01-rc-vpc.yaml

# Copyright 2018 Amazon.com, Inc. or its affiliates. All Rights Reserved.
#
# Licensed under the Apache License, Version 2.0 (the "License"). You may not use this file except in compliance with the License. 
# A copy of the License is located at
#    http://aws.amazon.com/apache2.0/
# or in the "license" file accompanying this file. This file is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, 
# either express or implied. See the License for the specific language governing permissions and limitations under the License.

AWSTemplateFormatVersion: '2010-09-09'
Description: This CloudFormation Template creates the VPC, subnets, routing, NAT Gateways, security groups and IAM Roles to support REDCap.

Parameters:
  AccessCidr:
    AllowedPattern: ^(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])(\/([0-9]|[1-2][0-9]|3[0-2]))$
    Description: The CIDR IP range that is permitted to SSH to bastion instance. Note - a value of 0.0.0.0/0 will allow access from ANY IP address.
    Type: String
    Default: 0.0.0.0/0
  RedcapS3Bucket:
    Description: "S3 bucket that contains your REDCap binary file"
    Type: String
    Default: redcap-test
  UseACMBoolean:
    AllowedValues:
      - true
      - false
    Default: true
    Description: Specifies whether an SSL certificate should be generated for your domain name using AWS Certificate Manager (ACM).  If one is not generated, HTTP will be used and an SSL certificate can be applied after deployment.
    Type: String
  UseRoute53Boolean:
    AllowedValues:
      - true
      - false
    Default: true
    Description: Specifies whether a record set should be created in Route 53 for your REDCap domain name.  If not, you will recieve a default Elastic Beanstalk DNS name (e.g. redcap.us-east-1.elasticbeanstalk.com).
    Type: String

  VPCcidr:
    Description: (optional to change) CIDR IP Range for your REDCap VPC.
    AllowedPattern: ^(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])(\/([0-9]|[1-2][0-9]|3[0-2]))$
    Type: String
    Default: 10.1.0.0/16
  p1cidr:
    Description: (optional to change) CIDR IP Range for the public subnet in AZ 'a' of your REDCap VPC.
    AllowedPattern: ^(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])(\/([0-9]|[1-2][0-9]|3[0-2]))$
    Type: String
    Default: 10.1.0.0/24
  p2cidr:
    Description: (optional to change) CIDR IP Range for the public subnet in AZ 'b' of your REDCap VPC.
    AllowedPattern: ^(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])(\/([0-9]|[1-2][0-9]|3[0-2]))$
    Type: String
    Default: 10.1.1.0/24
  a1cidr:
    Description: (optional to change) CIDR IP Range for the application subnet in AZ 'a' of your REDCap VPC.
    AllowedPattern: ^(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])(\/([0-9]|[1-2][0-9]|3[0-2]))$
    Type: String
    Default: 10.1.2.0/24
  a2cidr:
    Description: (optional to change) CIDR IP Range for the application subnet in AZ 'b' of your REDCap VPC.
    AllowedPattern: ^(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])(\/([0-9]|[1-2][0-9]|3[0-2]))$
    Type: String
    Default: 10.1.3.0/24
  d1cidr:
    Description: (optional to change) CIDR IP Range for the database subnet in AZ 'b' of your REDCap VPC.
    AllowedPattern: ^(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])(\/([0-9]|[1-2][0-9]|3[0-2]))$
    Type: String
    Default: 10.1.4.0/24
  d2cidr:
    Description: (optional to change) CIDR IP Range for the database subnet in AZ 'b' of your REDCap VPC.
    AllowedPattern: ^(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])(\/([0-9]|[1-2][0-9]|3[0-2]))$
    Type: String
    Default: 10.1.5.0/24





Conditions:    
  DeployRoute53: 
    !Equals [ true, !Ref UseRoute53Boolean ]
  DeployACM: !And 
    - !Equals [ true, !Ref UseACMBoolean ]
    - !Condition DeployRoute53
  NoDeployACM: !Or
    - !Equals [ false, !Ref UseACMBoolean ]
    - !Equals [ false, !Ref UseRoute53Boolean ]

Resources:
  vpc27bc775f:
    Type: AWS::EC2::VPC
    Properties:
      CidrBlock: !Ref VPCcidr
      InstanceTenancy: default
      EnableDnsSupport: 'true'
      EnableDnsHostnames: 'false'
      Tags:
        - Key: Name
          Value: Project REDCap VPC


#Defines Internet Connectivity
  igw8d9149f4:
    Type: AWS::EC2::InternetGateway
    Properties:
      Tags:
        - Key: Name
          Value: PHP IGW
  gw1:
    Type: AWS::EC2::VPCGatewayAttachment
    Properties:
      VpcId: !Ref 'vpc27bc775f'
      InternetGatewayId: !Ref 'igw8d9149f4'



#Defines NAT Gateway so that the Elastic Beanstalk servers and the temporary EC2 server can talk to the Internet
  NAT:
    DependsOn: gw1
    Type: AWS::EC2::NatGateway
    Properties:
      AllocationId: !GetAtt 'EIP.AllocationId'
      SubnetId: !Ref 'subnetd3e13a98'
  EIP:
    Type: AWS::EC2::EIP
    Properties:
      Domain: vpc




  #Defines two availability zones of subnets for the three tier network architecture
  subnet3d504d67:
    Type: AWS::EC2::Subnet
    Properties:
      CidrBlock: !Ref d2cidr
      AvailabilityZone: !Join [ "", [ !Ref 'AWS::Region', "b" ] ]
      VpcId: !Ref 'vpc27bc775f'
      Tags:
        - Key: Name
          Value: Data B
  subnet864d50dc:
    Type: AWS::EC2::Subnet
    Properties:
      CidrBlock: !Ref a2cidr
      AvailabilityZone: !Join [ "", [ !Ref 'AWS::Region', "b" ] ]
      VpcId: !Ref 'vpc27bc775f'
      Tags:
        - Key: Name
          Value: App B
  subnet7aee3531:
    Type: AWS::EC2::Subnet
    Properties:
      CidrBlock: !Ref d1cidr
      AvailabilityZone: !Join [ "", [ !Ref 'AWS::Region', "a" ] ]
      VpcId: !Ref 'vpc27bc775f'
      Tags:
        - Key: Name
          Value: Data A
  subnetbae43ff1:
    Type: AWS::EC2::Subnet
    Properties:
      CidrBlock: !Ref a1cidr
      AvailabilityZone: !Join [ "", [ !Ref 'AWS::Region', "a" ] ]
      VpcId: !Ref 'vpc27bc775f'
      Tags:
        - Key: Name
          Value: App A
  subnetd3e13a98:
    Type: AWS::EC2::Subnet
    Properties:
      CidrBlock: !Ref p1cidr
      AvailabilityZone: !Join [ "", [ !Ref 'AWS::Region', "a" ] ]
      MapPublicIpOnLaunch: 'True'
      VpcId: !Ref 'vpc27bc775f'
      Tags:
        - Key: Name
          Value: Public A
  subnet2c5c4176:
    Type: AWS::EC2::Subnet
    Properties:
      CidrBlock: !Ref p2cidr
      AvailabilityZone: !Join [ "", [ !Ref 'AWS::Region', "b" ] ]
      MapPublicIpOnLaunch: 'True'
      VpcId: !Ref 'vpc27bc775f'
      Tags:
        - Key: Name
          Value: Public B
  


#Security Groups for the three tiered network architecture
  PublicSGSSL:
    Condition: DeployACM
    DependsOn: EIP
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: Security Group for Load Balancers
      VpcId: !Ref 'vpc27bc775f'
      SecurityGroupIngress:
        - IpProtocol: tcp
          FromPort: '443'
          ToPort: '443'
          CidrIp: !Ref 'AccessCidr'
        - IpProtocol: tcp
          FromPort: '80'
          ToPort: '80'
          CidrIp: !Ref 'AccessCidr'
      Tags:
        - Key: Name
          Value: Public Security Group
  PublicSGNoSSL:
    Condition: NoDeployACM
    DependsOn: EIP
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: Security Group for Load Balancers
      VpcId: !Ref 'vpc27bc775f'
      SecurityGroupIngress:
        - IpProtocol: tcp
          FromPort: '443'
          ToPort: '443'
          CidrIp: !Ref 'AccessCidr'
        - IpProtocol: tcp
          FromPort: '80'
          ToPort: '80'
          CidrIp: !Ref 'AccessCidr'
      Tags:
        - Key: Name
          Value: Public Security Group
  AppSG:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: Security Group for Application Servers
      VpcId: !Ref 'vpc27bc775f'
      Tags:
        - Key: Name
          Value: App Security Group
  DataSG:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: Security Group for Databases
      VpcId: !Ref 'vpc27bc775f'
      SecurityGroupIngress:
      - IpProtocol: tcp
        FromPort: '3306'
        ToPort: '3306'
        SourceSecurityGroupId: !Ref 'AppSG'
      Tags:
        - Key: Name
          Value: DB Security Group


  
#Route tables and route definitions for the three tiered network architecture
  Route:
    Type: AWS::EC2::Route
    Properties:
      RouteTableId: !Ref 'rtb425bda38'
      DestinationCidrBlock: 0.0.0.0/0
      NatGatewayId: !Ref 'NAT'
  rtb425bda38:
    Type: AWS::EC2::RouteTable
    Properties:
      VpcId: !Ref 'vpc27bc775f'
  rtb3756d74d:
    Type: AWS::EC2::RouteTable
    Properties:
      VpcId: !Ref 'vpc27bc775f'
      Tags:
        - Key: Name
          Value: Public  
  subnetroute1:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      RouteTableId: !Ref 'rtb3756d74d'
      SubnetId: !Ref 'subnet2c5c4176'
  subnetroute2:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      RouteTableId: !Ref 'rtb3756d74d'
      SubnetId: !Ref 'subnetd3e13a98'
  subnetroute3:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      RouteTableId: !Ref 'rtb425bda38'
      SubnetId: !Ref 'subnet3d504d67'
  subnetroute4:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      RouteTableId: !Ref 'rtb425bda38'
      SubnetId: !Ref 'subnet864d50dc'
  subnetroute5:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      RouteTableId: !Ref 'rtb425bda38'
      SubnetId: !Ref 'subnet7aee3531'
  subnetroute6:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      RouteTableId: !Ref 'rtb425bda38'
      SubnetId: !Ref 'subnetbae43ff1'
  route2:
    Type: AWS::EC2::Route
    Properties:
      DestinationCidrBlock: 0.0.0.0/0
      RouteTableId: !Ref 'rtb3756d74d'
      GatewayId: !Ref 'igw8d9149f4'
    DependsOn: gw1  





#Elastic Beanstalk IAM Roles
  ServiceRole:
    Type: 'AWS::IAM::Role'
    Properties:
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Sid: ''
            Effect: Allow
            Principal:
              Service: elasticbeanstalk.amazonaws.com
            Action: 'sts:AssumeRole'
            Condition:
              StringEquals:
                'sts:ExternalId': elasticbeanstalk
      Policies:
        - PolicyName: root
          PolicyDocument:
            Version: 2012-10-17
            Statement:
              - Effect: Allow
                Action:
                  - 'elasticloadbalancing:DescribeInstanceHealth'
                  - 'elasticloadbalancing:DescribeLoadBalancers'
                  - 'elasticloadbalancing:DescribeTargetHealth'
                  - 'ec2:DescribeInstances'
                  - 'ec2:DescribeInstanceStatus'
                  - 'ec2:GetConsoleOutput'
                  - 'ec2:AssociateAddress'
                  - 'ec2:DescribeAddresses'
                  - 'ec2:DescribeSecurityGroups'
                  - 'sqs:GetQueueAttributes'
                  - 'sqs:GetQueueUrl'
                  - 'autoscaling:DescribeAutoScalingGroups'
                  - 'autoscaling:DescribeAutoScalingInstances'
                  - 'autoscaling:DescribeScalingActivities'
                  - 'autoscaling:DescribeNotificationConfigurations'
                Resource:
                  - '*'
      Path: /
  InstanceProfile:
    Type: 'AWS::IAM::InstanceProfile'
    Properties:
      Path: /
      Roles:
        - !Ref InstanceProfileRole
  InstanceProfileRole:
    Type: 'AWS::IAM::Role'
    Properties:
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - ec2.amazonaws.com
            Action:
              - 'sts:AssumeRole'
      ManagedPolicyArns: 
        - "arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore"
      Policies:
        - PolicyName: root
          PolicyDocument:
            Version: 2012-10-17
            Statement:
              - Sid: BucketAccess
                Action:
                  - 's3:*'
                Effect: Allow
                Resource:
                  - !Join 
                    - ''
                    - - 'arn:aws'
                      - ':s3:::elasticbeanstalk-*-'
                      - !Ref 'AWS::AccountId'
                  - !Join 
                    - ''
                    - - 'arn:aws'
                      - ':s3:::elasticbeanstalk-*-'
                      - !Ref 'AWS::AccountId'
                      - /*
                  - !Join 
                    - ''
                    - - 'arn:aws'
                      - ':s3:::elasticbeanstalk-*-'
                      - !Ref 'AWS::AccountId'
                      - '-*'
                  - !Join 
                    - ''
                    - - 'arn:aws'
                      - ':s3:::elasticbeanstalk-*-'
                      - !Ref 'AWS::AccountId'
                      - '-*/*'
                  - !Join 
                    - ''
                    - - 'arn:aws'
                      - ':s3:::cf-templates-*'
                      - !Ref 'AWS::AccountId'
                  - !Join 
                    - ''
                    - - 'arn:aws'
                      - ':s3:::cf-templates-*'
                      - !Ref 'AWS::AccountId'
                      - '/*'
                  - !Join [ "", [ 'arn:aws:s3:::', !Ref "AWS::AccountId", '-', !Select [ 1, !Split [ '-', !Ref 'subnetd3e13a98'] ], '-redcapebapp' ] ]
                  - !Join [ "", [ 'arn:aws:s3:::', !Ref "AWS::AccountId", '-', !Select [ 1, !Split [ '-', !Ref 'subnetd3e13a98'] ], '-redcapebapp', '/*' ] ]
              - Sid: MetricsAccess
                Action:
                  - 'cloudwatch:PutMetricData'
                  - 'logs:CreateLogStream'
                  - 'logs:PutLogEvents'
                Effect: Allow
                Resource: '*'
              - Sid: SSMAccess
                Action:
                  - 'ssm:PutParameter'
                  - 'ssm:GetParameter'
                Effect: Allow
                Resource: 'arn:aws:ssm:*:*:parameter/redcap-salt'
              - Sid: EncryptedEBS
                Action:
                  - 'ec2:CreateVolume'
                  - 'ec2:AttachVolume'
                  - 'ec2:ModifyInstanceAttribute'
                  - "ec2:Describe*"
                Effect: Allow
                Resource: '*'
              - Sid: CreateNewEBVersion
                Action:
                  - 'elasticbeanstalk:RetrieveEnvironmentInfo'
                  - "elasticbeanstalk:DescribeEnvironments"
                  - "elasticbeanstalk:DescribeEvents"
                  - "elasticbeanstalk:DescribeConfigurationOptions"
                  - "elasticbeanstalk:DescribeInstancesHealth"
                  - "elasticbeanstalk:DescribeApplicationVersions"
                  - "elasticbeanstalk:DescribeEnvironmentHealth"
                  - "elasticbeanstalk:DescribeApplications"
                  - "elasticbeanstalk:ListPlatformVersions"
                  - "elasticbeanstalk:DescribeEnvironmentResources"
                  - "elasticbeanstalk:DescribeEnvironmentManagedActions"
                  - "elasticbeanstalk:RequestEnvironmentInfo"
                  - "elasticbeanstalk:DescribeEnvironmentManagedActionHistory"
                  - "elasticbeanstalk:CreateApplicationVersion"
                  - "elasticbeanstalk:ValidateConfigurationSettings"
                  - "elasticbeanstalk:DescribeConfigurationSettings"
                  - "elasticbeanstalk:CheckDNSAvailability"
                  - "elasticbeanstalk:ListAvailableSolutionStacks"
                  - "elasticbeanstalk:DescribePlatformVersion"
                  - "elasticbeanstalk:UpdateEnvironment"
                  - "elasticbeanstalk:PutInstanceStatistics"
                  - "cloudformation:GetTemplate"
                  - 'cloudformation:DescribeStackResources'
                  - 'cloudformation:DescribeStackResource'
                  - 'cloudformation:UpdateStack'
                  - "cloudformation:DescribeStacks"
                  - "cloudformation:DescribeStackEvents"
                  - "autoscaling:DescribeAutoScalingGroups"
                  - "autoscaling:SuspendProcesses"
                  - "autoscaling:DescribeScalingActivities"
                  - "autoscaling:ResumeProcesses"
                  - "autoscaling:DescribeLaunchConfigurations"
                  - "elasticloadbalancing:DescribeTargetGroups"
                  - "elasticloadbalancing:RegisterTargets"
                  - "elasticloadbalancing:DescribeLoadBalancers"
                Effect: Allow
                Resource: '*'
# To support Enhanced health authorization in AWS
              - Sid: ElasticBeanstalkHealthAccess
                Action:
                  - "elasticbeanstalk:PutInstanceStatistics"
                Effect: Allow
                Resource: 
                  -  "arn:aws:elasticbeanstalk:*:*:application/*"
                  -  "arn:aws:elasticbeanstalk:*:*:environment/*"
##        
      Path: /





#IAM Roles for the temporary EC2 server to inject the ebextenstions files in to the REDCap source package.
  EC2Role:
    Type: AWS::IAM::Role
    Properties:
      ManagedPolicyArns: 
        - "arn:aws:iam::aws:policy/service-role/AmazonEC2RoleforSSM"
      AssumeRolePolicyDocument:
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - ec2.amazonaws.com
            Action:
              - sts:AssumeRole
      Path: /
  EC2RolePolicies:
    Type: AWS::IAM::Policy
    Properties:
      PolicyName: root
      PolicyDocument:
        Statement:
          - Effect: Allow
            Action: 
              - "s3:*"
              - "cloudformation:DescribeStackResources"
              - "cloudformation:DescribeStackResource"
            Resource: 
              - !Join [ "", [ 'arn:aws:s3:::', !Ref RedcapS3Bucket ] ]
              - !Join [ "", [ 'arn:aws:s3:::', !Ref RedcapS3Bucket, '/*' ] ]              
              - !Join [ "", [ 'arn:aws:s3:::', !Ref "AWS::AccountId", '-', !Select [ 1, !Split [ '-', !Ref 'subnetd3e13a98'] ], '-redcapebapp' ] ]
              - !Join [ "", [ 'arn:aws:s3:::', !Ref "AWS::AccountId", '-', !Select [ 1, !Split [ '-', !Ref 'subnetd3e13a98'] ], '-redcapebapp', '/*' ] ]
              - !Join [ "", [ 'arn:aws:s3:::', !Ref "AWS::AccountId", '-', !Select [ 1, !Split [ '-', !Ref 'subnetd3e13a98'] ], '-redcaprepository' ] ]
              - !Join [ "", [ 'arn:aws:s3:::', !Ref "AWS::AccountId", '-', !Select [ 1, !Split [ '-', !Ref 'subnetd3e13a98'] ], '-redcaprepository', '/*' ] ]
          - Effect: Allow
            Action:
              - "elasticbeanstalk:ListAvailableSolutionStacks"
            Resource:
              - '*'
          - Effect: Allow
            Action: 
              - 'logs:CreateLogGroup'
              - 'logs:CreateLogStream'
              - 'logs:PutLogEvents'
              - 'logs:DescribeLogStreams'
            Resource: 'arn:aws:logs:*:*:*'
      Roles:
        - !Ref 'EC2Role'
  EC2InstanceProfile:
    Type: AWS::IAM::InstanceProfile
    Properties:
      Path: /
      Roles:
        - !Ref 'EC2Role'

  # '${AWS::AccountId}-${subnetpublica}-redcaprepository'
  #IAM User and Access/Secret Key to be used by REDCap to access S3 as a File Repository
  REDCapUser:
    Type: AWS::IAM::User
    Properties:
      Policies:
      - PolicyName: S3Access
        PolicyDocument:
          Statement:
            - Effect: Allow
              Action: 
                - "s3:*"
              Resource: 
              - !Join [ "", [ 'arn:aws:s3:::', !Ref "AWS::AccountId", '-', !Select [ 1, !Split [ '-', !Ref 'subnetd3e13a98'] ], '-redcaprepository' ] ]
              - !Join [ "", [ 'arn:aws:s3:::', !Ref "AWS::AccountId", '-', !Select [ 1, !Split [ '-', !Ref 'subnetd3e13a98'] ], '-redcaprepository', '/*' ] ]
  REDCapAccessKey:
    Type: AWS::IAM::AccessKey
    Properties:
      UserName:
        !Ref REDCapUser





#Return the created resources to the Master template
Outputs:
  VPCId:
    Value: !Ref 'vpc27bc775f'
  SubnetPublicA:
    Value: !Ref 'subnetd3e13a98'
  SubnetPublicB:
    Value: !Ref 'subnet2c5c4176'
  SubnetAppA:
    Value: !Ref 'subnetbae43ff1'
  SubnetAppB:
    Value: !Ref 'subnet864d50dc'
  SubnetDataA:
    Value: !Ref 'subnet7aee3531'
  SubnetDataB:
    Value: !Ref 'subnet3d504d67'
  SGPublic:
    Value: !If [ DeployACM, !Ref 'PublicSGSSL', !Ref 'PublicSGNoSSL' ]
  SGApp:
    Value: !Ref 'AppSG'
  SGData:
    Value: !Ref 'DataSG'
  EBServiceRole:
    Value: !Ref 'ServiceRole'
  EBInstanceProfile:
    Value: !Ref 'InstanceProfile'
  TempEC2InstanceProfile:
    Value: !Ref 'EC2InstanceProfile'
  S3AccessKey:
    Value: !Ref REDCapAccessKey
  S3SecretKey:
    Value: !GetAtt REDCapAccessKey.SecretAccessKey