app-stack.test.ts.snap

// Jest Snapshot v1, https://goo.gl/fbAQLP

exports[`AppStack prod matches the snapshot 1`] = `
{
  "Outputs": {
    "DeployRoleArn": {
      "Description": "SPS GitHub Actions deploy role ARN",
      "Value": {
        "Fn::GetAtt": [
          "DeployRole885297C3",
          "Arn",
        ],
      },
    },
    "EcrRepoUri": {
      "Description": "SPS ECR repository URI",
      "Value": {
        "Fn::Join": [
          "",
          [
            {
              "Fn::Select": [
                4,
                {
                  "Fn::Split": [
                    ":",
                    {
                      "Fn::GetAtt": [
                        "EcrRepository4D7B3EE1",
                        "Arn",
                      ],
                    },
                  ],
                },
              ],
            },
            ".dkr.ecr.",
            {
              "Fn::Select": [
                3,
                {
                  "Fn::Split": [
                    ":",
                    {
                      "Fn::GetAtt": [
                        "EcrRepository4D7B3EE1",
                        "Arn",
                      ],
                    },
                  ],
                },
              ],
            },
            ".",
            {
              "Ref": "AWS::URLSuffix",
            },
            "/",
            {
              "Ref": "EcrRepository4D7B3EE1",
            },
          ],
        ],
      },
    },
    "EcsAppTaskFamily": {
      "Description": "SPS app task definition family",
      "Value": "sps-app-prod",
    },
    "EcsClusterName": {
      "Description": "SPS ECS cluster name",
      "Value": {
        "Ref": "EcsCluster97242B84",
      },
    },
    "EcsDbBootstrapTaskFamily": {
      "Description": "SPS one-shot scholars_audit bootstrap task family - run before migrate (#493)",
      "Value": "sps-db-bootstrap-prod",
    },
    "EcsMigrationTaskFamily": {
      "Description": "SPS one-shot prisma migrate deploy task family",
      "Value": "sps-migrate-prod",
    },
    "EcsSearchEvalCanaryTaskFamily": {
      "Description": "SPS one-shot post-deploy search-eval canary task family - run after rollout is confirmed healthy (#1444)",
      "Value": "sps-search-eval-canary-prod",
    },
    "EcsServiceName": {
      "Description": "SPS ECS service name",
      "Value": {
        "Fn::GetAtt": [
          "EcsService81FC6EF6",
          "Name",
        ],
      },
    },
    "EcsVerifyGrantsTaskFamily": {
      "Description": "SPS one-shot grant-equality verify task family - run after db-bootstrap, before the service rolls (ADR-009)",
      "Value": "sps-verify-grants-prod",
    },
    "EtlEcrRepoUri": {
      "Description": "SPS ETL batch-image ECR repository URI (#454)",
      "Value": {
        "Fn::Join": [
          "",
          [
            {
              "Fn::Select": [
                4,
                {
                  "Fn::Split": [
                    ":",
                    {
                      "Fn::GetAtt": [
                        "EtlEcrRepository058F5EEC",
                        "Arn",
                      ],
                    },
                  ],
                },
              ],
            },
            ".dkr.ecr.",
            {
              "Fn::Select": [
                3,
                {
                  "Fn::Split": [
                    ":",
                    {
                      "Fn::GetAtt": [
                        "EtlEcrRepository058F5EEC",
                        "Arn",
                      ],
                    },
                  ],
                },
              ],
            },
            ".",
            {
              "Ref": "AWS::URLSuffix",
            },
            "/",
            {
              "Ref": "EtlEcrRepository058F5EEC",
            },
          ],
        ],
      },
    },
    "ExportsOutputFnGetAttEcrRepository4D7B3EE1Arn21868DE8": {
      "Export": {
        "Name": "Sps-App-prod:ExportsOutputFnGetAttEcrRepository4D7B3EE1Arn21868DE8",
      },
      "Value": {
        "Fn::GetAtt": [
          "EcrRepository4D7B3EE1",
          "Arn",
        ],
      },
    },
    "ExportsOutputFnGetAttPublicAlb84330974DNSNameFA3FF7E9": {
      "Export": {
        "Name": "Sps-App-prod:ExportsOutputFnGetAttPublicAlb84330974DNSNameFA3FF7E9",
      },
      "Value": {
        "Fn::GetAtt": [
          "PublicAlb84330974",
          "DNSName",
        ],
      },
    },
    "ExportsOutputRefEcrRepository4D7B3EE140E01346": {
      "Export": {
        "Name": "Sps-App-prod:ExportsOutputRefEcrRepository4D7B3EE140E01346",
      },
      "Value": {
        "Ref": "EcrRepository4D7B3EE1",
      },
    },
    "InternalAlbDns": {
      "Description": "SPS internal ALB DNS name (consumed by EtlStack).",
      "Export": {
        "Name": "Sps-App-prod-InternalAlbDns",
      },
      "Value": {
        "Fn::GetAtt": [
          "InternalAlb58CEEAE8",
          "DNSName",
        ],
      },
    },
    "InternalAlbSecurityGroupId": {
      "Description": "SPS internal ALB security group id (consumed by EtlStack ingress).",
      "Export": {
        "Name": "Sps-App-prod-InternalAlbSecurityGroupId",
      },
      "Value": {
        "Fn::GetAtt": [
          "InternalAlbSecurityGroup32D71C5A",
          "GroupId",
        ],
      },
    },
    "PublicAlbDns": {
      "Description": "SPS public ALB DNS name (consumed by EdgeStack)",
      "Value": {
        "Fn::GetAtt": [
          "PublicAlb84330974",
          "DNSName",
        ],
      },
    },
  },
  "Parameters": {
    "BootstrapVersion": {
      "Default": "/cdk-bootstrap/hnb659fds/version",
      "Description": "Version of the CDK Bootstrap resources in this environment, automatically retrieved from SSM Parameter Store. [cdk:skip]",
      "Type": "AWS::SSM::Parameter::Value<String>",
    },
    "SsmParameterValuespsprodnetalbsgidC96584B6F00A464EAD1953AFF4B05118Parameter": {
      "Default": "/sps/prod/net/alb-sg-id",
      "Type": "AWS::SSM::Parameter::Value<String>",
    },
    "SsmParameterValuespsprodnetappsgidC96584B6F00A464EAD1953AFF4B05118Parameter": {
      "Default": "/sps/prod/net/app-sg-id",
      "Type": "AWS::SSM::Parameter::Value<String>",
    },
    "SsmParameterValuespsprodnetetlsgidC96584B6F00A464EAD1953AFF4B05118Parameter": {
      "Default": "/sps/prod/net/etl-sg-id",
      "Type": "AWS::SSM::Parameter::Value<String>",
    },
  },
  "Resources": {
    "AppIngressFromInternalAlb": {
      "Properties": {
        "Description": "Internal ALB to SPS app tasks on container port (prod)",
        "FromPort": 3000,
        "GroupId": {
          "Ref": "SsmParameterValuespsprodnetappsgidC96584B6F00A464EAD1953AFF4B05118Parameter",
        },
        "IpProtocol": "tcp",
        "SourceSecurityGroupId": {
          "Fn::GetAtt": [
            "InternalAlbSecurityGroup32D71C5A",
            "GroupId",
          ],
        },
        "ToPort": 3000,
      },
      "Type": "AWS::EC2::SecurityGroupIngress",
    },
    "AppIngressFromPublicAlb": {
      "Properties": {
        "Description": "Public ALB to SPS app tasks on container port (prod)",
        "FromPort": 3000,
        "GroupId": {
          "Ref": "SsmParameterValuespsprodnetappsgidC96584B6F00A464EAD1953AFF4B05118Parameter",
        },
        "IpProtocol": "tcp",
        "SourceSecurityGroupId": {
          "Ref": "SsmParameterValuespsprodnetalbsgidC96584B6F00A464EAD1953AFF4B05118Parameter",
        },
        "ToPort": 3000,
      },
      "Type": "AWS::EC2::SecurityGroupIngress",
    },
    "AppLogGroup7D8CD952": {
      "DeletionPolicy": "Retain",
      "Properties": {
        "LogGroupName": "/aws/ecs/sps-app-prod",
        "RetentionInDays": 90,
      },
      "Type": "AWS::Logs::LogGroup",
      "UpdateReplacePolicy": "Retain",
    },
    "AppTaskDefinitionCBC902A9": {
      "Properties": {
        "ContainerDefinitions": [
          {
            "Environment": [
              {
                "Name": "NODE_ENV",
                "Value": "production",
              },
              {
                "Name": "PORT",
                "Value": "3000",
              },
              {
                "Name": "OTEL_SERVICE_NAME",
                "Value": "Scholars-prod",
              },
              {
                "Name": "OTEL_EXPORTER_OTLP_ENDPOINT",
                "Value": "http://localhost:4318",
              },
              {
                "Name": "OTEL_PROPAGATORS",
                "Value": "tracecontext,xray",
              },
              {
                "Name": "SPS_ENV",
                "Value": "prod",
              },
              {
                "Name": "NEXT_ISR_CACHE_BUCKET",
                "Value": {
                  "Ref": "IsrCacheBucket311880A1",
                },
              },
              {
                "Name": "GRANT_MATCHER_SUBTOPIC_GRAIN",
                "Value": "off",
              },
              {
                "Name": "GRANT_MATCHER_ABSTAIN_FLOOR",
                "Value": "0",
              },
              {
                "Name": "SCHOLARS_CLOUDFRONT_DISTRIBUTION_ID",
                "Value": "E28NKDFXC7K2ZL",
              },
              {
                "Name": "SAML_IDP_ENTITY_ID",
                "Value": "https://login-proxy.weill.cornell.edu/idp",
              },
              {
                "Name": "SAML_IDP_SSO_URL",
                "Value": "https://login-proxy.weill.cornell.edu/idp/profile/SAML2/Redirect/SSO",
              },
              {
                "Name": "SAML_SP_ENTITY_ID",
                "Value": "https://scholars.weill.cornell.edu/api/auth/saml/metadata",
              },
              {
                "Name": "SAML_SP_ACS_URL",
                "Value": "https://scholars.weill.cornell.edu/api/auth/saml/callback",
              },
              {
                "Name": "SAML_CWID_ATTRIBUTE",
                "Value": "CWID",
              },
              {
                "Name": "SAML_EPPN_TRUSTED_SCOPES",
                "Value": "nyp.org,qatar-med.cornell.edu",
              },
              {
                "Name": "SELF_EDIT_REQUEST_CHANGE_SEND",
                "Value": "off",
              },
              {
                "Name": "SCHOLARS_MAIL_FROM",
                "Value": "no-reply-scholars@weill.cornell.edu",
              },
              {
                "Name": "SELF_EDIT_REQUEST_CHANGE_RATE_LIMIT",
                "Value": "20",
              },
              {
                "Name": "SELF_EDIT_ADMINISTRATORS_TAB",
                "Value": "on",
              },
              {
                "Name": "SELF_EDIT_ED_ADMINS_IMPORT",
                "Value": "off",
              },
              {
                "Name": "SELF_EDIT_ORG_UNIT_CREATE_SUPERUSER_ONLY",
                "Value": "off",
              },
              {
                "Name": "EDIT_DATA_QUALITY_DASHBOARD",
                "Value": "on",
              },
              {
                "Name": "RECITER_REJECT_SEND",
                "Value": "on",
              },
              {
                "Name": "SELF_EDIT_MANUAL_HIGHLIGHTS",
                "Value": "on",
              },
              {
                "Name": "SELF_EDIT_COI_GAP_HINT",
                "Value": "on",
              },
              {
                "Name": "SELF_EDIT_GRANT_RECS",
                "Value": "off",
              },
              {
                "Name": "PRESTIGE_AXIS_WEIGHT",
                "Value": "0",
              },
              {
                "Name": "EDIT_UNIT_ROSTER_EXPORT",
                "Value": "on",
              },
              {
                "Name": "PROFILE_CENTER_AFFILIATION",
                "Value": "on",
              },
              {
                "Name": "UNIT_ADMIN_CENTER_PROXY",
                "Value": "on",
              },
              {
                "Name": "CENTER_PROGRAM_PAGES",
                "Value": "on",
              },
              {
                "Name": "CENTER_COLLABORATION_NETWORK",
                "Value": "on",
              },
              {
                "Name": "CENTER_COLLABORATION_GRANT_AXIS",
                "Value": "on",
              },
              {
                "Name": "CLINICAL_TRIALS_SECTION",
                "Value": "on",
              },
              {
                "Name": "DATA_SHARING_SECTION",
                "Value": "off",
              },
              {
                "Name": "AVAILABLE_TECHNOLOGIES_SECTION",
                "Value": "on",
              },
              {
                "Name": "NEWS_MENTIONS_SECTION",
                "Value": "on",
              },
              {
                "Name": "NEWS_APPROVAL_QUEUE",
                "Value": "on",
              },
              {
                "Name": "CONSOLE_SUBNAV_GROUPED",
                "Value": "on",
              },
              {
                "Name": "MATCHA",
                "Value": "on",
              },
              {
                "Name": "MATCHA_SPINE",
                "Value": "on",
              },
              {
                "Name": "MATCHA_RECENCY",
                "Value": "off",
              },
              {
                "Name": "MATCHA_GLOSS_RERANK",
                "Value": "off",
              },
              {
                "Name": "MATCHA_GLOSS_RERANK_LAMBDA",
                "Value": "0.5",
              },
              {
                "Name": "MATCHA_GLOSS_INWORDS",
                "Value": "off",
              },
              {
                "Name": "GRANT_MATCHA",
                "Value": "on",
              },
              {
                "Name": "SELF_EDIT_RECITER_PENDING_HINT",
                "Value": "on",
              },
              {
                "Name": "MENTORING_COPUB_BRIDGE",
                "Value": "on",
              },
              {
                "Name": "PUBLICATION_CITING_BRIDGE",
                "Value": "on",
              },
              {
                "Name": "SELF_EDIT_SLUG_REQUEST",
                "Value": "on",
              },
              {
                "Name": "HONORS_APPROVAL_QUEUE",
                "Value": "on",
              },
              {
                "Name": "HONORS_CURATOR_ENABLED",
                "Value": "on",
              },
              {
                "Name": "SCHOLARS_HONORS_CURATOR_GROUP_CN",
                "Value": "ITS:Library:Scholars/honors-curator-role",
              },
              {
                "Name": "SELF_EDIT_OVERVIEW_GENERATE",
                "Value": "on",
              },
              {
                "Name": "SELF_EDIT_OVERVIEW_GENERATE_STREAM",
                "Value": "on",
              },
              {
                "Name": "EDIT_BIOSKETCH_GENERATE",
                "Value": "on",
              },
              {
                "Name": "EDIT_CV_EXPORT",
                "Value": "on",
              },
              {
                "Name": "REPORTER_MATCH_V2",
                "Value": "off",
              },
              {
                "Name": "POPS_BASE_URL",
                "Value": "http://pops.weillcornell.org",
              },
              {
                "Name": "SELF_EDIT_RAIL_RESTRUCTURE",
                "Value": "on",
              },
              {
                "Name": "BIOSKETCH_FAITHFULNESS_PASS",
                "Value": "on",
              },
              {
                "Name": "BIOSKETCH_PROMPT_VERSION_DEFAULT",
                "Value": "v7",
              },
              {
                "Name": "OVERVIEW_PROMPT_VERSION_DEFAULT",
                "Value": "v4",
              },
              {
                "Name": "OVERVIEW_AUDIENCE_DEFAULT",
                "Value": "informed",
              },
              {
                "Name": "FEEDBACK_BADGE_ENABLED",
                "Value": "on",
              },
              {
                "Name": "FEEDBACK_SITE_ORIGIN",
                "Value": "https://scholars.weill.cornell.edu",
              },
              {
                "Name": "SITE_URL",
                "Value": "https://scholars.weill.cornell.edu",
              },
              {
                "Name": "SPS_USAGE_WORKGROUP",
                "Value": "sps-usage-app-prod",
              },
              {
                "Name": "SPS_USAGE_DATABASE",
                "Value": "sps_usage_prod",
              },
              {
                "Name": "SPS_USAGE_REGION",
                "Value": "us-east-1",
              },
              {
                "Name": "SHOW_BETA_BADGE",
                "Value": "on",
              },
              {
                "Name": "SEARCH_GENERIC_TERM_DEMOTE",
                "Value": "on",
              },
              {
                "Name": "SEARCH_PEOPLE_MATCH_EXPLAIN",
                "Value": "on",
              },
              {
                "Name": "SEARCH_PEOPLE_SNIPPET_REPRESENTATIVE_PUB",
                "Value": "off",
              },
              {
                "Name": "SEARCH_PEOPLE_REASON_FROM_DOC",
                "Value": "on",
              },
              {
                "Name": "SEARCH_PUB_HIGHLIGHT",
                "Value": "on",
              },
              {
                "Name": "SEARCH_PUB_MATCH_PROVENANCE",
                "Value": "on",
              },
              {
                "Name": "SEARCH_PUB_DEPARTMENT_FILTER",
                "Value": "on",
              },
              {
                "Name": "SEARCH_REQUIRE_DISPLAYABLE_AUTHOR",
                "Value": "off",
              },
              {
                "Name": "SEARCH_PUB_MESH_ONLY_FILTER",
                "Value": "on",
              },
              {
                "Name": "SEARCH_PUB_FACET_SPLIT",
                "Value": "on",
              },
              {
                "Name": "SEARCH_PEOPLE_METHOD_FAMILY",
                "Value": "on",
              },
              {
                "Name": "SEARCH_PEOPLE_METHOD_FAMILY_TIER",
                "Value": "on",
              },
              {
                "Name": "SEARCH_PEOPLE_METHOD_CONTEXT",
                "Value": "on",
              },
              {
                "Name": "SEARCH_PEOPLE_CLINICAL_BOARD_OVER_TAGGED",
                "Value": "6",
              },
              {
                "Name": "SEARCH_PEOPLE_CLINICAL_SPECIALTY_OVER_TAGGED",
                "Value": "4",
              },
              {
                "Name": "SEARCH_PEOPLE_CLINICAL_FN",
                "Value": "on",
              },
              {
                "Name": "SEARCH_PEOPLE_CLINICAL_MESH_ANCHOR",
                "Value": "on",
              },
              {
                "Name": "SEARCH_PEOPLE_CLINICAL_RANK_FACETS",
                "Value": "on",
              },
              {
                "Name": "SEARCH_PEOPLE_ESI_FACET",
                "Value": "on",
              },
              {
                "Name": "SEARCH_PEOPLE_MATCH_AWARE_SNIPPET",
                "Value": "on",
              },
              {
                "Name": "SEARCH_RESULT_EVIDENCE",
                "Value": "on",
              },
              {
                "Name": "SEARCH_EVIDENCE_ROWS",
                "Value": "on",
              },
              {
                "Name": "SEARCH_EVIDENCE_REASON_COUNTS",
                "Value": "on",
              },
              {
                "Name": "SEARCH_PEOPLE_AREA_BOOST",
                "Value": "on",
              },
              {
                "Name": "SEARCH_PEOPLE_CONCEPT_ARM_FIRST",
                "Value": "on",
              },
              {
                "Name": "SEARCH_PEOPLE_AREA_BOOST_GRADED",
                "Value": "on",
              },
              {
                "Name": "SEARCH_AREA_BOOST_W_HI",
                "Value": "20",
              },
              {
                "Name": "SEARCH_PEOPLE_CONCEPT_ALPHA",
                "Value": "0.5",
              },
              {
                "Name": "SEARCH_PEOPLE_PHRASE_BOOST",
                "Value": "on",
              },
              {
                "Name": "SEARCH_PEOPLE_DIVISION_SHAPE",
                "Value": "off",
              },
              {
                "Name": "SEARCH_PEOPLE_FACULTY_PROMINENCE",
                "Value": "off",
              },
              {
                "Name": "SEARCH_PEOPLE_PUBCOUNT_DAMPEN",
                "Value": "capped",
              },
              {
                "Name": "SEARCH_PEOPLE_CONCEPT_HINT",
                "Value": "on",
              },
              {
                "Name": "SEARCH_FUNDING_TAB_CONCEPT",
                "Value": "on",
              },
              {
                "Name": "SEARCH_FUNDING_MESH_GATE",
                "Value": "fundedPubMeshUi",
              },
              {
                "Name": "SEARCH_FUNDING_CONCEPT_GRANTS",
                "Value": "off",
              },
              {
                "Name": "SEARCH_SHELL_STREAMING",
                "Value": "on",
              },
              {
                "Name": "SEARCH_SUGGEST_MESH_CONCEPT",
                "Value": "off",
              },
              {
                "Name": "SEARCH_PEOPLE_CONCEPT_PRECOUNT",
                "Value": "off",
              },
              {
                "Name": "SEARCH_PEOPLE_CONCEPT_GRANT_AXIS",
                "Value": "on",
              },
              {
                "Name": "SEARCH_MESH_RESOLUTION_FALLBACK",
                "Value": "on",
              },
              {
                "Name": "SEARCH_MESH_RESOLVE_TOKEN_COVERAGE",
                "Value": "off",
              },
              {
                "Name": "SEARCH_MESH_ENTRY_TIER_PARITY",
                "Value": "on",
              },
              {
                "Name": "SEARCH_MESH_DESCENDANT_TERMS_CAP",
                "Value": "200",
              },
              {
                "Name": "SEARCH_MESH_QUERY_NORMALIZATION",
                "Value": "on",
              },
              {
                "Name": "SEARCH_ACRONYM_SENSE_GUARD",
                "Value": "on",
              },
              {
                "Name": "COAUTHOR_HIDDEN_STUDENT_CHIPS",
                "Value": "on",
              },
              {
                "Name": "IMPERSONATION_ENABLED",
                "Value": "true",
              },
              {
                "Name": "PROFILE_CANONICAL",
                "Value": "root",
              },
              {
                "Name": "METHODS_LENS_ENABLED",
                "Value": "on",
              },
              {
                "Name": "METHODS_LENS_SENSITIVE_GATE",
                "Value": "on",
              },
              {
                "Name": "METHODS_LENS_FAMILY_FILTER",
                "Value": "on",
              },
              {
                "Name": "METHODS_LENS_FAMILY_ROSTER_FALLBACK",
                "Value": "on",
              },
              {
                "Name": "METHODS_LENS_PAGES",
                "Value": "on",
              },
              {
                "Name": "METHODS_LENS_FAMILY_DEFINITIONS",
                "Value": "on",
              },
              {
                "Name": "METHODS_LENS_TOOL_CONTEXT",
                "Value": "on",
              },
              {
                "Name": "METHODS_LENS_PUB_MODAL",
                "Value": "on",
              },
              {
                "Name": "METHODS_LENS_FAMILY_SYNONYMS",
                "Value": "on",
              },
              {
                "Name": "METHODS_LENS_CELL_LINE_ENTITIES",
                "Value": "on",
              },
              {
                "Name": "METHODS_LENS_ENTITY_USAGE",
                "Value": "on",
              },
              {
                "Name": "CENTER_METHODS_FACET",
                "Value": "on",
              },
              {
                "Name": "ORG_UNIT_METHODS_CHIPS",
                "Value": "on",
              },
              {
                "Name": "ORG_UNIT_METHODS_FACET",
                "Value": "on",
              },
              {
                "Name": "CORE_PUB_MODAL",
                "Value": "on",
              },
              {
                "Name": "CORE_PAGES",
                "Value": "on",
              },
              {
                "Name": "CORE_CLAIM_WRITEBACK",
                "Value": "on",
              },
              {
                "Name": "OPPORTUNITY_URL_INTAKE",
                "Value": "on",
              },
              {
                "Name": "PROFILE_FACET_REDESIGN",
                "Value": "on",
              },
              {
                "Name": "SCHOLAR_LIST_EXPORT",
                "Value": "on",
              },
              {
                "Name": "INTERNAL_VIEWER_NETWORK_SIGNAL",
                "Value": "on",
              },
              {
                "Name": "SCHOLAR_LIST_EXPORT_EMAIL",
                "Value": "on",
              },
              {
                "Name": "INTERNAL_VIEWER_CIDRS",
                "Value": "140.251.0.0/16,157.139.0.0/16",
              },
              {
                "Name": "PROFILE_EMAIL_RELEASE_GATE",
                "Value": "on",
              },
              {
                "Name": "SCHOLARS_SUPERUSER_GROUP_CN",
                "Value": "ITS:Library:Scholars/superuser-role",
              },
              {
                "Name": "SCHOLARS_SUPERUSER_CWIDS",
                "Value": "",
              },
              {
                "Name": "COMMS_STEWARD_ENABLED",
                "Value": "on",
              },
              {
                "Name": "SCHOLARS_COMMS_STEWARD_GROUP_CN",
                "Value": "ITS:Library:Scholars/comms-steward-role",
              },
              {
                "Name": "SCHOLARS_COMMS_STEWARD_ALLOWLIST",
                "Value": "",
              },
              {
                "Name": "DEVELOPMENT_ENABLED",
                "Value": "on",
              },
              {
                "Name": "SCHOLARS_DEVELOPMENT_GROUP_CN",
                "Value": "ITS:Library:Scholars/development-role",
              },
              {
                "Name": "SCHOLARS_DEVELOPMENT_ALLOWLIST",
                "Value": "",
              },
              {
                "Name": "SECURITY_CSP_MODE",
                "Value": "enforce",
              },
            ],
            "Essential": true,
            "Image": {
              "Fn::Join": [
                "",
                [
                  {
                    "Fn::Select": [
                      4,
                      {
                        "Fn::Split": [
                          ":",
                          {
                            "Fn::GetAtt": [
                              "EcrRepository4D7B3EE1",
                              "Arn",
                            ],
                          },
                        ],
                      },
                    ],
                  },
                  ".dkr.ecr.",
                  {
                    "Fn::Select": [
                      3,
                      {
                        "Fn::Split": [
                          ":",
                          {
                            "Fn::GetAtt": [
                              "EcrRepository4D7B3EE1",
                              "Arn",
                            ],
                          },
                        ],
                      },
                    ],
                  },
                  ".",
                  {
                    "Ref": "AWS::URLSuffix",
                  },
                  "/",
                  {
                    "Ref": "EcrRepository4D7B3EE1",
                  },
                  ":latest",
                ],
              ],
            },
            "LogConfiguration": {
              "LogDriver": "awslogs",
              "Options": {
                "awslogs-group": {
                  "Ref": "AppLogGroup7D8CD952",
                },
                "awslogs-region": "us-east-1",
                "awslogs-stream-prefix": "app",
              },
            },
            "Name": "app",
            "PortMappings": [
              {
                "ContainerPort": 3000,
                "Protocol": "tcp",
              },
            ],
            "Secrets": [
              {
                "Name": "DATABASE_URL",
                "ValueFrom": {
                  "Fn::Join": [
                    "",
                    [
                      "arn:",
                      {
                        "Ref": "AWS::Partition",
                      },
                      ":secretsmanager:us-east-1:123456789012:secret:scholars/prod/db/app-rw",
                    ],
                  ],
                },
              },
              {
                "Name": "DATABASE_URL_RO",
                "ValueFrom": {
                  "Fn::Join": [
                    "",
                    [
                      "arn:",
                      {
                        "Ref": "AWS::Partition",
                      },
                      ":secretsmanager:us-east-1:123456789012:secret:scholars/prod/db/app-ro",
                    ],
                  ],
                },
              },
              {
                "Name": "OPENSEARCH_NODE",
                "ValueFrom": {
                  "Fn::Join": [
                    "",
                    [
                      "arn:",
                      {
                        "Ref": "AWS::Partition",
                      },
                      ":secretsmanager:us-east-1:123456789012:secret:scholars/prod/opensearch/app:node::",
                    ],
                  ],
                },
              },
              {
                "Name": "OPENSEARCH_USER",
                "ValueFrom": {
                  "Fn::Join": [
                    "",
                    [
                      "arn:",
                      {
                        "Ref": "AWS::Partition",
                      },
                      ":secretsmanager:us-east-1:123456789012:secret:scholars/prod/opensearch/app:username::",
                    ],
                  ],
                },
              },
              {
                "Name": "OPENSEARCH_PASS",
                "ValueFrom": {
                  "Fn::Join": [
                    "",
                    [
                      "arn:",
                      {
                        "Ref": "AWS::Partition",
                      },
                      ":secretsmanager:us-east-1:123456789012:secret:scholars/prod/opensearch/app:password::",
                    ],
                  ],
                },
              },
              {
                "Name": "SCHOLARS_REVALIDATE_TOKEN",
                "ValueFrom": {
                  "Fn::Join": [
                    "",
                    [
                      "arn:",
                      {
                        "Ref": "AWS::Partition",
                      },
                      ":secretsmanager:us-east-1:123456789012:secret:scholars/prod/revalidate-token",
                    ],
                  ],
                },
              },
              {
                "Name": "FACULTY_REVIEW_TOKEN",
                "ValueFrom": {
                  "Fn::Join": [
                    "",
                    [
                      "arn:",
                      {
                        "Ref": "AWS::Partition",
                      },
                      ":secretsmanager:us-east-1:123456789012:secret:scholars/prod/faculty-review-token",
                    ],
                  ],
                },
              },
              {
                "Name": "RESEARCH_INFORMATICS_TOKEN",
                "ValueFrom": {
                  "Fn::Join": [
                    "",
                    [
                      "arn:",
                      {
                        "Ref": "AWS::Partition",
                      },
                      ":secretsmanager:us-east-1:123456789012:secret:scholars/prod/research-informatics-token",
                    ],
                  ],
                },
              },
              {
                "Name": "SESSION_COOKIE_SECRET",
                "ValueFrom": {
                  "Fn::Join": [
                    "",
                    [
                      "arn:",
                      {
                        "Ref": "AWS::Partition",
                      },
                      ":secretsmanager:us-east-1:123456789012:secret:scholars/prod/session-cookie-key",
                    ],
                  ],
                },
              },
              {
                "Name": "SAML_SP_PRIVATE_KEY",
                "ValueFrom": {
                  "Fn::Join": [
                    "",
                    [
                      "arn:",
                      {
                        "Ref": "AWS::Partition",
                      },
                      ":secretsmanager:us-east-1:123456789012:secret:scholars/saml-sp/prod/private-key",
                    ],
                  ],
                },
              },
              {
                "Name": "SAML_IDP_CERT",
                "ValueFrom": {
                  "Fn::Join": [
                    "",
                    [
                      "arn:",
                      {
                        "Ref": "AWS::Partition",
                      },
                      ":secretsmanager:us-east-1:123456789012:secret:scholars/prod/saml/idp-cert",
                    ],
                  ],
                },
              },
              {
                "Name": "SAML_SP_CERT",
                "ValueFrom": {
                  "Fn::Join": [
                    "",
                    [
                      "arn:",
                      {
                        "Ref": "AWS::Partition",
                      },
                      ":secretsmanager:us-east-1:123456789012:secret:scholars/saml-sp/prod/cert",
                    ],
                  ],
                },
              },
              {
                "Name": "SCHOLARS_RECITERDB_HOST",
                "ValueFrom": {
                  "Fn::Join": [
                    "",
                    [
                      "arn:",
                      {
                        "Ref": "AWS::Partition",
                      },
                      ":secretsmanager:us-east-1:123456789012:secret:scholars/prod/etl/reciter:SCHOLARS_RECITERDB_HOST::",
                    ],
                  ],
                },
              },
              {
                "Name": "SCHOLARS_RECITERDB_PORT",
                "ValueFrom": {
                  "Fn::Join": [
                    "",
                    [
                      "arn:",
                      {
                        "Ref": "AWS::Partition",
                      },
                      ":secretsmanager:us-east-1:123456789012:secret:scholars/prod/etl/reciter:SCHOLARS_RECITERDB_PORT::",
                    ],
                  ],
                },
              },
              {
                "Name": "SCHOLARS_RECITERDB_DATABASE",
                "ValueFrom": {
                  "Fn::Join": [
                    "",
                    [
                      "arn:",
                      {
                        "Ref": "AWS::Partition",
                      },
                      ":secretsmanager:us-east-1:123456789012:secret:scholars/prod/etl/reciter:SCHOLARS_RECITERDB_DATABASE::",
                    ],
                  ],
                },
              },
              {
                "Name": "SCHOLARS_RECITERDB_USERNAME",
                "ValueFrom": {
                  "Fn::Join": [
                    "",
                    [
                      "arn:",
                      {
                        "Ref": "AWS::Partition",
                      },
                      ":secretsmanager:us-east-1:123456789012:secret:scholars/prod/etl/reciter:SCHOLARS_RECITERDB_USERNAME::",
                    ],
                  ],
                },
              },
              {
                "Name": "SCHOLARS_RECITERDB_PASSWORD",
                "ValueFrom": {
                  "Fn::Join": [
                    "",
                    [
                      "arn:",
                      {
                        "Ref": "AWS::Partition",
                      },
                      ":secretsmanager:us-east-1:123456789012:secret:scholars/prod/etl/reciter:SCHOLARS_RECITERDB_PASSWORD::",
                    ],
                  ],
                },
              },
              {
                "Name": "SCHOLARS_LDAP_URL",
                "ValueFrom": {
                  "Fn::Join": [
                    "",
                    [
                      "arn:",
                      {
                        "Ref": "AWS::Partition",
                      },
                      ":secretsmanager:us-east-1:123456789012:secret:scholars/prod/etl/ed:SCHOLARS_LDAP_URL::",
                    ],
                  ],
                },
              },
              {
                "Name": "SCHOLARS_LDAP_BIND_DN",
                "ValueFrom": {
                  "Fn::Join": [
                    "",
                    [
                      "arn:",
                      {
                        "Ref": "AWS::Partition",
                      },
                      ":secretsmanager:us-east-1:123456789012:secret:scholars/prod/etl/ed:SCHOLARS_LDAP_BIND_DN::",
                    ],
                  ],
                },
              },
              {
                "Name": "SCHOLARS_LDAP_BIND_PASSWORD",
                "ValueFrom": {
                  "Fn::Join": [
                    "",
                    [
                      "arn:",
                      {
                        "Ref": "AWS::Partition",
                      },
                      ":secretsmanager:us-east-1:123456789012:secret:scholars/prod/etl/ed:SCHOLARS_LDAP_BIND_PASSWORD::",
                    ],
                  ],
                },
              },
            ],
          },
          {
            "Command": [
              "--config=env:AOT_CONFIG_CONTENT",
            ],
            "Environment": [
              {
                "Name": "AOT_CONFIG_CONTENT",
                "Value": "# ADOT collector configuration for SPS app tasks.
#
# Pipeline shape: OTLP/HTTP receiver -> memory_limiter -> tail_sampling ->
# batch -> [awsxray, otlphttp/newrelic] exporters. The tail_sampling processor
# is the load-bearing piece -- issue #123's "5% baseline + 100% on errors"
# cannot be delivered by an SDK-side head sampler (NotSampled decisions can't
# be reversed once the span is dropped), so the promotion happens here after
# the trace has ended and its status is known.
#
# Drops happen before the exporters, so BOTH the X-Ray bill and the New Relic
# ingest track the kept-trace rate (~5% baseline + every error + every >1500ms
# trace), not the SDK's 100% recording rate. See the exporters block for the
# soft/transitional dual-export rationale.
#
# Tunable in place: edit this file + cdk deploy --exclusively Sps-App-<env>.
# No app-image rebuild required because the file is baked into the
# collector container via the CDK Asset upload pattern (see app-stack.ts).

receivers:
  otlp:
    protocols:
      http:
        endpoint: 0.0.0.0:4318

processors:
  # Drop incoming OTLP if the collector is over a soft memory limit; required
  # in front of tail_sampling because the latter buffers up to num_traces.
  memory_limiter:
    check_interval: 1s
    limit_percentage: 80
    spike_limit_percentage: 25

  tail_sampling:
    decision_wait: 10s
    num_traces: 50000
    policies:
      - name: errors
        type: status_code
        status_code:
          status_codes: [ERROR]
      - name: slow
        type: latency
        latency:
          threshold_ms: 1500
      - name: baseline
        type: probabilistic
        probabilistic:
          sampling_percentage: 5

  batch:
    timeout: 5s
    send_batch_size: 50

exporters:
  # New Relic OTLP/HTTP ingest, US datacenter. The api-key header is the New
  # Relic *ingest license key*, injected into THIS collector container from
  # Secrets Manager (scholars/<env>/newrelic-license-key) as NEW_RELIC_LICENSE_KEY;
  # \${env:...} expands it at collector start. The otlphttp exporter appends
  # /v1/traces to the endpoint -- the exact URL the key was verified against.
  # gzip per New Relic's ingest guidance. EU accounts would use
  # https://otlp.eu01.nr-data.net instead.
  otlphttp/newrelic:
    endpoint: https://otlp.nr-data.net
    compression: gzip
    headers:
      api-key: \${env:NEW_RELIC_LICENSE_KEY}

  awsxray:
    # Region resolved from the ECS task metadata; no need to hard-code.

service:
  pipelines:
    traces:
      receivers: [otlp]
      processors: [memory_limiter, tail_sampling, batch]
      # Dual-export is a SOFT, transitional choice (2026-05-29): X-Ray and New
      # Relic both receive the same tail-sampled traces while New Relic is
      # validated. Making New Relic the sole backend later is a one-liner --
      # drop \`awsxray\` here (and optionally its exporter block above + the
      # task-role xray:Put* policy in app-stack.ts). To revert to X-Ray-only,
      # drop \`otlphttp/newrelic\`. Neither side is load-bearing for the other.
      exporters: [awsxray, otlphttp/newrelic]
",
              },
            ],
            "Essential": false,
            "Image": "public.ecr.aws/aws-observability/aws-otel-collector@sha256:8aa9ea5f67b8d318f7d6af24677e3c70f7098bc0631147cb5fa91addbe980b06",
            "LogConfiguration": {
              "LogDriver": "awslogs",
              "Options": {
                "awslogs-group": {
                  "Ref": "OtelCollectorLogGroup0FD207F7",
                },
                "awslogs-region": "us-east-1",
                "awslogs-stream-prefix": "otel",
              },
            },
            "Name": "otel-collector",
            "Secrets": [
              {
                "Name": "NEW_RELIC_LICENSE_KEY",
                "ValueFrom": {
                  "Fn::Join": [
                    "",
                    [
                      "arn:",
                      {
                        "Ref": "AWS::Partition",
                      },
                      ":secretsmanager:us-east-1:123456789012:secret:scholars/prod/newrelic-license-key",
                    ],
                  ],
                },
              },
            ],
          },
        ],
        "Cpu": "2048",
        "ExecutionRoleArn": {
          "Fn::GetAtt": [
            "TaskExecutionRole250D2532",
            "Arn",
          ],
        },
        "Family": "sps-app-prod",
        "Memory": "4096",
        "NetworkMode": "awsvpc",
        "RequiresCompatibilities": [
          "FARGATE",
        ],
        "TaskRoleArn": {
          "Fn::GetAtt": [
            "TaskRole30FC0FBB",
            "Arn",
          ],
        },
      },
      "Type": "AWS::ECS::TaskDefinition",
    },
    "AppinternalalbdnsEDBEA85B": {
      "Properties": {
        "Name": "/sps/prod/app/internal-alb-dns",
        "Type": "String",
        "Value": {
          "Fn::GetAtt": [
            "InternalAlb58CEEAE8",
            "DNSName",
          ],
        },
      },
      "Type": "AWS::SSM::Parameter",
    },
    "Appinternalalbsgid03BC738C": {
      "Properties": {
        "Name": "/sps/prod/app/internal-alb-sg-id",
        "Type": "String",
        "Value": {
          "Fn::GetAtt": [
            "InternalAlbSecurityGroup32D71C5A",
            "GroupId",
          ],
        },
      },
      "Type": "AWS::SSM::Parameter",
    },
    "ApppublicalbdnsB3FF6E1F": {
      "Properties": {
        "Name": "/sps/prod/app/public-alb-dns",
        "Type": "String",
        "Value": {
          "Fn::GetAtt": [
            "PublicAlb84330974",
            "DNSName",
          ],
        },
      },
      "Type": "AWS::SSM::Parameter",
    },
    "DbBootstrapLogGroupAF64F8C3": {
      "DeletionPolicy": "Retain",
      "Properties": {
        "LogGroupName": "/aws/ecs/sps-db-bootstrap-prod",
        "RetentionInDays": 90,
      },
      "Type": "AWS::Logs::LogGroup",
      "UpdateReplacePolicy": "Retain",
    },
    "DbBootstrapTaskDefinition603C6DE9": {
      "Properties": {
        "ContainerDefinitions": [
          {
            "EntryPoint": [
              "npx",
              "tsx",
              "scripts/db-bootstrap.ts",
            ],
            "Environment": [
              {
                "Name": "GRANTEE_HOST",
                "Value": "%",
              },
            ],
            "Essential": true,
            "Image": {
              "Fn::Join": [
                "",
                [
                  {
                    "Fn::Select": [
                      4,
                      {
                        "Fn::Split": [
                          ":",
                          {
                            "Fn::GetAtt": [
                              "EtlEcrRepository058F5EEC",
                              "Arn",
                            ],
                          },
                        ],
                      },
                    ],
                  },
                  ".dkr.ecr.",
                  {
                    "Fn::Select": [
                      3,
                      {
                        "Fn::Split": [
                          ":",
                          {
                            "Fn::GetAtt": [
                              "EtlEcrRepository058F5EEC",
                              "Arn",
                            ],
                          },
                        ],
                      },
                    ],
                  },
                  ".",
                  {
                    "Ref": "AWS::URLSuffix",
                  },
                  "/",
                  {
                    "Ref": "EtlEcrRepository058F5EEC",
                  },
                  ":latest",
                ],
              ],
            },
            "LogConfiguration": {
              "LogDriver": "awslogs",
              "Options": {
                "awslogs-group": {
                  "Ref": "DbBootstrapLogGroupAF64F8C3",
                },
                "awslogs-region": "us-east-1",
                "awslogs-stream-prefix": "db-bootstrap",
              },
            },
            "Name": "db-bootstrap",
            "Secrets": [
              {
                "Name": "BOOTSTRAP_DSN",
                "ValueFrom": {
                  "Fn::Join": [
                    "",
                    [
                      "arn:",
                      {
                        "Ref": "AWS::Partition",
                      },
                      ":secretsmanager:us-east-1:123456789012:secret:scholars/prod/db/bootstrap",
                    ],
                  ],
                },
              },
              {
                "Name": "APP_RW_DSN",
                "ValueFrom": {
                  "Fn::Join": [
                    "",
                    [
                      "arn:",
                      {
                        "Ref": "AWS::Partition",
                      },
                      ":secretsmanager:us-east-1:123456789012:secret:scholars/prod/db/app-rw",
                    ],
                  ],
                },
              },
            ],
          },
        ],
        "Cpu": "512",
        "ExecutionRoleArn": {
          "Fn::GetAtt": [
            "DeployExecutionRoleBCBD9CEE",
            "Arn",
          ],
        },
        "Family": "sps-db-bootstrap-prod",
        "Memory": "1024",
        "NetworkMode": "awsvpc",
        "RequiresCompatibilities": [
          "FARGATE",
        ],
        "TaskRoleArn": {
          "Fn::GetAtt": [
            "TaskRole30FC0FBB",
            "Arn",
          ],
        },
      },
      "Type": "AWS::ECS::TaskDefinition",
    },
    "DeployExecutionRoleBCBD9CEE": {
      "Properties": {
        "AssumeRolePolicyDocument": {
          "Statement": [
            {
              "Action": "sts:AssumeRole",
              "Effect": "Allow",
              "Principal": {
                "Service": "ecs-tasks.amazonaws.com",
              },
            },
          ],
          "Version": "2012-10-17",
        },
        "Description": "SPS ECS deploy-time task-execution role (prod). Migrate/verify/db-bootstrap only; the sole reader of the migrate DSN.",
        "RoleName": "sps-deploy-exec-prod",
      },
      "Type": "AWS::IAM::Role",
    },
    "DeployExecutionRoleDefaultPolicy0759ACD6": {
      "Properties": {
        "PolicyDocument": {
          "Statement": [
            {
              "Action": "ecr:GetAuthorizationToken",
              "Effect": "Allow",
              "Resource": "*",
            },
            {
              "Action": [
                "ecr:BatchCheckLayerAvailability",
                "ecr:GetDownloadUrlForLayer",
                "ecr:BatchGetImage",
              ],
              "Effect": "Allow",
              "Resource": [
                {
                  "Fn::GetAtt": [
                    "EcrRepository4D7B3EE1",
                    "Arn",
                  ],
                },
                {
                  "Fn::GetAtt": [
                    "EtlEcrRepository058F5EEC",
                    "Arn",
                  ],
                },
              ],
            },
            {
              "Action": "secretsmanager:GetSecretValue",
              "Effect": "Allow",
              "Resource": [
                {
                  "Fn::Join": [
                    "",
                    [
                      "arn:",
                      {
                        "Ref": "AWS::Partition",
                      },
                      ":secretsmanager:us-east-1:123456789012:secret:scholars/prod/db/app-ro",
                    ],
                  ],
                },
                {
                  "Fn::Join": [
                    "",
                    [
                      "arn:",
                      {
                        "Ref": "AWS::Partition",
                      },
                      ":secretsmanager:us-east-1:123456789012:secret:scholars/prod/db/app-rw",
                    ],
                  ],
                },
                {
                  "Fn::Join": [
                    "",
                    [
                      "arn:",
                      {
                        "Ref": "AWS::Partition",
                      },
                      ":secretsmanager:us-east-1:123456789012:secret:scholars/prod/db/bootstrap",
                    ],
                  ],
                },
                {
                  "Fn::Join": [
                    "",
                    [
                      "arn:",
                      {
                        "Ref": "AWS::Partition",
                      },
                      ":secretsmanager:us-east-1:123456789012:secret:scholars/prod/db/migrate",
                    ],
                  ],
                },
              ],
            },
            {
              "Action": [
                "logs:CreateLogStream",
                "logs:PutLogEvents",
              ],
              "Effect": "Allow",
              "Resource": [
                {
                  "Fn::GetAtt": [
                    "MigrationLogGroupFD140541",
                    "Arn",
                  ],
                },
                {
                  "Fn::Join": [
                    "",
                    [
                      {
                        "Fn::GetAtt": [
                          "MigrationLogGroupFD140541",
                          "Arn",
                        ],
                      },
                      ":*",
                    ],
                  ],
                },
                {
                  "Fn::GetAtt": [
                    "DbBootstrapLogGroupAF64F8C3",
                    "Arn",
                  ],
                },
                {
                  "Fn::Join": [
                    "",
                    [
                      {
                        "Fn::GetAtt": [
                          "DbBootstrapLogGroupAF64F8C3",
                          "Arn",
                        ],
                      },
                      ":*",
                    ],
                  ],
                },
                {
                  "Fn::GetAtt": [
                    "VerifyGrantsLogGroupD90AC2C4",
                    "Arn",
                  ],
                },
                {
                  "Fn::Join": [
                    "",
                    [
                      {
                        "Fn::GetAtt": [
                          "VerifyGrantsLogGroupD90AC2C4",
                          "Arn",
                        ],
                      },
                      ":*",
                    ],
                  ],
                },
              ],
            },
            {
              "Action": [
                "ecr:BatchCheckLayerAvailability",
                "ecr:GetDownloadUrlForLayer",
                "ecr:BatchGetImage",
              ],
              "Effect": "Allow",
              "Resource": {
                "Fn::GetAtt": [
                  "EcrRepository4D7B3EE1",
                  "Arn",
                ],
              },
            },
            {
              "Action": [
                "logs:CreateLogStream",
                "logs:PutLogEvents",
              ],
              "Effect": "Allow",
              "Resource": {
                "Fn::GetAtt": [
                  "MigrationLogGroupFD140541",
                  "Arn",
                ],
              },
            },
            {
              "Action": [
                "secretsmanager:GetSecretValue",
                "secretsmanager:DescribeSecret",
              ],
              "Effect": "Allow",
              "Resource": {
                "Fn::Join": [
                  "",
                  [
                    "arn:",
                    {
                      "Ref": "AWS::Partition",
                    },
                    ":secretsmanager:us-east-1:123456789012:secret:scholars/prod/db/migrate-??????",
                  ],
                ],
              },
            },
            {
              "Action": [
                "ecr:BatchCheckLayerAvailability",
                "ecr:GetDownloadUrlForLayer",
                "ecr:BatchGetImage",
              ],
              "Effect": "Allow",
              "Resource": {
                "Fn::GetAtt": [
                  "EtlEcrRepository058F5EEC",
                  "Arn",
                ],
              },
            },
            {
              "Action": [
                "logs:CreateLogStream",
                "logs:PutLogEvents",
              ],
              "Effect": "Allow",
              "Resource": {
                "Fn::GetAtt": [
                  "DbBootstrapLogGroupAF64F8C3",
                  "Arn",
                ],
              },
            },
            {
              "Action": [
                "secretsmanager:GetSecretValue",
                "secretsmanager:DescribeSecret",
              ],
              "Effect": "Allow",
              "Resource": {
                "Fn::Join": [
                  "",
                  [
                    "arn:",
                    {
                      "Ref": "AWS::Partition",
                    },
                    ":secretsmanager:us-east-1:123456789012:secret:scholars/prod/db/bootstrap-??????",
                  ],
                ],
              },
            },
            {
              "Action": [
                "secretsmanager:GetSecretValue",
                "secretsmanager:DescribeSecret",
              ],
              "Effect": "Allow",
              "Resource": {
                "Fn::Join": [
                  "",
                  [
                    "arn:",
                    {
                      "Ref": "AWS::Partition",
                    },
                    ":secretsmanager:us-east-1:123456789012:secret:scholars/prod/db/app-rw-??????",
                  ],
                ],
              },
            },
            {
              "Action": [
                "logs:CreateLogStream",
                "logs:PutLogEvents",
              ],
              "Effect": "Allow",
              "Resource": {
                "Fn::GetAtt": [
                  "VerifyGrantsLogGroupD90AC2C4",
                  "Arn",
                ],
              },
            },
            {
              "Action": [
                "secretsmanager:GetSecretValue",
                "secretsmanager:DescribeSecret",
              ],
              "Effect": "Allow",
              "Resource": {
                "Fn::Join": [
                  "",
                  [
                    "arn:",
                    {
                      "Ref": "AWS::Partition",
                    },
                    ":secretsmanager:us-east-1:123456789012:secret:scholars/prod/db/app-ro-??????",
                  ],
                ],
              },
            },
          ],
          "Version": "2012-10-17",
        },
        "PolicyName": "DeployExecutionRoleDefaultPolicy0759ACD6",
        "Roles": [
          {
            "Ref": "DeployExecutionRoleBCBD9CEE",
          },
        ],
      },
      "Type": "AWS::IAM::Policy",
    },
    "DeployRole885297C3": {
      "Properties": {
        "AssumeRolePolicyDocument": {
          "Statement": [
            {
              "Action": "sts:AssumeRoleWithWebIdentity",
              "Condition": {
                "StringEquals": {
                  "token.actions.githubusercontent.com:aud": "sts.amazonaws.com",
                },
                "StringLike": {
                  "token.actions.githubusercontent.com:sub": "repo:wcmc-its/Scholars-Profile-System:environment:prod",
                },
              },
              "Effect": "Allow",
              "Principal": {
                "Federated": "arn:aws:iam::123456789012:oidc-provider/token.actions.githubusercontent.com",
              },
            },
          ],
          "Version": "2012-10-17",
        },
        "Description": "SPS GitHub Actions deploy role (prod). Assumed by the deploy workflow via OIDC.",
        "RoleName": "sps-deploy-prod",
      },
      "Type": "AWS::IAM::Role",
    },
    "DeployRoleDefaultPolicyDC930F96": {
      "Properties": {
        "PolicyDocument": {
          "Statement": [
            {
              "Action": "ecr:GetAuthorizationToken",
              "Effect": "Allow",
              "Resource": "*",
            },
            {
              "Action": [
                "ecr:BatchCheckLayerAvailability",
                "ecr:CompleteLayerUpload",
                "ecr:InitiateLayerUpload",
                "ecr:PutImage",
                "ecr:UploadLayerPart",
                "ecr:BatchGetImage",
                "ecr:GetDownloadUrlForLayer",
                "ecr:DescribeImages",
                "ecr:DescribeRepositories",
              ],
              "Effect": "Allow",
              "Resource": [
                {
                  "Fn::GetAtt": [
                    "EcrRepository4D7B3EE1",
                    "Arn",
                  ],
                },
                {
                  "Fn::GetAtt": [
                    "EtlEcrRepository058F5EEC",
                    "Arn",
                  ],
                },
              ],
            },
            {
              "Action": "ecs:RunTask",
              "Effect": "Allow",
              "Resource": [
                {
                  "Fn::Join": [
                    "",
                    [
                      "arn:",
                      {
                        "Ref": "AWS::Partition",
                      },
                      ":ecs:us-east-1:123456789012:task-definition/sps-migrate-prod:*",
                    ],
                  ],
                },
                {
                  "Fn::Join": [
                    "",
                    [
                      "arn:",
                      {
                        "Ref": "AWS::Partition",
                      },
                      ":ecs:us-east-1:123456789012:task-definition/sps-db-bootstrap-prod:*",
                    ],
                  ],
                },
                {
                  "Fn::Join": [
                    "",
                    [
                      "arn:",
                      {
                        "Ref": "AWS::Partition",
                      },
                      ":ecs:us-east-1:123456789012:task-definition/sps-verify-grants-prod:*",
                    ],
                  ],
                },
                {
                  "Fn::Join": [
                    "",
                    [
                      "arn:",
                      {
                        "Ref": "AWS::Partition",
                      },
                      ":ecs:us-east-1:123456789012:task-definition/sps-search-eval-canary-prod:*",
                    ],
                  ],
                },
              ],
            },
            {
              "Action": [
                "ecs:UpdateService",
                "ecs:DescribeServices",
              ],
              "Effect": "Allow",
              "Resource": {
                "Ref": "EcsService81FC6EF6",
              },
            },
            {
              "Action": [
                "ecs:DescribeTaskDefinition",
                "ecs:RegisterTaskDefinition",
              ],
              "Effect": "Allow",
              "Resource": "*",
            },
            {
              "Action": [
                "ecs:DescribeTasks",
                "ecs:ListTasks",
              ],
              "Effect": "Allow",
              "Resource": {
                "Fn::Join": [
                  "",
                  [
                    "arn:",
                    {
                      "Ref": "AWS::Partition",
                    },
                    ":ecs:us-east-1:123456789012:task/",
                    {
                      "Ref": "EcsCluster97242B84",
                    },
                    "/*",
                  ],
                ],
              },
            },
            {
              "Action": "iam:PassRole",
              "Condition": {
                "StringEquals": {
                  "iam:PassedToService": "ecs-tasks.amazonaws.com",
                },
              },
              "Effect": "Allow",
              "Resource": [
                {
                  "Fn::GetAtt": [
                    "TaskExecutionRole250D2532",
                    "Arn",
                  ],
                },
                {
                  "Fn::GetAtt": [
                    "DeployExecutionRoleBCBD9CEE",
                    "Arn",
                  ],
                },
                {
                  "Fn::GetAtt": [
                    "TaskRole30FC0FBB",
                    "Arn",
                  ],
                },
                {
                  "Fn::GetAtt": [
                    "SearchEvalCanaryExecutionRole464F1E01",
                    "Arn",
                  ],
                },
              ],
            },
            {
              "Action": "cloudformation:DescribeStacks",
              "Effect": "Allow",
              "Resource": [
                {
                  "Fn::Join": [
                    "",
                    [
                      "arn:",
                      {
                        "Ref": "AWS::Partition",
                      },
                      ":cloudformation:us-east-1:123456789012:stack/Sps-App-prod/*",
                    ],
                  ],
                },
                {
                  "Fn::Join": [
                    "",
                    [
                      "arn:",
                      {
                        "Ref": "AWS::Partition",
                      },
                      ":cloudformation:us-east-1:123456789012:stack/Sps-Edge-prod/*",
                    ],
                  ],
                },
              ],
            },
          ],
          "Version": "2012-10-17",
        },
        "PolicyName": "DeployRoleDefaultPolicyDC930F96",
        "Roles": [
          {
            "Ref": "DeployRole885297C3",
          },
        ],
      },
      "Type": "AWS::IAM::Policy",
    },
    "EcrRepository4D7B3EE1": {
      "DeletionPolicy": "Retain",
      "Properties": {
        "ImageScanningConfiguration": {
          "ScanOnPush": true,
        },
        "LifecyclePolicy": {
          "LifecyclePolicyText": "{"rules":[{"rulePriority":1,"description":"Keep the last 30 tagged images","selection":{"tagStatus":"tagged","tagPatternList":["*"],"countType":"imageCountMoreThan","countNumber":30},"action":{"type":"expire"}},{"rulePriority":2,"description":"Expire untagged images after 7 days","selection":{"tagStatus":"untagged","countType":"sinceImagePushed","countNumber":7,"countUnit":"days"},"action":{"type":"expire"}}]}",
        },
        "RepositoryName": "scholars-app-prod",
      },
      "Type": "AWS::ECR::Repository",
      "UpdateReplacePolicy": "Retain",
    },
    "EcsCluster97242B84": {
      "Properties": {
        "ClusterName": "sps-cluster-prod",
        "ClusterSettings": [
          {
            "Name": "containerInsights",
            "Value": "enabled",
          },
        ],
      },
      "Type": "AWS::ECS::Cluster",
    },
    "EcsService81FC6EF6": {
      "DependsOn": [
        "InternalAlbInternalHttpListener9436A291",
        "InternalAppTargetGroup9E028644",
        "OriginVerifiedForwardC0422D52",
        "PublicAlbPublicHttpListener8CAA0E91",
        "PublicAppTargetGroup68798009",
        "TaskRoleDefaultPolicy07FC53DE",
        "TaskRole30FC0FBB",
      ],
      "Properties": {
        "Cluster": {
          "Ref": "EcsCluster97242B84",
        },
        "DeploymentConfiguration": {
          "Alarms": {
            "AlarmNames": [],
            "Enable": false,
            "Rollback": false,
          },
          "DeploymentCircuitBreaker": {
            "Enable": true,
            "Rollback": true,
          },
          "MaximumPercent": 200,
          "MinimumHealthyPercent": 100,
        },
        "DeploymentController": {
          "Type": "ECS",
        },
        "DesiredCount": 2,
        "EnableECSManagedTags": false,
        "EnableExecuteCommand": false,
        "HealthCheckGracePeriodSeconds": 120,
        "LaunchType": "FARGATE",
        "LoadBalancers": [
          {
            "ContainerName": "app",
            "ContainerPort": 3000,
            "TargetGroupArn": {
              "Ref": "PublicAppTargetGroup68798009",
            },
          },
          {
            "ContainerName": "app",
            "ContainerPort": 3000,
            "TargetGroupArn": {
              "Ref": "InternalAppTargetGroup9E028644",
            },
          },
        ],
        "NetworkConfiguration": {
          "AwsvpcConfiguration": {
            "AssignPublicIp": "DISABLED",
            "SecurityGroups": [
              {
                "Ref": "SsmParameterValuespsprodnetappsgidC96584B6F00A464EAD1953AFF4B05118Parameter",
              },
            ],
            "Subnets": [
              {
                "Fn::ImportValue": "Sps-Network-prod:ExportsOutputRefVpcprivateSubnet1SubnetCEAD37168693D373",
              },
              {
                "Fn::ImportValue": "Sps-Network-prod:ExportsOutputRefVpcprivateSubnet2Subnet2DE7549CDF5ACE3D",
              },
            ],
          },
        },
        "ServiceName": "sps-app-prod",
        "TaskDefinition": {
          "Ref": "AppTaskDefinitionCBC902A9",
        },
      },
      "Type": "AWS::ECS::Service",
    },
    "EcsServiceTaskCountTarget02FCCE22": {
      "DependsOn": [
        "InternalAlbInternalHttpListener9436A291",
        "InternalAppTargetGroup9E028644",
        "OriginVerifiedForwardC0422D52",
        "PublicAlbPublicHttpListener8CAA0E91",
        "PublicAppTargetGroup68798009",
        "TaskRoleDefaultPolicy07FC53DE",
        "TaskRole30FC0FBB",
      ],
      "Properties": {
        "MaxCapacity": 6,
        "MinCapacity": 2,
        "ResourceId": {
          "Fn::Join": [
            "",
            [
              "service/",
              {
                "Ref": "EcsCluster97242B84",
              },
              "/",
              {
                "Fn::GetAtt": [
                  "EcsService81FC6EF6",
                  "Name",
                ],
              },
            ],
          ],
        },
        "RoleARN": {
          "Fn::Join": [
            "",
            [
              "arn:",
              {
                "Ref": "AWS::Partition",
              },
              ":iam::123456789012:role/aws-service-role/ecs.application-autoscaling.amazonaws.com/AWSServiceRoleForApplicationAutoScaling_ECSService",
            ],
          ],
        },
        "ScalableDimension": "ecs:service:DesiredCount",
        "ServiceNamespace": "ecs",
      },
      "Type": "AWS::ApplicationAutoScaling::ScalableTarget",
    },
    "EcsServiceTaskCountTargetCpuScalingA9C91D4C": {
      "DependsOn": [
        "InternalAlbInternalHttpListener9436A291",
        "InternalAppTargetGroup9E028644",
        "OriginVerifiedForwardC0422D52",
        "PublicAlbPublicHttpListener8CAA0E91",
        "PublicAppTargetGroup68798009",
        "TaskRoleDefaultPolicy07FC53DE",
        "TaskRole30FC0FBB",
      ],
      "Properties": {
        "PolicyName": "SpsAppprodEcsServiceTaskCountTargetCpuScalingEBB138A7",
        "PolicyType": "TargetTrackingScaling",
        "ScalingTargetId": {
          "Ref": "EcsServiceTaskCountTarget02FCCE22",
        },
        "TargetTrackingScalingPolicyConfiguration": {
          "PredefinedMetricSpecification": {
            "PredefinedMetricType": "ECSServiceAverageCPUUtilization",
          },
          "ScaleInCooldown": 300,
          "ScaleOutCooldown": 60,
          "TargetValue": 60,
        },
      },
      "Type": "AWS::ApplicationAutoScaling::ScalingPolicy",
    },
    "EcsServiceTaskCountTargetRequestScaling41EBB189": {
      "DependsOn": [
        "InternalAlbInternalHttpListener9436A291",
        "InternalAppTargetGroup9E028644",
        "OriginVerifiedForwardC0422D52",
        "PublicAlbPublicHttpListener8CAA0E91",
        "PublicAppTargetGroup68798009",
        "TaskRoleDefaultPolicy07FC53DE",
        "TaskRole30FC0FBB",
      ],
      "Properties": {
        "PolicyName": "SpsAppprodEcsServiceTaskCountTargetRequestScaling18380323",
        "PolicyType": "TargetTrackingScaling",
        "ScalingTargetId": {
          "Ref": "EcsServiceTaskCountTarget02FCCE22",
        },
        "TargetTrackingScalingPolicyConfiguration": {
          "PredefinedMetricSpecification": {
            "PredefinedMetricType": "ALBRequestCountPerTarget",
            "ResourceLabel": {
              "Fn::Join": [
                "",
                [
                  {
                    "Fn::Select": [
                      1,
                      {
                        "Fn::Split": [
                          "/",
                          {
                            "Ref": "PublicAlbPublicHttpListener8CAA0E91",
                          },
                        ],
                      },
                    ],
                  },
                  "/",
                  {
                    "Fn::Select": [
                      2,
                      {
                        "Fn::Split": [
                          "/",
                          {
                            "Ref": "PublicAlbPublicHttpListener8CAA0E91",
                          },
                        ],
                      },
                    ],
                  },
                  "/",
                  {
                    "Fn::Select": [
                      3,
                      {
                        "Fn::Split": [
                          "/",
                          {
                            "Ref": "PublicAlbPublicHttpListener8CAA0E91",
                          },
                        ],
                      },
                    ],
                  },
                  "/",
                  {
                    "Fn::GetAtt": [
                      "PublicAppTargetGroup68798009",
                      "TargetGroupFullName",
                    ],
                  },
                ],
              ],
            },
          },
          "ScaleInCooldown": 300,
          "ScaleOutCooldown": 60,
          "TargetValue": 1000,
        },
      },
      "Type": "AWS::ApplicationAutoScaling::ScalingPolicy",
    },
    "EtlEcrRepository058F5EEC": {
      "DeletionPolicy": "Retain",
      "Properties": {
        "ImageScanningConfiguration": {
          "ScanOnPush": true,
        },
        "LifecyclePolicy": {
          "LifecyclePolicyText": "{"rules":[{"rulePriority":1,"description":"Keep the last 30 tagged images","selection":{"tagStatus":"tagged","tagPatternList":["*"],"countType":"imageCountMoreThan","countNumber":30},"action":{"type":"expire"}},{"rulePriority":2,"description":"Expire untagged images after 7 days","selection":{"tagStatus":"untagged","countType":"sinceImagePushed","countNumber":7,"countUnit":"days"},"action":{"type":"expire"}}]}",
        },
        "RepositoryName": "scholars-etl-prod",
      },
      "Type": "AWS::ECR::Repository",
      "UpdateReplacePolicy": "Retain",
    },
    "InternalAlb58CEEAE8": {
      "Properties": {
        "LoadBalancerAttributes": [
          {
            "Key": "deletion_protection.enabled",
            "Value": "false",
          },
        ],
        "Name": "sps-internal-prod",
        "Scheme": "internal",
        "SecurityGroups": [
          {
            "Fn::GetAtt": [
              "InternalAlbSecurityGroup32D71C5A",
              "GroupId",
            ],
          },
        ],
        "Subnets": [
          {
            "Fn::ImportValue": "Sps-Network-prod:ExportsOutputRefVpcprivateSubnet1SubnetCEAD37168693D373",
          },
          {
            "Fn::ImportValue": "Sps-Network-prod:ExportsOutputRefVpcprivateSubnet2Subnet2DE7549CDF5ACE3D",
          },
        ],
        "Type": "application",
      },
      "Type": "AWS::ElasticLoadBalancingV2::LoadBalancer",
    },
    "InternalAlbInternalHttpListener9436A291": {
      "Properties": {
        "DefaultActions": [
          {
            "TargetGroupArn": {
              "Ref": "InternalAppTargetGroup9E028644",
            },
            "Type": "forward",
          },
        ],
        "LoadBalancerArn": {
          "Ref": "InternalAlb58CEEAE8",
        },
        "Port": 80,
        "Protocol": "HTTP",
      },
      "Type": "AWS::ElasticLoadBalancingV2::Listener",
    },
    "InternalAlbSecurityGroup32D71C5A": {
      "Properties": {
        "GroupDescription": "SPS internal ALB (prod) -- intra-VPC /api/revalidate ingress.",
        "SecurityGroupEgress": [
          {
            "CidrIp": "0.0.0.0/0",
            "Description": "Allow all outbound traffic by default",
            "IpProtocol": "-1",
          },
        ],
        "SecurityGroupIngress": [
          {
            "CidrIp": "0.0.0.0/0",
            "Description": "Allow from anyone on port 80",
            "FromPort": 80,
            "IpProtocol": "tcp",
            "ToPort": 80,
          },
        ],
        "VpcId": {
          "Fn::ImportValue": "Sps-Network-prod:ExportsOutputRefVpc8378EB38272D6E3A",
        },
      },
      "Type": "AWS::EC2::SecurityGroup",
    },
    "InternalAppTargetGroup9E028644": {
      "Properties": {
        "HealthCheckIntervalSeconds": 30,
        "HealthCheckPath": "/api/health",
        "HealthCheckTimeoutSeconds": 5,
        "HealthyThresholdCount": 2,
        "Name": "sps-tg-int-prod",
        "Port": 3000,
        "Protocol": "HTTP",
        "TargetGroupAttributes": [
          {
            "Key": "deregistration_delay.timeout_seconds",
            "Value": "30",
          },
          {
            "Key": "stickiness.enabled",
            "Value": "false",
          },
        ],
        "TargetType": "ip",
        "UnhealthyThresholdCount": 3,
        "VpcId": {
          "Fn::ImportValue": "Sps-Network-prod:ExportsOutputRefVpc8378EB38272D6E3A",
        },
      },
      "Type": "AWS::ElasticLoadBalancingV2::TargetGroup",
    },
    "IsrCacheBucket311880A1": {
      "DeletionPolicy": "Retain",
      "Properties": {
        "BucketEncryption": {
          "ServerSideEncryptionConfiguration": [
            {
              "ServerSideEncryptionByDefault": {
                "SSEAlgorithm": "AES256",
              },
            },
          ],
        },
        "LifecycleConfiguration": {
          "Rules": [
            {
              "ExpirationInDays": 7,
              "Id": "expire-isr-cache",
              "Prefix": "next-isr-cache/",
              "Status": "Enabled",
            },
          ],
        },
        "PublicAccessBlockConfiguration": {
          "BlockPublicAcls": true,
          "BlockPublicPolicy": true,
          "IgnorePublicAcls": true,
          "RestrictPublicBuckets": true,
        },
      },
      "Type": "AWS::S3::Bucket",
      "UpdateReplacePolicy": "Retain",
    },
    "IsrCacheBucketPolicyF908ED16": {
      "Properties": {
        "Bucket": {
          "Ref": "IsrCacheBucket311880A1",
        },
        "PolicyDocument": {
          "Statement": [
            {
              "Action": "s3:*",
              "Condition": {
                "Bool": {
                  "aws:SecureTransport": "false",
                },
              },
              "Effect": "Deny",
              "Principal": {
                "AWS": "*",
              },
              "Resource": [
                {
                  "Fn::GetAtt": [
                    "IsrCacheBucket311880A1",
                    "Arn",
                  ],
                },
                {
                  "Fn::Join": [
                    "",
                    [
                      {
                        "Fn::GetAtt": [
                          "IsrCacheBucket311880A1",
                          "Arn",
                        ],
                      },
                      "/*",
                    ],
                  ],
                },
              ],
            },
          ],
          "Version": "2012-10-17",
        },
      },
      "Type": "AWS::S3::BucketPolicy",
    },
    "MigrationLogGroupFD140541": {
      "DeletionPolicy": "Retain",
      "Properties": {
        "LogGroupName": "/aws/ecs/sps-migrate-prod",
        "RetentionInDays": 90,
      },
      "Type": "AWS::Logs::LogGroup",
      "UpdateReplacePolicy": "Retain",
    },
    "MigrationTaskDefinitionE89B136E": {
      "Properties": {
        "ContainerDefinitions": [
          {
            "EntryPoint": [
              "npx",
              "prisma",
              "migrate",
              "deploy",
            ],
            "Essential": true,
            "Image": {
              "Fn::Join": [
                "",
                [
                  {
                    "Fn::Select": [
                      4,
                      {
                        "Fn::Split": [
                          ":",
                          {
                            "Fn::GetAtt": [
                              "EcrRepository4D7B3EE1",
                              "Arn",
                            ],
                          },
                        ],
                      },
                    ],
                  },
                  ".dkr.ecr.",
                  {
                    "Fn::Select": [
                      3,
                      {
                        "Fn::Split": [
                          ":",
                          {
                            "Fn::GetAtt": [
                              "EcrRepository4D7B3EE1",
                              "Arn",
                            ],
                          },
                        ],
                      },
                    ],
                  },
                  ".",
                  {
                    "Ref": "AWS::URLSuffix",
                  },
                  "/",
                  {
                    "Ref": "EcrRepository4D7B3EE1",
                  },
                  ":latest",
                ],
              ],
            },
            "LogConfiguration": {
              "LogDriver": "awslogs",
              "Options": {
                "awslogs-group": {
                  "Ref": "MigrationLogGroupFD140541",
                },
                "awslogs-region": "us-east-1",
                "awslogs-stream-prefix": "migrate",
              },
            },
            "Name": "migrate",
            "Secrets": [
              {
                "Name": "DATABASE_URL",
                "ValueFrom": {
                  "Fn::Join": [
                    "",
                    [
                      "arn:",
                      {
                        "Ref": "AWS::Partition",
                      },
                      ":secretsmanager:us-east-1:123456789012:secret:scholars/prod/db/migrate",
                    ],
                  ],
                },
              },
            ],
          },
        ],
        "Cpu": "512",
        "ExecutionRoleArn": {
          "Fn::GetAtt": [
            "DeployExecutionRoleBCBD9CEE",
            "Arn",
          ],
        },
        "Family": "sps-migrate-prod",
        "Memory": "1024",
        "NetworkMode": "awsvpc",
        "RequiresCompatibilities": [
          "FARGATE",
        ],
        "TaskRoleArn": {
          "Fn::GetAtt": [
            "TaskRole30FC0FBB",
            "Arn",
          ],
        },
      },
      "Type": "AWS::ECS::TaskDefinition",
    },
    "OriginVerifiedForwardC0422D52": {
      "Properties": {
        "Actions": [
          {
            "TargetGroupArn": {
              "Ref": "PublicAppTargetGroup68798009",
            },
            "Type": "forward",
          },
        ],
        "Conditions": [
          {
            "Field": "http-header",
            "HttpHeaderConfig": {
              "HttpHeaderName": "X-Origin-Verify",
              "Values": [
                "{{resolve:secretsmanager:scholars/prod/edge/origin-shared-secret:SecretString:::}}",
              ],
            },
          },
        ],
        "ListenerArn": {
          "Ref": "PublicAlbPublicHttpListener8CAA0E91",
        },
        "Priority": 1,
      },
      "Type": "AWS::ElasticLoadBalancingV2::ListenerRule",
    },
    "OriginVerifiedForwardHttpsBD6969E0": {
      "Properties": {
        "Actions": [
          {
            "TargetGroupArn": {
              "Ref": "PublicAppTargetGroup68798009",
            },
            "Type": "forward",
          },
        ],
        "Conditions": [
          {
            "Field": "http-header",
            "HttpHeaderConfig": {
              "HttpHeaderName": "X-Origin-Verify",
              "Values": [
                "{{resolve:secretsmanager:scholars/prod/edge/origin-shared-secret:SecretString:::}}",
              ],
            },
          },
        ],
        "ListenerArn": {
          "Ref": "PublicAlbPublicHttpsListener8840F702",
        },
        "Priority": 1,
      },
      "Type": "AWS::ElasticLoadBalancingV2::ListenerRule",
    },
    "OtelCollectorLogGroup0FD207F7": {
      "DeletionPolicy": "Retain",
      "Properties": {
        "LogGroupName": "/aws/ecs/sps-otel-prod",
        "RetentionInDays": 90,
      },
      "Type": "AWS::Logs::LogGroup",
      "UpdateReplacePolicy": "Retain",
    },
    "PublicAlb84330974": {
      "Properties": {
        "LoadBalancerAttributes": [
          {
            "Key": "deletion_protection.enabled",
            "Value": "false",
          },
        ],
        "Name": "sps-public-prod",
        "Scheme": "internet-facing",
        "SecurityGroups": [
          {
            "Ref": "SsmParameterValuespsprodnetalbsgidC96584B6F00A464EAD1953AFF4B05118Parameter",
          },
        ],
        "Subnets": [
          {
            "Fn::ImportValue": "Sps-Network-prod:ExportsOutputRefVpcpublicSubnet1Subnet2BB74ED74EB42ADC",
          },
          {
            "Fn::ImportValue": "Sps-Network-prod:ExportsOutputRefVpcpublicSubnet2SubnetE34B022AC8BB6627",
          },
        ],
        "Type": "application",
      },
      "Type": "AWS::ElasticLoadBalancingV2::LoadBalancer",
    },
    "PublicAlbIngressFromInternet": {
      "Properties": {
        "CidrIp": "0.0.0.0/0",
        "Description": "Internet to SPS public ALB HTTP (prod) -- HTTPS lands with EdgeStack",
        "FromPort": 80,
        "GroupId": {
          "Ref": "SsmParameterValuespsprodnetalbsgidC96584B6F00A464EAD1953AFF4B05118Parameter",
        },
        "IpProtocol": "tcp",
        "ToPort": 80,
      },
      "Type": "AWS::EC2::SecurityGroupIngress",
    },
    "PublicAlbIngressFromInternetHttps": {
      "Properties": {
        "CidrIp": "0.0.0.0/0",
        "Description": "Internet to SPS public ALB HTTPS (prod) -- #1507 origin TLS",
        "FromPort": 443,
        "GroupId": {
          "Ref": "SsmParameterValuespsprodnetalbsgidC96584B6F00A464EAD1953AFF4B05118Parameter",
        },
        "IpProtocol": "tcp",
        "ToPort": 443,
      },
      "Type": "AWS::EC2::SecurityGroupIngress",
    },
    "PublicAlbPublicHttpListener8CAA0E91": {
      "Properties": {
        "DefaultActions": [
          {
            "FixedResponseConfig": {
              "ContentType": "text/plain",
              "MessageBody": "Forbidden",
              "StatusCode": "403",
            },
            "Type": "fixed-response",
          },
        ],
        "LoadBalancerArn": {
          "Ref": "PublicAlb84330974",
        },
        "Port": 80,
        "Protocol": "HTTP",
      },
      "Type": "AWS::ElasticLoadBalancingV2::Listener",
    },
    "PublicAlbPublicHttpsListener8840F702": {
      "Properties": {
        "Certificates": [
          {
            "CertificateArn": "arn:aws:acm:us-east-1:665083158573:certificate/95f77e69-4abc-4d2c-b081-b8b5b8572fd6",
          },
        ],
        "DefaultActions": [
          {
            "FixedResponseConfig": {
              "ContentType": "text/plain",
              "MessageBody": "Forbidden",
              "StatusCode": "403",
            },
            "Type": "fixed-response",
          },
        ],
        "LoadBalancerArn": {
          "Ref": "PublicAlb84330974",
        },
        "Port": 443,
        "Protocol": "HTTPS",
        "SslPolicy": "ELBSecurityPolicy-TLS13-1-2-Res-PQ-2025-09",
      },
      "Type": "AWS::ElasticLoadBalancingV2::Listener",
    },
    "PublicAppTargetGroup68798009": {
      "Properties": {
        "HealthCheckIntervalSeconds": 30,
        "HealthCheckPath": "/api/health",
        "HealthCheckTimeoutSeconds": 5,
        "HealthyThresholdCount": 2,
        "Name": "sps-tg-pub-prod",
        "Port": 3000,
        "Protocol": "HTTP",
        "TargetGroupAttributes": [
          {
            "Key": "deregistration_delay.timeout_seconds",
            "Value": "30",
          },
          {
            "Key": "stickiness.enabled",
            "Value": "false",
          },
        ],
        "TargetType": "ip",
        "UnhealthyThresholdCount": 3,
        "VpcId": {
          "Fn::ImportValue": "Sps-Network-prod:ExportsOutputRefVpc8378EB38272D6E3A",
        },
      },
      "Type": "AWS::ElasticLoadBalancingV2::TargetGroup",
    },
    "S3GatewayEndpointE8BAF1BC": {
      "Properties": {
        "RouteTableIds": [
          {
            "Fn::ImportValue": "Sps-Network-prod:ExportsOutputRefVpcprivateSubnet1RouteTable1979EACBE1BD1DD4",
          },
          {
            "Fn::ImportValue": "Sps-Network-prod:ExportsOutputRefVpcprivateSubnet2RouteTable4D0FFC8C36E62A4A",
          },
        ],
        "ServiceName": {
          "Fn::Join": [
            "",
            [
              "com.amazonaws.",
              {
                "Ref": "AWS::Region",
              },
              ".s3",
            ],
          ],
        },
        "VpcEndpointType": "Gateway",
        "VpcId": {
          "Fn::ImportValue": "Sps-Network-prod:ExportsOutputRefVpc8378EB38272D6E3A",
        },
      },
      "Type": "AWS::EC2::VPCEndpoint",
    },
    "SearchEvalCanaryExecutionRole464F1E01": {
      "Properties": {
        "AssumeRolePolicyDocument": {
          "Statement": [
            {
              "Action": "sts:AssumeRole",
              "Effect": "Allow",
              "Principal": {
                "Service": "ecs-tasks.amazonaws.com",
              },
            },
          ],
          "Version": "2012-10-17",
        },
        "Description": "SPS search-eval canary task-execution role (prod). Reads only the origin-verify shared secret -- no DB DSNs (#1444).",
        "RoleName": "sps-search-eval-canary-exec-prod",
      },
      "Type": "AWS::IAM::Role",
    },
    "SearchEvalCanaryExecutionRoleDefaultPolicyFC978439": {
      "Properties": {
        "PolicyDocument": {
          "Statement": [
            {
              "Action": "ecr:GetAuthorizationToken",
              "Effect": "Allow",
              "Resource": "*",
            },
            {
              "Action": [
                "ecr:BatchCheckLayerAvailability",
                "ecr:GetDownloadUrlForLayer",
                "ecr:BatchGetImage",
              ],
              "Effect": "Allow",
              "Resource": {
                "Fn::GetAtt": [
                  "EtlEcrRepository058F5EEC",
                  "Arn",
                ],
              },
            },
            {
              "Action": "secretsmanager:GetSecretValue",
              "Effect": "Allow",
              "Resource": {
                "Fn::Join": [
                  "",
                  [
                    "arn:",
                    {
                      "Ref": "AWS::Partition",
                    },
                    ":secretsmanager:us-east-1:123456789012:secret:scholars/prod/edge/origin-shared-secret",
                  ],
                ],
              },
            },
            {
              "Action": [
                "logs:CreateLogStream",
                "logs:PutLogEvents",
              ],
              "Effect": "Allow",
              "Resource": [
                {
                  "Fn::GetAtt": [
                    "SearchEvalCanaryLogGroup434F45BC",
                    "Arn",
                  ],
                },
                {
                  "Fn::Join": [
                    "",
                    [
                      {
                        "Fn::GetAtt": [
                          "SearchEvalCanaryLogGroup434F45BC",
                          "Arn",
                        ],
                      },
                      ":*",
                    ],
                  ],
                },
              ],
            },
            {
              "Action": [
                "logs:CreateLogStream",
                "logs:PutLogEvents",
              ],
              "Effect": "Allow",
              "Resource": {
                "Fn::GetAtt": [
                  "SearchEvalCanaryLogGroup434F45BC",
                  "Arn",
                ],
              },
            },
            {
              "Action": [
                "secretsmanager:GetSecretValue",
                "secretsmanager:DescribeSecret",
              ],
              "Effect": "Allow",
              "Resource": {
                "Fn::Join": [
                  "",
                  [
                    "arn:",
                    {
                      "Ref": "AWS::Partition",
                    },
                    ":secretsmanager:us-east-1:123456789012:secret:scholars/prod/edge/origin-shared-secret-??????",
                  ],
                ],
              },
            },
          ],
          "Version": "2012-10-17",
        },
        "PolicyName": "SearchEvalCanaryExecutionRoleDefaultPolicyFC978439",
        "Roles": [
          {
            "Ref": "SearchEvalCanaryExecutionRole464F1E01",
          },
        ],
      },
      "Type": "AWS::IAM::Policy",
    },
    "SearchEvalCanaryLogGroup434F45BC": {
      "DeletionPolicy": "Retain",
      "Properties": {
        "LogGroupName": "/aws/ecs/sps-search-eval-canary-prod",
        "RetentionInDays": 90,
      },
      "Type": "AWS::Logs::LogGroup",
      "UpdateReplacePolicy": "Retain",
    },
    "SearchEvalCanaryTaskDefinitionEA26D4B7": {
      "Properties": {
        "ContainerDefinitions": [
          {
            "EntryPoint": [
              "npx",
              "tsx",
              "scripts/search-eval/canary.ts",
            ],
            "Environment": [
              {
                "Name": "CANARY_HOST",
                "Value": {
                  "Fn::Join": [
                    "",
                    [
                      "http://",
                      {
                        "Fn::GetAtt": [
                          "PublicAlb84330974",
                          "DNSName",
                        ],
                      },
                    ],
                  ],
                },
              },
            ],
            "Essential": true,
            "Image": {
              "Fn::Join": [
                "",
                [
                  {
                    "Fn::Select": [
                      4,
                      {
                        "Fn::Split": [
                          ":",
                          {
                            "Fn::GetAtt": [
                              "EtlEcrRepository058F5EEC",
                              "Arn",
                            ],
                          },
                        ],
                      },
                    ],
                  },
                  ".dkr.ecr.",
                  {
                    "Fn::Select": [
                      3,
                      {
                        "Fn::Split": [
                          ":",
                          {
                            "Fn::GetAtt": [
                              "EtlEcrRepository058F5EEC",
                              "Arn",
                            ],
                          },
                        ],
                      },
                    ],
                  },
                  ".",
                  {
                    "Ref": "AWS::URLSuffix",
                  },
                  "/",
                  {
                    "Ref": "EtlEcrRepository058F5EEC",
                  },
                  ":latest",
                ],
              ],
            },
            "LogConfiguration": {
              "LogDriver": "awslogs",
              "Options": {
                "awslogs-group": {
                  "Ref": "SearchEvalCanaryLogGroup434F45BC",
                },
                "awslogs-region": "us-east-1",
                "awslogs-stream-prefix": "search-eval-canary",
              },
            },
            "Name": "search-eval-canary",
            "Secrets": [
              {
                "Name": "CANARY_ORIGIN_VERIFY",
                "ValueFrom": {
                  "Fn::Join": [
                    "",
                    [
                      "arn:",
                      {
                        "Ref": "AWS::Partition",
                      },
                      ":secretsmanager:us-east-1:123456789012:secret:scholars/prod/edge/origin-shared-secret",
                    ],
                  ],
                },
              },
            ],
          },
        ],
        "Cpu": "512",
        "ExecutionRoleArn": {
          "Fn::GetAtt": [
            "SearchEvalCanaryExecutionRole464F1E01",
            "Arn",
          ],
        },
        "Family": "sps-search-eval-canary-prod",
        "Memory": "1024",
        "NetworkMode": "awsvpc",
        "RequiresCompatibilities": [
          "FARGATE",
        ],
        "TaskRoleArn": {
          "Fn::GetAtt": [
            "SearchEvalCanaryTaskDefinitionTaskRoleE68C849D",
            "Arn",
          ],
        },
      },
      "Type": "AWS::ECS::TaskDefinition",
    },
    "SearchEvalCanaryTaskDefinitionTaskRoleE68C849D": {
      "Properties": {
        "AssumeRolePolicyDocument": {
          "Statement": [
            {
              "Action": "sts:AssumeRole",
              "Effect": "Allow",
              "Principal": {
                "Service": "ecs-tasks.amazonaws.com",
              },
            },
          ],
          "Version": "2012-10-17",
        },
      },
      "Type": "AWS::IAM::Role",
    },
    "SecretsManagerEndpoint5E83C66B": {
      "Properties": {
        "PrivateDnsEnabled": true,
        "SecurityGroupIds": [
          {
            "Fn::GetAtt": [
              "VpcEndpointSecurityGroup02EA44AC",
              "GroupId",
            ],
          },
        ],
        "ServiceName": "com.amazonaws.us-east-1.secretsmanager",
        "SubnetIds": [
          {
            "Fn::ImportValue": "Sps-Network-prod:ExportsOutputRefVpcprivateSubnet1SubnetCEAD37168693D373",
          },
          {
            "Fn::ImportValue": "Sps-Network-prod:ExportsOutputRefVpcprivateSubnet2Subnet2DE7549CDF5ACE3D",
          },
        ],
        "VpcEndpointType": "Interface",
        "VpcId": {
          "Fn::ImportValue": "Sps-Network-prod:ExportsOutputRefVpc8378EB38272D6E3A",
        },
      },
      "Type": "AWS::EC2::VPCEndpoint",
    },
    "TaskExecutionRole250D2532": {
      "Properties": {
        "AssumeRolePolicyDocument": {
          "Statement": [
            {
              "Action": "sts:AssumeRole",
              "Effect": "Allow",
              "Principal": {
                "Service": "ecs-tasks.amazonaws.com",
              },
            },
          ],
          "Version": "2012-10-17",
        },
        "Description": "SPS ECS task-execution role (prod). Pulls images, injects secrets, writes logs.",
        "RoleName": "sps-task-exec-prod",
      },
      "Type": "AWS::IAM::Role",
    },
    "TaskExecutionRoleDefaultPolicyA84DD1B0": {
      "Properties": {
        "PolicyDocument": {
          "Statement": [
            {
              "Action": "ecr:GetAuthorizationToken",
              "Effect": "Allow",
              "Resource": "*",
            },
            {
              "Action": [
                "ecr:BatchCheckLayerAvailability",
                "ecr:GetDownloadUrlForLayer",
                "ecr:BatchGetImage",
              ],
              "Effect": "Allow",
              "Resource": {
                "Fn::GetAtt": [
                  "EcrRepository4D7B3EE1",
                  "Arn",
                ],
              },
            },
            {
              "Action": "secretsmanager:GetSecretValue",
              "Effect": "Allow",
              "Resource": [
                {
                  "Fn::Join": [
                    "",
                    [
                      "arn:",
                      {
                        "Ref": "AWS::Partition",
                      },
                      ":secretsmanager:us-east-1:123456789012:secret:scholars/prod/db/app-rw",
                    ],
                  ],
                },
                {
                  "Fn::Join": [
                    "",
                    [
                      "arn:",
                      {
                        "Ref": "AWS::Partition",
                      },
                      ":secretsmanager:us-east-1:123456789012:secret:scholars/prod/db/app-ro",
                    ],
                  ],
                },
                {
                  "Fn::Join": [
                    "",
                    [
                      "arn:",
                      {
                        "Ref": "AWS::Partition",
                      },
                      ":secretsmanager:us-east-1:123456789012:secret:scholars/prod/opensearch/app",
                    ],
                  ],
                },
                {
                  "Fn::Join": [
                    "",
                    [
                      "arn:",
                      {
                        "Ref": "AWS::Partition",
                      },
                      ":secretsmanager:us-east-1:123456789012:secret:scholars/prod/revalidate-token",
                    ],
                  ],
                },
                {
                  "Fn::Join": [
                    "",
                    [
                      "arn:",
                      {
                        "Ref": "AWS::Partition",
                      },
                      ":secretsmanager:us-east-1:123456789012:secret:scholars/saml-sp/prod/private-key",
                    ],
                  ],
                },
                {
                  "Fn::Join": [
                    "",
                    [
                      "arn:",
                      {
                        "Ref": "AWS::Partition",
                      },
                      ":secretsmanager:us-east-1:123456789012:secret:scholars/prod/etl/reciter",
                    ],
                  ],
                },
                {
                  "Fn::Join": [
                    "",
                    [
                      "arn:",
                      {
                        "Ref": "AWS::Partition",
                      },
                      ":secretsmanager:us-east-1:123456789012:secret:scholars/prod/saml/idp-cert",
                    ],
                  ],
                },
                {
                  "Fn::Join": [
                    "",
                    [
                      "arn:",
                      {
                        "Ref": "AWS::Partition",
                      },
                      ":secretsmanager:us-east-1:123456789012:secret:scholars/saml-sp/prod/cert",
                    ],
                  ],
                },
                {
                  "Fn::Join": [
                    "",
                    [
                      "arn:",
                      {
                        "Ref": "AWS::Partition",
                      },
                      ":secretsmanager:us-east-1:123456789012:secret:scholars/prod/session-cookie-key",
                    ],
                  ],
                },
                {
                  "Fn::Join": [
                    "",
                    [
                      "arn:",
                      {
                        "Ref": "AWS::Partition",
                      },
                      ":secretsmanager:us-east-1:123456789012:secret:scholars/prod/newrelic-license-key",
                    ],
                  ],
                },
                {
                  "Fn::Join": [
                    "",
                    [
                      "arn:",
                      {
                        "Ref": "AWS::Partition",
                      },
                      ":secretsmanager:us-east-1:123456789012:secret:scholars/prod/etl/ed",
                    ],
                  ],
                },
              ],
            },
            {
              "Action": [
                "logs:CreateLogStream",
                "logs:PutLogEvents",
              ],
              "Effect": "Allow",
              "Resource": [
                {
                  "Fn::GetAtt": [
                    "AppLogGroup7D8CD952",
                    "Arn",
                  ],
                },
                {
                  "Fn::Join": [
                    "",
                    [
                      {
                        "Fn::GetAtt": [
                          "AppLogGroup7D8CD952",
                          "Arn",
                        ],
                      },
                      ":*",
                    ],
                  ],
                },
                {
                  "Fn::GetAtt": [
                    "OtelCollectorLogGroup0FD207F7",
                    "Arn",
                  ],
                },
                {
                  "Fn::Join": [
                    "",
                    [
                      {
                        "Fn::GetAtt": [
                          "OtelCollectorLogGroup0FD207F7",
                          "Arn",
                        ],
                      },
                      ":*",
                    ],
                  ],
                },
              ],
            },
            {
              "Action": [
                "logs:CreateLogStream",
                "logs:PutLogEvents",
              ],
              "Effect": "Allow",
              "Resource": {
                "Fn::GetAtt": [
                  "AppLogGroup7D8CD952",
                  "Arn",
                ],
              },
            },
            {
              "Action": [
                "secretsmanager:GetSecretValue",
                "secretsmanager:DescribeSecret",
              ],
              "Effect": "Allow",
              "Resource": {
                "Fn::Join": [
                  "",
                  [
                    "arn:",
                    {
                      "Ref": "AWS::Partition",
                    },
                    ":secretsmanager:us-east-1:123456789012:secret:scholars/prod/db/app-rw-??????",
                  ],
                ],
              },
            },
            {
              "Action": [
                "secretsmanager:GetSecretValue",
                "secretsmanager:DescribeSecret",
              ],
              "Effect": "Allow",
              "Resource": {
                "Fn::Join": [
                  "",
                  [
                    "arn:",
                    {
                      "Ref": "AWS::Partition",
                    },
                    ":secretsmanager:us-east-1:123456789012:secret:scholars/prod/db/app-ro-??????",
                  ],
                ],
              },
            },
            {
              "Action": [
                "secretsmanager:GetSecretValue",
                "secretsmanager:DescribeSecret",
              ],
              "Effect": "Allow",
              "Resource": {
                "Fn::Join": [
                  "",
                  [
                    "arn:",
                    {
                      "Ref": "AWS::Partition",
                    },
                    ":secretsmanager:us-east-1:123456789012:secret:scholars/prod/opensearch/app-??????",
                  ],
                ],
              },
            },
            {
              "Action": [
                "secretsmanager:GetSecretValue",
                "secretsmanager:DescribeSecret",
              ],
              "Effect": "Allow",
              "Resource": {
                "Fn::Join": [
                  "",
                  [
                    "arn:",
                    {
                      "Ref": "AWS::Partition",
                    },
                    ":secretsmanager:us-east-1:123456789012:secret:scholars/prod/revalidate-token-??????",
                  ],
                ],
              },
            },
            {
              "Action": [
                "secretsmanager:GetSecretValue",
                "secretsmanager:DescribeSecret",
              ],
              "Effect": "Allow",
              "Resource": {
                "Fn::Join": [
                  "",
                  [
                    "arn:",
                    {
                      "Ref": "AWS::Partition",
                    },
                    ":secretsmanager:us-east-1:123456789012:secret:scholars/prod/faculty-review-token-??????",
                  ],
                ],
              },
            },
            {
              "Action": [
                "secretsmanager:GetSecretValue",
                "secretsmanager:DescribeSecret",
              ],
              "Effect": "Allow",
              "Resource": {
                "Fn::Join": [
                  "",
                  [
                    "arn:",
                    {
                      "Ref": "AWS::Partition",
                    },
                    ":secretsmanager:us-east-1:123456789012:secret:scholars/prod/research-informatics-token-??????",
                  ],
                ],
              },
            },
            {
              "Action": [
                "secretsmanager:GetSecretValue",
                "secretsmanager:DescribeSecret",
              ],
              "Effect": "Allow",
              "Resource": {
                "Fn::Join": [
                  "",
                  [
                    "arn:",
                    {
                      "Ref": "AWS::Partition",
                    },
                    ":secretsmanager:us-east-1:123456789012:secret:scholars/prod/session-cookie-key-??????",
                  ],
                ],
              },
            },
            {
              "Action": [
                "secretsmanager:GetSecretValue",
                "secretsmanager:DescribeSecret",
              ],
              "Effect": "Allow",
              "Resource": {
                "Fn::Join": [
                  "",
                  [
                    "arn:",
                    {
                      "Ref": "AWS::Partition",
                    },
                    ":secretsmanager:us-east-1:123456789012:secret:scholars/saml-sp/prod/private-key-??????",
                  ],
                ],
              },
            },
            {
              "Action": [
                "secretsmanager:GetSecretValue",
                "secretsmanager:DescribeSecret",
              ],
              "Effect": "Allow",
              "Resource": {
                "Fn::Join": [
                  "",
                  [
                    "arn:",
                    {
                      "Ref": "AWS::Partition",
                    },
                    ":secretsmanager:us-east-1:123456789012:secret:scholars/prod/saml/idp-cert-??????",
                  ],
                ],
              },
            },
            {
              "Action": [
                "secretsmanager:GetSecretValue",
                "secretsmanager:DescribeSecret",
              ],
              "Effect": "Allow",
              "Resource": {
                "Fn::Join": [
                  "",
                  [
                    "arn:",
                    {
                      "Ref": "AWS::Partition",
                    },
                    ":secretsmanager:us-east-1:123456789012:secret:scholars/saml-sp/prod/cert-??????",
                  ],
                ],
              },
            },
            {
              "Action": [
                "secretsmanager:GetSecretValue",
                "secretsmanager:DescribeSecret",
              ],
              "Effect": "Allow",
              "Resource": {
                "Fn::Join": [
                  "",
                  [
                    "arn:",
                    {
                      "Ref": "AWS::Partition",
                    },
                    ":secretsmanager:us-east-1:123456789012:secret:scholars/prod/etl/reciter-??????",
                  ],
                ],
              },
            },
            {
              "Action": [
                "secretsmanager:GetSecretValue",
                "secretsmanager:DescribeSecret",
              ],
              "Effect": "Allow",
              "Resource": {
                "Fn::Join": [
                  "",
                  [
                    "arn:",
                    {
                      "Ref": "AWS::Partition",
                    },
                    ":secretsmanager:us-east-1:123456789012:secret:scholars/prod/etl/ed-??????",
                  ],
                ],
              },
            },
            {
              "Action": [
                "logs:CreateLogStream",
                "logs:PutLogEvents",
              ],
              "Effect": "Allow",
              "Resource": {
                "Fn::GetAtt": [
                  "OtelCollectorLogGroup0FD207F7",
                  "Arn",
                ],
              },
            },
            {
              "Action": [
                "secretsmanager:GetSecretValue",
                "secretsmanager:DescribeSecret",
              ],
              "Effect": "Allow",
              "Resource": {
                "Fn::Join": [
                  "",
                  [
                    "arn:",
                    {
                      "Ref": "AWS::Partition",
                    },
                    ":secretsmanager:us-east-1:123456789012:secret:scholars/prod/newrelic-license-key-??????",
                  ],
                ],
              },
            },
          ],
          "Version": "2012-10-17",
        },
        "PolicyName": "TaskExecutionRoleDefaultPolicyA84DD1B0",
        "Roles": [
          {
            "Ref": "TaskExecutionRole250D2532",
          },
        ],
      },
      "Type": "AWS::IAM::Policy",
    },
    "TaskRole30FC0FBB": {
      "Properties": {
        "AssumeRolePolicyDocument": {
          "Statement": [
            {
              "Action": "sts:AssumeRole",
              "Effect": "Allow",
              "Principal": {
                "Service": "ecs-tasks.amazonaws.com",
              },
            },
          ],
          "Version": "2012-10-17",
        },
        "Description": "SPS ECS task role (prod). Application runtime identity; X-Ray write only.",
        "RoleName": "sps-task-prod",
      },
      "Type": "AWS::IAM::Role",
    },
    "TaskRoleBedrockPolicy3D08BCA9": {
      "Properties": {
        "PolicyDocument": {
          "Statement": [
            {
              "Action": "bedrock:InvokeModel",
              "Effect": "Allow",
              "Resource": [
                "arn:aws:bedrock:*:123456789012:inference-profile/us.anthropic.claude-opus-4-8*",
                "arn:aws:bedrock:*::foundation-model/anthropic.claude-opus-4-8*",
                "arn:aws:bedrock:*:123456789012:inference-profile/us.anthropic.claude-sonnet-4-*",
                "arn:aws:bedrock:*::foundation-model/anthropic.claude-sonnet-4-*",
              ],
            },
          ],
          "Version": "2012-10-17",
        },
        "PolicyName": "sps-task-prod-bedrock",
        "Roles": [
          {
            "Ref": "TaskRole30FC0FBB",
          },
        ],
      },
      "Type": "AWS::IAM::Policy",
    },
    "TaskRoleCloudFrontPolicy1C86BE7A": {
      "Properties": {
        "PolicyDocument": {
          "Statement": [
            {
              "Action": "cloudfront:CreateInvalidation",
              "Effect": "Allow",
              "Resource": "arn:aws:cloudfront::123456789012:distribution/*",
            },
          ],
          "Version": "2012-10-17",
        },
        "PolicyName": "sps-task-prod-cloudfront",
        "Roles": [
          {
            "Ref": "TaskRole30FC0FBB",
          },
        ],
      },
      "Type": "AWS::IAM::Policy",
    },
    "TaskRoleCoreClaimWritebackPolicyE86AA84B": {
      "Properties": {
        "PolicyDocument": {
          "Statement": [
            {
              "Action": "dynamodb:UpdateItem",
              "Effect": "Allow",
              "Resource": "arn:aws:dynamodb:us-east-1:123456789012:table/reciterai",
            },
          ],
          "Version": "2012-10-17",
        },
        "PolicyName": "sps-task-prod-reciterai-writeback",
        "Roles": [
          {
            "Ref": "TaskRole30FC0FBB",
          },
        ],
      },
      "Type": "AWS::IAM::Policy",
    },
    "TaskRoleDefaultPolicy07FC53DE": {
      "Properties": {
        "PolicyDocument": {
          "Statement": [
            {
              "Action": [
                "s3:GetObject*",
                "s3:GetBucket*",
                "s3:List*",
                "s3:DeleteObject*",
                "s3:PutObject",
                "s3:PutObjectLegalHold",
                "s3:PutObjectRetention",
                "s3:PutObjectTagging",
                "s3:PutObjectVersionTagging",
                "s3:Abort*",
              ],
              "Effect": "Allow",
              "Resource": [
                {
                  "Fn::GetAtt": [
                    "IsrCacheBucket311880A1",
                    "Arn",
                  ],
                },
                {
                  "Fn::Join": [
                    "",
                    [
                      {
                        "Fn::GetAtt": [
                          "IsrCacheBucket311880A1",
                          "Arn",
                        ],
                      },
                      "/next-isr-cache/*",
                    ],
                  ],
                },
              ],
            },
          ],
          "Version": "2012-10-17",
        },
        "PolicyName": "TaskRoleDefaultPolicy07FC53DE",
        "Roles": [
          {
            "Ref": "TaskRole30FC0FBB",
          },
        ],
      },
      "Type": "AWS::IAM::Policy",
    },
    "TaskRoleOpportunitySubmissionPolicy51C9A514": {
      "Properties": {
        "PolicyDocument": {
          "Statement": [
            {
              "Action": [
                "dynamodb:PutItem",
                "dynamodb:Query",
                "dynamodb:DeleteItem",
                "dynamodb:UpdateItem",
              ],
              "Condition": {
                "ForAllValues:StringEquals": {
                  "dynamodb:LeadingKeys": [
                    "SUBMISSION",
                  ],
                },
              },
              "Effect": "Allow",
              "Resource": "arn:aws:dynamodb:us-east-1:123456789012:table/reciterai",
            },
          ],
          "Version": "2012-10-17",
        },
        "PolicyName": "sps-task-prod-opportunity-submission",
        "Roles": [
          {
            "Ref": "TaskRole30FC0FBB",
          },
        ],
      },
      "Type": "AWS::IAM::Policy",
    },
    "TaskRoleReciterReadPolicyE018B6D7": {
      "Properties": {
        "PolicyDocument": {
          "Statement": [
            {
              "Action": "dynamodb:GetItem",
              "Effect": "Allow",
              "Resource": [
                "arn:aws:dynamodb:us-east-1:665083158573:table/Analysis",
                "arn:aws:dynamodb:us-east-1:665083158573:table/GoldStandard",
              ],
            },
            {
              "Action": "s3:GetObject",
              "Effect": "Allow",
              "Resource": "arn:aws:s3:::reciter-dynamodb/AnalysisOutput/*",
            },
            {
              "Action": "kms:Decrypt",
              "Effect": "Allow",
              "Resource": "arn:aws:kms:us-east-1:665083158573:key/6b9d182c-8abc-48a0-ac90-7c47b55c829a",
            },
          ],
          "Version": "2012-10-17",
        },
        "PolicyName": "sps-task-prod-reciter-read",
        "Roles": [
          {
            "Ref": "TaskRole30FC0FBB",
          },
        ],
      },
      "Type": "AWS::IAM::Policy",
    },
    "TaskRoleSesPolicy94AACEAC": {
      "Properties": {
        "PolicyDocument": {
          "Statement": [
            {
              "Action": "ses:SendEmail",
              "Condition": {
                "StringEquals": {
                  "ses:FromAddress": "no-reply-scholars@weill.cornell.edu",
                },
              },
              "Effect": "Allow",
              "Resource": "arn:aws:ses:us-east-1:123456789012:identity/*",
            },
          ],
          "Version": "2012-10-17",
        },
        "PolicyName": "sps-task-prod-ses",
        "Roles": [
          {
            "Ref": "TaskRole30FC0FBB",
          },
        ],
      },
      "Type": "AWS::IAM::Policy",
    },
    "TaskRoleXrayPolicyBA24E3D0": {
      "Properties": {
        "PolicyDocument": {
          "Statement": [
            {
              "Action": "xray:PutTraceSegments",
              "Effect": "Allow",
              "Resource": "*",
            },
            {
              "Action": "xray:PutTelemetryRecords",
              "Effect": "Allow",
              "Resource": "*",
            },
          ],
          "Version": "2012-10-17",
        },
        "PolicyName": "sps-task-prod-xray",
        "Roles": [
          {
            "Ref": "TaskRole30FC0FBB",
          },
        ],
      },
      "Type": "AWS::IAM::Policy",
    },
    "VerifyGrantsLogGroupD90AC2C4": {
      "DeletionPolicy": "Retain",
      "Properties": {
        "LogGroupName": "/aws/ecs/sps-verify-grants-prod",
        "RetentionInDays": 90,
      },
      "Type": "AWS::Logs::LogGroup",
      "UpdateReplacePolicy": "Retain",
    },
    "VerifyGrantsTaskDefinition82FF6836": {
      "Properties": {
        "ContainerDefinitions": [
          {
            "EntryPoint": [
              "npx",
              "tsx",
              "scripts/verify-db-grants.ts",
            ],
            "Environment": [
              {
                "Name": "VERIFY_ROLES",
                "Value": "app-ro,app-rw,sps_migrate,sps_bootstrap",
              },
            ],
            "Essential": true,
            "Image": {
              "Fn::Join": [
                "",
                [
                  {
                    "Fn::Select": [
                      4,
                      {
                        "Fn::Split": [
                          ":",
                          {
                            "Fn::GetAtt": [
                              "EtlEcrRepository058F5EEC",
                              "Arn",
                            ],
                          },
                        ],
                      },
                    ],
                  },
                  ".dkr.ecr.",
                  {
                    "Fn::Select": [
                      3,
                      {
                        "Fn::Split": [
                          ":",
                          {
                            "Fn::GetAtt": [
                              "EtlEcrRepository058F5EEC",
                              "Arn",
                            ],
                          },
                        ],
                      },
                    ],
                  },
                  ".",
                  {
                    "Ref": "AWS::URLSuffix",
                  },
                  "/",
                  {
                    "Ref": "EtlEcrRepository058F5EEC",
                  },
                  ":latest",
                ],
              ],
            },
            "LogConfiguration": {
              "LogDriver": "awslogs",
              "Options": {
                "awslogs-group": {
                  "Ref": "VerifyGrantsLogGroupD90AC2C4",
                },
                "awslogs-region": "us-east-1",
                "awslogs-stream-prefix": "verify-grants",
              },
            },
            "Name": "verify-grants",
            "Secrets": [
              {
                "Name": "APP_RO_DSN",
                "ValueFrom": {
                  "Fn::Join": [
                    "",
                    [
                      "arn:",
                      {
                        "Ref": "AWS::Partition",
                      },
                      ":secretsmanager:us-east-1:123456789012:secret:scholars/prod/db/app-ro",
                    ],
                  ],
                },
              },
              {
                "Name": "APP_RW_DSN",
                "ValueFrom": {
                  "Fn::Join": [
                    "",
                    [
                      "arn:",
                      {
                        "Ref": "AWS::Partition",
                      },
                      ":secretsmanager:us-east-1:123456789012:secret:scholars/prod/db/app-rw",
                    ],
                  ],
                },
              },
              {
                "Name": "BOOTSTRAP_DSN",
                "ValueFrom": {
                  "Fn::Join": [
                    "",
                    [
                      "arn:",
                      {
                        "Ref": "AWS::Partition",
                      },
                      ":secretsmanager:us-east-1:123456789012:secret:scholars/prod/db/bootstrap",
                    ],
                  ],
                },
              },
              {
                "Name": "MIGRATE_DSN",
                "ValueFrom": {
                  "Fn::Join": [
                    "",
                    [
                      "arn:",
                      {
                        "Ref": "AWS::Partition",
                      },
                      ":secretsmanager:us-east-1:123456789012:secret:scholars/prod/db/migrate",
                    ],
                  ],
                },
              },
            ],
          },
        ],
        "Cpu": "512",
        "ExecutionRoleArn": {
          "Fn::GetAtt": [
            "DeployExecutionRoleBCBD9CEE",
            "Arn",
          ],
        },
        "Family": "sps-verify-grants-prod",
        "Memory": "1024",
        "NetworkMode": "awsvpc",
        "RequiresCompatibilities": [
          "FARGATE",
        ],
        "TaskRoleArn": {
          "Fn::GetAtt": [
            "TaskRole30FC0FBB",
            "Arn",
          ],
        },
      },
      "Type": "AWS::ECS::TaskDefinition",
    },
    "VpcEndpointSecurityGroup02EA44AC": {
      "Properties": {
        "GroupDescription": "SPS VPC interface endpoints (prod) -- HTTPS from app + ETL SGs.",
        "SecurityGroupEgress": [
          {
            "CidrIp": "255.255.255.255/32",
            "Description": "Disallow all traffic",
            "FromPort": 252,
            "IpProtocol": "icmp",
            "ToPort": 86,
          },
        ],
        "SecurityGroupIngress": [
          {
            "Description": "App SG to interface endpoints HTTPS (prod)",
            "FromPort": 443,
            "IpProtocol": "tcp",
            "SourceSecurityGroupId": {
              "Ref": "SsmParameterValuespsprodnetappsgidC96584B6F00A464EAD1953AFF4B05118Parameter",
            },
            "ToPort": 443,
          },
          {
            "Description": "ETL SG to interface endpoints HTTPS (prod)",
            "FromPort": 443,
            "IpProtocol": "tcp",
            "SourceSecurityGroupId": {
              "Ref": "SsmParameterValuespsprodnetetlsgidC96584B6F00A464EAD1953AFF4B05118Parameter",
            },
            "ToPort": 443,
          },
        ],
        "VpcId": {
          "Fn::ImportValue": "Sps-Network-prod:ExportsOutputRefVpc8378EB38272D6E3A",
        },
      },
      "Type": "AWS::EC2::SecurityGroup",
    },
  },
  "Rules": {
    "CheckBootstrapVersion": {
      "Assertions": [
        {
          "Assert": {
            "Fn::Not": [
              {
                "Fn::Contains": [
                  [
                    "1",
                    "2",
                    "3",
                    "4",
                    "5",
                  ],
                  {
                    "Ref": "BootstrapVersion",
                  },
                ],
              },
            ],
          },
          "AssertDescription": "CDK bootstrap stack version 6 required. Please run 'cdk bootstrap' with a recent version of the CDK CLI.",
        },
      ],
    },
  },
}
`;

exports[`AppStack staging matches the snapshot 1`] = `
{
  "Outputs": {
    "DeployRoleArn": {
      "Description": "SPS GitHub Actions deploy role ARN",
      "Value": {
        "Fn::GetAtt": [
          "DeployRole885297C3",
          "Arn",
        ],
      },
    },
    "EcrRepoUri": {
      "Description": "SPS ECR repository URI",
      "Value": {
        "Fn::Join": [
          "",
          [
            {
              "Fn::Select": [
                4,
                {
                  "Fn::Split": [
                    ":",
                    {
                      "Fn::GetAtt": [
                        "EcrRepository4D7B3EE1",
                        "Arn",
                      ],
                    },
                  ],
                },
              ],
            },
            ".dkr.ecr.",
            {
              "Fn::Select": [
                3,
                {
                  "Fn::Split": [
                    ":",
                    {
                      "Fn::GetAtt": [
                        "EcrRepository4D7B3EE1",
                        "Arn",
                      ],
                    },
                  ],
                },
              ],
            },
            ".",
            {
              "Ref": "AWS::URLSuffix",
            },
            "/",
            {
              "Ref": "EcrRepository4D7B3EE1",
            },
          ],
        ],
      },
    },
    "EcsAppTaskFamily": {
      "Description": "SPS app task definition family",
      "Value": "sps-app-staging",
    },
    "EcsClusterName": {
      "Description": "SPS ECS cluster name",
      "Value": {
        "Ref": "EcsCluster97242B84",
      },
    },
    "EcsDbBootstrapTaskFamily": {
      "Description": "SPS one-shot scholars_audit bootstrap task family - run before migrate (#493)",
      "Value": "sps-db-bootstrap-staging",
    },
    "EcsMigrationTaskFamily": {
      "Description": "SPS one-shot prisma migrate deploy task family",
      "Value": "sps-migrate-staging",
    },
    "EcsSearchEvalCanaryTaskFamily": {
      "Description": "SPS one-shot post-deploy search-eval canary task family - run after rollout is confirmed healthy (#1444)",
      "Value": "sps-search-eval-canary-staging",
    },
    "EcsServiceName": {
      "Description": "SPS ECS service name",
      "Value": {
        "Fn::GetAtt": [
          "EcsService81FC6EF6",
          "Name",
        ],
      },
    },
    "EcsVerifyGrantsTaskFamily": {
      "Description": "SPS one-shot grant-equality verify task family - run after db-bootstrap, before the service rolls (ADR-009)",
      "Value": "sps-verify-grants-staging",
    },
    "EtlEcrRepoUri": {
      "Description": "SPS ETL batch-image ECR repository URI (#454)",
      "Value": {
        "Fn::Join": [
          "",
          [
            {
              "Fn::Select": [
                4,
                {
                  "Fn::Split": [
                    ":",
                    {
                      "Fn::GetAtt": [
                        "EtlEcrRepository058F5EEC",
                        "Arn",
                      ],
                    },
                  ],
                },
              ],
            },
            ".dkr.ecr.",
            {
              "Fn::Select": [
                3,
                {
                  "Fn::Split": [
                    ":",
                    {
                      "Fn::GetAtt": [
                        "EtlEcrRepository058F5EEC",
                        "Arn",
                      ],
                    },
                  ],
                },
              ],
            },
            ".",
            {
              "Ref": "AWS::URLSuffix",
            },
            "/",
            {
              "Ref": "EtlEcrRepository058F5EEC",
            },
          ],
        ],
      },
    },
    "ExportsOutputFnGetAttEcrRepository4D7B3EE1Arn21868DE8": {
      "Export": {
        "Name": "Sps-App-staging:ExportsOutputFnGetAttEcrRepository4D7B3EE1Arn21868DE8",
      },
      "Value": {
        "Fn::GetAtt": [
          "EcrRepository4D7B3EE1",
          "Arn",
        ],
      },
    },
    "ExportsOutputFnGetAttPublicAlb84330974DNSNameFA3FF7E9": {
      "Export": {
        "Name": "Sps-App-staging:ExportsOutputFnGetAttPublicAlb84330974DNSNameFA3FF7E9",
      },
      "Value": {
        "Fn::GetAtt": [
          "PublicAlb84330974",
          "DNSName",
        ],
      },
    },
    "ExportsOutputRefEcrRepository4D7B3EE140E01346": {
      "Export": {
        "Name": "Sps-App-staging:ExportsOutputRefEcrRepository4D7B3EE140E01346",
      },
      "Value": {
        "Ref": "EcrRepository4D7B3EE1",
      },
    },
    "InternalAlbDns": {
      "Description": "SPS internal ALB DNS name (consumed by EtlStack).",
      "Export": {
        "Name": "Sps-App-staging-InternalAlbDns",
      },
      "Value": {
        "Fn::GetAtt": [
          "InternalAlb58CEEAE8",
          "DNSName",
        ],
      },
    },
    "InternalAlbSecurityGroupId": {
      "Description": "SPS internal ALB security group id (consumed by EtlStack ingress).",
      "Export": {
        "Name": "Sps-App-staging-InternalAlbSecurityGroupId",
      },
      "Value": {
        "Fn::GetAtt": [
          "InternalAlbSecurityGroup32D71C5A",
          "GroupId",
        ],
      },
    },
    "PublicAlbDns": {
      "Description": "SPS public ALB DNS name (consumed by EdgeStack)",
      "Value": {
        "Fn::GetAtt": [
          "PublicAlb84330974",
          "DNSName",
        ],
      },
    },
  },
  "Parameters": {
    "BootstrapVersion": {
      "Default": "/cdk-bootstrap/hnb659fds/version",
      "Description": "Version of the CDK Bootstrap resources in this environment, automatically retrieved from SSM Parameter Store. [cdk:skip]",
      "Type": "AWS::SSM::Parameter::Value<String>",
    },
  },
  "Resources": {
    "AppIngressFromInternalAlb": {
      "Properties": {
        "Description": "Internal ALB to SPS app tasks on container port (staging)",
        "FromPort": 3000,
        "GroupId": "sg-010c270a395b4854b",
        "IpProtocol": "tcp",
        "SourceSecurityGroupId": {
          "Fn::GetAtt": [
            "InternalAlbSecurityGroup32D71C5A",
            "GroupId",
          ],
        },
        "ToPort": 3000,
      },
      "Type": "AWS::EC2::SecurityGroupIngress",
    },
    "AppIngressFromPublicAlb": {
      "Properties": {
        "Description": "Public ALB to SPS app tasks on container port (staging)",
        "FromPort": 3000,
        "GroupId": "sg-010c270a395b4854b",
        "IpProtocol": "tcp",
        "SourceSecurityGroupId": "sg-0ab492e161a9e9976",
        "ToPort": 3000,
      },
      "Type": "AWS::EC2::SecurityGroupIngress",
    },
    "AppLogGroup7D8CD952": {
      "DeletionPolicy": "Retain",
      "Properties": {
        "LogGroupName": "/aws/ecs/sps-app-staging",
        "RetentionInDays": 30,
      },
      "Type": "AWS::Logs::LogGroup",
      "UpdateReplacePolicy": "Retain",
    },
    "AppTaskDefinitionCBC902A9": {
      "Properties": {
        "ContainerDefinitions": [
          {
            "Environment": [
              {
                "Name": "NODE_ENV",
                "Value": "production",
              },
              {
                "Name": "PORT",
                "Value": "3000",
              },
              {
                "Name": "OTEL_SERVICE_NAME",
                "Value": "Scholars-staging",
              },
              {
                "Name": "OTEL_EXPORTER_OTLP_ENDPOINT",
                "Value": "http://localhost:4318",
              },
              {
                "Name": "OTEL_PROPAGATORS",
                "Value": "tracecontext,xray",
              },
              {
                "Name": "SPS_ENV",
                "Value": "staging",
              },
              {
                "Name": "NEXT_ISR_CACHE_BUCKET",
                "Value": {
                  "Ref": "IsrCacheBucket311880A1",
                },
              },
              {
                "Name": "GRANT_MATCHER_SUBTOPIC_GRAIN",
                "Value": "on",
              },
              {
                "Name": "GRANT_MATCHER_ABSTAIN_FLOOR",
                "Value": "0.1",
              },
              {
                "Name": "SCHOLARS_CLOUDFRONT_DISTRIBUTION_ID",
                "Value": "E17NRWINXLP3B3",
              },
              {
                "Name": "SAML_IDP_ENTITY_ID",
                "Value": "https://login-proxy.weill.cornell.edu/idp",
              },
              {
                "Name": "SAML_IDP_SSO_URL",
                "Value": "https://login-proxy.weill.cornell.edu/idp/profile/SAML2/Redirect/SSO",
              },
              {
                "Name": "SAML_SP_ENTITY_ID",
                "Value": "https://scholars.weill.cornell.edu/api/auth/saml/metadata",
              },
              {
                "Name": "SAML_SP_ACS_URL",
                "Value": "https://scholars-staging.weill.cornell.edu/api/auth/saml/callback",
              },
              {
                "Name": "SAML_CWID_ATTRIBUTE",
                "Value": "CWID",
              },
              {
                "Name": "SAML_EPPN_TRUSTED_SCOPES",
                "Value": "nyp.org,qatar-med.cornell.edu",
              },
              {
                "Name": "SELF_EDIT_REQUEST_CHANGE_SEND",
                "Value": "off",
              },
              {
                "Name": "SCHOLARS_MAIL_FROM",
                "Value": "no-reply-scholars@weill.cornell.edu",
              },
              {
                "Name": "SELF_EDIT_REQUEST_CHANGE_RATE_LIMIT",
                "Value": "20",
              },
              {
                "Name": "SELF_EDIT_ADMINISTRATORS_TAB",
                "Value": "on",
              },
              {
                "Name": "SELF_EDIT_ED_ADMINS_IMPORT",
                "Value": "off",
              },
              {
                "Name": "SELF_EDIT_ORG_UNIT_CREATE_SUPERUSER_ONLY",
                "Value": "off",
              },
              {
                "Name": "EDIT_DATA_QUALITY_DASHBOARD",
                "Value": "on",
              },
              {
                "Name": "RECITER_REJECT_SEND",
                "Value": "on",
              },
              {
                "Name": "SELF_EDIT_MANUAL_HIGHLIGHTS",
                "Value": "on",
              },
              {
                "Name": "SELF_EDIT_COI_GAP_HINT",
                "Value": "on",
              },
              {
                "Name": "SELF_EDIT_GRANT_RECS",
                "Value": "on",
              },
              {
                "Name": "PRESTIGE_AXIS_WEIGHT",
                "Value": "0",
              },
              {
                "Name": "EDIT_UNIT_ROSTER_EXPORT",
                "Value": "on",
              },
              {
                "Name": "PROFILE_CENTER_AFFILIATION",
                "Value": "on",
              },
              {
                "Name": "UNIT_ADMIN_CENTER_PROXY",
                "Value": "on",
              },
              {
                "Name": "CENTER_PROGRAM_PAGES",
                "Value": "on",
              },
              {
                "Name": "CENTER_COLLABORATION_NETWORK",
                "Value": "on",
              },
              {
                "Name": "CENTER_COLLABORATION_GRANT_AXIS",
                "Value": "on",
              },
              {
                "Name": "CLINICAL_TRIALS_SECTION",
                "Value": "on",
              },
              {
                "Name": "DATA_SHARING_SECTION",
                "Value": "on",
              },
              {
                "Name": "AVAILABLE_TECHNOLOGIES_SECTION",
                "Value": "on",
              },
              {
                "Name": "NEWS_MENTIONS_SECTION",
                "Value": "on",
              },
              {
                "Name": "NEWS_APPROVAL_QUEUE",
                "Value": "on",
              },
              {
                "Name": "CONSOLE_SUBNAV_GROUPED",
                "Value": "on",
              },
              {
                "Name": "MATCHA",
                "Value": "on",
              },
              {
                "Name": "MATCHA_SPINE",
                "Value": "on",
              },
              {
                "Name": "MATCHA_RECENCY",
                "Value": "on",
              },
              {
                "Name": "MATCHA_GLOSS_RERANK",
                "Value": "on",
              },
              {
                "Name": "MATCHA_GLOSS_RERANK_LAMBDA",
                "Value": "0.5",
              },
              {
                "Name": "MATCHA_GLOSS_INWORDS",
                "Value": "off",
              },
              {
                "Name": "GRANT_MATCHA",
                "Value": "on",
              },
              {
                "Name": "SELF_EDIT_RECITER_PENDING_HINT",
                "Value": "on",
              },
              {
                "Name": "MENTORING_COPUB_BRIDGE",
                "Value": "on",
              },
              {
                "Name": "PUBLICATION_CITING_BRIDGE",
                "Value": "on",
              },
              {
                "Name": "SELF_EDIT_SLUG_REQUEST",
                "Value": "on",
              },
              {
                "Name": "HONORS_APPROVAL_QUEUE",
                "Value": "on",
              },
              {
                "Name": "HONORS_CURATOR_ENABLED",
                "Value": "on",
              },
              {
                "Name": "SCHOLARS_HONORS_CURATOR_GROUP_CN",
                "Value": "ITS:Library:Scholars/honors-curator-role",
              },
              {
                "Name": "SELF_EDIT_OVERVIEW_GENERATE",
                "Value": "on",
              },
              {
                "Name": "SELF_EDIT_OVERVIEW_GENERATE_STREAM",
                "Value": "on",
              },
              {
                "Name": "EDIT_BIOSKETCH_GENERATE",
                "Value": "on",
              },
              {
                "Name": "EDIT_CV_EXPORT",
                "Value": "on",
              },
              {
                "Name": "REPORTER_MATCH_V2",
                "Value": "on",
              },
              {
                "Name": "POPS_BASE_URL",
                "Value": "http://pops.weillcornell.org",
              },
              {
                "Name": "SELF_EDIT_RAIL_RESTRUCTURE",
                "Value": "on",
              },
              {
                "Name": "BIOSKETCH_FAITHFULNESS_PASS",
                "Value": "on",
              },
              {
                "Name": "BIOSKETCH_PROMPT_VERSION_DEFAULT",
                "Value": "v7",
              },
              {
                "Name": "OVERVIEW_PROMPT_VERSION_DEFAULT",
                "Value": "v4",
              },
              {
                "Name": "OVERVIEW_AUDIENCE_DEFAULT",
                "Value": "informed",
              },
              {
                "Name": "FEEDBACK_BADGE_ENABLED",
                "Value": "on",
              },
              {
                "Name": "FEEDBACK_SITE_ORIGIN",
                "Value": "https://scholars-staging.weill.cornell.edu",
              },
              {
                "Name": "SITE_URL",
                "Value": "https://scholars-staging.weill.cornell.edu",
              },
              {
                "Name": "SPS_USAGE_WORKGROUP",
                "Value": "sps-usage-app-staging",
              },
              {
                "Name": "SPS_USAGE_DATABASE",
                "Value": "sps_usage_staging",
              },
              {
                "Name": "SPS_USAGE_REGION",
                "Value": "us-east-1",
              },
              {
                "Name": "SHOW_BETA_BADGE",
                "Value": "on",
              },
              {
                "Name": "SEARCH_GENERIC_TERM_DEMOTE",
                "Value": "on",
              },
              {
                "Name": "SEARCH_PEOPLE_MATCH_EXPLAIN",
                "Value": "on",
              },
              {
                "Name": "SEARCH_PEOPLE_SNIPPET_REPRESENTATIVE_PUB",
                "Value": "off",
              },
              {
                "Name": "SEARCH_PEOPLE_REASON_FROM_DOC",
                "Value": "on",
              },
              {
                "Name": "SEARCH_PUB_HIGHLIGHT",
                "Value": "on",
              },
              {
                "Name": "SEARCH_PUB_MATCH_PROVENANCE",
                "Value": "on",
              },
              {
                "Name": "SEARCH_PUB_DEPARTMENT_FILTER",
                "Value": "on",
              },
              {
                "Name": "SEARCH_REQUIRE_DISPLAYABLE_AUTHOR",
                "Value": "off",
              },
              {
                "Name": "SEARCH_PUB_MESH_ONLY_FILTER",
                "Value": "on",
              },
              {
                "Name": "SEARCH_PUB_FACET_SPLIT",
                "Value": "on",
              },
              {
                "Name": "SEARCH_PEOPLE_METHOD_FAMILY",
                "Value": "on",
              },
              {
                "Name": "SEARCH_PEOPLE_METHOD_FAMILY_TIER",
                "Value": "off",
              },
              {
                "Name": "SEARCH_PEOPLE_METHOD_CONTEXT",
                "Value": "on",
              },
              {
                "Name": "SEARCH_PEOPLE_CLINICAL_BOARD_OVER_TAGGED",
                "Value": "6",
              },
              {
                "Name": "SEARCH_PEOPLE_CLINICAL_SPECIALTY_OVER_TAGGED",
                "Value": "4",
              },
              {
                "Name": "SEARCH_PEOPLE_CLINICAL_FN",
                "Value": "on",
              },
              {
                "Name": "SEARCH_PEOPLE_CLINICAL_MESH_ANCHOR",
                "Value": "on",
              },
              {
                "Name": "SEARCH_PEOPLE_CLINICAL_RANK_FACETS",
                "Value": "on",
              },
              {
                "Name": "SEARCH_PEOPLE_ESI_FACET",
                "Value": "on",
              },
              {
                "Name": "SEARCH_PEOPLE_MATCH_AWARE_SNIPPET",
                "Value": "on",
              },
              {
                "Name": "SEARCH_RESULT_EVIDENCE",
                "Value": "on",
              },
              {
                "Name": "SEARCH_EVIDENCE_ROWS",
                "Value": "on",
              },
              {
                "Name": "SEARCH_EVIDENCE_REASON_COUNTS",
                "Value": "on",
              },
              {
                "Name": "SEARCH_PEOPLE_AREA_BOOST",
                "Value": "on",
              },
              {
                "Name": "SEARCH_PEOPLE_CONCEPT_ARM_FIRST",
                "Value": "on",
              },
              {
                "Name": "SEARCH_PEOPLE_AREA_BOOST_GRADED",
                "Value": "on",
              },
              {
                "Name": "SEARCH_AREA_BOOST_W_HI",
                "Value": "20",
              },
              {
                "Name": "SEARCH_PEOPLE_CONCEPT_ALPHA",
                "Value": "0.5",
              },
              {
                "Name": "SEARCH_PEOPLE_PHRASE_BOOST",
                "Value": "on",
              },
              {
                "Name": "SEARCH_PEOPLE_DIVISION_SHAPE",
                "Value": "off",
              },
              {
                "Name": "SEARCH_PEOPLE_FACULTY_PROMINENCE",
                "Value": "off",
              },
              {
                "Name": "SEARCH_PEOPLE_PUBCOUNT_DAMPEN",
                "Value": "capped",
              },
              {
                "Name": "SEARCH_PEOPLE_CONCEPT_HINT",
                "Value": "on",
              },
              {
                "Name": "SEARCH_FUNDING_TAB_CONCEPT",
                "Value": "on",
              },
              {
                "Name": "SEARCH_FUNDING_MESH_GATE",
                "Value": "fundedPubMeshUi",
              },
              {
                "Name": "SEARCH_FUNDING_CONCEPT_GRANTS",
                "Value": "on",
              },
              {
                "Name": "SEARCH_SHELL_STREAMING",
                "Value": "on",
              },
              {
                "Name": "SEARCH_SUGGEST_MESH_CONCEPT",
                "Value": "off",
              },
              {
                "Name": "SEARCH_PEOPLE_CONCEPT_PRECOUNT",
                "Value": "off",
              },
              {
                "Name": "SEARCH_PEOPLE_CONCEPT_GRANT_AXIS",
                "Value": "on",
              },
              {
                "Name": "SEARCH_MESH_RESOLUTION_FALLBACK",
                "Value": "on",
              },
              {
                "Name": "SEARCH_MESH_RESOLVE_TOKEN_COVERAGE",
                "Value": "off",
              },
              {
                "Name": "SEARCH_MESH_ENTRY_TIER_PARITY",
                "Value": "on",
              },
              {
                "Name": "SEARCH_MESH_DESCENDANT_TERMS_CAP",
                "Value": "5000",
              },
              {
                "Name": "SEARCH_MESH_QUERY_NORMALIZATION",
                "Value": "on",
              },
              {
                "Name": "SEARCH_ACRONYM_SENSE_GUARD",
                "Value": "on",
              },
              {
                "Name": "COAUTHOR_HIDDEN_STUDENT_CHIPS",
                "Value": "on",
              },
              {
                "Name": "IMPERSONATION_ENABLED",
                "Value": "true",
              },
              {
                "Name": "PROFILE_CANONICAL",
                "Value": "root",
              },
              {
                "Name": "METHODS_LENS_ENABLED",
                "Value": "on",
              },
              {
                "Name": "METHODS_LENS_SENSITIVE_GATE",
                "Value": "on",
              },
              {
                "Name": "METHODS_LENS_FAMILY_FILTER",
                "Value": "on",
              },
              {
                "Name": "METHODS_LENS_FAMILY_ROSTER_FALLBACK",
                "Value": "on",
              },
              {
                "Name": "METHODS_LENS_PAGES",
                "Value": "on",
              },
              {
                "Name": "METHODS_LENS_FAMILY_DEFINITIONS",
                "Value": "on",
              },
              {
                "Name": "METHODS_LENS_TOOL_CONTEXT",
                "Value": "on",
              },
              {
                "Name": "METHODS_LENS_PUB_MODAL",
                "Value": "on",
              },
              {
                "Name": "METHODS_LENS_FAMILY_SYNONYMS",
                "Value": "on",
              },
              {
                "Name": "METHODS_LENS_CELL_LINE_ENTITIES",
                "Value": "on",
              },
              {
                "Name": "METHODS_LENS_ENTITY_USAGE",
                "Value": "on",
              },
              {
                "Name": "CENTER_METHODS_FACET",
                "Value": "on",
              },
              {
                "Name": "ORG_UNIT_METHODS_CHIPS",
                "Value": "on",
              },
              {
                "Name": "ORG_UNIT_METHODS_FACET",
                "Value": "on",
              },
              {
                "Name": "CORE_PUB_MODAL",
                "Value": "on",
              },
              {
                "Name": "CORE_PAGES",
                "Value": "on",
              },
              {
                "Name": "CORE_CLAIM_WRITEBACK",
                "Value": "on",
              },
              {
                "Name": "OPPORTUNITY_URL_INTAKE",
                "Value": "on",
              },
              {
                "Name": "PROFILE_FACET_REDESIGN",
                "Value": "on",
              },
              {
                "Name": "SCHOLAR_LIST_EXPORT",
                "Value": "on",
              },
              {
                "Name": "INTERNAL_VIEWER_NETWORK_SIGNAL",
                "Value": "on",
              },
              {
                "Name": "SCHOLAR_LIST_EXPORT_EMAIL",
                "Value": "on",
              },
              {
                "Name": "INTERNAL_VIEWER_CIDRS",
                "Value": "157.139.83.164/32",
              },
              {
                "Name": "PROFILE_EMAIL_RELEASE_GATE",
                "Value": "on",
              },
              {
                "Name": "SCHOLARS_SUPERUSER_GROUP_CN",
                "Value": "ITS:Library:Scholars/superuser-role",
              },
              {
                "Name": "SCHOLARS_SUPERUSER_CWIDS",
                "Value": "",
              },
              {
                "Name": "COMMS_STEWARD_ENABLED",
                "Value": "on",
              },
              {
                "Name": "SCHOLARS_COMMS_STEWARD_GROUP_CN",
                "Value": "ITS:Library:Scholars/comms-steward-role",
              },
              {
                "Name": "SCHOLARS_COMMS_STEWARD_ALLOWLIST",
                "Value": "",
              },
              {
                "Name": "DEVELOPMENT_ENABLED",
                "Value": "on",
              },
              {
                "Name": "SCHOLARS_DEVELOPMENT_GROUP_CN",
                "Value": "ITS:Library:Scholars/development-role",
              },
              {
                "Name": "SCHOLARS_DEVELOPMENT_ALLOWLIST",
                "Value": "",
              },
              {
                "Name": "SECURITY_CSP_MODE",
                "Value": "enforce",
              },
            ],
            "Essential": true,
            "Image": {
              "Fn::Join": [
                "",
                [
                  {
                    "Fn::Select": [
                      4,
                      {
                        "Fn::Split": [
                          ":",
                          {
                            "Fn::GetAtt": [
                              "EcrRepository4D7B3EE1",
                              "Arn",
                            ],
                          },
                        ],
                      },
                    ],
                  },
                  ".dkr.ecr.",
                  {
                    "Fn::Select": [
                      3,
                      {
                        "Fn::Split": [
                          ":",
                          {
                            "Fn::GetAtt": [
                              "EcrRepository4D7B3EE1",
                              "Arn",
                            ],
                          },
                        ],
                      },
                    ],
                  },
                  ".",
                  {
                    "Ref": "AWS::URLSuffix",
                  },
                  "/",
                  {
                    "Ref": "EcrRepository4D7B3EE1",
                  },
                  ":latest",
                ],
              ],
            },
            "LogConfiguration": {
              "LogDriver": "awslogs",
              "Options": {
                "awslogs-group": {
                  "Ref": "AppLogGroup7D8CD952",
                },
                "awslogs-region": "us-east-1",
                "awslogs-stream-prefix": "app",
              },
            },
            "Name": "app",
            "PortMappings": [
              {
                "ContainerPort": 3000,
                "Protocol": "tcp",
              },
            ],
            "Secrets": [
              {
                "Name": "DATABASE_URL",
                "ValueFrom": {
                  "Fn::Join": [
                    "",
                    [
                      "arn:",
                      {
                        "Ref": "AWS::Partition",
                      },
                      ":secretsmanager:us-east-1:123456789012:secret:scholars/staging/db/app-rw",
                    ],
                  ],
                },
              },
              {
                "Name": "DATABASE_URL_RO",
                "ValueFrom": {
                  "Fn::Join": [
                    "",
                    [
                      "arn:",
                      {
                        "Ref": "AWS::Partition",
                      },
                      ":secretsmanager:us-east-1:123456789012:secret:scholars/staging/db/app-ro",
                    ],
                  ],
                },
              },
              {
                "Name": "OPENSEARCH_NODE",
                "ValueFrom": {
                  "Fn::Join": [
                    "",
                    [
                      "arn:",
                      {
                        "Ref": "AWS::Partition",
                      },
                      ":secretsmanager:us-east-1:123456789012:secret:scholars/staging/opensearch/app:node::",
                    ],
                  ],
                },
              },
              {
                "Name": "OPENSEARCH_USER",
                "ValueFrom": {
                  "Fn::Join": [
                    "",
                    [
                      "arn:",
                      {
                        "Ref": "AWS::Partition",
                      },
                      ":secretsmanager:us-east-1:123456789012:secret:scholars/staging/opensearch/app:username::",
                    ],
                  ],
                },
              },
              {
                "Name": "OPENSEARCH_PASS",
                "ValueFrom": {
                  "Fn::Join": [
                    "",
                    [
                      "arn:",
                      {
                        "Ref": "AWS::Partition",
                      },
                      ":secretsmanager:us-east-1:123456789012:secret:scholars/staging/opensearch/app:password::",
                    ],
                  ],
                },
              },
              {
                "Name": "SCHOLARS_REVALIDATE_TOKEN",
                "ValueFrom": {
                  "Fn::Join": [
                    "",
                    [
                      "arn:",
                      {
                        "Ref": "AWS::Partition",
                      },
                      ":secretsmanager:us-east-1:123456789012:secret:scholars/staging/revalidate-token",
                    ],
                  ],
                },
              },
              {
                "Name": "FACULTY_REVIEW_TOKEN",
                "ValueFrom": {
                  "Fn::Join": [
                    "",
                    [
                      "arn:",
                      {
                        "Ref": "AWS::Partition",
                      },
                      ":secretsmanager:us-east-1:123456789012:secret:scholars/staging/faculty-review-token",
                    ],
                  ],
                },
              },
              {
                "Name": "RESEARCH_INFORMATICS_TOKEN",
                "ValueFrom": {
                  "Fn::Join": [
                    "",
                    [
                      "arn:",
                      {
                        "Ref": "AWS::Partition",
                      },
                      ":secretsmanager:us-east-1:123456789012:secret:scholars/staging/research-informatics-token",
                    ],
                  ],
                },
              },
              {
                "Name": "SESSION_COOKIE_SECRET",
                "ValueFrom": {
                  "Fn::Join": [
                    "",
                    [
                      "arn:",
                      {
                        "Ref": "AWS::Partition",
                      },
                      ":secretsmanager:us-east-1:123456789012:secret:scholars/staging/session-cookie-key",
                    ],
                  ],
                },
              },
              {
                "Name": "SAML_SP_PRIVATE_KEY",
                "ValueFrom": {
                  "Fn::Join": [
                    "",
                    [
                      "arn:",
                      {
                        "Ref": "AWS::Partition",
                      },
                      ":secretsmanager:us-east-1:123456789012:secret:scholars/saml-sp/staging/private-key",
                    ],
                  ],
                },
              },
              {
                "Name": "SAML_IDP_CERT",
                "ValueFrom": {
                  "Fn::Join": [
                    "",
                    [
                      "arn:",
                      {
                        "Ref": "AWS::Partition",
                      },
                      ":secretsmanager:us-east-1:123456789012:secret:scholars/staging/saml/idp-cert",
                    ],
                  ],
                },
              },
              {
                "Name": "SAML_SP_CERT",
                "ValueFrom": {
                  "Fn::Join": [
                    "",
                    [
                      "arn:",
                      {
                        "Ref": "AWS::Partition",
                      },
                      ":secretsmanager:us-east-1:123456789012:secret:scholars/saml-sp/staging/cert",
                    ],
                  ],
                },
              },
              {
                "Name": "SCHOLARS_RECITERDB_HOST",
                "ValueFrom": {
                  "Fn::Join": [
                    "",
                    [
                      "arn:",
                      {
                        "Ref": "AWS::Partition",
                      },
                      ":secretsmanager:us-east-1:123456789012:secret:scholars/staging/etl/reciter:SCHOLARS_RECITERDB_HOST::",
                    ],
                  ],
                },
              },
              {
                "Name": "SCHOLARS_RECITERDB_PORT",
                "ValueFrom": {
                  "Fn::Join": [
                    "",
                    [
                      "arn:",
                      {
                        "Ref": "AWS::Partition",
                      },
                      ":secretsmanager:us-east-1:123456789012:secret:scholars/staging/etl/reciter:SCHOLARS_RECITERDB_PORT::",
                    ],
                  ],
                },
              },
              {
                "Name": "SCHOLARS_RECITERDB_DATABASE",
                "ValueFrom": {
                  "Fn::Join": [
                    "",
                    [
                      "arn:",
                      {
                        "Ref": "AWS::Partition",
                      },
                      ":secretsmanager:us-east-1:123456789012:secret:scholars/staging/etl/reciter:SCHOLARS_RECITERDB_DATABASE::",
                    ],
                  ],
                },
              },
              {
                "Name": "SCHOLARS_RECITERDB_USERNAME",
                "ValueFrom": {
                  "Fn::Join": [
                    "",
                    [
                      "arn:",
                      {
                        "Ref": "AWS::Partition",
                      },
                      ":secretsmanager:us-east-1:123456789012:secret:scholars/staging/etl/reciter:SCHOLARS_RECITERDB_USERNAME::",
                    ],
                  ],
                },
              },
              {
                "Name": "SCHOLARS_RECITERDB_PASSWORD",
                "ValueFrom": {
                  "Fn::Join": [
                    "",
                    [
                      "arn:",
                      {
                        "Ref": "AWS::Partition",
                      },
                      ":secretsmanager:us-east-1:123456789012:secret:scholars/staging/etl/reciter:SCHOLARS_RECITERDB_PASSWORD::",
                    ],
                  ],
                },
              },
              {
                "Name": "SCHOLARS_LDAP_URL",
                "ValueFrom": {
                  "Fn::Join": [
                    "",
                    [
                      "arn:",
                      {
                        "Ref": "AWS::Partition",
                      },
                      ":secretsmanager:us-east-1:123456789012:secret:scholars/staging/etl/ed:SCHOLARS_LDAP_URL::",
                    ],
                  ],
                },
              },
              {
                "Name": "SCHOLARS_LDAP_BIND_DN",
                "ValueFrom": {
                  "Fn::Join": [
                    "",
                    [
                      "arn:",
                      {
                        "Ref": "AWS::Partition",
                      },
                      ":secretsmanager:us-east-1:123456789012:secret:scholars/staging/etl/ed:SCHOLARS_LDAP_BIND_DN::",
                    ],
                  ],
                },
              },
              {
                "Name": "SCHOLARS_LDAP_BIND_PASSWORD",
                "ValueFrom": {
                  "Fn::Join": [
                    "",
                    [
                      "arn:",
                      {
                        "Ref": "AWS::Partition",
                      },
                      ":secretsmanager:us-east-1:123456789012:secret:scholars/staging/etl/ed:SCHOLARS_LDAP_BIND_PASSWORD::",
                    ],
                  ],
                },
              },
            ],
          },
          {
            "Command": [
              "--config=env:AOT_CONFIG_CONTENT",
            ],
            "Environment": [
              {
                "Name": "AOT_CONFIG_CONTENT",
                "Value": "# ADOT collector configuration for SPS app tasks.
#
# Pipeline shape: OTLP/HTTP receiver -> memory_limiter -> tail_sampling ->
# batch -> [awsxray, otlphttp/newrelic] exporters. The tail_sampling processor
# is the load-bearing piece -- issue #123's "5% baseline + 100% on errors"
# cannot be delivered by an SDK-side head sampler (NotSampled decisions can't
# be reversed once the span is dropped), so the promotion happens here after
# the trace has ended and its status is known.
#
# Drops happen before the exporters, so BOTH the X-Ray bill and the New Relic
# ingest track the kept-trace rate (~5% baseline + every error + every >1500ms
# trace), not the SDK's 100% recording rate. See the exporters block for the
# soft/transitional dual-export rationale.
#
# Tunable in place: edit this file + cdk deploy --exclusively Sps-App-<env>.
# No app-image rebuild required because the file is baked into the
# collector container via the CDK Asset upload pattern (see app-stack.ts).

receivers:
  otlp:
    protocols:
      http:
        endpoint: 0.0.0.0:4318

processors:
  # Drop incoming OTLP if the collector is over a soft memory limit; required
  # in front of tail_sampling because the latter buffers up to num_traces.
  memory_limiter:
    check_interval: 1s
    limit_percentage: 80
    spike_limit_percentage: 25

  tail_sampling:
    decision_wait: 10s
    num_traces: 50000
    policies:
      - name: errors
        type: status_code
        status_code:
          status_codes: [ERROR]
      - name: slow
        type: latency
        latency:
          threshold_ms: 1500
      - name: baseline
        type: probabilistic
        probabilistic:
          sampling_percentage: 5

  batch:
    timeout: 5s
    send_batch_size: 50

exporters:
  # New Relic OTLP/HTTP ingest, US datacenter. The api-key header is the New
  # Relic *ingest license key*, injected into THIS collector container from
  # Secrets Manager (scholars/<env>/newrelic-license-key) as NEW_RELIC_LICENSE_KEY;
  # \${env:...} expands it at collector start. The otlphttp exporter appends
  # /v1/traces to the endpoint -- the exact URL the key was verified against.
  # gzip per New Relic's ingest guidance. EU accounts would use
  # https://otlp.eu01.nr-data.net instead.
  otlphttp/newrelic:
    endpoint: https://otlp.nr-data.net
    compression: gzip
    headers:
      api-key: \${env:NEW_RELIC_LICENSE_KEY}

  awsxray:
    # Region resolved from the ECS task metadata; no need to hard-code.

service:
  pipelines:
    traces:
      receivers: [otlp]
      processors: [memory_limiter, tail_sampling, batch]
      # Dual-export is a SOFT, transitional choice (2026-05-29): X-Ray and New
      # Relic both receive the same tail-sampled traces while New Relic is
      # validated. Making New Relic the sole backend later is a one-liner --
      # drop \`awsxray\` here (and optionally its exporter block above + the
      # task-role xray:Put* policy in app-stack.ts). To revert to X-Ray-only,
      # drop \`otlphttp/newrelic\`. Neither side is load-bearing for the other.
      exporters: [awsxray, otlphttp/newrelic]
",
              },
            ],
            "Essential": false,
            "Image": "public.ecr.aws/aws-observability/aws-otel-collector@sha256:8aa9ea5f67b8d318f7d6af24677e3c70f7098bc0631147cb5fa91addbe980b06",
            "LogConfiguration": {
              "LogDriver": "awslogs",
              "Options": {
                "awslogs-group": {
                  "Ref": "OtelCollectorLogGroup0FD207F7",
                },
                "awslogs-region": "us-east-1",
                "awslogs-stream-prefix": "otel",
              },
            },
            "Name": "otel-collector",
            "Secrets": [
              {
                "Name": "NEW_RELIC_LICENSE_KEY",
                "ValueFrom": {
                  "Fn::Join": [
                    "",
                    [
                      "arn:",
                      {
                        "Ref": "AWS::Partition",
                      },
                      ":secretsmanager:us-east-1:123456789012:secret:scholars/staging/newrelic-license-key",
                    ],
                  ],
                },
              },
            ],
          },
        ],
        "Cpu": "1024",
        "ExecutionRoleArn": {
          "Fn::GetAtt": [
            "TaskExecutionRole250D2532",
            "Arn",
          ],
        },
        "Family": "sps-app-staging",
        "Memory": "2048",
        "NetworkMode": "awsvpc",
        "RequiresCompatibilities": [
          "FARGATE",
        ],
        "TaskRoleArn": {
          "Fn::GetAtt": [
            "TaskRole30FC0FBB",
            "Arn",
          ],
        },
      },
      "Type": "AWS::ECS::TaskDefinition",
    },
    "AppinternalalbdnsEDBEA85B": {
      "Properties": {
        "Name": "/sps/staging/app/internal-alb-dns",
        "Type": "String",
        "Value": {
          "Fn::GetAtt": [
            "InternalAlb58CEEAE8",
            "DNSName",
          ],
        },
      },
      "Type": "AWS::SSM::Parameter",
    },
    "Appinternalalbsgid03BC738C": {
      "Properties": {
        "Name": "/sps/staging/app/internal-alb-sg-id",
        "Type": "String",
        "Value": {
          "Fn::GetAtt": [
            "InternalAlbSecurityGroup32D71C5A",
            "GroupId",
          ],
        },
      },
      "Type": "AWS::SSM::Parameter",
    },
    "ApppublicalbdnsB3FF6E1F": {
      "Properties": {
        "Name": "/sps/staging/app/public-alb-dns",
        "Type": "String",
        "Value": {
          "Fn::GetAtt": [
            "PublicAlb84330974",
            "DNSName",
          ],
        },
      },
      "Type": "AWS::SSM::Parameter",
    },
    "CustomAWSCDKOpenIdConnectProviderCustomResourceProviderHandlerF2C543E0": {
      "DependsOn": [
        "CustomAWSCDKOpenIdConnectProviderCustomResourceProviderRole517FED65",
      ],
      "Properties": {
        "Code": {
          "S3Bucket": "cdk-hnb659fds-assets-123456789012-us-east-1",
          "S3Key": "d75c48c9f82cde63e9bf414df335e84e8ac24f11eb34889be255b702aec71e50.zip",
        },
        "Handler": "__entrypoint__.handler",
        "MemorySize": 128,
        "Role": {
          "Fn::GetAtt": [
            "CustomAWSCDKOpenIdConnectProviderCustomResourceProviderRole517FED65",
            "Arn",
          ],
        },
        "Runtime": "nodejs22.x",
        "Timeout": 900,
      },
      "Type": "AWS::Lambda::Function",
    },
    "CustomAWSCDKOpenIdConnectProviderCustomResourceProviderRole517FED65": {
      "Properties": {
        "AssumeRolePolicyDocument": {
          "Statement": [
            {
              "Action": "sts:AssumeRole",
              "Effect": "Allow",
              "Principal": {
                "Service": "lambda.amazonaws.com",
              },
            },
          ],
          "Version": "2012-10-17",
        },
        "ManagedPolicyArns": [
          {
            "Fn::Sub": "arn:\${AWS::Partition}:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole",
          },
        ],
        "Policies": [
          {
            "PolicyDocument": {
              "Statement": [
                {
                  "Action": [
                    "iam:CreateOpenIDConnectProvider",
                    "iam:DeleteOpenIDConnectProvider",
                    "iam:UpdateOpenIDConnectProviderThumbprint",
                    "iam:AddClientIDToOpenIDConnectProvider",
                    "iam:RemoveClientIDFromOpenIDConnectProvider",
                  ],
                  "Effect": "Allow",
                  "Resource": "*",
                },
              ],
              "Version": "2012-10-17",
            },
            "PolicyName": "Inline",
          },
        ],
      },
      "Type": "AWS::IAM::Role",
    },
    "DbBootstrapLogGroupAF64F8C3": {
      "DeletionPolicy": "Retain",
      "Properties": {
        "LogGroupName": "/aws/ecs/sps-db-bootstrap-staging",
        "RetentionInDays": 30,
      },
      "Type": "AWS::Logs::LogGroup",
      "UpdateReplacePolicy": "Retain",
    },
    "DbBootstrapTaskDefinition603C6DE9": {
      "Properties": {
        "ContainerDefinitions": [
          {
            "EntryPoint": [
              "npx",
              "tsx",
              "scripts/db-bootstrap.ts",
            ],
            "Environment": [
              {
                "Name": "GRANTEE_HOST",
                "Value": "10.46.160.%",
              },
            ],
            "Essential": true,
            "Image": {
              "Fn::Join": [
                "",
                [
                  {
                    "Fn::Select": [
                      4,
                      {
                        "Fn::Split": [
                          ":",
                          {
                            "Fn::GetAtt": [
                              "EtlEcrRepository058F5EEC",
                              "Arn",
                            ],
                          },
                        ],
                      },
                    ],
                  },
                  ".dkr.ecr.",
                  {
                    "Fn::Select": [
                      3,
                      {
                        "Fn::Split": [
                          ":",
                          {
                            "Fn::GetAtt": [
                              "EtlEcrRepository058F5EEC",
                              "Arn",
                            ],
                          },
                        ],
                      },
                    ],
                  },
                  ".",
                  {
                    "Ref": "AWS::URLSuffix",
                  },
                  "/",
                  {
                    "Ref": "EtlEcrRepository058F5EEC",
                  },
                  ":latest",
                ],
              ],
            },
            "LogConfiguration": {
              "LogDriver": "awslogs",
              "Options": {
                "awslogs-group": {
                  "Ref": "DbBootstrapLogGroupAF64F8C3",
                },
                "awslogs-region": "us-east-1",
                "awslogs-stream-prefix": "db-bootstrap",
              },
            },
            "Name": "db-bootstrap",
            "Secrets": [
              {
                "Name": "BOOTSTRAP_DSN",
                "ValueFrom": {
                  "Fn::Join": [
                    "",
                    [
                      "arn:",
                      {
                        "Ref": "AWS::Partition",
                      },
                      ":secretsmanager:us-east-1:123456789012:secret:scholars/staging/db/bootstrap",
                    ],
                  ],
                },
              },
              {
                "Name": "APP_RW_DSN",
                "ValueFrom": {
                  "Fn::Join": [
                    "",
                    [
                      "arn:",
                      {
                        "Ref": "AWS::Partition",
                      },
                      ":secretsmanager:us-east-1:123456789012:secret:scholars/staging/db/app-rw",
                    ],
                  ],
                },
              },
            ],
          },
        ],
        "Cpu": "512",
        "ExecutionRoleArn": {
          "Fn::GetAtt": [
            "DeployExecutionRoleBCBD9CEE",
            "Arn",
          ],
        },
        "Family": "sps-db-bootstrap-staging",
        "Memory": "1024",
        "NetworkMode": "awsvpc",
        "RequiresCompatibilities": [
          "FARGATE",
        ],
        "TaskRoleArn": {
          "Fn::GetAtt": [
            "TaskRole30FC0FBB",
            "Arn",
          ],
        },
      },
      "Type": "AWS::ECS::TaskDefinition",
    },
    "DeployExecutionRoleBCBD9CEE": {
      "Properties": {
        "AssumeRolePolicyDocument": {
          "Statement": [
            {
              "Action": "sts:AssumeRole",
              "Effect": "Allow",
              "Principal": {
                "Service": "ecs-tasks.amazonaws.com",
              },
            },
          ],
          "Version": "2012-10-17",
        },
        "Description": "SPS ECS deploy-time task-execution role (staging). Migrate/verify/db-bootstrap only; the sole reader of the migrate DSN.",
        "RoleName": "sps-deploy-exec-staging",
      },
      "Type": "AWS::IAM::Role",
    },
    "DeployExecutionRoleDefaultPolicy0759ACD6": {
      "Properties": {
        "PolicyDocument": {
          "Statement": [
            {
              "Action": "ecr:GetAuthorizationToken",
              "Effect": "Allow",
              "Resource": "*",
            },
            {
              "Action": [
                "ecr:BatchCheckLayerAvailability",
                "ecr:GetDownloadUrlForLayer",
                "ecr:BatchGetImage",
              ],
              "Effect": "Allow",
              "Resource": [
                {
                  "Fn::GetAtt": [
                    "EcrRepository4D7B3EE1",
                    "Arn",
                  ],
                },
                {
                  "Fn::GetAtt": [
                    "EtlEcrRepository058F5EEC",
                    "Arn",
                  ],
                },
              ],
            },
            {
              "Action": "secretsmanager:GetSecretValue",
              "Effect": "Allow",
              "Resource": [
                {
                  "Fn::Join": [
                    "",
                    [
                      "arn:",
                      {
                        "Ref": "AWS::Partition",
                      },
                      ":secretsmanager:us-east-1:123456789012:secret:scholars/staging/db/app-ro",
                    ],
                  ],
                },
                {
                  "Fn::Join": [
                    "",
                    [
                      "arn:",
                      {
                        "Ref": "AWS::Partition",
                      },
                      ":secretsmanager:us-east-1:123456789012:secret:scholars/staging/db/app-rw",
                    ],
                  ],
                },
                {
                  "Fn::Join": [
                    "",
                    [
                      "arn:",
                      {
                        "Ref": "AWS::Partition",
                      },
                      ":secretsmanager:us-east-1:123456789012:secret:scholars/staging/db/bootstrap",
                    ],
                  ],
                },
                {
                  "Fn::Join": [
                    "",
                    [
                      "arn:",
                      {
                        "Ref": "AWS::Partition",
                      },
                      ":secretsmanager:us-east-1:123456789012:secret:scholars/staging/db/migrate",
                    ],
                  ],
                },
              ],
            },
            {
              "Action": [
                "logs:CreateLogStream",
                "logs:PutLogEvents",
              ],
              "Effect": "Allow",
              "Resource": [
                {
                  "Fn::GetAtt": [
                    "MigrationLogGroupFD140541",
                    "Arn",
                  ],
                },
                {
                  "Fn::Join": [
                    "",
                    [
                      {
                        "Fn::GetAtt": [
                          "MigrationLogGroupFD140541",
                          "Arn",
                        ],
                      },
                      ":*",
                    ],
                  ],
                },
                {
                  "Fn::GetAtt": [
                    "DbBootstrapLogGroupAF64F8C3",
                    "Arn",
                  ],
                },
                {
                  "Fn::Join": [
                    "",
                    [
                      {
                        "Fn::GetAtt": [
                          "DbBootstrapLogGroupAF64F8C3",
                          "Arn",
                        ],
                      },
                      ":*",
                    ],
                  ],
                },
                {
                  "Fn::GetAtt": [
                    "VerifyGrantsLogGroupD90AC2C4",
                    "Arn",
                  ],
                },
                {
                  "Fn::Join": [
                    "",
                    [
                      {
                        "Fn::GetAtt": [
                          "VerifyGrantsLogGroupD90AC2C4",
                          "Arn",
                        ],
                      },
                      ":*",
                    ],
                  ],
                },
              ],
            },
            {
              "Action": [
                "ecr:BatchCheckLayerAvailability",
                "ecr:GetDownloadUrlForLayer",
                "ecr:BatchGetImage",
              ],
              "Effect": "Allow",
              "Resource": {
                "Fn::GetAtt": [
                  "EcrRepository4D7B3EE1",
                  "Arn",
                ],
              },
            },
            {
              "Action": [
                "logs:CreateLogStream",
                "logs:PutLogEvents",
              ],
              "Effect": "Allow",
              "Resource": {
                "Fn::GetAtt": [
                  "MigrationLogGroupFD140541",
                  "Arn",
                ],
              },
            },
            {
              "Action": [
                "secretsmanager:GetSecretValue",
                "secretsmanager:DescribeSecret",
              ],
              "Effect": "Allow",
              "Resource": {
                "Fn::Join": [
                  "",
                  [
                    "arn:",
                    {
                      "Ref": "AWS::Partition",
                    },
                    ":secretsmanager:us-east-1:123456789012:secret:scholars/staging/db/migrate-??????",
                  ],
                ],
              },
            },
            {
              "Action": [
                "ecr:BatchCheckLayerAvailability",
                "ecr:GetDownloadUrlForLayer",
                "ecr:BatchGetImage",
              ],
              "Effect": "Allow",
              "Resource": {
                "Fn::GetAtt": [
                  "EtlEcrRepository058F5EEC",
                  "Arn",
                ],
              },
            },
            {
              "Action": [
                "logs:CreateLogStream",
                "logs:PutLogEvents",
              ],
              "Effect": "Allow",
              "Resource": {
                "Fn::GetAtt": [
                  "DbBootstrapLogGroupAF64F8C3",
                  "Arn",
                ],
              },
            },
            {
              "Action": [
                "secretsmanager:GetSecretValue",
                "secretsmanager:DescribeSecret",
              ],
              "Effect": "Allow",
              "Resource": {
                "Fn::Join": [
                  "",
                  [
                    "arn:",
                    {
                      "Ref": "AWS::Partition",
                    },
                    ":secretsmanager:us-east-1:123456789012:secret:scholars/staging/db/bootstrap-??????",
                  ],
                ],
              },
            },
            {
              "Action": [
                "secretsmanager:GetSecretValue",
                "secretsmanager:DescribeSecret",
              ],
              "Effect": "Allow",
              "Resource": {
                "Fn::Join": [
                  "",
                  [
                    "arn:",
                    {
                      "Ref": "AWS::Partition",
                    },
                    ":secretsmanager:us-east-1:123456789012:secret:scholars/staging/db/app-rw-??????",
                  ],
                ],
              },
            },
            {
              "Action": [
                "logs:CreateLogStream",
                "logs:PutLogEvents",
              ],
              "Effect": "Allow",
              "Resource": {
                "Fn::GetAtt": [
                  "VerifyGrantsLogGroupD90AC2C4",
                  "Arn",
                ],
              },
            },
            {
              "Action": [
                "secretsmanager:GetSecretValue",
                "secretsmanager:DescribeSecret",
              ],
              "Effect": "Allow",
              "Resource": {
                "Fn::Join": [
                  "",
                  [
                    "arn:",
                    {
                      "Ref": "AWS::Partition",
                    },
                    ":secretsmanager:us-east-1:123456789012:secret:scholars/staging/db/app-ro-??????",
                  ],
                ],
              },
            },
          ],
          "Version": "2012-10-17",
        },
        "PolicyName": "DeployExecutionRoleDefaultPolicy0759ACD6",
        "Roles": [
          {
            "Ref": "DeployExecutionRoleBCBD9CEE",
          },
        ],
      },
      "Type": "AWS::IAM::Policy",
    },
    "DeployRole885297C3": {
      "Properties": {
        "AssumeRolePolicyDocument": {
          "Statement": [
            {
              "Action": "sts:AssumeRoleWithWebIdentity",
              "Condition": {
                "StringEquals": {
                  "token.actions.githubusercontent.com:aud": "sts.amazonaws.com",
                },
                "StringLike": {
                  "token.actions.githubusercontent.com:sub": "repo:wcmc-its/Scholars-Profile-System:*",
                },
              },
              "Effect": "Allow",
              "Principal": {
                "Federated": {
                  "Ref": "GithubOidcProviderD8241A88",
                },
              },
            },
          ],
          "Version": "2012-10-17",
        },
        "Description": "SPS GitHub Actions deploy role (staging). Assumed by the deploy workflow via OIDC.",
        "RoleName": "sps-deploy-staging",
      },
      "Type": "AWS::IAM::Role",
    },
    "DeployRoleDefaultPolicyDC930F96": {
      "Properties": {
        "PolicyDocument": {
          "Statement": [
            {
              "Action": "ecr:GetAuthorizationToken",
              "Effect": "Allow",
              "Resource": "*",
            },
            {
              "Action": [
                "ecr:BatchCheckLayerAvailability",
                "ecr:CompleteLayerUpload",
                "ecr:InitiateLayerUpload",
                "ecr:PutImage",
                "ecr:UploadLayerPart",
                "ecr:BatchGetImage",
                "ecr:GetDownloadUrlForLayer",
                "ecr:DescribeImages",
                "ecr:DescribeRepositories",
              ],
              "Effect": "Allow",
              "Resource": [
                {
                  "Fn::GetAtt": [
                    "EcrRepository4D7B3EE1",
                    "Arn",
                  ],
                },
                {
                  "Fn::GetAtt": [
                    "EtlEcrRepository058F5EEC",
                    "Arn",
                  ],
                },
              ],
            },
            {
              "Action": "ecs:RunTask",
              "Effect": "Allow",
              "Resource": [
                {
                  "Fn::Join": [
                    "",
                    [
                      "arn:",
                      {
                        "Ref": "AWS::Partition",
                      },
                      ":ecs:us-east-1:123456789012:task-definition/sps-migrate-staging:*",
                    ],
                  ],
                },
                {
                  "Fn::Join": [
                    "",
                    [
                      "arn:",
                      {
                        "Ref": "AWS::Partition",
                      },
                      ":ecs:us-east-1:123456789012:task-definition/sps-db-bootstrap-staging:*",
                    ],
                  ],
                },
                {
                  "Fn::Join": [
                    "",
                    [
                      "arn:",
                      {
                        "Ref": "AWS::Partition",
                      },
                      ":ecs:us-east-1:123456789012:task-definition/sps-verify-grants-staging:*",
                    ],
                  ],
                },
                {
                  "Fn::Join": [
                    "",
                    [
                      "arn:",
                      {
                        "Ref": "AWS::Partition",
                      },
                      ":ecs:us-east-1:123456789012:task-definition/sps-search-eval-canary-staging:*",
                    ],
                  ],
                },
              ],
            },
            {
              "Action": [
                "ecs:UpdateService",
                "ecs:DescribeServices",
              ],
              "Effect": "Allow",
              "Resource": {
                "Ref": "EcsService81FC6EF6",
              },
            },
            {
              "Action": [
                "ecs:DescribeTaskDefinition",
                "ecs:RegisterTaskDefinition",
              ],
              "Effect": "Allow",
              "Resource": "*",
            },
            {
              "Action": [
                "ecs:DescribeTasks",
                "ecs:ListTasks",
              ],
              "Effect": "Allow",
              "Resource": {
                "Fn::Join": [
                  "",
                  [
                    "arn:",
                    {
                      "Ref": "AWS::Partition",
                    },
                    ":ecs:us-east-1:123456789012:task/",
                    {
                      "Ref": "EcsCluster97242B84",
                    },
                    "/*",
                  ],
                ],
              },
            },
            {
              "Action": "iam:PassRole",
              "Condition": {
                "StringEquals": {
                  "iam:PassedToService": "ecs-tasks.amazonaws.com",
                },
              },
              "Effect": "Allow",
              "Resource": [
                {
                  "Fn::GetAtt": [
                    "TaskExecutionRole250D2532",
                    "Arn",
                  ],
                },
                {
                  "Fn::GetAtt": [
                    "DeployExecutionRoleBCBD9CEE",
                    "Arn",
                  ],
                },
                {
                  "Fn::GetAtt": [
                    "TaskRole30FC0FBB",
                    "Arn",
                  ],
                },
                {
                  "Fn::GetAtt": [
                    "SearchEvalCanaryExecutionRole464F1E01",
                    "Arn",
                  ],
                },
              ],
            },
            {
              "Action": "cloudformation:DescribeStacks",
              "Effect": "Allow",
              "Resource": [
                {
                  "Fn::Join": [
                    "",
                    [
                      "arn:",
                      {
                        "Ref": "AWS::Partition",
                      },
                      ":cloudformation:us-east-1:123456789012:stack/Sps-App-staging/*",
                    ],
                  ],
                },
                {
                  "Fn::Join": [
                    "",
                    [
                      "arn:",
                      {
                        "Ref": "AWS::Partition",
                      },
                      ":cloudformation:us-east-1:123456789012:stack/Sps-Edge-staging/*",
                    ],
                  ],
                },
              ],
            },
          ],
          "Version": "2012-10-17",
        },
        "PolicyName": "DeployRoleDefaultPolicyDC930F96",
        "Roles": [
          {
            "Ref": "DeployRole885297C3",
          },
        ],
      },
      "Type": "AWS::IAM::Policy",
    },
    "EcrRepository4D7B3EE1": {
      "DeletionPolicy": "Retain",
      "Properties": {
        "ImageScanningConfiguration": {
          "ScanOnPush": true,
        },
        "LifecyclePolicy": {
          "LifecyclePolicyText": "{"rules":[{"rulePriority":1,"description":"Keep the last 30 tagged images","selection":{"tagStatus":"tagged","tagPatternList":["*"],"countType":"imageCountMoreThan","countNumber":30},"action":{"type":"expire"}},{"rulePriority":2,"description":"Expire untagged images after 7 days","selection":{"tagStatus":"untagged","countType":"sinceImagePushed","countNumber":7,"countUnit":"days"},"action":{"type":"expire"}}]}",
        },
        "RepositoryName": "scholars-app-staging",
      },
      "Type": "AWS::ECR::Repository",
      "UpdateReplacePolicy": "Retain",
    },
    "EcsCluster97242B84": {
      "Properties": {
        "ClusterName": "sps-cluster-staging",
        "ClusterSettings": [
          {
            "Name": "containerInsights",
            "Value": "enabled",
          },
        ],
      },
      "Type": "AWS::ECS::Cluster",
    },
    "EcsService81FC6EF6": {
      "DependsOn": [
        "InternalAlbInternalHttpListener9436A291",
        "InternalAppTargetGroup9E028644",
        "OriginVerifiedForwardC0422D52",
        "PublicAlbPublicHttpListener8CAA0E91",
        "PublicAppTargetGroup68798009",
        "TaskRoleDefaultPolicy07FC53DE",
        "TaskRole30FC0FBB",
      ],
      "Properties": {
        "Cluster": {
          "Ref": "EcsCluster97242B84",
        },
        "DeploymentConfiguration": {
          "Alarms": {
            "AlarmNames": [],
            "Enable": false,
            "Rollback": false,
          },
          "DeploymentCircuitBreaker": {
            "Enable": true,
            "Rollback": true,
          },
          "MaximumPercent": 200,
          "MinimumHealthyPercent": 100,
        },
        "DeploymentController": {
          "Type": "ECS",
        },
        "DesiredCount": 1,
        "EnableECSManagedTags": false,
        "EnableExecuteCommand": false,
        "HealthCheckGracePeriodSeconds": 120,
        "LaunchType": "FARGATE",
        "LoadBalancers": [
          {
            "ContainerName": "app",
            "ContainerPort": 3000,
            "TargetGroupArn": {
              "Ref": "PublicAppTargetGroup68798009",
            },
          },
          {
            "ContainerName": "app",
            "ContainerPort": 3000,
            "TargetGroupArn": {
              "Ref": "InternalAppTargetGroup9E028644",
            },
          },
        ],
        "NetworkConfiguration": {
          "AwsvpcConfiguration": {
            "AssignPublicIp": "DISABLED",
            "SecurityGroups": [
              "sg-010c270a395b4854b",
            ],
            "Subnets": [
              "subnet-0c6593fb9c9a165c3",
              "subnet-070cbc242efbddc3c",
            ],
          },
        },
        "ServiceName": "sps-app-staging",
        "TaskDefinition": {
          "Ref": "AppTaskDefinitionCBC902A9",
        },
      },
      "Type": "AWS::ECS::Service",
    },
    "EcsServiceTaskCountTarget02FCCE22": {
      "DependsOn": [
        "InternalAlbInternalHttpListener9436A291",
        "InternalAppTargetGroup9E028644",
        "OriginVerifiedForwardC0422D52",
        "PublicAlbPublicHttpListener8CAA0E91",
        "PublicAppTargetGroup68798009",
        "TaskRoleDefaultPolicy07FC53DE",
        "TaskRole30FC0FBB",
      ],
      "Properties": {
        "MaxCapacity": 3,
        "MinCapacity": 1,
        "ResourceId": {
          "Fn::Join": [
            "",
            [
              "service/",
              {
                "Ref": "EcsCluster97242B84",
              },
              "/",
              {
                "Fn::GetAtt": [
                  "EcsService81FC6EF6",
                  "Name",
                ],
              },
            ],
          ],
        },
        "RoleARN": {
          "Fn::Join": [
            "",
            [
              "arn:",
              {
                "Ref": "AWS::Partition",
              },
              ":iam::123456789012:role/aws-service-role/ecs.application-autoscaling.amazonaws.com/AWSServiceRoleForApplicationAutoScaling_ECSService",
            ],
          ],
        },
        "ScalableDimension": "ecs:service:DesiredCount",
        "ServiceNamespace": "ecs",
      },
      "Type": "AWS::ApplicationAutoScaling::ScalableTarget",
    },
    "EcsServiceTaskCountTargetCpuScalingA9C91D4C": {
      "DependsOn": [
        "InternalAlbInternalHttpListener9436A291",
        "InternalAppTargetGroup9E028644",
        "OriginVerifiedForwardC0422D52",
        "PublicAlbPublicHttpListener8CAA0E91",
        "PublicAppTargetGroup68798009",
        "TaskRoleDefaultPolicy07FC53DE",
        "TaskRole30FC0FBB",
      ],
      "Properties": {
        "PolicyName": "SpsAppstagingEcsServiceTaskCountTargetCpuScalingFE6EC224",
        "PolicyType": "TargetTrackingScaling",
        "ScalingTargetId": {
          "Ref": "EcsServiceTaskCountTarget02FCCE22",
        },
        "TargetTrackingScalingPolicyConfiguration": {
          "PredefinedMetricSpecification": {
            "PredefinedMetricType": "ECSServiceAverageCPUUtilization",
          },
          "ScaleInCooldown": 300,
          "ScaleOutCooldown": 60,
          "TargetValue": 60,
        },
      },
      "Type": "AWS::ApplicationAutoScaling::ScalingPolicy",
    },
    "EcsServiceTaskCountTargetRequestScaling41EBB189": {
      "DependsOn": [
        "InternalAlbInternalHttpListener9436A291",
        "InternalAppTargetGroup9E028644",
        "OriginVerifiedForwardC0422D52",
        "PublicAlbPublicHttpListener8CAA0E91",
        "PublicAppTargetGroup68798009",
        "TaskRoleDefaultPolicy07FC53DE",
        "TaskRole30FC0FBB",
      ],
      "Properties": {
        "PolicyName": "SpsAppstagingEcsServiceTaskCountTargetRequestScaling02C35464",
        "PolicyType": "TargetTrackingScaling",
        "ScalingTargetId": {
          "Ref": "EcsServiceTaskCountTarget02FCCE22",
        },
        "TargetTrackingScalingPolicyConfiguration": {
          "PredefinedMetricSpecification": {
            "PredefinedMetricType": "ALBRequestCountPerTarget",
            "ResourceLabel": {
              "Fn::Join": [
                "",
                [
                  {
                    "Fn::Select": [
                      1,
                      {
                        "Fn::Split": [
                          "/",
                          {
                            "Ref": "PublicAlbPublicHttpListener8CAA0E91",
                          },
                        ],
                      },
                    ],
                  },
                  "/",
                  {
                    "Fn::Select": [
                      2,
                      {
                        "Fn::Split": [
                          "/",
                          {
                            "Ref": "PublicAlbPublicHttpListener8CAA0E91",
                          },
                        ],
                      },
                    ],
                  },
                  "/",
                  {
                    "Fn::Select": [
                      3,
                      {
                        "Fn::Split": [
                          "/",
                          {
                            "Ref": "PublicAlbPublicHttpListener8CAA0E91",
                          },
                        ],
                      },
                    ],
                  },
                  "/",
                  {
                    "Fn::GetAtt": [
                      "PublicAppTargetGroup68798009",
                      "TargetGroupFullName",
                    ],
                  },
                ],
              ],
            },
          },
          "ScaleInCooldown": 300,
          "ScaleOutCooldown": 60,
          "TargetValue": 1000,
        },
      },
      "Type": "AWS::ApplicationAutoScaling::ScalingPolicy",
    },
    "EtlEcrRepository058F5EEC": {
      "DeletionPolicy": "Retain",
      "Properties": {
        "ImageScanningConfiguration": {
          "ScanOnPush": true,
        },
        "LifecyclePolicy": {
          "LifecyclePolicyText": "{"rules":[{"rulePriority":1,"description":"Keep the last 30 tagged images","selection":{"tagStatus":"tagged","tagPatternList":["*"],"countType":"imageCountMoreThan","countNumber":30},"action":{"type":"expire"}},{"rulePriority":2,"description":"Expire untagged images after 7 days","selection":{"tagStatus":"untagged","countType":"sinceImagePushed","countNumber":7,"countUnit":"days"},"action":{"type":"expire"}}]}",
        },
        "RepositoryName": "scholars-etl-staging",
      },
      "Type": "AWS::ECR::Repository",
      "UpdateReplacePolicy": "Retain",
    },
    "GithubOidcProviderD8241A88": {
      "DeletionPolicy": "Delete",
      "Properties": {
        "ClientIDList": [
          "sts.amazonaws.com",
        ],
        "CodeHash": "d75c48c9f82cde63e9bf414df335e84e8ac24f11eb34889be255b702aec71e50",
        "RejectUnauthorized": false,
        "ServiceToken": {
          "Fn::GetAtt": [
            "CustomAWSCDKOpenIdConnectProviderCustomResourceProviderHandlerF2C543E0",
            "Arn",
          ],
        },
        "Url": "https://token.actions.githubusercontent.com",
      },
      "Type": "Custom::AWSCDKOpenIdConnectProvider",
      "UpdateReplacePolicy": "Delete",
    },
    "InternalAlb58CEEAE8": {
      "Properties": {
        "LoadBalancerAttributes": [
          {
            "Key": "deletion_protection.enabled",
            "Value": "false",
          },
        ],
        "Scheme": "internal",
        "SecurityGroups": [
          {
            "Fn::GetAtt": [
              "InternalAlbSecurityGroup32D71C5A",
              "GroupId",
            ],
          },
        ],
        "Subnets": [
          "subnet-0c6593fb9c9a165c3",
          "subnet-070cbc242efbddc3c",
        ],
        "Type": "application",
      },
      "Type": "AWS::ElasticLoadBalancingV2::LoadBalancer",
    },
    "InternalAlbInternalHttpListener9436A291": {
      "Properties": {
        "DefaultActions": [
          {
            "TargetGroupArn": {
              "Ref": "InternalAppTargetGroup9E028644",
            },
            "Type": "forward",
          },
        ],
        "LoadBalancerArn": {
          "Ref": "InternalAlb58CEEAE8",
        },
        "Port": 80,
        "Protocol": "HTTP",
      },
      "Type": "AWS::ElasticLoadBalancingV2::Listener",
    },
    "InternalAlbSecurityGroup32D71C5A": {
      "Properties": {
        "GroupDescription": "SPS internal ALB (staging) -- intra-VPC /api/revalidate ingress.",
        "SecurityGroupEgress": [
          {
            "CidrIp": "0.0.0.0/0",
            "Description": "Allow all outbound traffic by default",
            "IpProtocol": "-1",
          },
        ],
        "SecurityGroupIngress": [
          {
            "CidrIp": "0.0.0.0/0",
            "Description": "Allow from anyone on port 80",
            "FromPort": 80,
            "IpProtocol": "tcp",
            "ToPort": 80,
          },
        ],
        "VpcId": "vpc-08a1873fc8eebae28",
      },
      "Type": "AWS::EC2::SecurityGroup",
    },
    "InternalAppTargetGroup9E028644": {
      "Properties": {
        "HealthCheckIntervalSeconds": 30,
        "HealthCheckPath": "/api/health",
        "HealthCheckTimeoutSeconds": 5,
        "HealthyThresholdCount": 2,
        "Port": 3000,
        "Protocol": "HTTP",
        "TargetGroupAttributes": [
          {
            "Key": "deregistration_delay.timeout_seconds",
            "Value": "30",
          },
          {
            "Key": "stickiness.enabled",
            "Value": "false",
          },
        ],
        "TargetType": "ip",
        "UnhealthyThresholdCount": 3,
        "VpcId": "vpc-08a1873fc8eebae28",
      },
      "Type": "AWS::ElasticLoadBalancingV2::TargetGroup",
    },
    "IsrCacheBucket311880A1": {
      "DeletionPolicy": "Retain",
      "Properties": {
        "BucketEncryption": {
          "ServerSideEncryptionConfiguration": [
            {
              "ServerSideEncryptionByDefault": {
                "SSEAlgorithm": "AES256",
              },
            },
          ],
        },
        "LifecycleConfiguration": {
          "Rules": [
            {
              "ExpirationInDays": 7,
              "Id": "expire-isr-cache",
              "Prefix": "next-isr-cache/",
              "Status": "Enabled",
            },
          ],
        },
        "PublicAccessBlockConfiguration": {
          "BlockPublicAcls": true,
          "BlockPublicPolicy": true,
          "IgnorePublicAcls": true,
          "RestrictPublicBuckets": true,
        },
      },
      "Type": "AWS::S3::Bucket",
      "UpdateReplacePolicy": "Retain",
    },
    "IsrCacheBucketPolicyF908ED16": {
      "Properties": {
        "Bucket": {
          "Ref": "IsrCacheBucket311880A1",
        },
        "PolicyDocument": {
          "Statement": [
            {
              "Action": "s3:*",
              "Condition": {
                "Bool": {
                  "aws:SecureTransport": "false",
                },
              },
              "Effect": "Deny",
              "Principal": {
                "AWS": "*",
              },
              "Resource": [
                {
                  "Fn::GetAtt": [
                    "IsrCacheBucket311880A1",
                    "Arn",
                  ],
                },
                {
                  "Fn::Join": [
                    "",
                    [
                      {
                        "Fn::GetAtt": [
                          "IsrCacheBucket311880A1",
                          "Arn",
                        ],
                      },
                      "/*",
                    ],
                  ],
                },
              ],
            },
          ],
          "Version": "2012-10-17",
        },
      },
      "Type": "AWS::S3::BucketPolicy",
    },
    "MigrationLogGroupFD140541": {
      "DeletionPolicy": "Retain",
      "Properties": {
        "LogGroupName": "/aws/ecs/sps-migrate-staging",
        "RetentionInDays": 30,
      },
      "Type": "AWS::Logs::LogGroup",
      "UpdateReplacePolicy": "Retain",
    },
    "MigrationTaskDefinitionE89B136E": {
      "Properties": {
        "ContainerDefinitions": [
          {
            "EntryPoint": [
              "npx",
              "prisma",
              "migrate",
              "deploy",
            ],
            "Essential": true,
            "Image": {
              "Fn::Join": [
                "",
                [
                  {
                    "Fn::Select": [
                      4,
                      {
                        "Fn::Split": [
                          ":",
                          {
                            "Fn::GetAtt": [
                              "EcrRepository4D7B3EE1",
                              "Arn",
                            ],
                          },
                        ],
                      },
                    ],
                  },
                  ".dkr.ecr.",
                  {
                    "Fn::Select": [
                      3,
                      {
                        "Fn::Split": [
                          ":",
                          {
                            "Fn::GetAtt": [
                              "EcrRepository4D7B3EE1",
                              "Arn",
                            ],
                          },
                        ],
                      },
                    ],
                  },
                  ".",
                  {
                    "Ref": "AWS::URLSuffix",
                  },
                  "/",
                  {
                    "Ref": "EcrRepository4D7B3EE1",
                  },
                  ":latest",
                ],
              ],
            },
            "LogConfiguration": {
              "LogDriver": "awslogs",
              "Options": {
                "awslogs-group": {
                  "Ref": "MigrationLogGroupFD140541",
                },
                "awslogs-region": "us-east-1",
                "awslogs-stream-prefix": "migrate",
              },
            },
            "Name": "migrate",
            "Secrets": [
              {
                "Name": "DATABASE_URL",
                "ValueFrom": {
                  "Fn::Join": [
                    "",
                    [
                      "arn:",
                      {
                        "Ref": "AWS::Partition",
                      },
                      ":secretsmanager:us-east-1:123456789012:secret:scholars/staging/db/migrate",
                    ],
                  ],
                },
              },
            ],
          },
        ],
        "Cpu": "512",
        "ExecutionRoleArn": {
          "Fn::GetAtt": [
            "DeployExecutionRoleBCBD9CEE",
            "Arn",
          ],
        },
        "Family": "sps-migrate-staging",
        "Memory": "1024",
        "NetworkMode": "awsvpc",
        "RequiresCompatibilities": [
          "FARGATE",
        ],
        "TaskRoleArn": {
          "Fn::GetAtt": [
            "TaskRole30FC0FBB",
            "Arn",
          ],
        },
      },
      "Type": "AWS::ECS::TaskDefinition",
    },
    "OriginVerifiedForwardC0422D52": {
      "Properties": {
        "Actions": [
          {
            "TargetGroupArn": {
              "Ref": "PublicAppTargetGroup68798009",
            },
            "Type": "forward",
          },
        ],
        "Conditions": [
          {
            "Field": "http-header",
            "HttpHeaderConfig": {
              "HttpHeaderName": "X-Origin-Verify",
              "Values": [
                "{{resolve:secretsmanager:scholars/staging/edge/origin-shared-secret:SecretString:::}}",
              ],
            },
          },
        ],
        "ListenerArn": {
          "Ref": "PublicAlbPublicHttpListener8CAA0E91",
        },
        "Priority": 1,
      },
      "Type": "AWS::ElasticLoadBalancingV2::ListenerRule",
    },
    "OriginVerifiedForwardHttpsBD6969E0": {
      "Properties": {
        "Actions": [
          {
            "TargetGroupArn": {
              "Ref": "PublicAppTargetGroup68798009",
            },
            "Type": "forward",
          },
        ],
        "Conditions": [
          {
            "Field": "http-header",
            "HttpHeaderConfig": {
              "HttpHeaderName": "X-Origin-Verify",
              "Values": [
                "{{resolve:secretsmanager:scholars/staging/edge/origin-shared-secret:SecretString:::}}",
              ],
            },
          },
        ],
        "ListenerArn": {
          "Ref": "PublicAlbPublicHttpsListener8840F702",
        },
        "Priority": 1,
      },
      "Type": "AWS::ElasticLoadBalancingV2::ListenerRule",
    },
    "OtelCollectorLogGroup0FD207F7": {
      "DeletionPolicy": "Retain",
      "Properties": {
        "LogGroupName": "/aws/ecs/sps-otel-staging",
        "RetentionInDays": 30,
      },
      "Type": "AWS::Logs::LogGroup",
      "UpdateReplacePolicy": "Retain",
    },
    "PublicAlb84330974": {
      "Properties": {
        "LoadBalancerAttributes": [
          {
            "Key": "deletion_protection.enabled",
            "Value": "false",
          },
        ],
        "Scheme": "internet-facing",
        "SecurityGroups": [
          "sg-0ab492e161a9e9976",
        ],
        "Subnets": [
          "subnet-09a6fab648280ca19",
          "subnet-0485fefe267b06736",
        ],
        "Type": "application",
      },
      "Type": "AWS::ElasticLoadBalancingV2::LoadBalancer",
    },
    "PublicAlbIngressFromInternet": {
      "Properties": {
        "CidrIp": "0.0.0.0/0",
        "Description": "Internet to SPS public ALB HTTP (staging) -- HTTPS lands with EdgeStack",
        "FromPort": 80,
        "GroupId": "sg-0ab492e161a9e9976",
        "IpProtocol": "tcp",
        "ToPort": 80,
      },
      "Type": "AWS::EC2::SecurityGroupIngress",
    },
    "PublicAlbIngressFromInternetHttps": {
      "Properties": {
        "CidrIp": "0.0.0.0/0",
        "Description": "Internet to SPS public ALB HTTPS (staging) -- #1507 origin TLS",
        "FromPort": 443,
        "GroupId": "sg-0ab492e161a9e9976",
        "IpProtocol": "tcp",
        "ToPort": 443,
      },
      "Type": "AWS::EC2::SecurityGroupIngress",
    },
    "PublicAlbPublicHttpListener8CAA0E91": {
      "Properties": {
        "DefaultActions": [
          {
            "FixedResponseConfig": {
              "ContentType": "text/plain",
              "MessageBody": "Forbidden",
              "StatusCode": "403",
            },
            "Type": "fixed-response",
          },
        ],
        "LoadBalancerArn": {
          "Ref": "PublicAlb84330974",
        },
        "Port": 80,
        "Protocol": "HTTP",
      },
      "Type": "AWS::ElasticLoadBalancingV2::Listener",
    },
    "PublicAlbPublicHttpsListener8840F702": {
      "Properties": {
        "Certificates": [
          {
            "CertificateArn": "arn:aws:acm:us-east-1:665083158573:certificate/f50f0b04-dc62-4d8e-97b8-2761d1efdd0f",
          },
        ],
        "DefaultActions": [
          {
            "FixedResponseConfig": {
              "ContentType": "text/plain",
              "MessageBody": "Forbidden",
              "StatusCode": "403",
            },
            "Type": "fixed-response",
          },
        ],
        "LoadBalancerArn": {
          "Ref": "PublicAlb84330974",
        },
        "Port": 443,
        "Protocol": "HTTPS",
        "SslPolicy": "ELBSecurityPolicy-TLS13-1-2-Res-PQ-2025-09",
      },
      "Type": "AWS::ElasticLoadBalancingV2::Listener",
    },
    "PublicAppTargetGroup68798009": {
      "Properties": {
        "HealthCheckIntervalSeconds": 30,
        "HealthCheckPath": "/api/health",
        "HealthCheckTimeoutSeconds": 5,
        "HealthyThresholdCount": 2,
        "Port": 3000,
        "Protocol": "HTTP",
        "TargetGroupAttributes": [
          {
            "Key": "deregistration_delay.timeout_seconds",
            "Value": "30",
          },
          {
            "Key": "stickiness.enabled",
            "Value": "false",
          },
        ],
        "TargetType": "ip",
        "UnhealthyThresholdCount": 3,
        "VpcId": "vpc-08a1873fc8eebae28",
      },
      "Type": "AWS::ElasticLoadBalancingV2::TargetGroup",
    },
    "SearchEvalCanaryExecutionRole464F1E01": {
      "Properties": {
        "AssumeRolePolicyDocument": {
          "Statement": [
            {
              "Action": "sts:AssumeRole",
              "Effect": "Allow",
              "Principal": {
                "Service": "ecs-tasks.amazonaws.com",
              },
            },
          ],
          "Version": "2012-10-17",
        },
        "Description": "SPS search-eval canary task-execution role (staging). Reads only the origin-verify shared secret -- no DB DSNs (#1444).",
        "RoleName": "sps-search-eval-canary-exec-staging",
      },
      "Type": "AWS::IAM::Role",
    },
    "SearchEvalCanaryExecutionRoleDefaultPolicyFC978439": {
      "Properties": {
        "PolicyDocument": {
          "Statement": [
            {
              "Action": "ecr:GetAuthorizationToken",
              "Effect": "Allow",
              "Resource": "*",
            },
            {
              "Action": [
                "ecr:BatchCheckLayerAvailability",
                "ecr:GetDownloadUrlForLayer",
                "ecr:BatchGetImage",
              ],
              "Effect": "Allow",
              "Resource": {
                "Fn::GetAtt": [
                  "EtlEcrRepository058F5EEC",
                  "Arn",
                ],
              },
            },
            {
              "Action": "secretsmanager:GetSecretValue",
              "Effect": "Allow",
              "Resource": {
                "Fn::Join": [
                  "",
                  [
                    "arn:",
                    {
                      "Ref": "AWS::Partition",
                    },
                    ":secretsmanager:us-east-1:123456789012:secret:scholars/staging/edge/origin-shared-secret",
                  ],
                ],
              },
            },
            {
              "Action": [
                "logs:CreateLogStream",
                "logs:PutLogEvents",
              ],
              "Effect": "Allow",
              "Resource": [
                {
                  "Fn::GetAtt": [
                    "SearchEvalCanaryLogGroup434F45BC",
                    "Arn",
                  ],
                },
                {
                  "Fn::Join": [
                    "",
                    [
                      {
                        "Fn::GetAtt": [
                          "SearchEvalCanaryLogGroup434F45BC",
                          "Arn",
                        ],
                      },
                      ":*",
                    ],
                  ],
                },
              ],
            },
            {
              "Action": [
                "logs:CreateLogStream",
                "logs:PutLogEvents",
              ],
              "Effect": "Allow",
              "Resource": {
                "Fn::GetAtt": [
                  "SearchEvalCanaryLogGroup434F45BC",
                  "Arn",
                ],
              },
            },
            {
              "Action": [
                "secretsmanager:GetSecretValue",
                "secretsmanager:DescribeSecret",
              ],
              "Effect": "Allow",
              "Resource": {
                "Fn::Join": [
                  "",
                  [
                    "arn:",
                    {
                      "Ref": "AWS::Partition",
                    },
                    ":secretsmanager:us-east-1:123456789012:secret:scholars/staging/edge/origin-shared-secret-??????",
                  ],
                ],
              },
            },
          ],
          "Version": "2012-10-17",
        },
        "PolicyName": "SearchEvalCanaryExecutionRoleDefaultPolicyFC978439",
        "Roles": [
          {
            "Ref": "SearchEvalCanaryExecutionRole464F1E01",
          },
        ],
      },
      "Type": "AWS::IAM::Policy",
    },
    "SearchEvalCanaryLogGroup434F45BC": {
      "DeletionPolicy": "Retain",
      "Properties": {
        "LogGroupName": "/aws/ecs/sps-search-eval-canary-staging",
        "RetentionInDays": 30,
      },
      "Type": "AWS::Logs::LogGroup",
      "UpdateReplacePolicy": "Retain",
    },
    "SearchEvalCanaryTaskDefinitionEA26D4B7": {
      "Properties": {
        "ContainerDefinitions": [
          {
            "EntryPoint": [
              "npx",
              "tsx",
              "scripts/search-eval/canary.ts",
            ],
            "Environment": [
              {
                "Name": "CANARY_HOST",
                "Value": {
                  "Fn::Join": [
                    "",
                    [
                      "http://",
                      {
                        "Fn::GetAtt": [
                          "PublicAlb84330974",
                          "DNSName",
                        ],
                      },
                    ],
                  ],
                },
              },
            ],
            "Essential": true,
            "Image": {
              "Fn::Join": [
                "",
                [
                  {
                    "Fn::Select": [
                      4,
                      {
                        "Fn::Split": [
                          ":",
                          {
                            "Fn::GetAtt": [
                              "EtlEcrRepository058F5EEC",
                              "Arn",
                            ],
                          },
                        ],
                      },
                    ],
                  },
                  ".dkr.ecr.",
                  {
                    "Fn::Select": [
                      3,
                      {
                        "Fn::Split": [
                          ":",
                          {
                            "Fn::GetAtt": [
                              "EtlEcrRepository058F5EEC",
                              "Arn",
                            ],
                          },
                        ],
                      },
                    ],
                  },
                  ".",
                  {
                    "Ref": "AWS::URLSuffix",
                  },
                  "/",
                  {
                    "Ref": "EtlEcrRepository058F5EEC",
                  },
                  ":latest",
                ],
              ],
            },
            "LogConfiguration": {
              "LogDriver": "awslogs",
              "Options": {
                "awslogs-group": {
                  "Ref": "SearchEvalCanaryLogGroup434F45BC",
                },
                "awslogs-region": "us-east-1",
                "awslogs-stream-prefix": "search-eval-canary",
              },
            },
            "Name": "search-eval-canary",
            "Secrets": [
              {
                "Name": "CANARY_ORIGIN_VERIFY",
                "ValueFrom": {
                  "Fn::Join": [
                    "",
                    [
                      "arn:",
                      {
                        "Ref": "AWS::Partition",
                      },
                      ":secretsmanager:us-east-1:123456789012:secret:scholars/staging/edge/origin-shared-secret",
                    ],
                  ],
                },
              },
            ],
          },
        ],
        "Cpu": "512",
        "ExecutionRoleArn": {
          "Fn::GetAtt": [
            "SearchEvalCanaryExecutionRole464F1E01",
            "Arn",
          ],
        },
        "Family": "sps-search-eval-canary-staging",
        "Memory": "1024",
        "NetworkMode": "awsvpc",
        "RequiresCompatibilities": [
          "FARGATE",
        ],
        "TaskRoleArn": {
          "Fn::GetAtt": [
            "SearchEvalCanaryTaskDefinitionTaskRoleE68C849D",
            "Arn",
          ],
        },
      },
      "Type": "AWS::ECS::TaskDefinition",
    },
    "SearchEvalCanaryTaskDefinitionTaskRoleE68C849D": {
      "Properties": {
        "AssumeRolePolicyDocument": {
          "Statement": [
            {
              "Action": "sts:AssumeRole",
              "Effect": "Allow",
              "Principal": {
                "Service": "ecs-tasks.amazonaws.com",
              },
            },
          ],
          "Version": "2012-10-17",
        },
      },
      "Type": "AWS::IAM::Role",
    },
    "TaskExecutionRole250D2532": {
      "Properties": {
        "AssumeRolePolicyDocument": {
          "Statement": [
            {
              "Action": "sts:AssumeRole",
              "Effect": "Allow",
              "Principal": {
                "Service": "ecs-tasks.amazonaws.com",
              },
            },
          ],
          "Version": "2012-10-17",
        },
        "Description": "SPS ECS task-execution role (staging). Pulls images, injects secrets, writes logs.",
        "RoleName": "sps-task-exec-staging",
      },
      "Type": "AWS::IAM::Role",
    },
    "TaskExecutionRoleDefaultPolicyA84DD1B0": {
      "Properties": {
        "PolicyDocument": {
          "Statement": [
            {
              "Action": "ecr:GetAuthorizationToken",
              "Effect": "Allow",
              "Resource": "*",
            },
            {
              "Action": [
                "ecr:BatchCheckLayerAvailability",
                "ecr:GetDownloadUrlForLayer",
                "ecr:BatchGetImage",
              ],
              "Effect": "Allow",
              "Resource": {
                "Fn::GetAtt": [
                  "EcrRepository4D7B3EE1",
                  "Arn",
                ],
              },
            },
            {
              "Action": "secretsmanager:GetSecretValue",
              "Effect": "Allow",
              "Resource": [
                {
                  "Fn::Join": [
                    "",
                    [
                      "arn:",
                      {
                        "Ref": "AWS::Partition",
                      },
                      ":secretsmanager:us-east-1:123456789012:secret:scholars/staging/db/app-rw",
                    ],
                  ],
                },
                {
                  "Fn::Join": [
                    "",
                    [
                      "arn:",
                      {
                        "Ref": "AWS::Partition",
                      },
                      ":secretsmanager:us-east-1:123456789012:secret:scholars/staging/db/app-ro",
                    ],
                  ],
                },
                {
                  "Fn::Join": [
                    "",
                    [
                      "arn:",
                      {
                        "Ref": "AWS::Partition",
                      },
                      ":secretsmanager:us-east-1:123456789012:secret:scholars/staging/opensearch/app",
                    ],
                  ],
                },
                {
                  "Fn::Join": [
                    "",
                    [
                      "arn:",
                      {
                        "Ref": "AWS::Partition",
                      },
                      ":secretsmanager:us-east-1:123456789012:secret:scholars/staging/revalidate-token",
                    ],
                  ],
                },
                {
                  "Fn::Join": [
                    "",
                    [
                      "arn:",
                      {
                        "Ref": "AWS::Partition",
                      },
                      ":secretsmanager:us-east-1:123456789012:secret:scholars/saml-sp/staging/private-key",
                    ],
                  ],
                },
                {
                  "Fn::Join": [
                    "",
                    [
                      "arn:",
                      {
                        "Ref": "AWS::Partition",
                      },
                      ":secretsmanager:us-east-1:123456789012:secret:scholars/staging/etl/reciter",
                    ],
                  ],
                },
                {
                  "Fn::Join": [
                    "",
                    [
                      "arn:",
                      {
                        "Ref": "AWS::Partition",
                      },
                      ":secretsmanager:us-east-1:123456789012:secret:scholars/staging/saml/idp-cert",
                    ],
                  ],
                },
                {
                  "Fn::Join": [
                    "",
                    [
                      "arn:",
                      {
                        "Ref": "AWS::Partition",
                      },
                      ":secretsmanager:us-east-1:123456789012:secret:scholars/saml-sp/staging/cert",
                    ],
                  ],
                },
                {
                  "Fn::Join": [
                    "",
                    [
                      "arn:",
                      {
                        "Ref": "AWS::Partition",
                      },
                      ":secretsmanager:us-east-1:123456789012:secret:scholars/staging/session-cookie-key",
                    ],
                  ],
                },
                {
                  "Fn::Join": [
                    "",
                    [
                      "arn:",
                      {
                        "Ref": "AWS::Partition",
                      },
                      ":secretsmanager:us-east-1:123456789012:secret:scholars/staging/newrelic-license-key",
                    ],
                  ],
                },
                {
                  "Fn::Join": [
                    "",
                    [
                      "arn:",
                      {
                        "Ref": "AWS::Partition",
                      },
                      ":secretsmanager:us-east-1:123456789012:secret:scholars/staging/etl/ed",
                    ],
                  ],
                },
              ],
            },
            {
              "Action": [
                "logs:CreateLogStream",
                "logs:PutLogEvents",
              ],
              "Effect": "Allow",
              "Resource": [
                {
                  "Fn::GetAtt": [
                    "AppLogGroup7D8CD952",
                    "Arn",
                  ],
                },
                {
                  "Fn::Join": [
                    "",
                    [
                      {
                        "Fn::GetAtt": [
                          "AppLogGroup7D8CD952",
                          "Arn",
                        ],
                      },
                      ":*",
                    ],
                  ],
                },
                {
                  "Fn::GetAtt": [
                    "OtelCollectorLogGroup0FD207F7",
                    "Arn",
                  ],
                },
                {
                  "Fn::Join": [
                    "",
                    [
                      {
                        "Fn::GetAtt": [
                          "OtelCollectorLogGroup0FD207F7",
                          "Arn",
                        ],
                      },
                      ":*",
                    ],
                  ],
                },
              ],
            },
            {
              "Action": [
                "logs:CreateLogStream",
                "logs:PutLogEvents",
              ],
              "Effect": "Allow",
              "Resource": {
                "Fn::GetAtt": [
                  "AppLogGroup7D8CD952",
                  "Arn",
                ],
              },
            },
            {
              "Action": [
                "secretsmanager:GetSecretValue",
                "secretsmanager:DescribeSecret",
              ],
              "Effect": "Allow",
              "Resource": {
                "Fn::Join": [
                  "",
                  [
                    "arn:",
                    {
                      "Ref": "AWS::Partition",
                    },
                    ":secretsmanager:us-east-1:123456789012:secret:scholars/staging/db/app-rw-??????",
                  ],
                ],
              },
            },
            {
              "Action": [
                "secretsmanager:GetSecretValue",
                "secretsmanager:DescribeSecret",
              ],
              "Effect": "Allow",
              "Resource": {
                "Fn::Join": [
                  "",
                  [
                    "arn:",
                    {
                      "Ref": "AWS::Partition",
                    },
                    ":secretsmanager:us-east-1:123456789012:secret:scholars/staging/db/app-ro-??????",
                  ],
                ],
              },
            },
            {
              "Action": [
                "secretsmanager:GetSecretValue",
                "secretsmanager:DescribeSecret",
              ],
              "Effect": "Allow",
              "Resource": {
                "Fn::Join": [
                  "",
                  [
                    "arn:",
                    {
                      "Ref": "AWS::Partition",
                    },
                    ":secretsmanager:us-east-1:123456789012:secret:scholars/staging/opensearch/app-??????",
                  ],
                ],
              },
            },
            {
              "Action": [
                "secretsmanager:GetSecretValue",
                "secretsmanager:DescribeSecret",
              ],
              "Effect": "Allow",
              "Resource": {
                "Fn::Join": [
                  "",
                  [
                    "arn:",
                    {
                      "Ref": "AWS::Partition",
                    },
                    ":secretsmanager:us-east-1:123456789012:secret:scholars/staging/revalidate-token-??????",
                  ],
                ],
              },
            },
            {
              "Action": [
                "secretsmanager:GetSecretValue",
                "secretsmanager:DescribeSecret",
              ],
              "Effect": "Allow",
              "Resource": {
                "Fn::Join": [
                  "",
                  [
                    "arn:",
                    {
                      "Ref": "AWS::Partition",
                    },
                    ":secretsmanager:us-east-1:123456789012:secret:scholars/staging/faculty-review-token-??????",
                  ],
                ],
              },
            },
            {
              "Action": [
                "secretsmanager:GetSecretValue",
                "secretsmanager:DescribeSecret",
              ],
              "Effect": "Allow",
              "Resource": {
                "Fn::Join": [
                  "",
                  [
                    "arn:",
                    {
                      "Ref": "AWS::Partition",
                    },
                    ":secretsmanager:us-east-1:123456789012:secret:scholars/staging/research-informatics-token-??????",
                  ],
                ],
              },
            },
            {
              "Action": [
                "secretsmanager:GetSecretValue",
                "secretsmanager:DescribeSecret",
              ],
              "Effect": "Allow",
              "Resource": {
                "Fn::Join": [
                  "",
                  [
                    "arn:",
                    {
                      "Ref": "AWS::Partition",
                    },
                    ":secretsmanager:us-east-1:123456789012:secret:scholars/staging/session-cookie-key-??????",
                  ],
                ],
              },
            },
            {
              "Action": [
                "secretsmanager:GetSecretValue",
                "secretsmanager:DescribeSecret",
              ],
              "Effect": "Allow",
              "Resource": {
                "Fn::Join": [
                  "",
                  [
                    "arn:",
                    {
                      "Ref": "AWS::Partition",
                    },
                    ":secretsmanager:us-east-1:123456789012:secret:scholars/saml-sp/staging/private-key-??????",
                  ],
                ],
              },
            },
            {
              "Action": [
                "secretsmanager:GetSecretValue",
                "secretsmanager:DescribeSecret",
              ],
              "Effect": "Allow",
              "Resource": {
                "Fn::Join": [
                  "",
                  [
                    "arn:",
                    {
                      "Ref": "AWS::Partition",
                    },
                    ":secretsmanager:us-east-1:123456789012:secret:scholars/staging/saml/idp-cert-??????",
                  ],
                ],
              },
            },
            {
              "Action": [
                "secretsmanager:GetSecretValue",
                "secretsmanager:DescribeSecret",
              ],
              "Effect": "Allow",
              "Resource": {
                "Fn::Join": [
                  "",
                  [
                    "arn:",
                    {
                      "Ref": "AWS::Partition",
                    },
                    ":secretsmanager:us-east-1:123456789012:secret:scholars/saml-sp/staging/cert-??????",
                  ],
                ],
              },
            },
            {
              "Action": [
                "secretsmanager:GetSecretValue",
                "secretsmanager:DescribeSecret",
              ],
              "Effect": "Allow",
              "Resource": {
                "Fn::Join": [
                  "",
                  [
                    "arn:",
                    {
                      "Ref": "AWS::Partition",
                    },
                    ":secretsmanager:us-east-1:123456789012:secret:scholars/staging/etl/reciter-??????",
                  ],
                ],
              },
            },
            {
              "Action": [
                "secretsmanager:GetSecretValue",
                "secretsmanager:DescribeSecret",
              ],
              "Effect": "Allow",
              "Resource": {
                "Fn::Join": [
                  "",
                  [
                    "arn:",
                    {
                      "Ref": "AWS::Partition",
                    },
                    ":secretsmanager:us-east-1:123456789012:secret:scholars/staging/etl/ed-??????",
                  ],
                ],
              },
            },
            {
              "Action": [
                "logs:CreateLogStream",
                "logs:PutLogEvents",
              ],
              "Effect": "Allow",
              "Resource": {
                "Fn::GetAtt": [
                  "OtelCollectorLogGroup0FD207F7",
                  "Arn",
                ],
              },
            },
            {
              "Action": [
                "secretsmanager:GetSecretValue",
                "secretsmanager:DescribeSecret",
              ],
              "Effect": "Allow",
              "Resource": {
                "Fn::Join": [
                  "",
                  [
                    "arn:",
                    {
                      "Ref": "AWS::Partition",
                    },
                    ":secretsmanager:us-east-1:123456789012:secret:scholars/staging/newrelic-license-key-??????",
                  ],
                ],
              },
            },
          ],
          "Version": "2012-10-17",
        },
        "PolicyName": "TaskExecutionRoleDefaultPolicyA84DD1B0",
        "Roles": [
          {
            "Ref": "TaskExecutionRole250D2532",
          },
        ],
      },
      "Type": "AWS::IAM::Policy",
    },
    "TaskRole30FC0FBB": {
      "Properties": {
        "AssumeRolePolicyDocument": {
          "Statement": [
            {
              "Action": "sts:AssumeRole",
              "Effect": "Allow",
              "Principal": {
                "Service": "ecs-tasks.amazonaws.com",
              },
            },
          ],
          "Version": "2012-10-17",
        },
        "Description": "SPS ECS task role (staging). Application runtime identity; X-Ray write only.",
        "RoleName": "sps-task-staging",
      },
      "Type": "AWS::IAM::Role",
    },
    "TaskRoleBedrockPolicy3D08BCA9": {
      "Properties": {
        "PolicyDocument": {
          "Statement": [
            {
              "Action": "bedrock:InvokeModel",
              "Effect": "Allow",
              "Resource": [
                "arn:aws:bedrock:*:123456789012:inference-profile/us.anthropic.claude-opus-4-8*",
                "arn:aws:bedrock:*::foundation-model/anthropic.claude-opus-4-8*",
                "arn:aws:bedrock:*:123456789012:inference-profile/us.anthropic.claude-sonnet-4-*",
                "arn:aws:bedrock:*::foundation-model/anthropic.claude-sonnet-4-*",
              ],
            },
          ],
          "Version": "2012-10-17",
        },
        "PolicyName": "sps-task-staging-bedrock",
        "Roles": [
          {
            "Ref": "TaskRole30FC0FBB",
          },
        ],
      },
      "Type": "AWS::IAM::Policy",
    },
    "TaskRoleCloudFrontPolicy1C86BE7A": {
      "Properties": {
        "PolicyDocument": {
          "Statement": [
            {
              "Action": "cloudfront:CreateInvalidation",
              "Effect": "Allow",
              "Resource": "arn:aws:cloudfront::123456789012:distribution/*",
            },
          ],
          "Version": "2012-10-17",
        },
        "PolicyName": "sps-task-staging-cloudfront",
        "Roles": [
          {
            "Ref": "TaskRole30FC0FBB",
          },
        ],
      },
      "Type": "AWS::IAM::Policy",
    },
    "TaskRoleCoreClaimWritebackPolicyE86AA84B": {
      "Properties": {
        "PolicyDocument": {
          "Statement": [
            {
              "Action": "dynamodb:UpdateItem",
              "Effect": "Allow",
              "Resource": "arn:aws:dynamodb:us-east-1:123456789012:table/reciterai",
            },
          ],
          "Version": "2012-10-17",
        },
        "PolicyName": "sps-task-staging-reciterai-writeback",
        "Roles": [
          {
            "Ref": "TaskRole30FC0FBB",
          },
        ],
      },
      "Type": "AWS::IAM::Policy",
    },
    "TaskRoleDefaultPolicy07FC53DE": {
      "Properties": {
        "PolicyDocument": {
          "Statement": [
            {
              "Action": [
                "s3:GetObject*",
                "s3:GetBucket*",
                "s3:List*",
                "s3:DeleteObject*",
                "s3:PutObject",
                "s3:PutObjectLegalHold",
                "s3:PutObjectRetention",
                "s3:PutObjectTagging",
                "s3:PutObjectVersionTagging",
                "s3:Abort*",
              ],
              "Effect": "Allow",
              "Resource": [
                {
                  "Fn::GetAtt": [
                    "IsrCacheBucket311880A1",
                    "Arn",
                  ],
                },
                {
                  "Fn::Join": [
                    "",
                    [
                      {
                        "Fn::GetAtt": [
                          "IsrCacheBucket311880A1",
                          "Arn",
                        ],
                      },
                      "/next-isr-cache/*",
                    ],
                  ],
                },
              ],
            },
          ],
          "Version": "2012-10-17",
        },
        "PolicyName": "TaskRoleDefaultPolicy07FC53DE",
        "Roles": [
          {
            "Ref": "TaskRole30FC0FBB",
          },
        ],
      },
      "Type": "AWS::IAM::Policy",
    },
    "TaskRoleOpportunitySubmissionPolicy51C9A514": {
      "Properties": {
        "PolicyDocument": {
          "Statement": [
            {
              "Action": [
                "dynamodb:PutItem",
                "dynamodb:Query",
                "dynamodb:DeleteItem",
                "dynamodb:UpdateItem",
              ],
              "Condition": {
                "ForAllValues:StringEquals": {
                  "dynamodb:LeadingKeys": [
                    "SUBMISSION",
                  ],
                },
              },
              "Effect": "Allow",
              "Resource": "arn:aws:dynamodb:us-east-1:123456789012:table/reciterai",
            },
          ],
          "Version": "2012-10-17",
        },
        "PolicyName": "sps-task-staging-opportunity-submission",
        "Roles": [
          {
            "Ref": "TaskRole30FC0FBB",
          },
        ],
      },
      "Type": "AWS::IAM::Policy",
    },
    "TaskRoleReciterReadPolicyE018B6D7": {
      "Properties": {
        "PolicyDocument": {
          "Statement": [
            {
              "Action": "dynamodb:GetItem",
              "Effect": "Allow",
              "Resource": [
                "arn:aws:dynamodb:us-east-1:665083158573:table/Analysis",
                "arn:aws:dynamodb:us-east-1:665083158573:table/GoldStandard",
              ],
            },
            {
              "Action": "s3:GetObject",
              "Effect": "Allow",
              "Resource": "arn:aws:s3:::reciter-dynamodb/AnalysisOutput/*",
            },
            {
              "Action": "kms:Decrypt",
              "Effect": "Allow",
              "Resource": "arn:aws:kms:us-east-1:665083158573:key/6b9d182c-8abc-48a0-ac90-7c47b55c829a",
            },
          ],
          "Version": "2012-10-17",
        },
        "PolicyName": "sps-task-staging-reciter-read",
        "Roles": [
          {
            "Ref": "TaskRole30FC0FBB",
          },
        ],
      },
      "Type": "AWS::IAM::Policy",
    },
    "TaskRoleSesPolicy94AACEAC": {
      "Properties": {
        "PolicyDocument": {
          "Statement": [
            {
              "Action": "ses:SendEmail",
              "Condition": {
                "StringEquals": {
                  "ses:FromAddress": "no-reply-scholars@weill.cornell.edu",
                },
              },
              "Effect": "Allow",
              "Resource": "arn:aws:ses:us-east-1:123456789012:identity/*",
            },
          ],
          "Version": "2012-10-17",
        },
        "PolicyName": "sps-task-staging-ses",
        "Roles": [
          {
            "Ref": "TaskRole30FC0FBB",
          },
        ],
      },
      "Type": "AWS::IAM::Policy",
    },
    "TaskRoleXrayPolicyBA24E3D0": {
      "Properties": {
        "PolicyDocument": {
          "Statement": [
            {
              "Action": "xray:PutTraceSegments",
              "Effect": "Allow",
              "Resource": "*",
            },
            {
              "Action": "xray:PutTelemetryRecords",
              "Effect": "Allow",
              "Resource": "*",
            },
          ],
          "Version": "2012-10-17",
        },
        "PolicyName": "sps-task-staging-xray",
        "Roles": [
          {
            "Ref": "TaskRole30FC0FBB",
          },
        ],
      },
      "Type": "AWS::IAM::Policy",
    },
    "VerifyGrantsLogGroupD90AC2C4": {
      "DeletionPolicy": "Retain",
      "Properties": {
        "LogGroupName": "/aws/ecs/sps-verify-grants-staging",
        "RetentionInDays": 30,
      },
      "Type": "AWS::Logs::LogGroup",
      "UpdateReplacePolicy": "Retain",
    },
    "VerifyGrantsTaskDefinition82FF6836": {
      "Properties": {
        "ContainerDefinitions": [
          {
            "EntryPoint": [
              "npx",
              "tsx",
              "scripts/verify-db-grants.ts",
            ],
            "Environment": [
              {
                "Name": "VERIFY_ROLES",
                "Value": "app-ro,app-rw,sps_migrate,sps_bootstrap",
              },
            ],
            "Essential": true,
            "Image": {
              "Fn::Join": [
                "",
                [
                  {
                    "Fn::Select": [
                      4,
                      {
                        "Fn::Split": [
                          ":",
                          {
                            "Fn::GetAtt": [
                              "EtlEcrRepository058F5EEC",
                              "Arn",
                            ],
                          },
                        ],
                      },
                    ],
                  },
                  ".dkr.ecr.",
                  {
                    "Fn::Select": [
                      3,
                      {
                        "Fn::Split": [
                          ":",
                          {
                            "Fn::GetAtt": [
                              "EtlEcrRepository058F5EEC",
                              "Arn",
                            ],
                          },
                        ],
                      },
                    ],
                  },
                  ".",
                  {
                    "Ref": "AWS::URLSuffix",
                  },
                  "/",
                  {
                    "Ref": "EtlEcrRepository058F5EEC",
                  },
                  ":latest",
                ],
              ],
            },
            "LogConfiguration": {
              "LogDriver": "awslogs",
              "Options": {
                "awslogs-group": {
                  "Ref": "VerifyGrantsLogGroupD90AC2C4",
                },
                "awslogs-region": "us-east-1",
                "awslogs-stream-prefix": "verify-grants",
              },
            },
            "Name": "verify-grants",
            "Secrets": [
              {
                "Name": "APP_RO_DSN",
                "ValueFrom": {
                  "Fn::Join": [
                    "",
                    [
                      "arn:",
                      {
                        "Ref": "AWS::Partition",
                      },
                      ":secretsmanager:us-east-1:123456789012:secret:scholars/staging/db/app-ro",
                    ],
                  ],
                },
              },
              {
                "Name": "APP_RW_DSN",
                "ValueFrom": {
                  "Fn::Join": [
                    "",
                    [
                      "arn:",
                      {
                        "Ref": "AWS::Partition",
                      },
                      ":secretsmanager:us-east-1:123456789012:secret:scholars/staging/db/app-rw",
                    ],
                  ],
                },
              },
              {
                "Name": "BOOTSTRAP_DSN",
                "ValueFrom": {
                  "Fn::Join": [
                    "",
                    [
                      "arn:",
                      {
                        "Ref": "AWS::Partition",
                      },
                      ":secretsmanager:us-east-1:123456789012:secret:scholars/staging/db/bootstrap",
                    ],
                  ],
                },
              },
              {
                "Name": "MIGRATE_DSN",
                "ValueFrom": {
                  "Fn::Join": [
                    "",
                    [
                      "arn:",
                      {
                        "Ref": "AWS::Partition",
                      },
                      ":secretsmanager:us-east-1:123456789012:secret:scholars/staging/db/migrate",
                    ],
                  ],
                },
              },
            ],
          },
        ],
        "Cpu": "512",
        "ExecutionRoleArn": {
          "Fn::GetAtt": [
            "DeployExecutionRoleBCBD9CEE",
            "Arn",
          ],
        },
        "Family": "sps-verify-grants-staging",
        "Memory": "1024",
        "NetworkMode": "awsvpc",
        "RequiresCompatibilities": [
          "FARGATE",
        ],
        "TaskRoleArn": {
          "Fn::GetAtt": [
            "TaskRole30FC0FBB",
            "Arn",
          ],
        },
      },
      "Type": "AWS::ECS::TaskDefinition",
    },
  },
  "Rules": {
    "CheckBootstrapVersion": {
      "Assertions": [
        {
          "Assert": {
            "Fn::Not": [
              {
                "Fn::Contains": [
                  [
                    "1",
                    "2",
                    "3",
                    "4",
                    "5",
                  ],
                  {
                    "Ref": "BootstrapVersion",
                  },
                ],
              },
            ],
          },
          "AssertDescription": "CDK bootstrap stack version 6 required. Please run 'cdk bootstrap' with a recent version of the CDK CLI.",
        },
      ],
    },
  },
}
`;