ga-snpp-wb-ec2-poc-latest.yml

---
# Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
# SPDX-License-Identifier: MIT-0
#
# This template will setup the required resources to allow the AWS Ground Station service to stream
# satellite contact data into your account.
#
# The EC2 instance setup includes:
#  - Installing and configuring the AWS Ground Station receiver and agent for receiving data
#
# Other resources are:
#  - An Elastic IP which is associated and used by the AWS Ground Station service to emit stream
#    data into your VPC and  receiver instance.
#  - Supporting resources like security groups, limited permissions roles, etc.
#
# Prerequisites:
#  - VPC with at least one subnet to launch the receiver instance into.
#  - SSH key used to ssh into the hosts once they are built.
#

AWSTemplateFormatVersion: "2010-09-09"

Description:
  Example of implementation of AWS Ground Station Wideband DigIF X-band downlik data delivery from SNPP satellite to an EC2 with Amphinicy Blink SDR.

Metadata:
  AWS::CloudFormation::Interface:
    ParameterGroups:
      -
        Label:
          default: "Parameters"
        Parameters:
          - Ec2InstanceType
          - VpcId
          - SubnetId
          - SSHKey
          - SSHCidrBlock
          - AutomationBundleS3Path
          - BlinkConfigBundleS3Path
          - BlinkResultsBucketName



Parameters:

  Ec2InstanceType:
    Description: EC2 receiver instance type compatible with GS Agent.
    Type: String
    Default: "g4dn.metal"
    AllowedValues:
      - "c6i.32xlarge"
      - "c5.24xlarge"
      - "c5.18xlarge"
      - "c5.12xlarge"
      - "c5n.metal"
      - "c5n.18xlarge"
      - "m5.24xlarge"
      - "m5.12xlarge"
      - "r5.metal"
      - "r5.24xlarge"
      - "r5n.metal"
      - "r5n.24xlarge"
      - "g4dn.12xlarge"
      - "g4dn.16xlarge"
      - "g4dn.metal"

  SSHCidrBlock:
    Description: The CIDR block to allowlist for SSH and Blink Web UI access to the EC2 receiver instance. The CIDR block has the form x.x.x.x/x. The most secure approach is to use your IP address.
    Type: String
    Default: "0.0.0.0/32"
    AllowedPattern : '((\d{1,3})\.){3}\d{1,3}/\d{1,2}'
    ConstraintDescription : must be a valid CIDR range of the form x.x.x.x/x, for example "10.0.0.0/16".

  SSHKey:
    Description: The SSH key used to access the EC2 receiver instance. Choose any SSH key if you are not creating an EC2 receiver instance.
    Type: AWS::EC2::KeyPair::KeyName
    ConstraintDescription: must be the name of an existing EC2 KeyPair.

  SubnetId:
    Description: Subnet to launch the EC2 receiver instance in. Choose any subnet if you are not creating an EC2 receiver instance.
    Type: AWS::EC2::Subnet::Id

  VpcId:
    Description: VPC to launch the EC2 receiver instance in. Choose any VPC if you are not creating an EC2 receiver instance.
    Type: AWS::EC2::VPC::Id

  BlinkConfigBundleS3Path:
    Description: "S3 path to Blink configuration bundle"
    Default: "s3://"
    Type: String

  AutomationBundleS3Path:
    Description: "S3 path to automation scripts bundle"
    Default: "s3://"
    Type: String

  BlinkResultsBucketName:
    Description: "Name of the S3 bucket for storing decoded data and Blink decoding reports"
    Type: String


Mappings:
  PrefixListId:
    us-east-2:
      groundstation: pl-087f83ba4f34e3bea
    us-west-2:
      groundstation: pl-0cc36273da754ebdc
    us-east-1:
      groundstation: pl-0e5696d987d033653
    eu-central-1:
      groundstation: pl-03743f81267c0a85e
    sa-east-1:
      groundstation: pl-098248765e9effc20
    ap-northeast-2:
      groundstation: pl-059b3e0b02af70e4d
    ap-southeast-1:
      groundstation: pl-0d9b804fe014a6a99
    ap-southeast-2:
      groundstation: pl-08d24302b8c4d2b73
    me-south-1:
      groundstation: pl-02781422c4c792145
    eu-west-1:
      groundstation: pl-03fa6b266557b0d4f
    eu-north-1:
      groundstation: pl-033e44023025215c0
    af-south-1:
      groundstation: pl-0382d923a9d555425

  BlinkMap:
    eu-north-1:
      ami: ami-032d9834043e02ab8   # Blink v1.5.4
    eu-west-1:
      ami: ami-07fd4dd0e1da2e128   # Blink v1.5.4
    eu-central-1:
      ami: ami-0ace26d7aa5a9838a   # Blink v1.5.4
    me-south-1:
      ami: ami-07112af57c28da2ae   # Blink v1.5.4
    us-east-1:
      ami: ami-0cebf06762f9ed43a   # Blink v1.5.4
    us-east-2:
      ami: ami-02c2b27360696c505   # Blink v1.5.4
    us-west-2:
      ami: ami-022af04cf2c08e0cf   # Blink v1.5.4
    af-south-1:
      ami: ami-01b415345c8291ebe   # Blink v1.5.4
    sa-east-1: 
      ami: ami-004889f1fa1be9cf7   # Blink v1.5.4
    ap-northeast-2:
      ami: ami-03dcbd3a7400d240b   # Blink v1.5.4
    ap-southeast-2:
      ami: ami-04b1bcbf2161badd6   # Blink v1.5.4
    ap-southeast-1:
      ami: ami-08cef4e088ea207ec   # Blink v1.5.4  

Resources:
  # The EC2 instance assumes this role.
  InstanceRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: "Allow"
            Principal:
              Service:
                - "ec2.amazonaws.com"
            Action:
              - "sts:AssumeRole"
      Path: "/"
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/AmazonS3ReadOnlyAccess
        - arn:aws:iam::aws:policy/service-role/AmazonEC2ContainerServiceforEC2Role
        - arn:aws:iam::aws:policy/CloudWatchAgentServerPolicy
        - arn:aws:iam::aws:policy/service-role/AmazonEC2RoleforSSM
        - arn:aws:iam::aws:policy/AWSGroundStationAgentInstancePolicy
        - arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore
        - arn:aws:iam::aws:policy/AmazonEC2ReadOnlyAccess
      Policies:
        - PolicyDocument:
            Statement:
              - Action:
                  - sts:AssumeRole
                Effect: Allow
                Resource: !GetAtt GroundStationKmsKeyRole.Arn
              - Action:
                  - s3:PutObject
                  - s3:GetObject
                  - s3:DeleteObject
                Effect: Allow
                Resource:
                  - Fn::Sub:
                    - "arn:${AWS::Partition}:s3:::${Bucket}/*"
                    - Bucket: !Ref BlinkResultsBucketName
            Version: "2012-10-17"
          PolicyName: InstanceGroundStationApiAccessPolicy

  InstanceEC2TagsAccessPolicy:
    Type: AWS::IAM::Policy
    Properties:
      PolicyName: InstanceEC2TagsAccess
      PolicyDocument:
        Version: "2012-10-17"
        Statement:
        # Allow tags operations to watch GS Contact status
          - Action:
              - ec2:DeleteTags
              - ec2:CreateTags
            Effect: Allow
            Resource:
              - Fn::Sub:
                - "arn:${AWS::Partition}:ec2:${Region}:${Account}:instance/${InstanceId}"
                - Region: !Ref AWS::Region
                  Account: !Ref AWS::AccountId
                  InstanceId: !Ref ReceiverInstance
      Roles:
        - !Ref InstanceRole

  InstanceEC2StopInstancePolicy:
    Type: AWS::IAM::Policy
    Properties:
      PolicyName: InstanceEC2StopInstances
      PolicyDocument:
        Version: "2012-10-17"
        Statement:
        # Allow the instance to stop itself
          - Action:
              - ec2:StopInstances
            Effect: Allow
            Resource:
              - Fn::Sub:
                - "arn:${AWS::Partition}:ec2:${Region}:${Account}:instance/${InstanceId}"
                - Region: !Ref AWS::Region
                  Account: !Ref AWS::AccountId
                  InstanceId: !Ref ReceiverInstance
      Roles:
        - !Ref InstanceRole

  InstanceRoleIMDSRolicy:
    Type: AWS::IAM::ManagedPolicy
    Properties:
      PolicyDocument:
        Version: "2012-10-17"
        Statement:
        - Action:
          - "ec2:ModifyInstanceMetadataOptions"
          Effect: Allow
          Resource: "*"
      Roles:
      - Ref: InstanceRole

  # The instance profile for your EC2 instance.
  GeneralInstanceProfile:
    Type: AWS::IAM::InstanceProfile
    Properties:
      Roles:
        - !Ref InstanceRole

  # The security group for your EC2 instance.
  InstanceSecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: AWS Ground Station receiver instance security group.
      VpcId: !Ref VpcId
      SecurityGroupEgress:
        - CidrIp: 0.0.0.0/0
          Description: Allow all outbound traffic by default
          IpProtocol: "-1"
      SecurityGroupIngress:
        - IpProtocol: tcp
          FromPort: 22
          ToPort: 22
          CidrIp: !Ref SSHCidrBlock
          Description: Management SSH
        - IpProtocol: tcp
          FromPort: 443
          ToPort: 443
          CidrIp: !Ref SSHCidrBlock
          Description: Blink Web Interface
        - IpProtocol: udp
          Description: Allow AWS Ground Station Incoming Dataflows
          ToPort: 50000
          FromPort: 42000
          SourcePrefixListId:
            Fn::FindInMap:
              - PrefixListId
              - Ref: AWS::Region
              - groundstation


# An EIP providing a fixed IP address for AWS Ground Station to connect to.  Attach it to the receiver instance created in the stack.
  ReceiverInstanceElasticIp:
    Type: AWS::EC2::EIP
    Properties:
      Tags:
        - Key: Name
          Value: !Join [ "-" , [ "EIP" , !Ref "AWS::StackName" ] ]

  ReceiverInstanceElasticIpAssociation:
    Type: AWS::EC2::EIPAssociation
    Properties:
      EIP: !Ref ReceiverInstanceElasticIp
      InstanceId: !Ref ReceiverInstance

  # The EC2 instance that will receive data from your satellite using AWS Ground Station.
  ReceiverInstance:
    Type: AWS::EC2::Instance
    Properties:
      DisableApiTermination: false
      IamInstanceProfile: !Ref GeneralInstanceProfile
      ImageId: 
        Fn::FindInMap:
          [BlinkMap, Ref: "AWS::Region", ami]
      InstanceType: !Ref Ec2InstanceType
      KeyName: !Ref SSHKey
      Monitoring: true
      SecurityGroupIds:
        - Ref: InstanceSecurityGroup
      SubnetId:
        Ref: SubnetId
      Tags:
        - Key: Name
          Value: !Join [ "-" , [ "Receiver" , !Ref "AWS::StackName" ] ]
      # agentCpuCores list in the AGENT_CONFIG below defines the cores that the AWS Ground Station Agent is allowed to run on. This list can be changed to suit your use-case, however if the agent isn't supplied with enough cores data loss may occur.
      UserData:
        Fn::Base64:
          Fn::Sub:
            - |
              #!/bin/bash
              exec > >(tee /var/log/user-data.log|logger -t user-data -s 2>/dev/console) 2>&1
              echo `date +'%F %R:%S'` "INFO: Logging Setup" >&2

              echo AWS_DEFAULT_REGION=${AWS::Region} >> /etc/environment

              TOKEN=$(curl -s -X PUT "http://169.254.169.254/latest/api/token" -H "X-aws-ec2-metadata-token-ttl-seconds: 21600")
              INSTANCE_ID=$(curl -s -H "X-aws-ec2-metadata-token: $TOKEN" http://169.254.169.254/latest/meta-data/instance-id)

              aws ec2 modify-instance-metadata-options --instance-id $INSTANCE_ID --http-put-response-hop-limit 4

              # install dependencies
              export DEBIAN_FRONTEND=noninteractive
              apt-get update -y && apt-get upgrade -y
              apt-get install -y alien net-tools unzip python3-pip
              pip3 install boto3 ec2-metadata

              aws s3 cp --region ${AWS::Region} s3://groundstation-wb-digif-software-${AWS::Region}/aws-groundstation-agent/latest/amazon_linux_2_x86_64/aws-groundstation-agent.rpm /tmp/aws-groundstation-agent.rpm
              alien -d -c -i /tmp/aws-groundstation-agent.rpm

              AGENT_CONFIG_PATH="/opt/aws/groundstation/etc/aws-gs-agent-config.json"
              cat << AGENT_CONFIG > "$AGENT_CONFIG_PATH"
              {
                "capabilities": [
                  "arn:${AWS::Partition}:groundstation:${AWS::Region}:${AWS::AccountId}:dataflow-endpoint-group/${DataflowEndpointGroupId}"
                ],
                "device": {
                  "privateIps": [
                    "127.0.0.1"
                  ],
                  "publicIps": [
                    "${EIP}"
                  ],
                  "agentCpuCores": [
                    2, 3, 4, 5, 6, 7, 8, 9, 10, 50, 51, 52, 53, 54, 55, 56, 57, 58
                  ]
                }
              }
              AGENT_CONFIG

              # disable irqbalance service
              systemctl stop irqbalance
              systemctl disable irqbalance

              # Postpone agent service start after Blink services
              sed -i 's/network-online.target/network-online.target blink-dsp.service blink-snmp.service/g' /lib/systemd/system/aws-groundstation-agent.service


              # <Tuning Section Start>

              # Set IRQ affinity with list of CPU cores and Receive Side Scaling mask
              # Core list should be the first two cores (and hyperthreads) on each socket
              # Mask set to everything currently
              # https://github.com/torvalds/linux/blob/v4.11/Documentation/networking/scaling.txt#L80-L96

              # Replace eth* with enp198s* prior to adding irq affinity automation to boot

              sed -i 's/eth/enp198s/g' /opt/aws/groundstation/bin/set_irq_affinity.sh
              echo "@reboot sudo -i /opt/aws/groundstation/bin/set_irq_affinity.sh '0,1,48,49' 'ffffffff,ffffffff,ffffffff' >>/var/log/user-data.log 2>&1" >>/var/spool/cron/root

              # Set network interface interrupt coalescing
              echo "@reboot sudo ethtool -C enp198s0 rx-usecs 128 tx-usecs 128 >>/var/log/user-data.log 2>&1" >>/var/spool/cron/root

              # Set network interface rx queue depth
              echo "@reboot sudo ethtool -G enp198s0 rx 16384 >>/var/log/user-data.log 2>&1" >>/var/spool/cron/root

              # Adding additional kernel parameters to defaults
              
              echo "GRUB_CMDLINE_LINUX_DEFAULT=\"console=tty0 console=ttyS0,115200n8 net.ifnames=0 biosdevname=0 nvme_core.io_timeout=4294967295 intel_idle.max_cstate=1 processor.max_cstate=1 max_cstate=1\"" >/etc/default/grub.d/60-gsagent-settings.cfg
              echo "GRUB_TIMEOUT=0" >>/etc/default/grub.d/60-gsagent-settings.cfg

              update-grub

              # Configure these now because the agent installation did not do it
              
              cat >> /etc/sysctl.conf <<END_SYSCTL
              net.core.rmem_default = 2147483647
              net.core.wmem_default = 2147483647
              net.ipv4.conf.all.accept_source_route = 0
              net.ipv4.conf.all.promote_secondaries = 1
              net.core.rmem_max = 2147483647
              net.core.wmem_max = 2147483647
              net.core.netdev_max_backlog = 1000000
              net.core.optmem_max = 25165824
              net.core.default_qdisc = fq
              net.ipv4.udp_mem = 5242880 5242880 10485760
              net.ipv4.udp_rmem_min = 16384
              net.ipv4.udp_wmem_min = 16384
              net.ipv4.ip_local_reserved_ports = 42000-50000
              END_SYSCTL


              # Add the spool file to crontab, otherwise it won't start the spooled commands after reboot on Ubuntu
              crontab -u root /var/spool/cron/root

              # Set up fq qdisc on enp198s0 via service command, GS Agent requires these limits and fq

              TC_SERVICE_PATH="/etc/systemd/system/tc-qdisc.service"
              cat << TC_SERVICE > "$TC_SERVICE_PATH"
              [Unit]
              Description=Set fq qdisc for network interface
              After=network-online.target

              [Service]
              Type=oneshot
              ExecStart=/sbin/tc qdisc add dev enp198s0 root fq limit 1000000 flow_limit 100000
              RemainAfterExit=yes

              [Install]
              WantedBy=multi-user.target
              TC_SERVICE


              systemctl daemon-reload
              systemctl start tc-qdisc.service
              systemctl enable tc-qdisc.service

              # </Tuning Section End>

              sleep 120

              # Enable and start GS Agent

              systemctl start aws-groundstation-agent
              systemctl enable aws-groundstation-agent

              # Configure Blink
              aws s3 cp --region ${AWS::Region} ${BlinkConfigBundleS3Path} /home/ubuntu/blink_config_bundle.zip
              unzip /home/ubuntu/blink_config_bundle.zip -d /home/ubuntu/
              chmod +x /home/ubuntu/install.sh
              sleep 60
              cd /home/ubuntu/ && ./install.sh
              echo ${BlinkResultsBucketName} > /usr/share/blink-config/etc/s3-bucket-name.txt

              # Setup automation
              aws s3 cp --region ${AWS::Region} ${AutomationBundleS3Path} /home/ubuntu/automation_bundle.zip
              unzip /home/ubuntu/automation_bundle.zip -d /home/ubuntu/
              chmod +x /home/ubuntu/stop-instance.sh
              chmod +x /home/ubuntu/sdr-contact-completed.sh
              cp watch-gs-contact-completion.service /etc/systemd/system/
              systemctl enable watch-gs-contact-completion.service
              systemctl start watch-gs-contact-completion.service

              # Set runlevel 3 (non-GUI) as default
              systemctl set-default multi-user.target

              #  Stop the instance
              /home/ubuntu/stop-instance.sh

            - DataflowEndpointGroupId: !Ref DataflowEndpointGroup
              EIP: !Ref ReceiverInstanceElasticIp

  # The AWS Ground Station Dataflow Endpoint Group that defines the endpoints that AWS Ground
  # Station will use to send/receive data to/from your satellite.
  DataflowEndpointGroup:
    Type: AWS::GroundStation::DataflowEndpointGroup
    Properties:
      EndpointDetails:
        - AwsGroundStationAgentEndpoint:
            Name: !Join [ "-" , [ !Ref "AWS::StackName" , "Downlink" ] ]
            EgressAddress:
              SocketAddress:
                Name: 127.0.0.1
                Port: 55000
            IngressAddress:
              SocketAddress:
                Name: !Ref ReceiverInstanceElasticIp
                PortRange:
                  Minimum: 42000
                  Maximum: 55000

  GroundStationCloudWatchEventHandlerLambda:
    Type: AWS::Lambda::Function
    Properties:
      Handler: index.handle_cloudwatch_event
      Runtime: python3.8
      MemorySize: 128
      Timeout: 300
      Role: !GetAtt GroundStationCloudWatchEventHandlerLambdaRole.Arn
      Environment:
        Variables:
          ReceiverInstance: !Ref ReceiverInstance
          DataflowEndpointGroup: !Ref DataflowEndpointGroup
          StartInstance: "True"
          StopInstance: "True"
      Code:
        ZipFile:
          |
          import json
          import logging
          import os

          import boto3

          EC2_INSTANCE_IDS = [
            os.environ.get("ReceiverInstance")
          ]
          DATAFLOW_ENDPOINT_GROUPS = [
            os.environ.get("DataflowEndpointGroup")
          ]
          START_INSTANCE = os.environ.get("StartInstance", "").lower() == "true"
          STOP_INSTANCE = os.environ.get("StopInstance", "").lower() == "true"

          logger = logging.getLogger(__name__)
          logger.setLevel(logging.INFO)


          def handle_cloudwatch_event(lambda_event, context):
              logger.info(f"handle_cloudwatch_event: Called with event {json.dumps(lambda_event)}")
              ec2_resource = boto3.resource("ec2")

              dataflow_endpoint_group_id = get_dataflow_endpoint_group_id(lambda_event)
              if dataflow_endpoint_group_id not in DATAFLOW_ENDPOINT_GROUPS:
                  logger.warn(f"This dataflow_endpoint_group_id ({dataflow_endpoint_group_id}) does does not occur in this list: {DATAFLOW_ENDPOINT_GROUPS}")
                  return

              dataflow_endpoint_group_state = get_dataflow_endpoint_group_state(lambda_event)
              if START_INSTANCE and dataflow_endpoint_group_state == "PREPASS":
                  handle_prepass(ec2_resource)
              elif dataflow_endpoint_group_state == "COMPLETED":
                  handle_complete(ec2_resource)
              else:
                  logger.info(f"No action defined for dataflow_endpoint_group state {dataflow_endpoint_group_state}.")


          def get_dataflow_endpoint_group_id(lambda_event):
              dataflow_endpoint_group_id = lambda_event.get("detail", {}).get("dataflowEndpointGroupId")
              logger.info(f"get_dataflow_endpoint_group_id: DataflowEndpointGroupId is {dataflow_endpoint_group_id}")
              return dataflow_endpoint_group_id


          def get_dataflow_endpoint_group_state(lambda_event):
              dataflow_endpoint_group_state = lambda_event.get("detail", {}).get("dataflowEndpointGroupState")
              logger.info(f"get_dataflow_endpoint_group_state: DataflowEndpointGroup state is {dataflow_endpoint_group_state}")
              return dataflow_endpoint_group_state


          def handle_prepass(ec2_resource):
              for ec2_instance_id in EC2_INSTANCE_IDS:
                  instance = ec2_resource.Instance(ec2_instance_id)
                  if instance.state.get("Name") == "stopping":
                      logger.info(f"Waiting to Stop {ec2_instance_id}")
                      instance.wait_until_stopped()
                      instance.reload()
                  if instance.state.get("Name") == "stopped":
                      logger.info(f"Starting {ec2_instance_id}")
                      instance.start()
                  else:
                      logger.warning(f"Not starting {ec2_instance_id} because its state is {instance.state}")


          def handle_complete(ec2_resource):
              for ec2_instance_id in EC2_INSTANCE_IDS:
                  instance = ec2_resource.Instance(ec2_instance_id)
                  if instance.state.get("Name") == "running":
                      logger.info(f"Setting Contact tag for {ec2_instance_id} to 'COMPLETED'")
                      instance.create_tags(
                        Resources=[ec2_instance_id],
                        Tags=[{
                            'Key': 'Contact',
                            'Value': 'COMPLETED'
                        }])

                      if STOP_INSTANCE:
                        logger.info(f"Stopping instance {ec2_instance_id}")
                        instance.stop()
                  else:
                      logger.warning(f"Not stopping {ec2_instance_id} because its state is {instance.state}")

  GroundStationCloudWatchEventHandlerLambdaRolePolicy:
    Type: AWS::IAM::ManagedPolicy
    Properties:
      PolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Action:
              - ec2:StartInstances
              - ec2:StopInstances
              - ec2:DeleteTags
              - ec2:CreateTags
            Resource:
              - Fn::Sub:
                - "arn:${AWS::Partition}:ec2:${Region}:${Account}:instance/${InstanceId}"
                - Region: !Ref AWS::Region
                  Account: !Ref AWS::AccountId
                  InstanceId: !Ref ReceiverInstance
          # DescribeInstanceStatus does not allow you to specify a resource restriction, you must provide '*'
          - Effect: Allow
            Action:
              - ec2:DescribeInstances
              - ec2:DescribeInstanceStatus
            Resource:
              - '*'

  GroundStationCloudWatchEventHandlerLambdaRole:
    Type: AWS::IAM::Role
    Properties:
      Path: '/'
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole
        - !Ref GroundStationCloudWatchEventHandlerLambdaRolePolicy
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
        - Effect: Allow
          Principal:
            Service: lambda.amazonaws.com
          Action:
            - sts:AssumeRole

  GroundStationCloudWatchEventRule:
    Type: AWS::Events::Rule
    Properties:
      Description: "EventRule"
      EventPattern:
        source:
          - "aws.groundstation"
        detail-type:
          - "Ground Station Dataflow Endpoint Group State Change"
        detail:
          dataflowEndpointGroupId:
            - !Ref DataflowEndpointGroup
      State: "ENABLED"
      Targets:
        - Arn: !GetAtt GroundStationCloudWatchEventHandlerLambda.Arn
          Id: "CloudWatchEventHandler"

  PermissionForGroundStationCloudWatchEventsToInvokeLambda:
    Type: AWS::Lambda::Permission
    Properties:
      FunctionName: !Ref GroundStationCloudWatchEventHandlerLambda
      Action: "lambda:InvokeFunction"
      Principal: "events.amazonaws.com"
      SourceArn: !GetAtt GroundStationCloudWatchEventRule.Arn

  # The IAM role that AWS Ground Station will assume to access and use the KMS Key for data delivery
  GroundStationKmsKeyRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Statement:
          - Action: sts:AssumeRole
            Effect: Allow
            Principal:
              Service:
                - groundstation.amazonaws.com
            Condition:
              StringEquals:
                "aws:SourceAccount": !Ref AWS::AccountId
              ArnLike:
                "aws:SourceArn": !Sub "arn:${AWS::Partition}:groundstation:${AWS::Region}:${AWS::AccountId}:mission-profile/*"
          - Action: sts:AssumeRole
            Effect: Allow
            Principal:
              AWS: !Sub "arn:${AWS::Partition}:iam::${AWS::AccountId}:root"

  GroundStationKmsKeyAccessPolicy:
    Type: AWS::IAM::Policy
    Properties:
      PolicyDocument:
        Statement:
          - Action:
              - kms:Decrypt
            Effect: Allow
            Resource: !GetAtt GroundStationDataDeliveryKmsKey.Arn
      PolicyName: GroundStationKmsKeyAccessPolicy
      Roles:
        - Ref: GroundStationKmsKeyRole

  GroundStationDataDeliveryKmsKey:
    Type: AWS::KMS::Key
    Properties:
      KeyPolicy:
        Statement:
          - Action:
              - kms:CreateAlias
              - kms:Describe*
              - kms:Enable*
              - kms:List*
              - kms:Put*
              - kms:Update*
              - kms:Revoke*
              - kms:Disable*
              - kms:Get*
              - kms:Delete*
              - kms:ScheduleKeyDeletion
              - kms:CancelKeyDeletion
              - kms:GenerateDataKey
              - kms:TagResource
              - kms:UntagResource
            Effect: Allow
            Principal:
              AWS: !Sub "arn:${AWS::Partition}:iam::${AWS::AccountId}:root"
            Resource: "*"
          - Action:
              - kms:Decrypt
              - kms:GenerateDataKeyWithoutPlaintext
            Effect: Allow
            Principal:
              AWS: !GetAtt GroundStationKmsKeyRole.Arn
            Resource: "*"
            Condition:
              StringEquals:
                "kms:EncryptionContext:sourceAccount": !Ref AWS::AccountId
              ArnLike:
                "kms:EncryptionContext:sourceArn": !Sub "arn:${AWS::Partition}:groundstation:${AWS::Region}:${AWS::AccountId}:mission-profile/*"
          - Action:
              - kms:CreateGrant
            Effect: Allow
            Principal:
              AWS: !Sub "arn:${AWS::Partition}:iam::${AWS::AccountId}:root"
            Resource: "*"
            Condition:
              ForAllValues:StringEquals:
                "kms:GrantOperations":
                  - Decrypt
                  - GenerateDataKeyWithoutPlaintext
                "kms:EncryptionContextKeys":
                  - sourceArn
                  - sourceAccount
              ArnLike:
                "kms:EncryptionContext:sourceArn": !Sub "arn:${AWS::Partition}:groundstation:${AWS::Region}:${AWS::AccountId}:mission-profile/*"
              StringEquals:
                "kms:EncryptionContext:sourceAccount": !Ref AWS::AccountId
        Version: "2012-10-17"
      EnableKeyRotation: true

  # The AWS Ground Station Tracking Config that defines how the antenna system will track your
  # satellite as it moves through the sky.
  TrackingConfig:
    Type: AWS::GroundStation::Config
    Properties:
      Name: "Tracking Config"
      ConfigData:
        TrackingConfig:
          Autotrack: "PREFERRED"

  # The AWS Ground Station Dataflow Endpoint Config that defines the endpoint used to downlink data
  # from your satellite.
  DownlinkDigIfEndpointConfig:
    Type: AWS::GroundStation::Config
    Properties:
      Name: "Downlink DigIF Endpoint Config"
      ConfigData:
        DataflowEndpointConfig:
          DataflowEndpointName: !Join [ "-" , [ !Ref "AWS::StackName" , "Downlink" ] ]
          DataflowEndpointRegion: !Ref AWS::Region

  # The AWS Ground Station Antenna Downlink Config that defines the frequency spectrum used to
  # downlink data from your satellite.

  Snpp350DownlinkDigIfAntennaConfig:
    Type: AWS::GroundStation::Config
    Properties:
      Name: "SNPP 350 MHz Downlink WBDigIF Antenna Config"
      ConfigData:
        AntennaDownlinkConfig:
          SpectrumConfig:
            Bandwidth:
              Units: "MHz"
              Value: 350
            CenterFrequency:
              Units: "MHz"
              Value: 7925
            Polarization: "RIGHT_HAND"


  # The AWS Ground Station Mission Profile that groups the above configurations to define how to
  # downlink data to your satellite.

  Snpp350MissionProfile:
    Type: AWS::GroundStation::MissionProfile
    Properties:
      Name: !Sub '${AWS::StackName}: 37849 SNPP 350MHz WBDigIF EC2 Delivery'
      ContactPrePassDurationSeconds: 120
      ContactPostPassDurationSeconds: 120
      MinimumViableContactDurationSeconds: 180
      TrackingConfigArn: !Ref TrackingConfig
      DataflowEdges:
        - Source: !Ref Snpp350DownlinkDigIfAntennaConfig
          Destination: !Ref DownlinkDigIfEndpointConfig
      StreamsKmsKey:
        KmsKeyArn: !GetAtt GroundStationDataDeliveryKmsKey.Arn
      StreamsKmsRole: !GetAtt GroundStationKmsKeyRole.Arn

Outputs:
  DataflowEndpointGroupId:
    Value:
      Ref: DataflowEndpointGroup

  ReceiverAddress:
    Value:
      Ref: ReceiverInstanceElasticIp