{
  "typeName" : "AWS::MWAA::Environment",
  "description" : "Resource schema for AWS::MWAA::Environment",
  "sourceUrl" : "https://github.com/aws-cloudformation/aws-cloudformation-resource-providers-mwaa.git",
  "definitions" : {
    "EnvironmentName" : {
      "type" : "string",
      "description" : "Customer-defined identifier for the environment, unique per customer region.",
      "minLength" : 1,
      "maxLength" : 80,
      "pattern" : "^[a-zA-Z][0-9a-zA-Z\\-_]*$"
    },
    "EnvironmentStatus" : {
      "type" : "string",
      "description" : "The status of the environment.",
      "enum" : [ "CREATING", "CREATE_FAILED", "AVAILABLE", "UPDATING", "DELETING", "DELETED", "UPDATE_FAILED", "UNAVAILABLE", "PENDING" ]
    },
    "UpdateStatus" : {
      "type" : "string",
      "description" : "",
      "enum" : [ "SUCCESS", "PENDING", "FAILED" ]
    },
    "UpdateError" : {
      "type" : "object",
      "description" : "The error associated with an update request.",
      "additionalProperties" : false,
      "properties" : {
        "ErrorCode" : {
          "$ref" : "#/definitions/ErrorCode"
        },
        "ErrorMessage" : {
          "$ref" : "#/definitions/ErrorMessage"
        }
      }
    },
    "AirflowArn" : {
      "type" : "string",
      "description" : "",
      "minLength" : 1,
      "maxLength" : 1224,
      "pattern" : "^arn:(aws|aws-us-gov|aws-cn|aws-iso|aws-iso-b)(-[a-z]+)?:airflow:[a-z0-9\\-]+:\\d{12}:environment/\\w+"
    },
    "EnvironmentArn" : {
      "type" : "string",
      "description" : "ARN for the MWAA environment.",
      "minLength" : 1,
      "maxLength" : 1224,
      "pattern" : "^arn:(aws|aws-us-gov|aws-cn|aws-iso|aws-iso-b)(-[a-z]+)?:airflow:[a-z0-9\\-]+:\\d{12}:environment/\\w+"
    },
    "S3BucketArn" : {
      "type" : "string",
      "description" : "ARN for the AWS S3 bucket to use as the source of DAGs and plugins for the environment.",
      "minLength" : 1,
      "maxLength" : 1224,
      "pattern" : "^arn:(aws|aws-us-gov|aws-cn|aws-iso|aws-iso-b)(-[a-z]+)?:s3:::[a-z0-9.\\-]+$"
    },
    "CreatedAt" : {
      "type" : "string",
      "description" : "When the environment resource was created."
    },
    "UpdateCreatedAt" : {
      "type" : "string",
      "description" : "When the update request was created."
    },
    "WebserverUrl" : {
      "type" : "string",
      "description" : "Url endpoint for the environment's Airflow UI.",
      "minLength" : 1,
      "maxLength" : 256,
      "pattern" : "^https://.+$"
    },
    "ExecutionRoleArn" : {
      "type" : "string",
      "description" : "IAM role to be used by tasks.",
      "maxLength" : 1224,
      "pattern" : "^arn:(aws|aws-us-gov|aws-cn|aws-iso|aws-iso-b)(-[a-z]+)?:iam::\\d{12}:role/?[a-zA-Z_0-9+=,.@\\-_/]+$"
    },
    "ServiceRoleArn" : {
      "type" : "string",
      "description" : "IAM role to be used by MWAA to perform AWS API calls on behalf of the customer.",
      "maxLength" : 1224,
      "pattern" : "^arn:(aws|aws-us-gov|aws-cn|aws-iso|aws-iso-b)(-[a-z]+)?:iam::\\d{12}:role/?[a-zA-Z_0-9+=,.@\\-_/]+$"
    },
    "KmsKey" : {
      "type" : "string",
      "description" : "The identifier of the AWS Key Management Service (AWS KMS) customer master key (CMK) to use for MWAA data encryption.\n\n    You can specify the CMK using any of the following:\n\n    Key ID. For example, key/1234abcd-12ab-34cd-56ef-1234567890ab.\n\n    Key alias. For example, alias/ExampleAlias.\n\n    Key ARN. For example, arn:aws:kms:us-east-1:012345678910:key/abcd1234-a123-456a-a12b-a123b4cd56ef.\n\n    Alias ARN. For example, arn:aws:kms:us-east-1:012345678910:alias/ExampleAlias.\n\n    AWS authenticates the CMK asynchronously. Therefore, if you specify an ID, alias, or ARN that is not valid, the action can appear to complete, but eventually fails.",
      "maxLength" : 1224,
      "pattern" : "^(((arn:(aws|aws-us-gov|aws-cn|aws-iso|aws-iso-b)(-[a-z]+)?:kms:[a-z]{2}-[a-z]+-\\d:\\d+:)?key\\/)?[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}|(arn:(aws|aws-us-gov|aws-cn|aws-iso|aws-iso-b):kms:[a-z]{2}-[a-z]+-\\d:\\d+:)?alias/.+)$"
    },
    "AirflowVersion" : {
      "type" : "string",
      "description" : "Version of airflow to deploy to the environment.",
      "maxLength" : 32,
      "pattern" : "^[0-9a-z.]+$"
    },
    "RelativePath" : {
      "type" : "string",
      "description" : "Represents an S3 prefix relative to the root of an S3 bucket.",
      "maxLength" : 1024,
      "pattern" : ".*"
    },
    "ConfigKey" : {
      "type" : "string",
      "description" : "",
      "maxLength" : 64,
      "pattern" : "^[a-z]+([a-z._]*[a-z]+)?$"
    },
    "ConfigValue" : {
      "type" : "string",
      "description" : "",
      "maxLength" : 256,
      "pattern" : ".*"
    },
    "SecurityGroupId" : {
      "type" : "string",
      "description" : "",
      "minLength" : 1,
      "maxLength" : 1024,
      "pattern" : "^sg-[a-zA-Z0-9\\-._]+$"
    },
    "SubnetId" : {
      "type" : "string",
      "description" : "",
      "maxLength" : 1024,
      "pattern" : "^subnet-[a-zA-Z0-9\\-._]+$"
    },
    "CloudWatchLogGroupArn" : {
      "type" : "string",
      "description" : "",
      "maxLength" : 1224,
      "pattern" : "^arn:(aws|aws-us-gov|aws-cn|aws-iso|aws-iso-b)(-[a-z]+)?:logs:[a-z0-9\\-]+:\\d{12}:log-group:\\w+"
    },
    "LoggingEnabled" : {
      "type" : "boolean",
      "description" : ""
    },
    "LoggingLevel" : {
      "type" : "string",
      "description" : "",
      "enum" : [ "CRITICAL", "ERROR", "WARNING", "INFO", "DEBUG" ]
    },
    "EnvironmentClass" : {
      "type" : "string",
      "description" : "Templated configuration for airflow processes and backing infrastructure.",
      "minLength" : 1,
      "maxLength" : 1024
    },
    "MaxWorkers" : {
      "type" : "integer",
      "description" : "Maximum worker compute units.",
      "minimum" : 1
    },
    "MinWorkers" : {
      "type" : "integer",
      "description" : "Minimum worker compute units.",
      "minimum" : 1
    },
    "MaxWebservers" : {
      "type" : "integer",
      "description" : "Maximum webserver compute units.",
      "minimum" : 1
    },
    "MinWebservers" : {
      "type" : "integer",
      "description" : "Minimum webserver compute units.",
      "minimum" : 1
    },
    "Schedulers" : {
      "type" : "integer",
      "description" : "Scheduler compute units.",
      "minimum" : 1
    },
    "NetworkConfiguration" : {
      "type" : "object",
      "description" : "Configures the network resources of the environment.",
      "additionalProperties" : false,
      "properties" : {
        "SubnetIds" : {
          "type" : "array",
          "insertionOrder" : true,
          "description" : "A list of subnets to use for the environment. These must be private subnets, in the same VPC, in two different availability zones.",
          "minItems" : 2,
          "maxItems" : 2,
          "items" : {
            "$ref" : "#/definitions/SubnetId"
          }
        },
        "SecurityGroupIds" : {
          "type" : "array",
          "insertionOrder" : true,
          "description" : "A list of security groups to use for the environment.",
          "minItems" : 1,
          "maxItems" : 5,
          "items" : {
            "$ref" : "#/definitions/SecurityGroupId"
          }
        }
      }
    },
    "LoggingConfiguration" : {
      "type" : "object",
      "description" : "Logging configuration for the environment.",
      "additionalProperties" : false,
      "properties" : {
        "DagProcessingLogs" : {
          "$ref" : "#/definitions/ModuleLoggingConfiguration"
        },
        "SchedulerLogs" : {
          "$ref" : "#/definitions/ModuleLoggingConfiguration"
        },
        "WebserverLogs" : {
          "$ref" : "#/definitions/ModuleLoggingConfiguration"
        },
        "WorkerLogs" : {
          "$ref" : "#/definitions/ModuleLoggingConfiguration"
        },
        "TaskLogs" : {
          "$ref" : "#/definitions/ModuleLoggingConfiguration"
        }
      }
    },
    "LoggingConfigurationInput" : {
      "type" : "object",
      "description" : "Configures logging for the environment.",
      "additionalProperties" : false,
      "properties" : {
        "DagProcessingLogs" : {
          "$ref" : "#/definitions/ModuleLoggingConfigurationInput"
        },
        "SchedulerLogs" : {
          "$ref" : "#/definitions/ModuleLoggingConfigurationInput"
        },
        "WebserverLogs" : {
          "$ref" : "#/definitions/ModuleLoggingConfigurationInput"
        },
        "WorkerLogs" : {
          "$ref" : "#/definitions/ModuleLoggingConfigurationInput"
        },
        "TaskLogs" : {
          "$ref" : "#/definitions/ModuleLoggingConfigurationInput"
        }
      }
    },
    "ModuleLoggingConfiguration" : {
      "type" : "object",
      "description" : "Logging configuration for a specific airflow component.",
      "additionalProperties" : false,
      "properties" : {
        "Enabled" : {
          "$ref" : "#/definitions/LoggingEnabled"
        },
        "LogLevel" : {
          "$ref" : "#/definitions/LoggingLevel"
        },
        "CloudWatchLogGroupArn" : {
          "$ref" : "#/definitions/CloudWatchLogGroupArn"
        }
      }
    },
    "ModuleLoggingConfigurationInput" : {
      "type" : "object",
      "description" : "Configures airflow component logging for the environment.",
      "additionalProperties" : false,
      "properties" : {
        "Enabled" : {
          "$ref" : "#/definitions/LoggingEnabled"
        },
        "LogLevel" : {
          "$ref" : "#/definitions/LoggingLevel"
        }
      }
    },
    "LastUpdate" : {
      "type" : "object",
      "description" : "Details about the last update performed on the environment.",
      "additionalProperties" : false,
      "properties" : {
        "Status" : {
          "$ref" : "#/definitions/UpdateStatus"
        },
        "CreatedAt" : {
          "$ref" : "#/definitions/UpdateCreatedAt"
        },
        "Error" : {
          "$ref" : "#/definitions/UpdateError"
        },
        "WorkerReplacementStrategy" : {
          "$ref" : "#/definitions/WorkerReplacementStrategy"
        }
      }
    },
    "ErrorCode" : {
      "type" : "string",
      "description" : "The error code associated with an error."
    },
    "ErrorMessage" : {
      "type" : "string",
      "description" : "Error message describing a failed operation.",
      "minLength" : 1,
      "maxLength" : 1024,
      "pattern" : "^.+$"
    },
    "S3ObjectVersion" : {
      "type" : "string",
      "description" : "Represents an version ID for an S3 object.",
      "maxLength" : 1024
    },
    "WeeklyMaintenanceWindowStart" : {
      "type" : "string",
      "description" : "Start time for the weekly maintenance window.",
      "maxLength" : 9,
      "pattern" : "(MON|TUE|WED|THU|FRI|SAT|SUN):([01]\\d|2[0-3]):(00|30)"
    },
    "WebserverAccessMode" : {
      "type" : "string",
      "description" : "Choice for mode of webserver access including over public internet or via private VPC endpoint.",
      "enum" : [ "PRIVATE_ONLY", "PUBLIC_ONLY" ]
    },
    "EndpointManagement" : {
      "type" : "string",
      "description" : "Defines whether the VPC endpoints configured for the environment are created, and managed, by the customer or by Amazon MWAA.",
      "enum" : [ "CUSTOMER", "SERVICE" ]
    },
    "CeleryExecutorQueue" : {
      "type" : "string",
      "description" : "The celery executor queue associated with the environment.",
      "maxLength" : 1224
    },
    "DatabaseVpcEndpointService" : {
      "type" : "string",
      "description" : "The database VPC endpoint service name.",
      "maxLength" : 1224
    },
    "WebserverVpcEndpointService" : {
      "type" : "string",
      "description" : "The webserver VPC endpoint service name, applicable if private webserver access mode selected.",
      "maxLength" : 1224
    },
    "WorkerReplacementStrategy" : {
      "type" : "string",
      "description" : "The worker replacement strategy to use when updating the environment. Valid values: `FORCED`, `GRACEFUL`. FORCED means Apache Airflow workers will be stopped and replaced without waiting for tasks to complete before an update. GRACEFUL means Apache Airflow workers will be able to complete running tasks for up to 12 hours during an update before being stopped and replaced.",
      "enum" : [ "FORCED", "GRACEFUL" ]
    }
  },
  "properties" : {
    "Name" : {
      "$ref" : "#/definitions/EnvironmentName"
    },
    "Arn" : {
      "$ref" : "#/definitions/EnvironmentArn"
    },
    "WebserverUrl" : {
      "$ref" : "#/definitions/WebserverUrl"
    },
    "ExecutionRoleArn" : {
      "$ref" : "#/definitions/ExecutionRoleArn"
    },
    "KmsKey" : {
      "$ref" : "#/definitions/KmsKey"
    },
    "AirflowVersion" : {
      "$ref" : "#/definitions/AirflowVersion"
    },
    "SourceBucketArn" : {
      "$ref" : "#/definitions/S3BucketArn"
    },
    "DagS3Path" : {
      "$ref" : "#/definitions/RelativePath"
    },
    "PluginsS3Path" : {
      "$ref" : "#/definitions/RelativePath"
    },
    "PluginsS3ObjectVersion" : {
      "$ref" : "#/definitions/S3ObjectVersion"
    },
    "RequirementsS3Path" : {
      "$ref" : "#/definitions/RelativePath"
    },
    "RequirementsS3ObjectVersion" : {
      "$ref" : "#/definitions/S3ObjectVersion"
    },
    "StartupScriptS3Path" : {
      "$ref" : "#/definitions/RelativePath"
    },
    "StartupScriptS3ObjectVersion" : {
      "$ref" : "#/definitions/S3ObjectVersion"
    },
    "AirflowConfigurationOptions" : {
      "type" : "object",
      "description" : "Key/value pairs representing Airflow configuration variables.\n    Keys are prefixed by their section:\n\n    [core]\n    dags_folder={AIRFLOW_HOME}/dags\n\n    Would be represented as\n\n    \"core.dags_folder\": \"{AIRFLOW_HOME}/dags\""
    },
    "EnvironmentClass" : {
      "$ref" : "#/definitions/EnvironmentClass"
    },
    "MaxWorkers" : {
      "$ref" : "#/definitions/MaxWorkers"
    },
    "MinWorkers" : {
      "$ref" : "#/definitions/MinWorkers"
    },
    "MaxWebservers" : {
      "$ref" : "#/definitions/MaxWebservers"
    },
    "MinWebservers" : {
      "$ref" : "#/definitions/MinWebservers"
    },
    "Schedulers" : {
      "$ref" : "#/definitions/Schedulers"
    },
    "NetworkConfiguration" : {
      "$ref" : "#/definitions/NetworkConfiguration"
    },
    "LoggingConfiguration" : {
      "$ref" : "#/definitions/LoggingConfiguration"
    },
    "WeeklyMaintenanceWindowStart" : {
      "$ref" : "#/definitions/WeeklyMaintenanceWindowStart"
    },
    "Tags" : {
      "type" : "object",
      "description" : "A map of tags for the environment."
    },
    "WebserverAccessMode" : {
      "$ref" : "#/definitions/WebserverAccessMode"
    },
    "EndpointManagement" : {
      "$ref" : "#/definitions/EndpointManagement"
    },
    "CeleryExecutorQueue" : {
      "$ref" : "#/definitions/CeleryExecutorQueue"
    },
    "DatabaseVpcEndpointService" : {
      "$ref" : "#/definitions/DatabaseVpcEndpointService"
    },
    "WebserverVpcEndpointService" : {
      "$ref" : "#/definitions/WebserverVpcEndpointService"
    },
    "WorkerReplacementStrategy" : {
      "$ref" : "#/definitions/WorkerReplacementStrategy"
    }
  },
  "additionalProperties" : false,
  "required" : [ "Name" ],
  "createOnlyProperties" : [ "/properties/Name", "/properties/KmsKey", "/properties/NetworkConfiguration/SubnetIds", "/properties/EndpointManagement" ],
  "readOnlyProperties" : [ "/properties/Arn", "/properties/CeleryExecutorQueue", "/properties/DatabaseVpcEndpointService", "/properties/WebserverVpcEndpointService", "/properties/WebserverUrl", "/properties/LoggingConfiguration/DagProcessingLogs/CloudWatchLogGroupArn", "/properties/LoggingConfiguration/SchedulerLogs/CloudWatchLogGroupArn", "/properties/LoggingConfiguration/WebserverLogs/CloudWatchLogGroupArn", "/properties/LoggingConfiguration/WorkerLogs/CloudWatchLogGroupArn", "/properties/LoggingConfiguration/TaskLogs/CloudWatchLogGroupArn" ],
  "writeOnlyProperties" : [ "/properties/WorkerReplacementStrategy" ],
  "primaryIdentifier" : [ "/properties/Name" ],
  "handlers" : {
    "create" : {
      "permissions" : [ "airflow:GetEnvironment", "airflow:CreateEnvironment", "airflow:TagResource", "airflow:UntagResource", "iam:PassRole", "iam:ListRoles", "iam:CreatePolicy", "iam:AttachRolePolicy", "iam:CreateRole", "iam:CreateServiceLinkedRole", "s3:GetBucketLocation", "s3:ListAllMyBuckets", "s3:ListBucket", "s3:ListBucketVersions", "s3:CreateBucket", "s3:PutObject", "s3:GetEncryptionConfiguration", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcs", "ec2:DescribeRouteTables", "ec2:AuthorizeSecurityGroupIngress", "ec2:CreateSecurityGroup", "ec2:CreateVpcEndpoint", "ec2:CreateNetworkInterface", "kms:CreateGrant", "kms:DescribeKey", "kms:ListAliases" ],
      "timeoutInMinutes" : 180
    },
    "read" : {
      "permissions" : [ "airflow:GetEnvironment" ]
    },
    "update" : {
      "permissions" : [ "airflow:GetEnvironment", "airflow:UpdateEnvironment", "airflow:TagResource", "airflow:UntagResource", "iam:PassRole", "iam:ListRoles", "iam:AttachRolePolicy", "s3:GetBucketLocation", "s3:ListBucket", "s3:ListBucketVersions", "s3:GetEncryptionConfiguration", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcs", "ec2:DescribeRouteTables", "kms:DescribeKey", "kms:ListAliases" ],
      "timeoutInMinutes" : 900
    },
    "delete" : {
      "permissions" : [ "airflow:GetEnvironment", "airflow:DeleteEnvironment" ]
    },
    "list" : {
      "permissions" : [ "airflow:ListEnvironments" ]
    }
  },
  "tagging" : {
    "taggable" : true,
    "tagOnCreate" : true,
    "tagUpdatable" : true,
    "cloudFormationSystemTags" : true,
    "tagProperty" : "/properties/Tags",
    "permissions" : [ "airflow:UntagResource", "airflow:TagResource" ]
  }
}