{
  "typeName" : "AWS::SecurityAgent::Pentest",
  "description" : "Resource Type definition for AWS::SecurityAgent::Pentest",
  "sourceUrl" : "https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-securityagent-pentest.html",
  "additionalProperties" : false,
  "properties" : {
    "PentestId" : {
      "type" : "string",
      "description" : "Unique identifier of the pentest"
    },
    "AgentSpaceId" : {
      "type" : "string",
      "description" : "Identifier of agent space where the pentest should be created"
    },
    "Title" : {
      "type" : "string",
      "description" : "Title of the penetration test"
    },
    "Assets" : {
      "$ref" : "#/definitions/Assets",
      "description" : "Collection of assets to be tested or used during the penetration test"
    },
    "ExcludeRiskTypes" : {
      "type" : "array",
      "description" : "A list of risk types excluded from the pentest execution",
      "items" : {
        "$ref" : "#/definitions/RiskType"
      },
      "insertionOrder" : false
    },
    "ServiceRole" : {
      "type" : "string",
      "description" : "Service role for accessing resources"
    },
    "LogConfig" : {
      "$ref" : "#/definitions/CloudWatchLog",
      "description" : "CloudWatch logs config"
    },
    "VpcConfig" : {
      "$ref" : "#/definitions/VpcConfig",
      "description" : "VPC configuration that the security testing environment accesses"
    },
    "NetworkTrafficConfig" : {
      "$ref" : "#/definitions/NetworkTrafficConfig",
      "description" : "Configuration for network traffic filtering"
    },
    "CodeRemediationStrategy" : {
      "$ref" : "#/definitions/CodeRemediationStrategy",
      "description" : "Strategy for code remediation on findings"
    },
    "DisableManagedSkills" : {
      "type" : "array",
      "description" : "A list of managed skills to disable for this pentest",
      "items" : {
        "$ref" : "#/definitions/SkillType"
      },
      "insertionOrder" : false
    },
    "CleanUpStrategy" : {
      "$ref" : "#/definitions/CleanUpStrategy",
      "description" : "Strategy for cleaning up resources after pentest job completion"
    },
    "CreatedAt" : {
      "type" : "string",
      "description" : "Timestamp when the pentest was created",
      "format" : "date-time"
    },
    "UpdatedAt" : {
      "type" : "string",
      "description" : "Timestamp when the pentest was last updated",
      "format" : "date-time"
    }
  },
  "definitions" : {
    "RiskType" : {
      "type" : "string",
      "description" : "Type of security risk to test for",
      "enum" : [ "CROSS_SITE_SCRIPTING", "DEFAULT_CREDENTIALS", "INSECURE_DIRECT_OBJECT_REFERENCE", "PRIVILEGE_ESCALATION", "SERVER_SIDE_TEMPLATE_INJECTION", "COMMAND_INJECTION", "CODE_INJECTION", "SQL_INJECTION", "ARBITRARY_FILE_UPLOAD", "INSECURE_DESERIALIZATION", "LOCAL_FILE_INCLUSION", "INFORMATION_DISCLOSURE", "PATH_TRAVERSAL", "SERVER_SIDE_REQUEST_FORGERY", "JSON_WEB_TOKEN_VULNERABILITIES", "XML_EXTERNAL_ENTITY", "FILE_DELETION", "OTHER", "GRAPHQL_VULNERABILITIES", "BUSINESS_LOGIC_VULNERABILITIES", "CRYPTOGRAPHIC_VULNERABILITIES", "DENIAL_OF_SERVICE", "FILE_ACCESS", "FILE_CREATION", "DATABASE_MODIFICATION", "DATABASE_ACCESS", "OUTBOUND_SERVICE_REQUEST", "UNKNOWN" ]
    },
    "Assets" : {
      "type" : "object",
      "description" : "Collection of assets to be tested during the pentest",
      "additionalProperties" : false,
      "properties" : {
        "Endpoints" : {
          "type" : "array",
          "description" : "List of endpoints to test",
          "items" : {
            "$ref" : "#/definitions/Endpoint"
          },
          "insertionOrder" : false
        },
        "Actors" : {
          "type" : "array",
          "description" : "List of actors used during testing",
          "items" : {
            "$ref" : "#/definitions/Actor"
          },
          "insertionOrder" : false
        },
        "Documents" : {
          "type" : "array",
          "description" : "List of documents providing additional context for the pentest",
          "items" : {
            "$ref" : "#/definitions/DocumentInfo"
          },
          "insertionOrder" : false
        },
        "SourceCode" : {
          "type" : "array",
          "description" : "List of source code repositories to analyze",
          "items" : {
            "$ref" : "#/definitions/SourceCodeRepository"
          },
          "insertionOrder" : false
        },
        "IntegratedRepositories" : {
          "type" : "array",
          "description" : "List of repositories connected via provider integrations",
          "items" : {
            "$ref" : "#/definitions/IntegratedRepository"
          },
          "insertionOrder" : false
        },
        "TrustedCaCertificates" : {
          "type" : "array",
          "description" : "Trust anchors for validating target endpoint TLS certificates, for endpoints served by a private or internal CA, an intermediate CA, or a self-signed certificate",
          "items" : {
            "$ref" : "#/definitions/TrustedCaCertificate"
          },
          "insertionOrder" : false
        }
      }
    },
    "TrustedCaCertificate" : {
      "type" : "object",
      "description" : "Trust anchor used when validating a target endpoint's TLS certificate",
      "additionalProperties" : false,
      "properties" : {
        "Source" : {
          "$ref" : "#/definitions/CaCertificateSource",
          "description" : "Where to read the certificate from"
        }
      },
      "required" : [ "Source" ]
    },
    "CaCertificateSource" : {
      "type" : "object",
      "description" : "Source of a trusted CA certificate. Exactly one member must be set.",
      "additionalProperties" : false,
      "properties" : {
        "InlinePem" : {
          "type" : "string",
          "description" : "PEM-encoded X.509 certificate supplied inline"
        },
        "ArtifactId" : {
          "type" : "string",
          "description" : "Artifact ID of an uploaded certificate file"
        },
        "S3Location" : {
          "type" : "string",
          "description" : "Amazon S3 location URI of a customer-staged certificate"
        }
      },
      "oneOf" : [ {
        "required" : [ "InlinePem" ]
      }, {
        "required" : [ "ArtifactId" ]
      }, {
        "required" : [ "S3Location" ]
      } ]
    },
    "Endpoint" : {
      "type" : "object",
      "description" : "An endpoint to be tested during the pentest",
      "additionalProperties" : false,
      "properties" : {
        "Uri" : {
          "type" : "string",
          "description" : "URI of the endpoint to test"
        }
      }
    },
    "Actor" : {
      "type" : "object",
      "description" : "An authenticated actor to be used during pentest execution",
      "additionalProperties" : false,
      "properties" : {
        "Identifier" : {
          "type" : "string",
          "description" : "Identifier for the actor"
        },
        "Uris" : {
          "type" : "array",
          "description" : "List of URIs this actor is authorized to access",
          "items" : {
            "type" : "string"
          },
          "insertionOrder" : false
        },
        "Authentication" : {
          "$ref" : "#/definitions/Authentication",
          "description" : "Authentication credentials for this actor"
        },
        "Description" : {
          "type" : "string",
          "description" : "Description of the actor"
        },
        "EnableEmailMfa" : {
          "type" : "boolean",
          "description" : "Whether email-based MFA is enabled for this actor"
        },
        "MfaForwardingAddress" : {
          "type" : "string",
          "description" : "Server-generated email forwarding address for receiving MFA codes"
        }
      }
    },
    "Authentication" : {
      "type" : "object",
      "description" : "Authentication configuration for a pentest actor",
      "additionalProperties" : false,
      "properties" : {
        "ProviderType" : {
          "type" : "string",
          "description" : "Type of authentication provider",
          "enum" : [ "SECRETS_MANAGER", "AWS_LAMBDA", "AWS_IAM_ROLE", "AWS_INTERNAL" ]
        },
        "Value" : {
          "type" : "string",
          "description" : "Reference value for the authentication provider, such as a secret ARN or Lambda ARN"
        }
      }
    },
    "DocumentInfo" : {
      "type" : "object",
      "description" : "A document attached to the pentest, uploaded to S3",
      "additionalProperties" : false,
      "properties" : {
        "S3Location" : {
          "type" : "string",
          "description" : "S3 document location"
        },
        "ArtifactId" : {
          "type" : "string",
          "description" : "Artifact identifier"
        }
      }
    },
    "SourceCodeRepository" : {
      "type" : "object",
      "description" : "A source code archive stored in S3 for analysis during the pentest",
      "additionalProperties" : false,
      "properties" : {
        "S3Location" : {
          "type" : "string",
          "description" : "S3 source code location"
        }
      }
    },
    "IntegratedRepository" : {
      "type" : "object",
      "description" : "A repository connected via a provider integration",
      "additionalProperties" : false,
      "properties" : {
        "IntegrationId" : {
          "type" : "string",
          "description" : "Unique identifier of the provider integration"
        },
        "ProviderResourceId" : {
          "type" : "string",
          "description" : "Identifier of the resource within the provider integration"
        },
        "Branch" : {
          "type" : "string",
          "description" : "An optional override for the repository branch"
        }
      },
      "required" : [ "IntegrationId", "ProviderResourceId" ]
    },
    "CloudWatchLog" : {
      "type" : "object",
      "description" : "CloudWatch Logs configuration for pentest output",
      "additionalProperties" : false,
      "properties" : {
        "LogGroup" : {
          "type" : "string",
          "description" : "CloudWatch log group"
        },
        "LogStream" : {
          "type" : "string",
          "description" : "CloudWatch log stream"
        }
      }
    },
    "VpcConfig" : {
      "type" : "object",
      "description" : "VPC configuration that the pentest agent accesses",
      "additionalProperties" : false,
      "properties" : {
        "VpcArn" : {
          "type" : "string"
        },
        "SecurityGroupArns" : {
          "type" : "array",
          "description" : "List of security groups in the VPC",
          "items" : {
            "type" : "string"
          },
          "insertionOrder" : false
        },
        "SubnetArns" : {
          "type" : "array",
          "description" : "List of subnets in the VPC",
          "items" : {
            "type" : "string"
          },
          "insertionOrder" : false
        }
      }
    },
    "NetworkTrafficConfig" : {
      "type" : "object",
      "description" : "Network traffic configuration for the pentest",
      "additionalProperties" : false,
      "properties" : {
        "Rules" : {
          "type" : "array",
          "description" : "Ordered list of network traffic rules",
          "items" : {
            "$ref" : "#/definitions/NetworkTrafficRule"
          },
          "insertionOrder" : true
        },
        "CustomHeaders" : {
          "type" : "array",
          "description" : "Custom headers to include in outbound requests",
          "items" : {
            "$ref" : "#/definitions/CustomHeader"
          },
          "insertionOrder" : true
        }
      }
    },
    "NetworkTrafficRule" : {
      "type" : "object",
      "description" : "Network traffic rule",
      "additionalProperties" : false,
      "properties" : {
        "Effect" : {
          "type" : "string",
          "description" : "Whether to allow or deny traffic matching this rule",
          "enum" : [ "ALLOW", "DENY" ]
        },
        "Pattern" : {
          "type" : "string",
          "description" : "URL pattern this rule applies to"
        },
        "NetworkTrafficRuleType" : {
          "type" : "string",
          "description" : "Type of pattern matching for this rule",
          "enum" : [ "URL" ]
        }
      }
    },
    "CustomHeader" : {
      "type" : "object",
      "description" : "A custom header to include in outbound requests",
      "additionalProperties" : false,
      "properties" : {
        "Name" : {
          "type" : "string",
          "description" : "Name of the header"
        },
        "Value" : {
          "type" : "string",
          "description" : "Value of the header"
        }
      }
    },
    "CodeRemediationStrategy" : {
      "type" : "string",
      "description" : "Strategy for remediating code vulnerabilities discovered during the pentest",
      "enum" : [ "AUTOMATIC", "DISABLED" ]
    },
    "CleanUpStrategy" : {
      "type" : "string",
      "description" : "Strategy for cleaning up resources after pentest job completion",
      "enum" : [ "BEST_EFFORT_DELETE", "RETAIN_ALL" ]
    },
    "SkillType" : {
      "type" : "string",
      "description" : "Type of managed skill that can be disabled for a pentest",
      "enum" : [ "FINDING_PERSONALIZATION", "LOGIN_OPTIMIZATION" ]
    }
  },
  "required" : [ "AgentSpaceId", "ServiceRole", "Assets" ],
  "tagging" : {
    "taggable" : false
  },
  "createOnlyProperties" : [ "/properties/AgentSpaceId" ],
  "primaryIdentifier" : [ "/properties/PentestId", "/properties/AgentSpaceId" ],
  "readOnlyProperties" : [ "/properties/PentestId", "/properties/CreatedAt", "/properties/UpdatedAt", "/properties/Assets/Actors/*/MfaForwardingAddress" ],
  "writeOnlyProperties" : [ "/properties/Assets/Actors/*/EnableEmailMfa" ],
  "handlers" : {
    "create" : {
      "permissions" : [ "securityagent:CreatePentest", "securityagent:BatchGetPentests", "kms:Decrypt" ]
    },
    "read" : {
      "permissions" : [ "securityagent:BatchGetPentests", "kms:Decrypt" ]
    },
    "update" : {
      "permissions" : [ "securityagent:UpdatePentest", "securityagent:BatchGetPentests", "kms:Decrypt" ]
    },
    "delete" : {
      "permissions" : [ "securityagent:BatchGetPentests", "securityagent:BatchDeletePentests", "kms:Decrypt" ]
    },
    "list" : {
      "handlerSchema" : {
        "properties" : {
          "AgentSpaceId" : {
            "$ref" : "resource-schema.json#/properties/AgentSpaceId"
          }
        },
        "required" : [ "AgentSpaceId" ]
      },
      "permissions" : [ "securityagent:ListPentests", "kms:Decrypt" ]
    }
  }
}