{
  "typeName" : "AWS::OSIS::Pipeline",
  "description" : "An OpenSearch Ingestion Service Data Prepper pipeline running Data Prepper.",
  "sourceUrl" : "https://github.com/aws-cloudformation/aws-cloudformation-resource-providers-osis.git",
  "definitions" : {
    "BufferOptions" : {
      "description" : "Key-value pairs to configure buffering.",
      "type" : "object",
      "properties" : {
        "PersistentBufferEnabled" : {
          "type" : "boolean",
          "description" : "Whether persistent buffering should be enabled."
        }
      },
      "required" : [ "PersistentBufferEnabled" ],
      "additionalProperties" : false
    },
    "EncryptionAtRestOptions" : {
      "description" : "Key-value pairs to configure encryption at rest.",
      "type" : "object",
      "properties" : {
        "KmsKeyArn" : {
          "type" : "string",
          "description" : "The KMS key to use for encrypting data. By default an AWS owned key is used"
        }
      },
      "required" : [ "KmsKeyArn" ],
      "additionalProperties" : false
    },
    "LogPublishingOptions" : {
      "description" : "Key-value pairs to configure log publishing.",
      "type" : "object",
      "properties" : {
        "IsLoggingEnabled" : {
          "type" : "boolean",
          "description" : "Whether logs should be published."
        },
        "CloudWatchLogDestination" : {
          "type" : "object",
          "description" : "The destination for OpenSearch Ingestion Service logs sent to Amazon CloudWatch.",
          "properties" : {
            "LogGroup" : {
              "type" : "string",
              "minLength" : 1,
              "maxLength" : 512,
              "pattern" : "\\/aws\\/vendedlogs\\/[\\.\\-_/#A-Za-z0-9]+"
            }
          },
          "required" : [ "LogGroup" ],
          "additionalProperties" : false
        }
      },
      "additionalProperties" : false
    },
    "Tag" : {
      "description" : "A key-value pair to associate with a resource.",
      "type" : "object",
      "properties" : {
        "Key" : {
          "type" : "string",
          "description" : "The key name of the tag. You can specify a value that is 1 to 128 Unicode characters in length and cannot be prefixed with aws:. You can use any of the following characters: the set of Unicode letters, digits, whitespace, _, ., /, =, +, and -.",
          "minLength" : 1,
          "maxLength" : 128
        },
        "Value" : {
          "type" : "string",
          "description" : "The value for the tag. You can specify a value that is 0 to 256 Unicode characters in length and cannot be prefixed with aws:. You can use any of the following characters: the set of Unicode letters, digits, whitespace, _, ., /, =, +, and -.",
          "minLength" : 0,
          "maxLength" : 256
        }
      },
      "required" : [ "Key", "Value" ],
      "additionalProperties" : false
    },
    "VpcOptions" : {
      "description" : "Container for the values required to configure VPC access for the pipeline. If you don't specify these values, OpenSearch Ingestion Service creates the pipeline with a public endpoint.",
      "type" : "object",
      "properties" : {
        "SecurityGroupIds" : {
          "type" : "array",
          "insertionOrder" : false,
          "description" : "A list of security groups associated with the VPC endpoint.",
          "items" : {
            "type" : "string",
            "minLength" : 11,
            "maxLength" : 20,
            "pattern" : "sg-\\w{8}(\\w{9})?"
          }
        },
        "SubnetIds" : {
          "type" : "array",
          "insertionOrder" : false,
          "description" : "A list of subnet IDs associated with the VPC endpoint.",
          "items" : {
            "type" : "string",
            "minLength" : 15,
            "maxLength" : 24,
            "pattern" : "subnet-\\w{8}(\\w{9})?"
          }
        },
        "VpcEndpointManagement" : {
          "description" : "Defines whether you or Amazon OpenSearch Ingestion service create and manage the VPC endpoint configured for the pipeline.",
          "type" : "string",
          "enum" : [ "CUSTOMER", "SERVICE" ]
        },
        "VpcAttachmentOptions" : {
          "type" : "object",
          "description" : "Options for attaching a VPC to the pipeline.",
          "properties" : {
            "AttachToVpc" : {
              "type" : "boolean",
              "description" : "Whether the pipeline should be attached to the provided VPC"
            },
            "CidrBlock" : {
              "type" : "string",
              "description" : "The CIDR block to be reserved for OpenSearch Ingestion to create elastic network interfaces (ENIs).",
              "pattern" : "^((25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\\.){3}(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)/(3[0-2]|[12]?[0-9])$"
            }
          },
          "required" : [ "AttachToVpc", "CidrBlock" ],
          "additionalProperties" : false
        }
      },
      "required" : [ "SubnetIds" ],
      "additionalProperties" : false
    },
    "VpcEndpoint" : {
      "description" : "An OpenSearch Ingestion Service-managed VPC endpoint that will access one or more pipelines.",
      "type" : "object",
      "properties" : {
        "VpcEndpointId" : {
          "type" : "string",
          "description" : "The unique identifier of the endpoint."
        },
        "VpcId" : {
          "type" : "string",
          "description" : "The ID for your VPC. AWS Privatelink generates this value when you create a VPC."
        },
        "VpcOptions" : {
          "$ref" : "#/definitions/VpcOptions"
        }
      },
      "additionalProperties" : false
    },
    "ResourcePolicy" : {
      "type" : "object",
      "additionalProperties" : false,
      "properties" : {
        "Policy" : {
          "type" : "object"
        }
      },
      "required" : [ "Policy" ]
    }
  },
  "properties" : {
    "BufferOptions" : {
      "$ref" : "#/definitions/BufferOptions"
    },
    "EncryptionAtRestOptions" : {
      "$ref" : "#/definitions/EncryptionAtRestOptions"
    },
    "LogPublishingOptions" : {
      "$ref" : "#/definitions/LogPublishingOptions"
    },
    "MaxUnits" : {
      "description" : "The maximum pipeline capacity, in Ingestion OpenSearch Compute Units (OCUs).",
      "type" : "integer",
      "minimum" : 1,
      "maximum" : 384
    },
    "MinUnits" : {
      "description" : "The minimum pipeline capacity, in Ingestion OpenSearch Compute Units (OCUs).",
      "type" : "integer",
      "minimum" : 1,
      "maximum" : 384
    },
    "PipelineConfigurationBody" : {
      "description" : "The Data Prepper pipeline configuration.",
      "type" : "string",
      "minLength" : 1,
      "maxLength" : 100000
    },
    "PipelineName" : {
      "description" : "Name of the OpenSearch Ingestion Service pipeline to create. Pipeline names are unique across the pipelines owned by an account within an AWS Region.",
      "type" : "string",
      "minLength" : 3,
      "maxLength" : 28,
      "pattern" : "[a-z][a-z0-9\\-]+"
    },
    "Tags" : {
      "description" : "An array of key-value pairs to apply to this resource.",
      "type" : "array",
      "uniqueItems" : true,
      "insertionOrder" : false,
      "items" : {
        "$ref" : "#/definitions/Tag"
      }
    },
    "VpcOptions" : {
      "$ref" : "#/definitions/VpcOptions"
    },
    "VpcEndpoints" : {
      "type" : "array",
      "insertionOrder" : false,
      "description" : "The VPC interface endpoints that have access to the pipeline.",
      "items" : {
        "$ref" : "#/definitions/VpcEndpoint"
      }
    },
    "VpcEndpointService" : {
      "description" : "The VPC endpoint service name for the pipeline.",
      "type" : "string",
      "minLength" : 1,
      "maxLength" : 128
    },
    "PipelineArn" : {
      "description" : "The Amazon Resource Name (ARN) of the pipeline.",
      "type" : "string",
      "minLength" : 46,
      "maxLength" : 78,
      "pattern" : "^arn:(aws|aws\\-cn|aws\\-us\\-gov|aws\\-iso|aws\\-iso\\-b):osis:.+:pipeline\\/.+$"
    },
    "PipelineRoleArn" : {
      "description" : "The Pipeline Role (ARN) for the pipeline.",
      "type" : "string",
      "minLength" : 20,
      "maxLength" : 2048,
      "pattern" : "^arn:(aws|aws\\-cn|aws\\-us\\-gov|aws\\-iso|aws\\-iso\\-b|aws\\-iso\\-e|aws\\-iso\\-f):iam::[0-9]+:role\\/.*$"
    },
    "IngestEndpointUrls" : {
      "type" : "array",
      "insertionOrder" : false,
      "description" : "A list of endpoints that can be used for ingesting data into a pipeline",
      "items" : {
        "type" : "string"
      }
    },
    "ResourcePolicy" : {
      "$ref" : "#/definitions/ResourcePolicy"
    }
  },
  "additionalProperties" : false,
  "required" : [ "MaxUnits", "MinUnits", "PipelineConfigurationBody", "PipelineName" ],
  "readOnlyProperties" : [ "/properties/PipelineArn", "/properties/IngestEndpointUrls", "/properties/VpcEndpoints", "/properties/VpcEndpointService" ],
  "writeOnlyProperties" : [ "/properties/VpcOptions" ],
  "createOnlyProperties" : [ "/properties/PipelineName" ],
  "primaryIdentifier" : [ "/properties/PipelineArn" ],
  "tagging" : {
    "taggable" : true,
    "tagOnCreate" : true,
    "tagUpdatable" : true,
    "cloudFormationSystemTags" : true,
    "tagProperty" : "/properties/Tags",
    "permissions" : [ "osis:TagResource", "osis:UntagResource", "osis:ListTagsForResource" ]
  },
  "handlers" : {
    "create" : {
      "permissions" : [ "osis:CreatePipeline", "osis:GetPipeline", "osis:TagResource", "osis:ListTagsForResource", "osis:GetResourcePolicy", "osis:PutResourcePolicy", "iam:PassRole", "iam:CreateServiceLinkedRole", "logs:CreateLogDelivery", "kms:DescribeKey" ]
    },
    "read" : {
      "permissions" : [ "osis:GetPipeline", "osis:ListTagsForResource", "osis:GetResourcePolicy" ]
    },
    "update" : {
      "permissions" : [ "osis:UpdatePipeline", "osis:GetPipeline", "osis:ListTagsForResource", "osis:TagResource", "osis:UntagResource", "osis:GetResourcePolicy", "osis:PutResourcePolicy", "osis:DeleteResourcePolicy", "iam:PassRole", "logs:GetLogDelivery", "logs:UpdateLogDelivery", "logs:ListLogDeliveries", "kms:DescribeKey" ]
    },
    "delete" : {
      "permissions" : [ "osis:DeletePipeline", "osis:GetPipeline", "logs:GetLogDelivery", "logs:DeleteLogDelivery", "logs:ListLogDeliveries" ]
    },
    "list" : {
      "permissions" : [ "osis:ListPipelines" ]
    }
  }
}