{
    "AWSTemplateFormatVersion":"2010-09-09",
    "Description":"AES - Flowlogs - S3 VPC Endpoint.  **Attention** This template creates AWS resources that will incur charges on your account.",
    "Parameters":{
        "NetworkStackName": {
            "Description": "Name of an active CloudFormation stack that contains the networking resources.",
            "Type": "String"
        },
    	"FlowLogsDataEncryptedS3BucketARN":{
            "Description": "ARN of S3 bucket for flowlogs.",
            "Type": "String"
	}
    },
    "Resources":{
        "S3Endpoint" : {
            "Type" : "AWS::EC2::VPCEndpoint",
            "Properties" : {
                "PolicyDocument" : {
                    "Version":"2012-10-17",
                    "Statement":[
		        {
                            "Effect":"Allow",
                            "Principal": "*",
                            "Action":["s3:GetObject","s3:DeleteObject","s3:List*"],
                            "Resource":[
			        {"Ref":"FlowLogsDataEncryptedS3BucketARN"},
			        {"Fn::Join":["",[{"Ref":"FlowLogsDataEncryptedS3BucketARN"},"/*"]]}
			    ]
                        },
			{
			    "Effect": "Allow",
			    "Principal": "*",
			    "Action": "s3:GetObject",
			    "Resource": "arn:aws:s3:::amazonlinux.*.amazonaws.com/*"
			}
		    ]
                },
                "RouteTableIds" : [ 
		    {"Fn::ImportValue" : {"Fn::Sub": "${NetworkStackName}-PublicRoutingTable"}},
		    {"Fn::ImportValue" : {"Fn::Sub": "${NetworkStackName}-PrivateRoutingTable"}}
		],
                "ServiceName" : { "Fn::Sub": "com.amazonaws.${AWS::Region}.s3" },
                "VpcId" : { "Fn::ImportValue" : {"Fn::Sub": "${NetworkStackName}-VPCID"}}
            }
        },
        "SQSPrivateEndpointSecurityGroup":{
            "Type":"AWS::EC2::SecurityGroup",
            "Properties":{
                "GroupDescription":"SQS Private Endpoint Security Group",
                "SecurityGroupIngress":[
                    {
                        "IpProtocol":"-1",
                        "CidrIp":{"Fn::ImportValue" : {"Fn::Sub": "${NetworkStackName}-VPCCIDRBlock"}}
                    }
                ],
                "VpcId":{"Fn::ImportValue" : {"Fn::Sub": "${NetworkStackName}-VPCID"}}
            }
        },	
	"SQSPrivateEndpoints": {
            "Type" : "AWS::EC2::VPCEndpoint",
            "Properties" : {
                "PrivateDnsEnabled" : "true",
                "SecurityGroupIds" : [ {"Ref":"SQSPrivateEndpointSecurityGroup"} ],
                "ServiceName" : { "Fn::Sub": "com.amazonaws.${AWS::Region}.sqs" },
                "SubnetIds" : [ 
                    { "Fn::ImportValue" : {"Fn::Sub": "${NetworkStackName}-PrivateSubnetApp0"}},
                    { "Fn::ImportValue" : {"Fn::Sub": "${NetworkStackName}-PrivateSubnetApp1"}},
                    { "Fn::ImportValue" : {"Fn::Sub": "${NetworkStackName}-PrivateSubnetApp2"}}
		],
                "VpcEndpointType" : "Interface",
                "VpcId" : {"Fn::ImportValue" : {"Fn::Sub": "${NetworkStackName}-VPCID"}}
            }
        }
	
    },
    "Outputs":{
	"S3VPCEndpoint":{
            "Description":"Portal VPC Endpoint ID",
            "Value":{"Ref":"S3Endpoint"},
            "Export" : { "Name" : {"Fn::Sub": "${AWS::StackName}-S3VPCEndpoint" }}
	}		
    }
}

