair to associate with a resource.",
      "type" : "object",
      "additionalProperties" : false,
      "properties" : {
        "Key" : {
          "type" : "string",
          "description" : "The key name of the tag. You can specify a value that is 1 to 128 Unicode characters in length and cannot be prefixed with aws:. You can use any of the following characters: the set of Unicode letters, digits, whitespace, `_`, `.`, `/`, `=`, `+`, and `-`."
        },
        "Value" : {
          "type" : "string",
          "description" : "The value for the tag. You can specify a value that is 0 to 256 characters in length."
        }
      },
      "required" : [ "Key", "Value" ]
    }
  },
  "properties" : {
    "EncryptionConfiguration" : {
      "$ref" : "#/definitions/EncryptionConfiguration"
    },
    "LifecycleConfiguration" : {
      "$ref" : "#/definitions/LifecycleConfiguration"
    },
    "ReplicationConfiguration" : {
      "$ref" : "#/definitions/ReplicationConfiguration"
    },
    "MetaStoreManagerRoleArn" : {
      "description" : "The Amazon Resource Name (ARN) used to index AWS Glue table partitions that are generated by the ingestion and normalization of AWS log sources and custom sources.",
      "type" : "string",
      "pattern" : "^arn:.*$"
    },
    "Tags" : {
      "type" : "array",
      "uniqueItems" : false,
      "insertionOrder" : false,
      "items" : {
        "$ref" : "#/definitions/Tag"
      }
    },
    "Arn" : {
      "description" : "The Amazon Resource Name (ARN) created by you to provide to the subscriber.",
      "type" : "string",
      "minLength" : 1,
      "maxLength" : 1011
    },
    "S3BucketArn" : {
      "description" : "The ARN for the Amazon Security Lake Amazon S3 bucket.",
      "type" : "string"
    }
  },
  "primaryIdentifier" : [ "/properties/Arn" ],
  "readOnlyProperties" : [ "/properties/Arn", "/properties/S3BucketArn" ],
  "writeOnlyProperties" : [ "/properties/MetaStoreManagerRoleArn" ],
  "tagging" : {
    "taggable" : true,
    "tagOnCreate" : true,
    "tagUpdatable" : true,
    "cloudFormationSystemTags" : true,
    "tagProperty" : "/properties/Tags",
    "permissions" : [ "securitylake:TagResource", "securitylake:UntagResource", "securitylake:ListTagsForResource" ]
  },
  "replacementStrategy" : "delete_then_create",
  "handlers" : {
    "create" : {
      "permissions" : [ "events:*", "iam:CreateServiceLinkedRole", "iam:GetRole", "iam:ListAttachedRolePolicies", "iam:PutRolePolicy", "iam:PassRole", "glue:*", "organizations:*", "kms:DescribeKey", "kms:CreateGrant", "lakeformation:*", "lambda:*", "s3:*", "securitylake:CreateDataLake", "securitylake:TagResource", "securitylake:List*", "sqs:*" ]
    },
    "update" : {
      "permissions" : [ "events:*", "iam:CreateServiceLinkedRole", "iam:DeleteRolePolicy", "iam:GetRole", "iam:PassRole", "iam:PutRolePolicy", "kms:DescribeKey", "kms:CreateGrant", "lakeformation:*", "lambda:*", "organizations:*", "s3:*", "securitylake:List*", "securitylake:TagResource", "securitylake:UntagResource", "securitylake:UpdateDataLake", "sqs:*" ]
    },
    "delete" : {
      "permissions" : [ "organizations:*", "securitylake:DeleteDataLake", "securitylake:List*" ]
    },
    "read" : {
      "permissions" : [ "securitylake:List*" ]
    },
    "list" : {
      "permissions" : [ "securitylake:List*" ]
    }
  }
}