{
  "typeName" : "AWS::Logs::AccountPolicy",
  "description" : "The AWS::Logs::AccountPolicy resource specifies a CloudWatch Logs AccountPolicy.",
  "sourceUrl" : "https://github.com/aws-cloudformation/aws-cloudformation-resource-providers-logs.git",
  "tagging" : {
    "taggable" : false,
    "tagOnCreate" : false,
    "tagUpdatable" : false,
    "cloudFormationSystemTags" : false
  },
  "replacementStrategy" : "delete_then_create",
  "properties" : {
    "AccountId" : {
      "description" : "User account id",
      "type" : "string",
      "pattern" : "^\\d{12}$"
    },
    "PolicyName" : {
      "description" : "The name of the account policy",
      "type" : "string",
      "minLength" : 1,
      "maxLength" : 256,
      "pattern" : "^[^:*]{1,256}$"
    },
    "PolicyDocument" : {
      "description" : "The body of the policy document you want to use for this topic.\n\nYou can only add one policy per PolicyType.\n\nThe policy must be in JSON string format.\n\nLength Constraints: Maximum length of 30720",
      "type" : "string",
      "minLength" : 1,
      "maxLength" : 30720
    },
    "PolicyType" : {
      "description" : "Type of the policy.",
      "type" : "string",
      "enum" : [ "DATA_PROTECTION_POLICY", "SUBSCRIPTION_FILTER_POLICY", "FIELD_INDEX_POLICY", "TRANSFORMER_POLICY", "METRIC_EXTRACTION_POLICY" ]
    },
    "Scope" : {
      "description" : "Scope for policy application",
      "type" : "string",
      "enum" : [ "ALL" ]
    },
    "SelectionCriteria" : {
      "description" : "Log group  selection criteria to apply policy only to a subset of log groups. SelectionCriteria string can be up to 25KB and cloudwatchlogs determines the length of selectionCriteria by using its UTF-8 bytes",
      "type" : "string"
    }
  },
  "handlers" : {
    "create" : {
      "permissions" : [ "logs:PutAccountPolicy", "logs:PutIndexPolicy", "logs:PutDataProtectionPolicy", "logs:DescribeAccountPolicies", "logs:CreateLogDelivery", "s3:REST.PUT.OBJECT", "firehose:TagDeliveryStream", "logs:PutSubscriptionFilter", "logs:DeleteSubscriptionFilter", "logs:PutTransformer", "logs:PutMetricExtractionPolicy", "iam:PassRole" ]
    },
    "read" : {
      "permissions" : [ "logs:DescribeAccountPolicies", "logs:GetTransformer", "logs:GetMetricExtractionPolicy" ]
    },
    "update" : {
      "permissions" : [ "logs:PutAccountPolicy", "logs:PutIndexPolicy", "logs:PutDataProtectionPolicy", "logs:DescribeAccountPolicies", "logs:DeleteAccountPolicy", "logs:DeleteIndexPolicy", "logs:DeleteDataProtectionPolicy", "logs:CreateLogDelivery", "logs:PutSubscriptionFilter", "logs:DeleteSubscriptionFilter", "logs:PutTransformer", "logs:DeleteTransformer", "logs:PutMetricExtractionPolicy", "logs:DeleteMetricExtractionPolicy", "s3:REST.PUT.OBJECT", "firehose:TagDeliveryStream", "iam:PassRole" ]
    },
    "delete" : {
      "permissions" : [ "logs:DeleteAccountPolicy", "logs:DeleteIndexPolicy", "logs:DeleteDataProtectionPolicy", "logs:DescribeAccountPolicies", "logs:DeleteSubscriptionFilter", "logs:DeleteTransformer", "logs:DeleteMetricExtractionPolicy", "iam:PassRole" ]
    },
    "list" : {
      "permissions" : [ "logs:DescribeAccountPolicies", "logs:GetTransformer", "logs:GetMetricExtractionPolicy" ],
      "handlerSchema" : {
        "properties" : {
          "PolicyType" : {
            "$ref" : "resource-schema.json#/properties/PolicyType"
          }
        },
        "required" : [ "PolicyType" ]
      }
    }
  },
  "required" : [ "PolicyName", "PolicyType", "PolicyDocument" ],
  "createOnlyProperties" : [ "/properties/PolicyName", "/properties/PolicyType" ],
  "readOnlyProperties" : [ "/properties/AccountId" ],
  "primaryIdentifier" : [ "/properties/AccountId", "/properties/PolicyType", "/properties/PolicyName" ],
  "additionalProperties" : false
}