From 0b5c5bc28d2ee68fadec8d5f7aa99c29c4fa50ea Mon Sep 17 00:00:00 2001 From: lpiyumal Date: Sat, 7 Jun 2025 12:31:15 +0530 Subject: [PATCH] added files --- .../README.md | 78 ++ .../example-pattern.json | 69 ++ .../private_custom_domainname_TerraformV2.png | Bin 0 -> 72986 bytes .../main.tf | 833 ++++++++++++++++++ .../outputs.tf | 75 ++ .../variables.tf | 13 + 6 files changed, 1068 insertions(+) create mode 100644 private-apigw-custom-domain-private-restapi-public-lambda-terraform/README.md create mode 100644 private-apigw-custom-domain-private-restapi-public-lambda-terraform/example-pattern.json create mode 100644 private-apigw-custom-domain-private-restapi-public-lambda-terraform/images/private_custom_domainname_TerraformV2.png create mode 100644 private-apigw-custom-domain-private-restapi-public-lambda-terraform/main.tf create mode 100644 private-apigw-custom-domain-private-restapi-public-lambda-terraform/outputs.tf create mode 100644 private-apigw-custom-domain-private-restapi-public-lambda-terraform/variables.tf diff --git a/private-apigw-custom-domain-private-restapi-public-lambda-terraform/README.md b/private-apigw-custom-domain-private-restapi-public-lambda-terraform/README.md new file mode 100644 index 000000000..a9859fab8 --- /dev/null +++ b/private-apigw-custom-domain-private-restapi-public-lambda-terraform/README.md @@ -0,0 +1,78 @@ +# Amazon APIGW Private Custom Domain API with Internet-Enabled Lambda using NAT Gateway in Terraform + +This architecture demonstrates how to build a private API accessible only from within a VPC using API Gateway private endpoints, where the API is protected by custom domain names and SSL certificates. The solution includes a Lambda function running in private subnets that can access the internet through NAT Gateways, and an EC2 instance configured with Systems Manager Session Manager for secure management, all while maintaining network isolation and security best practices through VPC endpoints. + +User only needs to provide the following 2 variables, rest of the things will be handled by the code: +[1]. `aws_region` +[2]. `private_custom_domain_name` + +Important: this application uses various AWS services and there are costs associated with these services after the Free Tier usage - please see the [AWS Pricing page](https://aws.amazon.com/pricing/) for details. You are responsible for any AWS costs incurred. No warranty is implied in this example. + +## Requirements + +* [Create an AWS account](https://portal.aws.amazon.com/gp/aws/developer/registration/index.html) if you do not already have one and log in. The IAM user that you use must have sufficient permissions to make necessary AWS service calls and manage AWS resources. +* [AWS CLI](https://docs.aws.amazon.com/cli/latest/userguide/install-cliv2.html) installed and configured +* [Git Installed](https://git-scm.com/book/en/v2/Getting-Started-Installing-Git) +* [Terraform](https://learn.hashicorp.com/tutorials/terraform/install-cli?in=terraform/aws-get-started) installed + +## Deployment Instructions + +1. Create a new directory, navigate to that directory in a terminal and clone the GitHub repository: +CMD : git clone https://github.com/aws-samples/serverless-patterns + +2. Change directory to the pattern directory: +CMD : cd serverless-patterns/private-apigw-custom-domain-private-restapi-public-lambda-terraform + +3. From the command line, initialize terraform to download and install the providers defined in the configuration: +CMD : terraform init + +4. Review the resources that will be created: +CMD : terraform plan + +5. From the command line, apply the configuration in the main.tf file: +CMD : terraform apply -auto-approve + +6. Wait for the deployment to complete. This may take 10-15 minutes due to ACM certificate validation and API Gateway deployment. + +7. After deployment, note the outputs for testing. + +## How it works + +The architecture works by routing API requests through a VPC Endpoint (PrivateLink) to API Gateway, ensuring all traffic stays within AWS's private network. When a request is made to the private API using the private custom domain (e.g., mydomain@example.com), it's resolved through a private hosted zone in Route 53, which directs traffic to the VPC Endpoint. The request then flows to the API Gateway, which invokes a Lambda function running in private subnets, this Lambda can access the internet via NAT Gateways while maintaining security. For testing and management, an EC2 instance in the private subnet can access the API and be managed securely using Systems Manager Session Manager without requiring any public IP or bastion host. + +## Testing + +Once the terraform apply command is completed and resources are created, you will able to see the output of the script in the terminal. The output will contain the following information: +1. api_gateway_configuration +2. dns_and_certificates +3. ec2_instance +4. network_infrastructure +5. security +6. ssm_endpoints +7. vpc_endpoint_details + +Now, copy the "endpoint_url" from the api_gateway_configuration and run it in the ec2 instance(created by the terraform) by connecting it through the session manager. Below is the format of the commmand : + +CMD : curl -X GET + +# Sample Output : + +{ + "timestamp": "2025-04-03T04:21:07.426825", + "function_name": "private-api-lambda-egwvbbtf", + "internet_connectivity_test": { + "status": "Success", + "message": "Successfully connected to external website", + "aws_status_code": 200, + "aws_page_title": "Cloud Computing Services - Amazon Web Services (AWS)", + "test_time": "2025-04-03 04:21:07" + } +} + +## Cleanup + +1. Make sure you are in the "private-apigw-custom-domain-private-restapi-public-lambda-terraform" directory. + +2. Run the following command to destroy the infrastructure: +CMD : terraform destroy -auto-approve + diff --git a/private-apigw-custom-domain-private-restapi-public-lambda-terraform/example-pattern.json b/private-apigw-custom-domain-private-restapi-public-lambda-terraform/example-pattern.json new file mode 100644 index 000000000..d34f8a864 --- /dev/null +++ b/private-apigw-custom-domain-private-restapi-public-lambda-terraform/example-pattern.json @@ -0,0 +1,69 @@ +{ + "title": "APIGW Private Custom Domain Name with Internet-Enabled Lambda using NAT Gateway in Terraform", + "description": "This architecture demonstrates how to build a private API accessible only from within a VPC using API Gateway private endpoints, where the API is protected by custom domain names and SSL certificates. The solution includes a Lambda function running in private subnets that can access the internet through NAT Gateways, and an EC2 instance configured with Session Manager for secure management, all while maintaining network isolation and security best practices through VPC endpoints.", + "language": "HCL", + "level": "300", + "framework": "Terraform", + "introBox": { + "headline": "How it works", + "text": [ + "The architecture works by routing API requests through a VPC Endpoint (PrivateLink) to API Gateway, ensuring all traffic stays within AWS's private network. When a request is made to the private API using the private custom domain (e.g., mydomain@example.com), it's resolved through a private hosted zone in Route 53, which directs traffic to the VPC Endpoint.", + "The request then flows to the API Gateway, which invokes a Lambda function running in private subnets, this Lambda can access the internet via NAT Gateways while maintaining security. For testing and management, an EC2 instance in the private subnet can access the API and be managed securely using Session Manager without requiring any public IP or bastion host." + ] + }, + "gitHub": { + "template": { + "repoURL": "https://github.com/aws-samples/serverless-patterns/tree/main/private-apigw-custom-domain-private-restapi-public-lambda-terraform", + "templateURL": "serverless-patterns/private-apigw-custom-domain-private-restapi-public-lambda-terraform", + "projectFolder": "private-apigw-custom-domain-private-restapi-public-lambda-terraform", + "templateFile": "private-apigw-custom-domain-private-restapi-public-lambda-terraform/main.tf" + } + }, + "resources": { + "bullets": [ + { + "text": "Implementing custom domain names for private endpoints with Amazon API Gateway", + "link": "https://aws.amazon.com/blogs/compute/implementing-custom-domain-names-for-private-endpoints-with-amazon-api-gateway/" + }, + { + "text": "Tutorial: Create and invoke a custom domain name for private APIs", + "link": "https://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-private-custom-domains-tutorial.html" + } + ] + }, + "deploy": { + "text": [ + "terraform init", + "terraform plan", + "terraform apply" + ] + }, + "testing": { + "text": [ + "Once the terraform apply command is completed and resources are created, you will able to see the output of the script in the terminal. The output will contain the following information:", +"1. api_gateway_configuration", +"2. dns_and_certificates", +"3. ec2_instance", +"4. network_infrastructure", +"5. security", +"6. ssm_endpoints", +"7. vpc_endpoint_details", + +"See the GitHub repo for detailed testing instructions." + ] + }, + "cleanup": { + "text": [ + "terraform destroy", + "terraform show" + ] + }, + "authors": [ + { + "name": "Piyush Malviya", + "image": "https://drive.google.com/file/d/1ISkpmDwAClDH8RPdZOaxLq0aVbWNiIkX/view?usp=drive_link", + "bio": "Technology enthusiast and Amazon professional, driving innovation in the digital landscape", + "linkedin": "www.linkedin.com/in/piyush-malviyaa" + } + ] +} diff --git a/private-apigw-custom-domain-private-restapi-public-lambda-terraform/images/private_custom_domainname_TerraformV2.png b/private-apigw-custom-domain-private-restapi-public-lambda-terraform/images/private_custom_domainname_TerraformV2.png new file mode 100644 index 0000000000000000000000000000000000000000..1db0c70ad80aeacda66179352178087b99509f5e GIT binary patch literal 72986 zcmeFYdpMNq_dl+~&bBKmMM-pG5}H(UX7414Ob(?SWhrln57*n~x&D^X6&KqQcYeFG(|UF36-JI@(dPS(O0q8AKfnKkk>3u> zKh~MvIx=#z@NE6Y^mQMMem%7P*72ty>H^cKGk@&-GRd)}p$N~s~mcL{iFek$mgAjBG4dCcA@GmEpE)o-mVC$ry z;;0xOQ8k(xxV=AwT|z~HE(ZTR?BYzxV98lBD}<*`(v^sQ{0s5R zF~#v^-~WCH-cbEz;00n%^5Iu@1U*#kFVnkqxxGwmg4Q{oYFwy}q*>RB?=#Qe;}8dG zhW_Pk2>y{6V)es3(eDG_0bf-=;3)C^`Kp##m)nI3x$n;+eh>3VAHwy1JP+@8#6A#1 z{CNK8SOML&M5Tw7;kczb?2iybL@$+0T#_x*=TgzX+TiOhG>SzEV=^-J`HyP95QPI^ zj6g?UfEIirgfN+SrUML9tISAtm6n)tT`DO8Nw)0`;t3b0-KFb!=8Q#q8O>Y z$IkYV5fh`e1GJiEE%?E4G-n1Aa7Y-lc3)93`y5yvY&n_TW>!XkrK! zraoE-mYf1&2oK|L&Q$zdU4;wg6_-Li#!euXgwtC!M{EnQw`zan-hMei>7g08*g?9Y z>H>_+DwHLs259j_r7`UKSnibbn$reYt61L7C63(<1j41JaNJa;o1xyPTx;0GKFEl& zO^0$U>j*LcADU4x7P#bhD!@` zt5=qD@T_>|k(B#3kX36aL`uRyzP|7#SRZ#CYStW88%>pz6dfF_Za!L}{Wr4gfr(+y z2upg_#g5hU$Lhj%_b^!6rt&5BinI+$*``q0 zraVe{jKZx6FI^WamJ%6N-^@Ym1*&R^`;U@_SnFSpgHHny@I2YF|`_h z!pFicC75-URsVI89VSm2bwop8?cQF$!5DQNS{_xXq4+f(CE;)l{C7TG zonFGZf-nkIQEaQmq({H(k3O07#IDysak-!u%&Q-q_nWydDdrnh(Cck_l;s;>nM*Kw z!Nd9j0KFtBPEP&JRk&^{;cIm!s_?L4Up3WOtz@6#w2|5zHdObHSP)|_vmLdnXrm-& zprk6EJ>{qRS6xgM$K&g(a1S3A6&8n(n=$>WC~*zJAy0hHUpMZ`qdXhw*wKOC;8r$$ zWl;}*-E1?Y6F@1yG{#<%GZr9Nn-q>KE$(*UmGn%3JgN5Au)Mk6VkelHAnN4|1=|y| zWDn-|=`Dbh*-i)gOF%;>UH%eH4$c+*OOw`u*Ddjo^Yb}oiB|vLB)R{S0C7^E=~Y#Q za)>EQI)(IuTD}Vf64q;xA0*&mW$2q@QrmwdT)&52ogbF3{Qi7ioY^RI?&|kPk&lk} zbGufr`~G}Y>!XI-g=NdXKktv2yBMwV`}aqY;r--S4}SUe`|~^5;V1w3_`Eg#WA^Vp z@gIl#W{LkY)UGz^GSiJAAr=~Kl`BLv-Y*T>je9=$UDVHOM?4zP4%WvQ{mvgK&-*2VA<71wI$QuMI+|Cb-$Pv!R*!7Uyc6D zpC-I@KbaO`wAP4hy|4riu5L{Pg=Awyx;8HbjoxD2I#d42cQp&hlHP&?;k>;gFOMeN z!H}de)1LwLdmKZvQ=;g!M9lP8;PI6LJ>un$Wex=oe?EH0pN8`V>U7#ce0vIK7J#p_ zhW#^V43_1oEkMe-5kV}}K$fmzQi>bct0*Gkty+`V?HmRNs{ST0J?PKnR5nV6PTh-1 z?@<--Hj9YZ-(Y00ZOzX70*nLE{g#eH;T7n6OiKIYwuy***1iiaAlXmI0>hMl8WtB6 zv%4=443spVwWsjeZxdxBR)}0>)^mGHoh9V;LqqBPxHPoac9Fw13!Ao@lDylbD0#v_ zM1&MGb20;WK^EvkP~&Gx&>>$xzaK1_LL%rbX~q!Pj2jkLSZ#t3algBOs#5hjCNZ8m zJtz^8Tm|}*6Noy^HH+fN7tDwuh`P*=gElZE>#|`HPQam|VQ@-(TF>EiB3qs3H|hS( zDRV&WCbqoDRku3s^H%5q@o$nEcK{4t$eh605Coxi{z3si4ehb}-;lVpGaRRYatf?N zK7S0btfCB}$0%Q1#Qom?QQ!*|P+nx$I@G?y5X~s%*6P~I1~7q_&@%w}7{(ivM={wX zC}M)K8eHx@t!~~&^}}#`+iFp>U%#|aYcK_C!T8yM77vT{SY|tB`Mw!2=HN8dH*K~& zc&!oK(-4~(=E(?XAT(fllgq|me)mX~#my=d0{d>-uMy9V@c~>Q$)=yGf29r}uJ_L< zHdkLLk29?6+OF4BERZj**TX4cE>SrodOl!N_h zL#FPNWY^b@kuU}*_X?=JR^IKN0pSb} zzlrwVz;-85wR!^MLDaUgsgk)uz0=?~p>}ThyJTS+fp^ln#8OJf3j^c7d!g&5!H*?_ znH)bqA3J1)^GKMLb9erfrb@2LdD-WC2ltDJXkyEW$o6dI#*SMxk6o_YmOO^?f=2uX z$&MqCkz)6cOryx-Yv`m7wBfRb@;j@Un3n~gCBoTmYl;OsNT^ZD%? z?tM4{2aRTxSL(bqJflqoO0kRvXule`m7M$zt`}0v zWBsjhl{SH9wSo0!U5K=KbM6IU>N~bheSW6@;80+shXWyXS?h0~1SVWALz`k zje(b21&tm3qt|O>=m?TfHXfCztPnmc&>i3F*)c_+4QQMhC``p}!@7(W2KNSsF|-VIs22QLAHpoJ z7&cd$85lF@mcS)`I)}!dOX~ilYV-V8Lo61`X4pgY!USzO47ktr7q8yDwg*Cn%wQBF z$7$8ncG}BO+-z6Zf!wG+tU^8ENx?aWH2oK(lN&KxXSQ;~vXvY5$PKpBBF9M935LC( z1h259*SZa2gjD({Pj*17mZZ&+J@%R}D)QNO3O`ym7Q2fzRAgnd$0_Sevutita|gOgnHz1Ot_-VBB z^BQZGGsUN){b)_<;7aEPYWv`t=tP>&**y(FkTqx)-2J6CrE;nDbq~Kqqh5rp2^qUX zXMrD4dTREfoPyl%YPM(Rd)}?Q!wE>ymOkhCvi2PdUX{;iYW6c=^*$RAr-}T^QX3*L+K$#?Pe4)FgNGjFY(~6FrT6TCGMlNjv^uh@1^gsK_Ev%+ zE{qxqF*a<_u3|pct~>4W9SCCMk^BRlN+1a*m^RAuGT^(`?UKStZAYwbQ7Yr)z7*5Y zzL2CX)xl47J*8klm*fdqAUP?Qk~PT2%?F3nPS2GGs~QfzKRanS*q5dMAa<=PH@j9w zCg_;6bBAxzc5)_EXgCu^u_e2j@ny_$ovCWnCFV~6`a%!EH3}5oDZ$OG1FN=d-8!sh zip1pSd)z%Z1>PIaj5ee$r>U7XgyT5Oh#GBH)w@*2bo1H$dnfb6m!_k8FM>WhWftiB z+{cFQKkNt&)TY&)${*Y^lOvIr7`v5G!g%OHJ){p3Y>Q7Oz221^6v#A*4lyoC`DjDG z-5JXo&`MC=+&(29BtjhZJI2W3@8f@DwW`7`pPuX(kupPc2eVd^;mb{Vy!! zkx&(K0>S)k9+xb5gzqDLn+d5m<9a8I`- zuQ#Fgor^5A$toUQ>zv?oT2Az2G&)M>)ruu7C_U{~U~p|OwL-`rV#_msI`?-{&#n7C1|zW-Oepp-!mi3l0jH>{>^ z3hHV>nzFXS?KL(M!!YGfR1#-EQnLwL^9b4aj&iaW1Jx0+Fk6&YmnG`MPIcs;~EhHmBAK)8JxeePC` zH4q!KNmJc}gRIRLn#7XsgY53*#O6ynS>SkM`QCiZxeMpC3hyTx%3&n*B2u|k%xIF1 zpNi)XLi=Kdr8W%j~?SkPi2o^A~lqR_3D1u%vHsN_B1=+Ri%bJa{)FK7YAxF zat3+d(QSS~kHr{2fTSC-s@`+LPr*;lrCS{eobqwMx-s5mUC~-xzs`m4Sk-c?#?@lW z4GNOo+8lYk3$>3hVmSocC?hkI^rE;@ETYK&O8L4D8=sd3(4l-2euF*ynXTT%Eu}Bc ze{e3kbcv^bNPvBbg6D?aqvTIj6@_9r@VNZ3uAz^<2wW~CTD3NzGTSGB&%Zct_$M(y zB~c$sG*_C*CaxY<`&}Veiez6d zDZbu#dj-{YQ3kCpl;Z3HI*8f5H+o{F1oBlb^r9(<2G~t@(((ahHg1e{RzGkoye6jS zd4iwbTyE&AH5Y2ky`z)!WH@IpkIZ$*N6`s9+&L6VJb6!Pg9xQvBs)xwf!jb-fL1m? z_1O8n0uq8MV z@(xZxPNq2#^w7I%_Rc5?<+jqQgMsw0(K$;q^GwZtL+3a4q2{5Uy`V`Q*H;#kR+wFT ziI+zN3@r*gk#suYq?}*k0J}KHevaPmrwl`kvrxe|6Wn#g#A>uywERBhOB89{nX&)xzP}Fko|<25pu+ir<0^@ zajMEWE_M|q{J2)jI*@z)>7l8P?)vwFd~y>OJ8;;4g8~?BiTgO9W|#ZgCS|a>?uGrF zYT|3z+T0_FbgMXYvUY0zP+>Od6p9=ddD+i=-`bPKDz`cto0%^S4hP=ErP7HBl17>M z%(UR7vu9W)Y56am*8GUz_ca2Q=KH)TWh?F%=lNdv7Fg39Z!@uqnO&=3=p0{~`m)E! zNWkM1rsg*_dr;J=KHk~*Qu`9vmI#atDvsfycQ3^jJm)iPA1Uk|%)4(u*ryMMTJbaE z4Fz(tKe+#r_5)C=-g_b8DUrN+kLYw|^AI*`v(7m+Yk>Kh-;a~j1FGAh=f3-Ky7bv3 z4ioU1zyr_1^bAqYFI|GSqqhyrwWFr8?W6aTU0;RFrEn$$9JL6=yy%lBR6x(hVl^|( zFR7H|Bw25+0dZ!$%Um&mF=>QzKIloWMH&TK^w$M5VPY5FErRP=( z5wMC@c&geZzHI$jKle5EFKQvIV!tc6jVz{egNOSo?e>`3Ei$6!r)%nV$Qy6|uT65h z{z3`o&Uw~^m1LpQfW2%w7OQV#E|>K9^BHr+IFple7mg>1?70~lP{vtlgjbb$(rj~A z6`d-%oV97Axr6#X8wfj!^aye`o|v78#Ff{(-R2Hc&Y~tbL#@qBuaX>ni?~ETelLw; z2@CML^vqW4+6E#a%%QrubPFPk!eGuoHp0q6QJtVyw&oit^wHT;25ZnwToqFhxl=^s z@ILwzxzp(PQ?u#0a<%R9m~IJqw=2v0PEqvLhHv|HH8XQ+wOM#!I~W?T<{pOp({WgS zTV<@)Mz_(#;tdDU`D)YcAxdLZn@&a-_;U3_usrDOlqO4aKe}juRz;Gv)ptqK49u8~ z``*P^(hvIvEOOdv_YE>Pm+6V$N{rpc!n|%o?JLx`SO-!YAkVEd;cM-{oXQfmTc-Hi zya1I}`$b~65V3;bl-)KT&&jcBX|Y?KL7Q*A0AX(eCsPFjgN&qx^s@UHH$98}`d~Q? zs57sq7c8*D9F;)`Oub%0Hr~`6-9URCCcXnq7XF|s(^&^BJjN0q*5pnfo_8ytRE8(n)mSkYo7;x+FCfXB z#Iz$@R!|sbazz{GO4^Gk+`D}VwT{ltFLZCc!d{hw?ZRJ-t94}|pLd%2TnRno4{&+c zy1}CqR)UYiT*_Xox;}JLvS_UX(tGDWqL9f0i4anUXuBaEr~g@RH)i+kDY09r#BAY( zO9GEM&Te8C=2IlM9c1}Bbmz{!H3_v{Re4!Zb3;P4!I{v>Z0eR8=wP-BELX|`CCH`{ zh6*|9_4j=Tlu@{|8m!24_mSN&wYQ!%DKKkHoJd_wbAHJ;cq7Yc{6@$=M3c%@jwwlRinS;lyoQqRQr-sm^B8pl~7XUl8n=g#O zt7>o6+y{8SPvBvH7CW0|IYfn`KSd0|>g_n1@N%2ZbLIDduekS#|7bmSK$do|jN@P4 zHG&_pcaR;~htUY!uv`3btq0|5Fi%4~34PLDnea&tv~u9W5&g6B)yo94j}2ps1_XW> zgzRlFNMRs6k1<%c@X|nz%6XDcwYkG`0H+0i3?2`C4cd#U z2ppe7>!AVWi@9{CHXG&!=ke4P|Fqg(=c0T*!+s05J@)x?c4h6}nXQkX9zK27#7SPi z2I8W!l{?0ur{*7V7#EUel${&%xyiQr&dzu9dj`lm5}b9>!4nMKdd&-0RBRJa>xBk~ zEj+K_*60x|LtjCUG011BhJ%a@v{kO>*|2Lb1o~OEpRCZRe{iUnCa4xeEzt6WYvcDq zsnm%TjthO#l=35T<#B-`=l#BS@GN4QQp6C_OU5gXI~-c{*N0v4Gi3o>T=2g+URu1C z+gHj@(GtniTI`kY0ovNG#Bf~H#cvGN$^p1GwD0kPFyvZ^T5f-79~2mG@_oFDi7Wk) zYYJTZ9MH{17#EF>e|NgK2HhY=+k=}a2Vjma7~#%YWY08 za1e1JwOGbRzgcB85NLwCso~q9Wk6#cIAT~l(zt(f;OP`CV(>;|j3?G+eht0(0|hK_ z762@9Y~dg!{ry2v(CKtL;sxLWQ{lT=OT^e9q%>%86_*7qj`>(pszKE==K3P4m&>Zf zo=F2s+`7Cr@*IH%NF~SVumR^hasC zP15=htt8p=%a)$X`0rGF8afy&NZoz;%nW9lC0e}Vr$293Od5*Z6O#^q^tRT0VGF+< z85jF7K;FzDNt4#TJ041A3%l{{fcIUrUx1#;6}r6a`Bh67>n-L+3`T-t(#u3+m#X7E zI28`8^BO-aBKf!P+27u`?zwmd#ec8xTmiV3mz?Pp+)CQUlcLIPfz4l^({`;%?SMWCP7E=B)Mdf$}lZL6Vx^Ewi)99KX z_V$eUI+iNdYjN4ZhJ`7%2{WeOv`sC4p8yO?FYvvZSdgbUixL2qo1c>I0w-MfX5=6C5WW4wBJm8Dg(<2HT!lp!0**P(FAA>pd;5YN z<|Vib=FS`O^0|KSqyLz0!I}PJy8n3He2o7mVE==4|Nlx8@1d%8hS5}935wZK!9M=Nr z!hPn(ju5iH0!!862lI+1q89Sa8Dq*sBIim3-Pn$}H17oU5x69@{7bUg#+Zan208}Z zNrSof7-2s_FjCt;6NLF_U}qYI-2^*`FT_AD!{=O0fsaq5Eu_&h+7$5(uxO8~M;4Et zg@27~QRlWoWaVCx1%os4>_Vj4LQWjZD(73mCcg47(U#`M@!ST{5A8PM!6%q^F!AW} z8B>FRraHJ^RPEhbHgj(ySSXu~4J_94Ur6mi4g&ZY*n~It)!KN1e1}aTxb)&&cq#CC z$=!>&QhTo#q1{F&)Sx?LY0dVHGWN4!*0YJ)#$(8!30RwOKhO#9~BD>m}{B|pt)@LQ01y99(kl2^XYMMolv$^f}`?1Jqah^v|Hof!6U8LVwIaL6uuQ)~efX&eiaLQ`2l*r?v$+ z_mXt%#DMEa5-R2}{!D1&Y`3Zn@1PF^0T!BN0g4I-7FgM2DUbOI*d_M4t$R@hFR<<~ z|HdicM+6<>pyQht7-E2Re;D9lvte&pOPOLIiL&Ctn6jvDK~dO930Y96Ao*qBw_um+ zP{CujnGUhgAi{63^3LGKIkywIM3hv!4XH~CruC2U_}|;jY}|AXdAi9<@Bu-XwwiPO zY)zO(!sgx-6B886fvy&HBT?0WY*meP+A@R%v1|ofP61INtX`ngz?MIX$<*fC#Mai77~(nn~l-vyDh9m{T@@MAyUrYv6Iv|NS}M_nnoVv`rj$ zj?Sl{hw0q>0ly-DbzDicAD%|@FVJH_1^D^J{@2udL2}yA0{|O^Oe8Z6t5+5V>CHCx zOp%HU2Gl<$7fUw`OMyTq{2ItiK&wfD<^m!AzmFhRR|J`FOg>13d}eE3_L#g-efC)X zt0{hlTs@iozx$=mB;}9QM+-2>84T|{-pi}nE$N_-TEaOz)}Kb9`vLAh16!9} z0IK!syBSjG#;o{>sN8eeoGOz7|3X-RFPzn|l-=pX7^m;e>M}EtH~W zLaGU3EQ80-0pu1${VySSdyafC zjM)+)+OBg5yZ1<|+Zg<*e+SyDmi2)6}7HVENCd;T`lIlP8(HGm&%j7g&9g^4hz z@Ux??`FbJ7%fOXkJD^@YSmpMy2zEeJH{fMs@~cF8(M8IY5W=j0AiTk|uen3S)tsI& z>$ai;XAU{m>}7&s6e@t=yqci0j+lCz8W@ShCj5luiup9ES=WqcX_ z1PV!cY4BG1Ydj$YsS&&Tr`$=Cfg9Lj|2DmS%HVWJl(Wtc%L|DtaarIJ%AEqmiE6jo zB+DwdyQIekbW5$z*>)4obZ!}Nj!G?ENQ5A=YtHlB=Nd((umEs^MVNR%{#_mYWE}tyjhF@utUoB z2VMql25`D6nx!Eer3?~BU;UIOOa1%NogV*6nSsnz7>E^2+p*uLK#}{zFI>d%i478) zYcNk6ZN5g`xbO2z`5yVKyF>?$tJ|PfjbGz{I)%Cpt4Bsn09vWC7Ad`4uASR!D6L~! zpN$6#!*q-G2n@*jnFZKV4fV_51SB5)mNGT-H3PWm!p(-1=R+(o+xxo3dV=-msigR) zipZXyG8AlY54GX#cgM0W1SkI3De2_xjP%*I8`U;~F;-@*;uLkd{U;XWpiMWX75**5 zw0om_E*H4T+cVYiwSL0qo%iI0Qs1kG4B0OBx;^dp~i71KLpmosdM7NRHF|SPfw$9GOKEy zyB^o}Ro-#nPVa+PD=Re59SWv+xIfQ#cia#CHR_D+N+%iTflm()F={SRjHI>|i(OFP z?)~mbU|SXRLbuw7{0=EK->qn2$mtL)RcM`z);>L>6_iYt4;$$~jzq)f%hukk}gReRjKy z9kkzYaH2$`i%Ro7!d)X;L38%X1CxH?E=LS(9U~2Qi*MkJpKnJA(L#3E!)uzUH&!wm z@+p+HE55L4-OchWN;tozC6#dWO$FIK?ZfZZN*Y~;gR3v#nw?-g-P=Q;rct5k>QwC< z^Qc>#X?MPpSdrmu`M>ecw^>(`OI_b-nC)A(3sW~MCKkn=Ht~E zmEek;{Q(D(WxI4kRddYS?0h$*RLD-WS~J}519yCxxVra2ff`3rjscMY|Y<_yjQcS&o?<5R;tawoSl=uH7H zTEw>Peh9m#3ijIkYY~ieOOOQyjic|0^A#R%5?tJBwCdT3lJ{~luI~fZ_mZC1q%rUbIJPV@5yKtT&<$OS1EjBi zVBTky62cRUzZoH_xf2>>cd+1^QvBg7l73s$Nf$4N6yk%FZ9kQ5z5dHHz{Glo`cv%Q zbeO9aM39^o|7d;*^X2zoqc zj?y(Xb?cfpH^5^A&GD@ejEpqHo}K&RRcLWx`-`}(s-Ibfn{p1TBzoS5Miq=+j+ZD%Y8KD`{ZL_fc|=W*AD~f20Xt8_t*vdZ{1vTK z^L2;A zD}OKMmmZ!rMrt{t{QXD3Ew8?6^z1pX?sWZHcJu7=b8dxU8_qbkfxJvHyB@rqovn}R zk&+0&4tP^b_hjrq9tfI1%z}dX%o06dgYGrO4cdC}`+OfeM72#Pymr;jlvS8Jw6AwL z)T^j9@zi+S;^X36^d`ugyQ)sQ-kUjA4JSG`G;Cc}F+nO|guTbkRA5X|D{Za| zHZ=Z*dK0~Kg+)g1d5LK7{eqze`LcsGAq}5S65z!JmmE)J4iwyW6W22&Udi8_UHq)g z@g?u!^$spaj0O$uUe4c5eAFugk_T~?Na~pLDD(tT8bUz8fhVJ$Gh6t*-?#51b z@8g`&(RheL9ykv)A3VJlfC@vI*f4%FRWL3unCxe*|F`iWr#aF$Y-c}7A8ye5>6F}2 zC3I&}dy$ls?w2exWCDvq4dbkpAZ+ZTG2$=zoJgLW31-=O^t=SLF%I+K%c}kERo>KT zseL+#wrZ$zZENS-6U6qKiG<)}+pQs$c|V*_wTl{X9`j{QF!I$e+}GmctCNmn-a^s$pxQMCUCoVJgtIn(OA(qacc81zW zg7ul*Ot~;6D@^c2z~g?)5KO5JSIjY0cV>3OUS$ah@0I1bof|r)c7N{Nnr=55FBhHm z?0Jp8TUG&J+|@?`$46W$*CTDXiG)h9w;ZdYIjdT9C9;6XKe`b46WbYSV7#!2X{___ ztKp##6k@itI<`l(D;B>yJ2$y*XmsU`#dP=f zoDA2HXSS3tVzpqEbeX8p=*UpZ$@(S(>iS0Z5V=Q9KHK%ArAOGEa({nwk|5>N@tN7^~1XS?OWT~wz647>z*~lY~1E{^R zI@5dd)QF|*9n&uxgF+Kha>(&g8J8nFwN=I*$$72@)NFaE?SN&!$&HLT*wY=D#{$%B zPb$s)Du?bG$OAps2hA&bv^)jax_L!=x96lTDr(!KDe^zlRQCNJM>01XDV>xXKBM*T z@&!9@P+_)_jzd&TY?8NVq0|(F+=Sd)bmjyi1f8Wm_f&U!zumk)9;;h#4kE(43fz6V zdO{xeHxO~~^#bmO&ZJUOgCiuaKiP`?`F5~gj>44}1gI%-ZR@vv*q7gPb?4=tk}ds*PN4 z?U#Kfv!1unrV*U<9P|91XVWHqt)qdX=d3Vq9rk9ZhgsUtH>ei`k7jNd$P?Yw#`M>- z09x9VLwd+#XJ!OnLyl4t%GtrZO!5g(ePe3u^ic2NfSoD1N*@!fW=@Q<^Pb(TOxZ(;tZ%AZJ|0PGv3+Li zarjQk)^zo0Gl=y|-H)FL@0Y-2NS9Pgn_Oq}K|PC{sjuPeE#l#%THBDfYg^vvkrv;s z`$lkUw(Y($9cv?)g_f)Hc(uZbWKCnO{{{dViMv`@iM#nQPF*SZPy`C|ecInr`D@VG zI9nZ>7?915$0fbDP09r&Xph%D@|+M0E&=EUa04Z!qRi^NR|KwA36YbucbV;%fVT-* z34`}FYg$H2IKtz+!Q})g$euHgc_EEB23o8uPjC0ndwfAMHjhaA&ZiROJPfl=f*fI; zH;~u#7;9NCnH6R9!>>*#r67E;M?t#_?)iEB%%!xajUE1hORb)M^l4A>ajIjuPELG9 z-v)*i-m2-2pbkcP6mfYOKnXYMGpb&q5&Vs++uj4J#hY^)Ql}e}pBKgXk3s8v)FLqM zq#hs~TQd(#=ZPS`u-+tOop};{OvPy^{Nb5-_xuC&5zgN@ zdB5;xhBzWjFQSz;Q*hKLajJ^J<&|C<&9m{nWF4ZX@(vozf2HuE<6_!ZMzmYQb6NsI z;jp`e*q>>ywX*PbjE7mblXFq8vLj~MbH-wxIN_lK=-V}~@3MzA8tqc(Rp!@%s{m14ZiRW8 zGgsvvnIn$SJ~#OWf~2RZ0yW8 zQ?E!=2m=??ou0H+_v4jSe@*pv*9DhS{(-Sn311hzy*<J0QKyO!*n`Zvho=+$u=oZO7a%c_8b3$9?;b#WZ2Q}CdS#Ji z7}mSA4!_mxIBve)qA2t)6=l&Xe#@c1uPEIjF|Tbn(=Rb*RFc=ttX7k246FAz2uX6D zqXdtB(!dV{SdCoJk|_H{mOWW}E~>r;v%@+;PU^fwx#wTAc52Ur$G_k!|i{$Wym^BQv3LRf-KOB*}u+{;JKcYcHr-wh4wy( zz`C^kwDxK9s0csDdmm$NHg7%#A0Q##T?dVytc#pn$fuP6)m8Bl4Rd(q)5Wcl#Oe#c zVH6Ei2Z~(Z0z~;SK@ya>{A?7dVKI*?3|@C@UC5Qq6Kt{bf0i5nejY74q1$m>$fl{^ z_5Q2t|HilYhmdA{#tM1KKEVBYpc0`CcnN*=KR&Q{96P-)tgmtpgcl+)zZLL>7+_g` z7;UWdq{xUPFz_)Qh`}1+a7IB}|Dry!sRvkjBBUCci>gJ=;jKo0(!SC@{bfJr&3}`y zpJ7-1^_RR#XY~?L_!P>@sm_TH~XAJgp-xV~)#mqrdM+TD03@P4Pb#KcOYt&?LuPoiq9p z<|Ri}|CxvrHoV|ZT$0WE$z7&0n8HEm^}0^8=K8^1uhVq+>3W&3p9 zSBGeim%M?7CY~`z82fceh8Um{F0q5q&`0XU~h;>|?3} z<%%Hx`{%>7fPRwW_TI3*1JlMc|77@Ql_^6cBjU{}x4bGx@QaS?!?FO5ro<&R;J-c~ z!KU(5M<{tSLkI)@LjW(lwr1jXX^&^W;+?BtZv5O0NS|Rt?sc|j7NO?ugHhvx0N$GElLpE5bUvBu(Dgg+~NJ~mSScLQ*Nav3sxG1aW zyFbUb3?~hdlxLu=J)L;z%#DZ?EOzT29 zsn3t+y=<=rG|Q!N)o2X$%8kSI!p)BR?x~NSGi|rmP8j$XK62JsB2ibGyT)7Z8z8Gs z!0Y_xH>pyi9bFHB&J6~2rwArU`WI-v2Y}hOe}ZNSfgm~G z%IAT1omjwwkg!m=Y>@`9#Cc@*|SeYzI7TJ3E7L#_Q zDOe76FU1^@!Mo#lLfjt*;Pe^6s|dOl{qwKQlGxaSqm-J}1u9#lZx4MHvZNp>(zJ>bVtL@g<3JI>d`9VP((K2_^=gPIb@Yc^Wh=<2* zXU!hlikz&v*&K5)MHt|}&tbuLFGQ~BR&8y#>}3+>02BzbZ{+a1#1VO5D9A1HO2MZ+ z3GVl6+TaBfKWZtNlKmcF|O1UKs{oITQkM*YGJJ=;3mz3{LCV$`AM;Rzw#~g{z0*59l{()H#{uL_H~!^Hny)% z=T1;5J&b12n{g9jeED8|MjiRh+xI35%tI#A^0j zi@F#$6a(<;ODoxw`3GP5A9}TXNWK`C?j|SLHV!arv)vRyZ6XAh{WYEEerl?+9VBI%g}4p{P1CW0JcssM~H}bEYdN;98|z z?*`ns=~{~npA%~{)>;a8-7IOel{byA7(VPVC@&G$+IAf%k@nb8UGy~Q|LDfOvA_s73a<+iVf{Pl!p?xPp9LG{>?zR*9C0ZMn7VdOgHt-JM~Nk2Zy9 zdk`yC-X}}MOG)hF#o;o{@2CUydx6=>{cm*V#trx!FXXK7UK9rK*Er_mh;5My9zILe z%*a2nwq&iPJoBSRC#Tq{F8B|hW0aJ}TN67L+e-3M<4i+GOhZz$zTvJsFrcUs&}Xr= z?UDx4x!qb}DfuO@s| zRb3NOtd2=_*jcSX4W(udn4E}hwf8N4vQt~Al+wx^gqcBZ_S}K263KlJ1|=KJ+7MX& zY^!|NfGz~%5h-P6CLlqxW?P*jJyJq12s^$kBzC+(8YM*azKm5rTF~vj5m1zzm%Mc* zcvivrrl$AY37r)24$ULBoyRO2dyhA}fn1ga`jjZog9+PkCt16`4ubW3 zGI68AwgUA`8F-gmri^;z8%bc6h~C+;yu?8US(Nn%-T8e>oXe z{rXEy>p)+tw^qUl(ASfy-XSvfrKm~p(_LX9(7I8t%f&gD^5`z&dEwn+!vszaiYeqZ zkY^_{<$3j3-V2hk&zT4uM3-@e{YLpgjI;e3zuggf^RUr?Z(mn%QTBkb=Z!-%b+5Be z+C~2nvk>$5ygF+jxs=wnJ3uG~AL0JMRH|`>K6So@cI-S%PK+BP%3WUYHV+J(ZfzX6 ze2h~BgZaH^d7NiDSEr2PnJ2YcKmgK%bX?$~U$(bT8_V-1Tm>{Nzmp!Sjoe9^AXz*$ zxUxbV5pm;Rj$Ayd4agR@8>ib?C%&ABOZxhD|LE!j6rVa%sqi*0%jjcx>z7tnUp`*R zN!BWpI`^hCv?fR?)N~n-Vs$^wr4KxfpbH*DK7PFmpK6Ipj< z{Q0xKN1|3oSibxPAD%S+jK`5p(MM{ND&xKyovEe(okfjdDfgm^>!9`n>hF1tmcV>xBRX9qS%RLb4`9n7^fv~I}% z(7x)jXIp3OZ$7#id2*=Hb4ukHaozZooSzkU>C~4#T(YY_#cdSeMsWbwC4K{|^RVG} z_}^7k$D_Qm6V8#0K+?<-3wk))N1}(A{e;=(PzE^l0=`-(zi9L zn6JHj+IT|qZx5zFN%7jtV^%!Yc~Jn>+z3N`nLHT!#aE1BwL2q7DSvue7j|DYxyEMo z>XcJako|42Fg{j(wxBwoo|g8|x2sHD@O1@>fd>l&L}3e=(NeZAs8iBZcF?=)#`=-( z8$W#bI5KG`zyg?z_I8u^+VJZ5fpf7bsy`dx7w%nT%6wl=<{I)n{^Pap07ibIkhw*H zm;OxM5s`GIeRoq$(vK?yH|}%NM$%_!5MC40&pc#(5exyGDkl7WkIv)0up%fjw%fW` z^-})97Z;aVtWGy^lh)`{${+el{lWvkTG;PrV#Do>anrAyJ%XW`Ft!K4kKP6@D8=^f zvU)Vf)O8SXThQ&r7Uj6Jum6zI@EFYAgMXx>Za&p!>-(g@$s}X}uRu%L#EvfNfklGU zV3-GX`G44Z&#{p0;&>+tr}LfiS%1IIeN>r|~40UEQ+Xl)UZTxe_7n|1gZsg;Lh5Ru5+U?`?Ik#1s;iLm zAks2OTXWy*RmJE`{A)|#e7*;X?k)t8Skwl90XUR9j$4{EAhF&gcRyB@4h;Udhd}<^ z^4UZ;W>(@!X>ko|wi&%J19t6xgrqB(Xc@k1QqQ~lNH#psZ$+kPk6DOFL*hI@7W@t5 z{!y5-4g+kHMEM(moR9sDhTQ!qiz0)>ygH}XY& z>a5vr{yl%&S=8?I-0sW4SpJFj>q#ilb@Q}j*FM-44Yg()9bp6 zN?!lOmc-}>oymrUVw3vCuPfxY&?8fIJV})q5hmQ8;%2SHq#qk{GXB4<*i3h)DO`U&5C>D855xBT1swrRQ13ow8sy(?@z~@|H_cG1;?uuN z#iHVsk4h^|HZ|%}-d&_68k(M%Dti72SXLtl<-OpV8=cxkbr6Ng1z1u~lm zt%kfQ3hJf=0nqVJd4OHtxy6y+Ho0KZBVqq(uvhQRrr-kmBjuZ zN?Ao}RCtlUMIm$2p6QUSlNzdXKWY_OR6{d4YoDM4J*-Mr$8pNd>MxkVckR26gGhb(f7E!~_9 zdwh-W+Yfo<$Gs`dtKlnldd{R)ne`;1!~sspN;=8&)>fX(VSVv!JsUEq_0mag=i)OU z`c(M?xvLP4ZiEiNSac-cjWPDqZ;>Wo zk<=@#Q<79^4m^6e!rst{tFvZl!E~KHrYpUeamk*c{JfTx1#zCRavK!znztXx0?j+< zMz}PTMA<-di>C=!y%p};lh+p&XA}KbU3v0O+kyX#;8$7)PUTSrfb?sh30yx?M?0i7 zSPh_)?NI@eTh4FU|4@frUsjpr0bA_v?NKX@iVGW7s7-xbZ0S)jufl1>tj$hdR&f~K zC+x!(4Ya3bVe22bP+3J6?hF%rmZp(9SAH^nv`#9!vEh7DTzk+4ayq zUa*R9y(SYof&QBu;u5y!Kda$EW1p_8N3T(dWP%tT9>>^B#qbq{6vS;|ymA04FW|@d z=grSRaj7|hl70CiUdn%l5m9|5U{Qln^Xv&xM$_k;m74jL8G_|kjDMx_ zz*AQH!EM|dT>FN~H7i}C?^kdi{QGb7Hf4wB0oGD^Dzna3-PsCrqGGiJMhn`rG90T~ z$-TM`ek#t`x138eO^z}A{3poU*tkclW2gRInD7qie@DUvSopC6HLUbYRN0SMgX$M) z8D7uyg}fEGYKqLS+yTT#7pUioHmXmEZk{E$+H^slD6G^zC12j7j0i(Bi5g%(@d~%$ zx%XyzJ;2|a>0Cc5(*DO9GSel>nrX^icUsJA-HHjz1ZDT7U#xSZqwKbTp9#~i!WKdQ zChpIE3bi`45IRfsp`U0+#aK$5HUAk9iIl`NZS1&!Pz-Iq?nLUAtv*UynM2VPBx8Nk08% zMo4EEl2RVqTAgx+|%zj4n>cpcCEQFCih*fp=w^>36bW=}Dc#*5j* z-eMRzRa@x+pjg%8lt)WE*`$eRKB`AEbyGJKszYdEW;%fES|G3$=88z}&WN60Q9Moo zbXA`$bGbP#Q-3ONrTV7pwvQ(Niq%)*iX;qHN6s(-p#GVz@mKxyPX_uAaQ?qk&6T%J z%=zJ;$=hW|Un+vv{WSe^>+xnl82&eDdWRr0?cKkTrc3%wMSImN0@io0*vFDc#YXcR6`l zu{OA$>YF(CG*O=D;{eUF89C}|5;0XK^p7JcNppxBZlXc!3_@zg)d{bfL zJ(`!M-7mxwZJk>5>C0fDyX!*M$df6zyV6i`$un-CR;pTgRCMA!>YJNx=7-kbUC|1% zi$x20N}Spkppy&R=I~+So}?a}y~wATlz!Dr&H~UQ6$v@7XCgxE>VFZ@{qGj;zsMQD z(BZf9Nz_vj&Fn0_NWH4>7t&ReRi~?&7=`NTz4{j`x-PROeie?r9N@n9pNaO(;qK8y zcrQ0})p$8NUr{_+2V-{7OEScaU>q&BZn|W*eiPmC!KWXAa~&-0H@py!3l9-Oqf*@5 zJ}cJ63UnNlOkT_Yph9NFr^c@}dq*%q1Dezmcp<{}?uUQK23zmiw#I39NisAYx`ht@ zsqEjVCyDkY6xP){l^Rt;c3dMb!rR1z3 zW3s{<*$iEVueoUPD1i?Eup%-ehq}^oDp&fGcmu*uB0YK*kDjr<;X3-Z=ZG{~^^3$cXW#d@9(>`$$tJ}&)ZqJ zu)isrepnA^D|%mqxVTNIG`!%HU6ySY-6{0)DBYeqZE|t!V43N&*?I!6giwM?zbyb zbbe`{13PE|Tb$-PWzfILgaw2rD782>+v<*S=V>}O({=GwQz~~A7g&Nf=qn7Vg_&?v zoRV%R`n>a&gr%;1aBpvy#@{iOXV8BlUSp(o*{Xwec8mj{_mILB*}y-$hdO}V8jxFH ze$b+#j%gTyNGnsWVGk)*Q`^hLDd2$4$ZwiwBQU6>FW4bh3`L#+y6^p z9-~TEP-)y&Jy;k?XL}7f#u5*1UEvOzylIbDMEvR)rn zq!NXSg`>1uD>zDKcm2sbV2P@gZD!I`wW_$H@iU~zXg@GihG$|Pc{HbaLc*w`p^k(S_Y)N zk7>doNoSgFuzoG@M}>cA;{M=k*Biqm0io!aE$8=~6e!DVbRVuOe#d%H-+%jbQ_S2s z7W3-OP0Wr3h{s1=Ejz)0pLPdl{H2&Py%ZqJ`9o8zh%87Sx=(aJzCEdG^S+pS_XU8)DzTgo`zu#nZd~BjH?jFy<(GU3X4gF!fD|I#k-3slN4q z0z2q47NN8A9}P+6JZ|1?LsnE-rTA)Ubdg(>*~C(uPQTV$MLk_YdqM1z^R}JJImnyq zK1O72nG@)#w}f%Sb=>V=C|%VVI|RWu_>7epd1gqwLc|r;DZ;=b@uY&CBYCQ6T?HJb zWRKzv&2}o~Plp=c{pG`dv`R^O+q2=HzggMMcq3Be+_MeBT%O_T!KUJInK*43&FnwxWlYV>n{~Bg*z~L?pX-XQjq#ydIIRa zd;{P=t?87z^MDL}pFz!eo%JL3JR1e%+8OJ;fOM?X<2akMO(eZ&g5w3nTT(rE|1J$kj8_y?U&E&2i z-phf(v$yyESO>xItOfQ`_2H9$!ZWkq54ankb2=Ul$3&;(#0o65Qm$uA<97mn!|WpF zqYpc*(9^tak1t#Y@q0KzDKe)n7~%GWwO;%gI|wWtyP&KK1oBSM^0xWf31^AnTGjK# zR}%Z)n3rGdO%kP=lwD1#zhb|tU@iIg<-sN16S`p>xe-7E^DQU`urE95?Y~_O-!GK$ zt}XGb2#9BbKSUz~$CZb)73`!dQ#yJAat>%}-rXIqQC(T}VrKtBQ+MVi zH@gzvj3+68H(1J4S6%5xOb2G}+!DCtE(H|+I6^zU5N`lWs@X;A4fBXijQ z*j+25$rzc^rYV^HNX+E`1bT>O*N`fTmPrqn_Eg0+@3D8GaO&Dfx`kY+zG!{!uM5}yDtzO|ZuiRA zIbqWil2^NiC|c_4=6g9#VQS%RpIc&*o6E!pUdSv{D_ggN`%_w`*9Q|$r=z(9MBeSW z#WDV3jh@$G^ZE4MPyR&RjP0!cpzrAv@bA{$o9!XagA2Kk3GJLv)0C(}KGrYRoLjPq zE}pT7;?UK5-v9J7PjRzD1A&G>BcM+S7a;z1I;{9!TQMn^pt6vHVOR2u^|^JiV?V@)q>+4LHtt`USb&=p-%2b?S1o_G0n{Qu zTcO91&@JVJTc>|qOW0-e;UVZ*tv&`EsCa3hOIfOk6S!frI27=SAD;04S$q2bxR~P` zd5C2f+;31M7cZNdmPoux8>J;(@)=?5cy_;Q{c`^hJ^?=EX#LQp7x*_y zawo9-AC1b`I3QMr8<|`Hoe{7aVM!4TT>fG}^6~wtVVzaJLq$kLs2sSjH>1S)U%iK4 zHrl7OAbTW+s}?svJa()EBP%hbC9v>#R?UY@=XmzG3-RAv=-@A>*=jjg!V%bSUo&KL zT-&+*w(~YW>_YxmzvT4FMw2s8P-t`Z=1&+(hmn>(wLs#NAc%K`KE9Z*2I?mq=8%W!$AuljDf%nQ#;^d4~d?@t+RLoq|Xne700MYedAOE z#LMs+Ob(}Q&YZwE{4F^?2iW{(Px=|2O*$?J@GO6uy|WMa{vQtBIl}|s=@*gb`Y5U^ z?1)@&QF9BMIh>_aW#DIL6geh~31E2)q#+J#gchEJ2rPV?^zOT#w`B$h;7&Hj%skH9 zoGhaRT+H9+;{ccX!{IoO@_-Kgmnmc->f4*$F1*en|IIaRSNXl!X`}dt-;e|ryBWsZ zOh2jtzF+Qb_Tay{f@6dYliQfAf?O_@mnJ$bs@v-K#;EJcbEwqz?f-B3V~)8KlnSse zv8}+hb%${{_P770jcx0k3ld%mWi(H$1Regz8{#DBQHsk_;H1cLA8*q|L87X-JE3jFK; z=a#%nH^0zE*p^>^&2d3`^P4z0-fXSP08g&q;F#QX08vx3(TTC~l^kO`H^~bQ4v#Hp z!eRa0_Xn!1oV_&CTlyyV@)tsETf zTdBK^g?a7>su)CIemLCud)$uo!4J;+_&81%{Vx& z@7_WwZQjfM0*g;JN#u=dL`sRx@K0DD?MUF zs#I;Tc`*}?NqdYUGsNZv0)2ch8s9h5a2%y$^^lB-^RML!3#WXS+DCB%>MG%)V-^PG zC@q8V^u^2b#r!CkKihN+ER7#d|8oAm==}SOif-i4Oiy6cSwexZeRal6w9SD(HvoA% zF5Dx(`0YXAwl8()^|zF6yk+qy$IVxs7#Xxf7}UOzr|;JnT9`f&eC6Xq8nnDK9PN4T z4u!RM70jjw_Mt&oKH-HBM%MQ|S8P23|7>~X0JbagCgJJQT-+k30r31mcEfJYxq8|o z_}1fQ#kb$Ra#pJ_Qh@HF)$*;8>^3ZrT6Ya^`?n`P zzh^zl=Rv1?kQ@nO@(e@ewxz6vdP}EY zyc!>edV6ayDD`1Z5i86?WnFV8ek<=*f^xhJPqz_y_1=H&(E5GD=4IDkt{4JKY#QPP zwYhKlqz-Gy#G;Z$DCNY8j}}>S03+im@F;%q#h}1e7jQD|qK@r@mKv$L-TDT@I__n+ zt4C%Y3`9|gpN95S2~_4iPb&;AJ%rsaic!*zvQ}{He{GM-I9LYa4REqK*&qsc4sX3J zAJmu7>3x*BVE;;`b1s%p8b&V?7^!$EZP~0?+ z2K3;0%ET#(ZNh7j0{5&oyW}*wnNybBop*7)*9Q;C(M_8nl;m>w@O1VzfET-UwcL)H z90%WyLOcnQboFuZB2pJWlAB}}H25QL&Pi~Q9q-^dnyXv$B8~gvolCu>{ZRdO*SaN$ z1=Sl<*>;@JoSS%>Ls`^|8(Q=Y;UVh;5L;KR#w%r^B`V!;acMp;{UE&Y?ye&KgEAxs;1Kn{-!7Zy_rM^Do z_`2Su_v_Uz6>uioml=p2iboK{-40ag_<3H_J%E+T&g>Bw51e#)#{jn?E(*JaYS`fw z`G*;uLl}Q`O^+_ek0T#yiY@peYUvkO26!?3qoOLh2b~p@{&bNv5pKtpkq>OT_JpgB z+X_L?Er*`>yC$p=(ok4W8h{{h@R<5y`zlDy*l@46(-$(lRC0KTmpCdSlk5=OORn?R ztzCZGw?9H&L!4+{wqVxClk;1>Vk{?zi*S*T@b1gjEYrVkV+zg)2iq*R?YgqmJwLnX z%yeEse)j%4RWyW3jBqZZtm4w?O#_&PPDupx%&x6*Y_@h=#ID=Z$>hQKv*(|;{+_<( zQ7nBgW;&%BO-+(^9dr*i;H-+I2Pa|kyd6IeH>LP$C7qdmZP05N=4cU}*-!OxJx8|g zlC^CImto!4`bXhS8E;!(tLW6)GuP6&FV%6kQAQLPD&PjRYEVO@2t;Bufa(C}&FaOlgFyWLX>?Ds<%@OTCtWOZ1j3AqvwJVVBcE6`0xT zIf`UM-JT$Dx@cEM>s*WzSOnsn<0w(7Uk>LdTeVgY7ulxNW$`8<=i@}EFHMx7$oKsq zb59Y@_v#j=x7-ZI3dEf&NqI&!WHFlNT7@5}u}&jK7ES0XLOCoILmMq!v)i8_ATwW| znUfGUqS+~ZLXlq)hQ{Pb<|P>{Dq3ijunAyHjQkm%yl{*shM8JC;+SK|=zQs2ks@VV zfU2J_AJ2Et!%4MzU^RqtqeHdG?d^ACcJr27^1Tbm^c2@mnxkkJeK-W8G7XhI&Au_} z?fspP_nch=TWSpx``WJOYj8+j7Yv=UpW-vcc~SYI&lwSH%7dqzafU`yAHRbx#-48q2fx`4pOix<>W@D_cf%x!KZ#@8RE6r8?hV6b~QrExmGg6^!tMStUE?>?gydRbpnrm9=XV|$>h2WLpEo%nq%mt;fYn$XCc%-}g0 zv3CP8u|C$y8S^C-R!_ZgurA!e#F9k(vdD`)l*cUxmgZV%m6_j)B?moQ(b@h@Qw0vO zeXxMtpn8*hLi}zoG>uGJ!kJq(z+xOGVvsil8X+tJi!Pg$Qdw`|ZRA1nufmK>CydOi zr$8x8;fa3Ayr*8iz05N#=b+s2IVH}k3E`UQC+lD9#N`AAN4m1;AL^K@eJisR)&8B)yPlg z+1C<7pOWI-Ae*iFl;0wDU2wgQ^?a3I+kgM6dG$hxHmu;KIwg>T>5v>e>z3kaOwfQ@UC? z2P{utV}e(C`s!Nu3$k-4qC)!)AW%61nT~`&Z9*F>zV}{gd!-HVEqUX*Lx|Yvq2NOuQmKIpX$+Ld3(NkP>l(H_CI0b1yif;c1jajT%CHm>+?zih{oG{Kq0 ziQ3XM>_`G60@O@HuB1#G;NYH85RoSpk4f<5=p>sRh1Gr4hDlOfG-z4Ur zwZJA}9(f8+N670Z>Q*`azC|Qpb=02c6efZ1%pT}) z`-K8`XD65Ri|-n!_kO!TBkPDUvChBjc=lNO;qp+gX-4n6nWkN&?z!R#I*Xm@*w9Fg z+w+D@|D-egH1vfNKX?2WXBqqeFlcIYGVzU%W&f8($Cwxt?`QEIA2^-;zR zwX-WTV`keYc0Idv%BEvyuC!3`E|Nm~@0EQS-8=`0yO5LL_^UJn%6I}IrjB>6C2LE} z0$oOHTo*$$2;um2#?`4)#pHYC`YZnUAwz-Hto8$1p?;=ELI=rU6uMDobeevaTYL>n zLcTgpL}>BLZw8mNp($DUUC)u-N|0+y3Oac4=_Rwm8+(K&N|2uX!c&gG>+-%>(P05J zQtBu=Qyeh;QAb@=>@Cw;vRKoh&Z%%yO>I|bj4?$;mU;eMK20VK~%6|-(9dalrXL%t(4tq5C^CK4Zx{5f|4Q|55PtTR8`34o)oc8{CGktx2 zU6pGpZSp;H4|c*o6R_q%h;Kxy2#R`*Uhu|0zWP&PI5); z*pfCrxwEwWJ`@_lnIQY}8b5F4Jy7AT7t>9WmT?KDR~o?@`;Z05oI>hzPl7V>h$N*H_|vW~stS zw;uwX^tJVi@@L4r@1xwtxV?sf_@&B4l=&OLGGNyo7q9iegahirej@#J)pilr2yP&U z+KhJ#j|)a2I}zz;jf5J`h7`*!X2;KzW8@b=XXNsT%VP0usf5MlYi|qk!b963B6Q!v zZTXx+&JLh-x%irzGQk^tZv4?t$pEB?4^L8~veg9erA-U|zd7nyRyzZ$X}cn(y$B@IeuR zsTINa&rY@U=OheeED@_47z(dec=Bty%*_?{!D`l#iOKItB^Ne=tH)IMQBECe8#)4^ z`fI~7-HWEIMQ76T8T1#GJTK~>_(R1jTaOsfxaLkR8fY;cO7?H1Do)q%a;z}*{iKngh8ka$97Z$H24rHpJk#&K;)3GGrWC{68xe*e zoTGyvBX(4RC^eK}Ro$j|d8)sz##i~{h*7F+hRIo{gY?9{Y;SG3W4%X(wJ>zI!X38L zM{4TxZ>+}Ghby+i!K&6}(u0hp9J){-y=0py*F;Ig`OaS_O0a#RC-}dyv#wb6L)7}n zj5>SBO)bwWYhn0uZIANE-W*KLRAR*1itq98JU@#pcf!$49on{o`DDlwH+N)c#k~Km z5YdVBbZ;$oIKhPNYZ^39(xRu6Ds<=RZ>z#8*cp}ub((1RN1#!Pr9#Dp4 zUsi)edAx|uSicN{`o*~@%7pXQ5J60MzLWf%Zl%2q*Lm=ajI=4 zdc_`@$VJzH5a~E99`r1<%Szb3R3xPfe|||ogP*Lgo58hj; z0^|Dj?Nxk!Rj)6m4|N8xz3^TK&@0j&nzJzJ3eIn1-bweSvf@irN?5f6xAj>p0;6G*-ZT2n1%7z^-r$#$Uy9(O*vol7R^8li< zC9)NsM@n@}&bKIC%DBR~to%;FIv{mkgMTFHLmrxLzh^`@YaeR*UUXDgvfEyj?_tBN zt|6?*MxFFArDiHU;;>5AWMFkx9-)P}Glg&-ucz-_ zw|mcAYgOj#gFp8%GS(RG4PN@DI2@(E@5}+>O}N~pg-pZv&TsHoMcJFd4A#Qa*7PO# zoKAoSUWhI?0)IUplvYgwHNi0T+6Ghk^X6W-BoQJ%8smxdVUaYo92ma5!t(WnK0@^_ z>9BGOJ)bgU^TIX`$(iNxxUx|XVy?39O{ee)I4E+OF2_TLm&(WXimU0E9B`(dK^UxCE3pxc;!C&H4dYH+(04Nzd1-H-~xJwLIJxM=2U?1$%QE0nRqq}5E>4o&7ThFdq@1yesZDx)dI(LjjBwiUbTEFO zF#eiF65rglf%w^vZG&Wav;<}XMWLr){$ZNM6LXp(nYS|dl|Ug`@l|5K#t=#f~;Ak~y%rl0MUyIHuG#J`CJOEl~IZ$R1?pjYGTYGGrgVp|_?fr6j zPAv6w=iZUtJ5B}iL0z_z-EaIa`xzYTbj)QymLijYFKn)ey5qO&Y~hT0XoC z$2O}b-2oy1h**&Yfsml% z>_wC!BVA96New1ONZ*leHNL(U?lZcKy0Td92tD2_k-Niyjwr2FqyxB(5kWS&AGc)u z=5|_Kvx$u$!!t>w6Yl(3#_>3N+7m=1!-<*pwkt#UiPAg^mWoQ4w2GkXwU;a~8|X)5 zXq9LzmGvab432#Vmeo^PjLWW*!=A>4-T0JCo+<;pEIqcoWhk9Fha=JR;C$zpfEUrk zBUWoyKQ?@EDgT!M@`Uqe^7;MqvK-v-M-bs7%lDm~&Q6Dd_>A{JlT%Fl55-p_A=h`5 zocD7RYjPV~Kwfz*Hrj_s55#}Yy{*b-BpA^d_l&gg1PcbE5{IlP{Ph4F1jh zuW>EZg@4>?#eeX?10nU|8%xHrFf_a3p#7)4^;LZr-ZsR4q2(ROP<&9`)U*Rv89$n7 zDNXkNZFRcXYA;s9f1ss2#zAx1YecL6`TQBJ25lnh#;#0o22RIZNTrY$1+`Rn!f=aM zquo?eF@p;UbL`MO;Hc1o2!@o4z|f5~jG zNpjRaXzL&9X}>S-HNbluxlOd8Zkh|VdeAlR&^I0v(=Ki*1ZqB4EU%I2SRZx}^u&y% zk~eP=Uq2OHARaX}E9;$X&?W6DIn)J=!572r!RD6k)YY&W0@F>+-%GJ8hkd1*P&Z2) z;|fKErAzj|$QKmyv@58U=g`MNh{guH$w*6lT~x6cF;ClBc`{Z`JrJ9eVCnVz>NUqV zN{Y%a%B3M)b2n}072HBSWLDbe;Ivpoz2xQuXvkS7RX6}+E&3UG4ei_USRY{{HNQC% zIS>PPbJ2u0OgJ5>gVP+I)C*3qRBe=s%wd&}&J_MkfN@dsR#8MsNM@y7GXx=Q>bvV% zgtI{0^%QM}HzJX*VY&OBoxnG8T({>C&51u_MsBvNQa^9$}4p?ai@K)bDB2k0`~Qf(`vrgo8lI^ozQ9fQAt=I)%W#_Oa;{;a+yA! z%)Wf0GM;1xkm*3=>b46m^J_Bo=3OQ6uFFwCY`4J z$b#Q`R{M<`Xp&sCcX@>T=yZrE4A!<}d#b`$8ZZ4sJRSB4!cu?QDwrET+et1lE;%F@ zcd-$IK9Lj-^5* zTe6*NvS0IM+u`E=PSm-;-YItreQ5S?(~{ns1Q27d?rA zMhqTo;feQ$`dYk})eU^mC)PnW?i&4MI#m?_$7M4;Ku@#>M6Wkje+@k6KeYBtc}4&uU%T2efsy15>5pw|B+g}yeoBh zN-y{x_h@zb{;N}c4Hw|lkXlxTL(~<*i$cQDLvp>afCznG4`@E2^b8XjhHM_OsBV*u zAN)d(MT7o@&Qd)mivXQq$dnF4{eZ5FWo$zff5Q>iRPL4OCj)_cRr_&x$+c}O1{(F%NcKZPY$Bu_JL_t5e zoa^TR`ln49(2>}9p?+)=GfSV^zJudF-%4A;P~4i!4vv@S|Gj$037Fx}vFoRx3S~dm z2e!6p4}{Z8>$`qNU6i7hMmXf7z;WMnR~0(I@$Jk1 z6#@YwrvJaFua?$&$^)P#W#?7LlF+|j82a*Cv%t0cXYK(52q?ScP|9cbBz_!J2)Zr6 z^{e9XV>lj}ZBc96U{lYZ-9B;RgpJ9w=jtEh9QN&b@y!j*LQzsE$Y#?U74Lk#Xr`>W z$Vw%Oy9ayh#=yIq+5U@=ocKw7XV0iz!!LbVA# z7W-FTRvR`pm+na?PM+BR@nS`d|Bcll=Y!B@^&uLv^dpq1y;}W^4jU#A{k@%6n{T~% z`t%Bc_ zgchEQtpOEt6C1@;TCNiNI4LTtlb?sZt+N)g@&?|`-eB%w#M@6$%+%Dv>lUIc#+!6n z?+dgmPa27Wg#9~&2*)cEmu6YQD`Ei@$F=*}^$@8)wQMYC z-(I^QnIj#r;<>W#QFR1sWCk}@b|PEr!U-jk;b+_3SvLZ>RF?*rm@liw`Z3izN(B9 zq}@g6v#JY4`T42K6vE`Po>&kmX7Rvin99vhH5;IjzdB#T-4fagg__?hlwvPhBrY{~t{&;73%1)*$j5!gLo8$+rL!?72NudbZixrhl!iN^d zop}(OK2|pNiPm|rw`u7N$$%UtF;D$2@jDWMi*M7Rof zF#Ov+N0_b^x8r>aqGgZmUO2!yTw1|Ck@&z5|7Pa;TP!=Elg-d*YGx4n+jSS>@emQ6pt(z{9Q7z7DYb%#1(9 zFsIywe)Jnvu@jiF5!;C&2I(|<|8Zr&H{nPBBVy<0d9 zYbs#Auc*F{@K-j0!X%c<)aUj`st^jujgx}dD`KJDOaVP4CxIFM<;^YUm^9jFhQMdy zTru;L-fTiaiuFn#+8~;33t6kk^@z##>@!`Q{KC95X8;wEp`@VkmLJzXGN>Zhg`WJb z0A!s*QDbL5L15Dh-j12XtCKSbiAq8Nw@EC$zSxO|zk5X(#y=0twCzXiI=mn+JWm-R zFDN2gWzQz95Uz%1@2ORo_9j+9a|mMnXBR$?>Lu0E8{~!(tlgwm!OT`AZm4%H+{szh z;hdNrwzF}~NeV5@dg|fZcURqUt-)DUfSjdmZE_+YN@f+s3LTy`S4G7~EI3|HP081G zW8Wh|UL6j094)pfr<;<`*O$5W7oc;ppaM-Ok>kgq${s2$xfcua)SKQ^iR3=;2@9bN zFG!)=a?A5_aZb%S445Cz3m;j~p!X0e zU(!Ga`v@LPw$1$RJbzr=72>{5n{jq)1=3hWIvnAd@?r#4eV-^5i2&R>g3-C0+)W_b zmr_bDkK--|r~eR(=3!X=BNZGxA)kWSOe zG~v0Daer$Q+@iN-_~jvEU*V{!=jdo}HWFRX#TVRQU7lx|BfK`v_Jv@blvlqjSf}(X z*~F+!D;Ob7DyQ{a-7B!PzE8!a7;QI`LLY%k5WExRT>W2Gd_`E^QIuIe2`zAb=I`nr z_Ibi+F(u8_+7dLY6!m#%neA)PK<;7GL)@lmD0|1nwbHdE#=UZn6ovn%y*H0)>T3Ij zZF^hqIx7ke42lXWLPP{)w#wiHh*}T>iDgtnNFjzPgjj8>$PfVqks&Q{EQAP1!jwcS z5HLWB0s#VvG6hH=G9)1hNxlQYzU^Jx^?cuY-sfBIyL$d$agv<9_jT>xzUF;)s{CI6 zhW?p=UUdCrWbYp&uCVRJVW@WYirsMmC(Sn{w~GURU4zBFI8J|&ujiKcug$%C434h+ zPF~V6@Lf=EXkO9g9iInb>@eSWBhiY4McO25slzd9B5R;DE>!{vggz1(X9!p=p4%bO zP>_}=$#HedQDTfK<%Mlp*Y;X&Q0a{u@ndbEEs9bi%-5(`QDR?gjiGji(8C9juI%2L zkmlk#n@`Rdiv?K)gf=*!qpPSDpYt~mjU^Vk;1x?HeHD>Zs`=O3Q!P&6tIJg#mDzgO z?TihvT(`!tT3CaX!JuT!2E~hoOeK+N9?zhu2(&A7AU^Z%mUCbyo{u|ql~Agc=4Ul} z+ORCa#Gv{P-Hkkso=h;76KMD&JvjrmV#jEK<1Psv)3Qzev|B3LA*GaijHxF}yf{4> z915zBMH4#AfpK!`EF&^ouAeW~%br~>r1DZ}ARclLnw2AtE^7;HNw^d>Tkb%C2)v!N zF`<$aF-kg6!k&n~?*!Vn>1B8ddK*FZY_@>nWF4u`z1yXa9*V>YH86f||9uR;)X5Wl|(Q+FPeZ(u!* z+R|mbT(AWsZ8i3lS8i~iNjJF(!t$Sk--P;`T^1>-=K30sqep1Q7y#1pt z!Lk?w1Lw)Ad(hG$v6WOy7Vc-cv$Oiqn4}byTQHT~rV9)nTLqruW zhOv73RL@a#Oh;O)U_ z8_I$W&M}@&ghD|KYTEE-g}HN|xC3>`U=w34X-EEP#+5WL^*xrkQ+arZD5pW_;K#EA za7HDE!%a>xwooV&lD>&552YU;<5_f?Cn6}@gKb=ID)|oXLgUQfR==<^o_adrl4K^# zSMORIy0Z!wQzP*yUv)EhqUXT4%9qCH76DV>hOvLm`Z_T=Ait1>B z%FQV*P`wY@wi_!>K-}h%Tu0BEt;N8`ss$S&OfYtqs2*>U0eXbpM8r%7VV!nw*M)~( z#@w>(i)%C!hZtWxxN=laQdVZUYjtJxty`SRu_CCkK=7TLo~{_qcuVxmtUGA*xsP~A z#%&6}8wf^y`qU$;`Bg1KBd4{ThNBGmSw}iAo^jp`X9q$1XA0Vo`_U<2 z4fJ$RNPOl!(8mZ4fdmenVT=W+~3GEPJMj&!=FAkW|ij zY6Ap&#&~91Iks48-|AV1bd#nM`rbDVgSLNB}4#1qM_LZBnAQt@>al1#->LNi65`PN#LrSkmrc{jH?$ zDF9BuC^RPT$e7!xc)!ydv|w7BbU!l3toz38!1%2rj|p;)w#6NqH9gyAwhu z@_K^XLS>Io2Mu1Zs0oC}#Y+y^vUh)S{g3o zu4x2?6;Q`F3YuFE_o^<~iIZ}x!ov}5KXfG!kO$x#&kv%kOAtM2u^IoO`w^dS^+u5! zAAgy&CL1WE-vu0^7J_4~RW^@tY?bA`Z?2~l9~RTX+8E+CMM;gp_!v1_7d!&bPgJ}U zvSEEyc6J7Y{_!!RQx*zcmvPK0wniliN}3!kvg08lQFyTLKt2n5-vF5kmTx#<02KOk zFb7nj_mZu)a-{~28jNfcpI5n)4rRlo0 zvE*DTSGZ(HNF$~V{oI~J5IIfG_Pz>4J8d`4b+1Wu{KwFbJi2s&&wm=7+TfeA> zRWuVU`AjdH+J74c>||1uHV9|==!hr>eK?X#l+(uWg(}&rzS6iJOt@V}U=fYpT9UGs zWa7u!Q{yeODx70^PvxPtiL z9%wNUk4W<>#cmR#!HuwE$&68}edVGSReYNcE!0<1QVva-4j8d*Nf{8lQemEv8X#Xn zXYKNlFczo#VbPl32a51{HAnI8mzqCc@8Em4oqjT#2wiftL^$josy920X-fa>=K~!* z(c2Aho8PN;95x7oKQM4xKJEHhOQ(9+dT=mkcqajqte@k)G>lk=TItH1)D6eT9PX{# z=-^$35~2k+Z#1wy62AV`*w;{eE))8VbHJW;?5w-nN7?EsZbx}&)Y#9^>A|d(5qUT) zj;7lLS`rtau*n=&H1MY<+|-jnCQde~fJ%c`du{HWQ)sUJ$tU8y?({d^yO2R6cEwhN z&fW^7%5%FUqgIqm_?YO3skwS1XyKoL4L6KtiYxP(_?|p44kAY zokRLXXm*w$M5GFhQcWp=N_4)JsH-E5#pXu1xk??%0t=t?=ilRSW{|!Vn@c#FFrT-< z51)bIac6=$Xy7M|G!9E;PSL@3D3l3JxCn zHT2M8i46fnbIb1C%g#~J_HahHnB;W&#-}Tt1Jk!>@gtgPj~_F9ILPTvp=G!R0i%Is zU-Y$l!pEt6KwNll*llRIwyWxgO$!2XkDon0jr5+i7B%&Lq+DP=eHj{$JZLCXrFJ$O~o#ho_9j>h%Xbv3%cHERB z9&?GbFDnldI843z;BzH}_m_2Lxsc_zi9#Z!-5~gr zww8LKIZQ34(LhOI<;~e`p#35I9sBIU)9yjef=}~af<@&=67;3>#)`-$6OE5XxH9~l zuD9wW4?$c7DK|sM8#Qu3{whA~GI!3s>h_fK-7ZC(5@l^8Sf!W0=2=*lNiWiL+yrfK zZW)mn@YHuyVdcoi#12T{u{_>z=cUQ=I=MOd30@YzLRps1(Jg0O=;D^(#s!jk<1$I_ zG05?NUOy)h4~Z?I>TXW0zd)ev27+$VJsfo2@6?AU0WffdU<>p7SFyiV6-jzAdBice zDbtZGDNJ+pHZ74-HnhP9_Ovcagm!d%J)aKLT)oyNuQzR*v+cjgN*Tj&ZrFn&!y~D%Fn376<=RAtu{s- zqJfxU{`k@D3DhVF$P#(NYLjO>2qt%&oN(;u-t2S2Vpk_~EG3on(8I5t-%E4Q4!lkC zNCmqp^d6+LM+NzL*WJpT>VV*m5fe{FLELKbU zU6;}wYpvs0^jiRdw6zjk97)ss8r z`-;_n!Ojw_;JiYo4s!XuIbG(VYVE++v*=!a7}cKEx&e{dMV4f`xMG6!9!UTo@G>#2 zT$_fHSRT70qTyVl%}8r5Ux>LUN@_*#P8U5vlfS|nh$d)ZnMBm+h6f_V<*;md?1;1^ zEv!%#+kkQ%Ge1X`Ivh;>DSWVmI??E@Xi3MbJE8e+FlgdW~z;E~!ET9Tq6Imz$pBTU<(23RYFO)zbZ~1(e_1YtJV0fO#%Q1(y{h0PwP2Lz6EbLRtIow zWIDJyTl0egsK>yMW|@P5<+q9{!SNAkpHUrO?7f61;vkvr91`87rA78#jg^ z94II!wAKzV-Y)P_nfWr74PM%1E35La92H$u}IylwdLD;mqt!Z4HjzE#(2{X>1 zr2RU)H)%*r;3kC!lW?z8rBIxtJLGnpP|L1QYb z+PW;TMP=$#MqPE6n1%7Nr%S(V#WEy7l-5CIYbM0ZhB;-o&J>YD4Yb_on-wCC5Ce0N zIPz>Zi3aygofd>lLzqq6N0lwYse7Uv`B@0V4S!u1QCkYw6^gPMVY~Ee8xo@1yupE2{2r0NBEyQb~A>zvo)*T{H)|bgffXy#wzB#!b}IF)FR(ZOxT!@ zKvm#LVlz)r^CiKpj~L>b7KB6zSh^GUki}$(n*|jUobtygVC|NjOFkjwFm2y9eEC(+ z?T!~NfOGSuKlU;qTOqo3SCw03FVV_Cq}g5=wQd0eFbj$+S@Hg@Trk!8o;6 z-l4lStl_e4Urn6amR6btUX8oAA|>)+Z3uqsnmn@t>8ab=_vGi!(51cv-S1 zq_moP?&r)9(VKXK7Dtkd_5=sV=*M}z9G+T_m9TuM^jG`=AhnvD3hcSGtW1d`b&Ebz zgg(HX9<4AmAi>+A2;IPgUcs!*ygntP{K?q#>P;J2&zYcavllR7 z@%djd=||Kcd?({VSsSf7m1FoD{-OVOXD| z%h=gW^kxQ4@h|uL9+#(40jC~2S}!xF7%dJ!mrcFF9`x)4Iw{-XyilC!4}@BNUmfj`9P$^Rt+Jn|kQZPewR$xYbfgB$hDY z5^{NrRa;(z+t|kwGsW`R3l!Dt3Ejg63}^XNs8f9F8~S&NVR>wOA25^5wIC(Wr~5I3 z1KU-@*I!PS*^MqC0|0Vh-vr0D46F9MUZ&XB>K075AKeyb;JqxBEPo1)^({*k4IP#DsSYYQ^DKQMZB4&HiiHQ3N8tnbf}gl*vV<}tdbr@4Y~}~BrfY_ zAi)B7$|__Ln>`ZPW)B4`5}WEn!TsE>_;W#4(b~$_VbHl`#wh<81h;L@_6ZHavwI-e z8XdDXX-^u<=YETNNMT8~vy*g{1ov6ANezIEpe(ci>phD32H0K=MHI$3lr+=uJw8|} zI*`&O=sjMnGop0E_!A;71$AJjC(ewyO_p$tFjSiGe}$Ko-QK01LiY6&RA?%I4+%4^ zN-f<3*gsN+l9x722u$u~)J4pe^d_kF)#JP`*p5^uC-#U`4wPH{QR}%xZrLaQ)CMtt z4#;!#H9zKv6;+yVY2-_Qu;=PJWWc9eKEId-1kj&8%i6Ga5H`%*7qKm$@rHuGRS)88n8Tc0@;lrY*J?Z7#KNF!MhNzQ!^Yn84|Tjv2J!ej+rp)O?1=B*`SpkvjZ z^r@&;>|k#1h1@e*7`J?ecE)hczRuMmmx0tCucyZBRL$ZQ*JeFyHO_vforcze-X27dhM`Mu z=DNq1ge8m$whuMBEq;!7XqBei`Ss;vnJNF?~z4+ z)f%iMxKwK~n#uTAE0CL~#jSI_(U4Z#^J3WgNMddZAjY!_mAB9mEKpIP3Zd?N%M3Oz zzPEllvBp}X{%_pSO%m*=Zp+EL|B21x=uXlx?lZTZr_4~MknIMP9VJg@tE=yN8vND; zWb621=K-p@_HEov*lRX$xXQuYshKj6B015JI%`Uhy_ET0xYug^YFoc1qm-5Mm1*g|Aa?kJGmyec0L9Hh^ zTd<+;D;fw3f!zN}uQwXp>NLsFHEDsrFJS;mn4Fylf`6-tLadp)(r`C5p*%xF#_zKS zPa77&hNjmdgw7q$Y|1l#>9Lm z`8VRvXd*;w*4SwOKGZYc7DW5E$&YjO9|YwPPXjYV5Gfmc>GNuyOYJJmcl@`OB9`s4ni~();|C{=q?Ewfll7b8z-Wv4tU_{I>Qp}27cF=>GPPvxNpR@;%(UBYR802D)E<%Ha~pDNqF!lp@4Ju(5a5L!cw*)=EQS0%tx7S z`&uFQeZgI-%mUV?(3tV5%}}Qtj!M%tsO|hI)keN*)$}iP;#KONRAy~S?NmU|DeRT4 zDsB=#vP)=f*)B$08%%SWCD-66rS2h|Ou)dHD}4fpQo^Qx5>M0=Pov-D7qVo{r6_6= zTF~0hItCHNr9FtJeT=LjmQiYC->$Xaug1u-UVVF&I{TWSb3HlV&Tfg%tFTX}K1|5e z_GM$EI_=6N(Y@JI=i4atI-HWc*4lW;8&`opbzxEj818j(LB+lJmd9_mEL~IZ7L+Od zh3@;wVWEj=P5;@x19H_AePS~a&(Z76k@EBppy7aHI&l{3m%2a&s!aSD1T4J^-C8E- z4F#N|aOIZrnm-ksHUws9>4573#MX&kV)cF@%jmn~rUW|Bz< zS|oVIGdutT?8Y#3q5rm4?Mh;+&N0i08WYbm_vR}rCT&j9D_UqKDo44YZP`~(vp7w( za%~kHlbx=huE4Hx9qwP z^6|Tc$%?@^lHKtlEzV7pVTAt%f9zzevg%G_?3l+*^3}{GiBBL(Uvb)AAuqgFZ2o4Z56Y8pv9lJrnJ* zRtz7s#h}GW-{-e}=WA9-vXSaw>tRApV!yl#Ku>P`D|oU|nkz%A5#;B(QQ2|LPaE!d ziG6o^6P4U>Asv*D-E40yb&`*?6=EATdV|S7B0kC~*6L ztg!*=N$#7F2@d>y&xzC(WZE!`--iC#_XULeNX&3cL>KRIZD5cSn5R`kHJwr1YZ8T& zC>E@;pGKdy(bnj?j^<(RzA_Zf=D37y%J zdEBSBbk)H9u~DYU0PEuV#L2~9R@Uf;x?>%(YxHUS*@mf)h&j|R1W@6KmW6WS$cax= zmU83L{5@XPP9YFZ@t>?|Jo;qTBD1avY@H}c&I90Kxk&oqrqqxz2H{Tz1> zD})~;=61!MyGK}zQp6}5*W|Dm-F3YK-c%f%){PzW*8;TfKwM+Vm)afeFf0hd9GHZJ z-O677y!qxjee;e6cB^QKK#(-yIqOh=Mr>oFJ&FsBT;4%3WoT>`W>q5%eHmLd$G$w{ zBI%0>X-tvMWP9byv)ZgeWE>%(T8CU0AAn~UlK9lc=!oVdR5(u`H^!g~#PBH7qPn<= zO?{n$z==%?RHa!GDj+AV`*VW93{&t149oaSrLELY=O`s5nkL5J8HCY!lD6e?f%A_^@2?tCOcezZ9>V z588quc;7Tcg4Y`5c_8oU^VC|vk!LM;AQ(CUTC_63Ra%y|0an{@E*Ta$N7}b0t=Ly) z&U}32CvH~C&86e+>s)HBMwRE)E9%MuYVC_VU3uX_)7RGhW)WojV(&fq{#RdTt7A|S zx2#_LlcXQxNaO;qu5g1~k4uAUm)6-TE8GM%l=C2qDlQyI>!v7acBxx&)zC+gd0@1C zDawFH!eJ`oQ$Hru&k5HHQ;fndrGfFYiPMdb;^PI!uilMG3?_j79ohBxNZ4(An(9H* z@ZC|^h}MA#5zoxd>#5F@?{8M(Y$KjUuiS?w!P=s1-dSF%_Or5eqwaj4KS=nZvaojE zlFwut%kK|^3JiY6v2H%I=wkJ76NanznSTkz1|FohG|_^FIn)644qzImni7UDT4^`7 znY-vAYvasUHV#scoZtU&L+@#JtySE&Zub#(NqPXUXsJLAO@E<)uR@z22|*NX7cEFY zSO`f}Je3F@0csh#FQaoSj1?tca<4{+HuKQ3=*`BqF z^-J(~A2;$tMyFg!u~rk)85sPY&cekz%O8hdwzmw0_zdM+k(i}7Kt|Pa9oIDC7i8+x zboPQs6KG+MOzTjenx!j$eGD4GyxUolpkDD)v{=l`XJ^eR2+OJdRp+S~XvI^Xf44Gp z2(>dmseff(I8oxW+765b+M)g zqWY3FRXwSH>oko!7tF%NAJ>%w0@%b$heKyr)?%x`c@1 zLZ{5&i24iF%Io8ix`4Aj7A&bhHc8X?5v3ui+NHfYww`w}@-P`>@*dI?%R^41Qs)mI5ZMW zz@!=>$(ik6JODD36KB_5Z8FOF01l@g&x6vTHMJ8R{Eq(EHo>c&H$y1je9F#E$qdSC zN|qqpordYqcwv*>&gyh!2P6)fq3kGP6YX2y%@sbZ*2%3nTM#>f+_QZJjTPq&>;vJX} zD0WbF9GC=}r|GjBipP!}H`>&;Pj$xl{RBl7F?rm7o9r-xP>_5t4&RB}mCn!&d{E=0 z+gm*tQEOFtBmkCcVHf_J&UcqE2r8sVA8CRbhg+@EQ8X!eifbj(qBm+-m+f`C-6v`= z;0`Fi0~H9c0+N7eDRXj4Cq+MN?$*X+$LD`kxF#Fr8Jc^gYbn4Pt_0AU$w#U{rR^Hv z6sHAvz?D{%J=4P(`v~kB>lYFZ#_92S&?(MC15eX9J4Mw#>9bh>Ooq-#MogtWEo_t# zEl%9Kpmwt4bu+`vD<>q)O6z)|`y{KhoekAk*CLC}$ETa>wQa2K_OhGzRYj+?@gA;Y zZR~YpASd$?g-<~^Q|Wr?xY9-@2a?-8uL2-d9v!m6ve7L$rHdt;(%$O*-qak=P+Kq*?xBjyP$O=$i_!kb^zE;c#`npfLjwbD z#n7Zz^6$JoI+JPt+TcDEX3FH9T+O)WVo;)v4}TbLY=91a0XcD~-D;FE^_YF9@=>#( z)V5NGv5~aRcs0x%s=m4lt5wU@`4Vrb3DeY=bunDjud~|QK%Za2E-a}+5uV(g1|ls~W5 z{#SkJS!41>9G`~%8qy-Io18(1Ii)^nflAOLRrnb+H6gk9dlb!lEqs%p7CG9FQSCDz z;ez`r34uuiJuf@No{&FmrqW2H#xHQh+WYmwNAkc@zSY@KSg+T&XQ5W|fWT)(2~U1K zjVlBgSE%6a?wg6=t=iL>G~oFxHI?r*zxbrV6CzvRjyJ{^j|nepzP+rgtX+&AzuYx3h|UGq?<8LES(AvD%bv z23Lj~$KdeeT%8XFcE_q{v7ylS5SNS&xS_!b|nDYKgYHNv0q!XC!6pQ&tc*MxUHPP^nZZQd?6l&&(cWg z4mKM!BC;_8j6m7!#+0q(bm=ox?k$0+mn|MR8w{gXgucSmJ6z_vF{-3Jp6%xCk1MvG z7THk9InwwDR##SI$%2-ODt%wby50_J_MVJeE#L$32kAu-v+qeXCO?gxH?qg97vH^NFypg>;s6eTkTz+h{d{u;u4YT z`C)~R{T?%T{dP>@p-H*y08%cORa9$lzUtImR>V1fjWkPu#O^YT1j3U& zE}Ct8|qpqsG1{B7e7XLA;wlMPqUXKiOQ9oD4vM^FdC=XbB?zCFHvu2I=K;DMkM zD>1;dx59|USJQEPGQ?+b! z#$hP#!ytotpb7pFEovf=`=s{)eU8m45US07D^Jev_3gKf1!7AK1SZEh_eSp+Eo8 zbL8W>o#>w~TIBQS{Hpnn-rCG_;gdyI3Qs>>GXK$g-G7EP$B2Kp^$)fV{<9MQ5fJlI z@gH%zptb%lQ9gaq*a?MNCQ_9<%^>0m&Xb(9Sz`i?7XBvngUSWAr|{Kv(A2&f^xBVn zy~9ae2U0)N;frgL^0;}NEXsZKK@&H!5+;~X<*W{UmQ6iES|?BnVmzQ4y?bTqgWff% zhAk|x_N`}3zSfVZkEexyVL(_%wE>MEZ zDHKRTQ9t%2RH0OlGOkj2ANkruArmPlq0aLD1y^tKJ<^HMO9`MdZhqRpt#>O} zFqC7~FD%Tno}l-(oAd>ERTg&If3rd2g1!Crs|ARkcc4BOT=-cnpsPd);BSmX$JeXJ z;qluStoJKEUULq^zZP8)Pk%}x$ZiCbkuq@?4u1@4z@}v9k}e;n+q0iO-iu>Fr?7Bv zTldKY3;+G@1>5~;KIAQGzkyenq-XzCZhc z9fhZV&yFW5ym}C;6w~F`)knD5#}?@N2K7Hi*U+|`&9rll1uNDsIAElL1;Hm6SqyQT zT2mK-YjTnaunM+X1c;7VU?VGS)?(mqC!xXlC&*2@bP&I_o$z;)^>}u~K-r7eh2CJu zryzNwUVk%n=rf}T_Hp&7fr=o?myVvnUHTggZQCawiyN`f3mw>&>JBiK=siPRv`Dw{ zsPmU+X4PZ8^rRi^?9bn>G&;Sf=ABD-SoYED!TXt?-&}X1;Q8L4PA>~h{Z~}jI-64U zqO#Pyjq8dIhq{hjeek^g(7$sQ2cG@r$2`PC*w8c^g}@h+eul|=_}}VCiFj#($Nu+` zE9XQjy4Bib-@!$THh7xFm^Nz%ms!3pF4nC_dbH2*(VJER z;XHcaqp*J zG)noY4yMfTGeDF~3|wWu4)d~tX_@r)dfyg$5O3-5rmP0(jZZ?oU!Q~huvFvAJ%>y; z-&_tX;rfhakmF@8T}91Le&ISLsIO-g^6IR}N#s(@tZ>kw1UNXzfORueUyBVz*Dt+D zv^@M*jL)26Lsg@%&;iFe;Pq4C**o6{Pv}jeV1Gwom*4o$&!XAE)FXd4OM%%YV?hQoj&pRkznY)CV`gLD@9Z8Fgy&G_e`;}NL10M=5Z*yo7A@MF@Av-PJ=0eq*1==1 zxqiN+$r{eXzvI7W$L_H)|Bj@;W3`~!8lMm~s8maxppfdJhqVsGYBPb$-$A+8h^G?j z_|RS&7&ui&H9vXQ=PLsaX8N0vbirS1OMW&H?pi={+sJ=l4n8U6sm8?$wUkY-j8Xxk z$cXWF#OnOrj78-4*PZnp!05l`9yL)~PLscv0l_`F zY85Fg+Ac9LBD~6M{9-w)qVVr|)iW9cO?W?X2Ofz_g!Oe-JQDK_W@oz5WRJf?0C#q7 zAp!5MeT$hI3FRrLICM+iaC2qlTBzSw_(z-+`nUuLt^{nQ0>xK2i~?~8}cD2 zO9=}}iZ=Nx`IA2@TjE5U9Pb>JfPj*}azXg3c`(_$D_n(#R);hHmYMFir+-na;;3}A~hOUDiBzy901eb(iK%`pAe<&bYN=#^&ImvO+y|pm;*u=UQxrMPZpiGuY6m+ zAAGyH#T4B1mvTA}OuqYXdrIs6LYWXtyXNo^NSl4z50i?y zXpSzLt?di@0lw~|%7<9$iwk7&ekqBDr0r{vn_bm*Q z%*m7bc=5Zb|4PSz)~gIo`fEjt{67b4$neZ{qcquc+3a0Hraji|qfnay?2Amh(8J(U zkE`9k7R|3#?9q=-iqX;#{+Vu0=~L;vq@x}ud}La_YRoc-pDk^OS}E)A4`nB)-AA%n z=S&3dULR3m=_LgpX<|p9%SSZh@%oz|L2Op?`j5;zXrsx;h~4M?F}i|^c78;vHJ<%v z!1Gqv$2gpLC@VQfO`BmYk*Sf3=B_K%KWZ$K`MX7nrhnBK#|yV{3zp@=t;2%Nrn$YM zzhL=lZV#@~n1Bnv{qefSd|tTy^{_^SFWe6Q^xxj?P5qi9v*3c}3=^NWx~WM!eMn_r z#ml7l$cfQ>5=aZH9&q8tBD>bV5ySJLm3==)gNmUBi34Iu|#yz7fQYFZldHOTt~ zlZ9VfsL-?Usj|!T>$Zy$m3*ZvXv!j`=-z{A7%=Xzz^tXTiVDc7q$1x=#c*FU5@|l( z*-`CP#N_Q7PZ6z`){e%@X19jdTrPU5V=@wq6x~A`{juZchhnR{$TgIZuSvZtt#3w+ z@hh<}Ykx*N)X`>@oPFGqUm)8_qwMhOIXrX>a--&9<-(|+e=36bnLc!p5lt(JUv)A$ z@9Hn1OE7Tsp5lvoW;oAm@Os4S%;khI>xh5$1q*C;LXy1H8R}`L_X}z+z z`w+M&CJP6&0;9Z4arWAa_;NG**`&jDlTgJo`VLh~;jH^)bmBg!xL3mhgy{kc!bi?- z4Nv+70=^CNc@Fa_&slmcqvliI+RCR{cpG>Ur}(js$%Ni()P!d6=Qk|CuIEsg6DM=9 zpux(w`e_#BC7eQT2D8YVJ~D4xsk51I(Dce9c*NA6l_OO%%jf&tyZl3!TS+^uiTiar z%!G9o-IL%jC%Z=A(YhD$bKUCnNj(?^_IHoRPsnbi)`e ziS+l(EPj^dLlPYA(ONkYQ++4g#Cu5?;L>&BJ>aR^RY5 zS75FWNpDA4R&$?m`i9zN07RqtJmiIz=Jk?8)i=-QT-@>EGz-YM0#}9f!*kOEeP6|n zo$YQPE!eBW=*vGktH(ZJ@-8oZS#)KXPTyIyd$sBK*1Vjxg<~!yASWj^c=+tsz!A)w zFZv9fUQh!+Jk(I|{8)E77~(7X8ae*(HH5oT%J=bvuHkpX`W-TM^2_-igYQQ(*{SO# zljMrDofGaKB=}DYe#6uB)8A8fzH>KuUw88|(qzbeGO7Z;)hy{N;Ponm`|O)&&K-4R zpI`OTw*$Z!2GZX?(+fXvANijcDB6BAY65Yy!S4&RV`#4^yRSNyjUf%^8VW6Ew-D=f zq;3(QSMhI96VbYM68~<|YAhvSJzZi$oJkpz+LWhnndi}O6ElDJf3z6XQ1F}dl|J8U zaCc%nxYT$dYQKoNfaBb}Xvo03BztVyjP-L*Gj+a6HFZUw0wXoV4`_kxD`HTyNl8BJ z6WIyO%ZOQ!rd^kXwHG=_(2>deE>#lUXLH^bC!wz!c^QS(l~fvXx8M9hW?d^hM;krg(Et1|_h^KVjP;*&>&E5R&XnSf!sA&t#4M$-OQP7$*z_b4^(PW z2tBZck-kj&jZ!CU z(wD&}5a|c3h&Ob2C770Hbz!r5!7nA;nfNzUUzG#n7`E$O-?YPlL?R(H?N_Qic+N-r}dxz|0L&E55e?hdT_ zct;e^T}lpDpnrK1&2Y$g*(9@yNLY(CQ0Py9hiICd#dEWT75qb%PeD?9PpZxSi#{>T zU|Qt>{4xhwd5atkXq|UV>EN@)HNPTR&#HJ|5BcRB;356Dv)0cu@x1j1cEEhd;7Q(W zY<16!9XZUw&kyuj{lrnTe3ycMS;M#4!4aH%9KWvQ$)39`27iPWx4qw;AJfP z&OB?zV?sGJ-pE<%_K*nU1e)jUg-7J@wHSt{FP26ZGrV0EWX|c|x=Vr{SLHa7igkdu zVJ`i4%mGlH#i*a}Mpf85N|R6X55?!(;g3hj@=hn3EsYx^KR^8iXdFR#(rlt~FBCTC z!SwF+%V@u5F3Flze?CvjQ(KJ?zw)lUu)Df_knMs1qH_EdN^zuhs%RlWF19&n)Q`?_(#uipw}~R*+lGkyjgGE%~*%XR?sV) zSCw6PU3fmm1kXe^HJShs$hoV><^$Dr5+dAu5BX6Zm}sig^$-@hl}I_z!OcjDA)aQ> zDeXj-gNCh1k>>c0XL|5i(KL9Kj*lodGScdF0wRm*P z_cQjVSkd2q(XqY*;+~^ps|SR#@i8;^0!EWidz;2W$H9&M1 zxSrZAOhK8}_oXukbGknVP^%?T!VMQI7X>Se-NxdHNH?xfLK%K^7K91En*sAdxAtP0jzY zXhVsoKCgb#6V2-xlJ*RBbGj$H=0~(>#{v&EcmID|;F?kVrg}8D|N9O9f4W`te>;;I zidFaoAcp?qLf8SA@`E_3frGLS#S^}J<2e}{{+|2N*ued>d1N`cFtb$8$ z6Fu`Ulj^G!FXLBOHymz@(n&vmdX90i)6-Lh%?x7$moyMmqjKjS?TTH!?1jJY zhVj-n>Q_3gBT$uiq*~-8$B{VSLRN~CHcX>eImMW1DpP;|m!C15>S7L(zJi!84Ylh@ zm#W7`GVIUHRb~G1O50Vk*Y9$3q&j(VfjFjU&92|KqWPbnGe@R<6tbCWF{)p)N91pI zap#|Z7JB!(r&FxxT?URO9d5O&4ASUIfQ)~x|3MBshbx^jZZAq{+qFk~uG^z79?r#w I&R_k10RGs{qyPW_ literal 0 HcmV?d00001 diff --git a/private-apigw-custom-domain-private-restapi-public-lambda-terraform/main.tf b/private-apigw-custom-domain-private-restapi-public-lambda-terraform/main.tf new file mode 100644 index 000000000..3d52acbba --- /dev/null +++ b/private-apigw-custom-domain-private-restapi-public-lambda-terraform/main.tf @@ -0,0 +1,833 @@ +# TerraformScript Developed by @lpiyumal +# 2 things which requires to be updated by you : +# 1. Region on line 25 and 30 +# 2. Your domain name on line 38 + + +terraform { + required_providers { + aws = { + source = "hashicorp/aws" + version = "~> 5.0" + } + time = { + source = "hashicorp/time" + version = "~> 0.9.0" + } + random = { + source = "hashicorp/random" + version = "~> 3.0" + } + } +} + + +provider "aws" { + region = var.region +} + +provider "aws" { + alias = "acm_region" + region = var.region +} + + +provider "time" {} + +provider "random" {} + + + +data "aws_availability_zones" "available" { + state = "available" +} + +data "aws_region" "current" {} + +data "aws_caller_identity" "current" {} + + +resource "time_static" "current" {} + + +resource "random_string" "suffix" { + length = 8 + special = false + upper = false +} + + + + +data "aws_ami" "amazon_linux_2" { + most_recent = true + owners = ["amazon"] + + filter { + name = "name" + values = ["amzn2-ami-hvm-*-x86_64-gp2"] + } +} + +data "aws_vpc_endpoint" "execute_api" { + id = aws_vpc_endpoint.execute_api.id + depends_on = [aws_vpc_endpoint.execute_api] +} + + +resource "aws_vpc" "main" { + cidr_block = "10.0.0.0/16" + enable_dns_hostnames = true + enable_dns_support = true + instance_tenancy = "default" + + tags = { + Name = "PrivateApiStack/private-api-tutorial-vpc" + } +} + + +resource "aws_subnet" "public_1" { + vpc_id = aws_vpc.main.id + cidr_block = "10.0.0.0/18" + availability_zone = data.aws_availability_zones.available.names[0] + map_public_ip_on_launch = true + + tags = { + Name = "PrivateApiStack/private-api-tutorial-vpc/PublicSubnet1" + "aws-cdk:subnet-name" = "Public" + "aws-cdk:subnet-type" = "Public" + } +} + + +resource "aws_subnet" "public_2" { + vpc_id = aws_vpc.main.id + cidr_block = "10.0.64.0/18" + availability_zone = data.aws_availability_zones.available.names[1] + map_public_ip_on_launch = true + + tags = { + Name = "PrivateApiStack/private-api-tutorial-vpc/PublicSubnet2" + "aws-cdk:subnet-name" = "Public" + "aws-cdk:subnet-type" = "Public" + } +} + + +resource "aws_subnet" "private_1" { + vpc_id = aws_vpc.main.id + cidr_block = "10.0.128.0/18" + availability_zone = data.aws_availability_zones.available.names[0] + + tags = { + Name = "PrivateApiStack/private-api-tutorial-vpc/PrivateSubnet1" + "aws-cdk:subnet-name" = "Private" + "aws-cdk:subnet-type" = "Private" + } +} + + +resource "aws_subnet" "private_2" { + vpc_id = aws_vpc.main.id + cidr_block = "10.0.192.0/18" + availability_zone = data.aws_availability_zones.available.names[1] + + tags = { + Name = "PrivateApiStack/private-api-tutorial-vpc/PrivateSubnet2" + "aws-cdk:subnet-name" = "Private" + "aws-cdk:subnet-type" = "Private" + } +} + + +resource "aws_internet_gateway" "main" { + vpc_id = aws_vpc.main.id + + tags = { + Name = "PrivateApiStack/private-api-tutorial-vpc" + } +} + + +resource "aws_eip" "nat_1" { + domain = "vpc" + tags = { + Name = "PrivateApiStack/private-api-tutorial-vpc/PublicSubnet1" + } +} + +resource "aws_eip" "nat_2" { + domain = "vpc" + tags = { + Name = "PrivateApiStack/private-api-tutorial-vpc/PublicSubnet2" + } +} + + +resource "aws_nat_gateway" "nat_1" { + allocation_id = aws_eip.nat_1.id + subnet_id = aws_subnet.public_1.id + + tags = { + Name = "PrivateApiStack/private-api-tutorial-vpc/PublicSubnet1" + } +} + +resource "aws_nat_gateway" "nat_2" { + allocation_id = aws_eip.nat_2.id + subnet_id = aws_subnet.public_2.id + + tags = { + Name = "PrivateApiStack/private-api-tutorial-vpc/PublicSubnet2" + } +} + + +resource "aws_route_table" "public" { + vpc_id = aws_vpc.main.id + + route { + cidr_block = "0.0.0.0/0" + gateway_id = aws_internet_gateway.main.id + } + + tags = { + Name = "Public Route Table" + } +} + +resource "aws_route_table" "private_1" { + vpc_id = aws_vpc.main.id + + route { + cidr_block = "0.0.0.0/0" + nat_gateway_id = aws_nat_gateway.nat_1.id + } + + tags = { + Name = "Private Route Table 1" + } +} + +resource "aws_route_table" "private_2" { + vpc_id = aws_vpc.main.id + + route { + cidr_block = "0.0.0.0/0" + nat_gateway_id = aws_nat_gateway.nat_2.id + } + + tags = { + Name = "Private Route Table 2" + } +} + + +resource "aws_route_table_association" "public_1" { + subnet_id = aws_subnet.public_1.id + route_table_id = aws_route_table.public.id +} + +resource "aws_route_table_association" "public_2" { + subnet_id = aws_subnet.public_2.id + route_table_id = aws_route_table.public.id +} + +resource "aws_route_table_association" "private_1" { + subnet_id = aws_subnet.private_1.id + route_table_id = aws_route_table.private_1.id +} + +resource "aws_route_table_association" "private_2" { + subnet_id = aws_subnet.private_2.id + route_table_id = aws_route_table.private_2.id +} + + +resource "aws_security_group" "vpc_endpoint" { + name_prefix = "private-api-endpoint-${random_string.suffix.result}" + vpc_id = aws_vpc.main.id + + ingress { + from_port = 443 + to_port = 443 + protocol = "tcp" + cidr_blocks = [aws_vpc.main.cidr_block] + } + + egress { + from_port = 0 + to_port = 0 + protocol = "-1" + cidr_blocks = ["0.0.0.0/0"] + } + + tags = { + Name = "API-Gateway-VPC-Endpoint-SG-${random_string.suffix.result}" + } +} + +resource "aws_security_group" "ec2" { + name_prefix = "test-ec2-instance-${random_string.suffix.result}" + vpc_id = aws_vpc.main.id + + egress { + from_port = 0 + to_port = 0 + protocol = "-1" + cidr_blocks = ["0.0.0.0/0"] + } + + tags = { + Name = "test-ec2-instance-sg-${random_string.suffix.result}" + } +} + + +resource "aws_iam_role" "ec2_role" { + name = "test-ec2-role-${formatdate("YYYYMMDD-HHmmss", resource.time_static.current.rfc3339)}" + + assume_role_policy = jsonencode({ + Version = "2012-10-17" + Statement = [ + { + Action = "sts:AssumeRole" + Effect = "Allow" + Principal = { + Service = "ec2.amazonaws.com" + } + } + ] + }) +} + +resource "aws_iam_instance_profile" "ec2_profile" { + name = "test-ec2-profile-${random_string.suffix.result}" + role = aws_iam_role.ec2_role.name +} + +resource "aws_iam_role_policy_attachment" "ssm_policy" { + policy_arn = "arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore" + role = aws_iam_role.ec2_role.name +} + +resource "aws_iam_role_policy_attachment" "ssm_policy_full" { + policy_arn = "arn:aws:iam::aws:policy/AmazonSSMFullAccess" + role = aws_iam_role.ec2_role.name +} + +resource "aws_iam_role_policy_attachment" "cloudwatch_policy" { + policy_arn = "arn:aws:iam::aws:policy/CloudWatchAgentServerPolicy" + role = aws_iam_role.ec2_role.name +} + + + +resource "aws_route53_zone" "private" { + name = var.domain_name + + vpc { + vpc_id = aws_vpc.main.id + } + + tags = { + Name = "private-api-zone" + } +} + +resource "aws_acm_certificate" "certificate" { + provider = aws.acm_region + domain_name = var.domain_name + validation_method = "DNS" + + lifecycle { + create_before_destroy = true + } +} + +resource "aws_route53_record" "cert_validation" { + for_each = { + for dvo in aws_acm_certificate.certificate.domain_validation_options : dvo.domain_name => { + name = dvo.resource_record_name + record = dvo.resource_record_value + type = dvo.resource_record_type + } + } + + zone_id = aws_route53_zone.private.id + name = each.value.name + type = each.value.type + records = [each.value.record] + ttl = 60 +} + +resource "aws_acm_certificate_validation" "certificate" { + provider = aws.acm_region + certificate_arn = aws_acm_certificate.certificate.arn + validation_record_fqdns = [for record in aws_route53_record.cert_validation : record.fqdn] +} + + +resource "aws_vpc_endpoint" "execute_api" { + vpc_id = aws_vpc.main.id + service_name = "com.amazonaws.${data.aws_region.current.name}.execute-api" + vpc_endpoint_type = "Interface" + private_dns_enabled = true + subnet_ids = [aws_subnet.private_1.id, aws_subnet.private_2.id] + security_group_ids = [aws_security_group.vpc_endpoint.id] + + tags = { + Name = "API Gateway VPC Endpoint" + } +} + +resource "aws_iam_role" "lambda_role" { + name = "private-lambda-role-${random_string.suffix.result}" + + assume_role_policy = jsonencode({ + Version = "2012-10-17" + Statement = [ + { + Action = "sts:AssumeRole" + Effect = "Allow" + Principal = { + Service = "lambda.amazonaws.com" + } + } + ] + }) +} + +resource "aws_iam_role_policy_attachment" "lambda_vpc_access" { + policy_arn = "arn:aws:iam::aws:policy/service-role/AWSLambdaVPCAccessExecutionRole" + role = aws_iam_role.lambda_role.name +} + +resource "aws_security_group" "lambda_sg" { + name_prefix = "lambda-sg-${random_string.suffix.result}" + vpc_id = aws_vpc.main.id + + egress { + from_port = 0 + to_port = 0 + protocol = "-1" + cidr_blocks = ["0.0.0.0/0"] + } + + tags = { + Name = "Lambda-SG-${random_string.suffix.result}" + } +} + + +resource "aws_lambda_function" "private_lambda" { + filename = "lambda_function.zip" + function_name = "private-api-lambda-${random_string.suffix.result}" + role = aws_iam_role.lambda_role.arn + handler = "lambda_function.lambda_handler" + runtime = "python3.9" + + vpc_config { + subnet_ids = [aws_subnet.private_1.id, aws_subnet.private_2.id] + security_group_ids = [aws_security_group.lambda_sg.id] + } + + environment { + variables = { + ENV = "production" + } + } +} + +data "archive_file" "lambda_zip" { + type = "zip" + output_path = "lambda_function.zip" + source { + content = <')[1].split('')[0] if '' in aws_content else 'Title not found' + + test_results = { + "timestamp": datetime.now().isoformat(), + "function_name": context.function_name, + "internet_connectivity_test": { + "status": "Success", + "message": "Successfully connected to external website", + "aws_status_code": aws_status, + "aws_page_title": aws_title, + "test_time": datetime.now().strftime("%Y-%m-%d %H:%M:%S") + } + } + + return { + 'statusCode': 200, + 'headers': { + 'Content-Type': 'application/json' + }, + 'body': json.dumps(test_results, indent=2) + } + + except Exception as e: + return { + 'statusCode': 500, + 'headers': { + 'Content-Type': 'application/json' + }, + 'body': json.dumps({ + 'error': str(e), + 'message': 'Failed to test internet connectivity' + }) + } +EOF + filename = "lambda_function.py" + } +} + + + + +resource "aws_vpc_endpoint" "ssm" { + vpc_id = aws_vpc.main.id + service_name = "com.amazonaws.${data.aws_region.current.name}.ssm" + vpc_endpoint_type = "Interface" + private_dns_enabled = true + subnet_ids = [aws_subnet.private_1.id, aws_subnet.private_2.id] + security_group_ids = [aws_security_group.vpc_endpoint.id] +} + +resource "aws_vpc_endpoint" "ssmmessages" { + vpc_id = aws_vpc.main.id + service_name = "com.amazonaws.${data.aws_region.current.name}.ssmmessages" + vpc_endpoint_type = "Interface" + private_dns_enabled = true + subnet_ids = [aws_subnet.private_1.id, aws_subnet.private_2.id] + security_group_ids = [aws_security_group.vpc_endpoint.id] +} + +resource "aws_vpc_endpoint" "ec2messages" { + vpc_id = aws_vpc.main.id + service_name = "com.amazonaws.${data.aws_region.current.name}.ec2messages" + vpc_endpoint_type = "Interface" + private_dns_enabled = true + subnet_ids = [aws_subnet.private_1.id, aws_subnet.private_2.id] + security_group_ids = [aws_security_group.vpc_endpoint.id] +} + + + +resource "aws_api_gateway_rest_api" "private_api" { + name = "private-api-tutorial" + + endpoint_configuration { + types = ["PRIVATE"] + vpc_endpoint_ids = [aws_vpc_endpoint.execute_api.id] + } +} + +resource "aws_api_gateway_rest_api_policy" "domain_policy" { + rest_api_id = aws_api_gateway_rest_api.private_api.id + + policy = jsonencode({ + Version = "2012-10-17" + Statement = [ + { + Effect = "Allow" + Principal = "*" + Action = "execute-api:Invoke" + Resource = "${aws_api_gateway_rest_api.private_api.execution_arn}/*" + }, + { + Effect = "Deny" + Principal = "*" + Action = "execute-api:Invoke" + Resource = "${aws_api_gateway_rest_api.private_api.execution_arn}/*" + Condition = { + StringNotEquals = { + "aws:SourceVpce": aws_vpc_endpoint.execute_api.id + } + } + } + ] + }) +} + + +resource "aws_instance" "test" { + ami = data.aws_ami.amazon_linux_2.id + instance_type = "t2.micro" + subnet_id = aws_subnet.private_1.id + + vpc_security_group_ids = [aws_security_group.ec2.id] + iam_instance_profile = aws_iam_instance_profile.ec2_profile.name + +user_data = <<-EOF + #!/bin/bash + # Install and start SSM Agent + cd /tmp + sudo yum install -y https://s3.amazonaws.com/ec2-downloads-windows/SSMAgent/latest/linux_amd64/amazon-ssm-agent.rpm + sudo systemctl enable amazon-ssm-agent + sudo systemctl start amazon-ssm-agent + + # Rest of your existing user data + yum update -y + yum install -y curl jq + + # Install AWS CLI + curl "https://awscli.amazonaws.com/awscli-exe-linux-x86_64.zip" -o "awscliv2.zip" + yum install -y unzip + unzip awscliv2.zip + ./aws/install + + # Create a test script + cat <<'TEST' > /home/ec2-user/test-api.sh + #!/bin/bash + echo "Testing API endpoint: https://${var.domain_name}/lambda" + curl -v https://${var.domain_name}/lambda + TEST + + chmod +x /home/ec2-user/test-api.sh + EOF + + + + tags = { + Name = "API-Test-Instance-${random_string.suffix.result}" + } + + depends_on = [aws_route_table_association.private_1] +} + + +resource "time_sleep" "wait_for_certificate_validation" { + depends_on = [aws_acm_certificate_validation.certificate] + create_duration = "60s" +} + +resource "time_sleep" "wait_for_deployment" { + depends_on = [aws_api_gateway_deployment.api] + create_duration = "60s" +} + +resource "time_sleep" "wait_for_domain" { + depends_on = [aws_api_gateway_domain_name.api] + create_duration = "30s" +} + +resource "time_sleep" "wait_for_domain_name" { + depends_on = [ + aws_api_gateway_domain_name.api, + aws_vpc_endpoint.execute_api, + ] + create_duration = "30s" +} + + +resource "aws_api_gateway_resource" "test" { + rest_api_id = aws_api_gateway_rest_api.private_api.id + parent_id = aws_api_gateway_rest_api.private_api.root_resource_id + path_part = "lambda" +} + +resource "aws_api_gateway_method" "test" { + rest_api_id = aws_api_gateway_rest_api.private_api.id + resource_id = aws_api_gateway_resource.test.id + http_method = "GET" + authorization = "NONE" +} + +resource "aws_api_gateway_integration" "test" { + rest_api_id = aws_api_gateway_rest_api.private_api.id + resource_id = aws_api_gateway_resource.test.id + http_method = aws_api_gateway_method.test.http_method + integration_http_method = "POST" + type = "AWS_PROXY" + uri = aws_lambda_function.private_lambda.invoke_arn + + depends_on = [aws_api_gateway_method.test] +} + + +resource "aws_lambda_permission" "api_gw" { + statement_id = "AllowAPIGatewayInvoke" + action = "lambda:InvokeFunction" + function_name = aws_lambda_function.private_lambda.function_name + principal = "apigateway.amazonaws.com" + source_arn = "${aws_api_gateway_rest_api.private_api.execution_arn}/*/*" +} + +resource "aws_api_gateway_method_response" "test" { + rest_api_id = aws_api_gateway_rest_api.private_api.id + resource_id = aws_api_gateway_resource.test.id + http_method = aws_api_gateway_method.test.http_method + status_code = "200" + + response_parameters = { + "method.response.header.Access-Control-Allow-Origin" = true + } + + response_models = { + "application/json" = "Empty" + } + + depends_on = [aws_api_gateway_method.test] +} + +resource "aws_api_gateway_integration_response" "test" { + rest_api_id = aws_api_gateway_rest_api.private_api.id + resource_id = aws_api_gateway_resource.test.id + http_method = aws_api_gateway_method.test.http_method + status_code = aws_api_gateway_method_response.test.status_code + + response_parameters = { + "method.response.header.Access-Control-Allow-Origin" = "'*'" + } + + depends_on = [ + aws_api_gateway_integration.test, + aws_api_gateway_method_response.test + ] +} + + +resource "aws_api_gateway_deployment" "api" { + rest_api_id = aws_api_gateway_rest_api.private_api.id + + triggers = { + redeployment = sha1(jsonencode([ + aws_api_gateway_resource.test.id, + aws_api_gateway_method.test.id, + aws_api_gateway_integration.test.id, + aws_api_gateway_integration_response.test.id, + aws_api_gateway_method_response.test.id + ])) + } + + lifecycle { + create_before_destroy = true + } + + depends_on = [ + aws_api_gateway_method.test, + aws_api_gateway_integration.test, + aws_api_gateway_integration_response.test, + aws_api_gateway_method_response.test, + aws_api_gateway_rest_api_policy.domain_policy + ] +} + + +resource "aws_api_gateway_stage" "api" { + deployment_id = aws_api_gateway_deployment.api.id + rest_api_id = aws_api_gateway_rest_api.private_api.id + stage_name = "prod" + + depends_on = [ + aws_api_gateway_deployment.api, + time_sleep.wait_for_deployment + ] +} + +resource "aws_api_gateway_domain_name" "api" { + domain_name = var.domain_name + certificate_arn = aws_acm_certificate.certificate.arn + security_policy = "TLS_1_2" + + endpoint_configuration { + types = ["PRIVATE"] + } + + policy = jsonencode({ + Version = "2012-10-17" + Statement = [ + { + Action = "execute-api:Invoke" + Effect = "Allow" + Principal = "*" + Resource = "*" + }, + { + Action = "execute-api:Invoke" + Effect = "Deny" + Principal = "*" + Resource = "*" + Condition = { + StringNotEquals = { + "aws:SourceVpce": aws_vpc_endpoint.execute_api.id + } + } + } + ] + }) + + depends_on = [ + aws_acm_certificate_validation.certificate, + time_sleep.wait_for_certificate_validation, + ] +} + +resource "aws_api_gateway_domain_name_access_association" "example" { + access_association_source = aws_vpc_endpoint.execute_api.id + access_association_source_type = "VPCE" + domain_name_arn = aws_api_gateway_domain_name.api.arn + + depends_on = [ + aws_api_gateway_domain_name.api, + aws_vpc_endpoint.execute_api, + time_sleep.wait_for_domain + ] +} + +resource "aws_api_gateway_base_path_mapping" "api" { + base_path = "" + api_id = aws_api_gateway_rest_api.private_api.id + domain_name = aws_api_gateway_domain_name.api.domain_name + stage_name = aws_api_gateway_stage.api.stage_name + domain_name_id = aws_api_gateway_domain_name.api.domain_name_id + + depends_on = [ + aws_api_gateway_stage.api, + aws_api_gateway_domain_name.api, + time_sleep.wait_for_domain + ] + + lifecycle { + create_before_destroy = true + } +} + +resource "aws_route53_record" "api" { + name = var.domain_name + type = "A" + zone_id = aws_route53_zone.private.id + + alias { + name = aws_vpc_endpoint.execute_api.dns_entry[0].dns_name + zone_id = aws_vpc_endpoint.execute_api.dns_entry[0].hosted_zone_id + evaluate_target_health = false + } + + depends_on = [ + aws_api_gateway_domain_name.api, + aws_vpc_endpoint.execute_api, + aws_api_gateway_domain_name_access_association.example, + time_sleep.wait_for_domain + ] +} diff --git a/private-apigw-custom-domain-private-restapi-public-lambda-terraform/outputs.tf b/private-apigw-custom-domain-private-restapi-public-lambda-terraform/outputs.tf new file mode 100644 index 000000000..db3628d75 --- /dev/null +++ b/private-apigw-custom-domain-private-restapi-public-lambda-terraform/outputs.tf @@ -0,0 +1,75 @@ +output "network_infrastructure" { + description = "Network Infrastructure Details" + value = { + vpc_id = aws_vpc.main.id + public_subnet_1_id = aws_subnet.public_1.id + public_subnet_2_id = aws_subnet.public_2.id + private_subnet_1_id = aws_subnet.private_1.id + private_subnet_2_id = aws_subnet.private_2.id + internet_gateway_id = aws_internet_gateway.main.id + nat_gateway_1_id = aws_nat_gateway.nat_1.id + nat_gateway_2_id = aws_nat_gateway.nat_2.id + route_tables = { + public = aws_route_table.public.id + private_1 = aws_route_table.private_1.id + private_2 = aws_route_table.private_2.id + } + } +} + +output "security" { + description = "Security Configuration Details" + value = { + vpc_endpoint_sg_id = aws_security_group.vpc_endpoint.id + ec2_sg_id = aws_security_group.ec2.id + ec2_role_arn = aws_iam_role.ec2_role.arn + ec2_profile_name = aws_iam_instance_profile.ec2_profile.name + } +} + +output "dns_and_certificates" { + description = "DNS and Certificate Details" + value = { + hosted_zone_id = aws_route53_zone.private.id + certificate_arn = aws_acm_certificate.certificate.arn + certificate_status = aws_acm_certificate.certificate.status + } +} + +output "vpc_endpoint_details" { + description = "VPC Endpoint Details" + value = { + id = aws_vpc_endpoint.execute_api.id + arn = aws_vpc_endpoint.execute_api.arn + dns_entry = aws_vpc_endpoint.execute_api.dns_entry + } +} + +output "api_gateway_configuration" { + description = "API Gateway Configuration Details" + value = { + rest_api_id = aws_api_gateway_rest_api.private_api.id + deployment_id = aws_api_gateway_deployment.api.id + stage_name = aws_api_gateway_stage.api.stage_name + domain_name = aws_api_gateway_domain_name.api.domain_name + endpoint_url = "https://${var.domain_name}/lambda" + } +} + +output "ec2_instance" { + description = "EC2 Instance Details" + value = { + id = aws_instance.test.id + public_ip = aws_instance.test.public_ip + private_ip = aws_instance.test.private_ip + } +} + +output "ssm_endpoints" { + description = "SSM VPC Endpoints" + value = { + ssm = aws_vpc_endpoint.ssm.id + ssmmessages = aws_vpc_endpoint.ssmmessages.id + ec2messages = aws_vpc_endpoint.ec2messages.id + } +} diff --git a/private-apigw-custom-domain-private-restapi-public-lambda-terraform/variables.tf b/private-apigw-custom-domain-private-restapi-public-lambda-terraform/variables.tf new file mode 100644 index 000000000..fca156d0b --- /dev/null +++ b/private-apigw-custom-domain-private-restapi-public-lambda-terraform/variables.tf @@ -0,0 +1,13 @@ +variable "domain_name" { + type = string + default = " " // private custom domaiun name + validation { + condition = can(regex("^[a-zA-Z0-9.-]+$", var.domain_name)) + error_message = "Domain name can only contain alphanumeric characters, dots, and hyphens." + } +} + +variable "region" { + type = string + default = " " //region +} \ No newline at end of file