{
    "AWSTemplateFormatVersion": "2010-09-09",
    "Description": "Prisma Cloud stack for dns log ingestion",
    "Parameters": {
        "KinesisStreamName": {
            "Type": "String",
            "Description": "Provide a name for kinesis stream(Example: PrismaCloud_KinesisFirehose)",
            "AllowedPattern": "[-_a-zA-Z0-9]+",
            "Default": "PrismaCloudKinesisFirehose"
        },
        "WebhookUrl": {
            "Type": "String",
            "Description": "Generated Prisma Cloud Webhook URL"
        },
        "BackupS3BucketARN": {
            "Type": "String",
            "Description": "Backet S3 bucket ARN (Created in step 1)"
        },
        "KinesisFirehoseRoleARN": {
            "Type": "String",
            "Description": "Kinesis Firehose Role ARN (Created in step 1)"
        }
    },
    "Resources": {
        "KinesisFirehoseDnsLogStream": {
            "Type": "AWS::KinesisFirehose::DeliveryStream",
            "Properties": {
                "DeliveryStreamName": {"Fn::Sub": "${KinesisStreamName}-firehose"},
                "DeliveryStreamType": "DirectPut",
                "HttpEndpointDestinationConfiguration": {
                    "BufferingHints": {
                        "IntervalInSeconds": 300,
                        "SizeInMBs": 10
                    },
                    "CloudWatchLoggingOptions": {
                        "Enabled": true,
                        "LogGroupName": {
                            "Fn::Sub": "/aws/kinesisfirehose/${KinesisStreamName}"
                        },
                        "LogStreamName": "HttpEndpointDelivery"
                    },
                    "EndpointConfiguration": {
                        "Name": "PrismaCloudWebhook",
                        "Url": {
                            "Fn::Sub": "${WebhookUrl}"
                        }
                    },
                    "RequestConfiguration": {
                        "ContentEncoding": "GZIP"
                    },
                    "RetryOptions": {
                        "DurationInSeconds": 300
                    },
                    "RoleARN": {
                        "Fn::Sub": "${KinesisFirehoseRoleARN}"
                    },
                    "S3BackupMode": "FailedDataOnly",
                    "S3Configuration": {
                        "BucketARN": {
                            "Fn::Sub": "${BackupS3BucketARN}"
                        },
                        "BufferingHints": {
                            "IntervalInSeconds": 300,
                            "SizeInMBs": 10
                        },
                        "CloudWatchLoggingOptions": {
                            "Enabled": true,
                            "LogGroupName": {
                                "Fn::Sub": "/aws/kinesisfirehose/${KinesisStreamName}"
                            },
                            "LogStreamName": "HttpEndpointDelivery"
                        },
                        "CompressionFormat": "GZIP",
                        "EncryptionConfiguration": {
                            "NoEncryptionConfig": "NoEncryption"
                        },
                        "ErrorOutputPrefix": "failed-dns-logs",
                        "Prefix": "",
                        "RoleARN": {
                            "Fn::Sub": "${KinesisFirehoseRoleARN}"
                        }
                    }
                },
                "Tags": [{
                        "Key": "Service",
                        "Value": "PrismaCloud"
                    },
                    {
                        "Key": "Purpose",
                        "Value": "DNS_LOG"
                    }
                ]
            }
        },
        "Route53QueryLoggingConfig": {
            "Type": "AWS::Route53Resolver::ResolverQueryLoggingConfig",
            "DependsOn": [
                "KinesisFirehoseDnsLogStream"
            ],
            "Properties": {
                "DestinationArn": {
                    "Fn::GetAtt": [
                        "KinesisFirehoseDnsLogStream",
                        "Arn"
                    ]
                },
                "Name": {
                    "Fn::Sub": "${KinesisStreamName}-Logging-Config"
                }
            }
        }
    }
}