{
  "typeName" : "AWS::BedrockAgentCore::BrowserCustom",
  "description" : "Resource definition for AWS::BedrockAgentCore::BrowserCustom",
  "sourceUrl" : "https://github.com/aws-cloudformation/aws-cloudformation-rpdk.git",
  "definitions" : {
    "BrowserId" : {
      "type" : "string",
      "pattern" : "^(aws\\.browser\\.v1|[a-zA-Z][a-zA-Z0-9_]{0,47}-[a-zA-Z0-9]{10})$",
      "description" : "The id of the browser."
    },
    "BrowserArn" : {
      "type" : "string",
      "pattern" : "^arn:(aws(?:-cn|-us-gov|-iso(?:-[bef])?)?):bedrock-agentcore:[a-z0-9-]+:(aws|[0-9]{12}):browser(-custom)?\\/(aws\\.browser\\.v1|[a-zA-Z][a-zA-Z0-9_]{0,47}-[a-zA-Z0-9]{10})$",
      "description" : "The ARN of a Browser resource."
    },
    "BrowserNetworkMode" : {
      "type" : "string",
      "enum" : [ "PUBLIC", "VPC" ],
      "description" : "Network modes supported by browser"
    },
    "BrowserNetworkConfiguration" : {
      "type" : "object",
      "properties" : {
        "NetworkMode" : {
          "$ref" : "#/definitions/BrowserNetworkMode",
          "default" : "PUBLIC"
        },
        "VpcConfig" : {
          "$ref" : "#/definitions/VpcConfig"
        }
      },
      "required" : [ "NetworkMode" ],
      "additionalProperties" : false,
      "description" : "Network configuration for browser"
    },
    "RecordingConfig" : {
      "type" : "object",
      "properties" : {
        "Enabled" : {
          "type" : "boolean",
          "default" : false
        },
        "S3Location" : {
          "$ref" : "#/definitions/S3Location"
        }
      },
      "additionalProperties" : false,
      "description" : "Recording configuration for browser"
    },
    "BrowserSigning" : {
      "type" : "object",
      "properties" : {
        "Enabled" : {
          "type" : "boolean",
          "default" : false
        }
      },
      "additionalProperties" : false,
      "description" : "Browser signing configuration"
    },
    "CertificateLocation" : {
      "type" : "object",
      "properties" : {
        "SecretArn" : {
          "type" : "string",
          "pattern" : "^arn:(aws(?:-cn|-us-gov|-iso(?:-[bef])?)?):secretsmanager:[a-z0-9-]+:\\d{12}:secret:[a-zA-Z0-9/_+=.@-]+$",
          "description" : "Secrets Manager secret ARN."
        }
      },
      "required" : [ "SecretArn" ],
      "additionalProperties" : false,
      "description" : "Certificate location in Secrets Manager."
    },
    "Certificate" : {
      "type" : "object",
      "properties" : {
        "CertificateLocation" : {
          "$ref" : "#/definitions/CertificateLocation",
          "description" : "Certificate location in Secrets Manager."
        }
      },
      "required" : [ "CertificateLocation" ],
      "additionalProperties" : false,
      "description" : "A root CA certificate configuration."
    },
    "CertificateList" : {
      "type" : "array",
      "items" : {
        "$ref" : "#/definitions/Certificate"
      },
      "insertionOrder" : false,
      "minItems" : 0,
      "maxItems" : 10,
      "description" : "List of root CA certificates."
    },
    "BrowserEnterprisePolicyType" : {
      "type" : "string",
      "enum" : [ "MANAGED", "RECOMMENDED" ],
      "description" : "The type of browser enterprise policy."
    },
    "BrowserEnterprisePolicy" : {
      "type" : "object",
      "properties" : {
        "Location" : {
          "$ref" : "#/definitions/S3Location",
          "description" : "The S3 location of the enterprise policy file."
        },
        "Type" : {
          "$ref" : "#/definitions/BrowserEnterprisePolicyType",
          "description" : "The type of browser enterprise policy."
        }
      },
      "required" : [ "Location", "Type" ],
      "additionalProperties" : false,
      "description" : "Browser enterprise policy configuration."
    },
    "BrowserEnterprisePolicies" : {
      "type" : "array",
      "items" : {
        "$ref" : "#/definitions/BrowserEnterprisePolicy"
      },
      "insertionOrder" : false,
      "minItems" : 0,
      "maxItems" : 10,
      "description" : "List of browser enterprise policies."
    },
    "S3Location" : {
      "type" : "object",
      "properties" : {
        "Bucket" : {
          "type" : "string",
          "pattern" : "^[a-z0-9][a-z0-9.-]{1,61}[a-z0-9]$"
        },
        "Prefix" : {
          "type" : "string",
          "minLength" : 1
        }
      },
      "required" : [ "Bucket", "Prefix" ],
      "additionalProperties" : false,
      "description" : "S3 Location Configuration"
    },
    "VpcConfig" : {
      "type" : "object",
      "description" : "Network mode configuration for VPC",
      "properties" : {
        "SecurityGroups" : {
          "$ref" : "#/definitions/SecurityGroups"
        },
        "Subnets" : {
          "$ref" : "#/definitions/Subnets"
        }
      },
      "required" : [ "SecurityGroups", "Subnets" ],
      "additionalProperties" : false
    },
    "SecurityGroups" : {
      "type" : "array",
      "description" : "Security groups for VPC",
      "minItems" : 1,
      "maxItems" : 16,
      "insertionOrder" : false,
      "items" : {
        "$ref" : "#/definitions/SecurityGroupId"
      }
    },
    "SecurityGroupId" : {
      "type" : "string",
      "description" : "Security group id",
      "pattern" : "^sg-[0-9a-zA-Z]{8,17}$"
    },
    "Subnets" : {
      "type" : "array",
      "description" : "Subnets for VPC",
      "minItems" : 1,
      "maxItems" : 16,
      "insertionOrder" : false,
      "items" : {
        "$ref" : "#/definitions/SubnetId"
      }
    },
    "SubnetId" : {
      "type" : "string",
      "description" : "Subnet id",
      "pattern" : "^subnet-[0-9a-zA-Z]{8,17}$"
    },
    "BrowserStatus" : {
      "type" : "string",
      "enum" : [ "CREATING", "CREATE_FAILED", "READY", "DELETING", "DELETE_FAILED", "DELETED" ],
      "description" : "Status of browser"
    },
    "BrowserSummary" : {
      "type" : "object",
      "properties" : {
        "BrowserId" : {
          "$ref" : "#/definitions/BrowserId"
        },
        "BrowserArn" : {
          "$ref" : "#/definitions/BrowserArn"
        },
        "Name" : {
          "type" : "string"
        },
        "Description" : {
          "type" : "string"
        },
        "Status" : {
          "$ref" : "#/definitions/BrowserStatus"
        },
        "CreatedAt" : {
          "type" : "string",
          "format" : "date-time"
        },
        "LastUpdatedAt" : {
          "type" : "string",
          "format" : "date-time"
        }
      },
      "required" : [ "BrowserId", "BrowserArn", "Status", "CreatedAt" ],
      "additionalProperties" : false,
      "description" : "Browser"
    },
    "BrowserSummaries" : {
      "type" : "array",
      "items" : {
        "$ref" : "#/definitions/BrowserSummary"
      },
      "description" : "List of browsers"
    },
    "RoleArn" : {
      "type" : "string",
      "pattern" : "^arn:(aws(?:-cn|-us-gov|-iso(?:-[bef])?)?):iam::[0-9]{12}:role/.+$",
      "description" : "The Amazon Resource Name (ARN) of the IAM role."
    },
    "TagsMap" : {
      "type" : "object",
      "description" : "A map of tag keys and values",
      "patternProperties" : {
        "^[a-zA-Z0-9\\s._:/=+@-]*$" : {
          "type" : "string",
          "maxLength" : 256,
          "minLength" : 0,
          "pattern" : "^[a-zA-Z0-9\\s._:/=+@-]*$",
          "description" : "Value of a tag"
        }
      },
      "additionalProperties" : false
    }
  },
  "properties" : {
    "BrowserId" : {
      "$ref" : "#/definitions/BrowserId",
      "description" : "The id of the browser."
    },
    "BrowserArn" : {
      "$ref" : "#/definitions/BrowserArn",
      "description" : "The ARN of a Browser resource."
    },
    "Name" : {
      "type" : "string",
      "description" : "The name of the browser."
    },
    "Description" : {
      "type" : "string",
      "description" : "The description of the browser."
    },
    "NetworkConfiguration" : {
      "$ref" : "#/definitions/BrowserNetworkConfiguration",
      "description" : "Network configuration for browser."
    },
    "RecordingConfig" : {
      "$ref" : "#/definitions/RecordingConfig",
      "description" : "Recording configuration for browser."
    },
    "BrowserSigning" : {
      "$ref" : "#/definitions/BrowserSigning",
      "description" : "Browser signing configuration."
    },
    "Certificates" : {
      "$ref" : "#/definitions/CertificateList",
      "description" : "List of root CA certificates in PEM format."
    },
    "EnterprisePolicies" : {
      "$ref" : "#/definitions/BrowserEnterprisePolicies",
      "description" : "A list of enterprise policy files for the browser."
    },
    "ExecutionRoleArn" : {
      "$ref" : "#/definitions/RoleArn",
      "description" : "The Amazon Resource Name (ARN) of the IAM role that the browser uses to access resources."
    },
    "Status" : {
      "$ref" : "#/definitions/BrowserStatus",
      "description" : "Status of browser."
    },
    "FailureReason" : {
      "type" : "string",
      "description" : "The reason for failure if the browser creation or operation failed."
    },
    "CreatedAt" : {
      "type" : "string",
      "format" : "date-time",
      "description" : "Timestamp when the browser was created."
    },
    "LastUpdatedAt" : {
      "type" : "string",
      "format" : "date-time",
      "description" : "Timestamp when the browser was last updated."
    },
    "Tags" : {
      "$ref" : "#/definitions/TagsMap"
    }
  },
  "additionalProperties" : false,
  "required" : [ "Name", "NetworkConfiguration" ],
  "readOnlyProperties" : [ "/properties/BrowserId", "/properties/BrowserArn", "/properties/Status", "/properties/FailureReason", "/properties/CreatedAt", "/properties/LastUpdatedAt" ],
  "primaryIdentifier" : [ "/properties/BrowserId" ],
  "additionalIdentifiers" : [ [ "/properties/BrowserArn" ] ],
  "createOnlyProperties" : [ "/properties/Name", "/properties/Description", "/properties/NetworkConfiguration", "/properties/RecordingConfig", "/properties/BrowserSigning", "/properties/Certificates", "/properties/EnterprisePolicies", "/properties/ExecutionRoleArn" ],
  "handlers" : {
    "create" : {
      "permissions" : [ "bedrock-agentcore:CreateBrowser", "bedrock-agentcore:GetBrowser", "bedrock-agentcore:TagResource", "bedrock-agentcore:ListTagsForResource", "iam:CreateServiceLinkedRole", "iam:PassRole", "secretsmanager:GetSecretValue" ]
    },
    "read" : {
      "permissions" : [ "bedrock-agentcore:GetBrowser", "bedrock-agentcore:ListTagsForResource" ]
    },
    "update" : {
      "permissions" : [ "bedrock-agentcore:GetBrowser", "bedrock-agentcore:TagResource", "bedrock-agentcore:UntagResource", "bedrock-agentcore:ListTagsForResource", "iam:PassRole" ]
    },
    "delete" : {
      "permissions" : [ "bedrock-agentcore:GetBrowser", "bedrock-agentcore:DeleteBrowser" ]
    },
    "list" : {
      "permissions" : [ "bedrock-agentcore:ListBrowsers" ]
    }
  },
  "tagging" : {
    "cloudFormationSystemTags" : false,
    "tagOnCreate" : true,
    "tagProperty" : "/properties/Tags",
    "tagUpdatable" : true,
    "taggable" : true,
    "permissions" : [ "bedrock-agentcore:TagResource", "bedrock-agentcore:UntagResource", "bedrock-agentcore:ListTagsForResource" ]
  }
}