# Developer guide
<a name="developer-guide"></a>

This section addresses the source code, configuration files, and administrator tasks for this solution.

## Source code
<a name="source-code"></a>

Visit our [GitHub repository](https://github.com/awslabs/landing-zone-accelerator-on-aws) to download the source files for this solution and to share your customizations with others. The Landing Zone Accelerator on AWS templates are generated using the AWS CDK. Refer to the [README.md](https://github.com/awslabs/landing-zone-accelerator-on-aws/blob/main/README.md) file for additional information.

## Accessing solution outputs through Parameter Store
<a name="accessing-solution-outputs-through-parameter-store"></a>

This solution provides configuration management for resources provisioned through Parameter Store. The solution records the following resources types and their respective Parameter Store paths.

### Application resources
<a name="application-resources"></a>


| Metadata Type | Description | Path | 
| --- | --- | --- | 
|  Target Group ARN  |  The Amazon Resource Name (ARN) of the Target Group where ` ${0}${1}#` is replaced with the VPC name, and ` ${2} ` is replaced with the target group name  |   `/application/targetGroup/${0}/${1}/${2}/arn`   | 

### AWS CloudFormation stacks
<a name="aws-cloudformation-stacks"></a>


| Metadata Type | Description | Path | 
| --- | --- | --- | 
|  AWS CloudFormation Stack ID  |  The solution CloudFormation stack ID where ` ${0} ` is replaced with the stack name  |   `/${0}/stack-id`   | 
|  Accelerator Version ID  |  The Accelerator Version where ` ${0} ` is replaced with the stack name  |   `/${0}/version`   | 

### AWS Organization resources
<a name="aws-organization-resources"></a>


| Metadata Type | Description | Path | 
| --- | --- | --- | 
|  Accelerator Service Control Policy ID  |  The ID of the Service Control Policy where ` ${0} ` is replaced with the SCP name  |   `/organizations/scp/${0}/id`   | 

### Central Network resources
<a name="central-network-resources"></a>


| Metadata Type | Description | Path | 
| --- | --- | --- | 
|  VPC IP Address Manager ID  |  The ID of the VPC IP Address Manager (IPAM) where ` ${0} ` is replaced with the IPAM name  |   `/network/ipam/${0}/id`   | 
|  VPC IP Address Manager Pool ID  |  The ID of the VPC IP Address Manager (IPAM) Pool where ` ${0} ` is replaced with the IPAM Pool name  |   `/network/ipam/pools/${0}/id`   | 
|  VPC IP Address Manager Scope ID  |  The ID of the VPC IP Address Manager (IPAM) scope where ` ${0} ` is replaced with the IPAM scope name  |   `/network/ipam/scopes/${0}/id`   | 
|  Amazon Network Firewall ARN  |  The Amazon Resource Name (ARN) of the Amazon Network Firewall where ` ${0}$${1}#` is replaced with the network firewall name  |   `/network/vpc/${0}/networkFirewall/${1}/arn`   | 
|  Amazon Network Firewall Policy ARN  |  The Amazon Resource Name (ARN) of the Amazon Network Firewall policy where ` ${0} ` is replaced with the network firewall policy name  |   `/network/networkFirewall/policies/${0}/arn`   | 
|  Amazon Network Firewall Rule Group ARN  |  The Amazon Resource Name (ARN) of the Amazon Network Firewall Rule Group where ` ${0} ` is replaced with the rule group name  |   `/network/networkFirewall/ruleGroups/${0}/arn`   | 

### Direct Connect resources
<a name="direct-connect-resources"></a>


| Metadata Type | Description | Path | 
| --- | --- | --- | 
|  Direct Connect Virtual Interface (VIF) ID  |  The ID of the Direct Connect VIF where ` ${0} ` is replaced with the Direct Connect gateway name; ` ${1} ` is replaced with the VIF name  |   `/network/directConnectGateways/${0}/virtualInterfaces/${1}/id`   | 
|  Direct Connect Gateway ID  |  The ID of the Direct Connect gateway where ` ${0} ` is replaced with the Direct Connect gateway name  |   `/network/directConnectGateways/${0}/id`   | 

### Global Network resources
<a name="global-network-resources"></a>


| Metadata Type | Description | Path | 
| --- | --- | --- | 
|  ACM Certificate ARN  |  The Amazon Resource Name (ARN) of an ACM certificate where ` ${0} ` is replaced with the certificate name  |   `/acm/${0}/arn`   | 
|  Prefix List ID  |  The ID of the prefix list where ` ${0} ` is replaced with the prefix list name  |   `/network/prefixList/${0}/id`   | 

### IAM resources
<a name="identity-access-management-iam-resources"></a>


| Metadata Type | Description | Path | 
| --- | --- | --- | 
|  IAM Role ARN  |  The ARN of the IAM role where ` ${0} ` is replaced with the IAM role name  |   `/iam/role/${0}/arn`   | 
|  IAM Management Policy ARN  |  The ARN of the IAM managed policy where ` {0} ` is replaced with the IAM managed policy name  |   `/iam/policy/${0}/arn`   | 
|  IAM Group ARN  |  The ARN of the IAM group where ` ${0} ` is replaced with the IAM group name  |   `/iam/group/${0}/arn`   | 
|  IAM User ARN  |  The ARN of the IAM user where ` ${0} ` is replaced with the IAM user name  |   `/iam/user/${0}/arn`   | 

### Load Balancer resources
<a name="load-balancer-resources"></a>


| Metadata Type | Description | Path | 
| --- | --- | --- | 
|  Application Load Balancer ID  |  The ID of the Application Load Balancer (ALB) where ` ${0} ` is replaced with the VPC name; ` ${1} ` is replaced with the ALB name  |   `/network/vpc/${0}/alb/${1}/id`   | 
|  Network Load Balancer ID  |  The ID of the Network Load Balancer (NLB) where ` ${0} ` is replaced with the VPC name; ` ${1} ` is replaced with the NLB name  |   `/network/vpc/${0}/nlb/${1}/id`   | 
|  Gateway Load Balancer ARN  |  The ARN of the Gateway Load Balancer (GWLB) where ` ${0} ` is replaced with the GWLB name  |   `/network/gwlb/${0}/arn`   | 
|  Gateway Load Balancer Endpoint Service ID  |  The ID of the GWLB service endpoint where ` ${0}$ ` is replaced with the GWLB name  |   `/network/gwlb/${0}/endpointService/id`   | 

### Route 53 resources
<a name="route-53-resources"></a>


| Metadata Type | Description | Path | 
| --- | --- | --- | 
|  Route 53 DNS Firewall Rule Group ID  |  The ID of the Route 53 DNS firewall rule group ID where ` ${0} ` is replaced with the DNS firewall rule group name.  |   `/network/route53Resolver/firewall/ruleGroups/${0}/id`   | 
|  Interface Endpoint DNS name  |  The DNS name of the interface endpoint where ` ${0} ` is replaced with the VPC name; ` ${1} ` is replaced with the interface endpoint service name.  |   `/network/vpc/${0}/endpoints/${1}/dns`   | 
|  Interface Endpoint Hosted Zone ID  |  The hosted zone ID of the interface endpoint ` ${0} ` is replaced with the VPC name; ` ${1} ` is replaced with the interface endpoint service name.  |   `/network/vpc/${0}/endpoints/${1}/hostedZoneId`   | 
|  Route 53 Private Hosted Zone ID  |  The ID of the private hosted zone where ` ${0} ` is replaced with the VPC name; ` ${1} ` is replaced with the interface endpoint service name.  |   `/network/vpc/${0}/route53/hostedZone/[.red]#${1}/id`   | 
|  Route 53 Query Logs  |  The configuration ID of Route 53 query logs where ` ${0} ` is replaced with the query logs configuration name.  |   `/network/route53Resolver/queryLogConfigs/${0}/id`   | 
|  Route 53 Resolver Endpoint ID  |  The ID of the Route 53 resolver endpoint where ` ${0} ` is replaced with the resolver endpoint name.  |   `/network/route53Resolver/endpoints/${0}/id`   | 

### Transit Gateway resources
<a name="transit-gateway-tgw-resources"></a>


| Metadata Type | Description | Path | 
| --- | --- | --- | 
|  Transit Gateway ID  |  The ID of the transit gateway where ` ${0} ` is replaced with the transit gateway name  |   `/network/transitGateways/${0}/id`   | 
|  Transit Gateway Peering ID  |  The ID of the transit gateway peering ID where ` ${0} ` is replaced with the transit gateway name for either the requester or accepter transit gateway\$1; ` ${1} ` is replaced with the transit gateway peering name.  |   `/network/transitGateways/${0}/peering/${1}/id`   | 
|  Transit Gateway Route Table ID  |  The ID of the transit gateway route table where ` ${0} ` is replaced with the transit gateway name; ` ${1} ` is replaced with the route table name.  |   `/network/transitGateways/${0}/routeTables/${1}/id`   | 
|  Transit Gateway VPN attachment ID  |  The ID of the transit gateway VPN attachment where ` ${0} ` is replaced with the VPN Connection name.  |   `/network/vpnConnection/${0}/id`   | 
+ This depends on the account that the parameter is being put in.

### VPC resources
<a name="virtual-private-cloud-vpc-resources"></a>


| Metadata Type | Description | Path | 
| --- | --- | --- | 
|  Virtual Private Cloud (VPC) ID  |  The ID of the VPC where ` ${0} ` is replaced with the VPC name.  |   `/network/vpc/${0}/id`   | 
|  VPC Peering ID  |  The ID of the VPC peering connection where ` ${0} ` is replaced with the VPC peering name.  |   `/network/vpcPeering/${0}/id`   | 
|  Internet Gateway ID  |  The ID of the internet gateway where ` ${0} ` is replaced with the VPC name.  |   `/network/vpc/${0}/internetGateway/id`   | 
|  Virtual Private Gateway ID  |  The ID of the virtual private gateway where ` ${0} ` is replaced with the VPC name.  |   `/network/vpc/${0}/virtualPrivateGateway/id`   | 
|  Subnet ID  |  The ID of the subnet where ` ${0} ` is replaced with the VPC name; `\$1\$11\$1 is replaced with the subnet name  |   `/network/vpc/${0}/subnet/${1}/id`   | 
|  Route Table ID  |  The ID of the route table where ` ${0} ` is replaced with the VPC name; ` ${1} ` is replaced with the route table name  |   `/network/vpc/${0}/routeTable/${1}/id`   | 
|  Security Group ID  |  The ID of the security group where ` ${0} ` is replaced with the VPC name; ` ${1} ` is replaced with the security group name  |   `/network/vpc/${0}/securityGroup/${1}/id`   | 
|  Network ACL ID  |  The ID of the network ACL (NACL) where ` ${0} ` is replaced with the VPC name; ` ${1} ` is replaced with the NACL name  |   `/network/vpc/${0}/networkAcl/${1}/id`   | 
|  NAT Gateway ID  |  The ID of the NAT Gateway where ` ${0} ` is replaced with the VPC name; ` ${1} ` is replaced with the NAT Gateway name  |   `/network/vpc/${0}/natGateway/${1}/id`   | 
|  Transit Gateway VPC Attachment ID  |  The ID of the transit gateway VPC attachment where ` ${0} ` is replaced with the VPC name; ` ${1} ` is replaced with the transit gateway attachment name  |   `/network/vpc/${0}/transitGatewayAttachment/${1}/id`   | 

### VPN resources
<a name="virtual-private-network-vpn-resources"></a>


| Metadata Type | Description | Path | 
| --- | --- | --- | 
|  Customer Gateway ID  |  The ID of the customer gateway where ` ${0} ` is replaced with the customer gateway name  |   `/network/customerGateways/${0}/id`   |