{
  "typeName" : "AWS::RDS::DBProxy",
  "description" : "Resource schema for AWS::RDS::DBProxy",
  "sourceUrl" : "https://github.com/aws-cloudformation/aws-cloudformation-rpdk.git",
  "definitions" : {
    "AuthFormat" : {
      "type" : "object",
      "properties" : {
        "AuthScheme" : {
          "description" : "The type of authentication that the proxy uses for connections from the proxy to the underlying database. ",
          "type" : "string",
          "enum" : [ "SECRETS" ]
        },
        "Description" : {
          "description" : "A user-specified description about the authentication used by a proxy to log in as a specific database user. ",
          "type" : "string"
        },
        "IAMAuth" : {
          "description" : "Whether to require or disallow Amazon Web Services Identity and Access Management (IAM) authentication for connections to the proxy. The ENABLED value is valid only for proxies with RDS for Microsoft SQL Server.",
          "type" : "string",
          "enum" : [ "DISABLED", "REQUIRED", "ENABLED" ]
        },
        "SecretArn" : {
          "description" : "The Amazon Resource Name (ARN) representing the secret that the proxy uses to authenticate to the RDS DB instance or Aurora DB cluster. These secrets are stored within Amazon Secrets Manager. ",
          "type" : "string"
        },
        "ClientPasswordAuthType" : {
          "description" : "The type of authentication the proxy uses for connections from clients.",
          "type" : "string",
          "enum" : [ "MYSQL_NATIVE_PASSWORD", "MYSQL_CACHING_SHA2_PASSWORD", "POSTGRES_SCRAM_SHA_256", "POSTGRES_MD5", "SQL_SERVER_AUTHENTICATION" ]
        }
      },
      "additionalProperties" : false
    },
    "TagFormat" : {
      "type" : "object",
      "properties" : {
        "Key" : {
          "type" : "string",
          "pattern" : "(\\w|\\d|\\s|\\\\|-|\\.:=+-)*",
          "maxLength" : 128
        },
        "Value" : {
          "type" : "string",
          "pattern" : "(\\w|\\d|\\s|\\\\|-|\\.:=+-)*",
          "maxLength" : 128
        }
      },
      "additionalProperties" : false
    }
  },
  "properties" : {
    "Auth" : {
      "description" : "The authorization mechanism that the proxy uses.",
      "type" : "array",
      "insertionOrder" : false,
      "minItems" : 1,
      "items" : {
        "$ref" : "#/definitions/AuthFormat"
      }
    },
    "DBProxyArn" : {
      "description" : "The Amazon Resource Name (ARN) for the proxy.",
      "type" : "string"
    },
    "DBProxyName" : {
      "description" : "The identifier for the proxy. This name must be unique for all proxies owned by your AWS account in the specified AWS Region.",
      "type" : "string",
      "pattern" : "[0-z]*",
      "maxLength" : 64
    },
    "DebugLogging" : {
      "description" : "Whether the proxy includes detailed information about SQL statements in its logs.",
      "type" : "boolean"
    },
    "DefaultAuthScheme" : {
      "description" : "The default authentication scheme that the proxy uses for client connections to the proxy and connections from the proxy to the underlying database.",
      "type" : "string",
      "enum" : [ "IAM_AUTH", "NONE" ]
    },
    "Endpoint" : {
      "description" : "The endpoint that you can use to connect to the proxy. You include the endpoint value in the connection string for a database client application.",
      "type" : "string"
    },
    "EndpointNetworkType" : {
      "description" : "The network type of the DB proxy endpoint. The network type determines the IP version that the proxy endpoint supports.",
      "type" : "string",
      "enum" : [ "IPV4", "IPV6", "DUAL" ]
    },
    "EngineFamily" : {
      "description" : "The kinds of databases that the proxy can connect to.",
      "type" : "string",
      "enum" : [ "MYSQL", "POSTGRESQL", "SQLSERVER" ]
    },
    "IdleClientTimeout" : {
      "description" : "The number of seconds that a connection to the proxy can be inactive before the proxy disconnects it.",
      "type" : "integer"
    },
    "RequireTLS" : {
      "description" : "A Boolean parameter that specifies whether Transport Layer Security (TLS) encryption is required for connections to the proxy.",
      "type" : "boolean"
    },
    "RoleArn" : {
      "description" : "The Amazon Resource Name (ARN) of the IAM role that the proxy uses to access secrets in AWS Secrets Manager.",
      "type" : "string"
    },
    "Tags" : {
      "description" : "An optional set of key-value pairs to associate arbitrary data of your choosing with the proxy.",
      "type" : "array",
      "insertionOrder" : false,
      "items" : {
        "$ref" : "#/definitions/TagFormat"
      }
    },
    "TargetConnectionNetworkType" : {
      "description" : "The network type that the proxy uses to connect to the target database. The network type determines the IP version that the proxy uses for connections to the database.",
      "type" : "string",
      "enum" : [ "IPV4", "IPV6" ]
    },
    "VpcId" : {
      "description" : "VPC ID to associate with the new DB proxy.",
      "type" : "string"
    },
    "VpcSecurityGroupIds" : {
      "description" : "VPC security group IDs to associate with the new proxy.",
      "type" : "array",
      "insertionOrder" : false,
      "minItems" : 1,
      "items" : {
        "type" : "string"
      }
    },
    "VpcSubnetIds" : {
      "description" : "VPC subnet IDs to associate with the new proxy.",
      "type" : "array",
      "insertionOrder" : false,
      "minItems" : 2,
      "items" : {
        "type" : "string"
      }
    }
  },
  "additionalProperties" : false,
  "required" : [ "DBProxyName", "EngineFamily", "RoleArn", "VpcSubnetIds" ],
  "propertyTransform" : {
    "/properties/DBProxyName" : "$lowercase(DBProxyName)"
  },
  "readOnlyProperties" : [ "/properties/DBProxyArn", "/properties/Endpoint", "/properties/VpcId" ],
  "createOnlyProperties" : [ "/properties/DBProxyName", "/properties/EngineFamily", "/properties/EndpointNetworkType", "/properties/TargetConnectionNetworkType", "/properties/VpcSubnetIds" ],
  "tagging" : {
    "taggable" : true,
    "tagOnCreate" : true,
    "tagUpdatable" : true,
    "cloudFormationSystemTags" : true,
    "tagProperty" : "/properties/Tags",
    "permissions" : [ "rds:AddTagsToResource", "rds:RemoveTagsFromResource", "rds:ListTagsForResource" ]
  },
  "primaryIdentifier" : [ "/properties/DBProxyName" ],
  "handlers" : {
    "create" : {
      "permissions" : [ "rds:CreateDBProxy", "rds:DescribeDBProxies", "rds:AddTagsToResource", "iam:PassRole" ]
    },
    "read" : {
      "permissions" : [ "rds:DescribeDBProxies", "rds:ListTagsForResource" ]
    },
    "update" : {
      "permissions" : [ "rds:ModifyDBProxy", "rds:DescribeDBProxies", "rds:AddTagsToResource", "rds:RemoveTagsFromResource", "iam:PassRole" ]
    },
    "delete" : {
      "permissions" : [ "rds:DescribeDBProxies", "rds:DeleteDBProxy" ]
    },
    "list" : {
      "permissions" : [ "rds:DescribeDBProxies" ]
    }
  }
}