# EC2 Instance with user data to download, extract, and run the software infrastructure installation
  OpenflowAgentInstance:
    Type: "AWS::EC2::Instance"
    Properties:
      InstanceType: "t3.medium"
      IamInstanceProfile: 
        Ref: "EC2InstanceProfile"
      ImageId: !Ref LatestAmiId
      BlockDeviceMappings:
        - DeviceName: /dev/xvda
          Ebs:
            VolumeSize: 20
            VolumeType: gp3
      SubnetId: !Ref "PrivateSubnet1"
      Tags:
        - Key: "Name"
          Value: !Sub "openflow-agent-${DataPlaneKey}"
      UserData:
        Fn::Base64: !Sub
          - |
            #!/bin/bash
            cat <<\EOF > /home/ec2-user/.env
            #!/bin/bash
            UNIQUE_SUFFIX=${DataPlaneKey}
            DATA_PLANE_UUID=${DataPlaneUUID}
            AWS_REGION=${AWSRegion}
            DOMAIN=${DataPlaneURL}
            IMAGE_REGISTRY=${AWSAccountId}.dkr.ecr.${AWSRegion}.amazonaws.com
            AGENT_IMAGE_REPOSITORY=openflow-data-plane-agent-aws
            AGENT_IMAGE_VERSION=${AgentImageVersion}
            S3_BUCKET_NAME=${TerraformStateBucket}
            OPERATOR_IMAGE_REPOSITORY=runtime-operator
            OPERATOR_CHART_REPOSITORY=runtime-operator-chart
            OPERATOR_CHART_VERSION=${RuntimeOperatorChartVersion}
            SNOWFLAKE_LOGIN_ENABLE=true
            GATEWAY_IMAGE_REPOSITORY=openflow-runtime-gateway
            GATEWAY_IMAGE_VERSION=${RuntimeGatewayVersion}
            SERVER_IMAGE_REPOSITORY=runtime-server
            EXTENSIONS_IMAGE_REPOSITORY=runtime-extensions
            SF_ORG=${SnowflakeOrganization}
            SF_ACCOUNT=${SnowflakeAccount}
            SF_DB=${SnowflakeDatabase}
            SF_SCHEMA=${SnowflakeSchema}
            SF_IMG_REPO=${SnowflakeImageRepository}
            SNOWFLAKE_ACCOUNT_URL=${SnowflakeAccountURL}
            SNOWFLAKE_OAUTH_INTEGRATION_NAME=${SnowflakeOAuthIntegrationName}
            SNOWFLAKE_OAUTH_TOKEN_URL=${SnowflakeAccountURL}/oauth/token-request
            ENABLE_TELEMETRY=true
            TELEMETRY_URL=${TelemetryURL}
            CONTROL_PLANE_URL=${ControlPlaneURL}
            VPC_ID=${VpcId}
            PRIVATE_SUBNET_1_ID=${PrivateSubnet1Id}
            PRIVATE_SUBNET_2_ID=${PrivateSubnet2Id}
            DPS_ENABLE=true
            DPS_IMAGE_REPOSITORY=openflow-dataplane-service
            DPS_CHART_REPOSITORY=openflow-dataplane-service-chart
            DPS_CHART_VERSION=${DataPlaneServiceChartVersion}
            DPUI_IMAGE_REPOSITORY=openflow-dataplane-ui
            DPUI_CHART_REPOSITORY=openflow-dataplane-ui-chart
            DPUI_CHART_VERSION=${DataPlaneUIChartVersion}
            DPS_FEATURE_CONNECTOR_INSTALLATION=true
            USE_IMAGE_REGISTRY_OVER_PRIVATE_LINK=${UseImageRegistryOverPrivateLink}

            EOF

            chown ec2-user:ec2-user /home/ec2-user/.env
            chmod 644 /home/ec2-user/.env
            source /home/ec2-user/.env

            dnf update -y
            dnf install -y docker

            yum remove aws-cli -y
            curl "https://awscli.amazonaws.com/awscli-exe-linux-x86_64.zip" -o "awscliv2.zip"
            unzip awscliv2.zip
            ./aws/install
            aws --version
            rm -rf awscliv2.zip aws/

            cat <<\EOF > /home/ec2-user/ensure-ecr-repo.sh
            #!/bin/bash
            source /home/ec2-user/.env

            instance_id=$(ec2-metadata -i | cut -d ' ' -f2)

            exists_check=$(aws ecr describe-repositories --region $AWS_REGION --repository-names $1 2>&1)
            if [ $? -ne 0 ]; then
              if echo $exists_check | grep -q RepositoryNotFoundException; then
                aws ecr create-repository --region $AWS_REGION --repository-name $1
              else
                >&2 echo $exists_check
              fi
            fi
            EOF

            SNOWFLAKE_CLI_ARCH=x86_64
            SNOWFLAKE_CLI_VERSION=3.8.3
            curl "https://sfc-repo.snowflakecomputing.com/snowflake-cli/linux_$SNOWFLAKE_CLI_ARCH/$SNOWFLAKE_CLI_VERSION/snowflake-cli-$SNOWFLAKE_CLI_VERSION.$SNOWFLAKE_CLI_ARCH.rpm" -o "snowflake-cli.rpm"
            rpm -i snowflake-cli.rpm

            systemctl start docker
            systemctl enable docker

            usermod -a -G docker ec2-user

            wget https://get.helm.sh/helm-v3.16.4-linux-amd64.tar.gz
            tar -zxvf helm-v3.16.4-linux-amd64.tar.gz
            mv ./linux-amd64/helm /usr/local/bin/helm
            rm -rf helm-v3.16.4-linux-amd64.tar.gz
            rm -rf linux-amd64

            cat <<\EOF > /home/ec2-user/.upgrade
            #!/bin/bash
            AGENT_IMAGE_VERSION_UPGRADE=
            OPERATOR_CHART_VERSION_UPGRADE=
            GATEWAY_IMAGE_VERSION_UPGRADE=
            DPS_CHART_VERSION_UPGRADE=
            DPUI_CHART_VERSION_UPGRADE=
            EOF

            cat <<\EOF > /home/ec2-user/sync-images.sh
            #!/bin/bash
            source /home/ec2-user/.env

            echo "Logging in to local private ECR..."
            aws ecr get-login-password --region $AWS_REGION | docker login --username AWS --password-stdin $IMAGE_REGISTRY

            OAUTH_SECRET_ID="snowflake-oauth2-$UNIQUE_SUFFIX"

            oauth2_creds=$(aws secretsmanager get-secret-value --region $AWS_REGION --query SecretString --output text --secret-id $OAUTH_SECRET_ID)
            CLIENT_ID=$(echo $oauth2_creds | jq -r '.clientID')
            CLIENT_SECRET=$(echo $oauth2_creds | jq -r '.clientSecret')

            access_token=$(curl -s --request POST --url $SNOWFLAKE_OAUTH_TOKEN_URL \
              --header 'content-type: application/x-www-form-urlencoded' \
              --data-urlencode grant_type=client_credentials \
              --data-urlencode client_id=$CLIENT_ID \
              --data-urlencode client_secret=$CLIENT_SECRET | jq -r '.access_token')

            TOKEN_PATH="/home/ec2-user/access.token"
            echo -n $access_token > $TOKEN_PATH

            if [[ "$USE_IMAGE_REGISTRY_OVER_PRIVATE_LINK" == true ]];
              then
                echo "Connecting to image registry using a private link"
                private_link_param='--private-link';
              else
                echo "Connecting to image registry using a public endpoint"
                private_link_param='';
            fi

            SPCS_PARAMS="""-x \
              --account=$SF_ORG-$SF_ACCOUNT \
              --database=$SF_DB \
              --schema=$SF_SCHEMA \
              --host=$(echo $SNOWFLAKE_ACCOUNT_URL | sed 's/^https:\/\///') \
              --authenticator=OAUTH \
              --token-file-path=$TOKEN_PATH \
              --format=JSON
            """

            SF_REG=$(snow spcs image-registry url $private_link_param $SPCS_PARAMS | jq -r '.message')

            echo "Logging in to Snowflake Image Registry https://$SF_REG ..."
            echo $access_token | docker login "https://$SF_REG" \
              --username 0auth2accesstoken \
              --password-stdin

            echo $access_token | helm registry login "https://$SF_REG" \
              --username 0auth2accesstoken \
              --password-stdin

            echo "Discovering tags for repo $SF_IMG_REPO"
            latest_images=$(snow spcs image-repository list-images $SF_IMG_REPO $SPCS_PARAMS)

            rm $TOKEN_PATH

            echo "Found images\n$latest_images"

            docker_keep_only() {
              local image_name="$1"
              local image_tag="$2"

              docker images | grep "$image_name" | grep -v "$image_tag" | awk '{ print $3}' | sort | uniq | xargs docker rmi -f 2>/dev/null
            }

            sync_image() {
              local image_name="$1"
              local image_tag="$2"

              SNOW_IMAGE_PATH="$SF_DB/$SF_SCHEMA/$SF_IMG_REPO/$image_name:$image_tag"

              if [[ "$image_name" == *"-chart" ]]; then
                registryId=$(echo $IMAGE_REGISTRY | cut -d'.' -f1)
                foundImageLocalEcr="$(aws ecr describe-images --region $AWS_REGION --registry-id $registryId --repository-name "snowflake-openflow/$image_name" --image-ids=imageTag=$image_tag 2>&1)"
                if [ $? -ne 0 ]; then
                  echo "No $image_name:$image_tag found locally, so syncing"
                  helm pull oci://$SF_REG/$SF_DB/$SF_SCHEMA/$SF_IMG_REPO/$image_name --version $image_tag
                  helm push $image_name-$image_tag.tgz oci://$IMAGE_REGISTRY/snowflake-openflow
                  app_version=$(helm show values $image_name-$image_tag.tgz --jsonpath "{$.image.tag}")
                  if [[ $OPERATOR_CHART_REPOSITORY == $image_name ]]; then
                    echo "Pulling app $OPERATOR_IMAGE_REPOSITORY $app_version for helm chart $image_name $image_tag"
                    sync_image $OPERATOR_IMAGE_REPOSITORY $app_version
                  elif [[ $DPS_CHART_REPOSITORY == $image_name ]]; then
                    echo "Pulling app $DPS_IMAGE_REPOSITORY $app_version for helm chart $image_name $image_tag"
                    sync_image $DPS_IMAGE_REPOSITORY $app_version
                  elif [[ $DPUI_CHART_REPOSITORY == $image_name ]]; then
                    echo "Pulling app $DPUI_IMAGE_REPOSITORY $app_version for helm chart $image_name $image_tag"
                    sync_image $DPUI_IMAGE_REPOSITORY $app_version
                  fi
                  rm ./$image_name-$image_tag.tgz
                else
                  echo "Found $image_name:$image_tag in local ECR, so no need to re-sync"
                fi
              else
                LOCAL_IMAGE_PATH=$IMAGE_REGISTRY/snowflake-openflow/$image_name:$image_tag
                docker pull $SF_REG/$SNOW_IMAGE_PATH
                docker tag $SF_REG/$SNOW_IMAGE_PATH $LOCAL_IMAGE_PATH
                docker push $LOCAL_IMAGE_PATH
              fi
            }

            # If specific versions are set, make sure that we sync those
            if [ -n "$AGENT_IMAGE_VERSION" ]; then
              sync_image $AGENT_IMAGE_REPOSITORY $AGENT_IMAGE_VERSION
            fi

            if [ -n "$GATEWAY_IMAGE_VERSION" ]; then
              sync_image $GATEWAY_IMAGE_REPOSITORY $GATEWAY_IMAGE_VERSION
            fi

            if [ -n "$OPERATOR_CHART_VERSION" ]; then
              sync_image $OPERATOR_CHART_REPOSITORY $OPERATOR_CHART_VERSION
            fi

            if [ -n "$DPS_CHART_VERSION" ]; then
              sync_image $DPS_CHART_REPOSITORY $DPS_CHART_VERSION
            fi

            if [ -n "$DPUI_CHART_VERSION" ]; then
              sync_image $DPUI_CHART_REPOSITORY $DPUI_CHART_VERSION
            fi

            image_repos="$AGENT_IMAGE_REPOSITORY $EXTENSIONS_IMAGE_REPOSITORY $OPERATOR_IMAGE_REPOSITORY $OPERATOR_CHART_REPOSITORY $SERVER_IMAGE_REPOSITORY $DPS_IMAGE_REPOSITORY $DPS_CHART_REPOSITORY $DPUI_IMAGE_REPOSITORY $DPUI_CHART_REPOSITORY $GATEWAY_IMAGE_REPOSITORY"
            IFS=' '
            for image_name in $image_repos
            do
              # Find only the latest tag for this image
              latest_tag=$(echo "$latest_images" | jq -r ".[] | select(.image_name == \"$image_name\") | .tags" | sed -r 's/-/~/' | sort -Vr | sed -r 's/~/-/' | head -1)

              sync_image $image_name $latest_tag

              if [[ $AGENT_IMAGE_REPOSITORY == $image_name ]]; then
                if [ -z "$AGENT_IMAGE_VERSION" ]; then
                  echo "Setting Agent image version to $latest_tag"
                  sed -i'' -Ee "s|(AGENT_IMAGE_VERSION=).*|\1$latest_tag|g" /home/ec2-user/.env
                  docker_keep_only $image_name $latest_tag
                else
                  if [[ $AGENT_IMAGE_VERSION != $latest_tag ]]; then
                    sed -i'' -Ee "s|(AGENT_IMAGE_VERSION_UPGRADE=).*|\1$latest_tag|g" /home/ec2-user/.upgrade
                  fi
                  docker_keep_only $image_name $AGENT_IMAGE_VERSION
                fi
              elif [[ $GATEWAY_IMAGE_REPOSITORY == $image_name ]]; then
                if [ -z "$GATEWAY_IMAGE_VERSION" ]; then
                  echo "Setting Gateway image version to $latest_tag"
                  sed -i'' -Ee "s|(GATEWAY_IMAGE_VERSION=).*|\1$latest_tag|g" /home/ec2-user/.env
                  docker_keep_only $image_name $latest_tag
                else
                  if [[ $GATEWAY_IMAGE_VERSION != $latest_tag ]]; then
                    sed -i'' -Ee "s|(GATEWAY_IMAGE_VERSION_UPGRADE=).*|\1$latest_tag|g" /home/ec2-user/.upgrade
                  fi
                  docker_keep_only $image_name $GATEWAY_IMAGE_VERSION
                fi
              elif [[ $OPERATOR_CHART_REPOSITORY == $image_name ]]; then
                if [ -z "$OPERATOR_CHART_VERSION" ]; then
                  echo "Setting Operator chart version to $latest_tag"
                  sed -i'' -Ee "s|(OPERATOR_CHART_VERSION=).*|\1$latest_tag|g" /home/ec2-user/.env
                elif [[ $OPERATOR_CHART_VERSION != $latest_tag ]]; then
                  sed -i'' -Ee "s|(OPERATOR_CHART_VERSION_UPGRADE=).*|\1$latest_tag|g" /home/ec2-user/.upgrade
                fi
              elif [[ $DPS_CHART_REPOSITORY == $image_name ]]; then
                if [ -z "$DPS_CHART_VERSION" ]; then
                  echo "Setting DPS chart version to $latest_tag"
                  sed -i'' -Ee "s|(DPS_CHART_VERSION=).*|\1$latest_tag|g" /home/ec2-user/.env
                elif [[ $DPS_CHART_VERSION != $latest_tag ]]; then
                  sed -i'' -Ee "s|(DPS_CHART_VERSION_UPGRADE=).*|\1$latest_tag|g" /home/ec2-user/.upgrade
                fi
              elif [[ $DPUI_CHART_REPOSITORY == $image_name ]]; then
                if [ -z "$DPUI_CHART_VERSION" ]; then
                  echo "Setting DP UI chart version to $latest_tag"
                  sed -i'' -Ee "s|(DPUI_CHART_VERSION=).*|\1$latest_tag|g" /home/ec2-user/.env
                elif [[ $DPUI_CHART_VERSION != $latest_tag ]]; then
                  sed -i'' -Ee "s|(DPUI_CHART_VERSION_UPGRADE=).*|\1$latest_tag|g" /home/ec2-user/.upgrade
                fi
              else
                # Delete any other versions of image from local Docker cache
                docker_keep_only $image_name $latest_tag
              fi

            done
            unset IFS

            echo "Done syncing repositories!"
            EOF

            cat <<\EOF > /etc/systemd/system/openflow-sync-images.service
            [Unit]
            Description="Sync images for Snowflake Openflow"
            [Service]
            User=ec2-user
            Group=ec2-user
            TimeoutSec=600
            WorkingDirectory=/home/ec2-user
            ExecStart=/home/ec2-user/sync-images.sh
            [Install]
            WantedBy=multi-user.target
            EOF

            cat <<\EOF > /etc/systemd/system/openflow-sync-images.timer
            [Unit]
            Description="Run openflow-sync-images.service every 10 minutes relative to deactivation time"
            [Timer]
            OnBootSec=5min
            OnUnitInactiveSec=10min
            Unit=openflow-sync-images.service
            [Install]
            WantedBy=timers.target
            EOF

            cat <<\EOF > /home/ec2-user/create.sh
            #!/bin/bash
            source /home/ec2-user/.env
            sudo systemctl enable openflow-apply-infrastructure.timer
            sudo systemctl start openflow-apply-infrastructure.timer
            sudo systemctl enable openflow-apply-infrastructure.service
            sudo systemctl start openflow-apply-infrastructure.service
            sudo journalctl -u openflow-apply-infrastructure.service -f
            EOF

            cat <<\EOF > /home/ec2-user/apply-infrastructure.sh
            #!/bin/bash
            source /home/ec2-user/.env
            # Run in the foreground
            docker run --name apply_infra --log-driver=journald --env-file /home/ec2-user/.env --rm "$IMAGE_REGISTRY/snowflake-openflow/$AGENT_IMAGE_REPOSITORY:$AGENT_IMAGE_VERSION" /opt/openflow/create.sh
            EOF

            cat <<\EOF > /etc/systemd/system/openflow-apply-infrastructure.service
            [Unit]
            Description="Apply baseline Snowflake Openflow infrastructure configuration"
            [Service]
            User=ec2-user
            Group=ec2-user
            TimeoutSec=0
            WorkingDirectory=/home/ec2-user
            ExecStart=/home/ec2-user/apply-infrastructure.sh
            [Install]
            WantedBy=multi-user.target
            EOF

            cat <<\EOF > /etc/systemd/system/openflow-apply-infrastructure.timer
            [Unit]
            Description="Run openflow-apply-infrastructure.service every 10 minutes relative to deactivation time"
            [Timer]
            OnBootSec=5min
            OnUnitInactiveSec=10min
            Unit=openflow-apply-infrastructure.service
            [Install]
            WantedBy=timers.target
            EOF

            cat <<\EOF > /home/ec2-user/destroy.sh
            #!/bin/bash
            source /home/ec2-user/.env

            read -rp $'\nAre you sure you want to delete the Data Plane and all Runtimes present? [Y/n]: ' proceed
            if [ -z "$proceed" ]; then
              proceed="Y"
            fi
            [[ ! $proceed =~ ^[Yy]$ ]] && { echo -e "\nOperation canceled, aborting teardown procedure!"; echo; exit 1; }

            # Stop auto-apply of infrastructure baseline
            sudo systemctl disable openflow-apply-infrastructure.timer
            sudo systemctl stop openflow-apply-infrastructure.timer
            sudo systemctl disable openflow-apply-infrastructure.service
            sudo systemctl stop openflow-apply-infrastructure.service

            container_id=$(docker run --log-driver=journald --env-file /home/ec2-user/.env -d --rm "$IMAGE_REGISTRY/snowflake-openflow/$AGENT_IMAGE_REPOSITORY:$AGENT_IMAGE_VERSION" /bin/bash -c "/opt/openflow/cli/update-kubeconfig.sh; /opt/openflow/destroy.sh")
            docker logs -f $container_id
            EOF

            cat <<\EOF > /home/ec2-user/diagnostics.sh
            #!/bin/bash
            source /home/ec2-user/.env
            docker run -it --env-file /home/ec2-user/.env --rm -w "/opt/openflow/cli" "$IMAGE_REGISTRY/snowflake-openflow/$AGENT_IMAGE_REPOSITORY:$AGENT_IMAGE_VERSION" /bin/bash -c "/opt/openflow/cli/update-kubeconfig.sh; ./diagnostics.sh"
            EOF

            cat <<\EOF > /home/ec2-user/upgrade-data-plane.sh
            #!/bin/bash
            set -o errexit
            source ~/.env
            source ~/.upgrade

            images="[
              {\"repo\":\"$AGENT_IMAGE_REPOSITORY\",\"version_env\":\"AGENT_IMAGE_VERSION\"},
              {\"repo\":\"$DPS_CHART_REPOSITORY\",\"version_env\":\"DPS_CHART_VERSION\"},
              {\"repo\":\"$DPUI_CHART_REPOSITORY\",\"version_env\":\"DPUI_CHART_VERSION\"},
              {\"repo\":\"$GATEWAY_IMAGE_REPOSITORY\",\"version_env\":\"GATEWAY_IMAGE_VERSION\"},
              {\"repo\":\"$OPERATOR_CHART_REPOSITORY\",\"version_env\":\"OPERATOR_CHART_VERSION\"}
            ]"

            echo "$images" | jq -c -r '.[]' | while read item; do
              repo=$(jq -r '.repo' <<< $item)
              version_env=$(jq -r '.version_env' <<< $item)
              version="${!!version_env}"
              latestVersionVar="$version_env"_UPGRADE
              latestVersion="${!!latestVersionVar}"

              echo "$repo is set to version $version"
              if [[ -z $latestVersion || $version == $latestVersion ]]; then
                echo -e "\tNo upgrade is available"
              else
                sed -i'' -Ee "s|($version_env=).*|\1$latestVersion|g" /home/ec2-user/.env
                echo -e "\tUpgrade set to version $latestVersion"
              fi

              sed -i'' -Ee "s|(""$version_env""_UPGRADE=).*|\1|g" /home/ec2-user/.upgrade
            done

            echo -e "\n*****\nUpgrades are applied during the next cycle:"
            sudo systemctl list-timers openflow-apply-infrastructure | head -n 2
            EOF

            chmod +x /home/ec2-user/*.sh
            chown ec2-user:ec2-user /home/ec2-user/*.sh

            image_repos="$AGENT_IMAGE_REPOSITORY $EXTENSIONS_IMAGE_REPOSITORY $OPERATOR_IMAGE_REPOSITORY $OPERATOR_CHART_REPOSITORY $SERVER_IMAGE_REPOSITORY $DPS_IMAGE_REPOSITORY $DPS_CHART_REPOSITORY $DPUI_IMAGE_REPOSITORY $DPUI_CHART_REPOSITORY $GATEWAY_IMAGE_REPOSITORY"
            IFS=' '
            for i in $image_repos
            do
              /home/ec2-user/ensure-ecr-repo.sh snowflake-openflow/$i
            done
            unset IFS

            /home/ec2-user/sync-images.sh

            systemctl daemon-reload

            systemctl enable openflow-sync-images.timer
            systemctl start openflow-sync-images.timer
            systemctl enable openflow-sync-images.service
            systemctl start openflow-sync-images.service

            systemctl enable openflow-apply-infrastructure.timer
            systemctl start openflow-apply-infrastructure.timer
            systemctl enable openflow-apply-infrastructure.service
            systemctl start openflow-apply-infrastructure.service

          - AWSAccountId: !Ref AWS::AccountId
            AWSRegion: !Ref AWS::Region
            TerraformStateBucket: !Ref TerraformStateBucket
            DataPlaneKey: !Ref DataPlaneKey
            DataPlaneUUID: !Ref DataPlaneUUID
            DataPlaneURL: !Ref DataPlaneURL
            AgentImageVersion: !Ref AgentImageVersion
            DataPlaneServiceChartVersion: !Ref DataPlaneServiceChartVersion
            DataPlaneUIChartVersion: !Ref DataPlaneUIChartVersion
            RuntimeOperatorChartVersion: !Ref RuntimeOperatorChartVersion
            RuntimeGatewayVersion: !Ref RuntimeGatewayVersion
            SnowflakeOrganization: !Ref SnowflakeOrganization
            SnowflakeAccount: !Ref SnowflakeAccount
            SnowflakeDatabase: !Ref SnowflakeDatabase
            SnowflakeSchema: !Ref SnowflakeSchema
            SnowflakeImageRepository: !Ref SnowflakeImageRepository
            SnowflakeAccountURL: !Ref SnowflakeAccountURL
            SnowflakeOAuthIntegrationName: !Ref SnowflakeOAuthIntegrationName
            TelemetryURL: !Ref TelemetryURL
            ControlPlaneURL: !Ref ControlPlaneURL
            VpcId: !Ref InfraVPC
            PrivateSubnet1Id: !Ref PrivateSubnet1
            PrivateSubnet2Id: !Ref PrivateSubnet2
            UseImageRegistryOverPrivateLink: !Ref UseImageRegistryOverPrivateLink