{
  "typeName" : "AWS::EMR::Studio",
  "description" : "Resource schema for AWS::EMR::Studio",
  "documentationUrl" : "https://docs.aws.amazon.com/emr/latest/APIReference/API_CreateStudio.html",
  "definitions" : {
    "SubnetId" : {
      "description" : "Identifier of a subnet",
      "type" : "string",
      "pattern" : "^(subnet-[a-f0-9]{13})|(subnet-[a-f0-9]{8})\\Z"
    },
    "Arn" : {
      "type" : "string",
      "pattern" : "^arn:aws(-(cn|us-gov|iso-f|iso-e))?:[a-z-]+:(([a-z]+-)+[0-9])?:([0-9]{12})?:[^.]+$"
    },
    "Tags" : {
      "type" : "array",
      "insertionOrder" : false,
      "uniqueItems" : true,
      "items" : {
        "$ref" : "#/definitions/Tag"
      }
    },
    "Tag" : {
      "description" : "An arbitrary set of tags (key-value pairs) for this EMR Studio.",
      "type" : "object",
      "additionalProperties" : false,
      "properties" : {
        "Key" : {
          "type" : "string",
          "description" : "The key name of the tag. You can specify a value that is 1 to 127 Unicode characters in length and cannot be prefixed with aws:. You can use any of the following characters: the set of Unicode letters, digits, whitespace, _, ., /, =, +, and -. ",
          "minLength" : 1,
          "maxLength" : 128,
          "pattern" : "^(?!aws:)[a-zA-Z+-=._:/]+$"
        },
        "Value" : {
          "type" : "string",
          "description" : "The value for the tag. You can specify a value that is 0 to 255 Unicode characters in length. You can use any of the following characters: the set of Unicode letters, digits, whitespace, _, ., /, =, +, and -. ",
          "minLength" : 0,
          "maxLength" : 256,
          "pattern" : "[a-zA-Z+-=._:/]+$"
        }
      },
      "required" : [ "Value", "Key" ]
    }
  },
  "properties" : {
    "Arn" : {
      "description" : "The Amazon Resource Name (ARN) of the EMR Studio.",
      "$ref" : "#/definitions/Arn"
    },
    "AuthMode" : {
      "type" : "string",
      "description" : "Specifies whether the Studio authenticates users using single sign-on (SSO) or IAM. Amazon EMR Studio currently only supports SSO authentication.",
      "enum" : [ "SSO", "IAM" ]
    },
    "DefaultS3Location" : {
      "description" : "The default Amazon S3 location to back up EMR Studio Workspaces and notebook files. A Studio user can select an alternative Amazon S3 location when creating a Workspace.",
      "type" : "string",
      "minLength" : 6,
      "maxLength" : 10280,
      "pattern" : "^s3://.*"
    },
    "Description" : {
      "description" : "A detailed description of the Studio.",
      "type" : "string",
      "minLength" : 0,
      "maxLength" : 256
    },
    "EngineSecurityGroupId" : {
      "description" : "The ID of the Amazon EMR Studio Engine security group. The Engine security group allows inbound network traffic from the Workspace security group, and it must be in the same VPC specified by VpcId.",
      "type" : "string",
      "minLength" : 4,
      "maxLength" : 256,
      "pattern" : "^sg-[a-zA-Z0-9\\-._]+$"
    },
    "Name" : {
      "description" : "A descriptive name for the Amazon EMR Studio.",
      "type" : "string",
      "minLength" : 1,
      "maxLength" : 256,
      "pattern" : "[a-zA-Z0-9_-]+"
    },
    "ServiceRole" : {
      "description" : "The IAM role that will be assumed by the Amazon EMR Studio. The service role provides a way for Amazon EMR Studio to interoperate with other AWS services.",
      "$ref" : "#/definitions/Arn"
    },
    "StudioId" : {
      "description" : "The ID of the EMR Studio.",
      "type" : "string",
      "pattern" : "^es-[0-9A-Z]+",
      "minLength" : 4,
      "maxLength" : 256
    },
    "SubnetIds" : {
      "description" : "A list of up to 5 subnet IDs to associate with the Studio. The subnets must belong to the VPC specified by VpcId. Studio users can create a Workspace in any of the specified subnets.",
      "type" : "array",
      "minItems" : 1,
      "items" : {
        "$ref" : "#/definitions/SubnetId"
      }
    },
    "Tags" : {
      "description" : "A list of tags to associate with the Studio. Tags are user-defined key-value pairs that consist of a required key string with a maximum of 128 characters, and an optional value string with a maximum of 256 characters.",
      "$ref" : "#/definitions/Tags"
    },
    "Url" : {
      "description" : "The unique Studio access URL.",
      "type" : "string",
      "pattern" : "^https://[0-9a-zA-Z]([-.\\w]*[0-9a-zA-Z])(:[0-9]*)*([?/#].*)?$",
      "maxLength" : 4096
    },
    "UserRole" : {
      "description" : "The IAM user role that will be assumed by users and groups logged in to a Studio. The permissions attached to this IAM role can be scoped down for each user or group using session policies.",
      "$ref" : "#/definitions/Arn"
    },
    "VpcId" : {
      "description" : "The ID of the Amazon Virtual Private Cloud (Amazon VPC) to associate with the Studio.",
      "type" : "string",
      "pattern" : "^(vpc-[0-9a-f]{8}|vpc-[0-9a-f]{17})$"
    },
    "WorkspaceSecurityGroupId" : {
      "description" : "The ID of the Amazon EMR Studio Workspace security group. The Workspace security group allows outbound network traffic to resources in the Engine security group, and it must be in the same VPC specified by VpcId.",
      "type" : "string",
      "pattern" : "^sg-[a-zA-Z0-9\\-._]+$"
    },
    "IdpAuthUrl" : {
      "description" : "Your identity provider's authentication endpoint. Amazon EMR Studio redirects federated users to this endpoint for authentication when logging in to a Studio with the Studio URL.",
      "type" : "string",
      "pattern" : "^https://[0-9a-zA-Z]([-.\\w]*[0-9a-zA-Z])(:[0-9]*)*([?/#].*)?$",
      "maxLength" : 4096
    },
    "IdpRelayStateParameterName" : {
      "description" : "The name of relay state parameter for external Identity Provider.",
      "type" : "string",
      "minLength" : 0,
      "maxLength" : 256
    },
    "TrustedIdentityPropagationEnabled" : {
      "description" : "A Boolean indicating whether to enable Trusted identity propagation for the Studio. The default value is false.",
      "type" : "boolean"
    },
    "IdcUserAssignment" : {
      "description" : "Specifies whether IAM Identity Center user assignment is REQUIRED or OPTIONAL. If the value is set to REQUIRED, users must be explicitly assigned to the Studio application to access the Studio.",
      "type" : "string",
      "enum" : [ "REQUIRED", "OPTIONAL" ]
    },
    "IdcInstanceArn" : {
      "description" : "The ARN of the IAM Identity Center instance to create the Studio application.",
      "type" : "string",
      "minLength" : 20,
      "maxLength" : 2048
    },
    "EncryptionKeyArn" : {
      "description" : "The AWS KMS key identifier (ARN) used to encrypt AWS EMR Studio workspace and notebook files when backed up to AWS S3.",
      "$ref" : "#/definitions/Arn"
    }
  },
  "additionalProperties" : false,
  "required" : [ "AuthMode", "EngineSecurityGroupId", "Name", "ServiceRole", "SubnetIds", "VpcId", "WorkspaceSecurityGroupId", "DefaultS3Location" ],
  "readOnlyProperties" : [ "/properties/StudioId", "/properties/Arn", "/properties/Url" ],
  "primaryIdentifier" : [ "/properties/StudioId" ],
  "tagging" : {
    "taggable" : true,
    "tagOnCreate" : true,
    "tagUpdatable" : true,
    "cloudFormationSystemTags" : false,
    "tagProperty" : "/properties/Tags",
    "permissions" : [ "elasticmapreduce:AddTags", "elasticmapreduce:RemoveTags" ]
  },
  "createOnlyProperties" : [ "/properties/AuthMode", "/properties/EngineSecurityGroupId", "/properties/ServiceRole", "/properties/UserRole", "/properties/VpcId", "/properties/WorkspaceSecurityGroupId", "/properties/TrustedIdentityPropagationEnabled", "/properties/IdcUserAssignment", "/properties/IdcInstanceArn", "/properties/EncryptionKeyArn" ],
  "handlers" : {
    "create" : {
      "permissions" : [ "elasticmapreduce:CreateStudio", "elasticmapreduce:DescribeStudio", "elasticmapreduce:AddTags", "sso:CreateManagedApplicationInstance", "sso:DeleteManagedApplicationInstance", "iam:PassRole" ]
    },
    "read" : {
      "permissions" : [ "elasticmapreduce:DescribeStudio", "sso:GetManagedApplicationInstance" ]
    },
    "update" : {
      "permissions" : [ "elasticmapreduce:UpdateStudio", "elasticmapreduce:DescribeStudio", "elasticmapreduce:AddTags", "elasticmapreduce:RemoveTags" ]
    },
    "delete" : {
      "permissions" : [ "elasticmapreduce:DeleteStudio", "elasticmapreduce:DescribeStudio", "sso:DeleteManagedApplicationInstance" ]
    },
    "list" : {
      "permissions" : [ "elasticmapreduce:ListStudios" ]
    }
  }
}