AWSTemplateFormatVersion: 2010-09-09
Description: Create a cross account role that authorizes access for Cloudguard BE.
Metadata:
  Version: 5.36.4
Parameters:
  CloudGuardAwsAccountId:
    Description: CloudGuard instance AWS AccountId that is requiring external trust
    Type: String
  ServerlessStage:
    Description: The Serverless stage name
    Type: String
  TimeStamp:
    Description: The current TimeStamp running TimeStamp
    Type: String
  ServerlessRegion:
    Description: The Serverless region
    Type: String
Conditions:
  IsProtegoRegionCondition: !Equals 
    - !Sub ${AWS::Region}
    - !Ref ServerlessRegion
Resources:
  CrossAccountRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: CloudGuardServerlessCrossAccountRole
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Principal:
              AWS:
                - !Ref CloudGuardAwsAccountId
            Action: sts:AssumeRole
            Condition:
              StringEquals:
                sts:ExternalId: !Base64 
                  Fn::Sub: ${AWS::AccountId}
      Policies:
        - PolicyName: CrossAccountCustomerRO
          PolicyDocument:
            Version: 2012-10-17
            Statement:
              - Effect: Allow
                Action:
                  - lambda:InvokeFunction
                  - lambda:GetFunction
                  - lambda:GetLayerVersion
                  - lambda:UpdateFunctionConfiguration
                  - lambda:ListTags
                  - lambda:UntagResource
                Resource:
                  - !GetAtt CloudGuardNodeCodeAnalysisV34.Arn
                  - !GetAtt CloudGuardJavaCodeAnalysisV34.Arn
                  - !GetAtt CloudGuardPythonCodeAnalysisV34.Arn
                  - !GetAtt CloudGuardDotnetCodeAnalysisV34.Arn
                  - !GetAtt CloudGuardFSPInjectorV34.Arn
              - Effect: Allow
                Action:
                  - lambda:UpdateFunctionCode
                  - lambda:UpdateFunctionConfiguration
                  - lambda:TagResource
                Resource:
                  - !Join 
                    - ':'
                    - - !GetAtt CloudGuardNodeCodeAnalysisV34.Arn
                      - '*'
                  - !Join 
                    - ':'
                    - - !GetAtt CloudGuardJavaCodeAnalysisV34.Arn
                      - '*'
                  - !Join 
                    - ':'
                    - - !GetAtt CloudGuardPythonCodeAnalysisV34.Arn
                      - '*'
                  - !Join 
                    - ':'
                    - - !GetAtt CloudGuardDotnetCodeAnalysisV34.Arn
                      - '*'
                  - !Join 
                    - ':'
                    - - !GetAtt CloudGuardFSPInjectorV34.Arn
                      - '*'
                  - !Sub >-
                    arn:${AWS::Partition}:lambda:*:${AWS::AccountId}:function:CloudGuardFSPLogsSender*
                  - !Sub >-
                    arn:${AWS::Partition}:lambda:*:${AWS::AccountId}:function:ProtegoFSPLogsSender*
              - Effect: Allow
                Action:
                  - logs:DescribeLogStreams
                  - logs:FilterLogEvents
                Resource:
                  - !Join 
                    - ':'
                    - - !GetAtt ProtegoPython3CodeAnalysisLogGroup.Arn
                      - '*'
                  - !Join 
                    - ':'
                    - - !GetAtt ProtegoJavaCodeAnalysisLogGroup.Arn
                      - '*'
                  - !Join 
                    - ':'
                    - - !GetAtt ProtegoNode14CodeAnalysisLogGroup.Arn
                      - '*'
                  - !Join 
                    - ':'
                    - - !GetAtt ProtegoCSharpCodeAnalysisLogGroup.Arn
                      - '*'
                  - !Join 
                    - ':'
                    - - !GetAtt ProtegoFSPInjectorLogGroup.Arn
                      - '*'
              - Effect: Allow
                Action:
                  - s3:GetObject
                Resource: !Sub arn:${AWS::Partition}:s3:::${ServerlessStage}-protego/*
              - Effect: Allow
                Action:
                  - iam:GetPolicy
                  - iam:GetRole
                  - iam:GetPolicyVersion
                  - iam:GetRolePolicy
                  - iam:ListAttachedRolePolicies
                  - iam:ListRolePolicies
                  - iam:SimulatePrincipalPolicy
                  - cloudwatch:GetMetricData
                  - cloudwatch:GetMetricStatistics
                  - events:ListRuleNamesByTarget
                  - s3:GetBucketNotification
                  - s3:GetBucketLocation
                  - s3:GetBucketAcl
                  - s3:GetBucketPolicy
                  - lambda:ListEventSourceMappings
                  - lambda:ListFunctions
                  - lambda:GetFunction
                  - lambda:GetFunctionConfiguration
                  - lambda:GetPolicy
                  - lambda:ListAliases
                  - lambda:ListTags
                  - lambda:ListVersionsByFunction
                  - lambda:GetLayerVersion
                  - lambda:GetFunctionUrlConfig
                  - sns:ListSubscriptionsByTopic
                  - ec2:DescribeRegions
                  - logs:DescribeLogGroups
                Resource: '*'
  ProtegoPython3CodeAnalysisLogGroup:
    Type: AWS::Logs::LogGroup
    Properties:
      LogGroupName: /aws/lambda/CloudGuardPythonCodeAnalysisV34
      RetentionInDays: 30
    DependsOn:
      - PreDeployPhoneHomeCustomResource
  ProtegoJavaCodeAnalysisLogGroup:
    Type: AWS::Logs::LogGroup
    Properties:
      LogGroupName: /aws/lambda/CloudGuardJavaCodeAnalysisV34
      RetentionInDays: 30
    DependsOn:
      - PreDeployPhoneHomeCustomResource
  ProtegoNode14CodeAnalysisLogGroup:
    Type: AWS::Logs::LogGroup
    Properties:
      LogGroupName: /aws/lambda/CloudGuardNodeCodeAnalysisV34
      RetentionInDays: 30
    DependsOn:
      - PreDeployPhoneHomeCustomResource
  ProtegoCSharpCodeAnalysisLogGroup:
    Type: AWS::Logs::LogGroup
    Properties:
      LogGroupName: /aws/lambda/CloudGuardDotnetCodeAnalysisV34
      RetentionInDays: 30
    DependsOn:
      - PreDeployPhoneHomeCustomResource
  ProtegoFSPInjectorLogGroup:
    Type: AWS::Logs::LogGroup
    Properties:
      LogGroupName: /aws/lambda/CloudGuardFSPInjectorV34
      RetentionInDays: 30
    DependsOn:
      - PreDeployPhoneHomeCustomResource
  CodeAnalysisPython3LambdaExecutionRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: CloudGuardServerlessCodeAnalysisPython3LambdaExecutionRole
      Path: /
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - lambda.amazonaws.com
            Action:
              - sts:AssumeRole
      Policies:
        - PolicyName: CodeAnalysisPython3LambdaExecutionPolicy
          PolicyDocument:
            Version: 2012-10-17
            Statement:
              - Effect: Allow
                Action:
                  - logs:CreateLogStream
                  - logs:PutLogEvents
                Resource:
                  - !GetAtt ProtegoPython3CodeAnalysisLogGroup.Arn
              - Effect: Allow
                Action:
                  - lambda:GetFunction
                  - lambda:ListLayers
                  - lambda:GetLayerVersion
                  - lambda:ListLayerVersions
                Resource: '*'
  CodeAnalysisJavaLambdaExecutionRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: CloudGuardServerlessCodeAnalysisJavaLambdaExecutionRole
      Path: /
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - lambda.amazonaws.com
            Action:
              - sts:AssumeRole
      Policies:
        - PolicyName: CodeAnalysisJavaLambdaExecutionPolicy
          PolicyDocument:
            Version: 2012-10-17
            Statement:
              - Effect: Allow
                Action:
                  - logs:CreateLogStream
                  - logs:PutLogEvents
                Resource:
                  - !GetAtt ProtegoJavaCodeAnalysisLogGroup.Arn
              - Effect: Allow
                Action:
                  - lambda:GetFunction
                  - lambda:ListLayers
                  - lambda:GetLayerVersion
                  - lambda:ListLayerVersions
                Resource: '*'
  CodeAnalysisNode14LambdaExecutionRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: CloudGuardServerlessCodeAnalysisNode14LambdaExecutionRole
      Path: /
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - lambda.amazonaws.com
            Action:
              - sts:AssumeRole
      Policies:
        - PolicyName: CodeAnalysisNode14LambdaExecutionPolicy
          PolicyDocument:
            Version: 2012-10-17
            Statement:
              - Effect: Allow
                Action:
                  - logs:CreateLogStream
                  - logs:PutLogEvents
                Resource:
                  - !GetAtt ProtegoNode14CodeAnalysisLogGroup.Arn
              - Effect: Allow
                Action:
                  - lambda:GetFunction
                  - lambda:ListLayers
                  - lambda:GetLayerVersion
                  - lambda:ListLayerVersions
                Resource: '*'
  CodeAnalysisCSharpLambdaExecutionRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: CloudGuardServerlessCodeAnalysisCSharpLambdaExecutionRole
      Path: /
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - lambda.amazonaws.com
            Action:
              - sts:AssumeRole
      Policies:
        - PolicyName: CodeAnalysisCSharpLambdaExecutionPolicy
          PolicyDocument:
            Version: 2012-10-17
            Statement:
              - Effect: Allow
                Action:
                  - logs:CreateLogStream
                  - logs:PutLogEvents
                Resource:
                  - !GetAtt ProtegoCSharpCodeAnalysisLogGroup.Arn
              - Effect: Allow
                Action:
                  - lambda:GetFunction
                  - lambda:ListLayers
                  - lambda:GetLayerVersion
                  - lambda:ListLayerVersions
                Resource: '*'
  FSPInjectorLambdaExecutionRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: CloudGuardServerlessFSPInjectorLambdaExecutionRole
      Path: /
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - lambda.amazonaws.com
            Action:
              - sts:AssumeRole
      Policies:
        - PolicyName: FSPInjectorLambdaExecutionPolicy
          PolicyDocument:
            Version: 2012-10-17
            Statement:
              - Effect: Allow
                Action:
                  - logs:CreateLogStream
                  - logs:PutLogEvents
                Resource:
                  - !GetAtt ProtegoFSPInjectorLogGroup.Arn
              - Effect: Allow
                Action:
                  - lambda:GetFunction
                  - lambda:GetFunctionConfiguration
                  - lambda:ListLayers
                  - lambda:GetLayerVersion
                  - lambda:ListLayerVersions
                  - lambda:UpdateFunctionConfiguration
                  - logs:GetQueryResults
                Resource: '*'
              - Effect: Allow
                Action:
                  - logs:StartQuery
                Resource: !Sub >-
                  arn:${AWS::Partition}:logs:*:${AWS::AccountId}:log-group:/aws/lambda/*
  CloudGuardPythonCodeAnalysisV34:
    Type: AWS::Lambda::Function
    Properties:
      Handler: function_code_analysis_python.lambda_handler
      FunctionName: CloudGuardPythonCodeAnalysisV34
      Role: !GetAtt CodeAnalysisPython3LambdaExecutionRole.Arn
      Code:
        S3Bucket: !Sub ${ServerlessStage}-protego
        S3Key: !Sub >-
          code_analysis_functions/${ServerlessStage}_function_code_analysis_python3.zip
      MemorySize: 3008
      Description: Statically analyze Python code
      Runtime: python3.11
      Timeout: 860
      Tags:
        - Key: Owner
          Value: Cloudguard Serverless Security
    DependsOn:
      - CodeAnalysisPython3LambdaExecutionRole
  CloudGuardJavaCodeAnalysisV34:
    Type: AWS::Lambda::Function
    Properties:
      Handler: io.protego.lambda.Handler
      FunctionName: CloudGuardJavaCodeAnalysisV34
      Role: !GetAtt CodeAnalysisJavaLambdaExecutionRole.Arn
      Code:
        S3Bucket: !Sub ${ServerlessStage}-protego
        S3Key: code_analysis_functions/function_api_usage_java-1.0.jar
      MemorySize: 3008
      Description: Statically analyze Java code
      Runtime: java11
      Timeout: 860
      Tags:
        - Key: Owner
          Value: Cloudguard Serverless Security
    DependsOn:
      - CodeAnalysisJavaLambdaExecutionRole
  CloudGuardNodeCodeAnalysisV34:
    Type: AWS::Lambda::Function
    Properties:
      Handler: index.handler
      FunctionName: CloudGuardNodeCodeAnalysisV34
      Role: !GetAtt CodeAnalysisNode14LambdaExecutionRole.Arn
      Code:
        S3Bucket: !Sub ${ServerlessStage}-protego
        S3Key: !Sub >-
          code_analysis_functions/${ServerlessStage}_function_code_analysis_node.zip
      MemorySize: 3008
      Description: Statically analyze NodeJs code
      Runtime: nodejs20.x
      Timeout: 860
      Tags:
        - Key: Owner
          Value: Cloudguard Serverless Security
      Layers:
        - !Sub >-
          arn:${AWS::Partition}:lambda:${AWS::Region}:317307795746:layer:aws-lambda-layer-java:1
    DependsOn:
      - CodeAnalysisNode14LambdaExecutionRole
  CloudGuardDotnetCodeAnalysisV34:
    Type: AWS::Lambda::Function
    Properties:
      Handler: >-
        function_api_usage_c_sharp::function_api_usage_c_sharp.Handler::HandleRequest
      FunctionName: CloudGuardDotnetCodeAnalysisV34
      Role: !GetAtt CodeAnalysisCSharpLambdaExecutionRole.Arn
      Code:
        S3Bucket: !Sub ${ServerlessStage}-protego
        S3Key: code_analysis_functions/function_api_usage_c_sharp.zip
      MemorySize: 1024
      Description: Statically analyze C# code
      Runtime: dotnet8
      Timeout: 860
      Tags:
        - Key: Owner
          Value: Cloudguard Serverless Security
    DependsOn:
      - CodeAnalysisCSharpLambdaExecutionRole
  CloudGuardFSPInjectorV34:
    Type: AWS::Lambda::Function
    Properties:
      Handler: fsp_injector.lambda_handler
      FunctionName: CloudGuardFSPInjectorV34
      Role: !GetAtt FSPInjectorLambdaExecutionRole.Arn
      Code:
        S3Bucket: !Sub ${ServerlessStage}-protego
        S3Key: !Sub >-
          code_analysis_functions/${ServerlessStage}_fsp_injector_min_template_v10.zip
      MemorySize: 3008
      Description: FSP injector, add FSP runtime protection to functions
      Runtime: python3.9
      Layers: []
      Timeout: 860
      Tags:
        - Key: Owner
          Value: Cloudguard Serverless Security
    DependsOn:
      - FSPInjectorLambdaExecutionRole
  ProtegoAgentBucket:
    Type: AWS::S3::Bucket
    Condition: IsProtegoRegionCondition
    Properties:
      BucketName: !Sub protego-fsp-${AWS::AccountId}
      BucketEncryption:
        ServerSideEncryptionConfiguration:
          - ServerSideEncryptionByDefault:
              SSEAlgorithm: aws:kms
              KMSMasterKeyID: alias/CloudGuardServerlessAgentBucketKey
    DependsOn:
      - PreDeployPhoneHomeCustomResource
  CloudGuardServerlessAgentBucketKey:
    Type: AWS::KMS::Key
    Properties:
      Description: Key for encryption of serverless agent bucket
      MultiRegion: false
      PendingWindowInDays: 7
      KeyPolicy:
        Version: 2012-10-17
        Id: cloud-guard-serverless-agent-bucket-key
        Statement:
          - Sid: Enable IAM User Permissions
            Effect: Allow
            Principal:
              AWS: !Sub arn:${AWS::Partition}:iam::${AWS::AccountId}:root
            Action: kms:*
            Resource: '*'
          - Sid: Allow access for Key Administrators
            Effect: Allow
            Principal:
              AWS: !Sub arn:${AWS::Partition}:iam::${AWS::AccountId}:root
            Action:
              - kms:ReplicateKey
              - kms:Create*
              - kms:Describe*
              - kms:Enable*
              - kms:List*
              - kms:Put*
              - kms:Update*
              - kms:Revoke*
              - kms:Disable*
              - kms:Get*
              - kms:Delete*
              - kms:ScheduleKeyDeletion
              - kms:CancelKeyDeletion
            Resource: '*'
          - Sid: Allow key to decrypt
            Effect: Allow
            Principal: '*'
            Action:
              - kms:DescribeKey
              - kms:Decrypt
              - kms:ScheduleKeyDeletion
              - kms:CancelKeyDeletion
            Resource: '*'
            Condition:
              StringEquals:
                aws:PrincipalAccount: !Ref AWS::AccountId
          - Sid: Allow usage of the key
            Effect: Allow
            Principal:
              AWS: !Sub >-
                arn:aws:iam::${AWS::AccountId}:role/CloudGuardServerlessCrossAccountRole
            Action:
              - kms:Encrypt
              - kms:ReEncrypt*
              - kms:GenerateDataKey*
              - kms:PutKeyPolicy
            Resource: '*'
          - Sid: Allow attachment of persistent resources
            Effect: Allow
            Principal:
              AWS: !Sub arn:${AWS::Partition}:iam::${AWS::AccountId}:root
            Action:
              - kms:CreateGrant
              - kms:ListGrants
              - kms:RevokeGrant
            Resource: '*'
            Condition:
              Bool:
                kms:GrantIsForAWSResource: true
    DependsOn:
      - PreDeployPhoneHomeCustomResource
      - CrossAccountRole
  CloudGuardServerlessAgentBucketKeyAlias:
    Type: AWS::KMS::Alias
    Properties:
      AliasName: alias/CloudGuardServerlessAgentBucketKey
      TargetKeyId: !GetAtt CloudGuardServerlessAgentBucketKey.Arn
  ProtegoAgentBucketPolicy:
    Type: AWS::S3::BucketPolicy
    Properties:
      Bucket: !Ref ProtegoAgentBucket
      PolicyDocument:
        Statement:
          - Sid: ProtegoOnlySecureTransport
            Effect: Deny
            Principal: '*'
            Action: '*'
            Resource: !Sub arn:${AWS::Partition}:s3:::${ProtegoAgentBucket}/*
            Condition:
              Bool:
                aws:SecureTransport: 'false'
          - Sid: ProtegoPermissions
            Effect: Allow
            Principal: '*'
            Action:
              - s3:ListBucket
              - s3:GetObject
            Resource:
              - !Sub arn:${AWS::Partition}:s3:::${ProtegoAgentBucket}
              - !Sub arn:${AWS::Partition}:s3:::${ProtegoAgentBucket}/*
            Condition:
              StringEquals:
                aws:PrincipalAccount: !Ref AWS::AccountId
  ProtegoAgentPolicy:
    Type: AWS::IAM::Policy
    Properties:
      PolicyName: CloudguardFSPPolicy
      PolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Action:
              - s3:GetBucketPolicy
              - s3:ListBucket
              - s3:PutBucketPolicy
              - s3:DeleteBucketPolicy
            Resource: !Sub arn:${AWS::Partition}:s3:::${ProtegoAgentBucket}
          - Effect: Allow
            Action:
              - s3:DeleteObject
              - s3:GetObject
              - s3:PutObject
            Resource: !Sub arn:${AWS::Partition}:s3:::${ProtegoAgentBucket}/*
          - Effect: Allow
            Action:
              - logs:PutSubscriptionFilter
              - logs:DeleteSubscriptionFilter
              - logs:DescribeSubscriptionFilters
            Resource: !Sub 'arn:${AWS::Partition}:logs:*:${AWS::AccountId}:log-group:*:'
      Roles:
        - !Ref CrossAccountRole
  ProtegoFSPLogsPolicy:
    Type: AWS::IAM::Policy
    Properties:
      PolicyName: CloudguardFSPLogsPolicy
      PolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Action:
              - lambda:CreateFunction
              - lambda:DeleteFunction
              - lambda:AddPermission
            Resource:
              - !Sub >-
                arn:${AWS::Partition}:lambda:*:${AWS::AccountId}:function:CloudGuardFSPLogsSender*
              - !Sub >-
                arn:${AWS::Partition}:lambda:*:${AWS::AccountId}:function:ProtegoFSPLogsSender*
          - Effect: Allow
            Action:
              - logs:CreateLogGroup
              - logs:PutRetentionPolicy
              - logs:DeleteLogGroup
            Resource:
              - !Sub >-
                arn:${AWS::Partition}:logs:*:${AWS::AccountId}:log-group:/aws/lambda/CloudGuardFSPLogsSender*:*
              - !Sub >-
                arn:${AWS::Partition}:logs:*:${AWS::AccountId}:log-group:/aws/lambda/ProtegoFSPLogsSender*:*
          - Effect: Allow
            Action:
              - iam:PassRole
            Resource: !GetAtt ProtegoFSPLogsSenderRole.Arn
      Roles:
        - !Ref CrossAccountRole
  ProtegoFSPLogsSenderRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: CloudGuardFSPLogsSenderRole
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - lambda.amazonaws.com
            Action:
              - sts:AssumeRole
      Policies:
        - PolicyName: ProtegoFSPLogsSenderPolicy
          PolicyDocument:
            Version: 2012-10-17
            Statement:
              - Effect: Allow
                Action:
                  - logs:CreateLogStream
                  - logs:PutLogEvents
                Resource:
                  - !Sub >-
                    arn:${AWS::Partition}:logs:*:${AWS::AccountId}:log-group:/aws/lambda/CloudGuardFSPLogsSender*:*
                  - !Sub >-
                    arn:${AWS::Partition}:logs:*:${AWS::AccountId}:log-group:/aws/lambda/ProtegoFSPLogsSender*:*
              - Effect: Allow
                Action:
                  - sqs:GetQueueUrl
                  - sqs:SendMessage
                Resource: !Sub >-
                  arn:${AWS::Partition}:sqs:${AWS::Region}:${CloudGuardAwsAccountId}:${ServerlessStage}_customer_fsp_logs_queue*
    DependsOn:
      - PreDeployPhoneHomeCustomResource
  PreDeployPhoneHomeCustomResource:
    Type: Custom::PhoneHomeCustomResource
    Condition: IsProtegoRegionCondition
    Version: '1.0'
    Properties:
      ServiceToken: !Sub >-
        arn:${AWS::Partition}:sns:${AWS::Region}:${CloudGuardAwsAccountId}:${ServerlessStage}-${AWS::AccountId}-notifications
      AccountID: !Ref AWS::AccountId
      TimeStamp: !Ref TimeStamp
      CFTemplateVersion: 34
  PhoneHomeCustomResourceNew:
    Type: Custom::PhoneHomeCustomResource
    Version: '1.0'
    DependsOn:
      - CrossAccountRole
      - ProtegoAgentPolicy
      - ProtegoFSPLogsPolicy
      - ProtegoFSPLogsSenderRole
      - ProtegoAgentBucketPolicy
    Properties:
      ServiceToken: !Sub >-
        arn:${AWS::Partition}:sns:${AWS::Region}:${CloudGuardAwsAccountId}:${ServerlessStage}-${AWS::AccountId}-notifications
      RoleArn: !GetAtt CrossAccountRole.Arn
      AccountID: !Ref AWS::AccountId
      TimeStamp: !Ref TimeStamp
      CFTemplateVersion: 34
      ProtegoFSPLambdaRoleARN: !GetAtt ProtegoFSPLogsSenderRole.Arn
      Features:
        ProtegoBase: true
        ProtegoFSP: true
        ProtegoFSPInjector: true
      Python3CodeAnalysisFunc: !GetAtt CloudGuardPythonCodeAnalysisV34.Arn
      JavaCodeAnalysisFunc: !GetAtt CloudGuardJavaCodeAnalysisV34.Arn
      NodeCodeAnalysisFunc: !GetAtt CloudGuardNodeCodeAnalysisV34.Arn
      CSharpCodeAnalysisFunc: !GetAtt CloudGuardDotnetCodeAnalysisV34.Arn
      FSPInjectorFunc: !GetAtt CloudGuardFSPInjectorV34.Arn
Outputs:
  RoleARN:
    Description: The ARN of the role that can be assumed by the other account.
    Value: !GetAtt CrossAccountRole.Arn
  ProtegoFSPLambdaRoleARN:
    Description: >-
      The ARN of the role that can be used by protego fsp logs sender lambda in
      customer account.
    Value: !GetAtt ProtegoFSPLogsSenderRole.Arn
  FSPInjectorLambdaRoleARN:
    Description: >-
      The ARN of the role that is used by fsp injector lambda in customer
      account.
    Value: !GetAtt FSPInjectorLambdaExecutionRole.Arn
