From 376e37a84cd8c485770fdfab531394fb5c7048a8 Mon Sep 17 00:00:00 2001 From: Christopher Kampmeier Date: Sat, 11 Apr 2020 22:21:56 -0500 Subject: [PATCH] adding all content to new repo --- .gitignore | 3 + .gitmodules | 3 + CONTRIBUTING.md | 124 +++++ LICENSE | 152 ++++++ LICENSE-SAMPLECODE | 14 + LICENSE-SUMMARY | 5 + README.md | 13 + archetypes/default.md | 6 + config.toml | 59 ++ content/00-intro/01-intended-audience.md | 18 + .../00-intro/02-foundation-capabilities.md | 48 ++ content/00-intro/03-required-skills.md | 21 + content/00-intro/04-stages-of-adoption.md | 13 + content/00-intro/05-initial-foundation.md | 15 + content/00-intro/06-faqs.md | 53 ++ content/00-intro/_index.md | 15 + .../01-review-dev-environment-requirements.md | 58 ++ .../02-review-dev-environment-solution.md | 81 +++ .../03-map-people-to-foundation-roles.md | 44 ++ .../04-address-prerequisites.md | 94 ++++ .../01-perform-up-front-tasks/_index.md | 9 + .../01-create-master-aws-account.md | 100 ++++ .../02-set-up-landing-zone.md | 113 ++++ .../03-set-up-aws-platform-access-controls.md | 242 ++++++++ .../04-onboard-foundation-team.md | 54 ++ .../05-set-up-common-dev-network.md | 247 +++++++++ .../06-create-team-dev-environments.md | 121 ++++ .../07-onboard-builder-teams.md | 85 +++ .../02-establish-initial-foundation/_index.md | 10 + ...g-started-guide-foundation-team-members.md | 138 +++++ ...ting-started-guide-builder-team-members.md | 144 +++++ .../_index.md | 8 + .../02-controlling-builder-team-access.md | 516 ++++++++++++++++++ .../03-cloud-platform-system-users.md | 74 +++ .../04-using-aws-services/01-cloud9.md | 53 ++ .../04-using-aws-services/02-eks.md | 64 +++ .../04-using-aws-services/03-redshift.md | 57 ++ .../04-using-aws-services/_index.md | 27 + content/01-dev/03-reference/_index.md | 7 + content/01-dev/_index.md | 20 + .../01-cost-mgmt/01-invoice-billing.md | 7 + .../02-dev-fast-follow/01-cost-mgmt/_index.md | 7 + .../01-enhanced-access-controls.md | 11 + ...nced-security-monitoring-and-compliance.md | 20 + .../03-federated-access-to-aws.md | 37 ++ .../04-secure-os-access.md | 13 + .../05-siem-integration.md | 23 + .../02-security-compliance/_index.md | 7 + .../01-on-premises-network-integration.md | 43 ++ .../02-outbound-internet-filtering.md | 41 ++ .../03-network-integration/_index.md | 7 + .../01-infrastructure-as-code.md | 7 + .../02-custom-account-baselines.md | 45 ++ .../03-move-other-aws-accounts.md | 7 + .../04-foundation-mgmt/_index.md | 7 + .../05-windows-workloads/_index.md | 12 + .../06-linux-workloads/_index.md | 12 + content/02-dev-fast-follow/_index.md | 15 + .../02-review-preprod-prod-solution.md | 33 ++ content/03-preprod-prod/_index.md | 68 +++ .../01-resource-naming-tagging.md | 8 + content/04-prod-fast-follow/_index.md | 13 + content/05-project/01-project-faqs.md | 24 + content/05-project/02-project-tenets.md | 61 +++ content/05-project/03-contributing.md | 7 + content/05-project/04-authors.md | 7 + content/05-project/05-change-history.md | 15 + content/05-project/06-repository.md | 8 + content/05-project/_index.md | 9 + content/_index.md | 18 + drawings/initial-foundation.drawio | 1 + layouts/partials/logo.html | 1 + layouts/partials/menu-footer.html | 4 + layouts/shortcodes/toc.html | 3 + .../acme-base-team-dev-boundary.yml | 128 +++++ .../acme-base-team-dev-saml.json | 123 +++++ ...acme-base-team-dev-scp-vpc-boundaries.json | 128 +++++ .../acme-base-team-dev-scp-vpc-internals.json | 66 +++ static/css/theme-mine.css | 165 ++++++ static/images/00-intro/foundation.png | Bin 0 -> 57812 bytes static/images/00-intro/stages-of-adoption.png | Bin 0 -> 54171 bytes .../01-dev/accept-aws-sso-invitation.png | Bin 0 -> 138510 bytes ...tower-account-factory-network-settings.png | Bin 0 -> 65656 bytes static/images/01-dev/dev-initial.png | Bin 0 -> 279106 bytes .../01-dev/dev-network-initial-details.png | Bin 0 -> 233235 bytes .../01-dev/team-dev-access-provisioning.png | Bin 0 -> 106951 bytes .../images/01-dev/team-dev-access-usage.png | Bin 0 -> 217907 bytes .../02-dev-fast-follow/dev-fast-follow.png | Bin 0 -> 424680 bytes .../preprod-prod-single-region.png | Bin 0 -> 505025 bytes static/images/favicon.png | Bin 0 -> 575 bytes themes/learn | 1 + 91 files changed, 4140 insertions(+) create mode 100644 .gitignore create mode 100644 .gitmodules create mode 100644 CONTRIBUTING.md create mode 100644 LICENSE create mode 100644 LICENSE-SAMPLECODE create mode 100644 LICENSE-SUMMARY create mode 100644 README.md create mode 100644 archetypes/default.md create mode 100644 config.toml create mode 100644 content/00-intro/01-intended-audience.md create mode 100644 content/00-intro/02-foundation-capabilities.md create mode 100644 content/00-intro/03-required-skills.md create mode 100644 content/00-intro/04-stages-of-adoption.md create mode 100644 content/00-intro/05-initial-foundation.md create mode 100644 content/00-intro/06-faqs.md create mode 100644 content/00-intro/_index.md create mode 100644 content/01-dev/01-perform-up-front-tasks/01-review-dev-environment-requirements.md create mode 100644 content/01-dev/01-perform-up-front-tasks/02-review-dev-environment-solution.md create mode 100644 content/01-dev/01-perform-up-front-tasks/03-map-people-to-foundation-roles.md create mode 100644 content/01-dev/01-perform-up-front-tasks/04-address-prerequisites.md create mode 100644 content/01-dev/01-perform-up-front-tasks/_index.md create mode 100644 content/01-dev/02-establish-initial-foundation/01-create-master-aws-account.md create mode 100644 content/01-dev/02-establish-initial-foundation/02-set-up-landing-zone.md create mode 100644 content/01-dev/02-establish-initial-foundation/03-set-up-aws-platform-access-controls.md create mode 100644 content/01-dev/02-establish-initial-foundation/04-onboard-foundation-team.md create mode 100644 content/01-dev/02-establish-initial-foundation/05-set-up-common-dev-network.md create mode 100644 content/01-dev/02-establish-initial-foundation/06-create-team-dev-environments.md create mode 100644 content/01-dev/02-establish-initial-foundation/07-onboard-builder-teams.md create mode 100644 content/01-dev/02-establish-initial-foundation/_index.md create mode 100644 content/01-dev/03-reference/01-getting-started-guide-examples/01-getting-started-guide-foundation-team-members.md create mode 100644 content/01-dev/03-reference/01-getting-started-guide-examples/02-getting-started-guide-builder-team-members.md create mode 100644 content/01-dev/03-reference/01-getting-started-guide-examples/_index.md create mode 100644 content/01-dev/03-reference/02-controlling-builder-team-access.md create mode 100644 content/01-dev/03-reference/03-cloud-platform-system-users.md create mode 100644 content/01-dev/03-reference/04-using-aws-services/01-cloud9.md create mode 100644 content/01-dev/03-reference/04-using-aws-services/02-eks.md create mode 100644 content/01-dev/03-reference/04-using-aws-services/03-redshift.md create mode 100644 content/01-dev/03-reference/04-using-aws-services/_index.md create mode 100644 content/01-dev/03-reference/_index.md create mode 100644 content/01-dev/_index.md create mode 100644 content/02-dev-fast-follow/01-cost-mgmt/01-invoice-billing.md create mode 100644 content/02-dev-fast-follow/01-cost-mgmt/_index.md create mode 100644 content/02-dev-fast-follow/02-security-compliance/01-enhanced-access-controls.md create mode 100644 content/02-dev-fast-follow/02-security-compliance/02-enhanced-security-monitoring-and-compliance.md create mode 100644 content/02-dev-fast-follow/02-security-compliance/03-federated-access-to-aws.md create mode 100644 content/02-dev-fast-follow/02-security-compliance/04-secure-os-access.md create mode 100644 content/02-dev-fast-follow/02-security-compliance/05-siem-integration.md create mode 100644 content/02-dev-fast-follow/02-security-compliance/_index.md create mode 100644 content/02-dev-fast-follow/03-network-integration/01-on-premises-network-integration.md create mode 100644 content/02-dev-fast-follow/03-network-integration/02-outbound-internet-filtering.md create mode 100644 content/02-dev-fast-follow/03-network-integration/_index.md create mode 100644 content/02-dev-fast-follow/04-foundation-mgmt/01-infrastructure-as-code.md create mode 100644 content/02-dev-fast-follow/04-foundation-mgmt/02-custom-account-baselines.md create mode 100644 content/02-dev-fast-follow/04-foundation-mgmt/03-move-other-aws-accounts.md create mode 100644 content/02-dev-fast-follow/04-foundation-mgmt/_index.md create mode 100644 content/02-dev-fast-follow/05-windows-workloads/_index.md create mode 100644 content/02-dev-fast-follow/06-linux-workloads/_index.md create mode 100644 content/02-dev-fast-follow/_index.md create mode 100644 content/03-preprod-prod/02-review-preprod-prod-solution.md create mode 100644 content/03-preprod-prod/_index.md create mode 100644 content/04-prod-fast-follow/01-resource-naming-tagging.md create mode 100644 content/04-prod-fast-follow/_index.md create mode 100644 content/05-project/01-project-faqs.md create mode 100644 content/05-project/02-project-tenets.md create mode 100644 content/05-project/03-contributing.md create mode 100644 content/05-project/04-authors.md create mode 100644 content/05-project/05-change-history.md create mode 100644 content/05-project/06-repository.md create mode 100644 content/05-project/_index.md create mode 100644 content/_index.md create mode 100644 drawings/initial-foundation.drawio create mode 100644 layouts/partials/logo.html create mode 100644 layouts/partials/menu-footer.html create mode 100644 layouts/shortcodes/toc.html create mode 100644 static/code-samples/01-iam-policies/acme-base-team-dev-boundary.yml create mode 100644 static/code-samples/01-iam-policies/acme-base-team-dev-saml.json create mode 100644 static/code-samples/02-scps/acme-base-team-dev-scp-vpc-boundaries.json create mode 100644 static/code-samples/02-scps/acme-base-team-dev-scp-vpc-internals.json create mode 100644 static/css/theme-mine.css create mode 100644 static/images/00-intro/foundation.png create mode 100644 static/images/00-intro/stages-of-adoption.png create mode 100644 static/images/01-dev/accept-aws-sso-invitation.png create mode 100644 static/images/01-dev/control-tower-account-factory-network-settings.png create mode 100644 static/images/01-dev/dev-initial.png create mode 100644 static/images/01-dev/dev-network-initial-details.png create mode 100644 static/images/01-dev/team-dev-access-provisioning.png create mode 100644 static/images/01-dev/team-dev-access-usage.png create mode 100644 static/images/02-dev-fast-follow/dev-fast-follow.png create mode 100644 static/images/03-preprod-prod/preprod-prod-single-region.png create mode 100644 static/images/favicon.png create mode 160000 themes/learn diff --git a/.gitignore b/.gitignore new file mode 100644 index 0000000..ce09f14 --- /dev/null +++ b/.gitignore @@ -0,0 +1,3 @@ +public/ +resources/ +**/.DS_Store diff --git a/.gitmodules b/.gitmodules new file mode 100644 index 0000000..6433a7d --- /dev/null +++ b/.gitmodules @@ -0,0 +1,3 @@ +[submodule "themes/learn"] + path = themes/learn + url = https://github.com/matcornic/hugo-theme-learn.git diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md new file mode 100644 index 0000000..82d45d8 --- /dev/null +++ b/CONTRIBUTING.md @@ -0,0 +1,124 @@ +# Contributing Guidelines + +Thank you for your interest in contributing to our project. Whether it's a bug report, new feature, correction, or additional +documentation, we greatly value feedback and contributions from our community. + +Please read through this document before submitting any issues or pull requests to ensure we have all the necessary +information to effectively respond to your bug report or contribution. + +* [Reporting Bugs and Feature Requests](#reporting-bugs-and-feature-requests) +* [Contributing via Pull Requests](#contributing-via-pull-requests) +* [Code of Conduct](#code-of-conduct) +* [Security Issue Notifications](#security-issue-notifications) +* [Working with Content](#working-with-content) +* [Licensing](#licensing) + +## Reporting Bugs and Feature Requests + +We welcome you to use the GitHub issue tracker to report bugs or suggest features. + +When filing an issue, please check existing open, or recently closed, issues to make sure somebody else hasn't already +reported the issue. + +See the project [Kanban board](https://github.com/aws-samples/aws-get-started-workshop/projects/1?fullscreen=true) for the set of already filed issues and work in progress. + +When filing an issue, please try to include as much information as you can. Details like these are incredibly useful: + +* A reproducible test case or series of steps +* The version of our code being used +* Any modifications you've made relevant to the bug +* Anything unusual about your environment or deployment + +## Contributing via Pull Requests +Contributions via pull requests are much appreciated. Before sending us a pull request, please ensure that: + +1. You are working against the latest source on the *master* branch. +2. You check existing open, and recently merged, pull requests to make sure someone else hasn't addressed the problem already. +3. You open an issue to discuss any significant work - we would hate for your time to be wasted. + +To send us a pull request, please: + +1. Fork the repository. +2. Modify the source; please focus on the specific change you are contributing. If you also reformat all the code, it will be hard for us to focus on your change. +3. Ensure local tests pass. +4. Commit to your fork using clear commit messages. +5. Send us a pull request, answering any default questions in the pull request interface. +6. Pay attention to any automated CI failures reported in the pull request, and stay involved in the conversation. + +GitHub provides additional document on [forking a repository](https://help.github.com/articles/fork-a-repo/) and +[creating a pull request](https://help.github.com/articles/creating-a-pull-request/). + +## Code of Conduct +This project has adopted the [Amazon Open Source Code of Conduct](https://aws.github.io/code-of-conduct). +For more information see the [Code of Conduct FAQ](https://aws.github.io/code-of-conduct-faq) or contact +opensource-codeofconduct@amazon.com with any additional questions or comments. + +## Security Issue Notifications +If you discover a potential security issue in this project we ask that you notify AWS/Amazon Security via our [vulnerability reporting page](http://aws.amazon.com/security/vulnerability-reporting/). Please do **not** create a public github issue. + +## Working with Content + +### Use of Hugo Static Site Generator + +The [Hugo](https://gohugo.io/) static site generator is used to render the content managed in this repository. You can install and use Hugo locally to render and review the content. + +#### Install Hugo + +See [Install Hugo](https://gohugo.io/getting-started/installing/). + +#### Install Learn Theme + +Once you have the repository cloned locally, install the "Learn" Hugo theme + +``` +$ cd + +$ git submodule init ; git submodule update +``` + +#### Start Hugo Locally for Testing + +``` +$ hugo server -D +``` + +Access http://localhost:1313/ + +### Defer to External Docs Where Feasible + +When there's modular, to-the-point official documentation that can be linked to, we prefer that route vs duplicating lengthy instructions within these guides. + +However, when any of the following conditions apply, in the interest of providing a cohesive user experience, we don't hesitate to embed instructions inline: + * Steps are so few and simple that it's not worth distracting the reader by forcing them to go to another document. + * The instructions require context or specific data to be used that other more general purpose guides don't include. + * Instructions in other docs cannot be directly accessed via a link. For example, linking to a large PDF document and asking the reader to find a section for specific instructions is a non-starter in terms of the user experience. + +### Working with draw.io Files + +See the `drawings/` directory for the draw.io source files used for pictures and diagrams. + +The `.png` drawings used in this repository are created in the following manner: + +1. Open the `.drawio` file of interest using either the free online version or your internal instance of draw.io. +1. Select the tab of interst. +1. Select "Edit -> Select All" +1. Select "File -> Export As -> PNG..." +1. Select "Selection Only" and "Crop". +1. Select "Export" +1. Select "Download" + +Copy the exported PNG file to the approprite directory under `static/images/` and rename it to suit your needs. + +#### Tab Names in drawio Files + +Since the file name and tab name are used to create the file names of exported images, you can minimize work required to export images by ensuring that the tab names represent what you'd like to use for the image names. When renaming, you'll just need to remove the file name that is included by default in the export image file name. + +### Linking to Images + +Since the project uses the [Hugo](https://gohugo.io/) static web site generation tool, see the Hugo documentation for examples of how to include images in content pages. + +## Licensing + +See the [LICENSE](LICENSE) file for our project's licensing. We will ask you to confirm the licensing of your contribution. + +We may ask you to sign a [Contributor License Agreement (CLA)](http://en.wikipedia.org/wiki/Contributor_License_Agreement) for larger changes. diff --git a/LICENSE b/LICENSE new file mode 100644 index 0000000..7785b90 --- /dev/null +++ b/LICENSE @@ -0,0 +1,152 @@ +Creative Commons Attribution-ShareAlike 4.0 International Public License + +By exercising the Licensed Rights (defined below), You accept and agree to be bound by the terms and conditions of this Creative Commons Attribution-ShareAlike 4.0 International Public License ("Public License"). To the extent this Public License may be interpreted as a contract, You are granted the Licensed Rights in consideration of Your acceptance of these terms and conditions, and the Licensor grants You such rights in consideration of benefits the Licensor receives from making the Licensed Material available under these terms and conditions. + +Section 1 – Definitions. + + a. Adapted Material means material subject to Copyright and Similar Rights that is derived from or based upon the Licensed Material and in which the Licensed Material is translated, altered, arranged, transformed, or otherwise modified in a manner requiring permission under the Copyright and Similar Rights held by the Licensor. For purposes of this Public License, where the Licensed Material is a musical work, performance, or sound recording, Adapted Material is always produced where the Licensed Material is synched in timed relation with a moving image. + + b. Adapter's License means the license You apply to Your Copyright and Similar Rights in Your contributions to Adapted Material in accordance with the terms and conditions of this Public License. + + c. BY-SA Compatible License means a license listed at creativecommons.org/compatiblelicenses, approved by Creative Commons as essentially the equivalent of this Public License. + + d. Copyright and Similar Rights means copyright and/or similar rights closely related to copyright including, without limitation, performance, broadcast, sound recording, and Sui Generis Database Rights, without regard to how the rights are labeled or categorized. For purposes of this Public License, the rights specified in Section 2(b)(1)-(2) are not Copyright and Similar Rights. + + e. Effective Technological Measures means those measures that, in the absence of proper authority, may not be circumvented under laws fulfilling obligations under Article 11 of the WIPO Copyright Treaty adopted on December 20, 1996, and/or similar international agreements. + + f. Exceptions and Limitations means fair use, fair dealing, and/or any other exception or limitation to Copyright and Similar Rights that applies to Your use of the Licensed Material. + + g. License Elements means the license attributes listed in the name of a Creative Commons Public License. The License Elements of this Public License are Attribution and ShareAlike. + + h. Licensed Material means the artistic or literary work, database, or other material to which the Licensor applied this Public License. + + i. Licensed Rights means the rights granted to You subject to the terms and conditions of this Public License, which are limited to all Copyright and Similar Rights that apply to Your use of the Licensed Material and that the Licensor has authority to license. + + j. Licensor means the individual(s) or entity(ies) granting rights under this Public License. + + k. Share means to provide material to the public by any means or process that requires permission under the Licensed Rights, such as reproduction, public display, public performance, distribution, dissemination, communication, or importation, and to make material available to the public including in ways that members of the public may access the material from a place and at a time individually chosen by them. + + l. Sui Generis Database Rights means rights other than copyright resulting from Directive 96/9/EC of the European Parliament and of the Council of 11 March 1996 on the legal protection of databases, as amended and/or succeeded, as well as other essentially equivalent rights anywhere in the world. + + m. You means the individual or entity exercising the Licensed Rights under this Public License. Your has a corresponding meaning. + +Section 2 – Scope. + + a. License grant. + + 1. Subject to the terms and conditions of this Public License, the Licensor hereby grants You a worldwide, royalty-free, non-sublicensable, non-exclusive, irrevocable license to exercise the Licensed Rights in the Licensed Material to: + + A. reproduce and Share the Licensed Material, in whole or in part; and + + B. produce, reproduce, and Share Adapted Material. + + 2. Exceptions and Limitations. For the avoidance of doubt, where Exceptions and Limitations apply to Your use, this Public License does not apply, and You do not need to comply with its terms and conditions. + + 3. Term. The term of this Public License is specified in Section 6(a). + + 4. Media and formats; technical modifications allowed. The Licensor authorizes You to exercise the Licensed Rights in all media and formats whether now known or hereafter created, and to make technical modifications necessary to do so. The Licensor waives and/or agrees not to assert any right or authority to forbid You from making technical modifications necessary to exercise the Licensed Rights, including technical modifications necessary to circumvent Effective Technological Measures. For purposes of this Public License, simply making modifications authorized by this Section 2(a)(4) never produces Adapted Material. + + 5. Downstream recipients. + + A. Offer from the Licensor – Licensed Material. Every recipient of the Licensed Material automatically receives an offer from the Licensor to exercise the Licensed Rights under the terms and conditions of this Public License. + + B. Additional offer from the Licensor – Adapted Material. Every recipient of Adapted Material from You automatically receives an offer from the Licensor to exercise the Licensed Rights in the Adapted Material under the conditions of the Adapter’s License You apply. + + C. No downstream restrictions. You may not offer or impose any additional or different terms or conditions on, or apply any Effective Technological Measures to, the Licensed Material if doing so restricts exercise of the Licensed Rights by any recipient of the Licensed Material. + + 6. No endorsement. Nothing in this Public License constitutes or may be construed as permission to assert or imply that You are, or that Your use of the Licensed Material is, connected with, or sponsored, endorsed, or granted official status by, the Licensor or others designated to receive attribution as provided in Section 3(a)(1)(A)(i). + + b. Other rights. + + 1. Moral rights, such as the right of integrity, are not licensed under this Public License, nor are publicity, privacy, and/or other similar personality rights; however, to the extent possible, the Licensor waives and/or agrees not to assert any such rights held by the Licensor to the limited extent necessary to allow You to exercise the Licensed Rights, but not otherwise. + + 2. Patent and trademark rights are not licensed under this Public License. + + 3. To the extent possible, the Licensor waives any right to collect royalties from You for the exercise of the Licensed Rights, whether directly or through a collecting society under any voluntary or waivable statutory or compulsory licensing scheme. In all other cases the Licensor expressly reserves any right to collect such royalties. + +Section 3 – License Conditions. + +Your exercise of the Licensed Rights is expressly made subject to the following conditions. + + a. Attribution. + + 1. If You Share the Licensed Material (including in modified form), You must: + + A. retain the following if it is supplied by the Licensor with the Licensed Material: + + i. identification of the creator(s) of the Licensed Material and any others designated to receive attribution, in any reasonable manner requested by the Licensor (including by pseudonym if designated); + + ii. a copyright notice; + + iii. a notice that refers to this Public License; + + iv. a notice that refers to the disclaimer of warranties; + + v. a URI or hyperlink to the Licensed Material to the extent reasonably practicable; + + B. indicate if You modified the Licensed Material and retain an indication of any previous modifications; and + + C. indicate the Licensed Material is licensed under this Public License, and include the text of, or the URI or hyperlink to, this Public License. + + 2. You may satisfy the conditions in Section 3(a)(1) in any reasonable manner based on the medium, means, and context in which You Share the Licensed Material. For example, it may be reasonable to satisfy the conditions by providing a URI or hyperlink to a resource that includes the required information. + + 3. If requested by the Licensor, You must remove any of the information required by Section 3(a)(1)(A) to the extent reasonably practicable. + + b. ShareAlike.In addition to the conditions in Section 3(a), if You Share Adapted Material You produce, the following conditions also apply. + + 1. The Adapter’s License You apply must be a Creative Commons license with the same License Elements, this version or later, or a BY-SA Compatible License. + + 2. You must include the text of, or the URI or hyperlink to, the Adapter's License You apply. You may satisfy this condition in any reasonable manner based on the medium, means, and context in which You Share Adapted Material. + + 3. You may not offer or impose any additional or different terms or conditions on, or apply any Effective Technological Measures to, Adapted Material that restrict exercise of the rights granted under the Adapter's License You apply. + +Section 4 – Sui Generis Database Rights. + +Where the Licensed Rights include Sui Generis Database Rights that apply to Your use of the Licensed Material: + + a. for the avoidance of doubt, Section 2(a)(1) grants You the right to extract, reuse, reproduce, and Share all or a substantial portion of the contents of the database; + + b. if You include all or a substantial portion of the database contents in a database in which You have Sui Generis Database Rights, then the database in which You have Sui Generis Database Rights (but not its individual contents) is Adapted Material, including for purposes of Section 3(b); and + + c. You must comply with the conditions in Section 3(a) if You Share all or a substantial portion of the contents of the database. +For the avoidance of doubt, this Section 4 supplements and does not replace Your obligations under this Public License where the Licensed Rights include other Copyright and Similar Rights. + +Section 5 – Disclaimer of Warranties and Limitation of Liability. + + a. Unless otherwise separately undertaken by the Licensor, to the extent possible, the Licensor offers the Licensed Material as-is and as-available, and makes no representations or warranties of any kind concerning the Licensed Material, whether express, implied, statutory, or other. This includes, without limitation, warranties of title, merchantability, fitness for a particular purpose, non-infringement, absence of latent or other defects, accuracy, or the presence or absence of errors, whether or not known or discoverable. Where disclaimers of warranties are not allowed in full or in part, this disclaimer may not apply to You. + + b. To the extent possible, in no event will the Licensor be liable to You on any legal theory (including, without limitation, negligence) or otherwise for any direct, special, indirect, incidental, consequential, punitive, exemplary, or other losses, costs, expenses, or damages arising out of this Public License or use of the Licensed Material, even if the Licensor has been advised of the possibility of such losses, costs, expenses, or damages. Where a limitation of liability is not allowed in full or in part, this limitation may not apply to You. + + c. The disclaimer of warranties and limitation of liability provided above shall be interpreted in a manner that, to the extent possible, most closely approximates an absolute disclaimer and waiver of all liability. + +Section 6 – Term and Termination. + + a. This Public License applies for the term of the Copyright and Similar Rights licensed here. However, if You fail to comply with this Public License, then Your rights under this Public License terminate automatically. + + b. Where Your right to use the Licensed Material has terminated under Section 6(a), it reinstates: + + 1. automatically as of the date the violation is cured, provided it is cured within 30 days of Your discovery of the violation; or + + 2. upon express reinstatement by the Licensor. + + c. For the avoidance of doubt, this Section 6(b) does not affect any right the Licensor may have to seek remedies for Your violations of this Public License. + + d. For the avoidance of doubt, the Licensor may also offer the Licensed Material under separate terms or conditions or stop distributing the Licensed Material at any time; however, doing so will not terminate this Public License. + + e. Sections 1, 5, 6, 7, and 8 survive termination of this Public License. + +Section 7 – Other Terms and Conditions. + + a. The Licensor shall not be bound by any additional or different terms or conditions communicated by You unless expressly agreed. + + b. Any arrangements, understandings, or agreements regarding the Licensed Material not stated herein are separate from and independent of the terms and conditions of this Public License. + +Section 8 – Interpretation. + + a. For the avoidance of doubt, this Public License does not, and shall not be interpreted to, reduce, limit, restrict, or impose conditions on any use of the Licensed Material that could lawfully be made without permission under this Public License. + + b. To the extent possible, if any provision of this Public License is deemed unenforceable, it shall be automatically reformed to the minimum extent necessary to make it enforceable. If the provision cannot be reformed, it shall be severed from this Public License without affecting the enforceability of the remaining terms and conditions. + + c. No term or condition of this Public License will be waived and no failure to comply consented to unless expressly agreed to by the Licensor. + + d. Nothing in this Public License constitutes or may be interpreted as a limitation upon, or waiver of, any privileges and immunities that apply to the Licensor or You, including from the legal processes of any jurisdiction or authority. diff --git a/LICENSE-SAMPLECODE b/LICENSE-SAMPLECODE new file mode 100644 index 0000000..0b6f929 --- /dev/null +++ b/LICENSE-SAMPLECODE @@ -0,0 +1,14 @@ +Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. + +Permission is hereby granted, free of charge, to any person obtaining a copy of this +software and associated documentation files (the "Software"), to deal in the Software +without restriction, including without limitation the rights to use, copy, modify, +merge, publish, distribute, sublicense, and/or sell copies of the Software, and to +permit persons to whom the Software is furnished to do so. + +THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, +INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A +PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT +HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION +OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE +SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. diff --git a/LICENSE-SUMMARY b/LICENSE-SUMMARY new file mode 100644 index 0000000..39b5a31 --- /dev/null +++ b/LICENSE-SUMMARY @@ -0,0 +1,5 @@ +Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. + +The documentation is made available under the Creative Commons Attribution-ShareAlike 4.0 International License. See the LICENSE file. + +The sample code within this documentation is made available under the MIT-0 license. See the LICENSE-SAMPLECODE file. diff --git a/README.md b/README.md new file mode 100644 index 0000000..3d9c3b8 --- /dev/null +++ b/README.md @@ -0,0 +1,13 @@ +# Get Started with AWS for Formal Workloads + +This project provides a guided workshop to help customers accelerate the process of getting an initial formal foundation established in AWS in support of their development, pre-production test, and production environments so that customers can quickly get their first few workloads into production to start deriving value from their initial stage of adopting the AWS cloud platform. + +See the live workshop site at: https://...tbd... + +If you would like to contribute to the project, see [CONTRIBUTING.md](CONTRIBUTING.md). + +## License Summary + +The documentation is made available under the Creative Commons Attribution-ShareAlike 4.0 International License. See the LICENSE file. + +The sample code within this documentation is made available under the MIT-0 license. See the LICENSE-SAMPLECODE file. diff --git a/archetypes/default.md b/archetypes/default.md new file mode 100644 index 0000000..00e77bd --- /dev/null +++ b/archetypes/default.md @@ -0,0 +1,6 @@ +--- +title: "{{ replace .Name "-" " " | title }}" +date: {{ .Date }} +draft: true +--- + diff --git a/config.toml b/config.toml new file mode 100644 index 0000000..11a2998 --- /dev/null +++ b/config.toml @@ -0,0 +1,59 @@ +baseURL = "/" +defaultContentLanguage = "en" +defaultContentLanguageInSubdir= false +enableMissingTranslationPlaceholders = false + +title = "Getting Started with AWS for Formal Projects" + +theme = "learn" + +# Makes it easier to deliver content through CloudFront while not allowing +# public read access to the web content S3 bucket. +uglyurls = true + +#relativeURLs = true # Need to research: https://gohugo.io/content-management/urls/ + +enableGitInfo = true + +enableEmoji = true + +# Code Syntax Highlighting +pygmentsCodeFences = true +pygmentsUseClasses = true +pygmentsStyle = "monokailight" + +[params] +editURL = "https://github.com/aws-samples/aws-get-started-workshop/edit/master/content/" + +showVisitedLinks = false +disableInlineCopyToClipBoard = true + +themeVariant = "mine" + +ordersectionsby = "weight" # ordersectionsby = "title" + +disableHomeIcon = true +disableSearch = false + +disableNavChevron = false # set true to hide next/prev chevron, default is false +highlightClientSide = false # set true to use highlight.pack.js instead of the default hugo chroma highlighter +menushortcutsnewtab = false # set true to open shortcuts links to a new tab/window +enableGitInfo = true + +dateformat = "" # default "2 Jan 2006" + +# Analytic section +# google_analytics_id = "" # Your Google Analytics tracking id +# tag_manager_container_id = "" # Your Google Tag Manager container id +# google_site_verification = "" # Your Google Site Verification for Search Console + +[outputs] +home = [ "HTML", "RSS", "JSON"] + +# Markup configure section +# See https://gohugo.io/getting-started/configuration-markup/ +[markup] + [markup.tableOfContents] + startLevel = 2 + endLevel = 2 + ordered = false \ No newline at end of file diff --git a/content/00-intro/01-intended-audience.md b/content/00-intro/01-intended-audience.md new file mode 100644 index 0000000..bfff582 --- /dev/null +++ b/content/00-intro/01-intended-audience.md @@ -0,0 +1,18 @@ +--- +title: 'Intended Audience' +disableToc: true +weight: 10 +--- + +## Your Initial Cloud Foundation Team +This guide is primarily intended to be used by your organization's technologists who will be responsible for establishing and maintaining your inital AWS environment. These technologists will make up the initial form of your "cloud foundation" or "cloud platform" team. + +## Your Business Workload Owners + +Typically, you'll have another set of technologists who are responsible for owning the first few "workloads" to be hosted on AWS. Examples of workloads include existing applications or data that are to be migrated from on-premises to the cloud or new data and application services. + +Your workload owners are customers of your cloud foundation team and will benefit from the environments and documentation the foundation team establishes by following this guide. + +## Collectively: "Builders" + +At AWS we refer to both your workload oriented technologists - app developers, data engineers, data scientists, data analysts - and your infrastructure oriented cloud foundation team members as ["builders"](https://aws.amazon.com/campaigns/build-on-aws/) in that they are all responsible for building value using the AWS platform. \ No newline at end of file diff --git a/content/00-intro/02-foundation-capabilities.md b/content/00-intro/02-foundation-capabilities.md new file mode 100644 index 0000000..1b6cf53 --- /dev/null +++ b/content/00-intro/02-foundation-capabilities.md @@ -0,0 +1,48 @@ +--- +title: 'Foundation Capabilities in Scope' +menuTitle: 'Foundation Capabilities' +disableToc: true +weight: 20 +--- + +This guide helps you establish a set of AWS foundational capabilities to help support your use of development, test, and production hosting environments for your first few initial workloads. + +Other capabilities that are specific to your workloads and your desired Software Development Lifecycle (SDLC) and operational processes including supporting tools are not currently addressed by this guide. You'll layer those capabilities and solutions on top of the initial foundation addressed in this guide. + +## Foundation Capabilities in Scope + +Initial forms of foundation capabilities addressed by this guide include: + +**AWS Organizational and Account Structure** +* Centralized billing and cost management. +* An initial AWS account structure. +* Automated AWS account provisioning. +* AWS accounts for foundation management and workload hosting environments including development, pre-production, and production. + +**Security** +* AWS account hardening. +* Guardrails for overall AWS environment security. +* Centralized secure logging of AWS API calls and AWS resource configuration changes. +* Federated access to the AWS platform. +* Policies for managing access to AWS accounts. + * Cloud platform team access including cloud and security administration, audit, and finance. + * Builder team access to team development environments. + * Least privileged access to pre-production and production environments. + +**Networking** +* Virtual networking for hosting workloads. +* On-premises network connectivity. +* Internet integration. + +**Foundation Automation** +* Distirbuting foundation baseline configurations to AWS accounts. + +{{% notice note %}} +**Review Note:** Insert a layered architecture diagram to highlight the foundational capabilities that you will establish via this guide in support of your first few workloads moving into production will be just the start of an ongoing establishment of foundational capabilities. The upper layers of the diagram will show capabilites that are more workload and perhaps origanizational tool specific that are not addressed by the guide. For example, what the customer puts into their team development AWS accounts is outside the scope of the guide. +{{% /notice %}} + +## Progression of Foundation Capabilities + +{{% notice note %}} +**Review Note:** This section will use the familiar notion of "crawl, walk, run" to emphasize that the initial set of capabilities and their degrees of realization as addressed in this guide is more akin to the "crawl" stage of cloud adoption and that further investment in the foundation is often needed as adoption expands. +{{% /notice %}} \ No newline at end of file diff --git a/content/00-intro/03-required-skills.md b/content/00-intro/03-required-skills.md new file mode 100644 index 0000000..7515a8d --- /dev/null +++ b/content/00-intro/03-required-skills.md @@ -0,0 +1,21 @@ +--- +title: 'Required Skills' +disableToc: true +weight: 30 +--- + +## Assistance from AWS and Partners + +Although this guide has been developed with a goal of providing enough detail so that you can establish an initial cloud foundation in support of development, pre-production test, and production environments on your own, if your organization is new to AWS and doesn't have the necessary skills, you will likely benefit from working with your AWS sales team and AWS partners to help you navigate through this early stage of formally establishing a foundation on AWS. + +## Common Across Builders + +... + +## Cloud Foundation Team Members + +... + +## Workload Owners + +... diff --git a/content/00-intro/04-stages-of-adoption.md b/content/00-intro/04-stages-of-adoption.md new file mode 100644 index 0000000..89d819f --- /dev/null +++ b/content/00-intro/04-stages-of-adoption.md @@ -0,0 +1,13 @@ +--- +title: 'Stages of Cloud Adoption' +disableToc: true +weight: 40 +--- + +Based on almost 14 years of experience in helping customers obtain business benefits of cloud adoption, AWS has identified the following mental model to represent the [stages of cloud adoption](https://aws.amazon.com/blogs/enterprise-strategy/the-journey-toward-cloud-first-the-stages-of-adoption/). + +![Stages of Cloud Adoption](/images/00-intro/stages-of-adoption.png) + +Organizations leveraging these guides are typically in the “Project” stage of adoption during which they are starting with a relatively small set of people and a few projects to begin to understand how they can leverage the cloud to meet a business need. + +Once an enterprise has gained some benefit from the cloud by taking a few projects to production, an organization tends to move toward a "Foundation" stage in which the organization makes more extensive investments in boths its people and its cloud foundation in support of scaling cloud adoption across the organization with the goal of gaining more extensive business benefits. \ No newline at end of file diff --git a/content/00-intro/05-initial-foundation.md b/content/00-intro/05-initial-foundation.md new file mode 100644 index 0000000..3242c92 --- /dev/null +++ b/content/00-intro/05-initial-foundation.md @@ -0,0 +1,15 @@ +--- +title: 'Initial Foundation' +disableToc: true +weight: 50 +--- + +Even in the early project stage of adoption, AWS recommends that an initial foundation be established that can be extended over time as your organization transitions into the foundation stage to prepare for larger scale cloud adoption. This guide will help you establish the beginning of a secure foundation on AWS in support of your initial few projects. + +The guide starts with establishing an initial foundation in support of several development environments before it addresses how to extend your foundation to support deploying your first few workloads to pre-production test and production environments. + +The guide also address a set of "fast follow" capabilities that, for some organizations, are required before those organizations either perform formal experiments and development in the cloud or move an initial set of workloads into production. + +Later, after your organization has demonstrated success with the initial few projects, you will likely make larger investments during the foundation stage of your journey to support cloud adoption at scale. + +![Cloud Foundation](/images/00-intro/foundation.png) diff --git a/content/00-intro/06-faqs.md b/content/00-intro/06-faqs.md new file mode 100644 index 0000000..a73c7ac --- /dev/null +++ b/content/00-intro/06-faqs.md @@ -0,0 +1,53 @@ +--- +title: 'Frequently Asked Questions (FAQs)' +menuTitle: 'FAQs' +disableToc: true +weight: 60 +--- + +{{< toc >}} + +## General + +### Q: Where can I learn more about this project including who's involved and how I can contribute? + +See [Project Information]({{< relref "05-project" >}}) + +### Q: How can I see what has materially changed in the guide? + +See [Change History]({{< relref "05-change-history.md" >}}) + +## Federated Access to AWS Platform + +### Q: Why isn't federated access addressed from the start? + +Based on our experience, it can commonly take several weeks for an organization to go through the necessary preparation and execution to get true federated access into place. The minimal form of the foundation uses locally managed groups and users in AWS SSO for the first few weeks until a more desirable federated access capability is established as a fast follow-on capability. + +## AWS Accounts Design + +### Q: Shouldn't we develop a comprehensive design of our AWS account structure before we do any build out? + +... + +### Q: Why aren't "Sandbox" AWS accounts included in the initial build out? + +Since the premise of the initial guide is to help customers quickly establish a set of formal team development environment in which experimentation, integration, development, and early testing of the first few application and/or data services can take place before they are rapidly moved through formal pre-production testing environments and into production, the traditional role of completely isolated and disconnected sandbox AWS accounts in which your organization's intellectual propertly (IP) including source code is not allowed does not yet apply to this overall scenario. + +Instead, a focus of this guide is to establish team development AWS accounts to enable the formal work in support of the first few projects to progress rapidly. + +#### Similarities to Traditional Sandbox AWS Accounts +In this very first and minimal stage of the build out, there are similarities between the team development AWS accounts and typical sandbox AWS accounts. For example, the initial lack of on-premises network integration and failrly wide ranging access to AWS services. However, the expectation is that your organization will either 1) require such gaps to be addressed at the outset and before builder teams are onboarded, or 2) quickly address these gaps as fast follow-on requirements. + +We expect that in most cases the initially provisioned developemnt team AWS accounts will quickly evolve to take on these additional properties. Rather than characterizing the initial team development AWS accounts as sandbox AWS accounts and needing to rename and reposition them later, the decision was made to position them as formal team development AWS accounts from the start. + +#### Governed Sandboxes +The notion of ["governed sandboxes"](https://www.flux7.com/blog/aws-best-practice-sandbox-accounts-provide-secure-middle-ground/) is similar to the approach taken in this guide where builder teams are provided wide latitude to manage cloud resources in their team development AWS accounts, but within a set of overall guardrails. + +#### Future Role for Traditional Sandboxes +Similar to other aspects of overall AWS account design, the guide intentionally avoids overloading your organization with the fuller "to be" state of capabilities too early in your cloud adoption journey. Depending on your needs, in the future and perhaps in the larger "foundation" stage of adoption or even earlier as a parallel workstream, the capability to provide truly isolated and ephemeral sandbox AWS accounts to support a specific set of use cases may be addressed. + +## Cloud Resource Naming and Tagging + +### Q: Shouldn't we define and implement tagging standards early on in our journey? + +... \ No newline at end of file diff --git a/content/00-intro/_index.md b/content/00-intro/_index.md new file mode 100644 index 0000000..7b3507a --- /dev/null +++ b/content/00-intro/_index.md @@ -0,0 +1,15 @@ +--- +title: "Introduction" +disableToc: true +weight: 05 +--- + +Amazon Web Services (AWS) customers have expressed the need for a prescriptive guide to help their organizations better understand how they can get started with the AWS platform when they are ready to move from the informal stage of using personal AWS accounts to the next stage of formally bringing a few workloads to production. + +Regardless of your organization's motivation for adopting AWS, be it migrating applications and data from on-premises to the cloud, delivering new data services, or developing new modern applications, this guide is intended to help you establish an initial phase of your cloud foundation that can grow along with your adoption of AWS. + +{{% notice note %}} +**Review Note:** We're currently focused on authoring the following two sections: [Introduction]({{< relref "00-intro" >}}) and [Establish Foundation for Development Environments]({{< relref "01-dev" >}}). Later, we'll move on to the [Establish Development Fast Follow Capabilities]({{< relref "02-dev-fast-follow" >}}) and [Establish Foundation for Pre-Production Test and Production Environments]({{< relref "03-preprod-prod" >}}). If you have comments and suggestions about this guide, see [Contributing]({{< relref "03-contributing" >}}). +{{% /notice %}} + +{{% children showhidden="false" %}} diff --git a/content/01-dev/01-perform-up-front-tasks/01-review-dev-environment-requirements.md b/content/01-dev/01-perform-up-front-tasks/01-review-dev-environment-requirements.md new file mode 100644 index 0000000..419f994 --- /dev/null +++ b/content/01-dev/01-perform-up-front-tasks/01-review-dev-environment-requirements.md @@ -0,0 +1,58 @@ +--- +title: "Review Development Environment Requirements" +menuTitle: "1. Review Requirements" +disableToc: true +weight: 10 +--- + +This section introduces the typical requirements for your inital formal development environments and the supporting foundation. Organizations typically require at least the following capabilities when establishing their initial formal development environments. A separate set of sections address a series of [development fast follow capabilities]({{< relref "02-dev-fast-follow" >}}) that might be required up front depending on your organization's needs. + +## Cloud Adoption Framework Perspectives + +The following requirements are organized based on a series of perspectives defined in the [AWS Cloud Adoption Framework](https://aws.amazon.com/professional-services/CAF/). + +## Business Perspectives + +### Business +* Use of company authorized payment instrument, e.g. corporate credit card, by centralized cloud owner to pay for AWS cloud resources. +* Transparent and frequent cost reporting with alerts for greater than expected consumption. + +### People +* The organization must have at least several technologists who are assigned to and capable of configuring and managing the initial phases of the enterprise’s use of AWS. + +### Governance +* Cross-functional departments such as Security, Compliance, Operations, and Finance are important stakeholders in the use of the AWS platform and must be part of the initial planning, design, and implementation effort. + +## Technical Perspectives + +### Platform +* Builder Team Requirements + * An isolated environment for each team to carry out initial experiments and formal development work. + * Isolation from other builder teams being able to inadvertently impact a team's cloud resources. + * Ability to access other builder teams' deployed servies via networking where agreed and explicitly configured. + * Access to AWS services and AWS-hosted workloads from the corporate desktops on the corporate network. + * CLI and API access to AWS services. + * Access to a broad set of AWS services to enable experimentation and development. + * Including broad access to create and manage application-oriented AWS IAM role and policy resources in support of experimenting and developing application and data services. + * Access to an AWS network environment in support of those AWS services for which private networking is either required or desirable. + * Access to Internet-hosted code and package repositories so that 3rd party packages and code can be downloaded to VMs hosted in AWS. + * Use of corporate source code management services to manage code used in support of experiments and development. + * Insight into the costs of AWS services consumed in their development environments so that teams can make informed decisions. + * Sufficient documentation to enable builders to get started in the new AWS environment. +* The initial cloud platform team needs an isolated environment in which they can develop and test foundation capabilities. + * Separate from other builder teams and environments. + * Potentially with wider access permissions than typical development teams to enable deeper foundation development work. + +### Security +* Sufficient isolation between cloud development environments and existing corporate resources. +* Inhibit builder teams from making workloads publicly accessible from their development environments. +* Sufficient auditing of cloud access and activity and separation of duty for access to audit data. + * Use of per user identities to separate access and ensure sufficient auditing. +* Use of Multi-Factor Authentication (MFA) for all human user access to the AWS platform. +* Inhibit use of IAM users for human access. +* Inhibit use of long-term access keys to access AWS services. + +### Operations +* Sufficient access controls and permissions to protect the cloud foundation resources from inadvertent and intentional modification by unauthorized users. +* Clearly defined roles and responsibilities for managing the use of AWS. +* A sufficient set of runbooks and playbooks to support common operational needs and scenarios. diff --git a/content/01-dev/01-perform-up-front-tasks/02-review-dev-environment-solution.md b/content/01-dev/01-perform-up-front-tasks/02-review-dev-environment-solution.md new file mode 100644 index 0000000..2149297 --- /dev/null +++ b/content/01-dev/01-perform-up-front-tasks/02-review-dev-environment-solution.md @@ -0,0 +1,81 @@ +--- +title: "Review Development Environment Solution" +menuTitle: "2. Review Solution" +disableToc: true +weight: 20 +--- + +The following diagram represents a typical team development environment as a distinct AWS account supported by an initial set of foundation capabilities managed via a set of shared AWS accounts to meet the typical requirements outlined above. + +Since your specific requirements may include some of the optional [development fast follow capabilities]({{< relref "02-dev-fast-follow" >}}), aspects of your initial solution may be different than shown in this diagram. + +[![Initial Development Environment](/images/01-dev/dev-initial.png)](/images/01-dev/dev-initial.png) + +Key aspects of the initial, minimal solution include: + +## Initial Users of Your AWS Environment + +The initial workload builder teams, your designated cloud administrators, security and compliance team members, and potentially your finance team members who are concerned with cloud spend, will typically use their corporate desktops to access the AWS Management Console and AWS service APIs over the Internet. + +Builders will typically install the AWS Command Line Interface (CLI) and related Software Development Kits (SDKs) on their local corporate desktops to ease the process of interacting with your AWS environment. + +## Team Development AWS Accounts + +Each builder team is allocated a distinct team development AWS account to act as a resource container for the AWS resources a team creates and manages on its own. Since AWS service costs are automatically reported for each AWS account, using a distinct AWS account for each team’s development needs is a convenient way to make costs visible and attributable to each team. + +In addition to your initial application and data engineering teams that need access to the AWS platform, you should view your initial cloud and security administrators as a team of builders in its own right that should have its own AWS account for its own work to iterate on, develop, and perform early testing of changes to the foundation. + +## Common Development Network + +A centrally managed development network in the form of an AWS Virtual Private Cloud (VPC) is used to support the networking needs of builder teams for their development tasks. Your Cloud Administrators will provision this centrally managed VPC to a new "Network" AWS account and share a common set of private subnets with team development AWS accounts. + +The common development VPC will support cases in which a builder team needs to deploy AWS resources that reside in VPCs. For example, deploying Amazon EC2 Virtual Machines (VMs) and Amazon Relational Database Service (RDS) instances. + +The common development VPC provides private subnets in multiple Availability Zones (AZs) to mimic typical production topologies so that builder teams can start experimenting and perform early testing of multi-AZ topologies early in the lifecycle. + +The common development VPC includes a set of public subnets that host one or more Network Address Translation (NAT) Gateways to enable outbound connectivity from the shared private subnets to the Internet. The public subnets are not shared to the team development AWS accounts. + +The routing configuration of the shared private subnets and the NAT Gateways enable teams to access Internet-based resources such as package repositories and publicly available APIs during their experiment and development work. + +Benefits of using a common VPC for builder team's development needs include: + ++ The organization needs to manage and pay for only one set of common shared VPC resources for all builder teams. For example, one set of NAT Gateways - which are billed on an hourly basis. + ++ Configuration of organization standard newtork services such as AWS VPC endpoints is easier to manage in a single VPC. + ++ Builder teams reuse centrally managed VPC resources for multiple builder teams. + ++ Builder teams self-service manage their workload-specific cloud resources including security groups, EC2 instances, etc. + ++ Subject to how builder teams set up their EC2 security groups, builder teams have the potential to have network connectivity to other teams' development quality services given that their workloads reside in the same subnets. + ++ Builder teams cannot see and manage other teams' workloads even though they're sharing the same VPCs. + ++ Builder teams cannot modify the VPC and related resources that are centally hosted and managed in a separate network AWS account. No additional IAM policies are required. + ++ Costs for builder teams' cloud resources are still allocated to their respective team development AWS accounts. + ++ Costs for shared VPC foundation resources are allocated to the Network AWS account. + +## Access AWS Services via Internet +In this initial stage of your foundation, your builders’ existing access to the Internet via the corporate network is used to enable authorized builders to access the AWS platform. + +## AWS Single Sign-On (SSO) + +AWS SSO is used to manage the initial relatively limited number of human users across your builder and cloud foundation teams who need to access the AWS Management Console and AWS APIs to get things done in either team development AWS accounts or in support of managing and operating the overall use of AWS. Initially, you’ll use a locally managed store of groups and users in AWS to represent people who can access your AWS accounts. + +As a best practice, it’s strongly recommended that all users managed via AWS SSO set up MFA for their user accounts. + +AWS SSO includes the ability to manage permission sets that define which groups of users can access which AWS accounts and the fine grained AWS Identity and Access Management (IAM) permissions associated with this access. AWS SSO automatically propagates these permissions to each member AWS account in your AWS organization. + +## Foundation AWS Accounts + +Once you’ve signed up for a new AWS account, the “master” account, your cloud administrators will use AWS Control Tower via the Master AWS account to establish a “landing zone” of conventional shared AWS accounts and resources to help provide an initial foundation for your use of AWS. + +Your master AWS account will be the place in which your cloud administrators will use AWS Control Tower’s [Account Factory](https://docs.aws.amazon.com/controltower/latest/userguide/account-factory.html) via AWS Service Catalog to create new team development accounts, AWS SSO to create and manage groups and users in the locally managed directory, and generally monitor the overall use and health of your AWS environment. + +AWS Control Tower sets up a Log Archive AWS account to securely store AWS platform-wide logs such as AWS CloudTrail logs that record access to all AWS APIs across your AWS accounts and AWS Config logs that record all changes to AWS resources across your AWS accounts. + +## Standard AWS Control Tower Guardrails + +By using AWS Control Tower, your organization automatically benefits from the set of [built-in guardrails](https://docs.aws.amazon.com/controltower/latest/userguide/guardrails.html) that represent common preventative and detective security controls. AWS Control Tower includes mandatory, strongly recommended, and elective guardrails. diff --git a/content/01-dev/01-perform-up-front-tasks/03-map-people-to-foundation-roles.md b/content/01-dev/01-perform-up-front-tasks/03-map-people-to-foundation-roles.md new file mode 100644 index 0000000..cd588d7 --- /dev/null +++ b/content/01-dev/01-perform-up-front-tasks/03-map-people-to-foundation-roles.md @@ -0,0 +1,44 @@ +--- +title: "Map People to Foundation Functional Roles" +menuTitle: "3. Map People to Roles" +disableToc: true +weight: 30 +--- + +In this step you will identify the people on your nascent cloud foundation team who will play an initial set of functional roles in establishing, securing, and maintaining the cloud foundation so that your expectations are set in terms of accountability, ownership, and required skills and training. + +A subsequent section of this guide helps you tie these functional roles to specific permissions on the AWS platform. + +## Start With a Small Foundation Team + +Typically, several capable infrastructure oriented engineers are identified to play the role of the initial set of cloud administrators. Playing this role effectively requires that it is treated as a full-time assignment. + +In some cases, where the people resources can be made available and there’s a business need in this early stage, several technologists from your Security team may take on the functional role of Security Administration from the start. In other cases, in this early stage, that functional role may be delegated to the same people who are playing the role of Cloud Administration. + +Even in cases where roles are initially played by the same people, it’s recommended that you start with a separate set of functional roles so that, in the spirit of separation of duties, the access permissions are separated from the start and pave the way for an easier transition to a broader set of administrative teams as your adoption of the cloud expands. + +A common mistake made in this early stage of the journey is to assume that people playing certain functional roles in your existing on-premises environment must play a set of corresponding functional roles in the cloud. Although eventually many of your infrastructure and security people may transition to functional roles in managing your use of cloud resources, to start, it’s a best practice to have a small number of close-knit technical people manage your initial adoption of the cloud. + +## Map People to Typical Starter Foundation Functional Roles +The following table lists a typical set of minimal functional roles to own and manage your initial iteration of your cloud foundation. You should be able to identify 1-2 people in your organization who will play these functional roles and have these responsibilities for at least this stage of your cloud adoption journey. + +|Foundation Functional Role |Description |Responsibilities | +|--- |--- |--- | +|**Cloud Administration**|Write access to cloud foundation resources.|

* Create and manage shared cloud infrastructure. For example, AWS accounts and shared networking resources.

* Onboard new development teams on usage of their cloud development environments.

* Manage IP address CIDR block allocations.

| +|**Security Administration**|Write access to cloud foundation security resources.|

* Become skilled in AWS security including IAM.

* Provision and manage IAM roles and policies.

* Create and manage baseline security policies in AWS.

* Analyze access and configuration logs.

* Monitor and respond to AWS usage security events.

* Learn and promote cloud security best practices.

| +|**Cost Management**|Write access to cost budgets and reporting.|

* Monitor overall clound spend.

* Create, manage, and ensure access to cost and budget reports.

* Learn and apply fundamentals of cloud cost optimization practices.| +|**Audit**|Read only access to all AWS resources.|Periodically review environment configuration and data hosted in AWS for compliance. | + +## Define Additional Foundation Functional Roles Over Time + +When adoption of the cloud expands and the foundation becomes more capable and complicated, you may chose to introduce additional foundation functional roles to spread the ownership and work of managing the foundation across more teams. + +For example, a Network Administration functional role played by Network Engineering team members may be useful as the cloud foundation networking capabilities expand over time. + +Another common example is for your Security Incident Response team to become more directly involved in the cloud and have a corresponding Incident Response functional role with appropriate access permissions. + +## Use Separate Builder Team Functional Roles + +In addition to the foundation functional roles listed above, a later section in this guide will help you represent builder team oriented functional roles to be used by teams that need to experiment, develop, and test early forms of business applications, data services, and/or foundation capabilities. + +People playing foundation functional roles will also be granted access to builder team oriented functional roles so that they can select the proper set of permissions depending on which functional role they are playing at a given time. For example, a person who is playing the Cloud Administration functional role will assume the associated permissions when they are performing cloud administration work, but will assume a different set of permissions when performing development and early testing work to help evolve the foundation. \ No newline at end of file diff --git a/content/01-dev/01-perform-up-front-tasks/04-address-prerequisites.md b/content/01-dev/01-perform-up-front-tasks/04-address-prerequisites.md new file mode 100644 index 0000000..f7999d6 --- /dev/null +++ b/content/01-dev/01-perform-up-front-tasks/04-address-prerequisites.md @@ -0,0 +1,94 @@ +--- +title: "Address Prerequisites" +pre: "4. " +disableToc: true +weight: 40 +--- + +In this step your foundation team will address several prerequsites before you build out the environment. + +{{< toc >}} + +## 1. Create Email Addresses for New AWS Accounts + +Prepare a set of email addresses to represent the root user of each of the new AWS accounts that will be created. In later steps, when you create AWS accounts, you'll be referring to these email addresses. Each AWS account must have a unique email address associated with it. + +### Use Either Email Distribution Lists (DLs) or Shared Mailboxes +Instead of using a person's email address, it's recommended that you use either email distribution lists (DLs) or shared mailboxes so that you can enable at least several trusted people in your organization, for example, your Cloud Administrators, access to email messages associated with each AWS account. + +### Carefully Control Access to the Email Accounts +Since the email address associated with an AWS account is used as the [root user login for the account](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_root-user.html), anyone with access to that email account will have access to password reset process for the account. + +### Define and Request DLs or Shared Mailboxes +The following table includes the minimum set of email addresses to get started. Each AWS account must have a globally unique email address. + +If your organization already has a naming standard for mail addresses associated with services, you should use that standard format and include references to at least "aws" and and an abbreviation of the unique role or purpose of each account. + +Use your organization's process to request either DLs or shared mailboxes based on set of addresses you identify. + +|AWS Account |Example Email Address|Example with "+" Style Email Address| +|---|---|---| +|**Foundation AWS Accounts**|| +|Master|aws-account-master@acme.com|aws-account+master@acme.com| +|Audit|aws-account-audit@acme.com|aws-account+audit@acme.com| +|Log Archive|aws-account-log-archive@acme.com|aws-account+log-archive@acme.com| +|Network|aws-account-network@acme.com|aws-account+network@acme.com| +|**Team Development AWS Accounts**||| +|Foundation Team Development|aws-account-foundation-dev@acme.com|aws-account+foundation-dev@acme.com| +|Builder Team 1 Development|aws-account-team-a-dev@acme.com|aws-account+team-a-dev@acme.com| + +{{% notice tip %}} +**Use of “+” style email addresses:** If your organization’s email system supports the use of “+” style email addresses in which email multiple email addresses are aliased to the same email account, then you might find it beneficial to use this form to consolidate the root user email addresses for either all or collections of AWS accounts to either one or a few actual email accounts. For example: [aws-account1+master@acme.com](mailto:aws-account1+master@acme.com) and [aws-account1+audit@acme.com](mailto:aws-account1+audit@acme.com) will be treated as unique addresses in AWS but your mail system may deliver the mail to the same [aws-account1@acme.com](mailto:aws-account1@acme.com) email address. +{{% /notice %}} + +{{% notice tip %}} +**Office 365 Customers:** It appears that plus style addressing is on the [Office 365 roadmap for 2020](https://techcommunity.microsoft.com/t5/exchange-team-blog/exchange-transport-news-from-microsoft-ignite-2019/ba-p/993417). +{{% /notice %}} + +## 2. Obtain Non-Overlapping IP Address Range + +In this step you should consult with your existing Network team to obtain a suitably sized, non-overlapping IP address range or [CIDR block](https://en.wikipedia.org/wiki/Classless_Inter-Domain_Routing) that can be used not only for the initial shared development network that will be set up in this guide, but also to accomodate pre-production test and and production networks that you will provision on AWS as you progress in your journey. + +Since your organization will likely interconnect at least a portion of your on-premises networks to your emerging AWS hosted networks, a best practice is to assign a large IP address range or CIDR block for use in AWS that does not overlap with your existing allocated IP addresses. By using non-overlapping IP address ranges, your organization will avoid needing to introduce a complicated network address translation (NAT) solution. + +### Recommended IP Address Range Size + +Ideally, taking into account future networks beyond the initial development network, you should obtain for your organization's use of AWS overall, an IP address range or CIDR block of at least size `/18` to `/16`. + +If the desired sizes of non-overlapping CIDR block cannot be obtained at this stage, you should obtain a block of at least size `/22` to address the initial shared development network. You can obtain additional non-overlapping CIDR blocks later to support your build out of pre-production test and production networks. + +{{% notice warning %}} +**Larger CIDR Range is Better:** Although 1,000 IP addresses may sound like a lot, don't assume that it's a sufficiently sized range even for your initial few workloads. Since your initial shared development environment will likely have at least 4 subnets, when you divide a `/22` CIDR block across the 4 subnets, you end up with only 254 IP available addresses per subnet. Using a `/23` block would leave only 126 IP addresses per subnet. Depending on the number of workloads your infrastructure and workload builder teams will be experimenting and testing, these smaller ranges can end up being exhausted faster than you might expect. +{{% /notice %}} + +### Unable to Obtain Non-Overlapping IP Address Range + +If you cannot obtain a non-overlapping CIDR block at this stage, you can temporarily use an overlapping block for your initial shared development network. + +In the future, when you need to interconnect a portion of your existing on-premises network, you will need to create a new VPC with a non-overlapping CIDR block, migrate the workloads to the new VPC, and decommission the old VPC. + +### Resources + +* [VPC and Subnet Sizing for IPv4](https://docs.aws.amazon.com/vpc/latest/userguide//VPC_Subnets.html#vpc-sizing-ipv4) + +* [Visual Subnet Calculator](http://www.davidc.net/sites/default/subnets/subnets.html) + +## 3. Decide on Organizational Identifier + +Since you will be assigning names to several cloud resources while you follow the steps in this guide, it's useful for you to decide on a unique organizational identifier to assign as a prefix to those names so that: +* Names of your resources won't collide with other names when working in global namespaces. +* You'll be able to create security policies to restrict access based on resources with that prefix. + +Your organization is likely already using a stock ticker or other similar abbreviation to represent your organization in support of current business and IT processes. One of these existing identifiers might be appropriate to carry forward as you build out your cloud environment. + +You should limit the length of the abbeviated organization identifier to a handful of characters. Using no more than 4-5 characters is a good guide. + +As an example, this guide uses the prefix **`acme`** throughout. As you progress through the guide, you're expected to replace this example prefix with your organization's own identifier. + +{{% notice tip %}} +**More Extensive Resource Naming Standards:** As you progress on your journey, you may find it useful to adopt more extensive cloud resource naming standards. +{{% /notice %}} + +## 4. Identify Your Preferred AWS Region + +When you build out the foundation of your AWS environment using the AWS Control Tower service, you will need to specify a “home” AWS region in which AWS Control Tower will configure a set of resources. Typically, this AWS region will be the AWS region in which you expect to host most of your workloads. See [AWS Regions and Availability Zones](https://aws.amazon.com/about-aws/global-infrastructure/regions_az/) for a list of the current regions. \ No newline at end of file diff --git a/content/01-dev/01-perform-up-front-tasks/_index.md b/content/01-dev/01-perform-up-front-tasks/_index.md new file mode 100644 index 0000000..066131e --- /dev/null +++ b/content/01-dev/01-perform-up-front-tasks/_index.md @@ -0,0 +1,9 @@ +--- +title: "Perform Up Front Tasks" +disableToc: true +weight: 10 +--- + +Before you begin establishing your development environments and the intial foundation in AWS, you should perform a few up front tasks. + +{{% children showhidden="false" %}} diff --git a/content/01-dev/02-establish-initial-foundation/01-create-master-aws-account.md b/content/01-dev/02-establish-initial-foundation/01-create-master-aws-account.md new file mode 100644 index 0000000..093c9a2 --- /dev/null +++ b/content/01-dev/02-establish-initial-foundation/01-create-master-aws-account.md @@ -0,0 +1,100 @@ +--- +title: "Create Master AWS Account" +pre: "1. " +disableToc: true +weight: 10 +--- + +In this step your Cloud Administrators will use the standard AWS new account creation process to create a new “master” AWS account. + +This step should take about 20 minutes. + +{{< toc >}} + +## 1. Review the Benefits of Using Multiple AWS Accounts + +AWS accounts are coarse grained resource containers that help you isolate and secure different collections of cloud resources and data. Use of multiple AWS accounts can make your use of cloud more secure by providing clear ownership and control boundaries and lowering the blast radius of any particular set of cloud resources. + +In support of your initial need for team development environments, this guide first leads you through the process to create an initial set of foundation and builder team development AWS accounts. Later in the guide, you will create a series of pre-production test and production AWS accounts to isolate the formal pre-production test and production environments from your development environments. + +Over the course of your cloud adoption journey, you will likely end up with a number of accounts ranging from a dozen or so to hundreds depending on the size of your application and data services portfolio and the granularity by which you choose to isolate the associated cloud resources and data across your organization and across the software development lifecycle (SDLC). + +## 2. Start With a New Master AWS Account + +The initial AWS account that you create will be configured as a new master AWS account in which billing for AWS services consumed across accounts will be consolidated and your Cloud Administrators will provision new “member” AWS accounts for builder teams. + +Even if you have an existing AWS account, we strongly recommend that you establish a new AWS account as the basis of your formal cloud foundation and adoption for several reasons: + +1. **AWS Control Tower currently requires a new master AWS account.** Later in this guide, you will be using the AWS Control Tower service to establish an initial set of security guardrails and other capabilities as part of your cloud foundation. +2. **Your existing AWS accounts might not be aligned with AWS best practices.** + +After you create your new master AWS account, you can make use of a standard process to move any existing AWS accounts into your new master AWS account so that you can easily consolidate billing and day-to-day management of all of your AWS accounts. + +## 3. Create a New AWS Master Account + +Visit https://aws.amazon.com/ and click “Create AWS Account” and enter the the required information on the following page. + +### Provide Account Root User’s Email Address + +Use the master AWS account [root user email address]({{< relref "04-address-prerequisites.md#1-create-email-addresses-for-new-aws-accounts" >}}) that you already established. Since this email address is used to initially access your AWS account, be very careful that you enter the correct email address and that you have access to the email account. + +### Set Personal or Professional + +Set your account to either personal or professional. Both types of accounts have the same functionality and features. Enter your personal or professional information and then read and accept the [AWS Customer Agreement](https://aws.amazon.com/agreement/). + +### Provide Billing Information + +At this point, you’ll have an account created and you’ll get a confirmation email. However, you’ll need to enter billing information before you can continue. + +Add a payment method and contact information for the billing method. You’ll go through a brief account verification process via a mobile device so enter a phone number you have current access to. + +### Select a Support Plan + +On the Select a Support Plan page, choose one of the available support plans. Since your organization is going to be using AWS for formal development and eventually production purposes, we recommend that you start by selecting at least “Developer” support. + +Before you transition any applications or data services to production, it's strongly recommended that you upgrade to "Business" support. + +Once you are preparing to host business critical workloads and data in the cloud, you should consider upgrading to "Enterprise" support levels. + +See [AWS Support Plans](https://aws.amazon.com/premiumsupport/plans/) for a description of features and benefits of each level of support. + +## 4. Receive Confirmation Email + +In a few minutes your account should be fully activated and you’ll receive a confirmation email. If you don’t, review the troubleshooting steps from the [Create and Activate an AWS Account support page](https://aws.amazon.com/premiumsupport/knowledge-center/create-and-activate-aws-account/) + +## 5. Secure Your AWS Account Root User + +It’s strongly recommended and an AWS security best practice to enable multi-factor authentication (MFA) to the AWS account root user and to avoid using the root user, even for administrative tasks, from this point forward. + +See [Enable MFA on the AWS Account Root User](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_root-user.html#id_root-user_manage_mfa) for instructions. + +{{% notice warning %}} +**Do not create administrative access keys for the root user:** Under no circumstances create programmatic access keys for your AWS account root user and admininistrative bootstrap users. +{{% /notice %}} + +## 6. Set Alternate Contacts + +Using the root user, set the Alternate Contacts for your account so that notifications of billing, operations, and security events are routed to the proper teams. As a best practice, you can use email distribution lists so that notifications are set to multiple people in the same team. + +Access [Account Settings](https://console.aws.amazon.com/billing/home?#/account) in the AWS Management Console to set the Alternate Contacts. + +## 7. Create an IAM user for Administrative Bootstrap Purposes + +{{% notice note %}} +**Review Note: Is creating an admin bootstrap IAM user necessary?:** Functionally, is this user necessary? From a security best practices perspective is it necessary? Since this overall guide gets the foundation team members to start using their human user logins via AWS SSO as soon as feasible, this type of IAM admin user isn't currently used for anything other than working with AWS Control Tower to create the initial landing zone. AWS Control Tower [recommends that an IAM user](https://docs.aws.amazon.com/controltower/latest/userguide/setting-up.html) be established and used, but it doesn't state that it's an absolute requirement for the landing zone to be established. +{{% /notice %}} + +Although you will be provisioning cloud administrator and builder user accounts via the AWS Single Sign-on (SSO) service later in this guide, it is required that you first create an administrative bootstrap user account via the AWS Identity and Access Management (IAM) service and switch to that user to set up the next parts of your initial foundation. + +This administrative user should be only used to complete your initial foundation setup and act as a “break glass” user in case access via AWS SSO user accounts encounters an issue. + +### Recommendations for Administrative Bootstrap User + +* Since this account will only be used for break glass purposes after your foundation has been established, you don’t need to associate the user with a human user. Instead, you can use a name such as “Administrator”. +* Enable “AWS Management Console access” only for this user. “Programmatic access” should not be necessary for this user. + +### Create the Administrative Bootstrap User + +While logged in as the root user, follow the instructions in [Create an IAM user](https://docs.aws.amazon.com/controltower/latest/userguide/setting-up.html#setting-up-iam) to create this administrative user. + +Once the user has been created, sign into the AWS Management Console as the user and enable MFA to help secure the account. See [Enable a Virtual MFA Device fo an IAM User](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_mfa_enable_virtual.html#enable-virt-mfa-for-iam-user). diff --git a/content/01-dev/02-establish-initial-foundation/02-set-up-landing-zone.md b/content/01-dev/02-establish-initial-foundation/02-set-up-landing-zone.md new file mode 100644 index 0000000..f58ec72 --- /dev/null +++ b/content/01-dev/02-establish-initial-foundation/02-set-up-landing-zone.md @@ -0,0 +1,113 @@ +--- +title: "Set Up Landing Zone Using AWS Control Tower" +menuTitle: "2. Set Up Landing Zone" +disableToc: true +weight: 20 +--- + +In this step your Cloud Administrators will use the AWS Control Tower service in your new AWS master account to establish an initial “landing zone” or a foundation of security guardrails and other resources that will help your organization manage use of the AWS platform. You can learn more by reviewing [AWS Control Tower Features](https://aws.amazon.com/controltower/features/). + +This step should take about 90 minutes to complete. + +{{< toc >}} + +## 1. Log In as Administrator IAM User + +Log in as the Administrator IAM user that you created in the last section before you use AWS Control Tower to set up your initial landing zone. + +## 2. Create Landing Zone Using AWS Control Tower + +Before using AWS Control Tower to create an initial landing zone, ensure that you review these considerations: + +* **Desired Home AWS Region** - Ensure that you select the proper AWS region in the upper right hand side of the AWS Management Console before creating the landing zone. The AWS region you select should be the AWS region in which you expect do perform the majority of your work with AWS and from which you will maintain your foundation. + +* **Email Distribution Lists** - Consult the [set of AWS account root user email addresses]({{< relref "04-address-prerequisites.md#1-create-email-addresses-for-new-aws-accounts" >}}) that you established earlier. + +* **Pre-Launch Checks** - Since you’ve just created a new master AWS account, the pre-launch check considerations for creating your landing zone should already be met. + +Follow the steps in [Getting Started with AWS Control Tower](https://docs.aws.amazon.com/controltower/latest/userguide/getting-started-with-control-tower.html) to set up your landing zone. + +The set up process can take 20-60 minutes to complete. + +## 3. Set AWS Account Root User Password and Enable MFA + +Since AWS Control Tower creates two new member accounts while setting up the initial landing zone, you should follow AWS security best practices by setting the password and enabling MFA for the root user of each of the following accounts: + +* Audit +* Log archive + +See [Log In as Root User](https://docs.aws.amazon.com/controltower/latest/userguide/best-practices.html#root-login) in the AWS Control Tower documentation for instructions to set the root user’s password. + +See [Enable MFA on the AWS Account Root User](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_root-user.html#id_root-user_manage_mfa) for instructions to enable MFA. + +## 4. Log In Via Control Tower Administrator User + +As part of the landing zone set up, AWS Control Tower creates a Control Tower Administrator user in the AWS Single-Sign On (AWS SSO) service in your master account. + +The email address associated with the AWS master account’s root user will receive a message containing an invite to activate the Control Tower Administrator user account. Review the invitation and accept it. + +[![Invitation to Access AWS SSO User Portal](/images/01-dev/accept-aws-sso-invitation.png)](/images/01-dev/accept-aws-sso-invitation.png) + +When accepting the invite, you will be directed to set the password for the Control Tower Administrator user. + +The email message you recieved contains a portal URL that you should bookmark given that it will be used by human users to access your new AWS accounts. + +## 5. Configure Multi-Factor Authentication (MFA) Requirements + +Before adding any human users to AWS SSO and enabling the users to access your AWS environment in later sections, it's a best practice to configure AWS SSO to require multi-factor authentication (MFA). + +In the following steps, you will modify your AWS SSO configuration to align with typical security best practices. + +1. Since you just set the password for the **`Control Tower Administrator`** user, you should already be logged into the AWS SSO portal. +2. From within the portal, select **`AWS Account`** icon to expand the current list of AWS accounts. +3. Select the AWS **`master`** account. +4. Select **`Management console`** associated with the **`AWSAdministratorAccess`** role. +5. Select the appropriate AWS region. +6. Navigate to **`AWS Single Sign-on`**. +7. Select **`Settings`** in AWS SSO. +8. Set the following settings to the recommended values: + +|Setting|Recommended Value| +|-------|-----------------| +|`Multifactor authentication`|`Configure`| +|`Users should be prompted for multi-factor authentication (MFA)`|`Every time they sign in (always-on)`| +|`When prompted for a MFA code`|`Require them to provide a one-time password sent by email`| +|`Who can manage MFA devices`|`Users and administrators can add and manage MFA devices`| + +9. Select **`Save changes`**. + +{{% notice tip %}} +**Auditing use of MFA:** The configuration shown above does not force the use of MFA, but it does impose an additional overhead of a one-time password sent via email for users that have not yet registered an MFA device. You will likely want to establish either manual or automatic recurring audits to ensure that your users have registered an MFA device. +{{% /notice %}} + +## 6. Enable MFA via AWS SSO for Control Tower Administrator User + +Follow the instruction in [How to Register a Device for Use with Multi-Factor Authentication](https://docs.aws.amazon.com/singlesignon/latest/userguide/user-device-registration.html). + +## 7. Receive and Process AWS Email Messages + +### AWS Organizations Email Verification Request + +You will receive one more email with subject AWS Organizations email verification request to the master account email address. Click on Verify your email address to continue with inviting newly created accounts into AWS Organization. + +### AWS Notification Email Messages for Each Region + +The email address you provided for the audit account will receive AWS Notification - Subscription Confirmation emails from every AWS Region supported by AWS Control Tower. To receive compliance emails in your audit account, you must choose the Confirm subscription link within each email from each AWS Region supported by AWS Control Tower. + +## 8. Review Role of New AWS Accounts + +AWS Control Tower created several new AWS accounts when it set up the landing zone. + +|AWS Account|Purpose| +|-----------|-------| +|**Audit**|For the time being, it's recommended that you not use this AWS account. Once guidance is developed so that you can use it as a security oriented break glass account, you can repurpose this AWS account.| +|**Log archive**|Centrally located AWS CloudTrail and AWS Config logs.| + +## 9. Review AWS Control Tower Best Practices for Administrators + +Now that you've set up your initial landing zone, take a few minutes to review [Best Practices for Account Administrators](https://docs.aws.amazon.com/controltower/latest/userguide/best-practices.html#tips-for-admin-maint) so that you understand temporary limitations and other considerations when working with AWS Control Tower. + +For example: + +* **Managing Organizational Units (OUs)** - AWS Control Tower currently supports only a single level of AWS Organizations Organizational Units (OUs) and creation of OUs to be used with AWS accounts managed by AWS Control Tower must be performed via AWS Control Tower and not via AWS Organizations. +* **Modification of AWS Account Root User Email Addresses** - AWS Control Tower does not currently support self-service modification of the email addresses associated with the root user of each AWS account. You currently need to contact AWS Support to have these email addresses changed. \ No newline at end of file diff --git a/content/01-dev/02-establish-initial-foundation/03-set-up-aws-platform-access-controls.md b/content/01-dev/02-establish-initial-foundation/03-set-up-aws-platform-access-controls.md new file mode 100644 index 0000000..3822733 --- /dev/null +++ b/content/01-dev/02-establish-initial-foundation/03-set-up-aws-platform-access-controls.md @@ -0,0 +1,242 @@ +--- +title: "Set Up AWS Platform Access Controls" +menuTitle: "3. Set Up Access Controls" +disableToc: true +weight: 30 +--- + +In this step your Security and Cloud Administrators will decide on and implement the initial approach to controlling access to the AWS platform. + +This step should take about 45 minutes to complete. + +{{< toc >}} + +## 1. Temporarily Use AWS SSO Locally Managed Users and Groups + +If your team needs to move very quickly in a matter of 1-2 days to establish your initial development environments and does not have an immediate requirement to integrate your existing enterprise identity management system to help control access to the AWS platform, then it’s recommended that: + +1. Your Security and Cloud Administrators temporarily define and manage users and groups within the AWS SSO service. +2. Make plans for a parallel workstream to integrate your preferred enterprise identity management system with the AWS platform and transition away from locally managed users and groups in the AWS SSO service. + +If your organization requires integration of your existing identity management system even for the establishment of an initial development environment, then see [Establishing Federated Access to AWS]({{< relref "03-federated-access-to-aws.md" >}}) before proceeding further in this guide. + +{{% notice info %}} +**What about AWS IAM users and groups?:** Although the AWS Identity and Access Management (AWS IAM) service supports management of locally defined users and groups, it’s generally not recommended that customers depend on this capability to help manage human user access to the AWS platform _at scale_. Instead, AWS recommends that you reuse your preferred enterprise identity management system and associated processes to act as the basis for human user access to the AWS platform. +{{% /notice %}} + +## 2. Map Foundation Functional Roles to Existing AWS Groups + +Earlier in this guide you should have mapped your foundation team members to the [initial set of functional roles]({{< relref "03-map-people-to-foundation-roles.md" >}}) to be played in support of your AWS environment. + +The following table represents a mapping of those functional roles to a set of AWS SSO groups and permissions. Although AWS Control Tower automatically provisioned most of the AWS SSO groups, several of the groups in the table are not pre-defined. You will create these custom groups later in this section. + +|Foundation Functional Role|AWS SSO Groups|Effective Permissions| +|--- |--- |--- | +|**Cloud Administration**|`AWSControlTowerAdmins`|[Administrator](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_job-functions.html#jf_administrator) access in the master, log archive, and audit accounts.| +| |`AWSAccountFactory`|Ability to use the Account Factory product via AWS Service Catalog.| +| |`acme-cloud-admin`|[Administrator](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_job-functions.html#jf_administrator) access in all other AWS accounts. +|**Security Administration**|`AWSAuditAccountAdmins`|[Administrator](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_job-functions.html#jf_administrator) access in the audit account.| +| |`AWSLogArchiveAdmins`|[Administrator](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_job-functions.html#jf_administrator) access in the log archive account.| +| |`AWSSecurityAuditPowerUsers`|[Developer power user](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_job-functions.html#jf_developer-power-user) access across all accounts.| +|**Cost Management**|`acme-cost-mgmt`|[Billing and cost management](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_job-functions.html#jf_accounts-payable) access in the master account.| +|**Audit**|`AWSSecurityAuditors`|Read only access in all accounts.| + +{{% notice info %}} +**Your AWS platform access permissions will evolve:** The initial mapping of functional roles to groups in AWS SSO and the underlying permissions associated with those groups shown in the table above is only a simple starting point for your AWS platform access permissions for foundation team members. As you progress on your journey, you will evolve these groups and underlying permissions to meet your needs. +{{% /notice %}} + +## 3. Access AWS SSO Using Your AWS Control Tower Administrator User + +You'll need to use the AWS SSO service to add a new groups for Cloud Administrators and Cost Managers and create users for foundation team members. + +Since you have not yet created users in AWS SSO for each member of your foundation team, your Security or Cloud Administrator team members will need to use the AWS Control Tower Administrative user to start adding AWS SSO users for each foundation team member. Once these users have been onboarded in a subsequent step, you can stop using the AWS Control Tower Administrator user. + +Access the AWS SSO service: + +1. Sign in to the AWS SSO URL for your environment using the **AWS Control Tower Administrator** user. +2. Select the AWS **`master`** account. +3. Select **`Management console`** associated with the **`AWSAdministratorAccess`** role. +4. Select the appropriate AWS region. +5. Navigate to **`AWS SSO`**. + +{{% notice info %}} +**Permissions error:** If you encounter a permissions error when attempting to access AWS SSO via the AWS Management Console, ensure that you've selected the proper AWS account and role, `AWSAdministratorAccess`. +{{% /notice %}} + +## 4. Customize AWS SSO Portal URL + +As an optional step, you may want to customize the URL that your organization uses to access the AWS SSO portal. + +If you have plans to implement your own vanity URL for the portal, you can skip this step. + +The default form the portal URL is similar to this example of: `https://d-3a274d5e7d.awsapps.com/start`. Via the AWS SSO settings, you can customize the `d-3a274d5e7d` portion of the URL shown in the example. + +1. Access **`Groups`** in AWS SSO. +2. Select **`Settings`**. +3. Under **`User portal`**, select **`Customize`**. +4. Set the first portion of the URL to a unique value. Use your organization identifier, stock ticker symbol, or another identier that you use as an abbreviated reference to your organization. + +## 5. Add a Cloud Admin Group in AWS SSO + +Since Cloud Administrators don't have administrator access to newly created AWS accounts, you'll need to start laying the groundwork for this access by adding a new group in AWS SSO. In a subsequent step, you'll add Cloud Administrator team members to the new group. Later on, after the initial set of team development AWS account are created, you will assign this group and a permission set to each of those new accounts so that the Cloud Administrators can gain administrator level access to manage those accounts. + +1. Access **`Groups`** in AWS SSO. +2. Select **`Create group`**. +3. Provide a group name. For example **`acme-cloud-admin`**. Where you should replace `acme` with a common abbreviation for your organization. +4. Provide a description. For example, **`Cloud administration`**. +5. Select **`Create`**. + +{{% notice tip %}} +**Cloud Resource Naming - Using Qualifiers in Shared Namespaces:** When adding cloud resources to a shared namespace, it's a best practice to prefix those resource names with an organization identifier so that you avoid conflict with AWS-managed resources and can easily identify your own custom resources. +{{% /notice %}} + +{{% notice tip %}} +**Cloud Resource Naming - Lower Case, Camel Case, etc:** Most AWS cloud resource names support using a range of characters and cases. Typically, AWS-managed resources use camelcase, but organizations often standardize on one style and strive to use that style throughout their cloud environment. +{{% /notice %}} + +## 6. Add a Cost Management Group and Assign Permissions in AWS SSO + +Since there's no suitable predefined AWS SSO group for cost management team members, you need to add a new group in AWS SSO and associate the necessary permissions with that group. In a subsequent step, you'll add cost management team members to the new group. + +In the spirit of least privilege access, the resulting permissions will enable cost management team members to access only your master AWS account and only the cost management and billing resources and data accessible within that AWS account. + +### Add Cost Management Group in AWS SSO + +1. Access **`Groups`** in AWS SSO. +2. Select **`Create group`**. +3. Provide a group name. For example **`acme-cost-mgmt`**. Where you should replace `acme` with a common abbreviation for your organization. +4. Provide a description. For example, **'Cost management and billing`**. +5. Select **`Create`**. + +### Associate Group and Permission Set with AWS Master Account + +1. Access **`AWS accounts`** in AWS SSO. +2. Select the checkbox next to your **`master`** AWS account. +3. Select **`Assign users`**. +4. Select **`Groups`**. +5. Select the checkbox next to **`acme-cost-mgmt`** or similar. +6. Select **`Next: Permission sets`**. + +### Create New Permission Set for Billing + +7. Select **`Create new permission set`**. +8. Select **`Billing`**. +9. Select **`Create`**. + +### Associate Billing Permission Set + +10. Select the checkbox next to **`Billing`**. +11. Select **`Finish`**. + +AWS SSO deploys the selected permission set to the selected AWS account. + +## 7. Create Organizational Units + +Using AWS Control Tower, create several Organizational Units (OUs) that will act as a mechanism to group AWS accounts that have similar security and management needs. Initially, the OU structure will simply consist of two custom OUs: + +* **`infrastructure`** - For foundation infrastructure related AWS accounts including the Network AWS account that you will create later in this section. +* **`development`** - For team development AWS accounts that you'll create in the next section. + +{{% notice info %}} +**Your OU design will evolve:** Contrary to what's implied by the name "OU", AWS Organizations OUs are not meant to be used to reflect your enterprise's organizational structure. Instead, they are intended to provide a means to group AWS accounts that have similar security and operational requirements. Since you have the ability to move AWS accounts between OUs and modify OUs, you don't need to perform a complete OU design at this early stage. As you progress on your journey, you will evolve your OU design to suit your emerging needs. If you'd like to learn more about OUs, see [AWS Organizations in Control Tower](https://docs.aws.amazon.com/controltower/latest/userguide/organizations.html). +{{% /notice %}} + +### Create the `infrastructure` OU + +1. Navigate to **`AWS Control Tower`**. +2. Select **`Organizational units`**. +3. Select **`Add an OU`**. +4. Follow the prompts to create a new OU named **`infrastructure`**. + +### Create the `development` OU + +1. Create another OU named **`development`**. +2. Once the OU has been created, select the **`development`** OU and record the ID of the form **`ou-....`** so that you can use it in the next step. + +## 8. Distribute Permissions Boundary to Development OU + +In this step you'll use AWS CloudFormation StackSets to distribute an IAM permissions boundary policy to the "development" OU that you just created. This boundary policy will help ensure that builder teams using team development AWS accounts can't modify your foundation cloud resources. + +In a later section, when you create several team development AWS accounts, you will associate the AWS accounts with the "development" OU. Any AWS account that is added to that OU will automatically be configured with the IAM permissions boundary policy resource. Similarly, when an AWS account is removed from the OU, the IAM permissions boundary policy resource will be automatically removed from the AWS account. + +{{% notice tip %}} +**Review the sample team development access controls:** See [Controlling Builder Team Access]({{< relref "02-controlling-builder-team-access.md" >}}) for a detailed explanation of the requirements and sample implementation of how you can provide freedom to your builder teams in their team development AWS accounts, but inhibit them from adversely impacting the security of your overall AWS environment. +{{% /notice %}} + +### Enable Trusted Access in AWS Organizations + +First, enable the AWS CloudFormation service to automatically configure permissions required to use the CloudFormation StackSets feature to deploy stacks to AWS accounts in your AWS organization. + +1. Navigate to **`AWS CloudFormation`**. +2. Select **`StackSets`**. +3. Select **`Enable trusted access`**. + +{{% notice info %}} +**This is a one time operation:** If you'd like more background, see [Enabling Trusted Access with AWS Organizations](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/stacksets-orgs-enable-trusted-access.html). +{{% /notice %}} + +### Download AWS CloudFormation Template + +Next, download the sample AWS CloudFormation template [`acme-base-team-dev-boundary.yml`](/code-samples/01-iam-policies/acme-base-team-dev-boundary.yml) to your desktop. + +### Deploy Permissions Boundary as a StackSet + +Create a StackSet to deploy the permissions boundary policy to all AWS accounts associated with the "development" OU. + +1. Select **`Create StackSet`**. +2. Select **`Upload a template file`**. +3. Select **`Choose file`** to select the downloaded template file from your desktop. +4. Select **`Next`**. +5. Enter a **`StackSet name`**. For example, **`acme-base-team-dev-boundary`**. + +It's useful to prefix your custom cloud resources that live in a larger name space with your organization identifier and a qualifier such as **`base`** to represent foundation resources. The important consideration is to be consistent with naming of foundation cloud resources so that you can apply IAM policies that will inhibit unauthorized modification of those resources. + +6. In **`Parameters`**: + +|Parameter|Guidance| +|---------|--------| +|**`pOrg`**|Replace **`acme`** with your organization identifier or stock ticker if that applies. This value is used as a prefix in the name of IAM managed policy that is created by the template.| + +Leave the other parameters at their default settings. + +7. Select **`Next`**. +8. Leave the **`Permissions`** set to **`Service managed permissions`**. +9. Select **`Next`**. +10. In **`Deployment targets`**, select **`Deploy to organizational units (OUs)`**. +11. Enter the OU ID of the "development" OU that you created in the previous step. +12. In **`Specify regions`**, select your home AWS region. +13. Select **`Next`**. +14. Scrolls to the bottom and mark the checkbox to acknowledge that IAM resources will be created. +15. Select **`Submit`**. + +Since you have not yet created the team development AWS accounts, this CloudFormation StackSet won't create CloudFormation stacks in the team development AWS accounts until those AWS accounts are created in a subsequent section. + +Proceed to the next step. + +## 9. Create Team Development Permission Set in AWS SSO + +Next, you'll create a custom permission set in AWS SSO to represent the initial iteration of an AWS IAM policy under which builder team members will work in their team development AWS accounts. + +### Download and Customize Sample IAM Policy + +1. Download the sample policy [`acme-base-team-dev.json`](/code-samples/01-iam-policies/acme-base-team-dev.json) to your desktop. +2. Open the file and replace all occurrences of **`acme`** with a reference to your own organization's identifier. + +{{% notice tip %}} +**Infrastructure as Code (IaC) Opportunity:** Since you've just modified "code" that represents an important security policy for your AWS environment, it's a best practice to manage that source code file in a version control system such as a Git repository and control who can modify this file moving forward. If your organization is not already using Git-based version control, see the [Development Fast Follow Capabilities]({{< relref "02-dev-fast-follow" >}}) for assistance on how to get started using Git-based version control. +{{% /notice %}} + +### Create Permission Set in AWS SSO + +1. Access **`AWS accounts`** in AWS SSO. +2. Select **`Permission sets`**. +3. Select **`Create permission set`**. +4. Select **`Create a custom permission set`**. +5. Enter a **`Name`**. For example **`acme-base-team-dev`**. +6. Enter a **`Description`**. For example, **`Day-to-day permission used by builders in their team development AWS accounts.`**. +7. Set the **`Session duration`** to the desired value. +8. Select the checkbox **`Create a custom permissions policy`**. +9. Open the sample policy file that you just customized in a text editor, copy, and paste the content. +10. Select **`Create`**. + +Later, when you onboard the builder teams to their team development AWS accounts, you'll reference this permission set. diff --git a/content/01-dev/02-establish-initial-foundation/04-onboard-foundation-team.md b/content/01-dev/02-establish-initial-foundation/04-onboard-foundation-team.md new file mode 100644 index 0000000..c5ec74b --- /dev/null +++ b/content/01-dev/02-establish-initial-foundation/04-onboard-foundation-team.md @@ -0,0 +1,54 @@ +--- +title: "Onboard Foundation Team" +pre: "4. " +disableToc: true +weight: 40 +--- + +In this step either your Security or Cloud Administrators will onboard the few people that make up the initial foundation team so that they can stop using system users and start using their own user accounts to manage the foundation. + +This step should take about 20 minutes to complete. + +{{< toc >}} + +## 1. Create AWS SSO Users for Foundation Team Users + +In prepartion for adding foundation team users to AWS SSO, decide on the format of the user name. Typically, the user name will simply be the user's corporate email address that is often used for SaaS services. + +Next, access the AWS SSO service to begin adding an AWS SSO user for each foundation team member: + +1. If you don't already have a personal user account with administrator access, sign in to the AWS SSO URL for your environment using the **`AWS Control Tower Administrator`** user. +2. Select the AWS **`master`** account. +3. Select **`Management console`** associated with the **`AWSAdministratorAccess`** role. +4. Select the appropriate AWS region. +5. Navigate to **`AWS SSO`**. +6. Access **`Users`** in AWS SSO. +7. Select **`Add user`**. +8. Specify a user name and complete at least the other required fields. +9. Select **`Next: Groups`**. +10. Select the checkbox for each corresponding AWS SSO group based on [Mapping of Functional Roles to AWS SSO Groups]({{< relref "03-set-up-aws-platform-access-controls.md#2-map-foundation-functional-roles-to-existing-aws-groups" >}}). +11. Select **`Add user`**. + +## 2. Onboard Your Foundation Team Members + +Reach out to each foundation team member to inform them of the context of the email message they received, what they should do next, and what access they have been granted. + +Their initial sign on experience will consist of: + +1. Receiving the email invitation to the AWS SSO service. +1. Clicking on the **`Accept invitation`** link to set their initial password. +3. Being directed to AWS SSO landing page where they can select from the set of AWS accounts for which they have access. +4. Selecting from the permissions that they can assume for each AWS account. +5. Using either the AWS Management Console or AWS CLI/API to access each AWS account. + +Inform the foundation team members that use of MFA is required and how they can [register an MFA device](https://docs.aws.amazon.com/singlesignon/latest/userguide/how-to-register-device.html) on their own via the AWS SSO service. + +## 3. Stop Using the AWS Control Tower Administrative User + +Since you've onboarded foundation team members with the appropriate permissions, as a security and compliance best practice, there's no longer any reason for your Cloud Administrators to use the AWS Control Tower Administrator user. + +From this point forward, the vast majority of your work to administer and manage your AWS environment should be done via your personal users that are defined in AWS SSO. By using personal users, all operations will be auditable and tied to specific individuals. + +## 4. Brief Foundation Team Members + +Meet with the foundation team members to brief them on their access, responsibilities, and other topics covered in the [Example Getting Started Guide for Foundation Team Members]({{< relref "01-getting-started-guide-foundation-team-members.md" >}}). \ No newline at end of file diff --git a/content/01-dev/02-establish-initial-foundation/05-set-up-common-dev-network.md b/content/01-dev/02-establish-initial-foundation/05-set-up-common-dev-network.md new file mode 100644 index 0000000..8ff4308 --- /dev/null +++ b/content/01-dev/02-establish-initial-foundation/05-set-up-common-dev-network.md @@ -0,0 +1,247 @@ +--- +title: "Set Up Common Development Network" +menuTitle: "5. Set Up Network" +disableToc: true +weight: 50 +--- + +In this step your Cloud Administrators will review the initial development network design, create a new Network AWS account, provision a common centrally managed development network, and share the private subnets will all team development AWS accounts in your AWS organization. + +This step should take about 60 minutes to complete. + +{{< toc >}} + +## 1. Review Initial Network Design + +As mentioned in the [Initial Development Environment Solution Overview]({{< relref "02-review-dev-environment-solution.md#common-development-network" >}}), it's recommended that you start with a single development VPC the prirvate subnets of which will be shared across all team development AWS accounts. + +The centrally managed development VPC will have a set of both public and private subnets. In those AWS regions in which at least 3 Availability Zones (AZs) are available for customer use, it's recommended that your initial set of VPCs have subnets in each of 3 AZs so that your builder teams can experiment with and perform early testing of workloads and AWS services that can take advantage of 3 AZs. + +At least one public subnet will have a NAT Gateway that enables workloads in any of the private subnets to send traffic outbound to the Internet. For example, to enable workloads to download content from Internet accessible source code and package repositories. + +{{% notice tip %}} +**Option to filter outbound Internet traffic:** As you progress in your journey, you may transition from this initial approach of providing builder teams with unfiltered outbound or egress Internet access via the initial set of public subnets and NAT Gateway to a more secure architecture where all Internet egress traffic is routed through your standard enterprise edge security services so that all egress traffic is inspected for compliance. This capability is highlighted in the optional [development fast follow capabilities]({{< relref "02-dev-fast-follow" >}}). +{{% /notice %}} + +[![Centrally Managed Development Network Details](/images/01-dev/dev-network-initial-details.png)](/images/01-dev/dev-network-initial-details.png) + +## 2. Disable Account Factory VPC Provisioning + +Since you will be provisioning the centrally managed development VPC directly using AWS CloudFormation, you need to ensure that the AWS Control Tower Account Factory network configuration is set to disable creation of a VPC when creating a new AWS account. Otherwise, the Account Factory will attempt to create a VPC each time you provision a new AWS account. + +See [Configuring AWS Control Tower Without a VPC](https://docs.aws.amazon.com/controltower/latest/userguide/configure-without-vpc.html) for details on disabling automatic creation of VPCs. + +## 3. Create Network AWS Account + +In AWS Control Tower, provision a new Network AWS account that will initially contain the centrally managed development VPC. + +Later in your journey, you'll deploy more network related resources to this AWS account. For example, you will likely configure and manage [AWS Transit Gateway](https://aws.amazon.com/transit-gateway/) resources in this dedicated AWS account when you start integrating on-premises network connectivity in your overall AWS environment. + +{{% notice tip %}} +**Use the `AWSServiceCatalogEndUserAccess` role:** In the following steps, it's important that you select the correct role when accessing the master AWS account. Failure to do so, will result in you not being able to work with AWS Service Catalog to provision the new AWS account. +{{% /notice %}} + +1. As a Cloud Administrator, use your personal user to log into AWS SSO. +2. Select the AWS **`master`** account. +3. Select **`Management console`** associated with the **`AWSServiceCatalogEndUserAccess`** role. +4. Select the appropriate AWS region. +5. Navigate to **`AWS Service Catalog`**. +6. Select **`Products list`**. +7. Select **`AWS Control Tower Account Factory`**. +8. Select **`Launch Product`**. +9. Under **`Product Version`**, specify a **`Name`**. For example, **`member-account-network`**. +10. Select **`Next`**. +11. In **`Parameters`**, consider the following recommendations: + +|Field|Recommendation| +|-----|---------------| +|**`SSOUserEmail`**|Consult the [set of AWS account root user email addresses]({{< relref "04-address-prerequisites.md#1-create-email-addresses-for-new-aws-accounts" >}}) that you established earlier.| +|**`AccountEmail`**|Use the same value as `SSOUserEmail`.| +|**`SSOUserFirstName`**|Use a part of your account name. For example, `Network`.| +|**`SSOUserLastName`**|Use the remaining part of the account name. For example, `Infrastructure`| +|**`ManagedOrganizationalUnit`**|Select the infrastructure OU you created earlier in this section. For example, **`infrastructure`**.| +|**`AccountName`**|**`Network`**| + +12. Select **`Next`**. +13. On **`Tag Options`**, select **`Next`**. +14. On **`Notifications`**, select **`Next`**. +15. Review the account settings, and then select **`Launch`**. Do not create a resource plan, otherwise the account will fail to be provisioned. + +The AWS account is now being provisioned. It can take a few minutes to complete. You can refresh the page to update the displayed status information. + +{{% notice info %}} +**You can change AWS account settings later:** Configuration settings of the AWS accounts you provision via Account Factory shouldn’t be considered static. Nearly every part of an AWS account can be changed and updated at a later date. See [Account Factory](https://docs.aws.amazon.com/controltower/latest/userguide/account-factory.html) for more details. +{{% /notice %}} + +{{% notice note %}} +**Review Note: Address issue where provisoned products are owned by one user by default:** Based on preliminary testing of this step, only the Cloud Admin who provisions an Account Factory product is able to see and manage that product unless the owner chnages ownership to another user or to an IAM role. This may be the expected behavior of AWS Service Catalog, but it runs counter to our goal of enabling foundation team members who are playing the same functional role to share in the responsibilities of manging common foundation resources. We need to verify that this is the default behavior and, if it is, enhance this section to ensure that the resource is shared amongst at least the Cloud Administration team members. +{{% /notice %}} + +## 4. Enable Foundation Team Members Access + +Since Cloud Administrators won't automatically be granted sufficient access to the newly created AWS account, you need to enable this access each time you create a new AWS account via AWS Control Tower's Account Factory. + +1. As a Cloud Administrator, use your personal user to log into AWS SSO. +2. Select the AWS **`master`** account. +3. Select **`Management console`** associated with the **`AWSAdministratorAccess`** role. +4. Select the appropriate AWS region. +5. Navigate to **`AWS SSO`**. +6. Access **`AWS accounts`** in AWS SSO. +7. Select the checkbox next to the **`Network`** AWS account. +8. Select **`Assign users`**. +9. Select **`Groups`**. +10. Select the checkbox next to the group **`acme-cloud-admin`** or similar. +11. Select **`Next: Permission sets`**. +12. Select the checkbox next to **`AWSAdministratorAccess`**. +13. Select **`Finish`**. + +Now you've enabled all users who are part of the Cloud Administrator group in AWS SSO administrator access to the Network AWS account. + +## 5. Determine IP Address CIDR Blocks + +If you're just experimenting and don't care which IP address CIDR block is used to build the centrally managed development VPC, you can move to the next step, [6. Provision Development VPC](#6-provision-development-vpc). + +Otherwise, if you have a formally assigned CIDR block to use, in this step you'll: + +1. Review Default VPC Topology +2. Determine VPC CIDR Block +3. Determine Subnet CIDR Blocks + +### Review Default VPC Topology + +The default parameters of the AWS CloudFormation template that you will use in the next step will result in a VPC with: +* 2 tiers of subnets: + * Public tier + * Private tier +* 3 subnets for each tier. +* Subnets are mapped across 3 Availability Zones (AZs). + +The CloudFormation template requires you to supply a CIDR block for each of the following: + +* Overall VPC +* Public subnets 1, 2, and 3 +* Private subnets 1, 2, and 3 + +To keep things simple, you can size the subnets identically. + +### Determine VPC CIDR Block + +If your Network team has supplied a relatively large non-overlapping CIDR block, for example a `/16` - `/20`, you should consider using only a subset of that block for your centrally managed development VPC so that the remaining address space can be used in support of pre-production test and production networks. Otherwise, if you've been allocated a `/21` - `/22`, then you should use the entire block for the centrally managed development VPC. + +If you need to break down a larger block: + +1. Acess the [Visual Subnet Calculator](http://www.davidc.net/sites/default/subnets/subnets.html). +2. Enter your network address without the mask portion **`/nn`** in the **`Network Address`** field. +3. Enter the size of allocated block in the **`Mask bits`** field. +4. Click **`Update`**. +5. In the table at the bottom, click the **`Divide`** link to break down the block into smaller blocks. + +When you've reached block sizes from **`/20`** - **`/22`**, select a block size of most interest to you and record that CIDR range so that you can use it in the next step. + +### Determine Subnet CIDR Blocks + +Once you've determined the VPC CIDR block, breaking it down into an equal size block per subnets is straightforward. + +1. Access the [Visual Subnet Calculator](http://www.davidc.net/sites/default/subnets/subnets.html) +2. Enter your network address without the mask portion **`/nn`** the **`Network Address`** field. +3. Enter the size of allocated block in the **`Mask bits`** field. +4. Click **`Update`**. +5. In the table at the bottom, click the **`Divide`** links to start subdividing the larger block into 6 blocks of equal size. +6. Note the first 6 blocks and supply them as the subnet CIDR blocks in the next step. + +## 6. Provision Development VPC + +You can use this [sample AWS CloudFormation template](https://github.com/aws-samples/vpc-multi-tier) to easily deploy your centrally managed development network. + +Download the sample AWS CloudFormation template [vpc-multi-tier.yml](https://raw.githubusercontent.com/aws-samples/vpc-multi-tier/master/vpc-multi-tier.yml) to your desktop. You can review the [README](https://github.com/aws-samples/vpc-multi-tier/blob/master/README.md) to understand the role of this template. + +Next, access the new Network AWS account: + +1. As a Cloud Administrator, use your personal user to log into AWS SSO. +2. Select the **`Network`** AWS account. +3. Select **`Management console`** associated with the **`AWSAdministratorAccess`** role. +4. Select the appropriate AWS region. + +Now create a new AWS CloudFormation stack using the sample template you downloaded to your desktop: + +1. Navigate to **`CloudFormation`**. +2. Select **`Create stack`** and **`With new resources`**. +3. Select **`Upload a template file`**. +4. Select **`Choose file`** to select the downloaded template file from your desktop. +5. Select **`Next`**. +6. Enter a **`Stack name`**. For example, **`base-dev-vpc`**. +7. In **`Parameters`**: + +|Parameter|Guidance| +|---------|--------| +|**`Business Scope`**|Replace `acme` with your organization identifier or stock ticker if that applies. This value is used as a prefix in the name of some of the VPC-related cloud resources. For example, in the name of the IAM role used to support VPC flow logs.| +|**`VPC Name`**|Change to **`dev`**.| +|**`*Cidr`**|**Just Experimenting**
If you want to just experiment at this point and don't care about using formally assigned IP address ranges, you can leave the CIDR block parameters at their default values.

**You Have Your Own CIDR Blocks**
Enter values for the `pVpcCidr`, `pTier1..`, and `pTier2...` CIDR blocks from the prior step. You can ignore the `pTier3...` parameters because only two tiers - public and private - are being provisioned by default.| + +Leave all of the other parameters at their default settings unless you're comfortable changing them. You can always easily create another stack to experiment with other parameter values. Review the [README](https://github.com/aws-samples/vpc-multi-tier/blob/master/README.md) for details on parameters. + +8. Select **`Next`**. +9. Select **`Next`**. +10. Scrolls to the bottom and mark the checkbox to acknowledge that IAM resources will be created. +11. Select **`Create stack`**. + +In the **`Events`** tab, monitor the progress of the stack creation process. After 5 or so minutes, creation of the stack should complete. + +## 7. Review Development VPC + +Review the newly created VPC and associated resources. + +1. Navigate to **`VPC`**. +2. Select the VPC and review its details. +3. Select **`Subnets`** in the left menu and review. By default, you will see 6 subnets. +4. Select **`Route Tables`** and review. You will see one route table per subnet in addition to the VPC's main route table. +5. Select **`NAT Gateways`** and review. With the default behavior of the CloudFormation template, a single NAT Gateway will be created. +6. Select **`Elastic IPs`** and review. You will see one EIP allocated for each NAT Gateway. +7. Navigate to **`CloudWatch`**. +8. Select **`Log groups`**. +9. Select the log group associated with the VPC Flow Logs. For example, `/base/dev/flowlogs`. +10. Explore the log streams. You should see a log stream for each Elastic Network Interface (ENI) used in the VPC. For example, each NAT Gateway has one ENI. Each entry in a log stream represents a the source, destination, and other overall information about the network traffic flowing through the ENI. + +## 8. Share Private Subnets With Development OU + +Now that the centrally managed development VPC has been provisioned, your next step is to share the private subnets with all of the AWS accounts that will become part of the `development` OU that you created earlier. + +### Enable Resource Sharing in AWS Organizations + +This is a one time operation. + +1. As a Cloud Administrator, use your personal user to log into AWS SSO. +2. Select the AWS **`master`** account. +3. Select **`Management console`** associated with the **`AWSAdministratorAccess`** role. +4. Navigate to **`Resource Access Manager`**. +5. Select **`Settings`**. +6. Select **`Enable sharing with AWS Organizations`**. + +### Obtain the ID of the `development` OU + +While you're in the master AWS account, obtain and record the resource ID of the **`development`** OU. + +1. Navigate to **`AWS Control Tower`**. +2. Select **`Organizational units`**. +3. Select **`development`**. +4. Copy the **`ID`** of the form `ou-szfb-rixl8jqc` (example) so that you can refer to it in the next step. + +### Create a Resource Share + +1. As a Cloud Administrator, use your personal user to log into AWS SSO. +2. Select the **`Network`** AWS account. +3. Select **`Management console`** associated with the **`AWSAdministratorAccess`** role. +4. Select the appropriate AWS region. +5. Navigate to **`Resource Access Manager`**. +6. Select **`Create a resource share`**. +7. Enter a **`Name`** of **`base-dev-vpc-private-subnets`**. +8. Under **`Resources`**, by default, the subnets that were just provisioned should be listed. +9. Select only the private subnets. +10. Under **`Principals`**, uncheck **`Allow external accounts`** given that we're sharing the subnets only with other AWS accounts within this AWS organization. +11. In the search field, copy the organization ID of the **`development`** OU. +12. Select the matched OU. +13. Select **`Create resource share`**. + +{{% notice info %}} +**Sharing names of VPC subnets:** If you were to list the shared private subnets from within the team development AWS accounts, you would notice that the subnet names are blank. Currently, sharing of subnets does not include automatic propagation of resource tags, including the `Name` tag. As a workaround, in a subsequent section where you provision the team development AWS accounts, you can manually assign names to the shared private subnets so that it will be easier for the builder teams to understand the role of each subnet. For example, by including the word "private" in the subnet names, builder teams will be able to more readily understand the role of the shared subnets. +{{% /notice %}} diff --git a/content/01-dev/02-establish-initial-foundation/06-create-team-dev-environments.md b/content/01-dev/02-establish-initial-foundation/06-create-team-dev-environments.md new file mode 100644 index 0000000..51f0bc3 --- /dev/null +++ b/content/01-dev/02-establish-initial-foundation/06-create-team-dev-environments.md @@ -0,0 +1,121 @@ +--- +title: "Create Team Development AWS Accounts" +menuTitle: "6. Create Dev AWS Accounts" +disableToc: true +weight: 60 +--- + +In this step your Cloud Administrators will create several new team development AWS accounts via AWS Control Tower's Account Factory. + +This step should take about 30 minutes to complete. + +{{< toc >}} + +## 1. Use at Least Two Team Development AWS Accounts from the Start + +As highlighted previously, an AWS best practice is to isolate the work of distinct builder teams by assigning a different development AWS account to each team. Benefits of this approach include: + +* **Inherent Per Team Cost Allocation:** Since AWS resource costs are, by default, attributable to each AWS account in which the resources are provisioned, at this early stage in your adoption, you don't need to force builder teams to use cost allocation tags on their resources. + +* **Inherent Isolation Between Teams:** Since cloud resources managed by builder teams using different AWS accounts are, by default, completely isolated from each other, more advanced AWS Identity and Access Management (IAM) configurations are not needed to ensure that builder teams don't inadvertently impact each other's cloud resources. + +Initially, you will likely need AWS accounts for the following teams: + +|Team Development Account|Purpose| +|----------------|-------| +|**Workload Builder Team**|A team development AWS account for the team that will be doing the workload specific work for your first formal workload on AWS.| +|**Foundation Team**|A team development AWS account for the initial few Cloud and Security Administrators to experiment, develop, and perform early testing of changes to the foundation.| + +## 2. Create Team Development AWS Accounts + +In AWS Control Tower, provision the initial set of team development AWS accounts for early experimentation, development, and testing. + +You'll follow these steps twice: Once to create the initial deveopment team's AWS account and again to create the development AWS account for the foundation team. + +1. As a Cloud Administrator, use your personal user to log into AWS SSO. +2. Select the AWS **`master`** account. +3. Select **`Management console`** associated with the **`AWSServiceCatalogEndUserAccess`** role. +4. Select the appropriate AWS region. +5. Navigate to **`AWS Service Catalog`**. +6. Select **`Products list`**. +7. Select **`AWS Control Tower Account Factory`**. +8. Select **`Launch Product`**. +9. Under **`Product Version`**, specify a **`Name`**. This will be the name of the provisioned product in AWS Service Catalog and will not be the name of the new AWS account. For example: + * **`member-account-team-a-dev`** + * **`member-account-foundation-dev`** +10. Select **`Next`**. +11. In **`Parameters`**, consider the following recommendations: + +|Field|Recommendation| +|-----|---------------| +|**`SSOUserEmail`**|Consult the [set of AWS account root user email addresses]({{< relref "04-address-prerequisites.md#1-create-email-addresses-for-new-aws-accounts" >}}) that you established earlier.| +|**`AccountEmail`**|Use the same value as `SSOUserEmail`.| +|**`SSOUserFirstName`**|Use a part of your account name. For example, `Team A` or `Foundation` for the foundation team's development AWS account.| +|**`SSOUserLastName`**|Use the remaining part of the account name. For example, `Development`| +|**`ManagedOrganizationalUnit`**|Select the development OU you created earlier. For example, **`development`**| +|**`AccountName`**|`Team A Development` or `Foundation Development`| + +12. Select **`Next`**. +13. On **`Tag Options`**, select **`Next`**. +14. On **`Notifications`**, select **`Next`**. +15. Review your account settings, and then select **`Launch`**. Do not create a resource plan, otherwise the account will fail to be provisioned. + +The AWS account is now being provisioned. It can take a few minutes to complete. You can refresh the page to update the displayed status information. + +## 3. Initialize AWS Account System Users + +When each new team development AWS account is created, follow these steps to initialize the AWS account's AWS SSO user and root user to align with security best practices. + +### Initialize AWS SSO User for the AWS Account +When a new AWS account has been created via the Account Factory, a user for the new AWS account is created in AWS SSO. As a best practice, you should initiatize the associated user's password and enable MFA. + +1. Access the inbox for the email address you associated with the AWS account when using Account Factory. +2. Within the email message "Invitation to join AWS Single Sign-On", select `Accept invitation`. +3. Follow the process to set the initial password for this user. + +Follow the instruction in [How to Register a Device for Use with Multi-Factor Authentication](https://docs.aws.amazon.com/singlesignon/latest/userguide/user-device-registration.html). + +### Initialize AWS Account's Root User + +In addition to a new AWS SSO user being created for the AWS account, the new AWS account has a built-in root user. + +See [Log In as Root User](https://docs.aws.amazon.com/controltower/latest/userguide/best-practices.html#root-login) in the AWS Control Tower documentation for instructions to set the root user’s password. + +See [Enable MFA on the AWS Account Root User](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_root-user.html#id_root-user_manage_mfa) for instructions to enable MFA. + +## 4. Provide Cloud Administrators Access to New AWS Accounts + +Since Cloud Administrators won't automatically be granted sufficient access to newly created AWS accounts, you need to enable this access each time you create new AWS accounts via AWS Control Tower's Account Factory. + +1. As a Cloud Administrator, use your personal user to log into AWS SSO. +2. Select the AWS **`master`** account. +3. Select **`Management console`** associated with the **`AWSAdministratorAccess`** role. +4. Select the appropriate AWS region. +5. Navigate to **`AWS SSO`**. +6. Access **`AWS accounts`** in AWS SSO. +7. Select the checkboxes next both team development AWS accounts. For example: + * `Team A - Dev` + * `Foundation - Dev` +8. Select **`Assign users`**. +9. Select **`Groups`**. +10. Select the checkbox next to the group `acme-cloud-admin` or similar. +11. Select **`Next: Permission sets`**. +12. Select the checkbox next to **`AWSAdministratorAccess`**. +13. Select **`Finish`**. + +Now you've enabled all users who are part of the Cloud Administrator group in AWS SSO administrator access to the selected AWS accounts. + +## 5. Apply Names to Shared Private Subnets + +Since the names of shared subnets are not currently propagated to AWS accounts, as a Cloud Administrator, you should apply names to the shared subnets within each team development AWS account so that it's easier for the builder teams to understand the role of each subnet as they configure resources for AWS services. + +1. As a Cloud Administrator, use your personal user to log into AWS SSO. +2. Select the team development AWS account of interest. +3. Select **`Management console`** associated with the **`AWSAdministratorAccess`** role. +4. Select the appropriate AWS region. +5. Navigate to **`VPC`**. +6. Select **`Your VPCs`**. +7. Select the unnamed VPC and assign the same name as used in the Network AWS account. For example, **`base-dev`**. +8. Select **`Subnets`**. +9. Update the **`Name`** field of each private subnet to match the name of the private subnet as it's configured in the `Network` AWS account. You can open another icognito or similar browser session to view the `Network` account's resources. **Caution:** The subnets may not be listed in the same order in both AWS accounts by default. +10. You can optionally apply the same naming alignment for route tables. \ No newline at end of file diff --git a/content/01-dev/02-establish-initial-foundation/07-onboard-builder-teams.md b/content/01-dev/02-establish-initial-foundation/07-onboard-builder-teams.md new file mode 100644 index 0000000..3f55a88 --- /dev/null +++ b/content/01-dev/02-establish-initial-foundation/07-onboard-builder-teams.md @@ -0,0 +1,85 @@ +--- +title: "Onboard Builder Teams to Their Team Development AWS Accounts" +menuTitle: "7. Onboard Builder Teams" +disableToc: true +weight: 70 +--- + +In this step either Security or Cloud Administrators will onboard a limited set of initial builders who will have access to their team development environments. The outcome is that a small team of builders has the knowledge to start using their team development AWS accounts, where to find basic usage documentation, and who to contact for support. + +This step should take about 60 minutes to complete. + +{{< toc >}} + +## 1. Assemble Onboarding Documentation + +Work with your cross-functional colleagues in Security, Compliance, and Finance to assemble the basic form of a getting started document and share it with the members of the initial builder teams so that they understand the fundamentals of their responsibilities, access permissions, and how to access and begin using their team development AWS accounts. + +See the [Example Getting Started Guide for Builder Team Members]({{< relref "02-getting-started-guide-builder-team-members.md" >}}) as a recommended starting point. + +## 2. Create Team Development Groups in AWS SSO + +Create a new group in AWS SSO for each of the builder teams and associate those groups with an initial set of permissions and their respective team development AWS accounts. + +1. As a Cloud Administrator, use your personal user to log into AWS SSO. +2. Select the AWS **`master`** account. +3. Select **`Management console`** associated with the **`AWSAdministratorAccess`** role. +4. Select the appropriate AWS region. +5. Navigate to **`AWS SSO`**. +6. Access **`Groups`** in AWS SSO. +7. Select **`Create group`**. +8. Provide a group name. For example, replacing `acme` with your organization's identifier: + * `acme-team-a-dev` + * `acme-foundation-dev` +9. Provide a description. For example: + * `Team A development` + * `Foundation team development` +10. Select **`Create`**. + +## 3. Grant Development Groups Access to Team Development AWS Accounts + +1. Access **`AWS accounts`** in AWS SSO. +2. Select the checkbox next to the team development AWS account of interest. For example: + * `Team A - Dev` + * `Foundation - Dev` +3. Select **`Assgn users`**. +4. Select **`Groups`**. +5. Select the checkbox next to the group of interest. For example: + * `acme-team-a-dev` + * `acme-foundation-dev` +6. Select **`Next: Permission sets`**. +7. Select the checkbox next to **`acme-base-dev-team`**. +8. Select **`Finish`**. + +Repeat the process above to create a group for your foundation team and enable this group to access their team development AWS account. + +## 4. Create Builder Team Users in AWS SSO + +Now that you've established the two team development oriented groups in AWS SSO and wired these groups to a set of permissions and AWS accounts, your next step is to create a user in AWS SSO for each builder team member. + +Typically, the user name will simply be the user's corporate email address that is often used for SaaS services. + +Next, access the AWS SSO service to begin adding an AWS SSO user for each foundation team member: + +1. Access **`Users`** in AWS SSO. +2. Select **`Add user`**. +4. Specify a user name and complete at least the other required fields. +5. Select **`Next: Groups`**. +6. Select `acme-team-a-dev` or similar. +7. Select **`Add user`**. + +## 5. Add Foundation Team Members to Development Group + +Since you've already created users in AWS SSO for foundation team members, all you need to do to at this stage is to add the foundation team member users to the newly created foundation team development group in AWS SSO. + +1. Access **`Groups`** in AWS SSO. +2. Select `acme-foundation-dev`. +3. Select **`Add users`**. +4. Select the checkbox for each foundation team member. +5. Select **`Add users`**. + +The foundation team members now have access to the foundation team development AWS account. + +## 6. Brief Builder Team Members + +Meet with the builder team members to brief them on their access and other topics covered in the [Example Getting Started Guide for Builder Team Members]({{< relref "02-getting-started-guide-builder-team-members.md" >}}). \ No newline at end of file diff --git a/content/01-dev/02-establish-initial-foundation/_index.md b/content/01-dev/02-establish-initial-foundation/_index.md new file mode 100644 index 0000000..9ee4ab0 --- /dev/null +++ b/content/01-dev/02-establish-initial-foundation/_index.md @@ -0,0 +1,10 @@ +--- +title: "Establish the Initial Foundation for Development Environments" +menuTitle: "Establish Initial Foundation" +disableToc: true +weight: 20 +--- + +Now you're ready to start establishing the initial foundation in support of your first development environments and onboarding your foundation and initial set of workload builder teams. + +{{% children showhidden="false" %}} \ No newline at end of file diff --git a/content/01-dev/03-reference/01-getting-started-guide-examples/01-getting-started-guide-foundation-team-members.md b/content/01-dev/03-reference/01-getting-started-guide-examples/01-getting-started-guide-foundation-team-members.md new file mode 100644 index 0000000..05cd49e --- /dev/null +++ b/content/01-dev/03-reference/01-getting-started-guide-examples/01-getting-started-guide-foundation-team-members.md @@ -0,0 +1,138 @@ +--- +title: 'Getting Started Guide for Foundation Team' +menuTitle: 'Gettting Started: Foundation' +disableToc: true +weight: 10 +--- + +{{% notice tip %}} +**An Example Getting Started Guide:** This document represents an example that can help your organization develop and publish your own getting started guide internally for cloud foundation team members that are onboarding to your AWS environment. You are free to copy this content into your own internal wiki or other system and modify it to meet your needs. As your organization progresses on its cloud adoption journey, you will likely significantly expand your internal documentation to help communicate additional and increasingly sophisticated capabilities and associated best practices that are available to teams. +{{% /notice %}} + +{{% notice note %}} +**Review Note: Help add useful day 1 topics for new foundation teams and members:** What is the minimum knowledge a foundation team member would need for day 1? Don't overload the initial document with more advanced capabilities. Focus on the "crawl" level of knowledge that they need. +{{% /notice %}} + +This document is intended to provide foundation team members with awareness of the typical day-to-day tasks and supporting methods, tools, and AWS services to help them manage and monitor your new AWS environment. + +{{< toc >}} + +## Cloud Administrators + +### Identify Day-to-Day Tasks for This Role. + +Consider starting with the following list: + +* Applying [AWS Control Tower updates](https://docs.aws.amazon.com/controltower/latest/userguide/configuration-updates.html). + * Note that you may need to [disable AWS Control Tower's creation of VPCs](https://docs.aws.amazon.com/controltower/latest/userguide/configure-without-vpc.html) after you apply AWS Control Tower updates. +* Deleting [default VPCs created by AWS Control Tower](https://docs.aws.amazon.com/controltower/latest/userguide/configure-without-vpc.html) in the master AWS account. +* Responding to alerts from AWS Control Tower guardrails and other AWS platform monitoring services. +* Monitoring costs across accounts on at least a weekly basis. + +## Security Administrators + +By following this guide, your foundation team has already established a foundation for security: + +* Leveraged AWS Control Tower to set up and govern a secure, compliant, multi-account AWS environment based on best practices established by working with thousands of enterprises. +* Established mandatory [Guardrails](https://docs.aws.amazon.com/controltower/latest/userguide/guardrails.html) to provide ongoing governance for your overall AWS environment. Additional guardrails are available and should be reviewed by your security administrator and team. +* Established [AWS CloudTrail](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-user-guide.html) logging to capture all actions taken by users, roles and services across all of your AWS accounts. +* Secured the root user of your AWS accounts with multi-factor authentication (MFA). +* Set up an initial degree of AWS platform access management. + +### Identify Day-to-Day Tasks for This Role. + +Consider starting with the following list: + +* Responding to alerts from AWS Control Tower guardrails and other AWS platform monitoring services. +* Onboarding and de-provisioning users and groups via AWS SSO. +* Developing, testing, and rolling out access permissions via: + * AWS SSO Permission Sets. + * AWS Organizations Service Control Policies (SCPs) + +### Review and Enable Foundational Security Services + +While security is weaved within all AWS services and capabilities, a few explicit AWS Security, Identity, & Compliance services you should be aware of at this point in your journey are: + +****[Amazon GuardDuty](https://docs.aws.amazon.com/guardduty/latest/ug/what-is-guardduty.html)**** is our threat detection service that continuously monitors for malicious activity and unauthorized behavior to protect your AWS accounts and workloads. To use GuardDuty, it is a service that needs to be enabled. We recommend [enabling](https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_settingup.html) the service for the 30-day free trial and see the visibility and value it brings to your security practice. + +****[AWS Shield](https://docs.aws.amazon.com/waf/latest/developerguide/shield-chapter.html)**** is a managed Distributed Denial of Service (DDoS) protection service that safeguards applications running on AWS. AWS Shield provides always-on detection and automatic inline mitigations that minimize application downtime and latency, so there is no need to engage AWS Support to benefit from DDoS protection. There are two tiers of AWS Shield - Standard and Advanced. All AWS customers benefit from the automatic protections of AWS Shield Standard, at no additional charge. + +****[AWS Security Hub](https://docs.aws.amazon.com/securityhub/index.html)**** AWS Security Hub provides you with a comprehensive view of the security state of your AWS resources. Security Hub collects security data from across AWS accounts and services, and helps you analyze your security trends to identify and prioritize the security issues across your AWS environment. + +### Access CloudTrail + +AWS CloudTrail is an AWS service that helps you enable governance, compliance, and operational and risk auditing of your AWS account. Actions taken by a user, role, or an AWS service are recorded as events in CloudTrail. Events include actions taken in the AWS Management Console, AWS Command Line Interface, and AWS SDKs and APIs. + +1. Sign in to the AWS Management Console and open the CloudTrail console at https://console.aws.amazon.com/cloudtrail/home/. +2. Review the information in your dashboard about the most recent events that have occurred in your AWS account. One of these events should be a "ConsoleLogin" event, showing that you just signed in to the AWS Management Console. +3. Expand the event to see additional information. +4. As your usage of the platform grows you will find value in additional capabilities like search, filtering, and exporting the CloudTrail data. + +### Develop and Hone Your AWS IAM Skills + +{{% notice note %}} +**Review Note: Provide guidance on developing and honing IAM skills:** Provide pointers about how to learn more about effective use of IAM. For example, IAM Policy Simulator, testing policy changes before promoting them, IaC code techniques, etc. Reference how [AWS Access Analyzer](https://docs.aws.amazon.com/IAM/latest/UserGuide/what-is-access-analyzer.html) can be used to help identify the resources in organization and accounts, such as Amazon S3 buckets or IAM roles, that are shared with an external entity. +{{% /notice %}} + +## Auditors + +### Perform Periodic Audits of the AWS Security Configuration. + +Although some of the detective guardrails deployed through AWS Control Tower help continuously monitor and audit aspects of your AWS environment, it’s a best practice to periodically audit your security configuration to make sure that it meets your current business needs. See AWS [Security Audit Guidelines](https://docs.aws.amazon.com/general/latest/gr/aws-security-audit-guide.html) for best practices. + +### Monitor and Manage Resource Configuration State + +As resources are deployed in your account, managing the growing inventory of resources and ensuring that they are deployed consistently and maintained consistently can become a challenge. [AWS Config](https://docs.aws.amazon.com/config/latest/developerguide/WhatIsConfig.html) is a Management and Governance tool available to help you with: + +* Resource Administration and Governance +* Auditing and Compliance +* Managing and Troubleshooting Configuration changes +* Security Analysis + +More specifically, you can do the following with AWS Config: + +* Evaluate your AWS resource configurations for desired settings. +* Get a snapshot of the current configurations of the supported resources that are associated with your AWS account. +* Retrieve configurations of one or more resources that exist in your account. +* Retrieve historical configurations of one or more resources. +* Receive a notification whenever a resource is created, modified, or deleted. +* View relationships between resources. For example, you might want to find all resources that use a particular security group. + +Once you have resources deployed in your account, consider [Getting Started with AWS Config](https://docs.aws.amazon.com/config/latest/developerguide/getting-started.html). + +## Cost Managers + +AWS Cost Management tools give you and your team visibility into AWS account costs and usage. Each account you create will have access to view their individual account costs and usage. The Master account can see the total organizational cost and usage rollup. + +### Access the Billing and Cost Management Dashboard + +Sign in to the AWS Management Console and open the Billing and Cost Management console at [https://console.aws.amazon.com/billing/home#/](https://console.aws.amazon.com/billing/home) + +There are a range of AWS Cost Management tools to help you access, organize, understand, control, and optimize your costs. You start to access detailed information about your AWS costs and usage using the built-in dashboard in the Billing and Management area of the AWS Management Console. + +### Enable Cost Explorer + +To see more detailed cost information for the entire organization of AWS accounts and to enable builder teams to access cost reporting within their own AWS accounts, you should enable the Cost Explorer: + +1. As a **Cost Manager**, use your personal user to log into AWS SSO. +2. Select the AWS **master** account. +3. Select `Management console` associated with the `Billing` role. +4. Access the `Billing` service. +5. Select `Cost Explorer`. +6. Choose `Enable Cost Explorer`. + +### Enable EC2 Right Sizing Recommendations + +Enable [Amazon EC2 Right Sizing Recommendations](https://docs.aws.amazon.com/awsaccountbilling/latest/aboutv2/ce-rightsizing.html) so that the foundation and workload builder teams can gain insight into recommendedations for downsizing and terminating EC2 instances. + +### Create a Budget + +For more proactive management of your AWS costs, set up budgets within the Billing and Management console. Budgets allow you to: + +* View your usage against a planned/budgeted amount. +* See where your usage is within free tier limits and limits you set. +* Estimate your usage each month based on consumption of the budget +* Make decisions on frequently updated usage and cost data. Budget data is updated three times each day to give you the most accurate information. +* Create alerts based on a budget to notify you or others as budget thresholds are reached. Each budget alert notification can be sent to up to 10 email addresses and 1 SNS topic for subscribers. + +Take a few minutes and create an initial basic budget by following this guide [Create your first Budget](https://docs.aws.amazon.com/awsaccountbilling/latest/aboutv2/budgets-create.html). diff --git a/content/01-dev/03-reference/01-getting-started-guide-examples/02-getting-started-guide-builder-team-members.md b/content/01-dev/03-reference/01-getting-started-guide-examples/02-getting-started-guide-builder-team-members.md new file mode 100644 index 0000000..becb54c --- /dev/null +++ b/content/01-dev/03-reference/01-getting-started-guide-examples/02-getting-started-guide-builder-team-members.md @@ -0,0 +1,144 @@ +--- +title: "Getting Started Guide for Builder Teams" +menuTitle: 'Gettting Started: Builders' +disableToc: true +weight: 20 +--- +{{% notice tip %}} +**An Example Getting Started Guide:** This document represents an example that can help your organization develop and publish your own getting started guide internally for builder teams that are onboarding to your AWS environment. You are free to copy this content into your own internal wiki or other system and modify it to meet your needs. As your organization progresses on its cloud adoption journey, you will likely significantly expand your internal documentation to help communicate additional and increasingly sophisticated capabilities and associated best practices that are available to teams. +{{% /notice %}} + +{{% notice note %}} +**Review Note: Help add useful day 1 topics for new builder teams and members:** What is the minimum knowledge a builder team would need for day 1 use of their new team development AWS account? Don't overload the initial document with more advanced capabilities. Focus on the "crawl" level of knowledge that they need. +{{% /notice %}} + +This document is intended to provide builder team members with awareness of the typical day-to-day tasks and supporting methods, tools, and AWS services to help them experiment, develop, and perform early testing in their team development AWS accounts. + +{{< toc >}} + +## Accepting Invite to Join AWS SSO + +After your Cloud Administrators have onboarded your builder team and added your individual user logins, you will receive an email from AWS with the subject "Invitation to join AWS Single Sign-On". To login to your AWS account, you'll need to [accept the invitation](https://docs.aws.amazon.com/singlesignon/latest/userguide/howtoactivateaccount.html). + +Once you're able to login, you'll need to [register an MFA device](https://docs.aws.amazon.com/singlesignon/latest/userguide/user-device-registration.html) to your AWS SSO account. + +## Understanding Your Team's Initial Development Environment + +### Environment Overview + +Review the [Initial Development Environment Solution Overview]({{< relref "02-review-dev-environment-solution" >}}) for an introduction to the overall environment. + +### Network Overview + +The following diagram provides a more detailed view of the initial network environment that is available to your team development AWS account: + +[![Common Development Network Details](/images/01-dev/dev-network-initial-details.png)](/images/01-dev/dev-network-initial-details.png) + +When you access your team development AWS account via the the AWS Management Console and review the Virtual Private Cloud (VPC) resources, you will see a series of private subnets that have been shared with your AWS account. + +The private subnets and other VPC resources are hosted in a Network AWS account that is managed by your Cloud Administrators. All team development AWS accounts have read only access to these VPC resources. + +By design, your team does not have permissions to create and modify VPC resources in your own team development AWS account. + +{{% notice info %}} +**What is a "private" subnet?** Workloads deployed to private subnets cannot be directly accessed from the Internet. i.e. unsolicited traffic from the Internet is not allowed. In the initial configuration of the common set of shared private subnets for team development AWS accounts, your workloads are able to connect outbound to services on the Internet via NAT Gateway services that are hosted in a set of centrally managed public subnets. +{{% /notice %}} + +### Where should my team deploy resources? + +All AWS resources that your team creates and manages are constrained to your team development AWS account. In support of workloads requiring access to VPC resources, your team can deploy those workloads in the private subnets of the centrally managed development VPC. + +## Understanding Your Team's Access Permissions and Responsibilities + +*...use of personal users set up in AWS SSO...* + +*...summary of access permissions to their team development AWS account... withe pointers to detailed permissions...* + +*...extent of AWS services available via their team development AWS accounts and how that extent may likely evolve over time as the security baselines get more sophisticated...* + +*mention that an initial set of preventative and detective security guardrails are in place to avoid and recognize out of compliant resources...* + +*highlight that their access permissions will likely be further constrained for their team development AWS accounts over time to help reduce the risk to the overall organization...* + +*...use scripted builds for their cloud resources where feasible to avoid cost of rework as their team development AWS networks are likely to be replaced over time... provide pointers to Infrastructure as Code resources...* + +## Accessing Your Team's Development AWS Account + +For non-production environments, you're allowed access to use the AWS Management Console to create and update AWS resources. As workloads move towards production and our practices on AWS mature, we'll be implementing a "Console Read Only" policy in production environments. + +All resources required for your formal workloads should be managed with Infrastructure as Code (IaC). + +### Access Via AWS Management Console +When you log into your AWS SSO portal ([add your company's link here]()), you'll be shown a list of AWS accounts you have access to. Initially, each builder team is provided a single team development AWS account. + +### From Your Corporate Desktop - Access Via AWS CLI, AWS SDKs, and AWS APIs + +AWS SSO supports CLI access via the AWS CLI. + +First, [Install the AWS CLI](https://docs.aws.amazon.com/cli/latest/userguide/install-cliv2.html). + +Then review [Configuring the AWS CLI to Use AWS SSO](https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-sso.html). + +### Other Tools + +See [Tools on AWS](https://aws.amazon.com/tools/) for a list of tools and SDKs that AWS supports. + +## Working with AWS Services + +Since there are some constraints in using AWS services in your team development AWS account, refer to [Using AWS Services]({{< relref "04-using-aws-services" >}}) for more details on both general considerations and AWS service specific considerations. + +## Monitoring and Managing Costs + +With the adoption of AWS, we're shifting our operation model to empower builders with more flexibility and control over their environments. This includes understanding the AWS resources they're consuming and the costs that are associated with them. + +1. Use your personal user to log into AWS SSO. +2. Select your team development AWS account. +3. Select **`Management console`**. +4. Access the **`Billing`** service. + +Learn about [AWS Billing and Cost Management](https://docs.aws.amazon.com/awsaccountbilling/latest/aboutv2/billing-what-is.html). Specifically, review how you can use Cost Explorer and Budgets to help you monitor your cloud costs incurred within your development AWS account. + +## Learning Architecture Best Practices + +### How to Get an Application to Production + +*.... Well Architected Review...Any other changes to traditional SDLC...* + +### How to Apply Additional Compliance Guardrails for Sensitive Applications? +*... engaging cloud foundations team for SCP/Organizational changes/creation...* + +## Learning About AWS Services + +See additional getting started with AWS information: + +* [AWS Getting Started](https://aws.amazon.com/getting-started/) +* [AWS Training and Certification](https://aws.amazon.com/training/?e=gs&p=gsrc) +* [Start Developing with AWS](https://aws.amazon.com/developers/getting-started/) + +## Working with Other AWS Accounts + +### Consuming Another Team's APIs or Resources + +Since a common set of private subnets are shared across team development AWS accounts, any workloads you deploy to these subnets have the potential to connect to each other. + +### Working With External AWS Accounts + +If I already have an AWS account registered with my corporate/company email, can I use it instead? + +If you have production workloads, contact your cloud foundations team to absorb that account into our proper environment to ensure compliance and security requirements are met. + +## Getting Support + +*...address how builder teams get support to get things done in their team development AWS accounts... include: 1) organization-specific support needds; 2) support for AWS services - can the dev teams file tickets?...* + +Typically, best practices are: + +For organization-specific usage needs, consult these resources in this order: +* Review the internal documentation. +* Interact with the internal community forum. +* File an internal support ticket. + +For AWS-specific usage needs: +* Review external documentation. +* Interact with public community forums. Being careful to not disclose company confidential and other sensitive information. +* File a ticket with AWS Support. See internal guidelines and procedures for doing so. diff --git a/content/01-dev/03-reference/01-getting-started-guide-examples/_index.md b/content/01-dev/03-reference/01-getting-started-guide-examples/_index.md new file mode 100644 index 0000000..fc31280 --- /dev/null +++ b/content/01-dev/03-reference/01-getting-started-guide-examples/_index.md @@ -0,0 +1,8 @@ +--- +title: "Getting Started Guide Examples" +disableToc: true +weight: 10 +--- +The following documents are example getting started guides that you can use to start establishing your own internal documentation for foundation and workload builder teams. + +{{% children showhidden="false" %}} \ No newline at end of file diff --git a/content/01-dev/03-reference/02-controlling-builder-team-access.md b/content/01-dev/03-reference/02-controlling-builder-team-access.md new file mode 100644 index 0000000..1ef1635 --- /dev/null +++ b/content/01-dev/03-reference/02-controlling-builder-team-access.md @@ -0,0 +1,516 @@ +--- +title: "Controlling Builder Team Access to Development Environments" +menuTitle: "Controlling Builder Access" +disableToc: true +weight: 20 +--- + +The sample IAM policies described in this document are intended to be used as a starting point for how you might control builder team access in team development AWS accounts so that builders have the freedom to get many things done on their own, but are constrained from adversely impacting the security and stability of the underlying foundation. + +Your organization is expected to understand these sample policies in detail before potentially applying them. + +As you progress on your journey, managing and controlling changes to these types of policies will be a critical responsibility of your foundation team. Typically, only your Cloud Security team would have the permissions needed to create and update such policies. + +{{< toc >}} + +## Goals + +The overall intent of the policies is to enable your builders to have broad permissions to innovate, experiment, develop, and perform early testing in their team development AWS accounts while being prevented from adversely impacting the overall security and the stability of the underlying foundation of those AWS accounts. + +These policies are not intended to be applied beyond team development AWS accounts. For example, it's a best practice for organizations to apply strict policies for the creation and management of cloud resources in formal pre-production test and production AWS accounts. + +## Requirements + +The following requirements are intended to provide a practical sense of the access that you may consider providing to builder teams. + +### Disallow Access + +**Disallow Modification of Foundation Resources:** For example: +* Foundation IAM roles and policies. +* AWS account settings. +* AWS Control Tower CloudFormation StackSet stack instances. + +**Disallow Creation of Sensitive IAM Resources:** For example: +* IAM Users: Given the use of AWS SSO for human user login, there's generally no need for IAM users. +* IAM SAML Providers: Creation of these resources could enable external entities access to your AWS account. + +**Disallow Privilege Escalation:** Inhibit builders from creating and using IAM roles that circumvent these requirements. + +**Disallow Creation and Management of VPC Resources:** Since builders already have read only access to the centrally managed development VPC and supporting network resources, builders should not generally need to create and manage VPC resources. + +### Allow Access + +**Allow Wide Range of AWS Services Subject to Organizational Policies:** Allow for use of a wide range of AWS services with the expectation that AWS Organizations Service Control Policies (SCPs) will be used to restrict the overall set of AWS services that are accessible for any AWS account in the "development" organization. + +**Allow Creation of IAM Service Roles and Policies:** In development environments builders should be able to experiment, develop, and test solutions without depending on other teams to get things done. + +Since this work often entails creation of workload specific IAM service roles and policies, builders should be able to create and manage these resources on their own subject to the constraint that builders must not be able to escalate their privileges to circumvent other policies. + +For example, it's a common need to be able to define workload specific IAM service roles and policies and attach the roles to Amazon EC2 instances and Lambda functions. + +**Allow Read Only Access to IAM Roles and Policies:** Allow builders to browse and review IAM resources so that they know what is available to potentially reuse and can learn from existing examples. + +**Allow Access to Billing and Cost Information** So that builders can monitor and manage their cloud spend. + +### User Experience + +**Avoid Prematurely Requiring Standard Resource Naming and Tagging:** Although your organization will find value in the introduction of cloud resource naming and tagging standards in support of a variety of needs, these standards are not necessary to impose sufficient constraints on builders at this early stage in your journey. + +However, it is important that foundation resources adhere to a naming convention so that IAM policies can be defined to inhibit unauthorized modification of those resources. + +### Assumptions + +**Consider Similar but Different Policies for Foundation Team Development:** Since your cloud foundation team members are also builders and they will need additional acccess in their foundation team development AWS account to develop and test chnges to the foundation, a derivative of these sample policies may be warranted for this group of builders. + +As a best practice, when foundation team members are doing day-to-day development of Infrastructure as Code (IaC), they should not be using their administrative access roles and permissions. + +Instead, foundation team members should use their team development oriented role for their day-to-day development and only assume the escalated privileges of their Cloud Administrator and similar roles when they need to perform their cloud administration duties. + +## Common Scenarios + +There are two common scenarios that these access requirements are intended to address: + +* Builders working directly with AWS services. +* Builders creating and using workload specific IAM service roles and policies. + +### Builders Working Directly with AWS Services + +When your builders experiment and formally develop with AWS services, the IAM SAML role and policies under which they work in their team development AWS account needs access to a variety of AWS services. + +### Builders Creating and Using Workload Specific IAM Service Roles and Policies + +When builders are formally developing and performing preliminary testing of AWS service configurations, they often need to define and configure IAM service roles and customer managed policies that are specific to their workloads. + +Once the workload specific IAM service roles and policies are created, they are associated with AWS services so that those services can operate with the appropriate permissions. Instead of relying on a central team to develop and test workload specific IAM service roles and policies, this workload specific work is best performed by the builder teams that are also developing the workloads. + +Typically, before workload specific IAM service roles and policies are used in more strictly controlled pre-production test and production environments and associated AWS accounts, organizations implement either human powered workflows or, in more advanced cases, highly automated code pipelines to review and test workload specific IAM service roles and policies. + +#### Creating IAM Service Roles + +When experimenting, developing, and testing workload specific IAM service roles and policies, builders use a variety of tools including: + +* AWS Management Console. +* AWS CLI or SDKs. +* AWS CloudFormation or other Infrastucture as Code (IaC) tools such as Terraform. + +IaC tools are typically used before workload specific IAM service roles and policies can be promoted to pre-production test and production environments. + +#### Using IAM Service Roles + +The following scenarios are just a few examples of when a builder team would associate an IAM service role with an AWS service: + +* Deploy EC2 instance and associate an instance profile. +* Deploy a Lambda function. +* Deploy a Cloud9 IDE workspace. +* Deploy a Redshift cluster to support data warehousing use cases. +* Deploy containers to Amazon ECS and EKS container orchestration services. + +{{% notice tip %}} +**Best practice to use IAM service roles vs "service accounts":** In all of these examples, it's a best practice to use customer managed IAM service roles and policies and the associated short term credentials to permit the workload access to other cloud resources on which they depend. This approach is more managable and secure than the complexity and risks associated with managing and using workload specific "service accounts" in the form of IAM users and long term AWS access keys. +{{% /notice %}} + +## Sample Implementation + +This section provides an overview of the sample policies and then walks through each set of policies in detail. + +### Overview of the Implementation + +In support of the requirements described above, two IAM policies are used: + +|Policy|Purpose|Usage|Sample Code| +|------|-------|-----|-----------| +|**Team Development IAM Policy**|A JSON format IAM policy used for control human user access to team development AWS accounts.|This policy is used to create a custom permission set in AWS SSO that is associated with team development groups and team development AWS accounts.|[`acme-base-team-dev.json`](/code-samples/01-iam-policies/acme-base-team-dev.json)| +|**Team Development IAM Permissions Boundary**|A customer managed IAM permissions boundary policy that is used to control permissions of IAM service roles created by team development users in their team development AWS accounts.|This AWS CloudFormation template forms the basis of a CloudFormation StackSet that is applied to all team development AWS accounts.|[`acme-base-team-dev-boundary.yml`](/code-samples/01-iam-policies/acme-base-team-dev-boundary.yml)| + +#### Provisioning the Policies + +If you followed the steps in section [3. Set Up Initial AWS Platform Access Controls]({{< relref "03-set-up-aws-platform-access-controls.md" >}}), you already provisioned both the team development IAM policy as an AWS SSO permission set and the permissions boundary policy via an AWS CloudFormation StackSet. The result of those steps is that the supporting policies are available in each of the team development AWS accounts. + +[![Team Development Access Policy Provisioning](/images/01-dev/team-dev-access-provisioning.png)](/images/01-dev/team-dev-access-provisioning.png) + +#### Using the Policies + +The following diagram depicts how a builder team member accesses their team development AWS account, interacts with AWS services and is contrained by what they can do through both the IAM SAML role under which they are working and the permissions boundary policy and IAM service roles under which AWS services are working on their behalf. + +A key element of this sample solution is the use of [AWS IAM Permissions Boundaries](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_boundaries.html) to enable delegation of permissions management to builders, but also constrain the overall scope of their access and the access of AWS services working on their behalf. + +In this scenario, we're delegating a degree of permissions management to builder team members in their team development AWS accounts so that they can create and manage workload specific IAM service roles, but at the same time using a permissions boundary to constrain what actions services associated with those roles can perform and the resources that can be affected. + +[![Team Development Access Policy Usage](/images/01-dev/team-dev-access-usage.png)](/images/01-dev/team-dev-access-usage.png) + +1. Builder authenticates via AWS SSO. + +2. Via the AWS SSO portal, the builder selects their authorized combination of team development AWS account and team development IAM SAML role. + +3. Once the builder has been authenticated and gained access to their team development AWS account, they are working based on the intersection of the permissions of the team development IAM SAML role and any applicable Service Control Policies (SCPs) associated with team development AWS accounts. They can interact with AWS services and create and manage resources subject to those permissions. + +4. When a builder needs to create a workload specific IAM service role, the permissions boundary policy referenced in the IAM SAML role under which they are working requires that they attach the permission boundary with any newly created IAM service role. If the permissions boundary is not attached, creation of the role will fail. + +5. The builder passes a newly created workload specific IAM service role to an AWS service and resource. + +6. Since the workload specific IAM service role has an attached boundary policy, AWS will constrain the resource to being able to access only those services and resources that are the intersection of the permissions allowed by the boundary policy, applicable SCPs, and the IAM service role. + +{{% notice info %}} +**Learn more about permissions boundaries:** [AWS IAM Permissions Boundaries](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_boundaries.html). +{{% /notice %}} + +### Base Policy Walkthrough + +[`acme-base-team-dev.json`](/code-samples/01-iam-policies/acme-base-team-dev.json) + +Each section of the sample policy is explained here. + +#### Allow Virtually All AWS Services + +Start by allowing full access to all AWS service resources and actions, but disallow access to actions for all "iam", "organizations", and "account" resources. + +This first permission is patterned after a portion of the [AWS Managed Policy Developer Power User](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_job-functions.html#jf_developer-power-user). + +{{% notice tip %}} +**Depend on AWS Organizations Service Control Policies (SCPs) for AWS Account-wide Constraints:** As mentioned above, it's a best practice to use AWS Organizations SCPs to provide an overarching constraint on which AWS services can be used in a given AWS ccount. Instead of over complicating the following policy with fine grained lists of allowed or disallowed AWS services, it's best practice to defer to SCPs to control which AWS services can be used at all in the team development AWS accounts. +{{% /notice %}} + +``` + { + "Sid": "AllowAllWithExceptions", + "Effect": "Allow", + "NotAction": [ + "iam:*", + "organizations:*", + "account:*" + ], + "Resource": "*" + }, +``` + +#### Allow Typical IAM and Read Only Organizations and Account Actions + +A subset of the following permissions is taken from the AWS managed Developer Power User policy. In support of this use case where the intent is to provide builders in their team development AWS accounts a limited degree of self-service write access to create, update, and delete their workload specific IAM service roles, additional permissions have been added. + +``` + "Sid": "AllowCommonOps", + "Effect": "Allow", + "Action": [ + "iam:Get*", + "iam:List*", + "iam:PassRole", + "iam:CreateServiceLinkedRole", + "iam:DeleteServiceLinkedRole", + "iam:CreateInstanceProfile", + "iam:DeleteInstanceProfile", + "iam:AddRoleToInstanceProfile", + "iam:RemoveRoleFromInstanceProfile", + "organizations:DescribeOrganization", + "account:ListRegions" + ], + "Resource": "*" + }, +``` + +#### Allow Creation of Customer Managed Policies + +Allow builders to develop and test customer managed policies as long as the name of the policies don't conflict with the foundation policies. + +{{% notice tip %}} +**Importance of Standardized Naming of Foundation Resources:** In several of the following permissions examples, note the use of a naming convention for customer-managed foundation policies and roles. The example naming convention shown below is simply `-base-...` where `base` is shorthand for "foundation". +{{% /notice %}} + +``` + { + "Sid": "AllowPolicyCrud", + "Effect": "Allow", + "Action": [ + "iam:CreatePolicy", + "iam:DeletePolicy", + "iam:CreatePolicyVersion", + "iam:DeletePolicyVersion" + ], + "NotResource": "arn:aws:iam::*:policy/acme-base-*" + }, +``` + +#### Allow Creation of IAM Roles Only When Permissions Boundary is Attached + +Allow builders to create IAM roles only if the standard team development permissions boundary policy is attached at role creation time and the role name does not overlap with the foundation namespace. + +``` + { + "Sid": "AllowRoleWithPBs", + "Effect": "Allow", + "Action": [ + "iam:CreateRole", + "iam:AttachRolePolicy", + "iam:DetachRolePolicy", + "iam:PutRolePolicy", + "iam:DeleteRolePolicy" + ], + "NotResource": "arn:aws:iam::*:role/acme-base-*", + "Condition": { + "StringLike": { + "iam:PermissionsBoundary": "arn:aws:iam::*:policy/acme-base-team-dev-boundary" + } + } + }, +``` + +#### Allow Write Access to Non-Foundation Roles + +Allow builders to further modify non-foundation IAM roles. + +``` + { + "Sid": "AllowRoleOther", + "Effect": "Allow", + "Action": [ + "iam:DeleteRole", + "iam:UpdateRole", + "iam:UpdateAssumeRolePolicy", + "iam:PutRolePermissionsBoundary", + "iam:DeleteRolePermissionsBoundary", + "iam:TagRole", + "iam:UntagRole" + ], + "NotResource": "arn:aws:iam::*:role/acme-base-*" + }, +``` + +#### Deny Deletion of Permissions Boundary Policies from IAM Roles + +Ensure that once a permissions boundary policy has been attached to a role, builders cannot delete it. Builders can still delete the role itself which will automatically remove the attached permissions boundary policy. + +``` + { + "Sid": "DenyDeletionPBs", + "Effect": "Deny", + "Action": "iam:DeleteRolePermissionsBoundary", + "Resource": "*" + }, +``` + +#### Deny Write Access to Billing Resources + +``` + { + "Sid": "DenyBillingWrite", + "Effect": "Deny", + "Action": [ + "aws-portal:ModifyAccount", + "aws-portal:ModifyBilling", + "aws-portal:ModifyPaymentMethods" + ], + "Resource": "*" + }, +``` + +#### Deny Write Access to AWS Platform Roles + +{{% notice note %}} +**Review Note:** Validate whether or not an explicit deny is required for the following resources. For example, based on testing via a role with administrative access, it appears that the `arn:aws:iam::*:role/stacksets*` resource is not protected by default. The CloudFormation feature to [Enable Trusted Access](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/stacksets-orgs-enable-trusted-access.html) creates and manages this role. +{{% /notice %}} + +``` + { + "Sid": "DenyFoundationIamRoleWrite", + "Effect": "Deny", + "Action": [ + "iam:CreateRole", + "iam:DeleteRole", + "iam:UpdateRole", + "iam:AttachRolePolicy", + "iam:DetachRolePolicy", + "iam:PutRolePolicy", + "iam:DeleteRolePolicy", + "iam:UpdateAssumeRolePolicy", + "iam:PutRolePermissionsBoundary", + "iam:DeleteRolePermissionsBoundary", + "iam:TagRole", + "iam:UntagRole" + ], + "Resource": [ + "arn:aws:iam::*:role/stacksets*", + "arn:aws:iam::*:role/AWS*", + "arn:aws:iam::*:role/aws*" + ] + }, +``` + +#### Deny Write Access to CloudFormation StackSet Stacks + +Ensure that foundation related CloudFormation stack instances that have been created via CloudFormation StackSets cannot not be modified. + +{{% notice note %}} +**Review Note:** Validate whether or not an explicit deny is required for the following resources. +{{% /notice %}} + +``` + { + "Sid": "DenyStackSetWrite", + "Effect": "Deny", + "Action": [ + "cloudformation:DeleteStack", + "cloudformation:UpdateStack" + ], + "Resource": "arn:aws:cloudformation::*:stack/StackSet-*" + }, +``` + +#### Deny Creation and Management of VPC Resources + +Since the private subnets of the centrally managed VPC are shared with team development AWS accounts in a read only manner and it's a best practice to delegate ownership and management of VPC resources to your central foundation team, typically, builders don't need to have write access to VPC resources. + +{{% notice info %}} +**`ec2:` namespace:** Note that both EC2 VM resources and VPC networking resources share the same IAM `ec2:` namespace. In their team development AWS accounts, builders are allowed to create EC2 VM related resources, but are not allowed to have write access to VPC resources. +{{% /notice %}} + +{{% notice note %}} +**Review Note:** An alternative approach to including this permission here is to move the following permission to a Service Control Policy (SCP) and attach it to the `development` OU so that none of these actions can be performed in any of the team development AWS accounts by any authorized user - including builder team members and Cloud Administrators. +{{% /notice %}} + +``` + { + "Sid": "DenyVPCWrite", + "Effect": "Deny", + "Action": [ + "ec2:CreateCustomerGateway", + "ec2:CreateDefaultSubnet", + "ec2:CreateDefaultVpc", + "ec2:CreateDhcpOptions", + "ec2:CreateEgressOnlyInternetGateway", + "ec2:CreateFlowLogs", + "ec2:CreateInternetGateway", + "ec2:CreateNatGateway", + "ec2:CreateNetworkAcl", + "ec2:CreateNetworkAclEntry", + "ec2:CreateRoute", + "ec2:CreateRouteTable", + "ec2:CreateSubnet", + "ec2:CreateVpc", + "ec2:CreateVpcEndpoint", + "ec2:CreateVpcEndpointConnectionNotification", + "ec2:CreateVpcEndpointServiceConfiguration", + "ec2:CreateVpnConnection", + "ec2:CreateVpnConnectionRoute", + "ec2:CreateVpnGateway", + "ec2:EnableVgwRoutePropagation", + "ec2:EnableVpcClassicLinkDnsSupport", + "ec2:MoveAddressToVpc", + "ec2:RejectVpcEndpointConnections", + "ec2:RestoreAddressToClassic", + "ec2:AcceptVpcPeeringConnection", + "ec2:AttachClassicLinkVpc", + "ec2:CreateVpcPeeringConnection", + "ec2:EnableVpcClassicLink", + "ec2:RejectVpcPeeringConnection", + "directconnect:*" + ], + "Resource": "*" + } +``` +### Permissions Boundary Walkthrough + +[`acme-base-team-dev-boundary.yml`](/code-samples/01-iam-policies/acme-base-team-dev-boundary.yml) + +Since the overall intent in this development environment scenario is to enable AWS services acting on behalf of the builders to have similar access permissions as the builders themselves, the permissions boundary policy has similar permissions as the IAM SAML policy for builder team members. + +The main difference is that write access to all IAM resources is disallowed in the sample permissions boundary policy. For example, since there was no requirement to enable AWS services to create roles and policies on behalf of builders, disallowing role creation inhibits builders from creating roles that could circumvent the policies. + +{{% notice note %}} +**Review Note:** If a decision is made to move write access deny permissions for VPC resources to an SCP, then the `DenyVPCWrite` permissions shown below would be removed from this permissions boundary. +{{% /notice %}} + +``` + { + "Sid": "AllowAllWithExceptions", + "Effect": "Allow", + "NotAction": [ + "iam:*", + "organizations:*", + "account:*" + ], + "Resource": "*" + }, + { + "Sid": "AllowIamReadOnly", + "Effect": "Allow", + "Action": [ + "iam:Get*", + "iam:List*" + ], + "Resource": "*" + }, + { + "Sid": "DenyWriteAccessStackSets", + "Effect": "Deny", + "Action": [ + "cloudformation:DeleteStack", + "cloudformation:UpdateStack" + ], + "Resource": "arn:aws:cloudformation::*:stack/StackSet-*" + }, + { + "Sid": "DenyVPCWrite", + "Effect": "Deny", + "Action": [ + ...same as in the IAM SAML policy shown above... + ], + "Resource": "*" + } +``` + +### Example Test Cases + +#### Builders Working Directly with AWS Services + +This set of test cases depends on the team development IAM SAML role's policies. + +As a builder, attempt to perform actions with a variety of AWS services. + +Only those explicitly disallowed actions listed earlier in this document should be inhibited. + +#### Builders Creating and Using IAM Service Roles and Policies for Their Workloads + +This set of test cases depends on the AWS IAM permissions boundary being deployed and referenced in the team development IAM SAML role's policies. + +##### Creating IAM Managed Policies + +Builders create IAM managed policies via the following tools: + +* AWS Management Console. +* AWS CLI or SDKs. +* AWS CloudFormation or other Infrastucture as Code (IaC) tools such as Terraform. + +##### Creating IAM Service Roles + +Builders create IAM service roles and policies via the following tools. Builders attempt to create IAM service roles with and without the permissions boundary. All attempts to create IAM service roles without the permissions boundary will fail. + +* AWS Management Console. +* AWS CLI or SDKs. +* AWS CloudFormation or other Infrastucture as Code (IaC) tools such as Terraform. + +Variations: +* Use include inline policies. +* Attach both AWS and customer managed IAM policies. + +##### Using IAM Service Roles + +Builders associate IAM service roles to AWS resources and then attempt to access allowed and disallowed actions on resources. + +* Deploy EC2 instance and associate an instance profile. +* Deploy a Lambda function. +* Deploy a Cloud9 IDE workspace (same as EC2 use case). +* Deploy a Redshift cluster to support data warehousing use cases. +* Deploy containers to Amazon ECS and EKS container orchestration services. + +##### Using the IAM Policy Simulator + +Builders testing IAM policies via the [IAM Policy Simulator](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_testing-policies.html) in the AWS Management Console. + +#### Disallowed Actions + +* Deleting permissions boundary policy from existing IAM service role. +* Modifying foundation and AWS IAM roles. + * Delete foundation and AWS IAM roles. + * Attaching and detaching managed policies. + * Adding and removing inline policies. +* Creating and deleting IAM SAML providers. +* Creating, updating, and deleting IAM users and groups. diff --git a/content/01-dev/03-reference/03-cloud-platform-system-users.md b/content/01-dev/03-reference/03-cloud-platform-system-users.md new file mode 100644 index 0000000..2fdb4f7 --- /dev/null +++ b/content/01-dev/03-reference/03-cloud-platform-system-users.md @@ -0,0 +1,74 @@ +--- +title: "Cloud Platform System Users" +disableToc: true +weight: 30 +--- + +The following users are created as part of setting up AWS accounts and establishing your initial foundation on AWS. After an initial set of human users are onboarded to the platform with the appropriate permissions, the following accounts will rarely be used. A best practice is to store the credentials for these accounts in your enterprise standard secrets or password management solution and grant and audit access to these credentials to a very limited set of foundation team members. + +{{% notice note %}} +**Review Note:** Provide a diagram of system users so that foundation team members can gain a better understanding of where these users are positioned in the overall environment. +{{% /notice %}} + +## AWS Account Root User + +It is strongly recommended that AWS account root users not be used for day-to-day administrative tasks. See [The AWS Account Root User](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_root-user.html) for more specific guidance. + +In your master AWS account, the only initial purpose of the AWS account root user is for you to perform initial configuration of several AWS account settings and to create an administrative bootstrap user in the IAM service. + +Your Cloud Administrators will only need to use the AWS account root user for carrying out infrequent tasks described in [AWS Tasks That Require AWS Account Root User Credentials](https://docs.aws.amazon.com/general/latest/gr/aws_tasks-that-require-root.html). + +**Creation:** Automatically created whenever an AWS account is created. + +**Identity Store:** Not applicable. Built into each AWS account. + +**AWS Accounts:** Each AWS account. + +**Username:** Email address associated with the AWS account. + +**Permissions:** Full administrative access. Also see [AWS Tasks That Require AWS Account Root User Credentials](https://docs.aws.amazon.com/general/latest/gr/aws_tasks-that-require-root.html). + +## Administrative Bootstrap IAM User + +Since it's best practice to avoid using the AWS account root user unless absolutely necessary and setting up a landing zone via AWS Control Tower cannot be done with the root user, it is recommended that a bootstrap administrative user be defined in the Master AWS account to be used to carry out the initial landing zone set up. + +Once the human Cloud Administrators are granted access to the master account via their own individual user accounts and are granted at least equivalent permissions to this user, this user will no longer be used. + +**Creation:** Manually created by your Cloud Administrators as part of setting up your initial master AWS account. + +**Identity Store:** AWS IAM Users + +**AWS Accounts:** Master AWS account. + +**Username:** "Administrator" (recommended) + +**Permissions:** [AdministratorAccess](https://console.aws.amazon.com/iam/home#/policies/arn%3Aaws%3Aiam%3A%3Aaws%3Apolicy%2FAdministratorAccess) + +## AWS Control Tower Administrator + +Once human Cloud Administtrators are granted access to the master account via their own individual user accounts and are granted at least equivalent permissions to this user, this user will no longer be used. + +**Creation:** Automatically created when you create your landing zone via AWS Control Tower. + +**Identity Store:** AWS SSO + +**AWS Accounts:** Each AWS master and member account under management of AWS Control Tower. + +**Username:** Email address associated with the AWS account's root user. + +**Permissions:** In the master AWS account: [AdministratorAccess](https://console.aws.amazon.com/iam/home#/policies/arn%3Aaws%3Aiam%3A%3Aaws%3Apolicy%2FAdministratorAccess) + +In each member AWS account: [AWSOrganizationsFullAccess](https://console.aws.amazon.com/iam/home?#/policies/arn%3Aaws%3Aiam%3A%3Aaws%3Apolicy%2FAWSOrganizationsFullAccess) + +## AWS Account Adminstrator +Once the human Cloud Administrators are granted access to the AWS accounts via their own individual user accounts and are granted at least equivalent permissions to this user, this user will no longer be used. + +**Creation:** Automatically created when you create a new member AWS account via AWS Control Tower's Account Factory. + +**Identity Store:** AWS SSO + +**AWS Accounts:** Each member AWS account created via AWS Control Tower's Account Factory. + +**Username:** Email address associated with the AWS account. + +**Permissions:** [AdministratorAccess](https://console.aws.amazon.com/iam/home#/policies/arn%3Aaws%3Aiam%3A%3Aaws%3Apolicy%2FAdministratorAccess) \ No newline at end of file diff --git a/content/01-dev/03-reference/04-using-aws-services/01-cloud9.md b/content/01-dev/03-reference/04-using-aws-services/01-cloud9.md new file mode 100644 index 0000000..0eec282 --- /dev/null +++ b/content/01-dev/03-reference/04-using-aws-services/01-cloud9.md @@ -0,0 +1,53 @@ +--- +title: "Using AWS Cloud9 in Team Development Environments" +menuTitle: "AWS Cloud9" +disableToc: true +weight: 10 +--- + +{{% notice note %}} +**Review Note:** Since we recently changed the guidance to disallow use of public subnets in team development AWS accounts and AWS Cloud9 does not currently support deployment of Cloud9 environments in private subnets, we need to remove this section from the guide. +{{% /notice %}} + +This document highlights special considerations when using the [AWS Cloud9](https://aws.amazon.com/cloud9/) IDE in your team development AWS accounts. + +## Why Use AWS Cloud9? +If you have challenges getting the AWS CLI and other tools installed on your corporate desktop, you may find it useful to use AWS Cloud9, a web-based IDE that enables you to deploy a development environment in your AWS account. + +Each Cloud9 environment is an Amazon EC2 Linux instance that includes a browser-based IDE. You deploy a Cloud9 environment in one of your public subnets and access it via the Cloud9 service. + +{{% notice info %}} +**Cloud9 Environments Require Public Subnets:** Currently, AWS Cloud9 development environments must be deployed to public subnets. If your organization chooses to not provide public subnets in the shared development network, then Cloud9 will not be applicable until Cloud9 environments are supported in private subnets. +{{% /notice %}} + +## Creating a Cloud9 Environment + +See [AWS Cloud9](https://docs.aws.amazon.com/cloud9/latest/user-guide/welcome.html) for set up details. + +Ensure that you select one of the public subnets given that the Cloud9 service currently requires your environment to be deployed in a public subnet. Since Cloud9 doesn't list the name tag of subnets during the creation process, you may need to access the **`VPC`** service of the AWS Management Console to list the subnets and their names. + +## Configuring Your Environment + +### Use an EC2 Instance Profile + +Once you've created your Cloud9 environment, you can associate an instance profile with your Cloud9 EC2 instance so that your work in your IDE can have similar access permissions as your regular AWS session. See [Create and Use an Instance Profile](https://docs.aws.amazon.com/cloud9/latest/user-guide/credentials.html#credentials-temporary). + +For example, you could associate the managed IAM policy `AdministratorAccess` with your new EC2 service role for Cloud9. Since in your team development AWS account you're required to attach the permissions boundary whenever you create a role, your overall access will be constrained by the permissions boundary policy. + +After you attach an EC2 instance profile and IAM role to your Cloud9 instance, you can verify which role is being used by issuing the following command from a terminal session in your Cloud9 environment: + +``` +$ aws sts get-caller-identity +``` + +### Update Your Bash Prompt + +If you find that your bash terminal prompt is too long, you can set it to just the Linux user, IP address, and current directory. Either edit your `~/.bashrc` file and replace the `PS1` setting or export the setting as follows: + +``` +export PS1="[\u@\h \W]\$ " +``` + +### Install Latest AWS CLI + +Although a version of the AWS CLI is preinstalled in your Cloud9 environment, you should consider installing version 2. See [Install the AWS CLI](https://docs.aws.amazon.com/cli/latest/userguide/install-cliv2.html). \ No newline at end of file diff --git a/content/01-dev/03-reference/04-using-aws-services/02-eks.md b/content/01-dev/03-reference/04-using-aws-services/02-eks.md new file mode 100644 index 0000000..d9ce954 --- /dev/null +++ b/content/01-dev/03-reference/04-using-aws-services/02-eks.md @@ -0,0 +1,64 @@ +--- +title: "Using Amazon EKS in Team Development Environments" +menuTitle: "Amazon EKS" +disableToc: true +weight: 20 +--- + +This document highlights special considerations when using [Amazon Elastic Kubernetes Service (EKS)](https://aws.amazon.com/eks/) in your team development AWS accounts. + +{{% notice note %}} +**Review Note:** This is a draft document. +{{% /notice %}} + +## Using `eksctl` CLI to Create a Cluster + +* [Deploy and configure Cloud9 environment](3-2-getting-started-guide-dev-team-members.md#using-aws-cloud9-web-ide) +* Install `eksctl` and `kubectl` per [Getting Started with eksctl](https://docs.aws.amazon.com/eks/latest/userguide/getting-started-eksctl.html). + * Ensure that you have at least `eksctl` version `0.14.0` so that permissions boundary support is available. + * If the latest version of `eksctl` does not get installed, you might need to replace the `latest_release` portion of the download path with the explicit version of interest. For example, `0.14.0`. +* Review the set of public and private subnets in the **`VPC`** service within the AWS Management Console. +* Set up a cluster config file for `eksctl`. + +`nikki-cluster.yml` + +``` +apiVersion: eksctl.io/v1alpha5 +kind: ClusterConfig + +metadata: + name: nikki-dev + region: us-east-2 + +iam: + serviceRolePermissionsBoundary: arn:aws:iam::123456789012:policy/acme-base-dev-team-boundary + fargatePodExecutionRolePermissionsBoundary: arn:aws:iam::123456789012:policy/acme-base-dev-team-boundary + +vpc: + subnets: + public: + us-east-2a: { id: subnet-... } + us-east-2b: { id: subnet-... } + us-east-2c: { id: subnet-... } + private: + us-east-2a: { id: subnet-... } + us-east-2b: { id: subnet-... } + us-east-2c: { id: subnet-... } + +nodeGroups: + - name: ng-1 + instanceType: m5.large + desiredCapacity: 1 + iam: + instanceRolePermissionsBoundary: arn:aws:iam::123456789012:policy/acme-base-dev-team-boundary +``` + +* Execute `create cluster`: + +``` +./eksctl create cluster --config-file nikki-cluster.yml +``` + +``` +$ aws eks --region us-east-2 describe-cluster --name nikki-dev --query cluster.status +``` diff --git a/content/01-dev/03-reference/04-using-aws-services/03-redshift.md b/content/01-dev/03-reference/04-using-aws-services/03-redshift.md new file mode 100644 index 0000000..594c4e9 --- /dev/null +++ b/content/01-dev/03-reference/04-using-aws-services/03-redshift.md @@ -0,0 +1,57 @@ +--- +title: "Using Amazon Redshift in Team Development Environments" +menuTitle: "Amazon Redshift" +disableToc: true +weight: 30 +--- + +This document highlights special considerations when using [Amazon Redshift](https://aws.amazon.com/redshift/) in your team development AWS accounts. + +{{% notice note %}} +**Review Note:** This is a draft document. +{{% /notice %}} + +## Resources + +If you plan to use the [Redshift Immersion Labs](https://redshift-immersion.workshop.aws/en), section 1. Creating a Cluster, won't be completely aligned with your permissions available in your development AWS account. + +For example, since the AWS CloudFormation template provided in the labs attempts to create a VPC and you don't have those permissions in your development AWS account, the template will not work in your environment. Instead, you can either follow the directions in the lab to use the AWS Management Console to create the dependencies and the cluster or, if you're more adventurous, you could modify the CloudFormation template to exclude creation of the VPC and make other adjustments. + +## Create a VPC Security Group + +1. Navigate to the **`VPC`** service. +2. Select **`Subnets`**. +3. Select **`Create security group`**. +4. Assign a name to the security group in the **`Name`** column. +5. Select **`Inbound Rules`**. +6. Select **`Edit rules`**. +7. Add a rule with TCP protocol, 5439 Port Range and Source set to anywhere. + +## Create Cluster Subnet Group + +1. Navigate to the **`Redshift`** service. +2. Select **`Config`** and **`Subnet groups`**. +3. Create a new subnet group using the private subnets of the shared development VPC. + +## Create IAM Service Role to Access S3 + +1. Navigate to the **`IAM`** service. +2. Select **`Roles`**. +3. Select **`Create role`**. +4. Select **`Redshift`**. +5. Select the use case of **`Redshift - Customizable`**. +6. Select **`Next: Permissions`**. +7. Attach the **`AmazonS3ReadOnlyAccess`** and **`AWSGlueConsoleFullAccess`** policies to the role. +8. Expand **`Set permissions boundary`**. +9. Select **`Use a permissions boundary...`**. +10. Select your standard development team permissions boundary policy. +11. Select **`Next: Tags`** and **`Next: Review`**. +12. Provide a name and create the role. + +## Create Cluster + +1. Select **`Clusters`** and **`Create cluster`**. +2. Under **`Cluster permissions`**, select the IAM service role that you just created. +3. The shared development VPC should be automatically selected. +4. Select the VPC security group that you just created. +5. Ensure that the cluster subnet group you just created is selected. \ No newline at end of file diff --git a/content/01-dev/03-reference/04-using-aws-services/_index.md b/content/01-dev/03-reference/04-using-aws-services/_index.md new file mode 100644 index 0000000..439ef5c --- /dev/null +++ b/content/01-dev/03-reference/04-using-aws-services/_index.md @@ -0,0 +1,27 @@ +--- +title: "Using AWS Services in Team Development Environments" +menuTitle: "Using AWS Services" +disableToc: true +weight: 40 +--- +The following documents address how builders can access a variety of AWS services in a self-service manner in their team development AWS accounts. + +## Special Considerations + +Why do buider teams need special instructions to use AWS services in their team development AWS accounts? + +**Use of Shared Private Subnets** + +Since you may come across examples and documentation that includes creation of VPC resources and you don't have permissions to create VPC resources in team development AWS accounts, you will need to understand how to reuse the existing shared private subnets to which your teams have access in your team development AWS accounts. + +**Creation of AWS Service IAM Roles** + +Since the use of many AWS services entails the creation of AWS service specific IAM roles and your ability to create IAM roles requires that you associate the development IAM boundary policy to all roles, the process for configuring IAM service roles needs to be addressed. + +Refer to [Controlling Development Team Access]({{< relref "02-controlling-builder-team-access" >}}) for more background on permissions provided to builder teams in development AWS accounts and the role of AWS IAM boundary policies. + +## Using AWS Services + +The following documents provide tips on using AWS services given the constraints of team development AWS accounts. + +{{% children showhidden="false" %}} diff --git a/content/01-dev/03-reference/_index.md b/content/01-dev/03-reference/_index.md new file mode 100644 index 0000000..feec671 --- /dev/null +++ b/content/01-dev/03-reference/_index.md @@ -0,0 +1,7 @@ +--- +title: "Reference" +disableToc: true +weight: 30 +--- + +{{% children showhidden="false" %}} \ No newline at end of file diff --git a/content/01-dev/_index.md b/content/01-dev/_index.md new file mode 100644 index 0000000..27748f4 --- /dev/null +++ b/content/01-dev/_index.md @@ -0,0 +1,20 @@ +--- +title: 'Establish Foundation for Development Environments' +menuTitle: '1. Foundation for Development' +disableToc: true +weight: 10 +--- + +After you've addressed a few up front tasks, in about a day, this guide will help you establish an initial secure foundation in support of a set of development environments based on the following architecture. + +[![Initial Development Environment](/images/01-dev/dev-initial.png)](/images/01-dev/dev-initial.png) + +## Value of Development Environments + +This section of the guide helps your organization establish an initial foundation in support of a set of development environments. If your organization mainly focuses on integrating commercial off the shelf (COTS) software products and Software as a Service (SaaS) offerings, you might not have "development teams" in the traditional sense. However, you will still benefit from establishing development environments in AWS. + +Setting up development environments in AWS helps your builders experiment with and perform early testing of migration and application and data integration solutions in flexible and safe environments that are isolated from your more formally controlled pre-production test and production environments. + +Compared to the cost and complexity of setting up and maintaining development environments in physical data centers, carving out virtual development environments in AWS is relatively low-cost and straightforward. + +As your organization's use of the cloud matures, your builders are encouraged to begin using Infrastructure as Code (IaC) to gain the benefits of greater automation. Adoption of IaC practices means that at least some of your traditional infrastructure teams will evolve to become builder teams in their own right. diff --git a/content/02-dev-fast-follow/01-cost-mgmt/01-invoice-billing.md b/content/02-dev-fast-follow/01-cost-mgmt/01-invoice-billing.md new file mode 100644 index 0000000..38f18f6 --- /dev/null +++ b/content/02-dev-fast-follow/01-cost-mgmt/01-invoice-billing.md @@ -0,0 +1,7 @@ +--- +title: "Invoice Billing" +disableToc: true +weight: 10 +--- + +Transition from credit card to invoice based billing and payment for AWS services. diff --git a/content/02-dev-fast-follow/01-cost-mgmt/_index.md b/content/02-dev-fast-follow/01-cost-mgmt/_index.md new file mode 100644 index 0000000..39c862c --- /dev/null +++ b/content/02-dev-fast-follow/01-cost-mgmt/_index.md @@ -0,0 +1,7 @@ +--- +title: 'Cost Management' +disableToc: true +weight: 10 +--- + +{{% children showhidden="false" %}} \ No newline at end of file diff --git a/content/02-dev-fast-follow/02-security-compliance/01-enhanced-access-controls.md b/content/02-dev-fast-follow/02-security-compliance/01-enhanced-access-controls.md new file mode 100644 index 0000000..6eb2f5f --- /dev/null +++ b/content/02-dev-fast-follow/02-security-compliance/01-enhanced-access-controls.md @@ -0,0 +1,11 @@ +--- +title: "Enhanced AWS Platform Access Controls" +disableToc: true +weight: 10 +--- + +This section addresses requirements, options, and resources to enable your Security and Cloud Administrators to achieve further degrees of least privilege access to improve the security of the overall environments and stability of the foundation. + +* Constrain Set of AWS Services in Builder AWS Accounts +* Constrain Available AWS Regions + * See Dave's example. diff --git a/content/02-dev-fast-follow/02-security-compliance/02-enhanced-security-monitoring-and-compliance.md b/content/02-dev-fast-follow/02-security-compliance/02-enhanced-security-monitoring-and-compliance.md new file mode 100644 index 0000000..b48dcb4 --- /dev/null +++ b/content/02-dev-fast-follow/02-security-compliance/02-enhanced-security-monitoring-and-compliance.md @@ -0,0 +1,20 @@ +--- +title: "Enhanced Security Monitoring and Compliance" +disableToc: true +weight: 20 +--- + +This section addresses requirements, options, and resources to enable your Security and Cloud Administrators to extend the degree of preventative, detective, and corrective controls. + +Support for custom AWS account baselines can be the means to roll out such controls, but this section focuses on what controls are of most interest. + +## Examples + +* An application requires a named IAM user to access the AWS platform with an API key and secret, configure additional alarms and logs when these credentials are used. +* Expunge default VPCs from all AWS accounts and AWS regions in those accounts. +* Restrict access to AWS services to only the enterprise’s IP addresses. +* Restrict access to workloads deployed to development AWS accounts to only the enterprise's public IP addresses. + +## AWS Control Tower Guardrails + +Review the [strongly recommended and elective guardrails](https://docs.aws.amazon.com/controltower/latest/userguide/guardrails-reference.html) to determine if they provide value in your environment. diff --git a/content/02-dev-fast-follow/02-security-compliance/03-federated-access-to-aws.md b/content/02-dev-fast-follow/02-security-compliance/03-federated-access-to-aws.md new file mode 100644 index 0000000..1306bf5 --- /dev/null +++ b/content/02-dev-fast-follow/02-security-compliance/03-federated-access-to-aws.md @@ -0,0 +1,37 @@ +--- +title: "Federated Access to AWS Platform" +disableToc: true +weight: 30 +--- + +This section addresses options and resources to enable your internal users federated access to your AWS environment by using an identity proivider external to AWS. + +## Out of Scope: Application Level Federated Access + +The section does not address federated access in support or your applications hosted on AWS. Although your enterprise identity and access management solution may also be used in support of application level federated access, different considerations and mechanisms come into play in this simialr, but different use case. + +## Motivation and Common Practices +It is common practice for organizations to reuse their existing enterpise identity and access management solution to form the basis of controlling access to the AWS platform. Doing so, reuses existing security controls, lifecycle management practices, and audit processes. + +The source of truth for users and group-based entitlement definitions is often based in Active Directory (AD) and commonly exposed via SAML-based Identity Providers (IdPs) for integration with publicly accessible services including SaaS services and cloud platforms such as AWS. + +AD security groups are often used to represent entitlements that are mapped to permissions in a given application, product, or cloud platform. In an enterprise's access management solution such entitlements are associated with roles that are associated with people and teams. As people and teams change, their associated roles are reviewed and membership is either manually or automatically changed so that access to entitlements is automatically updated. + +--- +**Review Notes: For now add ideas and references to existing publicly available resources** + +Let's build up ideas and refine as we go. + +--- + +## Requirements + +*...use the CAF perspectives to represent the typical set of customer requirements...* + +## Solution Options and Resources + +*...defer to existing documentation including decision trees, blog posts, formal AWS docs, etc. as much as feasible...* + +### Migration From Use of Locally Managed Groups and Users in AWS SSO + +*...if the customer started with the use of locally managed users and groups in AWS SSO, highlight considerations when miograting to the use of external identity providers either via AWS SSO or traditional federated access to AWS outside of AWS SSO...* \ No newline at end of file diff --git a/content/02-dev-fast-follow/02-security-compliance/04-secure-os-access.md b/content/02-dev-fast-follow/02-security-compliance/04-secure-os-access.md new file mode 100644 index 0000000..131210c --- /dev/null +++ b/content/02-dev-fast-follow/02-security-compliance/04-secure-os-access.md @@ -0,0 +1,13 @@ +--- +title: "Secure OS Access" +disableToc: true +weight: 40 +--- + +## Secure Terminal Access for Linux and Windows + +See [AWS Systems Manager Session Manager](https://docs.aws.amazon.com/systems-manager/latest/userguide/session-manager.html) to learn how to achieve secure terminal access to your Linux and Windows OS instances without the need to establish and maintain Internet-accesible bastion hosts. In the Windows context, you're provided with a Powershell terminal. + +## Secure Remote Desktop (RDP) Access for Windows + +Session Manager can also be used to provide RDP access to your Windows instances. See [Forwarding Traffic Between a Local and Remote Port](https://aws.amazon.com/about-aws/whats-new/2019/08/now-forward-traffic-between-a-local-and-remote-port-using-session-manager/) for an overview of this solution and the [re:Invent 2019 lab](https://reinvent2019.aws-management.tools/mgt406/en/optional/step7.html) for a detailed example. \ No newline at end of file diff --git a/content/02-dev-fast-follow/02-security-compliance/05-siem-integration.md b/content/02-dev-fast-follow/02-security-compliance/05-siem-integration.md new file mode 100644 index 0000000..196f63b --- /dev/null +++ b/content/02-dev-fast-follow/02-security-compliance/05-siem-integration.md @@ -0,0 +1,23 @@ +--- +title: "SIEM Integration" +disableToc: true +weight: 50 +--- + +This section addresses options and resources to enable your Security team to integrate centrally captured AWS platform log and event information with new or existing enterprise Security Information and Event Management (SIEM) services. + +## Requirements + +Even in this early development stage, your Security and Compliance requirements may dictate that cloud platform access and cloud resource configuration be monitored via your existing enterprise standard Security Information and Event Management (SIEM) solution. + +*...In the context of the overall set of Security and Compliance requirements, highlight the typical role and value of integrating AWS CloudTrail and other event sources with SIEM services...* + +*...incorporate AWS SecurityHub...* + +* AWS API usage (e.g. AWS CloudTrail logs) +* AWS Resource Configuration changes (e.g. AWS Config) +* Network traffic monitoring (e.g. partly based on capture of VPC Flow Logs) + +## Solution Options and Resources + +... diff --git a/content/02-dev-fast-follow/02-security-compliance/_index.md b/content/02-dev-fast-follow/02-security-compliance/_index.md new file mode 100644 index 0000000..7108135 --- /dev/null +++ b/content/02-dev-fast-follow/02-security-compliance/_index.md @@ -0,0 +1,7 @@ +--- +title: 'Security and Compliance' +disableToc: true +weight: 20 +--- + +{{% children showhidden="false" %}} \ No newline at end of file diff --git a/content/02-dev-fast-follow/03-network-integration/01-on-premises-network-integration.md b/content/02-dev-fast-follow/03-network-integration/01-on-premises-network-integration.md new file mode 100644 index 0000000..ab7e10a --- /dev/null +++ b/content/02-dev-fast-follow/03-network-integration/01-on-premises-network-integration.md @@ -0,0 +1,43 @@ +--- +title: "On-Premises Network Integration" +disableToc: true +weight: 10 +--- + +This section addresses options and resources to enable network connectivity between your on-premises networks and AWS environment. + +{{% notice note %}} +**Review Note: For now add ideas and references to existing publicly available resources:** Let's build up ideas and refine as we go. +{{% /notice %}} + +## Requirements + +In many cases, organizations require that applications and workloads hosted in AWS can connect to workloads and shared services hosted on-premises and vice versa. + +* Cloud client access to defined non-prod application and data services. +* On-premises access to newly deployed cloud hosted development, pre-production test, prod workloads and services. +* Cloud client access to on-premises source code management access. +* Hybrid DNS resolution: + * On-premises clients resolve custom FQDNs for cloud hosted services. + * Cloud clients resolve customer FQDNs on on-premises services. + +* Security + * Protect against external attack vectors from the Internet. + * Protect against internal data loss/exfiltration to the Internet. + * Ensure that only appropriate cloud networks and cloud hosted services can have connectivity to appropriate internal networks and services and vice vesa. + +* Non-overlapping allocation of IP address ranges for use by cloud environments. + +## Solution Options and Resources + +Typically, as an initial means to quickly establish this connectivity, one pr more VPN connections are established using existing on-premises network appliances and the AWS Site-to-Site VPN capability in conjunction with AWS Transit Gateway. AWS Transit Gateway centralizes and simplifies sharing on-premises to AWS network integration across multiple VPCs. + +Introduction of a new Network AWS account is a common approach in which shared network resources such as the AWS Transit Gateway configuration can be isolated and managed separately from team oriented AWS accounts and the other shared accounts. + +Longer term, as your on-premises to AWS network connectivity needs expand, you will typically transition from using site-to-site VPN connections to AWS Direct Connect. When using AWS Transit Gateway as the termination point for VPN and AWS Direct Connect connections, a migration from using VPN to AWS Direct Connect has no impact on the VPCs behind the Transit Gateway. + +If you didn’t use a non-overlapping range from the start, you will need to either replace your initial set of development VPCs with VPCs that use non-overlapping IP addresses or implement Network Address Translation (NAT). + +*...defer to existing documentation including decision trees, blog posts, formal AWS docs, etc. as much as feasible...* + +*...if the customer started with the use of temporary VPCs in support of their first few development environments, highlight considerations when migrating to the use of a set of new networks to support their development,pre-production test, and production environments...* \ No newline at end of file diff --git a/content/02-dev-fast-follow/03-network-integration/02-outbound-internet-filtering.md b/content/02-dev-fast-follow/03-network-integration/02-outbound-internet-filtering.md new file mode 100644 index 0000000..0730312 --- /dev/null +++ b/content/02-dev-fast-follow/03-network-integration/02-outbound-internet-filtering.md @@ -0,0 +1,41 @@ +--- +title: "Outbound Internet Content Filtering for Development Environments" +menuTitle: "Outbound Internet Filtering" +disableToc: true +weight: 20 +--- + +This section addresses options and resources to enable you to further secure Internet integration in support of your initial development environments. + +{{% notice note %}} +**Review Note: For now add ideas and references to existing publicly available resources:** Let's build up ideas and refine as we go. +{{% /notice %}} + +## Requirements + +In the initial stage of your foundation, you may have enabled development team AWS accounts outbound access to the Internet via use of private subnets, an AWS Internet Gateway, and AWS NAT Gateways. Organizations that desire to filter outbound traffic to the Internet typically route suhc traffic traffic through centrally controlled proxies and security services. + +Since your corporate intellectual property in the form of private source code will likely be present in your team development environments along with early forms of proprietary applications and services, your organization might not want to allow for direct access to the Internet from the development environments. + +Additionally, download of software packages from the Internet should be filtered to help ensure that malicious code is not introduced into your development environments. + +## Solution Options and Resources + +### Tactical Routing of Outbound Internet Traffic Through Existing On-Premises Security Services +Under these circumstances, it is often most expedient to reuse your existing on-premises Internet security filtering capabilities to minimize the risk of IP and other information being leaked from your development environments to the Internet. For example, as a tactical step, all egress traffic destined for the Internet from the cloud hosted development environments can be routed back on-premises over a site-to-site VPN connection and through existing network and security layers before being sent to the Internet. + +The primary downsides of this tactical approach are: +* Increased in latency. +* Increased dependency on on-premises infrastructure. + +### Longer Term Cloud Hosted Ingress and Egress Security Services + +See [Nick Matthews' re:Invent 2019 talk](https://youtu.be/9Nikqn_02Oc?t=2304) on the role that AWS Transit Gateway can play in this regard. + +### Impact to Development VPC Design + +From a builder team's perspective, nothing should need to change other than the fact that their outbound requests to Internet service may fail when the security filtering services detect an issue. + +Behind the scenes, your Network team would have modified routing entries so that traffic from the development private subnets and destined for the Internet would be routed back on-premises. + +Both the NAT Gateway(s) formerly provisioned to the development public subnets and the public subnets themselves could likely be decommissioned. \ No newline at end of file diff --git a/content/02-dev-fast-follow/03-network-integration/_index.md b/content/02-dev-fast-follow/03-network-integration/_index.md new file mode 100644 index 0000000..03c9aa1 --- /dev/null +++ b/content/02-dev-fast-follow/03-network-integration/_index.md @@ -0,0 +1,7 @@ +--- +title: 'Network Integration' +disableToc: true +weight: 30 +--- + +{{% children showhidden="false" %}} \ No newline at end of file diff --git a/content/02-dev-fast-follow/04-foundation-mgmt/01-infrastructure-as-code.md b/content/02-dev-fast-follow/04-foundation-mgmt/01-infrastructure-as-code.md new file mode 100644 index 0000000..4877f6a --- /dev/null +++ b/content/02-dev-fast-follow/04-foundation-mgmt/01-infrastructure-as-code.md @@ -0,0 +1,7 @@ +--- +title: "Infrastructure as Code (IaC)" +disableToc: true +weight: 10 +--- + +Begin longer term learning paths for Infrastructure as Code (Iac) techniques. diff --git a/content/02-dev-fast-follow/04-foundation-mgmt/02-custom-account-baselines.md b/content/02-dev-fast-follow/04-foundation-mgmt/02-custom-account-baselines.md new file mode 100644 index 0000000..ba7c366 --- /dev/null +++ b/content/02-dev-fast-follow/04-foundation-mgmt/02-custom-account-baselines.md @@ -0,0 +1,45 @@ +--- +title: "Custom Baseline Management" +disableToc: true +weight: 20 +--- + +This section addresses options and resources to enable your foundation team to define and efficiently roll out new and updated cloud resources or "baselines" across your AWS accounts to further secure the overall environment and deliver useful common capabilities to your internal teams. + +## Content to be Rolled Out Across AWS Accounts Covered Separately + +The actual security and compliance controls and typical common foundation resources that would be handled by the baseline mechanism are covered in other sections. For example: +* [Enhanced Security Monitoring and Compliance]({{< relref "02-enhanced-security-monitoring-and-compliance.md" >}}) +* [Enhanced Access Controls]({{< relref "01-enhanced-access-controls.md" >}}) + +## Requirements + +### Automation and Infrastructure as Code (IaC) + +As the degree of customization and extent of your foundation resources expands over time, you'll benefit for having an automated means to roll out and manage such resources. Additionally, you'll benefit from using Infrastructure as Code (IaC) and other common practices to treat such resources as code that progresses through a modern development and testing workflow. + +### Ability to Target AWS Organization Units (OUs) and Independent AWS Accounts + +... + +### Ability to Test and Progressively Roll Out New and Updated Baselines + +... + +## Solution Options and Resources + +*...position AWS Control Tower's guardrails feature in this context...* + +### Customizations for AWS Control Tower + +See [AWS Solutions Customizations for AWS Control Tower](https://aws.amazon.com/solutions/customizations-for-aws-control-tower/) + +### AWS Deployment Framework + +[AWS Deployment Framework](https://github.com/awslabs/aws-deployment-framework/) + +### AWS CloudFormation StackSets + +[AWS CloudFormation StackSets with AWS Organizations](https://aws.amazon.com/blogs/aws/new-use-aws-cloudformation-stacksets-for-multiple-accounts-in-an-aws-organization/) introduced the ability to automatically apply stacksets as member accounts join and leave OUs. + +[AWS Control Tower Lifecycle Event Notifications](https://aws.amazon.com/about-aws/whats-new/2020/01/aws-control-tower-introduces-lifecycle-event-notifications/) can help trigger automation to manage the lifecyle of baselines. \ No newline at end of file diff --git a/content/02-dev-fast-follow/04-foundation-mgmt/03-move-other-aws-accounts.md b/content/02-dev-fast-follow/04-foundation-mgmt/03-move-other-aws-accounts.md new file mode 100644 index 0000000..effb2d9 --- /dev/null +++ b/content/02-dev-fast-follow/04-foundation-mgmt/03-move-other-aws-accounts.md @@ -0,0 +1,7 @@ +--- +title: "Move Other AWS Accounts" +disableToc: true +weight: 30 +--- + +...address the value and process of moving other AWS accounts into your new master AWS account and organization at leasy for the purpose of centralized billing and cost management... \ No newline at end of file diff --git a/content/02-dev-fast-follow/04-foundation-mgmt/_index.md b/content/02-dev-fast-follow/04-foundation-mgmt/_index.md new file mode 100644 index 0000000..5e947c5 --- /dev/null +++ b/content/02-dev-fast-follow/04-foundation-mgmt/_index.md @@ -0,0 +1,7 @@ +--- +title: 'Foundation Management' +disableToc: true +weight: 40 +--- + +{{% children showhidden="false" %}} \ No newline at end of file diff --git a/content/02-dev-fast-follow/05-windows-workloads/_index.md b/content/02-dev-fast-follow/05-windows-workloads/_index.md new file mode 100644 index 0000000..284861d --- /dev/null +++ b/content/02-dev-fast-follow/05-windows-workloads/_index.md @@ -0,0 +1,12 @@ +--- +title: 'Windows Workloads on Amazon EC2' +menuTitle: 'Windows Workloads' +disableToc: true +weight: 50 +--- + +{{% notice note %}} +**Review Note:** Given that many customers have Windows workloads that they need to run on AWS, we need to highlight the more immediate foundation capabilities related to using Windows in case those workloads are part of the initial set of workloads to be deployed into production. For example: AD integration and secure RDP access via either traditional bastion hosts or AWS Systems Manager Session Manager. +{{% /notice %}} + +{{% children showhidden="false" %}} diff --git a/content/02-dev-fast-follow/06-linux-workloads/_index.md b/content/02-dev-fast-follow/06-linux-workloads/_index.md new file mode 100644 index 0000000..99b0bdc --- /dev/null +++ b/content/02-dev-fast-follow/06-linux-workloads/_index.md @@ -0,0 +1,12 @@ +--- +title: 'Linux Workloads on Amazon EC2' +menuTitle: 'Linux Workloads' +disableToc: true +weight: 50 +--- + +{{% notice note %}} +**Review Note:** Address the common up front Linux workloads capabilities to help support initial development. For example, use of Amazon Linux 2, secure remote terminal access via either traditional bastion hosts or AWS Systems Manager Session Manager. +{{% /notice %}} + +{{% children showhidden="false" %}} diff --git a/content/02-dev-fast-follow/_index.md b/content/02-dev-fast-follow/_index.md new file mode 100644 index 0000000..63f95ee --- /dev/null +++ b/content/02-dev-fast-follow/_index.md @@ -0,0 +1,15 @@ +--- +title: 'Development Environment Fast Follow Capabilities' +menuTitle: '2. Development Fast Follows' +disableToc: true +weight: 20 +--- +{{% notice note %}} +**Review Note:** These fast follow capabilities are only sketched out topically at this stage. We expect to begin addressing them after the [Introduction]({{< relref "00-intro" >}}) and [Establish Development Environments]({{< relref "01-dev" >}}) sections are completed from a draft perspective. If you have comments and suggestions about this guide, see [Contributing]({{< relref "03-contributing" >}}). +{{% /notice %}} + +Depending on your organizations needs, additional capabilities may be required either as part of your initial build out of development environments or shortly thereafter. The following sections address the most common development "fast follow" capabilities and provide references to current best practices to establish these capabilities. + +[![Development Fast Follow Capabilities](/images/02-dev-fast-follow/dev-fast-follow.png)](/images/02-dev-fast-follow/dev-fast-follow.png) + +{{% children showhidden="false" %}} \ No newline at end of file diff --git a/content/03-preprod-prod/02-review-preprod-prod-solution.md b/content/03-preprod-prod/02-review-preprod-prod-solution.md new file mode 100644 index 0000000..418b6eb --- /dev/null +++ b/content/03-preprod-prod/02-review-preprod-prod-solution.md @@ -0,0 +1,33 @@ +--- +title: 'Review Pre-Production Test and Production Environments Solution' +menuTitle: 'Review Solution' +disableToc: true +weight: 20 +--- + +Beyond supporting initial development and early testing within the development environments, your organization will soon need to support formal testing and eventually production hosting of your new applications and data services. The following diagram represents typical extensions to your cloud foundation and a new set of AWS accounts to support formal testing and production hosting environments. + +[![Initial Test and Production Environments in Single AWS Region](/images/03-preprod-prod/preprod-prod-single-region.png)](/images/03-preprod-prod/preprod-prod-single-region.png) + +Key aspects of a solution that supports a typical transition toward support for several projects and their workloads progressing toward formal pre-production testing and production include: + +## Separate AWS Accounts for Hosting Pre-Production Test and Production Workloads + +AWS best practices recommend isolating pre-production test and production workloads, data, and supporting cloud resources from each other and from development environments through the use of distinct AWS accounts. Whether your organization chooses to define pre-production test and production AWS hosting accounts based on the owning delivery teams, collections of related services, or another basis, will depend on your requirements. Typically some analysis and design is needed to define the specific approach. + +## Separate AWS Accounts for Shared Builder Services + +Similarly, AWS best practices recommend that one or more separate AWS accounts are established to host shared builder services that are used to help build, test, and release your applications and cloud resources to the pre-production test and production hosting environments. Since CI/CD pipelines, source code management, artifact repositories, and other builder resources are considered production resources, they are not typically managed in development environments. Again, some degree of analysis and design is typically needed to identify the specific approach that best suits your requirements. + +## Expanded Use of AWS Transit Gateway to Support Test and Production VPCs + +If your pre-productuction test and production workloads need to integrate with on-premises resources and services, the AWS Transit Gateway configuration can be extended to enable routing between those environments. + +## Cloud Hosted Internet Ingress and Egress Security Services + +If your organization has strict requirements for securing Internet access, then hosting your enterprise standard security services in a dedicated set of VPCs managed within the Network AWS account is a common pattern. This cloud hosted approach to securing Internet integration is more performant than depending on routing traffic back on-premises. + +See the following AWS Blog posts up-to-date examples of how to use AWS Transit Gateway and third party products to support cloud-hosted ingress and egress security requirements: + +* [How to Integrate Third-Party Firewall Appliances into an AWS Environment](https://aws.amazon.com/blogs/networking-and-content-delivery/how-to-integrate-third-party-firewall-appliances-into-an-aws-environment/) +* [Securing VPC Egress Using IDS/IPS Leveraging Transit Gateway](https://aws.amazon.com/blogs/networking-and-content-delivery/securing-egress-using-ids-ips-leveraging-transit-gateway/) \ No newline at end of file diff --git a/content/03-preprod-prod/_index.md b/content/03-preprod-prod/_index.md new file mode 100644 index 0000000..6d0e765 --- /dev/null +++ b/content/03-preprod-prod/_index.md @@ -0,0 +1,68 @@ +--- +title: 'Expanding Your Foundation to Support Pre-Production Test and Production Environments' +menuTitle: '3. Foundation for Test and Prod' +disableToc: true +weight: 30 +--- + +{{% notice note %}} +**Review Note:** The pre-production test and production envrionment section is only sketched out topically at this stage. We expect to begin addressing this section after drafting the higher priority [Development Fast Follow Capabilities]({{< relref "02-dev-fast-follow" >}}) section. If you have comments and suggestions about this guide, see [Contributing]({{< relref "03-contributing" >}}). +{{% /notice %}} + +Once you've established your initial foundation and delivered the initial set of development environments to teams, your next step is to extend your foundation by introducting a set of capabilities that organizations typically require before moving workloads into production. + +[![Initial Pre-Production Test and Production Environments in Single AWS Region](/images/03-preprod-prod/preprod-prod-single-region.png)](/images/03-preprod-prod/preprod-prod-single-region.png) + +## Refine Requirements and Identify Solutions + +* Governance +* Data Classification and Compliance +* Encryption + * At Rest + * In Transit + * Key Management + * Certificate Management +* Multi-Region +* Pre-Production Test and Production AWS Account Design and Tenancy Model + * Pre-Production Test, Production, and Builder Services AWS Accounts + * Grouping like workloads together in same AWS accounts +* Pre-Production Test and Production Networks + * VPC Design + * On-premises Network Integration + * DNS Integration + * Internet Integration +* Initial Iteration of Workload Promotion and Release Management +* Evolved Foundation Baseline Management +* Cloud Operating Model + * Defining who does what in terms of promotion and production operations +* Identity and Access Management + * Enhanced Service Control Policies (SCPs) + * IAM for: + * Workloads + * Runtimes + * Lifecycle management + * Operations and monitoring + * Foundation + * Runtimes + * Lifecycle management + * Operations and monitoring + +## Establish the Environments + +* Establich Pre-Production Test and Production AWS Accounts +* Establish Pre-Production Test and Product AWS Account Access Controls +* Enhance Development AWS Accounts with Production-like Access Controls (for early testing) +* Establish Pre-Production Test and Production Networks +* Onboard Foundation Team + * Promotion and Release Management + * Operational Monitoring and Support +* Establish Encryption Support +* Establish Promotion and Release Management Process +* Onboard Development Teams + * Ability to Perform Early Testing of Production-like Access Controls in Development + * Promotion and Release Management + * Operational Monitoring and Support + +## Deploy Workloads and Operate the Environment + +... \ No newline at end of file diff --git a/content/04-prod-fast-follow/01-resource-naming-tagging.md b/content/04-prod-fast-follow/01-resource-naming-tagging.md new file mode 100644 index 0000000..db89eb2 --- /dev/null +++ b/content/04-prod-fast-follow/01-resource-naming-tagging.md @@ -0,0 +1,8 @@ +--- +title: 'Cloud Resource Naming and Tagging' +menuTitle: 'Naming and Tagging' +disableToc: true +weight: 10 +--- + +...placeholder to provider references to cloud resource naming and tagging guidance... \ No newline at end of file diff --git a/content/04-prod-fast-follow/_index.md b/content/04-prod-fast-follow/_index.md new file mode 100644 index 0000000..1d01334 --- /dev/null +++ b/content/04-prod-fast-follow/_index.md @@ -0,0 +1,13 @@ +--- +title: 'Production Environment Fast Follow Capabilities' +menuTitle: '4. Production Fast Follows' +disableToc: true +weight: 40 +--- +{{% notice note %}} +**Review Note:** The production fast follow capabilities are only sketched out topically at this stage. We expect to begin addressing them after the [Introduction]({{< relref "00-intro" >}}) and [Establish Development Environments]({{< relref "01-dev" >}}) sections are completed from a draft perspective. If you have comments and suggestions about this guide, see [Contributing]({{< relref "03-contributing" >}}). +{{% /notice %}} + +Depending on your organizations needs, additional capabilities may be required either as part of your initial build out of pre-production test and production environments or shortly thereafter. The following sections address the most common production "fast follow" capabilities and provide references to current best practices to establish these capabilities. + +{{% children showhidden="false" %}} \ No newline at end of file diff --git a/content/05-project/01-project-faqs.md b/content/05-project/01-project-faqs.md new file mode 100644 index 0000000..d470b05 --- /dev/null +++ b/content/05-project/01-project-faqs.md @@ -0,0 +1,24 @@ +--- +title: "Project Frequently Asked Questions (FAQs)" +menuTitle: "Project FAQs" +disableToc: true +weight: 10 +--- + +### Q: How I can contribute? + +See [Contributing]({{< relref "03-contributing.md" >}}) + +## Q: Isn't this information already addressed in formal AWS documentation? + +No, not to our knowledge. This guide take an experience journey based approach to introducing customers to the overall use case, the set of typical requirements, and an overall solution before leading customers through the actual steps to realize a set team development environments built on top of the initial form of their AWS foundation. + +Wherever feasible, the guide defers to existing AWS documentation for detailed instructions. + +Additionally, since the scope of the initial stage of customers' adoption of AWS extends beyond the domain of any single AWS service, it's difficult for any one AWS service to document such a wide ranging experience. + +Moving forward there's an opportunity to introduce this type of journey based documentation and into more mainstream AWS documentation. + +## Q: What are the tenets or principles behind this project? + +See [Project Tenets]({{< relref "02-project-tenets.md" >}}) \ No newline at end of file diff --git a/content/05-project/02-project-tenets.md b/content/05-project/02-project-tenets.md new file mode 100644 index 0000000..081caac --- /dev/null +++ b/content/05-project/02-project-tenets.md @@ -0,0 +1,61 @@ +--- +title: "Project Tenets" +disableToc: true +weight: 20 +--- + +The following tenets help the team make decisions about the content of this guide. + +{{< toc >}} + +## 1. Customer oriented with a goal of self-service + +The primary audience of this guide are organizations adopting AWS. + +Although it's often helpful for customers to have AWS experienced people working with them in this early stage of adoption, our goal is to enable customers to be able to follow this guide on their own. + +AWS and partners should also benefit from this guide as they assist customers in this early stage of the cloud adoption journey. + +As a byproduct, the guide should serve as a means to help train new AWS and partner technologists as they begin to become familiar with the initial practical steps of customer adoption of AWS. + +## 2. Work in the open + +Engage customers, partners, and others out in the open from the start. Hook the effort into an external community. + +## 3. Take a journey-based approach to providing guidance + +Make the target audience and specific stage of adoption clear throughout the guidance. + +Incorporate all guidance into a contiguous experience. Avoid inclusion of guidance and resources that don't fit the story and journey. Take steps to position all references to other guidance in the content of the contiguous narrative. + +## 4. Crawl, walk, and then run + +Don't overload customers with sophisticated and complicated capabilities prematurely in their journey when those capabilties aren't useful in the early stage. + +Balance this tenet with the interest in avoiding significant rework later in the journey. + +## 5. Focus on the common underpinnings or "foundation" aspects of the journey + +Focus on the common underpinnings or foundational aspects of the journey that apply largely independent of specific workload types and industry verticals. + +At least in the early stages of developing this guidance, defer to other resources to address workload- and industry-specific needs. + +## 6. Focus on early stage of formal adoption of AWS + +Don't boil the ocean. Focus on the early "project" stage of formal adoption of AWS. Provide pathways to other guidance and offerings that help customers through the later "foundation" stage of adoption. + +## 7. Focus on the 80% part of 80/20 + +Address the most common scenarios first. + +## 8. Avoid temporary solutions and accrual of technical debt + +Help bias customers toward making incremental, additive investments in their AWS environments. Avoid investments that involve substantial rework in later stages of the cloud adoption journey. + +## 9. Work with AWS to continually improve the customer experience + +Over time, the detailed guidance should continually reduce in scope as more features are built into the platform. + +## 10. Keep apace with latest best practices and AWS capabilities + +As more capabilities are built into the AWS platform and additional best practices are developed, ensure that this guidance is kept up-to-date. diff --git a/content/05-project/03-contributing.md b/content/05-project/03-contributing.md new file mode 100644 index 0000000..beb030a --- /dev/null +++ b/content/05-project/03-contributing.md @@ -0,0 +1,7 @@ +--- +title: "Contributing" +disableToc: true +weight: 30 +--- + +See [`CONTRIBUTING`](https://github.com/aws-samples/aws-get-started-workshop/blob/master/CONTRIBUTING.md) \ No newline at end of file diff --git a/content/05-project/04-authors.md b/content/05-project/04-authors.md new file mode 100644 index 0000000..2081f87 --- /dev/null +++ b/content/05-project/04-authors.md @@ -0,0 +1,7 @@ +--- +title: "Authors" +disableToc: true +weight: 40 +--- + +... \ No newline at end of file diff --git a/content/05-project/05-change-history.md b/content/05-project/05-change-history.md new file mode 100644 index 0000000..fbe6e4c --- /dev/null +++ b/content/05-project/05-change-history.md @@ -0,0 +1,15 @@ +--- +title: 'History of Changes' +menuTitle: 'Changes' +disableToc: true +weight: 50 +--- + +A history of notable changes to the guide. + +|Date|Change|Description| +|----|------|-----------| +|March 31 2020|**No longer share public subnets**|Share only private subnets with team development accounts so that builder teams can't enable Internet access to their development workloads.| +|March 27 2020|**Enhance team development IAM policies with NotAction**|Using the AWS managed IAM policy developer oriented `PowerUserAccess` as a basis, make the SAML policy and permissions boundary more secure by default by patterning a portion of them after the PowerUser managed policy.| +|March 15 2020|**Convert to Hugo static site generator**|Make it easier to browse the guide via a web site as compared to browsing markdown files in the git repository.| +|March 1 2020|**Initial form of team development access controls based on IAM permissions boundaries**|A means to enable builder teams with wide ranging access in their team development environments, but not able to modify the underlying foundation resources.| diff --git a/content/05-project/06-repository.md b/content/05-project/06-repository.md new file mode 100644 index 0000000..f794a6f --- /dev/null +++ b/content/05-project/06-repository.md @@ -0,0 +1,8 @@ +--- +title: "Repository" +pre: " " +disableToc: true +weight: 60 +--- + +... \ No newline at end of file diff --git a/content/05-project/_index.md b/content/05-project/_index.md new file mode 100644 index 0000000..c114934 --- /dev/null +++ b/content/05-project/_index.md @@ -0,0 +1,9 @@ +--- +title: 'Project Information' +disableToc: true +weight: 50 +--- + +Information about the project that owns documenting this guidance. + +{{% children showhidden="false" %}} diff --git a/content/_index.md b/content/_index.md new file mode 100644 index 0000000..263dc96 --- /dev/null +++ b/content/_index.md @@ -0,0 +1,18 @@ +--- +title: "Getting Started" +chapter: true +weight: 1 +--- + +# Getting Started with AWS for Formal Workloads + +This guide is intended to help your organization move from using informal personal AWS accounts used to experiment with AWS to establishing an initial foundation so that you can quickly demonstrate business value via the production deployment of an initial few workloads before making further foundational investments and using AWS at a much greater scale. + +{{% notice note %}} +**Draft Content** Content in this repository is in a preliminary draft form and should not be used to formally build out AWS environments unless an AWS specialist is working with you. The documentation is currently undergoing frequent changes as it is reviewed and tested. +{{% /notice %}} + +| | | | +|:-:|:-:|:-:| +|{{< figure src="/images/01-dev/dev-initial.png" alt="Development Environments" >}}|{{< figure src="/images/02-dev-fast-follow/dev-fast-follow.png" alt="Development Fast Follow Capabilities" >}}|{{< figure src="/images/03-preprod-prod/preprod-prod-single-region.png" alt="Initial Pre-Production Test and Production Environments" >}}| +|[**1. Establish Development Environments**]({{< relref "01-dev" >}})|[**2. Establish Development Fast Follow Capabilities**]({{< relref "02-dev-fast-follow" >}})|[**3. Establish Pre-Production Test and Production Environments**]({{< relref "03-preprod-prod" >}})| \ No newline at end of file diff --git a/drawings/initial-foundation.drawio b/drawings/initial-foundation.drawio new file mode 100644 index 0000000..287a7b8 --- /dev/null +++ b/drawings/initial-foundation.drawio @@ -0,0 +1 @@ +7V1dd9o4E/41nLN7EY5l+YtLICHN+6ZtmqS77d5wjC1AjbFZ2wTor1/Jlo0tyXwkGEhC2nOKFSPLmucZzYxG0wbsThbXoT0dfw5c5DVUxV004GVDVVXNNMk/tGWZtgCgKmnLKMQua1s1PODfiDVmt82wi6LSjXEQeDGelhudwPeRE5fa7DAM5uXbhoFXfurUHiGh4cGxPbH1b+zG47TV0pVV+yeER+PsyUBhv5nY2c2sIRrbbjAvNMGrBuyGQRCnnyaLLvLo7GXzcnURTPuTr9ZD758vP/Vo+u3/sXWRdtbb5Sv5K4TIj/fbtZp2/Wx7MzZf7b8fSEPXC2Yue+14mc3lNMB+nMhD75C/5HldpaGT33TpVVPVuQb+2iw3APGK9lFu4K/NcgPguwfc8wE/wEKDcFXqXuGerxQGSP7CTjCLPeyjbo5chTSOQtvFRE7dwAtC0uYHPpm9zjieeOQKkI/zMY7Rw9R26KzOCe1I2zDwY8YdoGbXbOLpdwj2pvTzZDGiPG3a80hrjsJgNk0eeUPYI/1tn3zsO1SYfduLaUdxGDyhbHANFZI/PQqYzhB7HjfoZxTGmFCp7eER7T8O6ONsduWhYdIjeRPsj26Tq0uosNHLHuHa0Ri5bKK2BDUDPx0KWhQozUB+jYIJisMluSX7LaNrprAyps9X7AeGxhrHReorBmu1mc4Z5Z2veEU+MGrtQDNNoJnALcn0C7LS20bXMooTCSqlVESQRCZ5V549QF7Hdp4oXnxXDts65aWasCQwU9dFgekSecH6xGVUqMWHh6+C4KRaoIoBvHYgv+vpmqm1Cr+7xCHpCCeM9oOQzkGJnOQ7XRNA0JNBZJj88FzLIHJLhX0XRJh1PwjiOJhsZLpDRoXCshbbpLHsaJpOxxAv6DjkKixEUTALHZQqsA65lKmyiOgXD/UjMpp+cl9dWISc8jBNUXmYlgjFrG3vSIQCEHuUpXYiP1V5RPaE/HOJnpEXTCd0Nrpqo00GTRBMXwZ2UuC2HYd8Ly60f/3egG1q2BW+u04nke8hg/5Zq5g26yKwRhel/WZmmlqjoFtKWdD5qlEQtAElSkcDdSkdXRA1k277LOEXSDi38DMJZ57M8SRctarco1FC57O1/dat7TCVpIQ/QDOvOm1xJc/X6z3Z2vlzDmJrtxS1qZdoBjWRZrqMZlCpi2amQLOi9lSVv+5Iv0biDQ1C8mkUJzOUtpAZ9ks0NP6dUQc/meeLOXsBqlaJaTaxvdUNWU9/fEHxPAifqE4uauY/s0eQl0qfkj35zPu3zvvnqSP1rTXLAlqtvrWS/PAuYW18NwS+WyLfIdRFvqu1Lastge8PY/LmLmm7C/GzHSPquc0GPiKsOpPtFMimvIZsEXJmIY6X/dXNDwnzso63XXuvjJ7as97q2gsUrWzhahJnFRhGAhGejVZdZARiRLkbhNMgTGl4acc2DS+nAYUzGU+BjK9a+ZxMuH2XiLafR4oEEuYLVX1roRgerZN/FznfMg9Tt5qS0KUlMX6BCuvinxgxYns5StudYF9cAXdBGT/hmt4xNEHa2c1lbWuZLdASpHOykUky+Bl5rSTS1p9FKCSS6iQKCoVXzyjVU9vuzO0OrjwKzsCVhyqKfpUEWXptil3cw+jMsOdSNZ7EIc/IeiPIUsrI0o+OLDHy+bGhpLwMSi56xg46LJh0Y7OaMqym1joknsQ4a8EE5QM/ebSGQxx5EJ5GqDDzyTZ6hX1VkGw5xA3WhPzqs0wAJxUgsUtUCcfrcwvEoNwNhSjxyd/VzKvqyc28JdGuKQmozqmOdUaJdqKRTtWcLopxTsXJp3TVSCYXkh8xHppTLmv4UQiEDvi7SFs6rIrgKBFELJP6GrXOmgRtzCvtCXZd+hgpzJLkiPp9CsD5FFCyLynLXVFrg8+a6FopvB1Jdh6J2kWCBN/vliMAsCw9SxOlB7U8hHqY8GgGjYIEP9tREn5RNm0d39Pkxo8jQEvZLD/VlEgvp+3+pSfG026DERVa6IzxMxKFuF5a+RL49qUFgAGa3Hqb53UUJSaPwNQmMTECU0jkYMGYnGn3LAFK9J75YHWvp/Rg1XondVeEhW2DDJMstcuKBbA2Kap8GDsLIRdNJtkOcm3pf6oY6uA4pnweTeLqTeRVC8umJvMcBvS5j8E8UbzXMzt0Qxt7O/eVpCDSkaAo2vnLHYIp7FP1YftuMrCo8Db2hAraH0QreX8Yy8sCVtMs6xLLaom6BJqy1RvUlsyQ6beif+SOUMZimh4ajALf9q5WrdyUre65DagqT2T3C8XxkgUg7FkclCWLFjj+Ufj8k3ZFXjy9ulywnpOLZSPbdrPDuE1PbCQemx1F2Mmae9iTO2m7rw/07dcKNESeHdOVcXWTXC7sq3c0WFJ0nltKs1X8KYHC0LWmUe4zVeCsm5W4JT0DwPWll3siUzVCsdATmVR7WbiNbZOteQUof1D1yNZ/gXxIx7DCcT7hr4C2cYb2YaENFdCEBWRbBid12AQi8nfGORla6TEtdZfH7IsExJBoWsKDtQ1D3/ylmshgHoMM7wXYuTVfpVm3xS7kPUClJnTq8gFXAlOXj6teTIqhw0+zSZIfaTP7kzczCcAyh9RexYW4m+aY4IhYnb32Fkbm9sZjiCL82x7kWyjlbBLq11ScdSq6xVXpdVsCPqOxYHjmB1zZABvFM6Qyg1RpQlMtn4xibskryQLMsnljlp4BOeIEw2GEYg5r+0GXGFksnD19ZM7RbTCSIGiNozXEo3Vf+8g+DshzUbJoiSy+JfdwDL0aZ6874SSGS1Y7Q8oDCtNNzVXEJPFcjx8/qTrld+j4yUVO2ezMmiEKFcj2DGqLn0DtbMu8wpbht9RfbIfzPZm69kpjZt9rABRTPx5Ydm8Wo+J1eDeYTD1s+464s/ShkkTeTL6RcWqZbFDMD+lh/4yoN4MoPoPNPDqixOyWDq1ck4T6WaT99oY6aXc3RUsmC+IXvKaVwXPa5gzLxqZyrjUhQm9tljVQraYBRXnXllMDRcf4NiAz7NGREwfZHiHJypUkzEc5IlLe8GLOU56WRPG4CX03ZD0NUsPpdpA35A7u11R9SS2fdelRVU7wSuh6jTJXuZA7UCSbuvmOy2G2YaDorPbozNKqVzb5QAU65mIj1ONn234pJqQn8M8CJ0Q1+X18y5LlzalNWfJFq7YyMGLmDLefy1Ocbe9uY0XsUiEGapqlNnaqENPpAqhLs3LeZYUYRrV+nAhgU1WjuoBscNl7lqYKKD5o+RgNVCCYmRkS98qObY8mGJ0xfPAqR6lM+g4TwamguGUeG8VqtR5Owr1nrB5B39KZPxZEgQ4sDqNHLtSliWFscTfjjNOD45TOfpzM/slgVZZVfFisVuU3dmbuSFYk47VANZQ2hOZuQFVNE4CPA9QBm/pjobTFJRgART/2qi/uDWSrfiRJeb1aTMlE1eB9ncG7hTUQxX2UCeBYELbgyUFYjAsLp+G+fqfuWBzOnHgW5g6Z7GjcuvSH9KCOcpEocezFF9inRUXI+HzHm9EC7KrCnfph+TnNbbpPD3Il3V9FNIUFJ+BVlcEy709Ict/crTAZ3VlE8I7CCwpOPMTJM75+X5MBsn6isD8MyVvnk5u8AV+fbZeJKNXSTHpjZzvKv8hyn5qCNtqUYbKhUgpXE0WuFjZnmBwqeq/xCScKEBgJpbW4s5zR13Dy179jCFpPTx11eT17/HRx/9ctvBBjehX1+iTH4Xg4rd+ieUcH41S+1I0qVn3TpMVU95FkIpVjVWTrXEz1vZSW+mjFVCGXxKy2oKSeFJQWU9XyW/dONDH4JimnembbW2fbKZUwrZVlRpllULMEjslLLGRFbPbOMDF0eC5geuJUOxcw3QMTWyZXTFjLMj9KFUxrKl96PbjowMVNdK8PIm3Yu2/dziOJVSkQ7hBnFH03S2RmUCUtLId5d4mkWb6b9U/dmc28M6jxUqxIbH5BsrH0NcWo991s4GHnrFw/tHKVWjhUubZ6RMHuT7nmzzmIctW4g4yaLIfOkJg5+6hkM8W/7+7inxP35v6fVvDt51O3N5QEXviM1zze8kf77ib6c1N8ZTgc6KYo0oNVRAmoyGM6v2adkuRPiiqSzDiZT7iXZMhvXx679vX01+Lb0Jl35wa0nYVEkjc+jnGa/0qDzv4qnxn5zzgMfOYr+nmojZ2GxM/JUY+NQVJhp+OoR6xUQ+aZSys9wz0I4Uf/V0vzvg0n//vuDuJH3Dd+u5kQzsUTmDhT42HdfapoDq2tmFi3PdTS+P9MQ2txpUX2VwuBc3pZqGlNHYS1XyifNxe+nh3trXqt/Rl68mTt07DiXwx8gvdw+SPjEr0o8IxeroiWXC3zq4O6DdphaLK/4g4mV+BJ5x2QEynuoMH9Vt+Rrh9v64xutvAoTcvUd1h86MUdCjGZLWo2rEjzAnrtez0yRZ6tM5zr5xn3n58a/Jn/rYuocB1ZgIuc7olnFXqhaljrb381y6TxJNFUflu0+xiBKN7n3RboGgd0TeMYsyegV0XOKse1/v5doU4uQ5pfVLidRl0+By6id/wH7V1rc5s6E/41mTnvh2Qk7nz0Nck5TpvWOc3liweDYnMiIxfwJf31r4QBG0m+xDVO3NB2ptYaBGifXe0+K+EztTGaX4bOeHhDPITPFODNz9TmmaKoqmLS/5jkdSGBUAELySD0vVS2FHT9XygVZodNfA9FhQNjQnDsj4tClwQBcuOCzAlDMise9kxw8apjZ4AEQdd1sCi99714uJBaOljKr5A/GGZXhiD9ZuRkB6eCaOh4ZLYiUltnaiMkJF58Gs0bCLPRy8YF/Lx5UMbndl8BGMDZI2m+zM8XnbXfckr+CCEK4r277rUfg7+bP9pXDhw8DD1rHMFhegqYOniSjlftvksFDUwmXvrY8Ws2lmPiB3GiD71O/9GTG+BMp980WOtC0TkB3zaLAii2WB9FAd82iwLIdw+560P+BlcEQqvQPeCuD1ZukP5T62QSYz9AjRy5gAoHoeP5VE8NgklIZQEJ6OjVh/EI0xakH2dDP0bdseOyUZ1Rs6OyZxLEqe1AJWunA8/Oodgbs8+j+YDZ6YUzi7SLQUgm4+SS19R6pN/26Meey5TZc3DMOopD8oKymztTVPq3zQBTf/Yx5m56isLYp6ZUw/6A9R8TdjknbWH0nPRIn8QPBp2k1VRBeveyS3hONEReOlA7gjoFP7sVNF8x6RTkl4iMUBy+0kPSb89NK0V16rLMtDlbmj/UM+Fw1fbVzGk5qdMZ5L0vDYt+SG1LbmdhdD9ptLs+diLt6y9rfte9VyR29gXFMxK+UOHC4mquSyZ0JBSDjhhkA/T13zO1xjoOnkOH6m3ixpMQCUa5qjd6KjLYX5mm9ZrRsIy1auUhxykRJH/yfjNfqpSpSV0rajKfe1ZVqegyVUL7AKqc1tCvm3/1p1gfPXa+fPvpPlrNtS7zOxr41Aorn3nyPjNcaFJiQlAzW/Ua5yyp/Dn5cziPmV/nOB5TM4t2pgCJneXGV7AzoJdlZ1CwsyaaIkzGI/b4Cvhx26iM7fSNbTp2pWGJZllQKzUsyWe0gpEdcXrTYNHsVInZ2UBiddYhJrfvTy+9Z2PUvGs3m6N/elPtmxGdm+LkNnVoKNP3sR+ze39iKlCAsjEMSfW03n3mIw73DUfyro6oL4ULRwxJOGJAib7yEw/uJK0d9QUrfVH70t9dX4qgr9tJH/sulXUn/QDF1ZR2+lNahNxJSM2vtzy4m6C+MMVsm+yovGXTvHl9xvb2RDy7znHCSoWf32zR/uikJ4kqdZPhqBQLVAUL7A7po3tUdhv6UydGlS1+Zltcl+K1jLbStk41xbN5S1QyA9tui2VZoi5YYpLSGQlP2Q/ppwH71MZkRg/rkEEkGKQUgevYxzXI5PSs11RQ1wVkpAcXlJUhoeP0Eb4lkR8ntEGzT+KYjLZCxaX3gsKibWyzAycaLx702Z+z+6gnLgmFrSlaeKa1xvJMh7GH2SCWhzINFGFmAksAmWaJGMtkB4eYIUCsgtD+EEoOo/Nib0BnyZnzWmbsoHKxuwnVZH7j0CTjfktjpMTk+EvtTnRYl+noVEjbG2mBcxSQQW5a1DQxQNUkCCstPbQFhH2nqGER6Z3Tx2Ltp4LUzpAK2UD24mQYy4RUEVG6hCJSJTOgal4AtSRQZbdUoepUUcWH70dGFXSD1/pNELo/H88fLsfqZacWZWXQFdggb4CyUSVhPCQDEji4tZTW6WgFXq7o5TEdwlSYjPJ/KI5fU105k5gUFRnFThjX2KogpmnsRJHvZuK2j5eH8RwjmvvxA7vuhWXqafsxaWet5jy9raTxutK4RaFPx4yBao8cLSKT0E1HqPXFu/rnddAOHtTpt9bNN+/JfjrXFsfRRxigeHssy0Z5I2ZChJ3Yn64eJFd/euotw/qKB7P45RP8bLd4ovQ0ZWXBEd+TyjlDw9CKPS2eWeiJKpiFT/lhKe3CIzZ/5v3LHZrgGSs6tqKAPgkdaxjHpWOlFiiSQBUdW9niJ6NjDeO4dKzUEsVScpUlnFSWwOeepqTcVmKWIAVVRWicOKh4V3VkULmdYbt//UIAflKic3yldfHfmzct3DuxOxRJ2cOXj+h3bVXTLGXlu6Yf0o4WoAlYfivCsd6Aqi5dn50vIv1wmJTjDy0SwcVkX6dN2bSf7D2YJTopD6T8OnETaAJIdUMEaSY7OELF5VYfmhwJ6DM/pBdOGivUCGsuuZGklZMjgZddLvWmVJJe6feIkk0EyFaiJK3xlU6U6IZRjOIg18fuRIkCNvf0ZqJkLSOjFy6kGTaH9UWX+5IsUmMQa66VMZRhDJsYrtKNQbGLyNKtfVlDhVtEoJl2ScYAirdsqkcwBpFxvE6r6lS6rnJMp8GYh7cklpUs6RXCAD5aGPmel1icjAYoWiEfJmAWkdQd92WQHCeLZEpLdVSepJZs8pNVbhUOlQeb8c13d3L5Iu6lhzvEfoatnkgXPdGmqL1sT6TxyFCVDzMr/0b5Qjqku67+p4kY+IuMWebg4P8JSP2EWwFsyVab8rYCSJUnUiNV7aniuz9J7cmWrLQqs/Ykz9JFIqkqPlXG+MmKT7Z23OKT3BQVwRSrQsFJFQr46hMEkpTs2JUCKO72qmB1UrDivdXHgJUhAKeiNH+bSJBQmpsSpyNQmloBeqay3IJyAFaT2/NUFsUPATwsrSldxCpG0ukb5EDNG/nBjqXXdQ616H91Ta8b2i4kKD3YMm1oGx/R0cq3WGE8oY/lsPvpTSIURlKXXNocrqsce5ZxXkfYcyUFlvgWoPrExx4dfTqFI2dUIetEkMXzssZ7I0vMOD43lMB+UPLQ1HfRkcEk7g4VwWRYF5p9RDyJqUaDhGMSJiwSvxwpf/sjH0Zi7I8jtDLyyQKaNUyJUBDMoj4oYiyvyRXdR2kq4vdWGrYhqEj6Sjm+cHwwBW0qvf6xagCAV4P9zmrQxdEuP3fK9n9ln3fZ+7V3vvU2bZaex0CFW6hkqty6t52zGAitLV0dKo2hmJRfaf29bTmjnMTnXZiAT41mYPJq5nYV7oxm297S08HADKBxYfHXutC2AHqHs8oBtfiii5VFSl0ULiK+5ZuqncBbaX1PFwaLqRlfRmm3QVt9EzMqLFvastYg4Wqba+btEmddjgy3NDE+hbL1SUZZs671Hn7qT/E5Np9u7L24ke/JUjlC8ZhriqRAEZeldNOyKbt8YuhcLtMgozH2ncDdsZzypybQJ8TFfDiWT+SP235QQeqEIMXRe9a7Q0rCHLNfE0qY48SPgUbnmsVPt9eroYxLAxfqWAGdy7Kf5lhGPB87nkkXmrAzS13MBVVzu7KhYl0YqqjwQ/AKitO9u46HsHYZzl6UX+6z+tJfuytQEq/+RXUebV4Hm1A1ffYzMe+mTsLUGbMhNktVp8mtc85fS7+qTelyIFCWLk9s/1z+ciHdMAspeZag7/5yoX1r9W9Dxz4vJdpkdKVH4AbPO/Hzxs4RuG5whCgP4kMl/Xa28SDfawc4u/i9zN0Jh8bD4AbCSyV4xZ3u03/zlqSoVSyXrjjBexK+YOJ4H35aK8vxQS4X0yQ/DwBlewIOkaRLtSeWkCrt7ao9E0oKG0fVnlhfqrS3q/ZsyWslStPe3e00hJ25PZh0G1+vpro9e3Flv9BHgnNCHwk74zELqxVwfSuyH47nhTRjkGQHy4Bk3Ur3txQO2+1Gw7bXIaG04FDl3xxv7RgcHmLfVO9y+jT90XLnkIwfw+vruPMDyBS18S3M/BcbNsJVq38/+huaTSBuVSjrDc1S9ImsQoW+Pxd9HKllS5zfgdBHm8tfkl5kA8sf5FZb/wc=7T3rV6rK23+N6/2dD7pguH9Uy+qU1dY67friQhmVHYIBavbXvzPchJkRtUBzp/usk4wwwHO/zTMVoTl5v3D16bjtGNCqAM54rwhnFQBEDojoDx5ZhiNA4bhwZOSaRjjGrwa65geMBuPTZqYBvcyJvuNYvjnNDg4c24YDPzOmu66zyJ42dKzsXaf6CFID3YFu0aNPpuGPw1FV4lbjl9AcjeM78/H7TfT45GjAG+uGs0gNCecVoek6jh9+m7w3oYWhF8NlsZz2xlpHF4B2MbsHV1r9dlkNJ2vtcknyCi60/U9PPX+y1DP15XbxrF42bxQw9gYv0SXcXLdmEbzqT1000LScmRG9tr+MYTl1TNsP8CE10H/o4iZXkdAvTXxUAxIxQB4r2QGePsJzZAfIYyU7wJPT88T9efIBUwPUUWZ6jrg/l3pA9J/QcGa+ZdqwmVAuhwZHrm6YCE9Nx3JcNGY7NoJeY+xPLHTEo6+LsenD7lQfYKguENuhsaFj+xHv8CA+jgCPr0G0N8XfJ+8jzKc1feGJtZHrzKbBLa8Q9zB/7aGvvQFGZk+3fDyR7zqvMH64ChDQvxYmmMbQtCzioefQ9U3ESnXLHOH5fQffTo+OLDgMZkRvYtqjm+DoTOCip2fdwtC9MTQiQG1J1BHx40eB7ymWjoj8AjoT6LtLdEr0qxLRdCSwqglDL1bszysxU4/TvC/EQkuPhM4omX3FWOhLxFtsPnvlO1fvPugseudvT/DO1luLPoPPbqG/cNxXNBhyXH0wcGYIEkBGEOMxgO4eK0IdT2wPXR3hbTbwZy6kmDKNN3QplPE/FqalutxU5bVoJUmOQGJydThvLEtBiZgEchaVAo1IUWDgUSoNjTyFxhB5HTgyEQee5OXRy0s3xCSDfXhROW/UCUGJxofBpzhpmdxnL9IyEXnL2GyjmUxgMZlYBJMxbRKayR6gPkEjCAjcGZxDy5lOMBiaoFLnUgJzkyA1UtdukKKGBFVDZJGBCvqCvL0UpaUlgW45+JSIYU3MYlijESwzEQwAFghfRXHLfvYHjxf+wBi3R7eW6XGLM4Y6bCGcGbofSFEuwnca16AkRP9F6lIlLB9eFmhMs+yeQlhZu66PLnTfHj22O+4d99vrXUsMPOfiI5L961GRiER+K7wwpGsylaX3odXQB69Y7tsGW/2UKnnVLLoUkWGnSgx0FWKlfjxejw2v+zx40nqTc/fsz/Thpgo2oysAVoIClmpOae4s7fO07lwjZiMklAX5qkKIREEUGS4CA/RqAZAfXFQXosFLH6riT5T6cwtKQhXQSu+vBD0PODHWKrGYAgzCTyCd8c+AUhL4eYZhbxgmVkc6vtgPFJIceNB9F30b4W8ZNcPpoTry/k68yVyWZQDPYBlRiXG7F6YRfgbPVGUpC3tJoGEPWIpdKwDyN/ZvqHFXsyG4864fO9aHd/bM4pe/E/QCAXpBkinQaxxTVpUG+y2Mqr8C9iIgHBdAkz3TNQVcWa4pbSBFrkr95K7sil+V1CiM8F557goTvbRCOYX3TuG9Yw7vqWLW2BYY4T2JJUOF0mSoQvERNEYwxq7j+mNnhM3u89VoY6XPMLBW59w4GAkBSfyBvr+MaEaf+Q6p43TXr+N0MhoYWLrnmYN4uGVabFW4u/TznJk7iN7KuTHbH9f67zm/vH4fD6/dm4UQn4duO4J+jpKPrAwMmVw0u9DSfXOezXWzUBZcigCgL1MnRAKMxGgy/+eRrFGStOm4U8fVfYg1pe7r6E8TwRS6J7F6/GJ1ECO3ZyDU9gYhYhlSlgs+lTKzzXSwsEwBW1WIJCWQaStVkllWqpjDrl9LoNAeQlTPwdWNiWnTIYpdaIwEtyg15LXOAaFMVUXjNQo3MeJvcEj23vGCuAv6re/4vjPZSBkJtaWofxOl6940fNGh+Y6fg0366OFn6LWCtERv5kEXYaoRiCfons9hKKW2rc7ZnbRUIkIsqwzSYuW/S8vM0W5/Y2ZaBhbiQdLmRFlHQllClrKkg1PWFqmHH0VK3OdIyYBzcwD3S0yytllMyWpN1PZJT7QrnzJAyUB+UotFOiaWZU49mIJ8UEpXQEgt8SpLw4okSESiRWZYJswEoyaXhRWRwsoVJlIb0oGvY4Y9iDPvMeQliYa8yIA8zxVQccGOXNICNoxtdbt320nadUWdpARGv7UkUUHsvvrtzHTRRKHAtLH7TmOlqfAC32L5DAm+jkO1uzCMAoTeUgMdsvwmDzkxFux56Gl6wXllEaMYRwXiMgMGLSoqTYrxWPGUKNC8Xn4ACL6b/u/U92c8FRKQ4dHZezRzcLCMDvYUNCo4yDN5v8eqP62geTlLApyWnSMk2OiyFXrpmSRhw0xhYIuaaX3gad2NJPaN1j9Z/gXoS/gMhUa5gHYIUt4TWaZjlI6wHP26+7dZ/7WALwv3vPXYkvdGviKRg5UVQkluTb4iUSEnamI55Lvukdc/GZni33QBUHMvKIfeBTqwVB8gd8PD5OJUwjoZ7/9oAzs0NcaO5yPCB7I+warY7nuBRp5OLaSnsfr26Ct1G4etsHVuObqBbzQ3cex4kLLmM9PRU9jJSotwsqlrzpluQLQELXyQ8IWCBydvQLA8UsR+lkMpI4O0RSamYYTCAHrmh95PXL5s7BuHf/PrFAmjLAmv0qyeK8AocyJZjxc9WyW95I1lZnA15OOpWZIMj77K/kBRarKsrT5ZQa/VBCE7pzMcetAnuKEY+qfjXyv/hetCN3S+Vxn+gOCSo05kGdJRMsIWPm+1uJawLlzBNIMpytpQBxuY72drvKmybNEqzxOBJ0Gia5SZnpFcVqRAkCicduFg5pr+MpYYpJxoOhMksnR7QC/G+lExqqMJdyrfLZAem9HpBRCmfaKoo6EoMoCu7JGiOpw8XbQv7LfJc/t+WDcuL4cGY6XFOQYFsnU8nHHv1ts36M+VgQARSrZ715mbQeYm0U8LEz064Nqt+o9VUMiOzloXCiNyxypKK0I/MRHLU7j4zi4mwoe7TOIs+CAVaMGHq0hLcBSHWnZDaLrMJjfamfZh89imbB+WWutDVgdv68IqXDamL8nlBGBI91KJPOV1z0Wez3Ncsf6oNnAXy8ngZdz6r9W+HtXdf18eGUIvlHPfwUHLTzTksfrXnbEqV+M4JeuNxcWtX3XHeD4rIZNUW6HuF7MoboOOC5MMTgAIZ4j+d4Frk7zE738MrASSOJLs0hKZWUZADBsSTP1Qut70k4EE+XehscYUj3mZqO3d+KLWNWhkdlBjrIFTJdZ6Hr6I+msmgsGR6TojviwyfNBIdMXuyCs9jCpwlIgmop9bx1GBtGmqogKpa+9UlF5h0iGdpj6DczTTA/Tww9UzEctIuoQ1rT/UbJYAKU6EODO0j8AOE4mMuM4YvbmRidSd8BXjS5NrWxYpFIEx5npORlcI00IK3rRHCZtd2UF4IOwTEWj5VAT2wdWHQyS9vzlaoxpmrFjKLU0GZLCVUQDEWvxRGoYVCsMdOAuMt4wl14LIENPDXBGZSYrzTV3HmkVkMERQB1zT0d3g6gtXRzYYJpacy5sIX64TrO1O8jzxEj1aLhxHimcnstndqeDJ/iKcLK6nkzUKXc2KHcCTPWYKcR/Yi/xVivqyMbJV2P/KRjQ1idvRhJIniCqiv23d1kcwWuX5v+7VefuflUo5iZ4oRAZkqs2DojI0DGA2cCtA/vA3yp8nRdDnv34P4BDCxsvlH4aGaeAOo0H9eojl5s0Vtinvr9JZvEyOOyqbOxIT4lC6hhUQ54Faiysji24Qob3Au7rZ6b/Imvt7xD/OZOl2m/ZD8eqm8mG3s8BFPnoGpFoMp33Eopnw3LnrwxdbC3wKKbmUsJmgDwZcwLCNJs486D8TGLqWg4SDtWTaNZNAKWEBNoqCXuxCmhkzBnYc5s1OiN2Z21LNayJ+yymAPahxc/8GjTP9mnPfProToa2Bh4bF9J1sGNBDbA2PZ4hKKkGjolCdDRIbeJKyaY4pProSBlKJyk3QxBogaENhyWJQUxjx0iK68DDbtdE4/ytXU2hx2VXSrY1RM8QS1UXYFeqbfM0pv0R17Py6HLrtgVp/igF/NHHqKCebpF3LyMmWHr9WiSp2Qf1s+FpBzgnIn6uo+LVC+MzxjdY/W/4FX8+jTmfNB+2l+fv6X7s+XUw883HOyqPGoVIyMEI1L2o67k/qSc6TUZBk/X+6K5UIWIkzQGb9P2U7shBIG+Zt3Qt6a2zsLt/B+1f8HPwp2mb0AZYWL8bwZyGPXqp64+CAd90djLG8pHCYj6xEIR8/spBW5ynLi2cEkdjdQstCGJ0eJBDEtUcTn3bB1q2LWMWiH5xFwLQXM901kOFu7TxXsJyTS8Lcu13cQJSUTrY0HS/1NruugthYdRoNbe9rsmzVrF1VFiWqnJrY9jEhMjKcQGB2QOWlAlq9MEmRTnKm9u95iCgIiRNGQCCHGofmKO+yn0wIPCACnSpjPe0aMpALWNzNpAI6rUYIFhKJkZwhMPflZd+CKKqgstOy70aTxz1Vf8qy7yjk0vMDBGyKjZVFxLJMGkGAouGy1oQzCZjOzGWyLIwlOLqvW9hKOpHw3jsXhDjpDSIUfBciVrUDEzHd8zCrUE+kegBpiyF/KArlJUn9XiTK6AxI24snOt07nWLo+wH0vw2tHtwmYO3JEXqpM2MEGUVaXyVUmasLgrIboQJF4fmfQ6j9CPSHolJNVMmyIk46NJ2CtXrfY8Rezt+nCFQleF8n8t3CHvD8HowRcCgiVsFBiZhdG3lcnYzibl6rDl7PlVVvL3Y3r93QmV5imhe1T68wza06LTs/yidp8YSogFCTUx9i86xt06USuRSUE2tC6kMEtXbOnH6hEkbqgdvbe/dKndZ7fzq/wO3dBThMcv4nt5fTVLmWtR0FVagBLvX5bMMuDSjkxF+ktnU3ktg3Wv9k+Rd8OU+ft3tEOk9v+rDqO1X8F/3y3/1t4XaFJkpnrR39N6kucA3px9gV6Hlhz3d6wd/51D6YaVHlyVopWd2bYcEkWXBUdsXnbYS8DomZToo5fF26pE62nEgW/WlZC+GTFVV8XD615bz7tBHyELNzt/ltxSa7xdIaqZi3FoQUiKHcI6VhIiYLFYh0N6V1QhLBauVPpZ42eYzS5J3AZ41eQVEoecfafKWIYh4mZf3N8q78FgVkcdanGxUDMsNZVqPiZDPubRsVb7jgy4ajIIJX9+HmEtzOlm8PfPvtEsrMhVBRYCqOS909ohO6vjsb+DM3ybiiu/XXF4zQI2E1IVcNwrSm5VdNG29rhR7PHlgzAwY1SdnSxGjf5No204fFpsH05x5e2mEGMhNw/WUyH1VNtXlaChjNmYcEKnSrWCaaQzO4x92j91mwmPbQRW+dADd4g2TXiU8AIrv1NJ4t3Ig0W5uTPStzF69GCapNhTsbtu8iNupiW+ybC3f2tWBRk/ialDWHNIEu5RGY2zRoBVTymO838s2Hd9Z++zPqN9QROPfOjnzFosqTa6g0Rn9X5lbVYgEKmQlR2tQLmRtLKN2DVrhKKixxJCB9+LWMuTSy01rG0oD+yneu3n3QWfTO357gna23Fn3GWsbs5sj/3TcpaJ+2fTy6bR/n0wFLSwBRVXmRrSUK2uQxUUR72eSR3AWeZy0aYCoKSSmJw+hFA8mSnfu4vz3XnfVtVqb8xGqHYDXuK6zmRc1JequTuwHfxRNvu5/1udwCLbU4TtzvftY4s8ALq8RC1oADHKvFCC8zarGVAlRf3s7NVDXAg6vbnomV3wVizoW+pLjyFKgvPVDvh0jojSIUlLntllwjdoHbZywePsBZ50puI0/7Queemw3k3zOcC4ZVts73RJLAztCr/DZz/Ahf1UX0/HhFoY1bJ1mrE+KZ/kc6vNF6qX9SXnV4l/jOJ7X1DdTWX2Mh8iWyu8aR/a4SmzEdTBAYmggU0U73Sr1/bVnnT+JldW69eq1up3nN4Heyd1WyGvh/9fsr7x+K46ilpX1Joa2NTzezYqwyzW1m5WCs+xjASrlrvIjtQiSFZVawOpfxXAHIPHP7H726ww3H94b9umjor9BnIDMOUtIyOygDWGtnbNHtpyzIVgWiylgANJcw96QVyoLrcSVsVr08Vu07nivp7h3sXh6rgjlRydYoacFGreurlPDBPXRNBG1MGmXs1hBvC/xddmuo8mrWclNJrt46MS5wmVo5kaix55VCS+nWvY5GbmpSbE8RJl8dZJfXwvmK38BXn+eEPOcxzQh50Z+CGWFz/QUj0ZqhLBGINTVV9wc+xzaiTNhSZCuHNZxRFO1KR0q7lZ36O610gqpIle3rVg+kEfJM3D1UTmU1gsh/spq6yvN8/kz7LI569QdgeXX3fvYbdp/H/c7dvMozMmZhbpkL2j0FbeO+wZ6Wu/oOZZm0PE/UxwuM5EBpXdaZ3EOHIJPcQLL3LeedcgPfKMhyyg0UEINRxZqQNbDFVSO2NDcqWtJV6os5AXTo4pKnlADG2Gk7BsRn/D8=7V1rd6I6F/41rvecD7qAcP2oVnuZdqYztjNzzhcXYlTOKDiAtp1f/yZAEJKIN/DS0nNpiRBi9rN39i07NdCevV575nzy4A7htCYJw9cauKpJkiRrGvqFW97iFkkSopaxZw+jNnHV0LP/wLiR3Lawh9DP3Bi47jSw59lGy3UcaAWZNtPz3JfsbSN3mn3r3BxDpqFnmVO29Yc9DCZRq64Iq/YbaI8n5M2iEH8yM8nNcYM/MYfuS6oJdGqg7bluEP01e23DKZ49Mi+/7jWnLdw92Nf3L50/8x/2tSfWo866uzySfAUPOsHeXT/9+1PpSy27P+09wXtwAxfXv+NHhKU5XcTz1fzRQw3tqbsYxl87eCNzOXdtJwjpobTQv+jhtlBT0CdtfNWQFKqBvtayDSJ7hfvINtDXWrZBpLsXqfeL9ABTDcxVpnuBer+QGiD6F7TcRTC1HdhOkCugxrFnDm1Ep7Y7dT3U5rgOmr3WJJhN0ZWI/nyZ2AHszU0Lz+oLYjvUNnKdIOYdUSLX8cTjZxD25vjv2esY82nDfPHlxthzF/PwlbeIe7if9tGffQsTs29OA9xR4Lm/IBlcTQLony4GTGtkT6fUoJfQC2zESs2pPcb9By5+nRlfTeEo7BF9E9sZ34dXV0CIR897xdD0J3AYT9SWoI7Bj4cCX1MsHYP8GrozGHhv6Jb4U5lInlhi1TXC6y8r/hdlNW6cpJnfAHGrGUudcdL9irPQHzFz8Rnt9elOdT9r5mjZe/zUkwfw5vqGw2g/XO/X1DWH+G0O/v+VGZjo143rB2g+0V9Ny3IXmOFoPuSQiqGr0lTburqWiDTAKJIlT0f9EskplUg3MRG0hHCqwRJO0Th0M8QCyKa2hrO5/vrpz487dTxavnl3/804ZDuMGAkHiFtRhsNMSVdTcwCnLdP6hRndGfLlTamMpmfppcocPlM45JLUAsjFXc5EhlyfYfCCGA1zU7iwxTxVk1Q0lyKeni/PNdDEHTsjz0SUW1jBwoO5ZEaPQhX/8y4YL2EpwncSh5Ay4BAyYdCDCDkYQyVojaQvN+3vnUf4A/oWh5AR+b7BsY2WukoxuXjFxIsoyWEgUdY6rSalkaD2UfhTnFqSvOcoaolKr26iBjAOKD4DPD5T9OTWwkWmznDaEzRnWFJilQQu4dSdz/Bc4PEnQjMRo/tKSV0aAHU7KSkcWQ3RlAyhgMSRhuSeNJWAXNayZmxLo7ZUa2bItGHNG6bp+2EWPDFRQIhTg6Nocg2E8kgssppmdsUT6ui/R8+emfHbqvWvWv8uaP0TEyYjclXRWaYTeOYCKGvtE1k1M7vifX9sV7x2+by2nFtc15es66JcqutLCH+OpmOqtI4pGgyPJdZdxvOllMZjEsNjvQn65sNoOVuaAbK1hd5i4ECOp6titlMwm3AIs/nQWnh28NZf3dwLOS+jym+x3nXUrtTVL3W9Uw2jkTUk6hqrZYqqyDKjVpqSCRgGg8MxJGR3vWDijl3HnHZWra3Qu5hM1+qeexeTIcTXfzAI3mIwmYvAzaIPvtrBz9Tf/+Cu0NxEV1evcc/hxVsCEtMLmjj8hxqsqen7tkWau/aUdH2ozeC7C8+KZ+JP8/e19WgbPft+rvz6ZinB3Sfi/0WvHcMgZ2blWJfB05mLDg9OzcBeZoOTPEKHj6IZMN9SN8TikMZB0v8B0FAYMd12vbnrRfI5jk200axCr5LSZyGlD1KJLELc/hCRtm9FhOVI50SDKU9JYqMjZQrmOqC1JEXczhAB5cUtVJb7ogi80BzObIdVjHbBGD3dstJSZYbW5ObsIqxrhmgwtCGEv8cxqEfXt4PQlr0auEHgzjYiI0FbCv2bkG768+iLjuxXPA4+9NHgF+hrmXg8/YUPPUSpViieoNdZwkhKbZtPsTu0FMrJq3KWfF5ETCkNWBoDrNbCng6xEBewE7FC1mUgS6aCdMrJkcUGDj42lIT9oDSES9uCxwVTEmTKEVOq3pCNY+KJDXKkFFA1TF4aIKmljvFfSVifNmemU3vuw9TMh8lPa7SrFGWzloSY430tjSqiTFFFAay9KHF4XC+LJuRlKZrcYog6kA0XXfDMq/S8s2HZI887u2pHwaBe78t2QnZdBh4tfNFnXUXWEKevPruyPdRRJCsdbO+zJGlrIhC7PHMhIdZlrOoejFwAkaHUQpc8k8lH9ssU9n00mn54X1lIVIhHIAeKms4ikbQVj0SdZfQP7TEq2MEze33Eq35qFUCmZwOALAoM0FC1bE8RbOOHV0Rm+xPVrfqLPFxMf+sdUOtep+e9bv0ot3kM/RGNp1DPl2RUED8yxEGRCFfU5NHy8Q2Uhq4aqR/qxXJDUOlP1w38gL7K4QRiFRyXE46E6o0ufKJ0lQ1/kU6bNuT9gA/Iqr+uo50xX3RQAcgfBFCL51urM/p6+1UVtKVj3ygP4y6JHZUuTql8RZX2Um+tKtCJj4JRjo5AvYds2Nl2XNT9JclCNh7WtCzo+5jyLv4fdp7+j/VMRIbaxPUDnOKgmjNsyDgDP7Rn5vMpsnKw8eOzT0a7gF7ibUH4RUsbB92sVByOfcpJNjhEz89JTgV9Y7zBMnp39B3CsWaHyDAsslyCLH8xVhltvM3s4TBiZejbf8xB4h7LxglxqCx/E8u6ZBqWUXPFD2N/JbtN47HV0hs6eXaZ0JBUPSttY3wcyrxUUpxBGXLuaOTDoFaGbGZDTivfjtCDXuSWXOUMh/BKrr7FhnP+5jScxdHtCl2wzpHL9RIwONqwJSr0blyt8TTtJtR3MNWzhNMF1oUq8jKtSoshAu0dL7alK2VU4E4D1Nq37SLKdHR2SpnMOnV7ccoWWUTopaPtztDCZToWuy3uQ4V4LidaeG5xaJnNtO7aToWoy0EUFX/WTo4oiUFUB88F0n/9MKO4+XCPft0O0UxEou3Rc5d2mPmQaDEvNhq7JDx0mx9Wjcm6zgxerQRe7Ks0NUY+SY7q3moMIof3ljhy8UXKk4svV67c8Ir4cnejZzpPNdd5tTlRVTqOQgUoL5cm7emV0ISs9a+o5XglpDUDXjcu+n5DL9YrcaOI99/e5E4dXs0my+/u7Pn6P045ikjMnYPNnh+pz+X1Qgx0omIke19qBxno5VvgssxQM7OCRXF4N/ya7gj97xpn7vqJp+c5VAJo2ifZF29IixqGtN6QgDGIhOf9IGlIaPsl0sW40i8vU2N7x01B6omhUJstDM6ubT25aZKt+FXWUqZc2FI2JI/Fag1qiZ/YnXilLTCUvN09XsiX20WvJ2teU6rTWmZ9eldwibp6gj4eWjPjf86UnfqY2m8dUIayKKzyEE7myZPZ9K9ky+TKMVtRLLrdMBr6ySm2bzL0Dnl6hqxcdaXaTnl6ShMILYVBwXvN0ws800Fj7o/NAL5g4VoaDDVK2zSEhpD+YQF51LQ9hYXfWWsecTKU0JB1UEsnRAkqueanROGLR+jZaNow8FaG9s/0xWlMct7eUV6tM+lYMQ46v3zfRAH0ZKYjQFfNLEiFEsVsyFUyjpAOqLCB/29wERpkMG2dIVQ7Q9PDazIbMBlBZHmZYQaAYJK0Ad+dLkJ5yt6OpDI2eU0v7BpJNLRQDJnsgbgjTmAfcRT+YqugPn4rv3boZcTzd5LSO3sLRIXW+vLqOq2J3OtZg1MS6RJt5XkOVNb33cKVssNdfZFW376/xfzxeJst2pZKYIl3FFyIPhnvIsaQPermYF6cQ5T0hgrY5by0/SAqa9d1sVsmJSqEyWJmOmlxsxIL6ANzDLlF3j6kt0g25IakbEFmqcGr81eMw4inCbDuXSLtEfydDOXU3ws3iOeu/hKPDpf003AiCvmULBGcqlZRv2iYUdfRfenFZe+X/bWm5u7fDPqquhEXV93nnEppiSXKCBFIWkPLpuTLgsoICUmQGySmlhESdAJRYUKC6Dz8xL1bZ+yF8r/bif+oitidDedVRey24Dy6iJ0kss4Ufg07es9PcbsgWZtwXZHkRNmOavGSKi4nS5flVNw9id9WpEujyLLMKX/NddsWUg+NK0oBQ9eqNuGZy9CqNmERyg1RWQgzKlxm5J21Uh4zbi9khY9Zib6OCMKLTspqadXouYRivREpQj16sP7oucNFFJrCVab83QvTp3ZB7UvXyy9LX5f40WiZl2gLCsm05dJ7XTWSqjT92a6SVWn6Q0rT15H1z2M8YHAYr5jy9FzGyz2bhQjaysJ/L3x3BhZ+eRon606r63IDSKkKF+x5EMf3rgHWu5biuSiPrrLx19n4okoHVuoKSOoIpk0LALixFU1L5G7xpGWjppWRf55itDLyixC5KsWKstLQM/JW5vDlMU1+wO6AqEz+LM1UEmw+zulzXCrlOmZStn5l5O9j5POOzeUfPleahc+pBVJZ+Ge+RFYW/kEWvqIe9fQ5LtexfjW+XK0M/HfCdh/NwFc4mzCPb9JzCt6s4bPKsN/BsJcNgRvA5xv2heTGcqnLOmwqq/48ZWdl1Zdi1esijw+PashzShk8LgZT26p48EPzIFezwTxodBEfFseDyXsyPJi/GaksDtWErBYk4QL8rLHBZVCjNAZlQ4kZA6OqDLBpn3ldbOjAyPxwlJ+yNp3zaKqwms+qkGOiyvYCxAAfVXHVwGoLD2FHnaWbpvMKwyhC8uwhtHt9ulPdz5o5WvYeP/XkAby5vqmzoajVsXzJlrxd/akD0sWH8aYq1EbOumqwFqesc7iyEGcql7RsTnHWl1qpQWegBlXe0124TKe5jOPXIVX5i3eecrmMNTg4ArRynL4TjnvHjlMNqRmKtu4UoLqiSQyrlepC5XJb3inCnKMCKvdpdkebSMlPBQCey0bReGpoEZ5TLlF5JmHlOD1H2Vk5TguQszonPsXnw7Jcp99f69+EXm/58xks3N7X7p3++3udNeKzZcxXRzPcOiPXm5mxxyZy0YSV39Hvh1SJD+Gv3m3n4e+VaD623N3Vh3Ok2i4ikEU6iiVKnHNbJB4AirAXuQBgXQHJHtSMwe9zLP62622k7jsy90WJKrqkcXKngCzxllGpiPw4LgFZg//B9INQN9rksfnmugekMV4c/QxlM/kkXvS4POKxuY337hjTzLMmuNQeQ8N8YiWG/uUTSwRs0J93ypXEc68lZ0YUTrB1qYoJgYSH8Sxgq+StO6mvnZTJenJfQqa9Xpje0DPt6c59hcezC0mZtd0ebiEk4VUwqeDm+rt8m/bCxyVaUT+mD6dRdbD42V0P+Nt4ek7ctH3hQN6qny03WprI0QAdAdA4EQAJcG0vkcRYCofxuj21odH8FKMPiSJOvcccJI/scd5jHxkIIgCULOMtPnwYqAV4MbkoMNahgAglmoixjKIod2hp6S6QZV1KfbZFaelWWwQKVy15l6Wl42qK/SAkwKlyC3S6bCFxAx6h0DTfemVzKzN1RTnrlBmYU6xiVRg+Nob9iCZ9KybBuaBY5/i4j4ti1gmTXVIrrJ5A3uKZPxVERZVgkmBUZ7WF42KU9ROxGmOF06PjFM9+EM7+2WBV4xzieFysrsuBaS2GY15Y6VCgqkITAG03oEqaJoofB6iDeOpPhlKROshRFETtxDBlk0jIsu9zfC6d1zmaqRLMrwq9W6gDftCHhACnwrChnx2EL+yIweSgH6W2OuZHrOUd8bMbMdPH8uQ5/NOn8uTFZcs/lEfRKUwJoKGmfqiixtse0qMaWayquNpS6odyae18ZM8BZ5rcgY6j37fthbYcgeast5B7j5yzD26oEy1oecw97Ya+KeeE75Ofknsux+HI9MFQeSlHfLRJDIqz56EJcrbHQs7GeXlV3S//dJ7eXv7Rfv0aXz0IyhPB0XEF4j5ybW8hur9A5BY3J86PzUeH66WIxF1PBdPog7eFXDmYf3v2DDFWOgvZh5kMy22lsUEVXGY6WiN/i+IK7aLUhN0QfqnAJalH2yKXun8DdJmn6VOLtoYu1ZG45YHJRUHXOKlAr6VPo1TOTqDnlY29FL4QaSlLrJp1iGQeIBmbWwp1kdraKZH6VzuzBjgta5Cl+0LE+j5MVTBvCBfOGrKmlsoaip7V4ykrcWvG0DboTWUzBqgYYzfGIMXILpYz6uRUhIo18llDPWPWgM6QvQk15nJPMW6UjXZyScBnAUIXCJUNsBVCDmYhiiG24bl4aEWdyD2aTwL/rufUJ22705283fTbdzmnog6yCZBPnun4Nh7wtRnAFzwZySmng1Ua5EY34CnSHk9ycPb6DB0ilAgyZKOhail3XuzNyBTPjJoyaftFJIGrd4Lz87Plf9Z+jJr3zdH4H+U0Tr4T2HeL51urM/p6+1UVtKVj3ygP4y5Ph/3T/H1tPdpGz76fK7++WUpw94ncd7SFeq3coNzLorSnE00jtf7WdVTc0pk3oemdWoit64Fbx79ruNrAZwaYhwaHDVm56u6Yg6M0gdBSGEn2XoPDaLywH7j98Pdy7mwUp2WJTYkqR2MIDVFNbe0/XrA4T3Ck8BttGsEpDXTcLITyah0tEtScBXU9ZvM2odJwjVBJYzUBcaFwDcUe9ML9tz6R/FwIo7lapSykRpsMoyw01umMG07FMl6d+SIKlhmB29IfZ5IzmT//eyXd1KXf4jaK3JdndEMv8BZWsPAgX3/bvB8m2lYZFq3HdSqCuu3gDfxoeI41XQzDyjDUHs04gtzYaqtVuOs27L7j4yirHYJTEgZvSX/MtrLN3TKTQbizjsFnj+zwHV+e/X2nxXZGHvrWyeSG3+AzDPA5DHtNRFJwLJnq6MonJUGiTcq3aKDtq4gCSFeyR6aFyTNL71nPxvG3envq+Ijw/dHhTPHuuXm6uuHE9YNoa90erxlmjiGJXhRWj85+wPS8o5mRVutzbI24ugJ/Qd5sZhxpq31doarUGuTwpbTFIHF3+u6++qFLD3N8StnD8vfBHUJ8x/8B7V1bd+I4Ev41Obv7AMfy3Y8JCd3Zk0xnm+7tmXnJMSCIu43N2iaX/vUr2ZKxLoAhGAxRZncGC1s2qvpKpfpK5QujN3v9lPjzp/t4DMMLXRu/XhjXF7quA0tH/8Etb0UL8Dy7aJkmwZi0LRsGwW9IGjXSugjGMGVOzOI4zII52ziKowiOMqbNT5L4hT1tEofsXef+FAoNg5Efiq0/gnH2VLS6lrZs/wyD6RO9M9DINzOfnkwa0id/HL9UmoybC6OXxHFWfJq99mCIR4+Oy+cfQfKf+Htw9QIWvcHA61x9ee4UnfW3uaT8CQmMsv12TaT77IcLMl6XPwaooRfGizH52dkbHct5HERZLg/rCv0P3a+nXVjomx4+6uoW18AfO2wDEI9wH2wDf+ywDYDvHnD3B/wDVhqEI6Z7jbu/VnlA9D/jKl5kYRDBXqm5GmqcJv44QHLqxWGcoLYojtDoXT1lsxAdAfTx5SnI4GDuj/CoviDYobZJHGUEO0Cnx2Tg8TVI9+b48+x1inHa9V9SsztN4sU8v+UtQo/020f08XGEhfnohxnuKEviX5A+3IVuoH/6WGGuJkEYcg/9DJMsQFC6DIMp7j+L8e18chTCSd4j+iVBNL3Lj64NjTy97BZjP32CYzJQNZWaKD9+FPhagTRR8k8wnsEseUOnkG8Nj+CVWKyOQ7H+ssQ/8GzS+FQFv0fB7xOrMy27XyILfSDg2gJohgC0H3HyK4z9Mb5bhP997Wc++s/nOM3QeKJPl6NRvMCA43EoEZUgV+vS7rn2SiHyCsaJrLy66JdaTr1BuQHT4QRnu6LgHJncPNCU2ExBbO8TRokAUEsyEjCVXYX+EIZX/ugXBno0ltubJoFmuqy8bFOCM0siLt1uSlyWIK4/YPaCgIbRlE9sBFMXOvJiDICH58v3C+MSdxxNEh9JbjHKFglcK2Z0KbTxP2cBPEvjcKdLBOnqEkE6ZlOCtFf4JV/hNEBTna510P8fkmDmk5spN+Wk3ZSkkKsETmhauLm65PwT1D7J//bnpJT3OYiTYtkmgznUkusFhzpDhjrU3LUawp2jcKdwd864431M4JRgOibuXAF336A/w/4KXhjAZxjG8xkeC/xgpetSOjO7+iquPjTser6KdtjFgKVbjKAMQ/RJbNsSpWQ05pN4dWXU0y8uGTFt8DzHVfl+GLcTWIDFoqHJRCwBYnMipk+k5j81/53l/AcskwOd7Qqg013Z7Gc0NfcBIICOnfH++9BTWDt9rD3PR9IAtOm6wGw0AK3lf4fCmA14H9MAIsZMCcaA1RjGDAFBcDyFVK5xkj3F0zjyw5tl61UeVyyHa3nOXYzFkCvDT5hlb0Rb/EUWs+oFX4Psz8rnv3BXSI2Lo+tX0nN+8Fb6mH6SXWLiDzWMQj9NgxFt7gch7fq9fkoaL5IRXHceEQW67xSu69Aga2Y8nmvVI4GhnwXPLC8pk3R+KRoC/61yAjF4vCKU/b9DN8Qg93WQYDOia9Sg4GVHPzfFfwiKhGCRsXKnAB0hUcBEguNZMB4XKgbT4Lc/LFcYrFm/3hjmXgX0uspAaRke3CUfTZ7tokr5ykCvdU3g2AzuSUfbiX32+oCHYNlxx7RZc0IpCNpFPJmkMGtEMcRwei9O5nHiZ/Ci5Kt6hZDVBH3yE/SICvdxjET7WKJXmLJLmDU3ZYuMWZNTdgdwXFbHkkzZsqCQ0RiXBUQOhGRlaJfjWRCJtPA2OsYPt2ld2aYga3oyuwRyHQ94gmyo4O+wwX6I0yDLV1bXwzjL4tlGzSi1raL9mzTdT+fFD50Er/g55KqPHn6BfpaPn+dxkcIkpRMNTG6eYWGl6ubYbK9als6qlu2IYQ4ZS2o1plhikP9qEYRjbMQ1HNJSmnUamsUnTFhH1ywxjP2xVUnbTZXG8DkYwcMqUxlgX2OmbLdreofUJzHkXnFA7TyhbYislj3Fn8pUD36hG4bBPIWVkc8T4lZ4VxXJsmtMsCYW2JxfwoXrbMsQpAJkfonblEzozSoyucUqGkGRvDjhkbf5cRdJwgOPuxglLaiJweBLPSO7KiuTN77ou75lOgjpy++KgEBhKyMcCRJF0nOAAfqy5UIprNOY1RNYBIeKhRIOUciWTClav4TwMUVP85if15QmWlTya1TRcUVNpG3710RxUv/YscQ9R/7EEJBual3DYLXAM7q2w/ZUqC25eClksT9g1+qvCH0K/a2OTK66nbvudqufss5l6EPxPHuNfOkqXH5oFTf2qeGWXV7avH4bVte1vcofd2Ozq9n8t6se/B19NYQE8xhIOJBWb+R29AOpPx9+RILeTfENOuuv6mhrnd83qUDzus5SoRo3kw6bFWfz0efaLgDXkaF5zcz9K+7TrM2S7B4YjWCaYsjH+F84yPkPMYJQLKie4jRDuqbb/gwvOKJhmq875vMQrUbwIiUVryx2cL2QLV34Rs8BJsdGFb5MvCoqN6cU18+T4Fka2iBkZHHv4jfkz8o+ogCsE2ZmqZnYBzOr2y5rFUnf7wUjt9FQ5xZczRGzuhjBX8ZgtAFMivDhMtM0V6/y6CtZ4K7fWIjOvun3tb6xKuAqXc0LerRhO1sehbheERHazvhus+OJEZwrSTwFsvycxrg+qjpqUtzFeeIINsfg5rK6k6LQUfucJzEgPoCjRRJkb3QS4aeOXjxDE5cfjcQtjR+KijkdVq9tfLEhRvz7QaQ06nQ0iuOJnaNrlMhl3OCxQP5vij3lweX9HfrP7RiNRGHaHpL4OcgzFEov5iVAz65r9/3LD+vGsCEuT1bnQsZRNebGGEdhBnZ2Y5A4krcy4IoPKhFXfLgMueZHNOa6nTw3ZhrrdaNRxoEcKoOLRjn6jlEGR2NX/5bdTJRBX/HAq56LP99zmfPfHZX4exJ//v3zx49f+n/1y2B0aX7p/NURZ9HCzLVhzb4Do06xvpcFuumysX9al2pXRW5+CU7JilVTWEGYx/nvjCfoX59wim1ahnq+514AL/wyTeINuVHjXNgbMiWGhfW8G5YNpXC/FM6Y1PytS6l4b0791v6JZ3VZO+Hp4kzmlic9seXamprLTov4gNGYXkb8GtRCrtheeI3NMJzB3Z7YkxvufU8oK27TaNTaEHdbXMNn1NU3mOJHu2QC0EzNsI/p/grJcUDTuzS5+WihPEMkHwZP6LdjaS0js0pihSOmga7taMs//djSEyPrgrDem1znmdZ1X7/YKrnOujS0K0vQiHNNrssSP0LP/Dj1M/iCDW1jKum6Omvqta5W/RPTbQ+aa2ecFjFAM5i0Lvboq1lMmk2P5XlM+OABJgEaNqx4jayzidHYuM6mOe6NExd8cveubD66kumozOXfs1sEAMujGqZ+AL9I5DweKE+uLRl0hiLnSZAhOg1CXL8ljjrzBM7QIq10oviT39CoX9B6keQG4pR9wtz6KiO59cpdyJK3hRy7GjS6yy7+dMBX2WpuFW+KQZmvcJEv4GF1NY8sXzT2E+zDifoygWil7ucpI5pP80zSOFzkc654epzkI+0neddo1kPOxFhINyEdSTJBkNXFP2yZBYLvKi8UrJS0UoK2XCWsKx/VQh0VyZIrXBY/365ZrAJ7d7fY9j7csrXhKhlPZKvIiaw/yPZwrLKNBp4Mzn7JiDGgu13bEF2+xjb6mLog7z4O41VMhfa0mPlR1dwszQL6wp9CaS25DxldND2zy9USlItZLwuwHibAaIoRZGrukf5HjOjs/y3ijAxe54U8Hi4d6ODUJfotnSMk1bOKftFzFl0X51Vnl51v9s8VFbb/JaifqghyjIog2qqV+KmV7AINGglgOU7XYTdbmLQAR7UEiGZ2qX1mrASfcrY/KyEWZ5JUpBxAJMKxqknZFtCpmpTbgM/l3LAW1KQ0RTJGwU7B7pxg53Hr4raUQjdFAk2Vgz1DvLXJt2wUZ/z7yFpQDtYUac6SpF4G1weLYQQlUUUFtpNbyKVkl8jj8uRBjjzacd0578bu6333VOc8oOkml2vWcVzJrAccIOKRho32D0dZ3TQVClIWpEUWpE3TdaOhINcTQ0GSfNQjhIJEIryy6/c2miY5F9C/IR+Uo9wa5ClHuQbybI17Jx59R97x/GS6RK7xXq6SeC1e/0RLNR9tr73kJU9HyfkEDpflZJliTh1wdVl2f2MOF63urdY/p2ND1fpnHzyXB7j1j2nLon7Adg8LSDHpQQFSAfL8AekBh4OjDIwHhaKYl6LeRcqGjPL6qXqlDqPIVx743aSWmCZQEdpDAjsPSTxeFLtM8Fse0u1fU1qpbrarjE//JaUd4NWQvWSRYjRWTYOuftRLS09n7lRM9XteWtrB2ZobQHjghBFLZK0lBpiaXhWbOxMotiA21xzqxJzIjmNuxN3B4+KWSGarXK3zht2HmwH5FMk2zoAiia1mwPOH4jnPgBIquONsXP4dYQYUmeEK9Aq8KX6qLj+ll5uYazBUTvnakr1LlZp86cZ3FQpvkwVVofA9ANGm7xunpha/DIcxtWI+ADAkPk5joXFbpI0VIhUizxaRntF6RIq8sSKrWJnZkrdbHJidstdSihVmSlFSdSTMU1K2IZPwQTkou9Y2ZcVBtWmKVBG4d3FQlnX0kBu14hvtqoq2nQnszjnaJuObyrnuqPE1W/JCQcUwnTXQPtz8JjBMbZjfRGZXzW9nDbtznt9kbJKltaHIlL2Bul3iTLFINVmkjuHW3ubUWClJW+QFl/HqVMWrW2Q1Vby6CQbJdMrtTkcLUdOOFQgVCD8CCAXSqBUglDC3i2EYjBRx+6ExKF1YYAx6fYTD/WGwvA+DwfUF9JtCqE13v9Nym5IYmxSdXmPoFFlcFV9rPVJVfO0d1TZ13SrrzR+z2qYjUvOqqNAHwF8LAm1Hqb7ZgqJCjpgroXzRViJM+aJN+6JAM9j6Fy1wRsWkCoZpUu/hXflW16O9ttWRvHSXwK/CWQwypN6HllJbGArbsUuHs3x9oyg3R1r3ydLKa/cvO0ktaiU7zkryb8hoh+TW0oYfMPnaslmAdcos3OPlXjsiB3i1CMJx/vrA8oWA2yZeD2kXu8rw5NKuLf51GbYnk+1Bs64pcayyrk9nTaGiZtuAzuVBJ6vEfdikNFekkiQGVQXKzgRyLQiUNbYkAJKENMrFHDUhzVWE0EfD2Ueb2jythVObSAapqe18IXfGU5tnSKY22WtFDz+1ieyPDGMq0VouWIdfEZj0Va1HzLN2ZZSBqgvSRoOpUjz3kUDGhTktQ/oOiYNmeLoiBaQwqDB4rhj0nDZiUKTybnAy2TwJUlgs2Amvp91GkziZ+YRTL0j0m+eCK7r3I38KCXH0z8Htzf2/lr7RoR2fbVl2oihY7xtNszdMjedzgS4p9aPLNKA5RkKkBMv3+DCcUiohlXpxslG8Z8QoAd1l5edIWF3DlLqyemN8oSvyhfd+muXLk02s4Nc4fgete3IC9KzN8tOdg0rPE8mJu3iKhZaMnoJnKApxvbTKGNvpSwsYwOItpkO1fVPMDeiNSWxVqLuUkHY/nWXVFzSLr2wuWorrkPeGxhTf91v8ksP208JPxokfhFv3NRh8KZ6kyP3e7uIrpEp4JqTTey9Ot/k1vUWaxTiZ5MpPIXZLl9f6M6xi0TBdRhoqKoz0IWMdVKkrIIluUZ9vBLHXss5DkM38ed7kARw/o5YWG45s3gC0hOn+9ViMHRN9xKGrb0T9kDFKt1LlSTBdd9lH1gRgcDstXb22HtAcpP2rgRgK48wSL0VipTjRSZeiMj/8RrJERd/1DdN09cp310ECixReLOQEjw+/IrzqAcOSuiblNChdP9zh1OmHOA1I98M4w5Zr08qy1K2Kfm6K9fvpvBiOSfCKn0O+jk5IlLhYRV+hQ9l6elRI5DHLBXCsDHBX550oXVBimmjILGLdpjR4VbGvcgEqzFR+5ofYy1I6fGgdTguZPI6ICNqixa4kjeKwWrzqpUh0TlW6egR7i0f+aFttbLrXk+qoKy5XD6ujYrBIdBmVnh5cT/HoZ/not0ZXHevYuiqGxcgqdzGeyqil9yqqrV0ahrOdouqOA8DHUdQhGfqjaSngKrEDDYgUzEHVFFAGQDLvp5Kwy83rHA1VA+svpb41/IE0e4RUAMdSYn6DfBt0GAjqCBHSqRyw8sTTOPLDm2UrF3NZnnMXY6HnwvsJs+yNSNdfZDEfGvKT7DJJ4hesG6GfpsGINveDkI0gVQPW8DXI/sT37Vrk6C9yLv58/UoeKT94u9glJlRo07rZiZyInhVZxDUnUoYWj+da7Uhg6GeYMFieJBc1ufQBZ1JUTKNJqweXaqUZXbvy57BdFj+R9LJUIKFj22MXWrZrdo3KHxfXKgZE6BaJ2X+rnEbyQHjNLcfjPcosxvc/L2Z+znqTuDpvlJFmUprGX7Kl3EkvAVJAXbvvXwpgEcOe9cOZyFYFv/1hSX2zGTLXq81U1Uo3lO2pa6NiOiLPh9q0tbbN5Iqy2usyAOX6pgt63NWYP5PtMZ5MUpg1o0nGMcziLtZtZ1O6Z7MI6ppFoxmzuNrMyJXNMVh9JYk6q2yhRx9Aejr6UNxffjG3nVVIeK5rkF1KYK7qaIUJ3h8sTAWL7WBh2qcFC2Gd1SQu+ELeBmfg6+LC09l++KmncVisIuK+JX6ElkqiR/HJz+CLL26mO4o7QanZFZ4Euy6rCQ9qKd7vWGhdE9CaM29MR+/0mzvAZP1bA3QB5yo36WLY7bGl2knYUsrztM1E0lTQuuaJO3+DkQRAb8ZKAj43uXEz6SiN307jT8x5cHRzS2CAdedvCwzdsHdEBrcWAAd3INyjIqOKixIl7UaGdWLQQEs1bjOltVYlhfMBSTj7eNjwjoGN90eotwDVnrFhGieODZNsMGwKHJbLBhq5QHZtaDgb4jpNQ4P6oQoatR0q68Sh0aFxdoWNDdg4CrGJtDR5+7N6UFFyfLjU8vxoS7cKRmPxJNS4Fnb7YYg2QosiZjMvarQTWhxQ6mDRWwOtHTRZ/3v69/O1r//7mzN5/bnoWD+HWUdMMinDiTSa+OU7OmGQJYtRtkjKpGl0t+HqXR9iS7GjMK/2haukZJ0gwnvX0eNFo3AxzqsRcdsTCWXarbXHKN9xmnd/k+LoX5Cnl+ja8K3sT9hPtblbYTCKvUww6eD0kWAS5Pf48j3ddViCaJKgX10Obv4L/oDZS5z82mkgynqu5VAXRyktSFNs0L1FD9q7LiSArEAw8UdYPLPqhm2WuK51d/zYYeyPU3L/bzDfKVZsG5tXi68/xWlW7Cnb4TZjpiJxcaO8XDH7hdDzxni4kK+0jFOv3lpECgvIc5Q27yo60D7zjs3VKfMMEvGspAeZ1OljN7nuIUHIuv9y/3XyDKZuMP0z/vGfbze/XYn1KfeYq5IfquTHuZb8sE2zy5JDnWXN92rND/qyw3fW/ECHCZ5+K54Dlsx9PIb4jP8DrLzXjutMsjX4NH05gOjJS3rvPe9EK3rv9PQ/s3b3+U/trzHAAFPY3FKRFMnMjFixVkSo/oWw/SUu7+mjj3nR/Qt+5de/EO5fMAzhMPG8gD33v/dA8OvPnmqp83/v+7873Ppb/Hvnf07b67xYf524jWO31dPvndk4DEW2/dr3Xpbx/H1aOXa/7zq9q+IfO9zs3f1zb1jn2+fPXhJ7/d/9UlFXn//cGXr9+0j//s/J/96xft75eP6vXQj/L4RdxnH7866/2KIDs/efeREqv7crIWablQud5VVjzvn//LmY8P/lI/8zhKUYtv9/L438ufTx7vZ/z9e/x7rd/5nAZ9gTeFv3PzPN/LzS6/RnsV7PnqNYtvqZce2dFp01rvVWj8NzLB23bez/1wl0V1fgwDZO/7nQ81v+3t7/Qug/v8LCNFT/gtk6YEznfKliNdLPj+H6H96vnneQ/fynGCwdg/3w9+vi4A0dGa7zkullRTMcnEJ3pyt0X3CEfz4nXDKTYM/lXXAVm2YUhxf8gpbWw+6qLg9z6jlIEl9EO75+7LLcKtOzSo8yoyFv6c04UWR/JGaK0hWZOtjc4RdJYJvZIX1a5FsaItK/YKbYUgNiz0uAlxhfBQiKeeGyfcbJbJa25RAM8NbM8nmxvDL1/KqyeWVvdzBwxLgGsziG/W1ZEEXdjvCRK9r5L5tt1iiNL8KbWgxRFeLnzgalfVHuNDouyM1C3UxFSPKMfEF5Cq1icu5sQtO/N4buPtJIotpM7ZHmkO5681TuIpAJB4kpWp/jQxB4G74kjbxLiyDrG0Ol6aWzCk//3gxWYy1nstOgvuKFKefHcpgXIuXqzbZsK2/82KNVkQkptDPRNC6td/TadBP7lVHaCw8YvqZ/b1VVn5849NxImxD1NQfa5yw+zzwZruLUhGN27ucjizLV6ZNF0PkbV9WZfY6HoSUsjdnMr1FKRLt/rOH3Zmvk58VmAuS9LISz1LpNno8RS+0UDuPxY/08u3eWITcjAvXyn2NYORRKDc2zaaLRibLvS+AhT6KwsfuOrkPT9V9bB4mjTirz7lvW9/umZvW5Sp4gMobK55fuvOdXsOaCS6EMC4W5v8tovMAtfQQecgJLCpQYeo1IHKF8hz8QwEQaRD4v+7o/Lqa7Ms3/3mThOWq/GYt1x2bqbDAMVdr2xeJsbXXxPXx2LMACg71nkdRvx2qir+uFTUP0VbbDz4fnmZiDbW0jv9WL/SLpc3Y9roFrEVdgDXLb0/9YKW3mbYV0Aj7W8Wg5JnKGlvPmZLZ8AX8LzSUiAyHvWhjBxy2Q3+XXeQYi8OxufkLruBr0fJ6KYXWp+rC66krGTt0PCAgvCIuPEqvDuSawd8p7/zCSvSEYa2ZHQUGs5wNNNfJuVe6eiOhrx9Kzz+2U+tnH59j5ZUgGH5w2vp6ZEWANHt/zcUeDyR3RsZlghusg4cZNzD5vMXjOkcUrN5HygYf/6ocjFzJIjY8Ce3lKkh7RFWqwAixwjHFhLNFFPwZKz0jjgVmGkj3O/wBPVSNsSyIG76FjtC3Gm0gz9z6oXKWm83x6w3ChTA5qodfg+MeIa5bJq+H1bkUoNbqmIi46cvZrkKgwHiHeMzxvPMDDO6oFk2fm+S8Q0YRe+pwT5Dw2IKCzXYxIZkFpU3hzjBjr81TkBsxFPpzy1XlWhHt/e82P5wgrewSK3QfVGCq0yHTpXWw7fKCpjosmdwIT7DQL+cbZM8y9XntxZqtyhrrep+jzCIBBvSpwq8N9L96yd2AtghKpBXcvRjWcWccFZhP/bd40Hz5olcfqvGmeH3ZKaNRyclcvBwS9HlfFnZfO93LwHPBm42WIEP62oh1G4FkYvPMa18lBc1M+y1l4HlQAYPLJgiXg0ZacAj+UEG7tI+0zvG8Ript/Lrk2OqeDD2/2rYsCa82Xm1B7uFP1/QCN/YxqOqphyVsyiL5BK6yyF+GokzVzd0UAAF7hbpdEIMF0+T5Ec0qIrYjEbzffCT8UaFnq3d9IArYBdmyVdAOrzDKSpGvlsMJR+gH9PVTdoYSvz/xc/yqwAIF2N8goSa7nXXggExVL4PZ9yTb4nUq7+7b6q25jYCGBFASJl3Dn3ys9vDhbpeyOTowv8FSP8XHvsL/b8pg3g7Gfxa+X6Qiz6TmaWiP2BdGTQO4ObmGjXGrrfu4Pb/P8ORXtOWSfKSM+HzWd6fRS/XjezvHSR4vT3oH5CpjXHmr/nPHKw8RRyOR57T3lyirdHF+pN5QB8X5/aNt/WCaSHUYAcDE7cHi8oNIhD2A/nUZFS2BdTEo7ZHaPASEPMVF70TrgfgtZVB1sx5EH27zm/9XLnou0a4WfUbCkjK74GvR2XTB8bsjAnGBieJjW9q5TTUFwGwE7tzbUhC5K86GWuAUup04pttBK29PYkO9VoTr7LQ9keYyByV9gzpp1OP+JLLK2KokKV/o8OF52+csMAJMmD7u5JM0QdKno1gqZKZgjGyIlmm6KUTHcHwxkAMTY0fYaAOhRtHZYyqhwivIu99B/W8AcBK3vYbAa0vjCMvr8L7FEWhWFhar9iXgXYQT3MhhPTDiAq6VQ1TMEgAwlLzmC+iYAP4wXohHnWXjOJR5SbxpgFUZag1rMjeZxRr+zY+MB6QtOaOikdrx1XIgxnv4HLwltq3qfQaD1GOUHsKPHs4MmiijirmxdUOxLRYqir8fMPuME5gWMcz8DOkQ+s0QuSFX7RYZDyyfWJEoOgy6BGplEtPCW/hsbMDM5UV8xrH0u9JtoDEpxrvSisDh/3O39xAVhfXyFam/IiT+aEDHXUgJvTosNkpVWP3oI3iZKJG9oOwLUq+TWpn9vL46UKXpDtvLYC/hDjhYikX5t8cBWGYDWUrM9lI/KQ/BLoTsZ5v/jKjat5Y7LLFrg5VvIwe75zzvZtJI7GTfNIxH/N79WKnnB+p5YWi2bPd8dNCUsUmgipmuhPmz1cSdiqILB/msUmWLLmrXX0j6j5IqQfqRpzF3KG5RkI0pibmt8ew4TK1mdmy9ka2P226RMjmYs7FVduNdidBm+MVIjC8fxBOnYr3EvvvADFEzN0kTZRo4WDyctQCWmF7L/+0oqa/FDM4oD9FZr/JkuP41XttKTvlp4Kg31NXGz0KmicB5wXLKObx84vuQPUZkYv7HVtQXbUV0i+qIPkXw43/24PXN9QRTr5dlWjT4cniCaqVtyuqGkqtEsPSBYnQolLKzA2FQySVfcu7/nuc24UQx4QR+OOi8vCWOmB0MGhxX5xqjnpY/bFyPu0NR33Gu+vkmJnbySyzK9AhiH6I+6tI/M+d8bxaPsyo8GnBqAY2zhlXjY64XQeb0FqicKCbbdt+Kqn8GccLLus3Sf8ycsMOFaoDKtBTZlP57QVr+vm3M7GDSYSE950RuIU+8Lo2N5dsTTM1/D1MjD6J6JhuMZcHUZt9zv1xwpBeVpXlUr05FL5G8QKeqQua50foEZpd1eeNQX07g8JDM2wwApJiWlGKozM3P8xK+zIuVlKznK6MUsOze+NUx/oUPp1HQ3v8JBhI7m6u4XpN6+b/unle5HDW3E9ZJc34znS2RUMaNymRxyo7ACtKnSmBd5K+iqxvqbW4AnFd4+nh1kv+dYQD7IyZwmD/FYgxM6rM7vVJr2mffR8l41379FMEvHg+mNcXYvR36et9bv41mh36qI0VixgU7Gvz0Q/fwSYZ4wwbiq66In3stbWZzrNx3Ikc93F70v67vaFxP4b7YksycQ5c99KowHTOVvDure/chcZLRVspe230RaUgFcnIF4MOUDxwdmXL8eqKTEqG9XHweBWMebV19ZtvrytUD65P+86rByapiPk3jvngT43O6QszJ/uU8ccV8TV+q+NX3hUcjXe8CO9ivh9iZBLJ9SSMtuAgf9jFRnEvmX1kRu84wn3CQYdMJePyHbwV0Pui3Bxjh6HHc1q7e0FsE9P5/tzk9IJ6JUSeC7/WIaQJbvF3tr4/lr9QBoyI+uwbMpNHcV0z/FTLhujUYuOr5RYHV4qguo62J08rUK84WKOdQPhPqx+JnTIowiF+H0f1uaTdF1UuDLe0kE1lE8q0KPHKoVHEum4PPSHlIQecRNCFvvXBAWfF8lYLJRs3JAy3xkJpwb/LVZbdj+IhZVc8mjlgch7J2JntXu/Zwu1RRsxFMRq50O5uVqL+hDb3l41YOrlm3JvgdcrtzlWsEMX/nrL/2tcI+C/t51PFqT69W3Hn7anay3vs+ykn8IprerM1C5l+gJMd0S8pesL1jNNmJaNCtN97Oz/YcsY2SZtOf/QgieLZWBG3JvCvvEm5aa+m6sUTrU5WdBAWiA5PO8qql2vcB+ovrflwoIp5M7yHv4mNMoLnCG0elCJmXLocffGop0dUtwNRLxzMx/+CTzdu/JsffyIPk3JTg8ZIp7IFjwlJEf8ZPvuyyqBW59UWGxmuqZ58r8jhX0N/40j1VMvIsMlzwtMiJHun2J78PnzFNLoiAID4cL7YnvQn0RC7LHHp8IEX5Mgx4prycSvgG5tcRib6tfz4xzscCv8b0+6gbqakAFYEi560Gk8PNZOPvUb7dneSGeWQ3p39+zqvyYFQSPVP/JdQza0b9dkA0IegKwdufV3y0vLC9cl+SJKOOBH0XUpCJRgTc6c5XERllW7deCcXP2H/EMMxgYSOGpEei3fnQdffF5Pb8y008lTDo9GPMNgBNyto4ZzQQRbNGH+fmLgcYy4LhooSICMNCJSmk18WHmxqhFzq0qykvlpd6PcxSuYLs3LhZvwTtR9m8G76CtrlE6UYYgkaLbGhbkhfyASseq9IzBcXMJca22OL6GKCDuoniTGvqwfV7fzdFDaS5pfIad57Vs7kz6i89Yp/bt8CZQHKud7nYDNg4SH4NpAFvKSTukKQCfeGvxgRGwCB84Cv/ALi9V+z4KnK4PFlzDcjeTAZ+0svUSK0XvKWyRPv7g/uJBGvUhuWd9/Cbqu7J/hB3cDXe4YVWWuYHtpov08oJNdUM8iEf+Fuerf2RiV9H6pdRDrhAO4ktKaHbr4sUZn5Eg7EpCsWmCS0Up4vEgDwEiJsWw9Vhs5BdFL+WXxwik7dMK0fJVBUQfM6mavySAsmwSupBzWK+XIk9iUb71FhWyaeazCl1dNk+23X5BTbAXHfSWjdHn+1h3o8/Necvz+XLK4e+K4ZrNq3NHEDj3uX5nW8BEMsCJGixMPVzxN/G47ysxXmlLZpqjr7QnOraC0dd2l70db0ag6uVn148iR5FUuq/W2zmZecxnRH40o6NCS0lS9BtHtZgH+SdUhIikGf5LjjFn+FFo+zZIBWOq3qEHkCZVhm2c4ULW27aQJtGjj8+FwV18CzXOfhMhVBZRMH0pPFp9v7pTnLHC8H+skQWhyjMlpGq57VN9MelPlIFcbaz+EWV0ZiqKaApeHE4weGm5AOmvQlVen+wVuHpvqIxF55+JYVbD7xK9+iia49QrM7MLwnE1m/JuFMRfDZblr9DK2nesQUJmvG6QfB78CQ6VFiSLKp8Bysb4yPbfygw8ihNygnz0gogJTp/HE4PHU+LvyYABalgLn5sO1X1ZIyqCP2VQqxzKvOXJq9bwozIsv6XrtGxhDY2NkbBbdTZ7jW/LJF+TrQ72BKzJi+mHQBPPIjFah/62gzplFI5Kv86rdTZa4IJkUBibXo6v28GmekUBFMiQyZNwMJxrQ47yHWWkacf425t4qLLbAauzracnMW5b4X5/I2K2pgHT1+qI2lgwZb3IjddRpIhNEMpa7e+HJc5sZdZVHfwjC/jZGFoub7e6kcEzhi4sFPg4QaZzyof8YY2w6Jk5Q/LdsuDLvndfCMsf3V63UyEqJaPWStO6CSVpnheoTmOdA3StOqWzBbV6DC+2TqRlaRx5Igp/VYj6pi2I9u9nckTv+e9brjvN3tnfz8UxJvYnGc6ZaglyKQKbKfPu8r5aKM7umXAEUmJsHqiDiblz5K0P8flG54zqbyQpa2NdULRVqrzDVV6+w/3mRFjBC7H53JbBVOZlRGrRlcW+g6fZOE4jZEJ6rhmfD7oDMwdmymRa9Rs5c1sN5dvYHmLP+Zwf8dcutOPpT5C5GxB1EDebWyUNz1lGkVSrfQjSSie0Sc+v1l1Z9aUnloXble+Uy0vam/UYUIdo2gerpx8QEyqrIn9njCvtQXsdPNRwospLax0rQ3nILS96ngQd7XwkOtFG/anUIMh5I280G5LRYs/2xZMNOntBiT5a6Z/qaGQ/Zec29EV1SAOeZCkTxKaOQ2NCwsc7TCUj5E6vaGlPr5kWNmDspIAbNPtndaWzaZiQIdpnwpQy3wnzxvDZObsg/8DzDm9fcSSVJ3YoLcPkWSPDfydQWCZlc7vu0k55Y1jSyCr7yHspHR/q1HXyKK+KLr/nGhVv8/orYiZog4oNdkZ4Y8Mc1m03i6o9gPqCuOiqzWRbeM8yasvK/leWtmu5U+huqtHhpGnLgUPgyzew8mUkdmmRSpl0a/ZIT8DTGejz0f6hMh9bYAgG6qSUopuqhxwdLvwXIlwjsK7Y5RCOrANysHFKjX8s981otULbeSDIRmv8XWH6XnycYRA/LgRJk57f6mesVmWtLl435WOOe3BX9DgracN/2Di1CWf8Fxsv6TogmiekSabFylvoXysZz5PdqW42z1G9/tRHgMll6iNr/Gd8dC5kZ/Y3rxm5VSlkoh0tktytEwJiw9oFkCFX4Uddgjgo1PPRityrrthzsO0tFHSjDX6PjKNfbnFmUwLnspDRLAS1TvFqRDLlMb/B7wfKAZWN5vgktChAHVqR3JFl8bZS1ub123551uLrOn740OVXxne8NEd04vkwm/nhBuQZdSBXyBwOQ3nSE3m06AKx8xTO4i99DNHLDtd7+ESjr7nyfIJD3rPgk3afJkTlX3vD/yTMmGG6y9SxKdehmvb1O9JKDM9ozhh4nd9MAn0AIqzygq0+jKNEgne3qG8CufhPspscrz6oXFUVUse/0W/97HTr13peBGcy7GWfir7rdq2irUOzDRBIrCkvMzyoL8UtI/2PeAsz69C6GfLFxE1ttnvsYYisW4OUKP+jnL7MIn5dfX0wNeIrr6H779y5Z1+2WzOFwmtcD1J2adYbaDDc2YQl8V2+113EIEirmPe87JGCtH+FFhm96bej5qSLUrDvM/Cbk5StVitd4YhdedbdR2w3RH5p3WeL7KNyQy1P8Kijg/ddcvplPljNBCBNfGC2f1tpp9a6Yy65eQEJgTSk8uK1wMJIInj9XpEjwZ5VUGKFTQY5M0rD7BGNLkLV7oOFOQOQzb989vKL3Mke/F12eQX1nF+ZDpW2eKsRDQJ1NJc8NHJQ7qzXLgJi3Mrvln3tR0oav9P4XqCFn5PXnWR38do0d2WLEEe6er9akK+83ib+SHGRGXwEh0wXaAV9djM00+9CfjEMFFmr6cm/kYUNGRE4BamnRa80fPOSlrD5vIimK0IjrWFrigZzeCuJNwhlXU+JAM1gFDCwBsyD5436Q46ff4jBXtletAYoaDLIjUXFYV2zFg5mky+lf8tfu110iuCGIFDYyv4Armgxa584CDLAc32C+uuu8M/TJtAL9rLf8YSVWZCiSHKdUu5DDwh1Brk5GebPa4R4Zo8Doc2adHVuSc9VxVTC0rt2x4HS8yVDctU8yoItZYsmQV4zkrZcJrAbind2qgGYH/d8GAUgvPAFpmUm3qDkQDjGFXtsXNni9Hr1a3K9HauBWvfAP/oUzPs2kI8ua0IojzrAzdCfYqa63m8+cL0RI8aE+OPjrNRQ23G+13blSGAVVF/S6l/IutBbae0IdlqMQrKbNmZk0+usDtgnUsovU+LG3ZKkcDckTnDrcdcUD3DTAMPAfdogIcnxXWdh/T680fdivsMgXVFBtfmoUXVMgjKEjDRgKIuzfK4MJyPdXt4APo3vdcmd243cMI5N6XupglR0nHDM9em138PykdWO3eX5Y9vBgsQvZADrvX7r4xBOi0O1CjaXGW77cMriBfNvRghxdIkNJE8RhH3MAwoEIqoLZqvscTZGF/Xa3yvNkCy0BVGEQOzh/Jk54QrHDEIkKZLcxuyv9kXiocvGk+q0vO54Hqs6tU7HSnGEhzuofq892srrsZZpMXvn2QINWPwk/W6LCCjdEW9DKQylKkxTIKECmaIxcMMyep2jr5VEsMKppi6rOjvvdaDrnmGLqf7CyATZ9SwrTh5ML/IlKUGii6yG3idRuEr5qcFkPIuDek32MAnYypNw/jS1CjKAqw4KoT78EbccDnqW/K4VCaI/D9S0eVs0/lf0+NCL0X8jRWwugsKDH3lFJDG0D03zgSNQSMQxjFz8OTDbWf3IqCFL31y890CfExsQbp+9Dazm8udUGopMz0UYuZ1fq7qMLFMyFfp+SwiKJu8PFERBBUPadUzvR/w+7tuAylQH45Ss73Ywq5FZla7cd5j/HffIvuLA63nCb80y+2zhURxSy2lehjtwRw3tZ7bM0VhdCBnFaImY72CzjNjS/Sm/M5ycsSb2PxWfolZNRQtuE9jntHHXZp6ZPv+us1C1zfGfx+1uufqWgOGjXP0evNddGNwAxgkYKt7pd2b6pshdpIlDxq5+pUD04je7rvLK1LxoqlusPapXUlb1mg0uFV/DZJ3ntYaaBip1uVjiZlfn6+Hb9qcyzRo0J/h5Bhln76ccPWwPQn47KQzemu8kjJbgUtEJ3MTHYigvrmm3j8yAvoLz4jv00Zoq5cORaJEBZxjS4Io0HQTJXV/cX/yftzVR74Pk5eibi5CRHbDRMHjupp3LQlzZtxmGRXO14QuKnhmaJ42wVfLU+0MREpOG79H6NkVXjwaLUoxweb01sIJ3kHNuhCbxTJy6th1pF8ctVN2dZhreu9tI28QA6onvD/ad0FQM1zFhCj68NDoqHaP+kJzAzuvgJ/Wc9lg8XwCHgx58BofFcK9t5Isaf+KA93Cq+ac6Gr9x61fsZkYlVknAWwWuOgsT4hZqNwtUUDDypUVaJwSl3Om9x1FtDTmYT7FrsN9zWxrZrvpyXX97UCyNryw3+WwPvf0Kl2wNTS22e9x2O4L3naAcjs1EVuOdS1/JDaJpQEj9M34Ofs0C6J0+HsCU7GqX9sYjVYYa9jJXdOjitSX5DkhAdEkIyZRuwooNtP/3/0VBWaNVJXlZDr39JlYtFQ6jRzyWzEVMgMiVv7MCun26kcJ5nidxBVWHQAY5ZfyrjJQLp3qvECYvNTj+LpXLyQuV1x/7bVWfokGhvnxnaX6aHFxWJlxOoq4+8McTDUgZ+q5fR1IrQ6k7vZSQwJ30CoeM0PYz6+dkd74HlJtWijFXY4Fc0TCPN3NuuGTaWRTR5fJZIkwGORbpi720qf1f7IT7aTRg93IMhU9h2jLIhIFWEFlmPu+iLJdZl0Blbr9fdDWD2rB5O3vzAYwqe5sd4IFZ3o+4sK56rMm8N61w4CZWb3sPlfaLqkdNja84ri/PMcvVqjhkjgGRDsrtAl0nlLCD4on79TuangjzvmEYX+xZBQ5ABKF2G/W8QdSc0ybbLtHnu2R8nEKQD1HktPJmuz8PNn8nof5tidJ40WmDczmnRgXDI047DN/LeDyMWFjsIr+GvKqv4zKcXQXIidlnbIm1WjqjqulxXd71KTB2cNLJ2ZxobPhJskWJoM4+mTWTPw+Bx3aNXm+7nbSQi9uMi23Dozqt5kVomy8PRsZqtf+xULNmx3h7OB1LlEb+0q8xCOF1yRoaJCnEQ7vJfk6XP8ru+1Gr0RxXNf/dm1EFmBqbjy29cZgIezlORiQ3Pmd7V/UBVKHfuoSkaPTJOjiwxBYE1tYMVaUm184a6mwYkMvdIdgSI1OPJI5hHE27nV4oVP+AjDKSMDWYO/eFlb0LuLva0dZmbI4tq6+7swAxDINRG+d539VqEI4AA04DPcjkXW1OkYZLAZMIVQ/0km1ZNe+0WrPBGKoFyf2BDxzHsfBBmI5mcMfWM1DNxJNVJ35nHumBFUFr4exdGoxleNNANz72XhtBR6oU643WU8Hd5q4ON0X/8Lj7nctikedBgnP4bjJHxaNzJ3IA9JlKLc/19AWazNKAdE18eQNBt3fYbSTDfdqv3rB9XglhM29dpdPuaHkNOHa8v8qLMK6coAJ8DqyPtfW68YnD2apuFnR/dLaFhlsdFW/H7A1iIGLiW2bCmD4s6Q3/WVX7Fmg78sdNqKO/7LSk3TWsr+CRTCeRmQxtRtIcyB0vvwqU3T7QSxSo0vtueFdgy2sRG2cdOgi9BXyI3JOINwIkxvJ8fLV4TEr4kGpovMQb+nB/D3gq9ynJQc/6QhMxrT4z3yhj+HPzIMYKvbpEGgFJqacFTdKo35vKVHYBDulnJsjrm7U7hMo7BRahc5fgUOHrOB1o/XjpfL/4bxBzVumVA9Ymr8R+zhJthpsMgDkv/BO39u9ajnRKvOpEKNwswbr5l/1omO6QmmaHWcdteK/s3GjBPGvDYS+OTcl9g5iQ3YOJvS5SqxQUd9GVr0ndqlal0W2JrOsKK967VkGj4/LRtONv0PDIaBfkQC7bM90tuYD98s5qcbEEz+xpgISXewLSnPN5Tt1AE6YEQWx7IaKgS2S4OZuCuRJ9QydN3SoXE+VxID8t3wWMJ+Hw2OlEfxx/yDTe/UsHm2fL2wFTgRtMfGL4i2gb0XHyHFd365xDAphRuKd2IleJZ0c78E02JwmGm5pEPOILSZE1vC4UD06HQVYaN6AkJtIMzx5wh/okDN/1Osi9UfXlpFeIM+NGO64p4vgm0ChZZEKZQ2a6yqDS8AX8aYPvxVTsN+h3Deci+OAWyZOBZAhz9Qz9/srj9w36iAIXfVMkaJoli27RXkjnG1YpH6xzviufIBYGe2/49Y/uDs62q4me/aDOqupRJZUYjS69ZZRDI11C81aNZQxeFCYPkMKMDlh2Q0yVFWhe6tGVbFtg9S9CCCf99Y5Jb7lviKD5wmv2p33DjRakiIbYp9F0h8JF5dHuVg44OXQpdxEqutYoNdtl3t7R2qPmBmA70Iu3NArdLbXb74TZ1/yP6Ah2RTiewdD0C2aoV11FtvzEOKhGff9XchG3XrwnTPeunYEa5GqrcPVoCQYD7ddqvxMu+i748xBjK46H0nvGcB+DLAqfLLU8bUyiuspCGYsn8eDo7OB23uMmWXRewUzhEauoFUgZlgrbppRZWeUK6JpheShm7JixneS9mjaG+GOUD/IkgcVddcsi7mP3xZR+sJAThxCrE8t9sx6oY5lVr0L+7zr4dvFjCeJMPE9d3J56dIRyOtXMSjxsSYwLiNOsqJMkSMcGyuPfKoqCIpUqPlwginExiz65UN1vhaOLOmEsDn/Biso9OnejPBn3yGOIz09cvRNNgI3QbSdWc3s0BXEuAd2TCD4tWs5XoB2VwwaSeDCUBiuEP86MxKFRCh9tjKpnFQxE6wj4V7bVlkkH5oQa0LQvxbZvNfhYCGG8BmCxS+C5bwIZiK/uLNNIhwG144un5ooDg+S0WeheQrJCZl1MjwT+GX5fLJWRNWfkLJOzG27gXl5IiurFWe/iw1egtJRYIdC/rRUhdaj0Z9vJxqei6CwEFGRAD/hxhdmI51GRQCKT6GxaCNKyTorsdz+apPMtS+QKy2qyaeRRoyadVpbFu8xvz5b78+5eLbplUDaxaNu2kk2yIjfV4wGgCG4X/3sEHDJOSF9NL1ycM+ce3sE+Uds2rS4oZD9h3VeqaZ0giXyXQjsjUx6BSHyc0T2noo8Nc0ldX3ECtkq9j+mq5wF2D2M0gM3sFT/vt/2rJzNlGTuEjkVw/KCPbb0/V0mQ8bKJ4PoJZ2NFbcVVOUZpRIw+ZctutV17dqAHpAiixNpNKdVuOMy7W6E/em+JOS9lfpscLmMzbyh5iCCUcdxhqkItmezpNXiwBgXZHX48HF2a//RekYR2EF5LxN9PFK/i3DbJIupHeBWtUbB/mEWYaB9JMw6IroBeFDUzLyFM1fNIb+xc+oDutuflKwi/8tOoWnm1Xja07QSK7ZneDpiTyFEbvLkvllNYbGC1LI9+GjD3JSmeMYDZfvg/7rusXSuPZz66OGfVIQcprlI+T5JSmKMsQJbbNA9D38u6rknXIEB3oxNAVDkQyYm7j+Pd34BOXqb3sNzP9V2oTx0D/fUc9GsMrj/Hx8pVdWTjtbvKc2c+LlqWIbIchxNK+43DMipxis8wedq0zy+/srrr9KXnLlzOyteWuf9q6SvqqVy9CiLXq0aRaSzymSE6H1WmkDqrpOoBeox/iqFrnLbt2CV5fY6hVs9Huj7WgiDSfhzWF4Ecua78QLjeuu0lWFYeQ0f/ZAeDxYGJ7VRqKHMfV2KHiDEIg+vSFzEhZ74iU5/pdRUMiaqlbxAJzilxCNS2XOy1gwpBwPt1P+AiiUX7N6WoJzZdrxiVOXYxfL7gZTbyPUCgjfD+Z2XqxcYOx7deDEbB1oHbDlgzqBeqTciu+7Iemo65izyAt8j3X6Qj4DhLEF+qab4QBCyuQ6KyFN72p6PCJXpJNYt7G3B52L/tL/ig8hNEGOfC/tgfw1/XC+7WRXEfhjzrTplMvgpJUyuFMAoH4QKeZp+lCUTfvNfn1Kq5V0OR/qLwBtkxb49r3c5vAFqlUXASOMqJyizik/fQs89FmY2Nc1B5j+hDNW+B+auO9TakkYvls0LiWgO5o/GG0mwyT5XrzR0isyAshpj64rEgunNgWJ3wCkCoCY0cVMVlkvwjglXxz5CoJPEJY9r0rmhRWUPaPkpyUr1IhfJAulF4P3NHJZ663XcYRYpixgufgmJF/1nAhQJoh6RugFOlE9NN2xJCmQchrcl0y+ly7nsEvg7amfOMuJJQ5qSHsggScs8Lkp2gKdCmd3XO07iQYp/NGTZ3nE92V78bXY2Rb5W6Fj/vOUDlE9GwL3YTCe1uAXzb7ucrDzLe6BPutg6PJ2YA98NQ15DIymm+wy6lWJOtOfPLy9I/E1Acxc6cNJibipwedeQPmCJIElZ2QDZAjt+hKjR/kcQqiyOr42WLP995h0FGToLcPd8eHq0sqNNdgHdOCOjpgYrp4Cf+IeZFKZO0WHIXijpDrINsdL4+RIRKMY72XQaoBV+WdPl3dfuhVi35b7R7NEXckZMQomOq3AtxI2/vUcu08ghHoqRA9uDFOay3hVQphOrkyemdA4OF+NE+dlMjR+0ib2z7w4UOs8ThaaG+8BBY9NFtytF/vOX7/DTG9eeeEPzTmRREihyhapY7HCx+0XQ2YQGcAWgJ0nx68L6MEvuIJN1anvV8sOXlMF5LhYG+0SUvX7IgwshnXSQpjYb8AWGx8kZyyF6qpOt/VfQZukVr3za/EKtPoKBP6vGE1yDhyu4Jpsgif3ij8/Z6XfuWj7WhZPI6DDfUgsNIVuFSVAHlhnZMx0WApLE9X9XQe0ydrg+TdklLFLg7g0PJeokE+6ZoT+kuPjsgvjuliBiapjneeZmnq8gxtQqiTdFh2RuAgffii1fQOuJsto+l4bb1CHEhjdVs4k6PShR4laGUwoHnK3c2mLo9T8EQ+uIgoG9UVzx5mc5sK+Ad2BqmSuxoQXX2hGNAJ5h/dDIa9Do2PMhhDy+xP3Ag8JAl3capcKjjW9c3SmKCn+q2H1lBjRlr/6wgeoREsvIgt3Oir2ol36f585Uln3s4GTkugIO5eAJ7Ah94AQ85+kNwVwdXQbqsqZ7t66eMvHbFxUhJojgEm//UbamiVL9DGOk5+ybNzSPvqZq6mr8fR7u0KWBF19YeOhhHbO/mpcCE06gkKxxjeePgw6ccB7hVpIy0qJ8qQ/ZCtwuL0W1+bQGgKQqgX0C6AOsaF63MUYdW85+al9eZC+//VbfraWTBwMVI4nOi2eG6iTcRIM13LQvD34ne8r3nTXTFcjOk1WbfmkkWdf3X2bCMgpO3p4s/X8JpiMOZ3uhPywm3YaXHBVD6aDqNr60QxxYR4gXW89/pqA3mJMnQ9dOsrasbRUGIg1gq+SzrXopxoC4/uVSN9dDwU0KXLuSHNG/tHQ5PrOpHfu/cM5M7esv9MaTQb/y6M1MQgiAP9XVDZDc2H+tT4nlToH5ND9zYUWtLasCkpfdDq/GXUrjNvlxm1WY1/XCdWBpJBv2r8sKzmW5o0RAFoC7KiFVKvSI46gLs35W+RxmkHb43zOurLAhDjGL4zmxf4x8VEqyNRhBou3+TEO1ONaVUNXiJIkmWlvsnGqKAAL1DNX1TVbaELsRDrlE7hNudID35vid8zMuqmxIZ2y1sQQwKO88XIglGCgKKvsFIOgA4HEt+8dXhmXDAD6yuxWTO+JLt6j+O+73jZWeK0DQFsic0k3uTrOI/xF/WVyoDkrvHMSjDnblYP3aWwkQRuD4ULqicgNjNCx1Rej8PDUu0YjwhgBqeUbn/O1+fnio+qkylEW+32Gyrugo4zR8KSCCw2aQN4hqiLgV+Y9FnAdVgAimsL0rLMGDfoiZapRfSNDOqZCtr4B0As1rm2IdqwX1eGLMiV1RQbJSl2DiEjMXZ+FAWmE8Uny4D83fGKOqlzxbIidGmut4Y/byjbP12onr1XKFyA1cfQxXIG3UZKTnPzueEbtb4hMZLWzxnYpmsUtOHrc9L54renmVbC0oZIxENmAf86uwrG1VIs/RkZyl+d74BGuAULAzDxLeVhoP4ziDBg+0yBNgwnOzwsg5ap9btgWBtKLQxmThxYyys1YlfYGEqCgLWozrIXZBCFI7nVt0wGErTagAJaCGKbXy8VxJhmlqc7xmKCYsUyqEaKIN/FD1kVjSBKw8NOKocOWaKNlokE86hjlZJhnfxAlXil2vZSR72z8OYQ5poR9y5oGBxJPLmYY/glZ0j8r8syCkazDS2XDkt8xYShn7JaE4/ilMuzYaFfveuGJmrKwOyWUloz94DlDNOjQ/TgVqQGjH9o8QkBBk2ix9r55llXwyF7lJcpY9+QlU5v3pjuVE/l7sCC07P3DX6C0Lua+7Yrgi6HHFJB3OZm3khF4SkIDmurCWZjvtofnhnA+nLaGJUxBf8KjIFno1SoeksGImyAgzxS4+immY8+56uXmujsUaCbzNMIXvCG/MacrJ9KTqvqh+8bQhJqX71Nj4rTi++O8ahVQ24mhD8EUEpgWCP6GtvfItAo+SeIlgx4/v8SrKsnSmQFyzjYo1KU005MZw9+kwH+MBrjoxfuEll2qd+2B3mYsnau1rqdVrOAKxi0M4Hr9uJCTpUuc8MNvdU8FaOmjKOEHLeonQdlXRud1Ig0wb9iLDiY3ykJipRx5Yp0NMzt+WVIfTvHA3TsklaZv6yfS+yQEyUgKTwvh8TNfouW6RhQceSPkqkE40eKTRlt8UDnkDrNpkQA562gNFnIC062Ydjgx6IvcD2hI9W4LreMeMxVWpdjlMRf6DEIuCWqknli5vQ2DJlVCuIun6AeukQWGkcyA6mGrOTG6oHS7sxYj1BOHU/kcWWQWuKx083LWO1TeXS1XkDBHFeopH+9Y1rgWFGBJWeSI2uUUqYHGqZRN4F2S6VB3sX5I4ITZXyOpFjXpWHk8l7FvJ9gTQXB1pFDLKQZ5cAv0spRu7RoQmfEwG48RLsr8G9lTSCqJUjeITDruxh6lXId5AnqEmKb3aQfz5uvZV4r+6lcWuvyJrL+ENj7Q/LvGHNvfm/OjGrtfKeO5Uj7E+AXlySmE0Ev0CgfX9XQa+HwIWvLdGlb2sKnyH+UO05UxixPTooMgjwc4w2YJNxQ44/4kli+O+b/ezvjgQ8DODXN/NbA/Q3fiwGdz5yT2S14ULI7TG3Z1enfZdzTJn0anr2X98RVB+vqMe5lTcW8lUEYsVu11PphYNIdqXay7r1L8qZuReDr9g48hGbNSW1lQUqZXoJvU7Qt/s+1utVu2Oj7aWa7o3ck5HLfecfz+FYPPDmfEzDQz7YyC7pYH5cm9yKO/6VaYlaoYLmK/lu7EfGs6bb+wh06TP3IJwUbUUkcHbfoAgMg5AAp/KdSpdxfPiCrtS4unZ5QDUXIc69AMAZWxiAUUJ1Tjk+N7jf1qE3cX7EKKof8POsySjuTlrSgZBNiurC2jYT26PKqdXjKOpffYXexZ9xv/D1swT2DPjUjTwMOgfVc9YNUNNRrmPZukd4RbKa6lBL5f7CYMTFjHM6oBx9suslHE7dyocqWUECVE+KVT+Z6mN712V9YLnpiMIcMoy7NYY8b5diPqwTtXAES9M0EArlkC+FVGiem140k4cfHda1vyzPY+Q7FhsIp2hQw17Aje60WH0Zf+iKdn1+/i5DilOl9NPR8/hSGNVuy3lsRwyLuvYkZPpTmmN6E1Wcyr+VGZoCoq2+D3sH3/JVcarO5jmoWgil7OMrc44s+pc+t5YaFt+zrhK0s3kpALHpxMy/OwFkIfmutSPjOTEcZHqhcPbOv+RqSLu55k5EIE9UOaK4UzaP/0jWCtGAnBnBaIT+nRgduTsKDHJJKqW00yDMVuzF8QLSgMfP16IWBJOt/PYE7guV9NZy7eULQbj5lrkxoGZh2XVpY/pfa0yf3dx9zldqfYwjJ24WlNzu2uNOSlmyQ/9EBNCEW3ZNNxr58Dt3+7W0yT7Ws1I2iyLTwvSL0npwE0pLUDjl/rtvwP2iM3LGWoe7L8Xb3W0/SZ87ikf7NW7MsnjfuFhX/fbQRwz225e0gLOTd6pugAtKHQNLTYqwLyrzrxzFEpAx6aAa+8xRk/j8+/qsPME0oCzIOEZAzsSLM1mJrWXfsmgXUhlKKtClWQX1ank2BB2V9yRLZ/jXN5Wl7BEDykya4DtD3/I4+yfW6W/Eutn85RMBBaXb4W7EB4j825qiuB6uxhBngnni5drgcb+6ODeyguDkFyZT4OvCP0xc0NmNwkfEBxxrUG3X3+iCPvQjhCgldR3Lmj5ETy15IJadZkJ+M6UN3VIiykZXJcSMQ+6ii5Xa8kTLNv/GxtSGgaNoxSInZRJZGmRO11XODzx2NmSPexTCqbyaXY18U0j7syqCR0LfO7e+dK+QDqvGngZZCYTCUVM7R+fou8OvVDvJhAZM6zMcWOkLYTPsg0pOeGSvYWiFd3Rc/tpyCL9e37nAWCsNl5XRhdqiPtLmf1TPgMtyKuPEqQPFtJFvfadN24IEXjVlV7QAU4Zuo3zRodxMXVUEchYQMuS7RxfCuVxaGqFXymLx706Rxsrp6UxhkKQxSbJlTk+d+3UtQtBsC4bF+mQ7qgTeZdg31xvC9kfQE9jJpg9MiRmNsXkw1ZxutVZtHC52YVTfvXKv0+oyr7dbBmUxQoSxWJadp4vskR8fvqJogyPus4j3/FxyJr+sXh8b1uTrw0/dVkeswR4Wn240iN3NNEI+yLBH6dqwapjrd1IPm9nQNbxZW19mKMsrFFcx7DwW5elm/2N1IjnoWheSQ56QxyY7bNJoZW3hKgQG0dx++W7xonCZTwlStazaDI1SjyJ7cqQFerKRWMkeIdII6bXt5FWspmQ27jbc8axKntxrN6A6FUPjTHNgHRt7GYDxuXOzbXeF+oa+aTuI+62YE7u0GugcpkCsr6sNytNzg4MVUoQSI6p7eyuh9Jm/7oLNTaIIe4yRUPmxFVe7N89H8D4cNr4TFle+b0RsDTFVSLcriZkwWohEXa+F8HW0Urp6oegQRI3IsrXazJsazeBPPAmww0P+VN9YiscqGYTNZteg//Yd9EZZ9mv4ROT2QTNyaOt9gF899s3gyHoRhTbtdTd8zaCUIRMkjMRiYsq+sJgMvztV7jjKOgmoIT/Wi9pnXi4qTLGxWRKCj4nF91KUKFwwbXE578/X9z1FFe5b8N5qEBMreRog/Bc0mDsnA1ndwxByvHudo+WGoSw9Al+ZdptZuOLt6p3UUPejJgH7z5dweod0fvP91bPXlTpd3CXs8YXOJUlrKZCiJIhBFBP6Lz+8SRBwFUoaB/ErPvSpi9o4qkEFuSxAIicx8xWGR6rnCwtXGIWIlhGbSW5UKNoG3YfFqKPXf7qTgSu7zCa0w0f2WajmvWaUAS9zvdVYIZc+F+1M8PaELkmo+aLENZH9nvQhxpWpCvHtc/fZMpXB8HFCzUigdCcPWWX+srtSH4RlbjD8kXkZZMucfbCqPOFF0kjFu84iq/v5iwvfNYTc7R3mKrvFHxjNhOuSiZRgUNV9LRuQ5uVHZ+V4SYdDICcVYh/bA+K9t7LhlRdjwX6uj6aunu62Y01PrmE/w7e9Ww9RaZvfXPBOIfgQ9W6UKJjXqxte5vBzfYPp0k8ynJh1WK68IfwufXnMwESiC9gIoR9xSkUPWxGdItQWs5wvcc6ski2dfHhJGS34owtBal+cFSpB8Ut6yRvdbtEw5oeCIBLCBBgqTJRWgcjkUG6IJzXR+5mqr3vLyKBG0jKqjJY9WiJoBtVJDNgiQb2azW/CPjq1y9ZOxWSyOWTjHo3kAzg2dWT6GVBq/tVO8PdPGEeIwm4Ef3XmYCcr4wCsq8XHB6yZtDwPJ5iJwIrBU4Y77LokLGcE8jyssNfnad9dyR0n5dAekTugVhVy5fi45w2paUoDHrEh30cvoPY7GCXZvs9X/+2svM4KheSbKgaW1dhJ1/xPhklqWWxGvJD/nvFCsuChga82wuYS0YTCbzyUBbnSn0cHVkhkCEvQ2LeSx6Qfh0/iM9W5uh/sCezAq4Aafs6b33tEvWkUxsTOA0U2xuuHfunA5Vd4TRHQk5EUGSIZl0ml1wQZd9ATKuwz+9FxPlT0ddnRjfnBVoXLsxQqAJPgFJ+g9ShR3OynZCnLxvm+tjCeF4UAVmo/6omhz/xK+MDheQQAoUNRh/j5+SL2jHOFR/sb5jBXiUagYKEJ/h2i0MhHVZ9v5jI6RMr/H7q+Y0lCbEn2l5AJLNFaa3ZorVXC1z+ovnOnq8aeWVpvujup5ER4uIc6rcLC2g5vk3YDYQbFXDoPRksnpWuU0xIk2jLOQ+DpsWcHQWQYb/1yboM9GzQW9SnBw0r2Ln/GbRAbwW1+LLoqkYFVUW00JfCfHrboiZg0Dk/XA1rhhHwukYDJpe1hKhpIgZrsd06eG5v3N8whIr9G2GDfG8dgWdxjogkqPZvVG2Yfio0eTDINfXsA0MDKp+mEa36wL/UtUu8i/Gv5h9XFreUse/bZBwW3cBgT0osk23FkVObFRlgxICJKd7/PiDK+WTBBPxpKmQocljd3E2+2g7HUuKgTY79PBpVUUw6oIaB6dXejDruKzGvAlf+06ElvQzzp++Cg+nWxiWZtlPHgBRzDTWrr/528eLeV3PRRyOxAp2aLJRvUhxIxxWx57INXSYnHknJhSoBIsXhVsfZtmNrX5qWFl+j67b3gPhXqf4MKhOyEgPhx1ZH54STF4uJl8PmEQO0Ty7IqUTqXqXtdM+56OF06Nq7U0bBIZ8fgYN4lSWoryKASQjFztrmVM0EmOeJNgycqtgrbl4XgTf5uqsPcdcOgbz9hjH3yohrNwYi8jV1l3K1LsBWBrlt+iQBU/+2sKN1wzNvtgHNLsBovNsQDccuiHm/4oxn5aDikMB8taTBDOiOLxxhhKmbKw1/uYu8Ev3uEb3+7bXE1EMKNQvhj6/k1sOY3IqLVe3Fw7/lFe09I+dC9Wt3gFDmVmnNpI+1Xp2Det4HOSC12Pe63RUYeCjSg86utOHaypQWGUQyO9jCy12/kR5nr8VVVAsUQbXK+o+iKf8AvAhRvYpgwWwP1sqQeCQ61siK4PvN+XHmi9ZcmNhGWhHnAHD7fl3qqkzCVokCf+ErBYJGz2TL1sxsmM0GBaMX/VgPe/BjH/Ez7pCgkxdRxd1YF06h7VnDIG+Xr3lNN6jGQN7pXdoo1QtIYymM8x/xE+S/+KE1rwLKkVA8wKX4XoeuAxBLWxP5wBooLy41WBsNhhQRmvmmCGc/lggbzd2UpxfU6me9ZUqCsObx9mu2b/PMVDGHZF1/d5zWY0O3RSgPebpS+X2CM4MsoOLv+Fner0XXJn44AqTc601AVLe23jc2KOe6FiS0+IFlYB7pbBwDPNYhzrMedo3mezm77I0wt/Dm8RvmgzaCr93HOpvc6fvx9h6+qIc/nLKrOx+9nZjh5GG1i/E3xTubjlxKg4c4T7WYgLriETALZYT2991tV7T5onE0BfrsCzmchQNkj078pGlnTvjvXmUhV5uki6lzy6OfPKFdp0JIgitHTA70SSuBqOcDHQmhD80UzN+C0l8xs0BJMRJLCeUK9bnFTpgclek8je1GaggwfECYJG4QV0tRCCQFmEwUdKVSsM8O/tdf1/XHTZ3GUhM+S1UJ+tu1sB7FiRUjp5r9qIdyPFHjte7A6Kqum4us7PviJyjEqbpRVUqdKtojNbi1bVXutxgNbiV5daWUfNxjiVMs03GF4mQoFl1+QzLjq+xj7Y7xVoQt1lEkrkU4rDNtp1gyuW3kx3hXNI4PSFDlMDPWr90/Ywl5FWxB8rYfzQRaOlDcB1YIty11C6ia0MnizWi/CSTFnsrVBZF62CVxCLnZ0psC19Cif60s8msuOvv3gWHXFjP65v6n3ozVkIjyHxjkE7iuA99nRm/EzXHpMNag1tp7oqSxv38X+3D4+gbhWFiq3CUBvcqf/3ZfLfYgNrIX4V4a6AbHxd+rA3xrCBqOYA8p4h08vuBXnZuTmelAUk1hGjThMZJ6TOfWCraYJkZKiHaN162yOeZ4VFIBNhM8hWN/4jb29ywTLa/7FWRe3uxaCVcNN8X38BPZ4V+l2iz6TkRqBRC0IYWWzD93iY297Ed/6X1sL+emA0rd3TIFxMlA+/4MCkGuQPWuUWheSoseVTzzuh1clHpP7CCxyrQj73RLEFR8+I0yNvFF9urejVypLmkuBw8IQGkGa8MI3D2xz3iZZwYeI/BmMPbXF1PymV9snKIGHALFt4CRtgczAvYl+5870NAsT9cQSIEajuZ99mPeKEqFDE9uHsiqWuF+iteu915IchFNh3hqnOvBxwcg0cSRV+jv0TMC1D8SgF2mHMLTkusrFbTGRVR+qnYOyhV06kdHdqCuwbgRQ8Xv4Umm/nIR1gkf7fHlbE6xtDarhMpYx+qQ1+lki0vERniKKHlUPpuBfL6wRdgk3Ml8QXsNbzhNKiDmdFKGwSws3HWXdlPYvJnr+VqdcEmxdS8pbWfDTl8oPdL055wYDEB6tUj9foqLBSJirFFH56e0bQIMpk//NfN7kzk7viTCX4r36qGNpA72ML7TEWst2CECjrBi+jLGeuo9bSY6RDOYTQHEvscmrYY7I6utMhwQOGoflTkRhdQhTWWSMZttJH9+5DC51K1/7MFW+GKqE4jQaFyoquMiLGaFLzCeohMWX/2xl/QTT1LbE9XtL2/1PTqHM6Og72bWe9uR6Dk8Ulc6wyq661sDZkn2pyb9MuTxcIV5kgqveWhNFT3G+uHESMZYivKtKqXtBP3m26xejiVeAbN6wUmv5pv5pSmiQ0piAJeGQCGiIdntUiECplhCF34phtSG8z5+6EsU+igz2Yg+0wxJL+VtICrKh9M06NPO4eVJKaWjrmhB7IIgPC/LzTae0eo3BIFZ2hi4s8EjmRMNSkikPMT0l+AgW+n3zCde7YZZ8p5g4gGq5/53xLWmqBElXuIzS4UPY97+0FsfHu6+GGwBxiYSzWkZx6T9JaHIfRvPiKPEZzp5Y+tCyOTJx2hfuokVodp6/njS6qK22uy5JkSc72Wch+1mZA63LaqEjuelk0oCUlw0SneftkzoYLMyEisjbk/+yBt452Y/9oDlLkrZrUc+XUNKXa7J3sCYewgvtr+/RALx0aCtEhlr0UNn4nLG2hGzQIKfvxuzDdPi4jdJS8loelZIszhmxN5e54aPaqSKmgvK22Lk+kpl3D9m3DPUbNmuv2QR2IlHfRJIWO6FTlHHPNtIg9PYXO76DK6HBM68vurdmWqeBRHQ03Jwg7bqYfPE/9kp9d6fXjYDlt8E8rxyFhzDl6gHAAJjAfWaps5eKVQT9yaibSBBmX8BX7KTN2pqm/k5jfXZa9UX1v6UwvcVJsJzaMKyKxn7JjwNeh/D5GmcO6pefVpqdMFr+mSVFUkZMx9RmBaaKxjsy1S017Aro56FB9cbkUM1NkOlA/83FSBOv8Yb6+sPPTtH8nUCjBtMKtP3u9oFYWixM+fPt1qAO7mQfsJLyRIzih3Ytj6LNaZ4ATmAv/tEPBgJ9FNYuisUyPzMRpntzC8tXgzcEdfcP3xrta5LSpXdQfH9RJ/McTtLqr+vLEI9zq1AGZXSPY9Xrse8bIrX0xC4uQu3fiwDXhqOGxO2qBWvpEBkTRPIpjt6Je4vPkaWFkPxyHf/cgiMZ3sqf4TXVXdoPuSdm8DbRokmdU4qGYbagCcuIGMNE8quI5Itj3HCyTMn9D44drV+uAotCtDYpxP0W3sp5uYBSbL4cQkY422HY8+vQ3ICNaPCnBfgsmn8TOUo9Emd6u5hBXs48lP+GPuEMATvhKbaGb9avn5ppO65dmfyo3OKLE4ZSi9NXkTFJipueyIWwEy0XGZ3gHp7AB8FHmCr0gvQCVlSY4LDdd2GuouGshQdQjXjQpadvr4VFRpflXOxib9omeyB/r0EWQHvTwsv7AFjJEiMMsGPU+ekjZwncHqW1lHy3Gtpbo+LTYghBoyDetMPHeU3iyt69B6tslevS6VSR8u4tsl1yyrnlBG+rRzQVonbEPaajVMm/fGTX3vK86bAgKYUQglFCV0wWUVmFhx18KYly2Bc/ItihzFWKqJ5Kjlbw0HhrM7X61wasKlSU8XRnkC7brJ54MrTFXjX5PXrEsVwMa91JxIbWbHwzoKglslXdus7VL5I1/D454qOBE8mhvrUjuUseGFpTzDmBAX2O9OjP1r8aNsxHE0dHyXud7jq0Y5j3LKu+l/TXbD9iAtDMJkzevGDpzH7CrAaZW2uuKTHKDgsAfHkTqIYzIl31IrMcwrwZYwOvOtV5o2QxCD194wJhRXB46VMv0KERYpDbUACBxL/1QRHwp1aUdwoJse7hqzvePprr6W6GaNUFaRT0Asma9E2Dy0OlOlRBZ9Xu3ux0bnSC4CPvirRh/Wech9jFChaP2UnwHnMcKf3z5l8QCt0ATE6d2omknWFb6hy8sEqUc5UkqqOYBacA378jw/nv3iSRX6WNHiXxZvxubDUXhs5m86jsnoY2oatKrbwxopXwy2rvNIKyvGjdSlG1ZStVh9NSF48LmNeShdoIElvgWt5UnTK8thaAoSJ+Pb/Mol2bRKRpzvj1ni3crURw6ie+YBouS7Nu2DHR9l5iyXf5cqdC+9D4URe992UF/nIEl2OMyA87+mlZbkBn2kFqieIv7e9AE9kxt+lnTz+aRTDEL3b1owa9heY+TC1VBV264fjYkM8rLi3T2sV9sB7Kg08BtmwcSeBCyxcoZKQpwfeksF1yWL+xOx3FgB1qoZJ6Xs2kEnqpSVhFPdtH5dtcZ/fsbFK3Z8B0c7y+JI4nAOl4wn2iJg0b+r6D8+zEDoQQEnoTMQIwFt8v3k/OF68+CaRwN7doy6IgEEirjxR9nbyY9oApFfxuORiNUKGF35xyBmSUWMP6p77uSx1MlgNR8o7I/2yyNRl8cF+VrGUXF8OrrGSppFxmgbUcu7Nnb+vDpb5K9nVp8xHr5VQ+76NA9d5OZCRWHt2QNrbpd8t3hQ32I/etxa4ztkNrK3BkSYdljeNS0VTF263nZW8dQ+vlVwy1MC5wZwGmyM6z+rcd+Qz7Zk5lSvJkq1YWkcL1SMV79TvxPWqcnglmi5MOY57j4VL2ThuqP5gha/ANArNa4n+2a12Smh+l8NNbcwaBeuJGatymN5Aywm8RvT6w8fYsMN2IfVt9Cle4iOWoECm2LXAqCxsRK/kyc/2Jjo7OcWiPcZb72liDSiE+DGnNHyKZEDPNwKhH889++2LvyUwFNWUaYVHA+1a5ifdQtCeW70lLWVXXaXNxe4bLXWorsXaXUzjgp2/Q+eloyOpiko7mXjiGY3umzQcGnkjwajH5mIFUIAR0qBgJbz7Hm+mTXZhZCJqGBIaeIAYaIw+KsmBITZZhHhXhK7RjTmdluoY/ffGB+68yJm0q9/QWPR72vxJIFmRzwHZphhauos5hLfZonotvq/TasZ1zGtXlw6pEn3PXzAuGcp8p3Lo399KL2ZbB+mWDLEehDQ7K9PK9P5CNygB8bVHtYOiPZBdVQg56KEzZveXUVnsYivZJ4A6awncXjos1NSTliITguZXrAnWwEyqN/Fq6nzaLEmrq380Rb1nfIdam/izzl4Z0m1cizJO8qrYZp8iToywSfBLbKANzn7hL0tDeTo5zoDmHyZZFXrU9UPc7KcqTlcpDolV+mBnonyQ2NfcO8TKfGVyHK+Bq7Tbg64XJJ6g8//xZCoNPtu8F3zG5dpVHAKCZvYIaWAQ7E+I9lSocukHtCLuB50372dz5uCz4MI25+kdnZCKAG9AFoPlHP7OR3cJ5xBOjSt7/HbbBhctjh/1YP2NVHxnhoopnGttRZUWtDi5J53fUiuuyi05Ed3ZrzwNvnFfrM2Pbih2ic3S7+WpZqhDbdxdLnkvb/+y1dEzxtFzZlqaQpSb+uD/TqKvY+WatOgDF3mkkTiEWxX/jMBA52fg2xGvS9olNe7HPe9rlOkeDaPhkXfP9OAMDNbeCT0PoH16yQI12TCeh2JvaRP9JIkOENTuOYiexLG1wnLyCyw/uxiHvHLpA/8beLwgnI77txd8Xw1mBhy8qPEEcubcavVykWlRJS8NHhB977vHibIj1y5k7RKCEL8zDQRj88zhS39yvQ+Qq7LhJOf+shjnvj7gtyZvBIvZXuO0ttNZ/7yKQTbE/+ofCndGmhJeWFA6NyX2Ucqf9EcSfKn8zmdnfjc8bLZ/zZvtG4heQNBa8/TOd6tkbZNAt+NXLUV/ABiWVP/eLrBJGLlVlaxww7/7liOTjZuQASSSvv9WGTXFQbvq9yV5bxU6K4nbKY/JN8nPOeVx4opsmhzcmuXkBvNcBif/eFUTpVI0VCdIGhilgAh5KP7MzZwtoqehyDLjZhUz86QnSKkFUkFliqkiu0N2PMq3VrdTWBfN5F7Zwj+f2d0us3mrl1/kmci3e34TvVTieVZwKpzu1Q/LrJfB3Hhj1d98yGdLlJ0fC9RgojnMFn8hga/XPprffGfJYFuaehI+/k0ACjVBvB07mNg0YP4p9h8iZUDn4g8TSewUQ9YQ5lvd+SmnCeqm/OrLgtiuxENKpB3p3Y9Jay3bcwtErvIoyJCQpzxtkhdX/7ikbrYedDhtbuvYKRVLjO9bzQsYPuIMbRVUMmO05r2fKr9nZrdNDElrdq49EUVCRDHWg4nPqCt5ILqmAEWtHwvr3/pmebMeJYlcPvUTr6wf1TEvxhC4W/lZB5uelzarRrb8tuYyQchTsUsqD1gQaDQFe8m0ULKvrifWzYS+xpfT+fUvBR17ZUDrsZQdFN0UGK7NfbRB/naCrjRi4YRDMi+ImMu70Hu4CnwET/t57TreU+ImAWZ9ucQ3Ez5BXOyU76P7TFiltu5wOd1mOCyOquxDlWeuSBvv8q7p6oztJXfmvJkNjpMnYBdOOGS81trC9e0L4w4uIz6XQ6ePOsTo/zGm6wEAJfuYGiKF8HEB5iQ8biNTvjc4kR/F0ha/GmwC3S1jvUNqwlHleBFLvg4RMErTI+7Be7R7gIgj4vunKFnhwlCUVzyOQujuZP1vJLDIDRz9RynHIRCrzQVnygIml1PEN3A4snKtAZtSWW3HzDYKc05ytBmQfNN76GYOG6sNPKLRlANAHt0ZR3+tVtM57o2scQliWzbs2R3qZzfdDkEPyjecc/OeGAmJAKPDts+e0IJCxvJmcWR8xf98CsEC/leV2XSQ7G4xVjnLm66Nt2o/cxo/G9TzbAwlDhgr8+JKffq5y+IsDoyIza3A/Mj0TsM+uBH4/e0TgXUeH5sFJN9dpLGJ5sHeBBxWNMLb4LvDSCBQJgU5zsnr9rhcuX7sDDewaUYnLvh0m7USht+41xbvg9MNr80PSgV1v6M9/WnuKhTksNHiTDycgM+MKPcS3HZFdHo8Pkob6YrfbT9kZDfF3KJf72Tj2ivtCBzPt3zP6zlmlGQGCq29eevL8igOd1vgrzkTdM2RiMmmIRC6XCTw+RTFcrBwGYTLEanEX+dATPZoWQOo1cvBZF7KD/R78d7+vye/wTd7hiwJWS+Hsb18z8Jcp4Lvw3i0al5W2NlAkkRugtodQTShvhfPTF6vIviLadeys0OI64EycpTiFKOgF4DejA8dV5HfGhNEEGVhw9/PWPCxzD9KD4srU+kLKKSdRBbDlFnigKUvKVwqVz74TbhR7ZlO/0x2AGjsdOodt5849PPRvDmDogSAz3GHD/7821LMP4kVl0MSTgwQHrNl1T5POa4nryH0AYuE/GrTRiAkB74KghyfzW4AxOladLS/OprK3mV7yze7rEKrbluIHxDHeSsAlb+JAyuvckLwP41B9pXyW7IXutxJJwQtCGHGNLmjQxTvI+iPkYlXaSzqIshwqMlb9SY0PRlJQodjg53teexKbZkU2cun5s1ED9JRInveFsol2A258q/cUTkqpiX2MhaAQdKB6ZJFwCFvjDiHr79DyD46x37dBVPvST4QWj/LXLgvno4oCXkjQE2japN1JwyXD0xi8dW+7hWe5Ov3Ujio9ZCt4k1gkg/Qn2GmjA57/SSlT3BUKO6dXTjV2PDzfkl2PjgFumLK0LBptfMb1+xblV1sUTLLoN5sGg7FPIrM8MbxeZqnL/BUdBbeaUXzT4WgaPI5KKrBcLwbSPg0dRfmcfSvDUYAxPPfgbMlxdfUy/hZOsT+hqJjGve/KPc+hV6T0SVe0PFnOU2Hw4a9d7KOCP7JhAmILfuVe8wrDR8lxZwzA+qDUI2ewTXS+cx03Yi0ES0atbUS+2sAwM31eO8PQgqAaq2Zcep1ApiyK/NW/ir1/E6Zl+HqPt2queKKxGlnC7MIMEhgbDcLOmW2EskFwj4f16NDcpDGVm+/NFV36kJmP/XuP5Cc0jVwsE02wZBfKrJMFwKoZ3DHoBakcMuX94xVS8UGdgOq6v2VIRxuSdNeDTe4gKJ/XVRUaMq+9CwbnYJgvqLQs47P627foccMtM6X1Z1qxo3Qmk+DVMQGzRgF2bvxKzDVurBRpnVTCuQHJPQKD9By3Lany3RQFevf4HH/41m893+O/qrPhFk12nVKK4hx/cU0Cwl9zbr6Lld+3Q6Wtv1BCazmeAhfpMVNUaZwjtZiCP/p6M5B1BbaFwWy5fxHQFzTHsIH0jLL6QBhIhPXMlkB380+zmH8mX0WEz390gWe0uv1nfkwYaS2h5Ms81xA+F8jXpctZvsfo6OmZJchSi49DvtmGTKfnhbse8F5q5/QJTwnnPWeytMAk4Tl8jzKFIGgF6f9sIS1JKggX2GZcp32bdIoq0fIPnMlLwlqd8bYppfubXMScJrR7QZDHmJMrQpK55aOyOQSK49LZL9BaP9OD5S28nRQR0gGGwmBZh6aC+ff2pdziqS2em5DYe9O0MwXQ7aXDwi0uBGbIJUy+53sw5pGTOY/ZR4ifo7OkdXyiY7xTLc04DJ1Q1Y+kUT8bOPJxxL+X+4dRLqQka6Ie6VU+R03yqWm0tHCrElF55LEb2MaDyCM06SuOZnC5zIuo5bqHS4+S3K12YPcMEVYPg2tPxZkMty/CPz3cyeWc6IC7deR+mDhsJ3Z/E/dkGxMoSqvvUAC1AGO6A7eu6JDLKxIjh3F4jXkcV5SLvo2+RoNGHwmgaroK7esfZfMu+h9JxPitiUS9lEHCVy1UMD/aDmRgQ8IzzTQ/wyyxXQjEgXTHkS2Rnqq2F5tpHZVtmQJdJTs2y+mQJO0HHr67CkwyKD7XQ9BP/89emc60/G6NSvsepWWAnG8Ym1dl0cVUmokDDBEa7J/9TsNYkDf09LO3lsOPjyxbXBB93l+GptXHcHOSm+c8/LkL5feuVgZmA2ZTH76nAqbAojNOaGJ9aeKEp6LRmgyxulrkqbMvtjmY6HNCHOsN1m9DB/URK2CO759e8g/NyetasHIm/L6hsuNOEjlKOJg1hd82I5r6aJ+rN34WKqzIzp3DAXOcQGgnmWXvxWjQK+uZ4UMvUEU3JQYFs4rdPDLtL+WITJH05/6L0NMf1lmYPPm2kD2f02MseOvOz/coEgm48DvaCwzLxRgl4A+7htBFfGm6pCcmGDtvz+jVfHMZUuCifT0yozvMd6Ke1vgYdIRV1+97Q4WxKrNqRVm/oBjOA6gTi8yvx3r1oBjQWlA/k2J2rcgL2cWjZ9OG8KZQ2U+sDWsVOTPrrcCMsR4oG9BXKQeAEoVegAiD+Ve/6n/vDSp7qnNSL0yNfEUFKUGpMBddwJv7HhlTb9zfBP5l3DY0R8pQDH5+mQE5TyyPvkjQGOjJSymJe3p31ZYZXTy1PK/MjAKvQXJH/PdFNyK7ijmzD+EyTotu5bJoYgOgPdD6lfd+9PevQIQzksV49mm/oCOInaUtAEPu3scaBjChItUWuNGU3vSohVTvPIhIlKj850YNsVQW+9Jqy4+kLzXrfpwTeDX1zQkSJAhwMaEUUTEK+kmAlj2/xxqnpokELEfDx8RRLi3X81eOfyhXEb/pn90xWdyMjeFLrM4oSOqv92jTDEbnN/RFGsg44UqTG+rnipJRaL/JfJero+M1n3qFJblchc3mTgNc1lr1ks1VjD8C5bX6vnqOlEPR9uf+ivlLaNKfPeK+KZFpHpHET4n9ZpP97hC75Sy/kK1KFYqJScYH2YGb8qo3PUNWLvvizPoJSL/y6DcAgA5Xg67iWUinAqwsv1UaKu/O5M/GLeD8uWwTFsNKMyaWU7glDun3HpA5Q2wI7uJoSnPvEMXdCLVyqOb8FZ6cNaqKSKOSZMm9isQzF9B5RK8U1ure8v4BPH6Jf7bikCb4EkNylGNnDKyrn0EnNvt2Qw5fwfmcUEPLEdSQ4syFfh2iZBoQRU4PenQXh0NSyDfWzHTHWaabzaLs3zvyZLzEVQemcC0nuL61eEK0em61oFAJqrdpKYoHcJy/AaoboBfmKDe7NB8quz97aoWWMln7P7UO059Xo736SHi+mQM9lr937u+Uq8nrdN6QIHZ/yYwZSXDuhVjq/M9az+bDfLtC+7zfFuZ5o0qA94Co55PV5foJT4/iopH6pEgjA+ljvj42KRFGJ8rzC0I4uQu/MwmxVJB9d2SbVNqeKS5eqHrXgxiOxn0oxDF1UAZRmN5cTJo7rzkJaxfh7Q1LDR5bCy3nwfURuCj3huoflGvVJ9RrzCMUzp8LXyPz710mvruWe+GGQBamtVykaDP8Q8FfOUZQEJmCsPt2frLwE53Cx2wFSJrEWaK9SKy96B2e24YJpK2frW1sn0pNh/4UCcJXimphux6y3d9SGt9s3vZ5l4v5ARS8k0BxR/s2W/tzO49u/lKX8ZTiV99jyF1DMEk+HLvj4DPge3S9NRh7+HIPDq/+yeMUB0GLaIxx5IuZs5oh8r53cn+xRCQTovDbGKFZdo+umbZdQCa/qP0mtdPZHydosyj23THoudPrXhrISpz5GCVFmZTlks/H5oVTSA7repjgNDXR+kh0PRrfkhHxE/Ntvr1WOAhrqwLTkmGM5ePx+YiaqZmi0MXC5ib6Er9nNkl8HgJ4GmQ5jtaYD4ob/PMM0yVdj2Sfz1XmlJdw8z6OuzTwMyfGjnzHzxGH3aSfsPoCxf2qQShrj3g8PVRKQLM94CCKOqtqkbZp883ZvjYFtBEZZZryz0HOYxbOpPh8ZFKWS/r5kK86JjseH84DHVpCygy2nsIVr95MQ3SeVdLgwp7T+ptxxprCCBMMKl5QaF3d8kmfY/f5Yjq/EUCOzrIL+YwD04zUZxbDLN1B8/1NHMn9550+EqSNSixPZ16XYBEKrOmm8fvExGapdUEsqDyPJkm9F0j5RPMeDl4n6lIjpypnt10atezaviET9gOxo22arit5HZSxDSdy/PevE0+zrBEwflj3C9t2LiBAjLDmT3YAECF/K79P0MC+9icboJ3ncJB5bV1l4RB/JTWi62dEeExnfpRkCiGSnRf7aNB5sJ+vfwhBPZLPpxzJVRdKXkAGPyNq0Xm4CzZ86arF7K7RNinZrAgLoDFnRHXEvezwAUEMsBBF/Lf/FfzQb4njMfx1ZkZrbZtRtGf0zbBb/Fz+71m9T1zJUyyYn+1aSwlhhIF9rXvCRrs/ZT/81nSEfuieKD+8hkx8CHehJTL0HICJLARXQwvzHFjg7f/vs2TRlV67l0CW+j92T4cCv72NLpRmHuNgyYGnTE5e3LuP7SijE06spDqDhp1srQ6kmJtZObZnk/1H1jUIght5GezOiriRPR8TJ7zeO0fNU39ZPCeyleVTXkO/7x+eswq6u8746ZrpDg++I03Mp/2rSWGsUBtOnzDwcnQX97Sz3v2pznjuvu4oA4X8TLUIqiqEkjyLaTAB+jmhf1mGqbcNQscH2skYijMwn/IuioLvGRQ/5c6QqOUSUeGaVu/Mw+dTosHM80wZXDehhZ7wdXccqQlbEgMd+ZyWNc+U4BOVS/3yZbsCKQWF3bP+qaD17CDM/9ka5a9M0rfvRF/Y2EabqM7h9852ht2hHKP+3dqMluwnSscBl2bcp2V5vkoOsL0kcy8f7LCXLP7ovmz+yzYea1SZUxyYbhPTQYvMe3lpQBAAiM/uWsYehSO0ggMzn7C6nIZXxXxWF0K7sseDpQWXuCmQP4JcATFsf8/nDZrdQ6pcg/3POf2PF4thSqZvmYui55Tql+XdILM3u2WPWcRcO9gvnSNhl/m2cyMhO0PhyX8eVTEHhEdLshgMI93tgPgJJ+szFyoF7B/Tctk38ZsJjaf+CzEea/RJkY1oc/9kx/DTN0U8nBaF2XB02hxZmDcKIEqh2s3i7L5xlp+qH+35USEDUL/F0WX0eun05I1/0F4dhRft0UDfQO4v1ps8h3BCUrYNe4yI2aPMt2G9R6qLIz7jTZBgvvdF7g/TOb2vbqAamgjhUsWh5nOFf8rsSuLpbfCfQ95x2xP4z+oz+ZSYOiTteeZYj9j8fz3xsRa/zCj+dJntZqvibUcLgJ2sXbWeHlsuDonR+G9xLsn4XpezPyFmdQRK3ajoQZPTmtxjynJQylCPnUeq4ubEX0bWo2itMMOfTaa/rOT5uEIpLmHNs/386eqNiGzeH5kUUPHIP7VZYXJLFDTYVaucd60fYpEMi68TwcMx88IU9+aBkqrk7kRgRfb1BzFp4o3+g4y1r5x0X+EOo2thEwcaCd/AFInpCDG4pCWrcXUelreukBD84yor0niy5W8jrmP9saaMLzxfSoJjzFMm23mqSq9wXP96xjiRtM2f8h7XRuDuHrzF9WyLbmB+5YPTpQLcUuUUVnPfTEj4tlP1NW+MR+0DpxO/boRROHxN2JmPVx2nRhVMjE5k9fr1JTNe9X/92qKkJZG/zKMMgl4tvNDcslLLlS+IkXhXlfLnk9O797PifHsIrHO5elVvj+hF1mWLjQeZymSH9MAUUSo6eOynUMl7f23RLT2JQlQ/MZuHZBGkk/k+ZUeK1clScL0ZG4IXdmir0pTHTcNCPNOPKpKcAm2MRK3uJCCfLA3+Wo7Z+GLKb86JUOQZ6Q9NrYwdJH/72fNUnm1Zf45cMWePFwwPlxvqIdAjnQ9WzfgZQh7TOWt7XijtEqTyI8yQF7dFQ5/9us+cilU/x3dyTUemSQF8wov19SSHM38/SX8omSSkczwR/FCIi8xcVo6ReS5n+NIUXBWcC3PnuftSF0Fnhik1oEmiwzOxj2W0RD7KVuSjTekjfhSxo3paf9sbbN7rd2leftvIA/4NRVLMHKqQZ4OwrM2ebt2C+jhcrcJFs+x24q1gBcAELZuLXbX9ZoJ56MgH/yocd1jre5NnMkKsxPs8zKOs5JFVHnnzN8KcEtmw4hHxIiERpJcx6m5EokOQfSueEIm9Cnzc/IEeVYo6cBmqbWHdDo/V8U9z1RiXCkJo929fk8cg096dKW3PjYzc71baPwzu0ZNklwJWTiUcrnDhbLFyBzxkANY8fEmsSAFlzNrj9jgE7MXC3l7BIfl8yWbqGK5gyRL9dFZpRylf8QgELWRzyh+z/MU7/kENNS/NFeJu8T3v6C0RUpMjsmHVvpUZPq/M7J7jipMNUWRviaAHoNm6iEE74G3FoK23GggdCWfRXcpJML4KpOU/xkwsU/T8sF/8TToLsl7rpj8PZ1Bb7JFcdGJwleCqSJTLxfpVRNDqeGWk4fXdScMR7l02kXrQP8vQyp/SyOABHE5hPn8+EcwAfbKZd+APU5RMvyzFyHpYpDIbKiHvxp5GSP+EQgCPVhSxWRM3Orz3K2hYdWcVuFxd+U/vngniyzIbL/v+Ps48c3KfK745183+682WzCA8OCDbj/YggOroMiG3FCq8ZI2NcRdNMpo5UPK6kBStru6quNDnbTyQWblkVBPVpHGAQRhXF8NkPLH1y+S0L+csPsscCX/9yyUdmS3ZRa1YD+0WHkwBjdzXqzyrSA4nZ3k4VV5fd/x5nI14L+o4Ps6eKQJnTGcN24sBptFUVhU2j8kZ+oWNF5Rkmd2bBQHddvX+y99+MIQNeVI84Mqkx0UTPeYjskIAfCRTnsVz4y/zbA6ghF/BixVHewp8YHGi83YEnbbsUo5qWoAtL3uGhFn8cMLreWNlVKPvWnzCa//qJE4UclasjNnWJX+dzuOn5bsP+34EDnENvr2MwRwY0/lHh93xZwsLD57C9ZHOHEYs5uudovapYpDpzofho6H+Mvxr96J5/svwD1A4xfK4pk0KCAr8mbj9Z/nlI8FFLcT9N86761r38F4g6hA0qvcFbVu/ivN1ZBdEkfyEz+0tt3ZmLilTZP0wubmpP34vl7+9DeBx1luzGQnNI+wW+xyVVI4Ye1IuIla9lxxvsB9yrjqGnKYW4ekhTg3ZbWp37vggdDV2R1eJD+MY5Of75+UXajxPeXvG2NJ6G4zcFq0ohgiEkBuqRchkSNyahxy9/02UI4YSNwYAaFEFBtzhd5HfYXs3+v11nnxH3TMZOjEE/qxjpEyz8XCf34xf2Pt8GBKnO9zvz+ChK+z9anzFtKlk1Wrx+H5iOC4j8s1JP8pFTYVjLh7If4sdX5ygcJf5Dn5lU2prkbTnRkFjgr71J1o6iKXKA0qwVma14hOnmIOFk9j2kPwrDNLbLzniBVK+DtiEPYXb+wzD8gRrWWjdkKFYHPF1kCVMRLIHfdaq8NfiGefTQ7NY/8Z5sXn+rbIRCSNNw/VTcolk1IdMtFYuTnlzdAUIsDdAyXdYP2rCnpDejzha2oBThiEgcQLEXRzP6Ti6M9/Fo9x1Ag/rdrpsDdyg/cO6jYkWKQTlIWEglyqVm7zQtp5aNzw2+M/x2Q9gdGZI4uN6ECqfyxr23mtQr+S+gmbw5TZc4cRY9Y9mqUnBR/9yG6uEKAElshN6J61GT+wdo0ITdUoels4Gsi9cJMRuyBSCPsazeBofYgdcUFQX02iRRcx6qgEmTPZAujU+llbxk4lkDv9/ecYT/Yc8LZEarNjpE14mKtulje1FmFrVYRTX90YgMXO40KnuJuY4zZSOy1HUTeBPY4yG75ta6tIYcFSQRbwy1yiTHDw8pnv0+hP7O2qm5feQCme5pwYV+8LmNBGIXLRjJUdwN5W+i1FWjA3/sn14hPHkAqvaunMSYwMy4sunCVonGKlZ+nzepSTIE5NLngKyzfprhxHHidQr9TpyNDpUUsDUWNIjebtmQv0Ew9rdzPmRAWoT+YwiVCJeI45815qriZD9iZW56Gk1Jon5ZVEc+TBf3vsgmbX+RcG1rNcmhJjERgdjk+il0b2shaXj3SnPST8rN3QDZTh2G5gtEDsxFKnspgR5PJf0equJSIcKiz4Y1Hl17jxaeyLHrxpmylevrBzpZpv5W694pUVx4mDiQY22GOjR4etSPqye90kF5cYgl8qzbtyJ2JdhbUD1uNBLEnEbPf+oQFXwoocBeJyGj/qrxaKgkED+b/7BuVihWbGr45IBSo+5jAiOiQoWD3KngEirGR6MBW6Cxx9GQKyf0eESjNrELyw3NOmICwY9aJMDPaLp1gG9v0nOmip8c0Z8fbabBf6N0Tw5CvNWrqErpDvkdl73SG4Cz/iBcTrGq6U33ddOJqY9hEJqUkco7G48gdxc9nCXuG7+kafM3FPyzCblCe1uKcY0G0+PiuFD92/MzEo7PwQXJwp9n+z7o6iJgSZfR5y8PXSI6Tog5KN/H4dEg+1EHddznLEegJFyfR4AMjoS5849j+97WwTXWe4PU/wM8rT+ZYq6+Xi71sGThckJgG95T2SsJY2TtAm2hOYWP108USrvRHeUKmO4CCTdJdaaLp/Ckb6jZwzJi1K+eVG7ldQjHYX5EzPna4esef2r/VqnRHLiIuzkoZRzLx26w6KkF9ot5d481hpWYa5K9lqOFCaxgl0u+9br/eInj27J+NytzFkQrZhgTVGCbqnp9OsLdMoO6Gf9zfAXkqbZE92ptJ6o4iSu6Qk2tTmG9Rhg/GdmbBg20pyyXq46BAnN9QEWJBLZ1VOukLwXlT5ajh3s9sDWvIosYtxZCScSsqXTrejZkhWOuG8GqXaDhzxsy6zzrz9SIuvJ3284vryGJla87MOlnzQJvRkRs3nBF3dvlUv/ZDbR+kb+Nzry8+vRCaDKUAm0ncdAJ2CBXRUySY95rXCx+X7bls2YSLNpyRYphUNsWghpb3+ctR1HB7+xF493wSPgezoj4Kc/2J6Dtg4B5PuYcsp/IYNCCwHp2Kxr/QGIHoX2bzbFOyTCRgn65cXBJQxlnV+HIYf1OzW9SLRgre1HWHdritqkrOeVOn/VBMKUyFLRf4oM4cOQHXNzs7dfBUyDsgEejEQasXkLAF/cqFxpSJNtrcMCmeJ5ma9Nf6kM7K4J9l3cikNT37KFek+yow5qLEmDIItKTAI5OO0Wt+s4Cixj6fj3uc9sWHKLMUFYb657fYfGF8AmU9XFElvLjzMtl3qvSDaFEnVbn95u/PKfXT6ca/Z8bb+yaMiQ8+toDx/z4o8HCRROFxY7pyWKkcUgfn9y3sL7KxfpiYMfbAy1D7KHOLAma7VskskztYn7Zdwg4O+Md3gxp+t+yR5OG7NHNraRhJY4p6PrdEF6V7AN9fvF76EpcoIQCNZZPUcDO8ZPD7Zwu22lKnl/bTg0+0I5sDa93trIjIgdmT5/Jz/jVU35c/snW8xI5UghEzETUsrRR9sXDGhjvjgx1u6hGK7ABbKzOIRMZ/7oqn2WHk1bpi/I9e4GEv2n9a/AXnjCnaX88Lg2KCGydGHtEJYZAf9G9RdBGZEz3GFJVa+gsjS3bLClhq9ycHrr5mn70Q3LVEIAbKaKMJwR8jqXzXILoyJleozzNoYQFjYGn62P+Qk/lwmQkpd1mdp44S8+xKIxZSTvHWEcncaocMqYIheNnOAfkLCN3hD33qsUqUCPcfXxRH0vN+ScIiGGvBTBG45r0+w8qt4IBcTZh4V5GOY51/ffnCgoI1YqPfuW0eBnUyGRhyKfzjocJd5gxScMHcj0KGy5niN19vVyxnjgOzivQnAEIg30R4djst3qs0ptdkmj/1QSrmNA5+OXzqhThaxYFtijXHjbzF6V/dEiQR8qqUNiPsBhmSi3HJg0u4zFzkHIT2TB15XaRSon7PV2sehQOymPFXcyFvOLUT5v6mHk5WWY7F+sqqqeoiDZY4wA07hLlU5PQh/FRvtCoMrNHrojfoi0gtU9Knlm/DJyVXeMuztsT7V/unPrIMe4MzP8npxG8JapOUMWEnl+1MP8zlSz/P/D/JiR/W4shmaV0hrvpX1fi+g1uM6s3Jd7gU3fAteYH28HCrfnLrkpxiNuFbOu0oEsMVmN6Ftm5LiuhK9Nra30KAIvCmwE9KpftqjrpfM2NfjIW+G7Kgn41O3PljbLlLiZP73mp1Wggt64400KG+U6M9pqSSzAuGoZN4jiZlwn7WiuGsfsXNlHT4yASlqAEM8UEvvgX93NcwhLVBDasqJ7PMznAGnfcVsxyETs3K5p+DAO7Ow4dfiwBhmex9N1h1shEvJRuHEQ3QVrlurlQxt2Mwoo6x2fUbjzJ5N2bJ6h/HpiTrWmSoLFCQeuWNYLUNbsdgtIUB7do2zoyVKdK7BaynwehVjANaAZzARmMI/bY3njSVNmoZm8b5jw9tG3JYR84+pBzXFFataIaq319+3oTVo0ge4k1uOxUUD/NBe7MtXN7ZInfTRYUFaLKdMbK6TwlGNq24uY6/K3KjeWNZ5qD5bIPNKJ3HfPzgnxxGnTVIzwcVHwkdwtjs9HuCWyj+Cvw0vOPwXM5cOzi6wm9OnWW3WsXimLxVXFlPlwyOrEi+9hGMZbGiXVt88hN5T7KF4LWLSboosm2mGx+meNOxd9cR8P3hubv+oVvf0C23vlDOfRo7cp3gJeqDo4o/fukhVq2TrL9G2JLTzQ//7l+xKD6Fwijk1SIJU8fedsrLFcckNLbH0pxx5FWljgIGzFujsr1shiDNxRCoEq7t0uT0+OTQlHR+XCGsDr8jr/EgljzBUQDD8scZNelIOw8ButZ/h2nIsRJ76km8uPkBdmBSe3JIbMso5ypW+bfJk/lXHJYx/IaKeaa/1g9x89qY5y6blfYGK+HU59l498BTgKRB1bRUH80ygCuK1rOVjLTEnAa7JzTGH/FgMiZVxt9muDkQ2sLBAQNkTEn9AXLJwugXichLUyN71/yABNjGZYJ/l0QME/LOEAKNLcOXMqz9CU5vg86KQ4kkaLnL9VkbfExJ06tCOcjhQi5HhnZRgch78RyowaoTXH3UKUcBxsIa6/n10e1QbrI+XrlDHQeuqtxuISQwoXv492Nzjdh64ExNJ9eKSkPGZIFAJcB5JoGbQUtOoXWjKOcnCCrkyEG2zgMRpBaET1Qfjrb3Ujzch69/WAbuqr5rJLt/NCHd/yj/J2NCmQ63S4NMHWPSHKwsVqI4/cDD2wDpc1bQLy6Df3aq63nGJQlnFZRN2XzFKVa9Ze9S4AMITmJFiRdlqnrWwbOBQ15+28Ui4JEn2xJquHh8R/MVanW0vnXYp98ynEDdPZ7E5fFLKVhdm6hcMr4BBjbsp2bHLCHXGq4mDF9JPhN/2x5SQQ7Lih3/OKP582icSbGsfKjCTWMs3RLCXRPua4nUTOI9jYVHFLoqXCbeGXMtZjLY3O8k2QBfjk0ru29nzOhaIB0UIiV2Qm4PG3mTlNjrVgJdp8gs6fD1TPUklcMuqBO5yUMC8aHhuxxgfzkCuEvmtCXi7lBrj5bgXnvpw6oJzkUos7/sYYxVROs80+Y0PYHAuTuN/WfT4UDJS+k3jwGvPd9ETVSDprmxO6cUL1rXgo8PuD2+rr4PlnJ/gOuLgCpC17ncja106ZdOSDs53oRNSIxLmvDERvjMpNGTreFsXuFm2LtkYTjx4FZ67zq66phzFUVrL1t1SVmswDEmCouPIZd7EKq2J4eNTsCrv3NtuY3aFzGNlJ7P1zxZPxEDvZzjeGQPHdJl3dh5U7EfGgyHM7Ld1HU01lye9wcXwPZwJubgJms6w4AYo99ndtJ6YCijw7HowaRbpPtcZcT8zYoLXTm1bfSbaLbft3iJG742AbHhcaUolbp+ahIIYxlutgUpf9M2W0cbEzEjb2/6j6im3JoR3ZXzLDME1pZqdhZmZmf/3zPnVvv+5aq86kTmUapFCEpC1ZH8SX/p7LKnyomeWXT10ZA1daBtPxM62vjloVi9x3r8oyvJyy7P6WeltxpA1beHe1RkzWIpFSWaGCljAFTjOxjTk2jUPyrlf/FEZUcpjCg1lyemUI0BeZIiaPMlLISHmkczQ8k0XsbplvSh9mt9U1IAjcjlmwVObTnHmv/zcXNDFCKHpr+bd+SSterjobzoDrthMWKsv0xT38bX9DtRV50TiQprW8DRTKFCnlPdjd6f1T9J5LDRBo8fubVnZb1ipu4PLj8+Xk7Z9vV8wtZ1DEEphL1XI2k9uNf+xBuSCfMlpFwgWE8tAfnFkCfg81gsu1NX08VSjtXDqE1In40/IHFOzZ4tyLt7qZ7/kBQ4ePx7q7d8y/gvI4fXj+VpGBMwVNZUuOvH/ZryeNkSBLUR17qVutMIf9n9zDqJzWKrAMG1tJQX26QssuLMMh3v9rPo11qa9Tm5oIcUuk1doDTOXeKxiquatcJeZK7YaM9LaZY4GJTQro7Ac3hV3yf3cu65nUmWP8rUZWeymiKPTtRq6iE9ZyZUCyZcu1NL+SbsaxZnTSWnQInOVlI9/z+rY3pyC9Z4JI0J4E+lfnbw0zG0pi9MqtcWNFrbPGkUhL4zbB9113zDPllmO1Saef5+pm3N4mzBHr3L9I4n1YU6Kx4YyvhqawW998Lt9fLVCY5qk2aRxm6EtFOqbfq1mePmDUFRLe6gH58Iip0yBg1+tBEP8STBIHezKkm/ZfTiTKCNNbCnOxd4FZW39tDwNN5E0WpbcLhzt+f7Jgpc9r55L7EVVFYwKYeW2yZKNw+LTMZ7Y8WaqijyTZNju8+Do2e9VW50R5hHxKjjVhl7dXnx9b8K5We+387NFdfzac3bjXDLykqRS7tTkHKA7LPr4zHhlT84HrDbNY56iLXNf5gDcNwofWvjChwP6nS9u2+CwidxLN7kIyhg3g1TNyLa7uVwUz1mNjxOszI7ncIJYcbCKhNGG70F2LIn11mTjlsKE5fEkjrCkGvYGCVNBdwNALCYuoz221ZoO6TAmOJNwcYfla7SiSNU9UXp4Y+XJ+tiJYQL7y1OIWUs1PCF3NG9tXkK3X6+QTEmTUn95lsMt40V/1uAL5SwgVYcDxZ89c8kXaBBw30e4pA/jO2j/6VZbvdSWhm654XbS7ZJgOhOyS9+KjIzAtZjWvSy2OwPXytKj6cPnm6hd7xk5NT0GlcwVHlY4KLdxCvT2Nf76yZzI4jEjakAycXpp+WgWfuNuYM4GTwgHu4XVO8tkvIyL7fggsgleqKraHo2F/dghyIkyZc3S9Zg+QkjvokxwsgkxPYRvNMZ2og1Y8R4W3Pg1ARsdgEfVglJR6Yxbo0yOxfrWRJOfCKgE0jCHTq89WeDWUdqTsX3C1WDtwufzzDzsp7+Mf4TLCs7kbO/hMBZI/NqjfURW2NeCKxOS9BsqUs02kt+/q0S0/PAuvPBjXPVRG7yrdFJ6BwxgXPVKFdXLi8edg2Mb0UxcoJ+gqDzosghzFkwZXAibkTsEd5gbUePlJ3ZXYqXSxXT6Ttll5f+ofz6CX0aP5wbWldwHKIINOBktqcV6VfjXIXDtW9asmMPNWfiavNoBos27ntdPJ1m+pttYVjX8ba3T9Ry7SLwty6xdPyrpt1uMlHDwV7eSGyi7IZQuBYiAsiiiEODcTcJRf+fL2RGYxvSdjEpQYt0IDh+CT02+WPaToD0jgs1bEZ0c3yZ15G3+bkJWeo7g5PwP9b2WHB+pYQopLKa4PJf6CP/6XZeDnwcwrqJYYJ4aZxC9f3lbJ7DG+/KCKtJtk+UCD7/TBU+WcBskONFkooq8ifFSrIRqr7oPRbcmnwOQgEanvYQ2revN8nTlYjeUr3rQeI7qir+ClU0zDINSEv/dK1NjzN2yG/dXL+HpXHelwwDMjDoZGSxE/B4XQLyYwJRblV75rdJh6JNJQknqk8GfWi5OW8+Iswe1l/YH2A6ja6x32t/ELevitfAwG0Vv2WScGRsMdHYJVEGiwvorZc/XZt0bmCP6mv0XqgKkQGRLGxjblWBBdFgzsL6tIhvzed2JLl5tXuiwZoDCswo+9fZQL0+cWQWN6hT8gGz1R6UMDUdTizNPNDppoe78AXdxVj1NRC/wyBvnmHfjBnByRKiBYG8elMsndTCxMhhq8JqK86BwjeOpH4099ZP0JWkETiPXIkVi8HJwKMP6WtvWiABxuybDkD5wCaiNJxqSlzr5B85CDtscZFDtOFJtVHMB8/vaIb5Bl1d0lkcDmlNZpY3mQjKPve+0/v0Kx0fOl5lZVR1ldB0+Xx4OGjRcDyQmGV9VRKr9buxDmL2HkKIlj+oofpYbhZ8plpFrGDuqZRljBN1HWsTfqtVMb/XU8mOer1FPqL56oV3twZyRN3iGwXz5empeVfOYiXLNwKUBump5AJfqDlEeGqKS2S/5aXt9wo+BZ+tcnqbf1ymEIG3aG0wwvSwDjWAomO6FuBO0Wny/U5i7f2VhQUxMTNSOo1wq2iHyzh6+bZwKvtMrBIH2tSfoY0OHG34tL4zBZIH7xI+CBcQrR3VHd4CHjlJj58XlWbW7r0WH2cLCEwhTgquiJ0s1u6Nkd8CHoDRpnUf10/rbJnpSDnOPcmQ75XWpt6jUDuDjdURGMHNzPy8q/9hMRlbuvWwQ545+ooOGSe2eVNJJebZ+B43uLZHaq4fLbPY0gifA+ib8l52ee4uYCdc3RfpKM1GVUfFYjAYULlLt+NKnqoqnRFPnl9aDApy80pMHX6p9Bl/DjSz7xid/QUa+Qou9fKes/ZsSHgwYR4/rxTodQfDPzpUlcCPZLlF+9zMtdbbSXIHfSBCOYGeA9ctGim73P+L3hxHzfuRFTu/UUrvv4RSwwikZ9NHU12t8RzaSGDUNtB4q9tsZ52KxDxYhkq71Ruz6QlTigquE94UmWvBygzOBDyZeF8t0tXB7Blwwj5RFNjT9ZpvNPkvTURFLsk4NW4TaP3AvHd1fD5GTtaPqqL4eGXt6jnOvMmbwoJdwSE6mFAR9tdiW3ciMluC8GgvrdQ/Iv/5WkXFxgyChjeAqfsWSFo0ionNJz4+sVZB+Uwaa9sUY+B3GsMcqGuzGXdizih3M1DHi3wUgJbFpNxNtv5Kjtz8ua8I5h89a/XwyuwxF6ydKy2xEb8I4Lv9Hekcx0JNcOjb8z9Dch0f99pJ8fkTlJ3yhxuTB2B2U3kAq806gJr/9R/XKYfyrJlXHualGoYbO/A2QrH+AXOWe4tNggHYPvsgp/3bWSFfYyOmZQop9JIFGzGHpL10xx5OXLYXA714n0tpKU/hG/qq8M840hW3E/kQ1gSEU4AdAD3nI2xHu5LKXIK8AQMGjn85efTzRzdqkPcoe2RmUXSvRnES0O+/Ttl7MlWL2ELYYotD7Hl4Y4zPXy9+qWBVrAF+6OKzSBLhnvOMLwICNAeidyAiBCP6QC+t0YeyxvxDBeQfNYhHMlcXnEzK9qEuJ5Y2mfcpz8uXq1RwHUMSA2qPFDPxWe0mbHkrBssrRMSrXIPHM6VL4jXtvY2/K6Yy8lO5flID/ujTTfFeO0Vr39tnoivBD+RvAhanf9yk4pvu/dDsotOqLjfTQ2+DZPCK6yHuDI6o1EHvFOw2h4WtMA177WV9xggQekvcLEsd+aH0xtlp+BZ6fYSaZp6cMlppc6Da+tr4QzvawoCe1CPVVEgyRcwhCqY4EzKYhkqhqqefjGyEkBuPMgbswy6FCtloFRgZb7dJPBcI+BT3f1lJannBcWHt7arb6Bq7BmAazkZghcwITtpwtqRXCtCHp8ZzIKVGuqmTy5/RrrXvEWkmXXncvzBk9A0nbRpC0EdVjyt3pFDRKZ8tz/fG2CWJ/1wWk2oUmQuHixhR1Pn5Gcn/eZJElLHpreVgboLJnrRGtkeKo7Kb2W/RZE1B0AZC7doMFmJAw0XB1jlMhO8ua8n+p46eoUd3YV9hOQLi3yzxtQtO9+1hcBE7ytdepVM3hQKyFk5xf/hhebn6VJr1f7P+pibe3yHhV5+DS0ehiuun/TlzN7GpVf/U6baaZAXUXoURm7aa4k/griSz3Q7Dh4X5nmoFlv1NYHPtqJfylop2mGxldb5DIPti3YO5nMGbrhapPkgPh071csk/837stUZRSEctMaRBKVv3lpyvaDbr1GEgPm/fI4G2v9Lr9a9rV1EowCfiPSJ0wPqmpfjDFRwyc84+cM7XZlr/nzJnu5N80SfgBs3botgy0FrPrj4YBli9Eu39LfIKwhDF5GXwWqXkLYBYVS3IB4og86+pSbxITaUoFazRU7Pm1vYSRqlEjpC6GTlXgzolUXviT3suRXXuuZDtZ6fMR3TYE/v2qXsVa62hPmZPzfwR6G4ZKTwHrNHu4/vi+bB7PtQAsFJv3k6N8cUg3eFKIVMJzv//YQ3/D8yY1sHToppJd8VyyFrFZXfb5qAdWA0wjRKa7cbf7+thpAy3b0bG7tU5A0CdyTQ9lqNXALkSmLb0GCOP/yUFhhJ9CanE/6nW/5nQal9GNq1lGfixMZWiLvvShyNrDdL98PSQdg86/WLI88Ap8UNezeexE/j89L8dPqxsw7mJVa06VrrfHTH3w9ZZPHnLtOc1XoSAWcM1ytttZaFplUzFbPUhD0DmYZzE8jU/lViitR4ROASzTz5hGGmSrxI4IAlGAe5ABExW33mtsy/1HhBP8xSHW5NzjiHqcb6lFbkgGmhe2/3ZxiKXJ/ZwterVuxBl6cHD1Cx7oWF5GCNFmyJgJFDI2o54Yeq2uSYoSPi4g0d9Y5h/ppP/pK4akndflPB/bganhe4A0//42k/ZjqLyNo8eW+oGKlIKpYeqCHyVxDKcPwdk0chYnjdNNfTPfSA9yd2prP0n7nrMlNcvrMJUw6x9UfY6+iEFxRwU0aOeUr1yN2TZ7J60JKfSH/LsnFgyOZUlYrrtRAFy2F6Ssxk3xRLbPDsZ1SL9L32n/Fk8FTt1IkGefgWWYn/MMjTdGde1VivkSj6wXfYg6PlUN1rWDjN0O2NnWwcOGCcneo4NEFg9xpeoshcA3rRxBrE8JNc4ITaSQ7+8DLzqWdOzWc1wfwvIVORj+fIu6bbXgBKGB/YfYtvIg9pdfyk7n8TojvQOTSqevsLTzAG4AOVhMTJWQYWnS65/qiYBxDBUp16gm4S7+2eUTf/scgxGzzh2hVCw6FyiJP2B/oq8ZQQFyhfHjSxb71crtjbb/vqomumR73RkGLYN6y2kpFbvkSwRTyTkkyUpx6n7bGVs+mrEQG2/+YoQ1IXMaG0T6jzKUnBZOMN0Q6h+JVai1V0Cb9SL6+R9EZKku+8s3kfVocIoT4fJjPh+9462c7U1sVVD35k0mDzegC6Pfj5L1TnQwlw3DAMsQOHdn5qq4H62cSW84hGrNTCRnhQn+MRraoz3QcXPG3oel9sdrhp4So7jiwvRo3dzTmt1WpGVebOGENYkpQ1yINqOukEIwZ//rLjmscg6LKPxk1qrwDJcKQqkD8aJ/qX6Mw4i5hcQavzzERKsGmc90/VIy98wIgMX6TPhcXO6KVz6lrSCCqH5FIIdtrfpSdNvlO0/TXSg3T4zUcF0I1t/h9WkwSWE+rSUkr9FDRcl/NULLB7dxNFIFXXodK5+Pd6Yi+LEwPWisIqIwVoXuamkcISqZWeK3KMmaHBgsl5dEjoM8W01l9UIAWO7xWQR745mqZH4X72FJr+7ny6HzrlJdXSGt64JiY6642qgb37TIPo3NiAqscQ+ttfMPOffV5Le3eActKYwLbP7ZRPPvOzXg9edCU0D7ni1Xi1tWh/vWcA15RaDoUVGmpELkI/YE56IWwvzUbSLdm/aM3PyWz7mbw14kLv3IB7VZckURxtBYeMsIS45VJfrsGnQziCRHX09wOylqSM451B+NAyPhVgkjRbSIIezi0x/85l2Yp1LMuVa5HmwSou/fr2W3vRNuNj0coa6IWxbxeE/xLyjDofu665pT8syOhyGAGMg6cBkaTp1J8OFLMefZLh7Pw00scXqdh+8cCN7ilH/CAkTW+oSl2d8sbP/IMlJZ5LvLT4K19tnO0FfaDqVJkWBYrOOl8ouHmZmrNQ9bOtoEjCFjdulR4actkQKpnz8gTKtLyNcnWyxG+HwfMOpyOCGFZg4FNKHSiK9+NhUDYRKKXT1Lvn/vjib/Dfah/leqOu1nO3ZpG7uM7llneY2MFFXCAzwWSVUuwFq9JMtRqTiqhN3na3XlHY5813se0z2WFd/h64DWALyzeKiKtfUF4UQu4XbIKB4k9nOCsdXjjPYF+XSWGQHzmVxO4lNZqRcAaITwFiwSkGnmZMtX8igLz8+6bYt1vkTT3A/GJFnI3/ieOCPcT9em0nHyerjs+inIlP0q1xQL9rahBVQ9+ma+PD15Z3t8kp3sqCH0UVv+RBBZV1kOwSO0HCwLQyhklg2jyAKyv7sT5m4zTIHBYDjoAaOnqTTRYnm84JvQS9pv0kpT8jdhBA0UQ3krw2UyPWCI5yI0QKdwMg4Klmi9XcP+SU1NO3OOYVd4CGYpV1aZrKooWvoTs5h0pDyBvyit9bJB/Kcye2RZs+kEFpt422OAl02mrEjg2wTfaW5T6l2QGj0vefVQV75ft161cs3Ps4IDtmAw3WGH/W9GoM9BCrRqO3b7UwjO9lnhn1sJcWGFxPuUpE3Gs88r1FFuSJkvO+6WQLkbQUGCtddeDCiDQPHLGox2p0hiaWep3Mkf8g0YylM1ubHxxsMOOwQQ3OjrSaDyYX3SV/NQCiCiaYLrSCCvwRhjZrer4xkD3VqxGyESdhkQuGF0LPPMwkV9FgUD3OdLd/zrZpcwJL0aPklp21GdIgttwDYQGWlnmhaSItZZEb1T698or7W/dVvUtG/xmkEWuW/KSe4GinwgAG3Vqbn4oxg4CsPpNcpONKoJA7BYFaGOC8+0DD+liOhY8dDu809bfXGF5WAPHoyVXxe0iGs595pFPyfxJFj+XwPCnnmkPXWheBsYaPwrJssKqA/j6rW0S1oPLWFKVnDIRmYgcXkDvTS4y+cSV1cHhUJIT/cRKp2lKI8pG5o/1mT70ba9u5OmT/9KzIp5Q5aAVggz/TjNylpwzBf1xBsJrI9A+GmmqSEfWegzjRAT+a2BmEdRjBu4Vk1IypTS4zfFNyu8II2xmeI4G1vXHXJMVDfBXY5ynGU33fmMCaIU36NH5pB5TkXAYKKs6ZnCaQR1L51WWrmA1HYPlbfhC1QF77EcajL9FlFHL+ZW6K0gughLF6b+gFjT0chQEnE2LhgVW8cY0A5t6lmuQl13yAyXSAWDf6z3/Q+Vr3/TL3VXvYLFPEEmHOJPMdDewQ3N7593Pfozu96zSiOQ9zbr+mPjr/fgkaBnQpgIrVUuNeGkVn8e9K59WXogdbu/v10WzRS5gm+wKzgjYcA/wG7sst1OsosuI/UNcD/C3jTJRtG5NaqFe7uMI04EbdmOM7QrSYBYtRYU/RnkHvg2DlBXEUmO3fY7nxdD/O/dsI6E119M4DcvfTK+4yGf3r6E4SnKlmGGBik96Mu1U2uW4xaXVu5G71KX78/uVWOfYhFn2zK2y0G+pQvPeGfEB6jCBQWCltxTUCebkgqtuuoUd1vynCiZBJH5U/WiwNtPUKxIZFq8pXVUBoxTJkNgwnAjAQDbmWniH/qmzhWbQbKrZ1AAG4xN4OaoBNOnnbpDbI43I+h38gu/RBf3R/G8DT2CpuAG4vAk/lRrJCtbPIpa5XmsNai+O0M2gLSqe8Qf7904xF/457gV0gqW+lzN8Dt4zgyDR9T40hjayktnPugteBhlw7nL1Q7V4xrNOKNgdld+3QEBOe794p2pfTb0X8AlXygs1dCpG/NhCiid97O/R2Y8KbFFi2mV2tPu3/M52Au3ijM0zUmWo0t/ERa8FwL94cyoMlKXI5cxafU5uWUGtRdgNrj7aXv3b6iSTfx9DePiWpCbwyZFMWcuOC7VuUHlhsPrupo29okxta6YAs6PmLnJu2/V4daAGTkzozM3/U4UpZEYycB2fLfJ8sLBe3baYeoxDi6uQpdLpf0+3fideMzNvRlNyQsMoPx+0/jrC385zXr7SFBu9W14fkyhO/M7cHGmKISzHN7I58uf+fn4i8/qKTEWipXcz1HZEE1nb3ZL3ryeeMoWS2fSN7CoYIZWnaZWwXJnnycsbFvOAOr26m3tDXTAHClZS0FMnefC+1elVaEQcV4sPSQk0wzE+YJD8Gy3sdnfl2AIwXVKTzJrDq+8CzExyAg1dY7WNP/A2FwYyrj+8LxIzatP2JzsUjX76YZupHmRncF907hfYBm2SJclh5HxQ80vxLn5lXioWWDKVzzzGvkKYr6av8ameThTj5CaqdG4TzsQT+GTjIiE5+tHoN1J9h4ou1uo5uhR7XqAkmsw2FC+MO+FD0rMeDYkLJWJE07LbTCinOs8In/0gZncvZhTzV5FhBPwuX7QILsKZJL7RHFVe1coEsnnWMDijmUlItaX9U9YgQD3mg07Tb3p15qlOePKqEkzjflMTPeIFWXfhXH1Hn7FqSuiCSABIEPn89suFwIdMQTrFIYHZFuaD4IzokrKYfKXk0GyZ3sMeQdpCREyLuIFyv4kxrNkAHbgnZPVZ2ShJsS/WTxP1WM0bZ/dnietjbOgDaraWsonzb76mphoxpiICtxLdoUGAOKT3Exy+oELFIh7sgo3kKieLsm5Jmb3gAIPiGJV2eYVvDmkJSZCSYEy5QFojF4RirfCMVQmQYk2fMiJWuJEQW6nYigeLEhjK4mWjkho5cPrWGRv1HD1V8w9fVZ/naVamtHlHNoNWZDv2UWw6z+l8kjBLKtupMxOBv5P3/83WvPUPEHKm50EUAOz1ws5kRqX49UFQ6K3rSCKgJcMOxZEGT/Ij6g756INSyUdAiWZv8mr477nRT/g9hTwyV/7yfLN55bM4mA18OTkVLwOV5T6z4E546RMt0neanGdnI/Lt/iaQinG48ve7lS9P/qS7rZ+FdQZfgBqMoY+cN8n9LhnHVJ7O6Jy8CSHLVFh4CIxzcq1IeWQWWkn85+xlFKyXCSLJEQmqi/JKb2YWqmbc/MVpkYF+JGIkD8tW/Sx02pMuBYuAfciMpcG74TnDMvoZIVUui3SFn773uymZdL+gytQvRQ+bhL3Twnoho9N89VavTCNnZzW2+2dyJFR9J0aVxAGUMHeb1eNpbOb6l6LvXd/84RoXUdOSULXsqwOesurrsSgYtyBm/OQeem1WA/Hi8u5QdCfXqQUdlaBGynOfjudEhXQCHhbUgbkSFrt44XKQug7uxSPags2rjZrExb/VL66nUmauR6Xf1WduVthiEkKGAj1pkMwqzLNEcbXMKQOVjUEJ+mhM6mJiv+RZMvrDgu0BAiua+Ia0K1AaKCD9OPyRDhM2rP0sNl2xCHqjDD+wr652rungsGKUs0UhQDZg2B56nCnQ86vzYGmFjaL8BGUN8/JfR/mh9eCY6Nrh/BuddXmdQ34J1E6kl0ssgQ5CCAvIlDrPNblrxZ1rui9TleOpp/2q6LWjWWHnUQTef1TDEpFIvJtvMRdEYujk93mZZKBGwYWKRihBsTozaxpPpOSjmEdSik9W5jkYQv0J9NX8C5YS5fOrgSI8Qc3kAZXAu4UdYBGoeuZsVpXVElet9WlN8sSFod6tMAjKqiN7S3w8X3IIurXOypiVXL5t7eA2NlutRo6wii0glw2k6tepxvtHK5lH3vbb1edgewUl4BXYGqgU2YfpcLkyT0graOejt27ASNd1y5Xyqo6VfVtvxla3Rvt13vGXMPnzC5soz/NMuP9WBBX9nU2Jxz+HsN8+P9MV/nWP/+ngWVvuA3R626pCef5QEhBz19SdJBmmiM5pN34hHfHkBkPRNAf6iLrMvAehF0jLoXg500fR0526FRvAXZIZ44V+0QZpFjyh2PDeNLJqUdrHzue7VutVtRP0uFLvjggb0XuKVI1yCBniKRjZE7sL32ehiFrf3tB9uXOObcxew1rnkxeoGnOIlj4jyP0kfTZIkV/IZM2L9F81Va05lHccbaca968h4MIMAKZ5YzS7OD5wttQBuAsXHK8d+Nw5Ax9XOM9Inz79yReeNEp0E0jWAWc7Sjvc624jGUdJ6TkJmNf0hnma1YUhmZoc8riVQrp2ydPlL1+HWh+hG8zu+XAoml6UtVdEZ8GHAOkjUdgnG4NNlhigllQxjU6avegEktUCdb4TEQ8+2iYO41ogpQDEUyvH1xYfpm6TF8n37yNxd4heaKQyRPNWhsO8nG2kP6B1xRT75X4pMYPTtZKc2QrQgpHxpzzJprhOcNPbft0TrTbYVy7MepK8PukbkBFmMieSkWAyHjLqL3SlvsgtXUogAxsyRQ6luIAELFI+ei6R74Ms3P35DJWqEAg9pK0H7cJjComJFUo5ZS7+YrftiPfR3NSKWDHhf+CUoPfBxTjjatZO3EIJQ/vOah+s+NPer+Nz6ENwx4OHRZuvkDMZZ0JUDdhTzgjHjgV5gF5S4RMdSAgzBdUtdHxaXOMepFAfKh1yhjOTlExSY3j/QOqBXTPl+xzj38ukLESkqiZXc1W3riQ+B4yizqV2AhoB1Fusll/H/TDhdsbMCC7t3mGXdyjyYbFH9fW7A/6Pbtdd9Rh2mk4Ppw2gvu3fZtN0DxBiiy+eKRGr9r8R31hr+Cji+3QlHMvz4udPPHa5cPaXk2DW2RJv4YNVwRIM02KAa8g3Vmi9Hykga33M9P6fGR1W99m/iJjX2raxLrj9HH5Z7z5dbC5h9it+isfnk4BgSNKq/KLooMIUBIKcjmVl/8bv4C/MA1fAMEqqyME7JyxkLO5JIjhmEwitbbE1TBINY3S/5ML+eraaZkfDN9nzSv5N4kq8+ac9+Jb4W5VODql+5dGD50RXlF8umhq7FVV5XuZvjPIVsmuTEsan/UO/qwgkW1c24FXM7DwEK9bL5IWff4RL6IxJVFShnWmDDQoMJ90YTYPLjZonB81/0l8xe6GgtG/qIDLm5lJqOST87GXz7W4mHosY0zmVBLjITXZeGiLDW2rpRajgtdvtxJe46scMxx6SqFrC4JC/Oi5jxBX//u1k3KNpYlfzBFm040DBt8LDg2cZzhlYreNSp0vu5NGxGbDDI5+rca+i65iamOcAtIMW6Q9eKBp9/6aIVouQNKBA38jFvQ8rSAAq+aIEg/pB8oBVVFwn0QH6/fU2mtPwmjeJS2GR0IDZGXpRd0Mtrq3nHrPeU65NaHJjFo806CJqQO2PhBfV1Bk9d2WoRbvLacBIleZHZDXyIxQz3Y/z+8SVxJROWf50iSOx0+sA/9YKt3A9FFkHBRyScLYD+sC9rsYUP1YdFbAGGWkV9TOkbnew+HKL+notiho5OSaKUO6RIJFDfjYa9KN6F7VPECr+ZfnywGCL8nRyY/CB7HG2S31ijmXC8Mdyn20lucVsyF1S4EGxUN7ST+Nrhs0W/4z/OXk4nq+tjCMGUadJrSlxWi0R3aWD7Kp5ZsvB8LS2n2hwHk3sxNcjkKCVWoB6egHWdPY5lKH5mKJQ4d5xgeiT/9nrsPWs0a9MocpbRHlJwo69AlRoROAXtzRzrc9SXKEevMiuIBIC56bqff5Ow9eJ8gxC6eTTDqBzR5jy+IhC4uuertXbdnfo6yrG7tVhil1f1ixC5BiZZq6N/CG6EZuKrfWDrbnLP6fXriCAfa5XWt8858o0qmGaER8J9bdIO8cZ24VNEaGuWRZR3q9zN9LVcOCzlar9yRh0WxwCcQUaGGrZpNX+il6DsJy1oD1S9B3PfGL8IqqP3v20TKrbqpg2df6qkL+1Qq7HOw+bg7S2ZRrgC77asW6hfjPA+txFW8d71tPWB+k1aSrRq7ih0JwzLToaKjiVX2dGYM2HQK/rU2lDfxjaSaJfOW8oPg2Wl3S6YnnR0PKH15uoZlJrGkeJnijuCkxqHGcKb4JriaGRrN8YW6N+63ucWx9O+kUv53is34phGlM8gHHQ+Lft5nGWs/LmTCcjBcqcR3eJziy5lPPfJJ6urKUMGbLfRQ6MCbFuJ/Qpoxq2z24gaflBQJaCwYZ6DSHKuL7D+K8iObJteC3wyjpR5hJOHaYK0YN7v9VXj/g0c7ViRXKyC2rZDJ2Qlr6eqADw8K9Tw3oQkZGatrpII+1z868gG/lCV3QL+b6rs6FvLf6Ws3blGFem5KafQ2hL5GfxiQ1YbeQ+xyTG6lLPPGF+NdYjyh0vDpXxoUyszG+vM6CXRWOpKjVucGIkEOnA+hukVMgN8TS2v+MPtlq0oSJwZFPAgFlyRcgwws7oMRLi21BrDmoLjMosvSqFDDxPS3AU+DZRCSKy5W9JVnBDg02YrG72xZOVRfT82PUj2HGUPzRtAz4zdNcp0RvLaS+va9vsfcHqass5P/1KpNjd7Mzb0RzwXqw3pl606CtWFZGAbHS6HqxvA+LxS29ftFx5eeI4yKQYE8WSaQ+LO3i8OzZSUD7jNyilQv6rGvth1Nk+8tV+C4D5oKyD0CkrHEby+q/smHYPPMWfyclqa3SC6JY5OJ//vsl0vqMW9Zn5XGMLDVwXLA3xVw3/0vfBIiR3+Tdz07qrhY+5TvwIKWHAsPNV/SfsJUAaci5zL5Z98BsnvogyNu97ncoovnPuOHnhl1vcAhFK4oNWNVw+fMhIzWzfM7lbeA0tx/ZvtTfx8yWRu1nQQVplO77kezle7VLYvLsbaI6+KM7xSYvKelxWPmC3JDlufV1lCvYSc2719nYKBmzyK3khQavKBekDqaFYX4aNhDP/PakRSqUVm1pusb/nB6k+7lhP+7SvHJowj054cfwkxSX7gWvW1Z3d5/vYZZByES6jsC2QqkM/+L2w93D5sDMozt+7UOfcAiDmHK7zkzDctgJfwGzdOcSYeOODSGr1hfLItr6RDU3dR771PrXakWrFOTjagrnOH0Vd7EsAA3Zqcf/ESwE4DabOFZeeTHZ01iK+oqwWr4tmZw7KpCpCt0091sh3tZe/fMvW7NfzQsMTzuAP8oYxkIYR7kRn1T+Ov955ie8seT1qZzZFYqiTKeImuwFIEWTK5D2z4/7zgkGqIE92ziEiX7LxJjWwFdfAJ1YdcspJHIkNkKMzuHG85+e5mOJAsnOqctikGL77itDxs3ryulfod4Rrdfo92bRKeEmxOer5IdvvwCnR03u2UjUCj1KtEtXOOwENwzcJ6QkmYpVfF3K4NA7IDs1l4ZLdTYEsGJQRUcraL+8mBwUyjFU3Hd7ZYt4fDpEpJ+fQgiXthfPABtH9sadqSwDEXnUDitIFMmiCsPW2o3rWVa8/TB1ifgfn1gQtsdoJg7wL/sBUaT4goGbhqk4SdJr59so1/hIe0eWpldoZq6umZuJiw3hNCLw0PDpoe/2x2ydIYa/O294Ycz0qj4AFlI/6HpXmmkdXXPRFelvxyM5sCEWH7CClkCjR80UCXpokEHi9p5djlttzJ9ROV9uDkw87GWu/u79kRBa9LAvttAM8P5zsqZ3NleUhwRlXLZzL8ktfuCwXH5w8GjvNOupgC9nn4L/zdMVV00WeNLjAh8TH//TuJOZzMxRwZT8oIxJeDs950Tyf51YydVtf1MNE5UZL5DS1znDdNiIEHJNbmq9uNUFUjYcoEBW2jhR7h1zb2vs8LsmL2f8+Lf8prX+RRoK43CSW4/4wLceeBFRq80fvgjQusM9RVgjVf3IxVsp7XQs4GhjcYZo6VETVqdE1xEzb92xbIKkF/Zv48CfM3r/hSZlTk57qfiBfA7bCTX6GNGto83kwUIm4iAjYMm24dPnXcn6DGu5ChLK8+YXX+n+DvjtDdgc1uqyfawjIqXivTLVlaQQdv8Du2wq1z3J4TIQNqHv2UUo7TTzuVjcGJpwuz8PsTm1jsjRn5tbCP6M4s3YTzdMgSoFyu/hgJ9+/l27P1LJ1nBAdPdCnEUTL6DnWcA0AIs17Q1LhTu1BFb5Yvt5zBK3+ekm/ysH83qSK+DwAl73ZoLvCLW6w4H32JrA287BR4qnVQrazh7WU8NW0HUQLe07o9EOPA3YLGEg2M8VIDhHZrANGQ9VDjmkQrDyvIQFijoP3pJdIzOQvMEB0MVByTQUUukXlSLjNMI5wiVw6x+hnRw0Ji/ZQ0cexflmkWrEkUl/ubiPtwDGeqbwmR31DnxPm4es/w/FFWt0aVnfWSVIwKgnRh0pI56IdBn+jaSNPDW7q9KTrhmJz/+okKKKsoGPkKTO3vNXQS3+imU2lX49dcbp5nF1tqiY4Mf4yqSfpSbq1BGjWzw5ZDMkwIgW/VNtXJfsD1aKpK7aVGNL1YvKhFcXoiJOp/quXKzQ8xspPYbfxWEUCz2Qp3sU06lzF98IvW6Glst6qGP44BnqD3wpByk270FCBZGHx70MK2jO+HmWHC8O/fN+k55hrDTARTbQysL3l/5+CPsARfWFBJmCXr6Kyigqxen5QjtGwWTs4O47HVWFAI8O8Le8P5M3CkWGeHZZgJhEKtEVYBxY5OSYr5mHdtVkyGPyTunoOB/CxGQL2UAqShc6YC0MyUxHXIlNTWIRlhWIShxW4fGJ0m0csZL1qZDSqPrCDPYyZkI7nxAQ3BbWxKdq31ZMk4F1W/AVnpD/UcDwyNX53eAlCeNGP6M41xdWD9USUqmx+EjVapNS+AXysaQO1RAK45C/OxD3gj2RVhaUGaO9d6W+4gV33zheDrJ6+Tg0gB9xqk92S0w+75wekfLAoo20N+FzwykeqpQEaoDEPTJXDIz+Jw4PKPps9kkXniEH1M1nnr7/0mgyaeZoxSL07mHK4zwKR0u0bSWWnqsmIDH12MfUA/PI3O4kse3En5CfGm1bb9a8udAAaDNobGDmnMcBcTiFS2H5YQQ3hN5SV2d5Hw1uCC6Id0IWoncDWNoyHOnZdB48HeWrikMusKkgtqVDx92q0LXKbPlu6LNbHLJAWkvoONX7baP1joZen8ehnDDvvWumcSFuOBx5sfd05mTFr5QA9s+8pSPP+b/lYh4AHaqX716PL9ryh7O8RnZi2R5LGssoeQKXvDFVJHc8MqvQ6vGGAE3Ygym/b9yksDomgYdsFF41fRnYecS77wNZUz7nSopyhfEY9waA4MOywcenaMtCYQSZpqpvRUy1yz60vQ3XedqjKhQ6H0F1oMf06I2Bx/DdGanIfMbNxB62dRSJGsllipyaEYdU75iPUigEo822mBbSTpAX1lNWowoEg1GdBAtCJiu5ycXMgKb+4kILgQJ5mbcb+Nd+gY04j+XQvBjYBS3152v+ekCCfEoriD19XgQmO9UhJQRnyzc5fQkD/xlSij8NbobIWA0mwL3gFGw6mpwuMF0OLZ3PQvWj7897kiiHwWhbEmfSY5jaSR1BgjhRIdVnzRSgoCL8IF/UaZN7p0arY2F6yMJiFoak/EeiZkiEiApyqYITNVDWZbONSoYXzybQ2xWaQOGOdIn0eHsWT61lzeWuVHYnunVYPwV++aixdQtKvv0dhM0dfeeMxoiiumsLXnHuvbDN/3WExI0VmaLCVXKhB+CzEo7o4jqljeRl68Px+oRA4e/inMlxWwvtbLZItuXXjQdmdqmWkPCKq6D9uLG81FIb437GDP2EVYnoh1fvF44FRwW14qxf5WvtWAF9gvpnHonzEzEeDOXeSBsi3nOKMIl/2yy8y9CRQh//JyjwdCg9mHT0mN3NsQE+HUQUCxlnPo/tgOkrcLyd2ZKyvXeTZOtiukIIdvkLyEc3aEXCzf7UTVZxsVc0jG3zXh5iMV5g7m/oNW5+q/07OgqcgyzRCg94C0c4ZAqTAesKA8N+XMl+ti23S16dfHNboazrEibgIt2jWKS2Rb1cs+W+x4L8q7UcgjQMUcY/8cHz2Q2E32lBFKHoogUNO2x8JuLUe/HgC5FDn3YSQXzrBAvpoVX6nvUeBHmVM4tk5CY58K0FZIbLYLlmabznaf5uGQTLxmYWABkNiBG5/WKS4ENSLXpGU/FGbpquyRNgxvY23A/RqUMWik7+X3mW5Q9iXbryUJG15uo5Dk1m02GSDj4KNZE5NX2ngDLC8jp8orE6JjAZLrAXn3y4UZs5ssEEiKd2xtqjjZ1JTpwliwSvM36kiL+1P3MUlj/ucVWnefpq/bp+s5F51C+fpFAiQDEvp02ad4Sfps+3/zorlQrO7G8KeDSIC+O7yjhjSt7Qiv1chELZRIpqNC0J1GVkrk453G9hx7RE/EY6GH5bz4+aRIH4FOkOGCj0KvmO4u8a8SJcfN83KajGpnJqzpfA2lrGqtjLnHonb1uSHi0Kg8N5sSkROAoBKgvafkXYsz6QkdrpmREow+8nLodkkrOxlmEEOaaxKwWtFG02T0fgZGvvXh42AlzWEu6HXesnf6rKKyZBtEj5Oxq1WNScGX69zy7pxATIH0DNhmqx+8+Jzw6pf7dfL5PRNnH4sJ4ZxoCbm8RRIq7JKDwNBk0OIaRodc33rIOD3e3uZvm1g6gq5zVO8odY3Uy8hpLX3/80AYn7uM1BimkISTtQ6NeM9nUEcsKerz7HCJtVGMUOqd8LceGIYiywBsNEPsO72mHDS3uuOWNEAQYgHlJjcz4FlMrJK01K+fDD9EtcLf1V3tRtGU1yQs9Bc23fWB5jDUzJdXWuvHJQ6pqRYHouA3GgKOp7zKIyYMPMhd+mbw0lOFUzeF1YIx17dxUkN4irDFWEgtLkrLaMsHrnTkjhReNc5/EhH9tssJxD/qIOFBpqxxs8nBRhOASATyEIn5/b26LWTlMQtlg1UplNEpGhRoisLpXrxvVGEso+LycPfnU4ziPO60hzoOOThA4qwtwL7eShFqOUUJFCOR43uHgPNthcppOYTsRjv2lY+mW0sr7KiLODPG8BuILkDTZiD1/Vi4CnfIrMySwxGdMn7j05hMsMcWzXa7AzpWhY/+ngjRM7P67n3/53JvrKSdLMtu6t0KDUyUXukJ0Lz73GKcBaag/oK9tVi7032yAoSa4gRpF8GHM8VsukzfJgiFI7p679qyt5SwbC57OXl62owXodtE7xm+XnF00sLbqcjSQU88SxyfLTHv83XJMLvudjsSH8ZMyF6OwHRUK9WsfnWk4cHyPyto++LStT6UuTyNQU2uXxly6ZngDxHGLftoouW13eIrBwNQIm2zgP9rVi9jnNuDzU0jIcF+QHY6uwap+5iWUJ6bV+3r3O6PFLsCsmd86QiNPcE47SFu3nuW/6IedmL8wTOxLbJQVH3D1TdQ+ZeRdIKCBoxFDdHKXI6UVVIJTrarjTP5kRs69thVk82wz0KAYTSdfW8ihhcA9dtpEH6INmrAQGylviBvUyFqYfNElux3mJbSuXfkp7Qnbc0YNvn9pMzDb53vJhP+dfxRnjeHc0kMI948qsAc+Fb3cIB3c1kiPlU1cGh/JYe1JUZ0i3SCjQb94mZbJiYRy5sM1Y4qgZ9XFm8oGhxhc2HBhT84PJIH8GRzzqOarOb2CuZlEtt9CMg248WL9fjszzlv0+fLu7fsbhMtZLJUgKbRAHV278321UCY5k4EQv/a/LNJzYs41WrHmyCJOLMDM7By1xs/Z3+sA0XmUSobq78+FYMr+W8qvPqFaKXSWELpBcG/Vk/++4+OVnv6NJcAU0UWSiDmpwA0IOAfjBbwLfn3+C8lQt+JFezmMcPpBSalxk+SHSa2mJdqj/WqleDI7wvAsgMSIrHzpgDbZj9dahLL4OxrSsWdb5vA/dwuHMFv4UVoc2PIIloRgnOWTCGPCpaUSgzI7fy1M7VC8QM0n1VXv52jHCIdA0uky16RKXpzjN2M6tM/9vhqRf0cjqrb3T+DndUuMV5REu+AzVjXV+i2sypmRETsvs1ykrH8z4Qietz9X9myUoXwcgknt6YjImEwtMYXsiCgAf6znZ8SVuHM69I8xnT0C5e6dHOUcd2gND2n2DM/47J/czwqv0nhUl7tMuzcvLY7FOkmVHevNT+pVGlsuyyNgVXApHbqU66VuhEhn6V0rSuUbbzBVBecOXM76mFfFie7ipLUL2k8pUMtapouTgyeCX4MY95ncVnGVoOqM+yIj/sHsWP85cqVbRr9hibzuGazHgc2T/tWtxxzw1sjPsFHvWb26nfmle+slOcOK+jfvir4K2L947XygTf/46ddFy6O11uqtvV5FZEDna0xz2gqEPP44LtBz+6r4SMoYQ+d5dhzz11oa60f7XILYSxgmMaQFmc89oNdEf+N/tklykLj87yfeVKLWi60mYI57R04/vYYmpfxmVz1lRRexXGDmUmrGlkQdUkxXUd3eGMlWsq/WxF4xlWs/RqpjTYrMhLUPgcQ/LIHJ+fTCTNJNwo00t12hr80xtmsUN7ecpadk8VJE5Kxh9xATmaSPgRyPCSFmziIE9oQA3WEcpeGuQfmzfwoP9oGrjJqOGhUbgDp0tMBTuTtI+O2HTbj7oZbHYkm3aNLEq+LCnFq69ychAkRHGUR29VtcjZfKUeFzfWMAsjZEIvnlWfTvC5l5w/ke+TF2av5PSGFPHx4/PI/+kuXWhChD8IRQrNdQFNu6bTWTN3wmtyVpj+ngmvOoeV/7WVBHTTROXPP2M9q30NzmamLhCc+X9sfcWy3GrW7CuJVRqKmVkzMZWY9fRXqtN/H7vjjhxhe++qj3JlLtTQD6gou3q9tBiBs+iz7wRWDspYkGurh+dK/8Ipp5T0E2Xp3G/uulacRysVCaXVq2o6cajbi9n+muSu7lzVD239QTPoVjuOPuLG4/nItggTFItDp1P7riHkegOwZrt2nKLD0m842Zmhc0XcsPYdu6BRxV7kecRTMlvk5N9U4T65Tvu0m++uy9+pbYPEj17M90PVlwsmzp8f3yvL/yYIAFhLOJcVRnw/XwRwOhIn1PliA0EN0dXJ6dIYXQASHIb7gNg2DstcfjuqmLxE9NYrU7gFHvdW8FnOe7Pbq2spOa7vNvlzE169V+IYeEezgCtLPtD9D/neNSiEn9extMCKJxucrDiKbq/HSTd7MHJRvsa2pmX/mLdTghQtI9WvJVpgODFDRCK9HA7rVtH9aRgWtMqCksY0yuyfFx7ByfbGxeuljGPbcpl/WULetTwFtEx5UDrAGo8uft7G+/S/SPkrohGzaZV4ZqRl5wow+z3uwvbuRkq4W1zTdl+hdlg4g33v0wEGw8VzemfKU4MZaK0KsB2HOftRKG0gMl/qm+edsuU8mIa7LFRvZC8XY903mOqxyXp8H93gxDi1o+m0zBheSnSIZJn8BnWpmogxXVMWF+C/gDAD2/c4Lmg6iIrEAgu/xChTKj1XByN0M4oEgUcCd8tbu8Od2azTeFraWKSLiyw0IvU9AXWi9N3GcF9cwDdo9aqy49nAj7/K/hWFoWZ/cCaTK5xj8aqrUijnJAKTPLuJC1sPwS1n3a/L9hYqqCTuIMv/zEOQmWahFBhrenO1lEfYhBfcCg+9S9t0V4NQHiMBWEqwMIGmPahUojRYPPjb9muPNo8y+apU33Z8F7PwZZ93zHeW+6Wk73TCY7GZ7yOr7qLBA1Lht5aiUdYdrYYHsfU99HaYkC+IvuD51WpBaQKSCVv5FNu2UK6+KJV4fJGfM3mDRW33fKeoUhY0fzD8gUr9Ch5UQFZ3ZeFCk09XwinJ4GzidUFhKKTUTUpfvHS3+W8ysv8xF/lWr0HXPjOZXjwrqtlywM/zLSp/Z9ULTGeO9g+Y+VVSl9kRFxqg0mJ+7DjgMPfXemDy1yWca5wguoLTxbYMhcp69w0XNvjFeNnRt2gLGo+4/kM008vr+pgH1bJOOdGcVLAivMP8q7NbyJZWTeeoNTIgWYyeLBk5GKkf4kiDd3dCjfs4nf7Y4dONNXbdahxm8/0wGjlEDu19pt8DJ7Hm2ngh7gZzJGbTgm+/oTGM/mLO87K9U/H2EH6uHHfmJiNOGLWQzMuw4HoPdbMs+qGKlskmdxGNvBox0r1WoOcq4PJ3J14CtJgVHiHRq2D0FY7PmyU0sRR/pfSn6Z9GB4p/dzDMmdZiqV/LAopoN0tC5ZPTlEOhjjjk8xXE+1ZGYXD1ZMDL1DG39Dqa8lREUcqNzFXoOzGElfhu5wFyq9CFrcemvLMA5scsl3n3PzMdeZM+O/doqkIdnJ71DI+plLGzO7ToXldlMHBu/smowfv6Wnx0TuwKjwGaUbGKdzf1uPfqGMTRX32XhKgJ/Oq4dwiZyZi1SDrzhl0eMKn9eyJA8IszcdIoyuEbEUMSGWIJSXpdUy92XBJUGwOzGktkvESdI4o7Z2ni0HGYvHeP0wt68tAtcjZmc5lAaM2HaOj113Y98yP2+vZPtwiXumM2VrzMPjH2r77hImKQ01gqr7tL5dkpV0riGhsquCBtflBOXh69ru1jEhnxnCvPFrXOyGy8wRN2kny1bG5s86EM6WeqsZLpwuNZnAH69MPMgL8nZbGdahpLazfqMkJhAt5m3VtUJ8Y3PfaF/PkNrGq27MQ7iJhm31Nghg+7pogUvIvSylWp+KXPnspvIDQXgKihP5f16h2WTetlxb7ZRv87vxAJSpuC5V201KlWWtn8mEAsmmucfXYoY8QA19zbmSi5vlgK/Fg5KstYVR3jcOmnwgJtu7GNJmPwyjPeVK39iYVh/Visd+okZ2pc9r/Tbwhyo6KMG1MNNlIV+tpMMjjJ6Sys7SIWD7zOkPUEHODVNP403/SkpTftVfrg5tNjIN7Qx3sevZikhSL/5ial8SdQEraa5lo6gnemrDNskGH+PSvJaUY2K10a008EJi49W1HpeU+NORxt1nkR1gwvBQZfp5bM5tjFa9x6it0jRQwWbj6L27Z4TxNxivUWk18bbCmuV2bv7vIjEICf7H8moqqcKWlX6qWnkfFa9ZkwVa6zz1tOzyFRh1/A0oRdH++mF2Iny1O6djv+EDGRpKHuYXdYP0mv2ikRa3pBsExWERVZu9YfSfB5R2IS1/B3V8+VxMlNzuL2Vfuyq/iJYF10tqo3t7E4LUsRRAuPVHk9RZuQ81ezi0SRVwmbp+T4aeh8tMccaC70CxGV7Ycr1YolDM7Sd1EKFzBT6ODEm/IjUCFrHJV63u9Nh2ru3sh/Sbj0Fvjn2SVXkCn7Wl/fGlv165eExg6u10cn3J6/SsEqIvvZH/isg5ub4OIis4r1Sl5WjTjIDGW+t4+uSf4GFW3uLGaNx/3vHN3W5UvWXd/QV9AHCBIjlDqBescHr5uMeemLqNQXEcEWNt6N6lI7//EBXffs7PI27AuZk2VNNxHnxRo2TB25Cd5GYHzterdVZb/pjqc7IAAWyrd0+y518ij63A6GvVlu1DvphOpQlXGCpsRsAkhw/TrxuzPJwJqUJktOpY2EPq9x3pHFwAQ9nF51rX5dNPC7DYkm1jMU1nB1/OOkiHeIhOYJ5lnfkoJkBiOHdfD2LEUfQAd4sDkggIACt96US8ZWEPbXF/GRGmMYoZcq9fpXO3V5C+Iu3u/XK+fvkOE91q6esYAqJXli50afSu/v6UDkRqs15r6+OS53Kl1KQEvhoBqJlQVFO9BW3oBdza7CeFIcWkkotXsQzemRdfqdyKYmXqd0hbXsB0sP3fg6QVngi8HgEvs6nU1ltB9QeeG8cmLL1Y972p9bdED9o+x7HeQ+7Kd9MUCnL9XeLsKbffTIPqAMAWoBtFCgLAHynaFpm2eeHRQfQhjdP359sDMnHD8SAUJ2pFWAcsQQnBaga/9DuF/RfSRvi1hKydd1uVHrXk3WxCtq3akeXDa+PoTtFMdCMoT8pKfp6vn+oDaUVCTV6YokyYR4J+kVnV6nusLxYpwNvB2y1HbSgh3jK7X+f6bdsUFyDGcCDVFhrAzBJl9ceuRXJDrRr92OBJq5sLp5Jb2uogiQAK4F+jIaaokek5PZv4hISQ8npR/Bkn2R72RScNjgZ7+WwOhs4befdnVJz1NHP3Tl1qJh1MAbx1OmoPknhg2rx1snSdmGwoBstRJvphXkp02VfKpz53Hb4trrHv377D/LHFq4kdEMSot7eYMfvv9+HBUSTEbiFq9hPm5ZJxDARgaut3OtfqpfN031WwRh9Ib5cHX4zWJByuodgc2GWq6D4V/v9p1X8P01qQdukuEytBBzmWdfXErWMEUcF8UMRA5yCvsVka9z/T1980I7XIqbiTyTjl1q1Xm9efrLLQW96As3YcW3zMv41T+9azSOcB0fA7n5b5S1BQijY93r8DdzaXiLJarbtpHuLVF6XeMskS9nTjNC23Q3NyxjeTEZssDtAq2aKz80x2IZxoHY9SZW/jPaLx1ZggXBWQTD0GQhqU7yQDdi1xbwq0FL6iTSB5moWVrQFF+r0WXXRvjDJIKBhuwHmKDcTGALqLuxf127HLbYkHIP0q4md/CZqt0ZIDln495KrfMBs7/nloPkP/3RpgYwSjwJBpvdaBurO+sNrGUl3SD2hLTVHO3ZULwFwuPJ2vywAG2eVljQ2cveepl5Ljthwy0gEK4wt151hssJExyGk3UKRpngyu2yffolmRxhIqVC/ODaN8zi1ClGXVQJXo+OMS3KomgDBw4OW5RYqHiHY1CHbyg1zLjpjQfvQ/05nriHC5JBffLdYl2nlZl2gX6ctKE8B0U1Y/FxQnJA+/vBO8DwsfjCfx7FRapb4lV3K6cj5SO/efdbUKqqjdJgzlJ7iLsQN177Yp4OIz0EpV+PLhIuK86/ZgsuDMlazA7KkwzF1bCH/RmZ1wfrpeXiNhuAipdP1T20vn/KaGwkjzYi0yioK9uUVchxJcaJzLqMbafOf4XvCGDCijouZDoXJZdYvPO+hWEIOSodpPcSV2LoVuhNtBIAC9ntl9xuvkkHxKc6sG+lSH5vLZua1xS2GWxfd8BSjLE1G7RKGOl6VM36Pd4P4xphI9LcyYZhe+3lt4P55E16efvIciXUZWCdb/vrNG1QaOnR3jLO2W/DlWzf2WbQ93mOf83/PGSyWpjBN/0g6T8c6ACPbGPNoEXpyFNHnPFwpAIriMG1n3+FqIRVRgXdHZEpkD51z/Q0WVTEKe+MErNcxa8J1MntAdnBSX7Grzh95e3wDOsOqrctYZXT8B1/smVrMKk7VWulbQMZqaLGEo+TzGHWCsNBpfVRiN9381LU7+DwN885v8wYyf+aFOlyoVhTFFfWDu3ysB4+OFKMbKkSG8bdawGB/TB/ul0TJkgu1gzOo0poC7elOYe0Sd2fOpmAQgQMljCwu1LUOSxgijltcq7aXh9VuMmfqAyCFnEk8csCs2IIns6cFYSBTYWmJUeBEoA3+8IYJzOM+VTlwdrP0Jf3BRDswAY63ElUsLSY57S0GCL4ZJ8vGNwB7cDqa6coq4pegV9fAS959HK0r8wDv1RI21P1EO1p0MK/Z7bGZQk4VS3Q22qwSSK4n7CMQCj8EADiTWz9sWt/Pm/PrOzItFNM1RY5dN46FA+yfi54JVkJjk7DSJMhQ7QHq7/r7kt8GAbVJV5Hzjl+gSk/8+tSR8CQINFRiFVr9Yq6Eu2SXfL0Y/ETxY3KApspb/CsT8bgY0QrYwQ0SMwwEBGU2uC9XfibTpJb6sf94HYtcXD2YoQNDuP2Ld85nV8ZobuJ+Xu6r9mR01q7rvNhPiwI3vzgWNHuWKl0oBJXMPCDZb8SueJy9UzyniN8w6r2gx6/MHrnNi239N+LbXW/rrx7fhu8UzvzkJ6h5eqBMSC1KsxuaUG4lrf3Kb0NEMuOxtUcOjYR9aI4xOpYE8hHMgB7Y3NhF0OcFnES+myLa2ALaj9aQ/Lib0onHvP3lKZBIS3utboycHcZFji3dkal9AUCA3K9Qf/k9h7+JgMz7OuG0zw6uE4g7b1d8aq6Ry0/ddb+8Jc2DRfUNRkEgUrntXxBiHBZ5WG18RC/vi6Cia4MKktHl73c07gW6dQtDLLSorb58JM+nEoH4eiQ/Sbt7w56C6Mp6oSTWA7Ys39AYUbZoB4Vtsy58zhA+gShTSpxZbvj2f98n/f2XkdC5Sf/73jIcZDb61bjAPctSLB5eyoyJ6fFQJQSyKmA6g0HladbaYm1NnKYLz87zZVhp+7WKgxfF/wujkoeSZ+eGrRxGMsSmW2lsj3QkDFyIlK2mxDELnQDIpeARjUPTe3ADQBig/OfJHfxxBCHhbb6E2jk0iP4L2qkdwkfar8qDFp/fa32lzF9gz6DwddamX53X5IgvrSNDwZb/lHu4WR6BjAafiRPwlR7oIS/E7JA3TPD8+8pLRJFmmI4NWCgWcmrX9UphtgCdr17UDgd9cS5JYGdDItaAly4biODC7aoZ9rxuc/z9b7JQxKqYoMBOIFeu+O/g1LsCwdkOaHOGl5lvYI0HyyNBxIhoUP5kH9MJSdLYhtgKPGQVaeUewJ29beIiovgm4CB2XvXug7dazj2OMFgJjf8d5vwWVo11c8n99OuZsMQ4Ji8eTQ5vPpw90gDln2z2UyE7CfN3g96Crq/UFclRXHVPEPsYIRSHkZ4c7Dc5eR/SLeKvhGuqnlDhBSyNqftC71fb4WSGt++uzsH8SwHe/TDaG4Sp+ZXHlHtdGkl7pcJ1lHL9ronR+q5PbLXfGrYgnMtDHLtkSnZrh6bArkzeBg6kqw+KHFIsQAPa7w32gAm3QT0c1uK2PrnUrguS65SiJHsNNg7QE19/bdeVw/RgE+JkgTzJZEWpSAZp7Q8a6jdcgXMAcUWIjyvxlhAt4FW6NJPuk5VeZQ4sv6cgNvl/Z0Syt3xi3sEa7b9elrdEW8+eMW0fb18wfMYvIcQGOmQF0Gs9GEDBJ8bU7h43Y6kKp8N2V8lSCwI4wx4/favp/atzramnPCraSs6sm6TZCWWY21xb8qEN5P3CyN8d6t69HlI7UYd3xIOI1jVBTUUbKlMK5eibfbRepQoWqF1+TIIrcGX/icdiNvvHFfvdpiH5FHmW+GhhJHAWeBxCZ6pb5szLvf8PV7UtAcB0vkW9fxY4i9oi7eJmT3ld17yQVLbXnFt0Umrv0A4zsfEYmmypESbZCvxnXhE0rhY1Z6PvG91ZYKQbwpAGGAsL+8Yp/SP/cZ7tv11k2j8s9TQ9b8+A6Mf8lIPm4EbuSb8sKUY/hvz6VvRy0X8K8MNpNSgLsRwW2XqTOUToqNHcIJZhX179uWPDNgL3H+3auJA2+/csJfLE6N7fTxbSWNChXdmNSVkwgNzO/tYRozRNk7TxzXTlLYEPhLZKYK3ZF0rTJby9Alz/xBaNaxBZyXLThyUkSwFGWcpkjZbUqSfhQNiKD4s7tsuaVwSXqF8CnOfJ9T8kjrMLJBn+thbqkm9kRtK7ZO44SLCd9u3hxEWJlXBPUTaKk+ooNXFE5ZDeX7uhGG5AB/D7bl1UTuhSxXctKFqmfrW3Rp9q6Cbsh7pLLsgGyFfh3fIxQSYz6Djhrn6U/qhnX2IlDFcP3FfoszDXfwOJYRFHN9b94+I4mZqgdgeFgBBXzUc8e6aFxTlUN76KpY78rsKrvwNKiCGyiskTRCjhtJUxH8hpuW5z+n9EhCjhZbACGVja481aVREsDbLchpAzN2j/9uphwKwpnGYiIqDegMUQq5KD0BATTPViIgtTfO6ex8VQ9+bC6DbKi1hteOiKsn5YKiRm/OfjCZ1pSLlA/LfFUxnqHJLKk2nGJFLqikfCdvo7YBOskUTMS9kcjvM5rbNNREb0xXFvBqXjVyO14a9NRHUuj6UnvHS10KUHB6Qq5k9gjTdFIBMgGPiDSYORBONKiYzJNk0Kyq0LCpN8NbdAxmoxXHigu8aRwdcz2Q6kR+eJhJ/x3lZJFEU0jm4ea+wlRMNDkO9bffOzFoUBQbzMvrmb1/Kx8KQrVj2ZX1k7oyeqBHocQ79viWR9FZzHLizBhJwGoTcwpidafHowxA0furWvshjqdkQGzROC366Ee7NYYPBNgUfq4aS69b1anm/e0bYzy88w+G8gdwUagfML+Y9bi1lXy/FkZkDjYaVzvK7E/QxDz+YZHks8I1/vcxX1gr1t6CQW048gT/GvlS1XBtuLoOXrO4UZ3X6m9KDyA9oTaVdD3hEKfCSEtSd0hT+Bhel+jlSEZA/Pat/EaHVPf6Wd9kCIX0AUGFoA1agTO7SJ9Mq0xJbo0PT5zYDM2spAbCxWXtH0nrSFRhyG+1FH5aUaJMsxTIK60VrenEofPaDPKCXaw8HWEd05zhllu3SPTNo0LAI631swD6epS/ul0AeEJE+x5RU9Mh4pC4qagGO0cpbHYjdHqc0QV8MnsEHbx5wCBNdtVSB5xqmwttflKM5HEBFIyNGe8FK5wbezapi9nJ6ML99hxz8iFdH2O0bUPT8R51m7zmprwyQY1+2Oir33lQrUT9xzjt5OkrndaiAPZkkZiUdaIwMGmLs6de9s+cAVc+b1Hm9QXkclPPYLAm6BAXVOSgGxbsjL88BeL2+L+XLGDg5/yp8utYTlcLT6c8PSM7lf/ftdwmlSSjl57F+dETQ1Kqvk+OU6WMPDY8EF6CmARnq3rb+mYR5DQnqAnvEEq2q7LBmA0mktJBfbGR8iauBRmsCvlkelJ2a81un6w4zFvmEDebpbU41jx/vohx4Qd7yf+GS4Sv1I+UkbI+Buht5jYTPCMKp1F1JG8Ro/mNq/g97RaGVEoZDEUv4dZcMoT7lTs4hFib0PWZKFa8Geu7K0bQVYx1NfSJd+MFCDem7zMdyH9xntsjwA1Vv3RWncY8gllaulE+Ktcwzk83wYv/9zJpGaYVs6spwKTQe3y/N1iElvn5Hwod6EBY/8eG91eqRaRrLzLzBzF1RehJUEt84bp0/raziuTX2+YRj84Z4aGjuuqFpZOOaF64YCNLF9nGvHazFkd83VKkHYLn818baPPLY2IZep4gRh/M7eDRudVumuEkgb8xrYsZfP0U7q8aDkWh28twX2haIMAtvnlzbWOfVDrO3ii2YPlAAT7HpdhXrL1VKOyzTueoX/xeTJJKmzZ6MCEOEskFWj3V51otZNXgo1GmvX0pdwOztyMRBbyTAZl1inWwss7YWHxeOHhdpvaLOoPEk1XBYlX+lIe3PIoiSDJfsXwhom706UFgoMX6SCUtIG+Q1w+6vVOBRBoNalS+K1aJJfNjwq607BODEFrFv72I2rKRk7NjD9CrORXdjXengO2S4eLZFKJdpKF7S+2LOqRL7/1vfy2EyGqLts8BrRtulESjMxHUBbO1EKT5IiUlZy3JqDpdC/zPj1krz2dbbm5APGh+8rdrgGaaJ34unfvFzCHydjkg6yQmQ92MXByzIk43SKmdXbLMV/Zc5sfTFwvRHRcwlMdkxhpp1l9uBpTZ/cuD2BxAV63wwQQS1o9TxuktoIxhkBRYTJj5QxRu8Yx8dwCnR5zVLTksuHvubdNA2dxX+FxtbIWS1AhiqMQC071TlvDYJe0W/IlEQymDku69Llbt7NEJf4oKUtwVOIXOVKhCA0Lz/ccnUdKu45Gui3kBXB+Rz2ClALC+zEyt7loKDGvfq//a1pkZaNfWe5Kp91E6Qhhqx9n/tPo5I1Yve5wh6TJXiyB199L1McGgmfo2lGRuPNlgG0Ei9+A2QvcyOKK1hhQR7Ki89/YoTEpCT6bBm704s0lr/PctnV6EH5Rj4JFS2n6T6FH2wSU6xAukvUFcwYu7blY8Ga7zkmprvN00myRZ+hu9KnILQ9PgroMscQn0ueZ/xCsS61siVLX1xwLSF8DHxH0xiFilOPn9gqGCuZXd0sM3srbRtpcWA92nxqKnfMTOoupKTKOncJflsESVZLOdK7ptnPPvgr7BM8YvChbMFt9xqoG4Y3zDDHGu6TwZKzmJ2A4FA8aekU5IExFjkuThoV2OR6evoR4HL0EPa47boLNUr4OYiF9O0+S0YYolRQqKr76Rq1yWB6C/xZFmzBrBlDIKHFZcXEiRzxGtDePfp8TplEazUJvkDgUS68QBVBVoK8j05GA/WEnRaiF8CVr4Xc4crVAc56kLz0NpqIVE/uU1zxQfSMS0mdHLBdkIKvKFVXC1ATX/34O8wZy/vkBwLkaZ0ZQaK9ex3M8q6/fMsnxeisFJdOTaj+CxFzb4GWC8eJMF1Qx8/38tQl0fobWbJuf1ai3JxEEIDkvt/GtnwEEnItzLYq3sma2k10a6eChcJSLS+GGs1QxrCVLaXrdRinzJdxG7BmowxIp4iWtPFw0x8PWXkIPyGvCKm/yXOVQGn29ael11+4GDo8ZmwkcC++qMZMK0NCNVZ8VNYqe+oyw1FrWfW+6WpWR71EBLtBN4jn9l6AR4eI6XF+Soxr75AXUNeQR/Yn2mc/TsRxiOQX6XvsIqYOwGTrxhsUpRmzXQNLRbj1EY1GreVQF6YMjvKcHHpmvUkyy2yaSTFeR+DzMfK+gvxUorD78inOGjexeksaCmZ9T73DkTCbndeSxSu37ISbUxg6rvd3dCaK1KqVWyLSBp8ENj9XiDT8TxE57kgErF/KUEHj5vJnHOXdrwVegWwuQFLM58faEMHyXHIVo1fpOyhd5Gc/X1rUqjo3Vf4F5+cpvYxjRtwXqEPgeTM2RRmUQyHJ32T1RiVqvbmHo70NT8I8ghh+yjloXWOsqMcuw0kU/SwXY/f0hDo3Mri0os9hL763UyskG6gXFTbJ7IVStKvKvd1HqkzqWZz+tEs9ZD3yOza5n8Y0XsB+Somx37Se0s4wcfuDJ6430FaJP4EsN+i+uKbPI5XQby+xc8bsH09LfGoxHS4eCoqZu+ydP8rctPnxuWW/DrFWt4NBvujanqxtsU4q4Pf5XnGLGZOTDuEKPNgPu2OHfF2tv4YtCbZ2XAnNEfsBIf2e5WG2deeS0KrvIRrIOZNTGfFe9s4hwPBoR0FNwwUy4R70OC4RDoMbDeHxy5aFCetQkUVl5I2SI1yv9fkkphqxonTjQx/1+pYYcWSlhuys5y2I8nEGfztnDvlNMVUOV7RbAOGiJq4mNnZy2TeKAbnkKwdcrEDA6+0ErN43tg08JzS8gIG0Kfw+AsrUfKfinNKaAt1v+A2TvqqKg7URE7ig2SYvMeLMrE3V4yAiDCOh25klwwK9qZyfNtHX2uRu9FqkZSSQoWLTrE3Funt7v8aZoF0j7gkoWbYcibcGOBxJJiED4pLGEkMANJnCDYxyhkvo+ZLunuTPNlNoI2v3hxSvI/Ce5qJa+w0KjzsXigACQYy9Qv6/AxdX86y5VT2raDLbaNnilA90/ceJ9BVCTEfKN4vrm6AhWb2qOzD4q+JVmOkswAuOjxHCkFShLd1HZG3seEZ9RtczRNsMpcRgB0xpjeEjuhE9ADpBuFdmvN6tIP60GC69H1FFJa2ouB/GCvQtOYg/ffePqzVcROS6Dpg3OIEFR4pverbgk9l/tl0mTxxieh9GbO8gmXub1sJ35gXMGYM3VuMIZYLdb4GgF4qN44IayeJgLvvG56UyharRD1s+tyGYPtXjseBmKGCTG/zC74pVa4xSomNWtdEi1iABAI9Msw/SxuVJO1XWzOlv6FuVY2YQuXPaV1/Rl0wPfwsFdDyMq3yNf4SjS19xKC+Nvhp0KM7IOyXMBQ8IfPtNd73UG75VDpetX8fCNiGBzJCNOnDl+ZpZft/nod/+KVcJpYUTgj4sANX36Z9XCizRMiPQpFL5kNvxK2eXpvxxv16skxkCCqqOyaC1gpCf+aMkkuMZ7UNFX5FzYGHQg+/es9tuhK1cduZTe+Qjyr8nF6K1RXjegqXMEC5T7PLrm6s4jjuZN1I8KZ7fyuwnXzDXaBBeWw9E31LwrreZY0PiapEKp4o4Wu6LfDHGpRSIL9L0dCJPO2bKOaNejwfXZCMhy7UOehViS8jLlZ0CWrb4mLc9jB8IKjD14SMM87YFdO7oReW0Gbe2KqeGpgXCMUNr3IIB+8aS/zQ0IdYed5iWO1CW9RviM2DXR/bExvWkLOPr+zbtt0C8WX94EqFi9G/vGdrb/Yjh3xeAjpxwH8eeIMKxky2d/Khm2ZWhY9+Cve2kMpuCJnppTto17L4iZ43q3nom0eiKJn+IXKX8eK+dXjFZC3vnewgW/WfHqWDdK1J/iUdjdf22AldlXGXypGPfE1Mlo/SVVaEPaiBFtCr4HZ+Ymyoz+ujO6VRyvK5EAHaKYrssDxAz/QdrUMzjyE+CNXvdWA5L9iRprsgPRWBQmtjaEIkYS9jr1oyupYItZaxWYzKWMhnCa0f3uQ81G+06eMTcr/I0Ai4ogqaK8fRJSsnj3QQefZCqN5s0KTexJ+jR//23uaLTColkUzS8vD+pVd/XfdfLtSO96/N+sdtqzisnK8NWU1OnZVJbVye7tXBgl2VJXaHyhaqq72iaDQOftVcEVK9lQftVnd6mC22A0G91kiWjl8vcSnvOunFw695DJblcEPEMO1Nd/ylC2JOYfIwoFECIanv3xSZlC9ysThz0Hfl63yTD+KcQx/xMF2hCHC3G0IMyG6fdF3FJc+BA+zVxbtdQGfHnpRtIhKbjMdqhP3Td0MWCqqS6jdnVF+WRpUbY5YpMuQIg+BZyWqepFRDPAi1Y1EAB7bC/k4DVEo2hs7KJaVIYMIf7cxUxFY5M8rz+Ma20UerKIsb/XvEEb4/Jsh7OF3NxOshXac7H/5aiKNWCQUZPXZGV+YQUxPhsSqMvuKkLU+cfJatLKaBUJRGCW43vNcbs9fUZfyG+KQCfnWCTvDJpqt3pF2HUQLXN9JYiaZpueKLbv1D8T0r1hmIih3TVqHXVVYt6OysJnbGrRfNUQgOa+ju3povvqNScQDcORDH+JEqxGQl6sPUIGa2h9TnBXLr5BrDCVnPv4dY3jACjwax/lKtDIMRFxQ0Mz7PlPg+TdOvy/K7tryhmzB286YEsuURL9WFomhuK5JgLFtpfJgXAG0kj/jq64o4I5Ip3/Hjkay44QkmPvMU0wqvd97TSV8HGB9+4cEp7ffB2NQ5B5cWSvJgkbU88ANb/3mHHz5Ps99mjZFi+3hv4w9AVNZPSUNDcnS4nRQDq2xbPvIMF+ziGq+M5KyMr7U8mHhvcPerzaPn2HiZQezslB23CyAgrT/Ybk907NGEhJsPPL9xiDjjhGZh77zgP57R2zm30qqCZYbNPbiQ04gwgHpT1leyjt5bbsTXyiWhdxFEPLYyvI717mPTPO/B8H1seFAZR+ZqWYctyMzjif082/+c6n99kKnZkyqxjEwnhBkTf8lYe9iMTrWFH9Gf5ovz3DkMTV3WxeXgtuC4AKubmIY7zaGLNIZgcNtHuyNRqPFRdSRthdguF5fCfCA/zZJYTUpdzVEB1l9ntvpXRQHxIkjSin6UCIeEQl4dHfXIrlhQ2ZNVPLR6zDFb/uuLf04jZHgQHViap9Cyz0TcpasOlyY9mcBveGEq8bqz4t1ZK7SUwZNTVS/Sg0AwmZ5ekNDtJKoryb6FwbymxDETRJ2pSZXnA/QcjBdNzkXUOwrBTAxNpFx80+Hxbh9DfoG5nn7FKChZ4NElWRWmz1OjO0kxC2YgYQjCPltcpX47s7FgkJIts/aWDI/uzKd5zFKO8Ls39Ws0WTlTRcAnVQo4GXVRjqOaPlXuVt31SPTEBN97CK2D8y3Cf3k9W/FkvW827cEIldiCZkgTpTk3zX4yFfjlwuDzq/7tCaK52Vn8j0CVtQdSnOG8gbW4HcN2tTJk/lJj2z/7PF558JULEobLk6FXupj8JjbP3j1VmjxZSPxacmvKKORWGC4QAbuMFTUB8ougugMBfXBXSFCDS/Aea2sjXtevg3Tu2+3vRVsmr2IOzQD8uOAF7ZYw3huqVE7Z4kwO+7XB2TJ825eqNrstNnZmpdrpjP7rnqMw76S7SvGJvf0l0OHc5nmHBHJGLJ7C2xudBYNv1aLbv74/sqY2WiCDHQamBjv052F/ZU+g4Oq8wamaICBMQFY40d1NUC6koMeWTXeDyrc0yN1hBb6klktDX5uqueGEe/1Zgvqq31z08I7Kl2eXK32qLQcFFCxxFDlkl8q6svNNJg15PPSXDfVt9eXKpOqoBUJKcI3Q0KzT1VrunZKe36zOnpIMgnW7KehVJG/NF2OG7xamRr+cBB/sfqW8hm55OAsPml1OJe2lrTuYsh9dXtk8cpqTmIWZGOgKcEZneN1QgeE6X0LcscRoRFqirnzba2yXOWrUTZO0WJcOzAOVJ/pPL+YAmB3HP6pg9g2vptY65ZxZ0vnELLJBKwCInY4RTr9RZFofOrLxzrcdFaTubuHJ4mJp/c0eXaWrQGhZdIm4tzq2LeH+HR7Aw40hgu9S0ooRlGVmHNQBuXIZDQ6E+o0TuhtjjU+x7/vxmMznp0wBrfgs6rKXOvj6EZTD/jDQV5Ej0ni5khuNRjiLMoIM4essavUz5a7zpN6PGZ1tsLqDVcSkqv+ThOF8lNUvgRf06ZWM9Tc1DSGJ0yoo8W3rrLAwojVVtUU0HJkKnmuz1sXvfEmjRRUltg6bZVmvOghuqs0/sLNOpVAI8NaCNX3BZuO8Jas9W4RGxs99e4EtTgm03VCdM5fBSawpHgqEiBBj0fJd6whXXzyVs+FGJSamfGttncAdoFq5CA0lCSq/JS6qXmoGULh65MvFr9TjpGXC053hN+zsn5C5p7u99BGTJen10ZkN7ljnRTKcU0IZhm9N8xJUhVhQvnhYdLiFNB4Iq96ujEY0GFpqS+YNJgVEqMuKm+BvHjdNCSYyv9am/fXhHPN00z0u8DaL6wymCxojHgYX0x/z8+CzzJZk/f/l/hIpK69reXLhmZ31AoIHeEvcVxDPxjzrynTd/Cz57Qg/egzG9/2xfKeM0U1l2zrxmCWhIj5yDVx0+YpkruskApr3FsWZaxWEtwJHrQs85r/UI1CNNFZ8e7XCr2Pu3VuTUcwuAmQ1YEf4PDiHGxFSbhpwwvu6M03FarKscSKyYdz1K8FwAj8M+pzxFYZ4Av34/XfChvBE48agITeEH/L1/DcZ4uXw+5s/X02PNAa2hS4b/Lt1RvbNLqy/1kx36qZP3ZWkuCA1qmns/vTgBxRP7t9s2YQejxbTvdSBFFZaEphd6sy8epX8YjnPVYb49PQuVWLn3HgIxgfOa3yIC3RrP9YEbJUIYlQVX6D/PcdDDR/DFJhZawr8MW7PLkP5Gyd1MdBHiZmVwsV9Nm5Beh/9GjAWBPTubMIayEuL5TpJypfHDn/ErZ7TbXmSzTp56C+toesYLETgoN4KGOpgpm9Y0G5YXNJn+OwSHrSSsSpFOraGPa+m34ZTEwZhPcFHUsIDoz4PcZmvaPja51D0Y7zcspOZG6W+PoE+7PSAUul/FdOzhwizAliJLEeK3s5yZte0ltYHkx5p1xOx1T82kgiQ1pmOJQ1Nc16V6hsjJEnUm965pJCH/WH2DPxDyBNZQXnAENvz2YNqxVomMfK8UOnPCJJqVmUWeJPr6LnvzO8P8s9lxejQyuaU1kr/V2FMv374kgjQWlnD/s3zixv5vZCvg4pawCbNj31FtED2BShjezOC/aQ/FrAFOXXV7bXcqOVSy3KbF51tJ/EPXiZSiJi8eRq0BuqKY5urfJBfjlU7HvHXul/fhAKuMtH9W/SfEf76XPQsNt1dRwOlKRF++XhvtgPHv7Ez/B71H8mmvGIcp9fZaJk1udGPKqvn6qNwjzH74/MHjqXBzNZ6wYS/7bEOPK12vULDlQwYV/6Po9ra4jctRO/4ToUTWVgdIXBE+UA1y/WnrnrZ2OuwPgihMOOMTOZaq/twoltTrR7ofHieBH4nsu3+8vQyMsUkKDQKylby+swXpBSMamTTS9mxRvxSHP5N8wf2sMbF0LwoglRol+3i4e7O/quqxnSvlkBRS4aB9R2L6mMpQkEcKBWzS64e7kp2pb/umRW3JmkQ8QJIo7I9TzBd573qvvox7Y32ItjXRF//vLReFS/PVl3k+hozdXPRzEQOuQh+9MfiWm6QktbJeeIbVKh2cQprlzf355O13ycPUDBS4V+f3A004atZOllYKyhZPXHjo/1djch1yQDQVM3PDBXMfeg7pesrYpCiLTZ0T0OW4TZnm3GnnqkLrU/EwxfkREeKPJ5xW/LTClBCqZapCfoQgV+n/94vg5V2I4sCvKJ3dAS0yFUnHN+Hml4S+rribjIAEP1N3BLhVfjGqpb1L5LQ4jDlK+Df4bhNq3uVetfYA5Q88Gtp+aJEqPzGngcWcto3VscpwUldt8Ye/+dJ5U3g50n9dJ7VhCz4KjMnAUh03703KIKRoqbWa6vUvkB8PgCO5Be6WqPQm6WtfXXL04/jV6Pgc8XYlWjBMdG6JkcbVJxxAFhdpUzEym/JyTfPFrddYvEvzVMDHMnmWJVfUkupQQitMthZQ4ANpaqoArFj5PprgB6XhfBmaY5y7cV6pBFrrQ+T8mgVq+NK8LaQADeHu9SPrC8MQoUBDGVjtHC9o2HZg7U8QwA02dz+yip61DTxFiAAJSzHFjrEDLfIN6ZPjHMOdyxdjBHgJNzpxW/qQnle2SOsHybLpxqV+JPG+Y2y6Bs7wQNLwKX+9n6764gf3/44ehOS4tQbjRQ/3/EPZvyt6QOJH1G0e4oY3fxAGPtcZY7LaTIN0Qh8by38ciPzo2a04vGZRQNMei+yJumd5tPi+exWF43cdK2v4GhOC7qSh80p57M+1kuODx13wp+2w2U/pce0tLBDWxk0U6W9jI0ul4nYph4y4wht0Gt60ertPPYiBgwSn9K6UqcT/L432QDztYdKz1GoAWO2eQ/f5UWgzn4DOV4IRo29DV4dG6iNKCoTLFRSXP+RCzE99zE431TGs3l0U8bYJCwI9FcAmZlDs3lS9cgwXFxwwcLZ6eBYLqbKSOf5oMmI0WysG6nm80Gf3lGrqIsVgY3ll5e/u7pc6Q/Bffcr/4WgSvu+sFKrvw2/RVqTOuG+2oOHT2/S0gZUHlHroNb1390LtECKhF8/qNeA6MQCTc7ncx0ErcOPyPchcjaJe0qno9WJa3FRblCrnOaOkLQ4l/tEBl79iSp2XC9MvTnTeJDWa5qqM3SNsZpOl1bkUCyJ3IUGHxmxLw8TlmsliVbwx8/9VzJJBHahDo1zR/k8QlsgCtEA9yjkxP8kSZT5tcv6I0bS8uRHF/L9Hz1hyVST1uAJvIkqJxriQMtDq75YUsmFdObUrkvPIK+sRaKpXq8JMX5qrt3pV+OIOXO24sdxc1W+5KHUOB4WuLLI+7ddDVWbH0p8TpQaabEu42rS22H5I0rDHaL5LvcjdKK5M0OEQLRivm1QuXxW5frqODHBICf+AE7nA/Wr+Q0hrE7bYXa77bIwbOqNNZ0GqMN6TpPW7RYKPza+ztyqVGWWFWmR7USbpqe2Pew6+jcfSXTI3DLeA3RMLBGR+osPETnRZJ/RHIks4yylrPTy9oRN8pBZ5elzIY3tY+nHXnAv0cZplYZGk8fSVV9fATsDrwqCLhQm5P7RPkzXdSxf/jxVfmnf3PNl/tQj34UCLChFhqL0QU0zl8brrd8xVBQRjsP4voJajubFBe4z/SQWepVp1ccIYvOdOc7M9p14gx3cIrzIYua4q3/JOiKGJRa7Daf84srIe9OV0X79vopkNzB9/HEDtswIxd2g4nep4GMgH3UZ+Ulwj/0j6Aj7bfxKgUQP3XB3O9B5FMaOMu0maBsTe7NeQi/ocg4VK2zOxtGCIzpTt+OLOd+3ehBi16QddH7lRHGlDor1zPUEx0eG/JEdxovSQr1MBVjIgdF3XK8sN3/MfKX6bjVw87UidJn4ob1qHKVaV/wy2hCc2lgDAFCLJmnzdI6N4sW++LWcImqDfabfFfRkZo9nMIk9xOBFPvCh3C28/YW2n6s40EnUR6XfJQ+emZ24/fZRj6TvJZFn2wrIXzNER+vH0w2CbjdDj69hZA6kn/uE5E2Pt9t4dYkTaxlAzYs5rd/Ts8HNLsUYcMkaVEjpg9N/eiufuxDzLI0TP03uBZeQKeBVkAQKIQf4VjXyn/fW+nZUQ12KQ+Xzz/dZDxp4vZtuWvTt62dyj8zE7ynUcL4wf9nEW9vnz+i9lMwt1NCbWH/2E+7qJCvWojuRFmZ7HPuHv25pBrWRexGTjCQvg/hrqamvZfzg93T8oW8erEi0IPg2ieH81vh0e2CIBTX/+KgcEy46WQVwdBdn8g4Jm93nMQXos+W0yHdi/by/6SvaDfrX+4Osd6Qvd6ecz+OQ0SsRngidZ4CmcWWbhoFZKr1rgDEzxQn6k+dJFEUNO/l0RpfeyLSn8fJ9xlOuwNcfhCTJYAzBlN8j5hG6zmhOTESHD/b0CesO5J8ZiaaU/i5cflwCcbUMlpY3uk08EvCGJSVe9A7G4doQhLohxq5NgmtVGC/vEDy+aFn0VpVrL/yj9uVomVkd9O5+KNCfE4PzzoALRq15T7kbY/KWuenBYLs7/1SVZPdsml+Q97ydsS8rkQCaqcBJ3ncHhLZA487grLQAeP1uHTIhZJBlHyVtU3skim5Ezzhx1ZeizaXq92uXY0EMPL+bO5B/7AxqphX5pz7Tq4WK4YMBiDfPTTYDNFpYvGqaQUJEk6altmi7/tPPsYszUDLTpgbkN46H+8Ia0KxubGdYMvkNX77si/tkwg30biKG9tjOtO52cQ9zHIRWXEQuK6s/VvvbiYJMx4/wwdxckgr/lxqJxR0wBLKs33HS1K8lWN0CyNIC+XgfKTgk8tcP2tn+MSmI/6kB0oDqfltIzMv4amC7ncsDc3rMLGQujyahPg9C0GBwLi+r/jMD0Fzo93ra6wh2h+xLfOj/Ztpx3/NXdGKyWMzBsTrub9Rv2K+Vj2j5uGMm5on2rYT2j2qY2IXXAMtazrJXHk6wuo5t5cS7UsYs3r2/0+z55D9tvOnfhD9eKGlFZLKLAMjslzbZFxdON+M2YGRleQNrhkdlrWiloPDoa5zk3hB/WAUhCJsoBVr4f6Y1DMEXm0Big/j1DfoHsyP+ulLrPXk158OhJDqtzf0KeXlt/4rau6Ys00MGiFUAtFnxvA7EwUodHxlmIUHKZUCqAxxEdU/1fAMiXN+w+aGDAPdybKNZxHrX0cmkQD72RB5ZMS6G4Z5gLV98hB/zzzn7j60Zu9Peon9tDfVYJUVJYN/h9qOTfeCFcBeEviCplBcwVlVYvr0JjswLX8Ux6Oz1ysdxgVExMuatGFLWqkxBEGaWyhhf+05cQxCSScGAlQOd/uYjxhxCq5u958VXxts/o5vGc/desAi05AtwNBweZSxxtkqmE/XWnXNFMfhvyGxUAdwqvpf5jsfhuHllVjFbRw07zplbZhNC1PLCHPJ1cl6Arnd1dmNZLU0jxy7fH89Ea7HkpvlBvh39l29RoleKCdfM0nRAFIpjRbg8ypms36zFharlyVlLUkJaDfuKVT95Lzp2F4J2sF8YC2Nj3DoAs8vF6LRbC8KW+5sd4VqfNA4k1fln76Hf3lvXwf2bn0CJYin/P6q+Y9t1o2f2lZjDUMwUM8U8Y45izk9/2dr+P/suj3yOLVHNBlAFFABkjuvvwJkircPq1mAvinDAQXPzLJgp4ShLnKwgm2/bsFHwQGYTELf7qd8yTpPuBl7GmeIfdS9jVNqgw7nmuKCMel/ZduXEFvJV7oNlh/DVFNPMnsuO/bxOH75ALHNWNOqV/49xpNzATuAGF/ZAuOLFfqP2eSybX88E+Bho4rlyC+9OjGl7hgo2wrYareX+XgK07Kvqfu0qRTu+930iw/jdv2iirruf0i9DpQeR8lV3E65NXhwy8yBznPIevu/rYk0dK696HD6b+2Cl8jf/jdSIRl8d5SE+1ghiZnjEU6agRC5sOyLjb+UfG79/Nm6dIdA1/y/zxll8bgp5hY/MusM6K5ML05q0z5/RKsdueApZwkBMS9b3yF+5qff25BlFAdLRFv1cct06cVJ4+17WW7gXvjWDObdW8TZcEFoD6nw9cXZ9EAXWUr4lerMGnFluAm8HZiT6+kWXjANzwn8Cxh0FB3iFi6+wZ4iDhnHUkrY7IIRdqSR3qqpx9oR67sYuPLmsj5DxhOazh7pXxYuPqQmcgFiGTZT/opXnLj2MJPqs4V5uOUW2DJItBrMUPpM0SNckID0wWNaArbiizAQ4VZ2GIReLutgukrXv3odSxmMkZdJJ3ml7O86gD5Q9fckwCjKYeG16U2UPiSfSASIlR9V3BW+T2ux0lRINCHtFIabyxCI5rpYihdQMLon/0xBK+KjKfvF4+Trv/INcBp31I+wnGUgX+z0z8D8vZg8BXnWn5UsuC/6geh9QiHWfi0Xfv6zWawIZztUaEcWz/ouSaszUx07BHgh5Zs0mHLzgni6hh6+1jj9RAsubGkCVUzDeunyHOUVlV9VOyBM8mHsPsHdV1y6Ynt+tnUekxAIznx0PYvJC39fy3ePsx5u6SMzJQfI+WQYFDy0fnO9X2DnS9xN7ydWav9zujALpAxFtdSjP4QOFXgEVzjIPNeG/5FkgCLK/0bNaAVHVnIbK7wGaPLXLqRQfSLy8LQaEF+h7JHNfN4IBp4S7bFV26NdVTjUxRZVsghv/Pkhw43EK18j/D1HYNRseZvQ2q71SawxUxeSlMRqQGugw5z2xQepf3iiOwvoYPshpsi8aZSvrMbN64x7eokztukJDVHGrPTh+j0+fdvT2HSHDmz0WskOTEU634nmrW0oyB6lcqzPG+b24z4uoSKhCokjji6grPSby9Mi3v54HO1b70SUvEM7Ub8y+geCHT5hRBc3q8t2m+LdomnGaRNgTdwvQma7PkMqnLTD+8qWL/3kH1Fi7HnbNkgnXJOreGUYni4oHgQipJPF68wp8monK++av/UkDPaPNjNUxLQ1Yyoai/74e7Lv50ech3v/DvvpglBaQ4AjKYDgPRt4qXyfKuHOzFLleryyrggQdYiygNR6FwzqgERhe9yzVjBX9DNNUJ9Fn3ATWbZpPpt0Gmsgr+pwZ0z8B4ntDyYomJEz/4wsM0jgW7jz16H267klQOT/KH7d/E+vzq+GkMHto4F8131QQOVapJ0Qbaa50l2QbcicdetP4BjsujH4YspqkdIkGPwcfDeemNI6gi69IofGb2eJd68qBrvYqPkegeZF2hLM42O+YrL99e/9muquDAmdQbYAeGGF6g3rUExn30xr+9TRSye76ExPyiufWTEPEQ3TXCjkImJ0Byqaza6Pr4bZE5NPPYLnWQ87jCf6CejeXwqfobB/i7jjItEey4nll6417+X4lTi1bQ7oj7eEUVXkvjXxpghB8suRyT0fnoscr9454M3MHkeLhClIMw8Qd8pgisOoF4WjNu1pNcIoxMOcJyuZf5A+XgbKCl+/BkJm+K8vK6XwfKiGgPsWuzGeoQJHL08YvgdtvgxRAw5pAVVMzF/ky0sCu9CdC8J6tn/D7+pchi5b5sjF0dArype8ZnFvjAnVMSqN8kj4M6/OqVv9rLZHiy+AhbATc4oAW45Dj+BvuPCEf17YQ9ydKZMRqpWLW4objNvZxzKJzYrWi7+hNjjz/3mCGJ8b0yyp3isK3t5FCNVO8G3yfW0USjx0GCmgOZzYk+fSdkHtcou1U+qnbjN6ILN8d4I4JKqX32Q2KeR1HHX5h8n5oKgq5lrdKL7ju1fGBJTNHSUCS59jnUvBG5QvykbED4/4y4XZRfdb/8PSKdY++UJ+7Ak+sEieQJpmne4yMGmlUiiGY7u3K4f+2aLA81jLzWkm+hKDqg5Wbx0tMSXnhG3WPWSftj1eYfnmKQqpKIuNLQ+L9oxUn5GCwJTSDT1UeUVt+JUGWUJi4ViR50DXgt3VNoyByaJKlnx+c+boeqO3SBDydUQz/zWsViuCFCWvZOupg1HdoXCmRVwocEjfGU86xI2nlRWAyDfNdOnjqvjkyfRb7hemHXE8aoXeE5QPeslnd4Cv5l73iKqPCur9D4lMioiYCCUPlyBqoG6U3KdTw40VwepOKbu44UGQ3oZBjHuhdLahCY7/VBPV7ixJJA4O8CrvN34IzmXhjD7BSamrVEbyhventJjFMNmrE2AYbJ76xBx/qx3XZDeWziFx+pR1giHO9g0T0G/WjyPO9Ktw41A8K4whT7bjqb/drp82rfUfDEEnNJ5a/2yt87nl+q0NjXggSeKdptkXC9e8HApzRgW3+2RImTi84IZpio3U8EqCM3Ra5sEekN9F5k3pmfBgoW7TayXlI+8AsQCksgjwhgyGLgNGKBhONkssRyxxKRJikpSSFcUODGa/bQRFrMz8mW/2eESZdp+SqhAw1xfH43Pvd3ikxTVP/POGdb92l7EEijEyJpQSvSuuxK2TIzO8DSw2VuWECz+7kLcfIQfK7it2ggNcdK89XezdSJLdLpKelMV1YeFZMARICC3Xlx6JHYo1THQvM2jfVrkK4TC2aV2ZPq17MGli5BFbyMEk2dWiNZ9sWEg8FouW5B2Cd5Y5gmtKeuc2V3/q4NAlw+7TnaSco3p6zg5XnZyz7mY3pPV4pPWMn6BoA7ltx8oTpFlFNP5LKotfHNxZTt0yt950D0kzvrt7weE74lnaItTHp45PKbUxjvov/WNXwMr7pbwHV26flfSud1wFxgNn7tjMQ+hFYx0mJSBdY8elay+MGogTz0Ieh68CHMEVunkYiMGVWdT9NCBC5O0A9APRcpgSqt7ltVygF9q6ZzgdaVYZnEnOwTyzOgLevfrvglkBqzq1pU/pAuS2gWFYZQMVT+ZVvuPJI6Q2dL5z9vsd361gcyTwX2tO/DBBaSr6Da3mh9u7ewhYK5ONNgbwuBisGdPiDBMx8GbqCgm3OArZCWFMOX/gtkeXn0HooTPo2zBFa3LC72iEplkfvI09uB0StIBIP33MFkcsD9qDi3JbhIjTF37HEuQK6K9Mmx0F0apOzny8KBTKAhFbMB9BaLaSulVtUVYDvDg2TFIzJrpv3Y2K4EDR5c7dEitDVvUc4I0VY/kSwAR+oPz+0l/y9aAxpE+ClMzj4MQM2YDcKpqujMCgcvs4EUUNWi3xTXwkmEUluLWe/EumXy7lWmrj4u+gL3MGkzX14fjRtFam9g/1C1IlL7hswjArGnxfJzBl7rulnN7+wQhv7c90ZEYSERsq/Pb9VJ5ZqSARBFoTewIUE3Rj75Z6/YnqvX8BywgndUXIhcBimC7Lwvx1LA4n5hJE8J38RKTmaFvc2lPa+zvwVhtRwbfeGwVnjx9iVm2va/UHlAwOFRJWi85YlkvJylZdTt/wD/CrfAMn/6N2F/9fPsLyK5OVm2uxAgdDHx1qxCH/nvNabDztnxA7yeRZbiKQCB9hWhHpnJbL9Uw47l4D/QQ+bSVgty08W5Wlwvil6lCp3LGtZVvUHTzkqabE7lb5Y0YSleWbBKwOJD0krOf0YKmp1DDM6TGNyqsJgNg4LsFonTMgSamLQOuPHZqavbUq8OVLdK2Bjw08/AnJ4FU99RvB0RXHsQDErA9MUZCg3cG6AWb6RhFlXlyToizeYksIhXX8UiidArcyeeZ1ZOsiShFwyX5oOynYnSIW9612zl7R6AGZGO9qJrY160hJVtWjSHTHStAUR0Twyb2cevb6H9ACOOT4K2xwDatZu9VqTPzTKEJFE8hq94nvchQ1lIKglIzZhE2RVWCSegsJ9slSDl2ORHVutxoJRQ4KSeDh/PQhSAIXtrHnBM6aHz8tDZpJ9CaQatClwKPH8nbPcM1BUeqvF6Nnp/asncT1VtFeuGz0AYWZ/+/x9Ur9dChG1d8Awk25MryiFA2LNshz4XNO9HOa9U5hB9l0IAv6BHqFeHMTDhyrjOx5vI++Sr+N4vIxkPyUIyK9LI8HCv+qTyMshY+jdymja/DaG32jWwwDJFS4EqdMhM3KpDCUCE9LkyNBFmeRPEltnk5UJ6XAGSALJBUSMAqWEBb8ZG73hOl/gwM1zcCUBh0k9BKZQjv2bn7b13thk1WvUjoD8SarMmAQIffxUFXxKuFYEvtloRyMC6Hq+Jezd3LjGsu9sXGvSUj/paOPgQBrOXipkOYgw1f1B3E7aVR+urT6YDPZXJj06jrvEezCpfONNNqwbYAjkjXI5g7aaZbdNa2RzwCXATb/6a2eCQLfvBONCJk4ISRe7RU3BbDjwpCG8MDhDH+7cpqm3ybAgYLubCnD1REZGO9TfIA1xy9w8llcHbegmxxvZMk/ut7LXGSlUWu2z/GwAUm4zMATe+6BUfZMX9i0koWn9079pZTBLXBHNYsYKGkwmL5ZBxIiHamelPrsNMEdB54yde6yVHNB4kB5o5/ft52g3uIZUREX6BWgWcuTdmJqNqd4JX2DIquSSLxpcsbkdpm3vR73AKXHX48X3yUS5FxxywKtjYj+CMy94K6BIRvWTob1wPYt82pLFBfnqISEuTsCl/Hl+CqzJpcq7eVd3Qs6wQ9aqXz99R13WIDr1sur+MtyUVbnDatDF3l84oKMVMcDIXmf6t7Fy+IpriMLvkY4r8Btpy3FR/YuLVY7X93KoM5pfDyp60OKLVWcscMYWTuoecRwOaL1fnucUrQ5G1/jftz8cdIf5X22+oYKkNziRIpAAYjTx5H1kKEcOVyZMtzjCuZZdRSlgoBqXsJkd9iUuflkCK85CcBRznw2D0BL789llUq++TXXXXCCf19cZUUVowu3GQMMbU5UauhjHCYGkaW74nkdE5eJ98h12Eg+A86K0ccpuIxI2NKI3Q36F1RQ4jSbLfhPah9C1oaT9oGYKEhXLL6RObyO41wvXSiUAMemo2bk2Ckge9fbx2KF43jfkUErEijfW4ibFIFQlYJ/NsZGGIhJMmiNHyUZJzldTN7qefOLQ94yxcVauZUkqNqNUB53yvUdJUgU3gOzdbPGrHRbU5NW7GHLJbtFWZ4BKXef0wtsVHn84oJcU1M8ZZZX/aRuMfX67rYFzPgyAb3pF43KnYFXoPuNlZDRWddvXjq7y/3oGAq17sdIrpD+Uz2vfJoa+bYj2jiTk6qu2osrhbSd8EI88ayo9Bq6tpdGw+uTDeT92JcXYbh1FURWH+MQg7QYgxDSpYDqN3tTbV7vIbleaalRvsei+v9rOUiQoUK6nhKXiA1pZVhWwgoFhU1PhUw8Tb463tjiPvoRP7VRXypDDnbDIYAlOY3TWgwsjR2oGrG5By7dQ9jkTaezu3db3yqmA+lA9X6IILpvHDGMfkZMIgDEESsdt/q7aV3PPXlgDlkK6Il2aZeRNrGbPsNm+yBICqrqy3mAEuAqx77TeERq7nAswR4qHGOMWjP1rBvz6o9KJ9sWUsK45CVQctX7ShHc5IflZNeEJ/VQE2CqocH0MDLpcZtH0IRjGdv+S+3gUJ/untdSg2VQvltLrku3I68/piNBF3kqSXbzDxS8Y69G4+s51+INL1FLhHlq5vwpYBDUe1G6MMGlAneaXFyywFl89YBjEGAPk2DOidE6K3B/490DgBxTG5/y4IuB+h838IeuP9yahANMvjrRZRPVNqakRMSIoUeQ4czzfhuJErKRdnKh17DZgOj+CEMqGG+bF5ROQHke/n/vpsOQKC72gG4OVI9rbFVvpiXjGcFFbzT9Q0OxjVXi8okSBwcd32bKGiVlcEyBDXZBK6/iv0SIZXvtlBvXYhcu118pdQjz00KKcd+h8/d6RuR0JY8Y5s+0Bc/287mrNzBkPXP/ieRP/cQAtJ5bKX5zs5NGFJOWdxotDC7WWrA1R5OPAksEJteYm4C4BroqIGV2yUexukDBVuWz18Q+7cUN8T/Mxk4v4QWdFQfucBUCU/sMKuhMYmoYqE/FPJW6KyJ+4W8gBSqm9FjrV7BNsffEL8k8EgPQ/+rDpFbsmi8wXsNIYrQPTkjO7gzwlYejCXfQBOdwXyg3Ndi4q7Lk2AP7UYe5qj0COSV98y8a8dFXA/piGBX8NJn8KFIsSteEeg/fCKt6yIg+7oXNSQc6aXRxLzlPAjJnfuqblQ06M9FoyblHuGi2xBax6uY/B1hCOVvjlFVTmjrjNgp4Y9XAUZlP7k9siaNVdFNop+NrNtHbwy9XtmWhkBtzwsn/nj1+574WaBgFNYzO8YuCfGHL5CAYqe4Ltj18DOGjeyGn3hZEPImYU+HhxDbjtlVyOIM0RNAaYCrRapZ58C8WK0A2ajoRkvqQd3rp04soaN7dUE3AJuVg/UiJNqg/4pN9U/YSRV5za9Xt5H0UrqsOO6nLoigR2bJ1uoRaiCbjRPZ5JJjMv1tJgP5mEVx/bNiqG9K8lVY7auOf5s3/V1+kaBToj09he0Wsthq+EuC+Nf8MozgEq5bdKlOX29HcXKCm7fpqbUqeu5Q3jRCY4mH1oizOeH7/rI/Na+oh8d4+hOhBTzzvb42Eoqr/BVRcCB9gGSpCCk83Mrd2Lnre4Ea/b9tzgx/+m0uJRAGJhjDXIFv9SdZt9Vfv3E0858pntPx3//qpLDcNxzg/fzGsidfCC5abvQ2vwMBZHb4CxuXlhqLp2YcYEP2VoGBiaeUnoN/dKYyqJU8PgU2J2pyI/dcxDjL1kNlAWE98AuDbOe7NUBB0CGj+bKft23uoIEIk4Q+CESvXpTlQYwxwMtWKE/V1Uw9L6an5Gu44oeXeIN+DtQu34o8/VeYYxL+sUfQnt/AFGF7YQofzD6zmgacuMVNrziY2QPhxcwHlxTsoglBHHeiVSnby1VmArjZn38pbjn6T7LWjHrVHJY7NaK/ve5EXV/WeKAtjVnRAj/DpPO9TrJT9JynzhVjf9vUphHkFFWCpNhPS2OX0IwYvyJRsjo6panx/h1wO9ZA8u9u9Pmj5eHzOSMfJ9D8yb2JTx2xpmtotXmSwuFfMpZ+uFSZVN9va+EwnR7exUm5Ht7YSSrwkb6Ye0GMWt0zRF/TIeham+yTzzRahd/7QysmUFPjKyn+wfnaTxMgtpsT3GNO8z47ERE76G5O6LdQNIaGwDdRJlM3NJjsheS5DvBniqWnguKACPH/6jmTml94yLm01rptZvDY3QAtWn+13Git+4jGKW1KguaetbByfFryXQ/vNan2jeZRrxW3R2ShB1XqWUx1ap4jjpac8DfRierSSz389jUo2mFlOwZDjVY2etex0JaYyb+bC5vT28m62UXF4L7wkkEl94RWCxtk2aoSSsHCbv94G9lIwXaP1tF4+XYY/ZZzKbQ4mT4995deyYCA0kU0kfluQNiGoklLvfKnzLBTzO6rChDJuCWbix3ZCdRbOFs1D5SL9aCbbvOiwOvtfsYm7JoOUtG333B4aWbc819oDJL87CQoMMyR41mn64gjn74B0WPRbdoRfJfx17BMmlCv1OgfMg5DQV9b7Qy91NJl+8bdab5i/bh5Oq394EF+Y1nwiZvMlso/2STx1TcrDU/GdwYrGrXPV8291hlMRJ1zRMnIY8NJ95IUt6zPH+/SVbjhvDMuTn/5F/FoR1I8p9frfjgX5A99QqYTu6QPf0fkiD1Dje9PJ5hefDZVLxF04eMRGotguYwpurKLWuYWr/EIceWw40PMQKfDLIa1SsyPukQDFX/oU/IoUYcgSBDU/C5yVv7JEHlWtsWjKDVyighh737ifx52mieVML4sTKzWAINzXMTpTmJBvni05/DBpkoA7UsMIOzKFhbG7FfJEjPdYv2xde6x8JinCKlL4numOWo1U5hvrL+dXUCIuwdfsANsL/kmRdxAcjWx6l+pa9mmgmdinsOoePAg8Gtaq2UwBpl0MF9hFqBcdRebkvZ//LUOMgHwKv8PsScl9MUhPuYAl6rQ0xpAi98ElxL1n7BQPvfhsHyjlfRPpz8ecuv9M0FyFP+vzasBhqgjui0hLclyBSxFZypVNCDLHT+HJ6UGSeB2L9b89CWBJy+20rrBhdf/bp19eAP1vQ2UBeUnClGT9e7JDWCSezPbjHjdZLbkEKU5Gt4KBxLCA7kOCUU5R8ghLwbhIRFydXw9HzNSgOuWlBdiBLVQwGjSfGSqbDfNX0tdEn3VQHbuyvOfgxid2lKCoFNGt8uyUj2y/+5OXinBIFhKW3Xf5TwTQGOeRkDFSrmWD4VZtEdOH6iFahTMQFf3WC9P2GjA49VD31UIcohvcsEJpz47E7+n9XHTxUiARqPE/EHrm9q8Hw1woEuMesVjXUyicxhZoXgTbf56g+4JHFbzDiwu6uEdL6jp7QILyr2lIx0OvFdGq1Sgx3V/GwxZWU0x8HDX+JEkZihymUiObFUvmtNzTy9/0nmRQIR4pJQrZFGNQ6HcNYWHVP9I4j6hZ2shMQBMIO7grkmcqdqtFPYHQGFhGBfeFZ/nADG7LpaznEcL4QT5IJ9LcurQ0yCitbMHoRrzT/ech+BU95kw974dhKfQ82s3/gVwqiDQp9ugE0MIg0eqP6gBu9Kyy87aXvbIcas81I+AVK7KMBkkLMOsUrNO53eWU8iMgMvoy6SGRGd+3ic1UmeNOc1SmARmgRG/zBUprEObdCWPIxukSk7T2/oyia9Pvf6zAWMXxCdVDWyfl5A93AG32R1/2XDg9rLwsdCNYv+yCz7g4S9G6Iw0OLfU3g8Pnsu7VZs3xefZYGFaSp8wzD3UrKBMT/tElD/fKVOmYVu5WPnyoP+1pc2hPUqNQzwVB5096aiMCFHScU+xp88Oq+rcXQQIv1BLp6L+PUrE8JIMs5MF6Y6XhgESKc1woRtD52kNuisEDgKISySj/cYU3Uc0jAwfELZajPJRZXHM4WSTsf/K7qu7yXezCzkYXyZQuoUo5LvnebDzfWgtN9wl1UW7CNafGyKQp1c2vPHMhiSeAKvb5uaKGLQ6QoZuV48FjL92e6qHSP0OPGEWp7LIL7AHogPcQQ5ONrr7CbDaWFkEmpy3lCAjhscmhZgeuXcKcV3aZ318psrTR3eseWz5u5W7N7i0AB2F381stJR6kNxhqJjoAvdIm86INisRm0OGdckgCovGceS5witudz9SBIxwB+G0umZndN9l8mfWa/HUvyqQLHxfESLLEQ+pVaimXS1bg3UngwEqcQI5uxMp/qDsZBd4ts2fSS9uU9QKGvSCsO+EXm34iQ6NmDYrDwmvPMjlQgot00HSmnN6Vb5oEUbkoLwgFf2XUPhET3Z7L0QU+eo/fp8bGyCYt2j4dJB149NU2OuS7xuynqoQD01mn0jN/t+9cz8vininnZlP+wS8z8ZqbNWnTS8GSQvO4MOGkBJgFbEs7US2T+vZ0k7KQ+tWf6ze0H1nDnikuaAnuXCI7muz+OJaiqQJ2p2SwpQ+h5fslHlVLAVQxAsiBD8ORlI5fAKqTT82YyImQ2cFrgHRbjALTKbXlLuVu3aJn2xntdCiZYSC39lFiijQzg9veId0NM5lAT1KofqKdRtTo/vMZwM0uAAplGVJJ8jLMK5S9LDNflYiRG6L1PLyf+osjxFu7OvTABvGaxUEl9VS6wMjZQF5t0gW56f7gib6zIwIdhx1UYdg0jLLCsIRg6yc4aP1Dg2inobI/QJcp3stjrWcA78x5zs3IeyKLg5HCB9IZr5QWQ1QYJ4adIIIMcHpLdweN0BBJfCu50N6eyeiyQHWpHqrEDqTXnzd84pr/TqUYpZvwDKYH7IBSjVoCrk/yjTFcfJGOEVz+x5/rexT6f4KXxXmFSF1I5RaC2zX93+zflGnzAQS55bc4pTKxvN8pl2pN9gclwktxJw7LqWt0bzVgoNEHJHkgzgj4HfD010+3dwP2ZUsBiwANE1zZhWvUCoHvff2OI83Cmj5aRH2AtP/9MDS42/9dluzEQI9UVorjWSzz0cEuBPydFU7CJHtWKrW74NvlAxG/3ZTnc1EcqwLiiSzYya2dSBo37vSKjMHcisSJr+Hrt7Bv0OWhcLeYzr9E0Wy4vVDO5/CbZokLTbtbLWsNMax50/qWZIaL3ArLi6gM7OSz7R+UTeuDqzU8gsjv1eoe3gkwbZd99ltRoRzPebwR2lVXEojW1qRMC46P38fjt3JVJENGKK0QXM4+Csm/ey3W+CoWIjk+dfEvpUBiQ5hIsckQ+KhUI9SJYaRA8uOn5H4Fvs+6LJOnl+e9GW8Wy5ZUa1JJ4JV03H8obC4CxRP+jwkutsNxj0wAo8btnwhIqZk3oV+kGvPbq3YZE08Dceiz82jlcvZJWowtsn9X36R+k7GV+fMarP5Un+54vo8gk+6XBUi5ADWc1An4MseCUA6CpTEIl4GXz/DGGoMrQwROlSdHRYVu9HzgwFPkbnORH86WvoUgQgWfGScaIBbPIG8k6v4cIncygM8zFIVnzMDQlOvTAEvW9mvMolAUkkEZc66Kf2mqd4fqOvtAmiVyqSX+XXi1oDB9BTrSgBz9/LknFMzM/NyWHdLPXkYpQ/nU7vl9iXtHG7BE0qr3noQgcJM8EjRwZCRSPrn46FlWG76RBNzPbZpewUAijzNujBXMZqNy058emluflUNAgHw7/Incsf4tORb9Ps1iRxJBIbBcpRwJ8r6z8KYYssRwd1ZIH45qQjbnd4oNeiGWfQ8aKsdpaGrOXmCFCUryY5l6/TgtTr4B9dfEg08HA5AnK0qkMNUQZ1hPYqSEk0YpgOEro3IN+sHt+Zb4Urgc/fnDpo64ZfAS4Ri0D6gt2irxAl6CQDa4h6V+xbTHY0PAiGxRYdrEDGt3mVvLUviuQAUFEmD4fgFDnGg2XSVIVco4/eOcNYXzLJhP+0u13fT3U475o+AxSTjktiXFTk6cThwhJu3iBKxZmoq4EYhKJtj0vYSN0hZsACsMgnvBFvgpgF6o5ZXK7JukBG41w0WJB3IwttDjiRv5zdckP1GMHK8skSjh09pgqeQfzsmzAw/QPy1KgWbkoGb+EovJLxDR6hn3iF0u8LNMqoNfDOoscNXcUom5YR9BSEHLQbYgVogOAy5Z/v19obvbt/bH+o+ZXXaFcfao24qPHsq3kidMimN314wxzlW2V4o9FBbp29d/43OeQqDLTevDT6qEliDvCWCuDHUKxiQR9EIC00CRClNeoOYHJKZBgCFIdQWtRPJSEU3/7rbBewvAGKEgMwySxL5q3I10B+aBfX8GNfaZM+Hj/nW9dvviCI3R1yrYv4BFwUdylz7OiB9r/vr5g2FLIkL8hl2z8PH4T55hPUrLQztoCrWcF/QqYQ2wveh+JnjhP912cZVeaYzIh8drLnAurYY3XHcJZjvtSihTqu7EGPQEGs7CYz/cRrlvQf9TMDyte64Gtr6Osr718G4k7RnpFkGAjt4BIE5YRTOOMY2dCPkIndGskhDyindPG+UvPIlcWuKrcI/UsDowTe5Vb9tclBVEPDS8L/cDoDBPR5vT457tsI2KwEc85ENRp7k9Vq/5UtdBbhcp/lY8xu/Ddvl5a5Ow5YZEzJhzU8iYleBIbByWo39Md8ClGG4cKkrOMH3DPtveACs9FSrWp1rjcxGGmO+Bc7SPEeX8elNszT0jMUmX0/X4j3796/IZob8xp7kstl+CoxffvXmpEAjSZFBT2+vEfTabwYucbXd5jijfeZfh+xTCl7RWuBolSuyQgiyC+TMxps73x3POscj585yciUWsBGAqPtN3747aeBYNm4Dd0kow2eR+Ifk+YuLjs9RjpeBHrqzdrJVsX4bBeC6xZKo59q+8RsdS/XfEKJiOSDucTDWlND5EUhzJMsje24CTv7jOV4HFohmrwgLDPnbrmDpUOSmSBP46hu2q2h0OGFcsukdYUfnIupCmZo7NOSaQgevKZxi2eUz2Gnx8nJpr+Ya8M4xLkvvj489cxnb2Yt0+x/+00GdzXfPvwtEMdrjr7CeQaDG/BPvc11U5XFc26DwllgRtralp0BlHlhEm5sfJIfFq+/+K5j5Mcn1eznw3DmK3O8sK86QtbafGAWXc8O5DEeC+jt37dRHaVIfBmINUQqD1NrDaGp3QDPUE5twX6jvbNgsg856txBeWudc+y/PmEz9PGoDO4zTPn47L/m141vZaV5sopLqmqQg+j53GtGufPMIjyOfp8pqksBeQD0OvFv14f12Y8XafY1KSlKThp4DXrJeD7sXE0On2u3ldrliyBGEE13Ae2l9et3r2GB76Hb0l/BO/8064OiMbskXBU6sYL+yq+XYd/MrbLgw7fxMbOyWla5nf+Wr4+OcXztvvVnqwGQaRg4/fvzdYXQPJJF84a9plZW/VLuZ7eKgK5O/d/M8tlsZURpklXvLsmbfoTO6zv8jTzztaozwvPWruabMjyfrvOsazWYUnovtEAx3iYsAAM9Z6X+I3qgmKSM3Wk+dBn2rHJwuU1UrniZoJ+uAoldX6GVL2n8avN4zCAHrT6U/pzzJ6Y97KrUIilZjWHe6+TZyjRDH11b4gYpmmKi5lx6fRFQkxumLv8cCgS/lMNpHuhqiSdlpfaEDOCvV72NZ3M4P5+8eCOiPX9d8sAZ7AqC0otax18LOmOVzlDsfdDC6yVHUTP01FjkNCDNDOHquxqjx9Pv3ybHh/uCCJiBIfxOo+PcdHjtFyW2HLzhirk337UndDzPaBQLM11d4QIAfGq4krlVJayFZB3Z/9azfCVRL/D86AMIZGz76FvqrN4CLYf9Y+rDFf7JqOd6+6TemwxefEcgIlYiemrA4iO1Y4gBNHItu+BkH3Sb1WepSiCDOV+4t9YyXLekheb5yUvnOpOZv+NQ7PLlHeGRhHzda48oKTuagQ6VqZkJELDfThPSTKjBH/oCaWDb/zEKYN9jJ6x1kuN/W/sOznXQRiyCZBhmjc1bRLHwB8NTSBRVFSBOT+bMDFxt0xQ2Z6figUz/C/cwKxJcBO9P8HpZ5IkHeHfZUWueXzQQ/KOO1LeMrFBPaAPANkNJkqL/bnyK5dY39fKu3LAlqB7Ovh03CYc/3ayzocTmskwbaGdMtrmEi3yvMzM8ZUM+4KP+ipLZd6w4tF7ivGwBhZlM3jaIPDMw5yeXGsGJA/d89aS/h5hM+Bwcu2D8wR6E8VTGrhYarAJgDYi45toigE4PDQEJEw8dHqeScg3epKyX6kzVKFo6f76y91I+e4Mi7d/vU9wuXhM6LfL+GE+TSDd+x+viQ08EP4JjmpKx3va39mk5KOv1OjcRXC4TKMHG1ZQf34rrSWdHgPJwt0mC9mQWtRDF7qRZhB5b/iIyL8Vlupip9MwTuaw5usijm1hPTLTOiN+N8a5HpjfRn0Yy3w7IlcPASxOwGkZSGJqT1zYaVZIGHOWw1Q1zg47nFZ+yU9MoWLh3f0HQfRvjamn+aQlWk0zXLyiUX5fsBP2LsM7Ysvk5hPkDmwo2k+DQauWukWWNdPuWSQsxQdqciH60Avi7rzAW+HrwlAj29AYj9UM6lMco/QdGnYjeLAEDiRoZ+PTYKhQC80OpDPP32qPOwiyn2ANaQoOx5rfRhPrdVkZE5Tyvz2wX+RdAgrdh3ZT8KYyEYRYz4MATwsOjH3UdQuISlDCX0M37fd1/G1eRk54d5Rr415o8EkGjaTfUvS1e+ZCIoMGCYJcZ3sPVI58Bbhf28+76rHqLw4/78Dz24Ngabqg0Bg1pvjbre7BN9nWB3Pq2aN4JwDgrZlyQ7HSWBRL1atZcIc0he6/sy+tpQ95XQtcjPuoAE9wAEUM6OVk2ZoTNvCJz+v8IvZHICXMPYC6VGg5OipyWdC/lKHrNBEmjw9HsRcvGfi52WdzDsT6BfVcpmx3/oljlwlSFSm0ms4C0gdYGDzu/M03IHOj8frkj4Y74AmUDClH4pcDswML/XxONxJfYKv/9Ix9uoN9YK8rSsBDWVLuWNjnnUWOfTQUniuvC5YOdS6quffPSRre9hPLaMTQr8APk07i7MM1/M69IlJrtFvblGNuu+j9MKxZ2b+BIS2o6qmCfWxjPXXREC4xYYGMl7srMMTHkgtm9Lsax7Xu/3qxI9ZitIcdbafJLcUqaoAGvniTADPPb7Zc6K3p32oljcCGPz4N0tPnV0uQ7F1NNONVDxshaZH26e/gfnT3xLDf9TPOeenSEVPYcr7e7ZUQBupuM5fokMh0U7qi5Ho7Jv6NPvomlNpVtX323+mtNU9XL9RtwPkfAspF2vG9fFUuSXoTUAoiOmcmrIk4+ulrmgWuLjPWLPTcjauvRwtCyyKRDIoTHdDhCOXxeu3CNnlFO6Zm7B1R5mCa/zDca5kVDEsNT/bY1+dhIPEggNH6jITSXmcP7zIKfzOyu41f/m890A+dMxgbo0imiBxdvc+JWdvpQejdZzFTJUynIeZgh5jaHpb27VB1F2vV63RB0DISJqOiBbpVANP2ZBTs4YrkElV/GxkKX8SvFdVti3Em4eCYA9eOYHxCLNMKmppcdkkdmKR7Edkqh1P3v8lBvw3pQGIu/OuTlF4mOQzk7Nvw3DOOaurtvawGR65SQ1h6fX3XRlZ/cikOdAswOuYjy+S2aH6cqnfeyfJBbX0Ldpjo/Mdf/op6tnE6i8fWE92YDrUDmErGo7t1wG8ioosSINXKRA4XbrvSjmvFc+rfNjLl4Sj/3UYGS6ERgEy25wAUe/ipA5+S7Bg3PK5FUMTGIvpTudylgjjJTjjvfdB1D+Uc/Pn3rKH1DPm0owKUF0IxwzcE607gwsXn+wlh7VPKmuIAVJKbmX4tvZaNX+HrvyOEB85JRt929xFwVhZ4uVYYpWPTjrat/3U2PtT0uUCFmWHpeQP8R3btQe5o6A3c0AvczHci5B2OCr/3HrBmqNsfbvgSPrtoQW7b/uolNz7A14lAZLiAEUyC3Ua+7+JG0Bl+sHkPF/nepveqwjGickMKL1BM14/J+bSoEhjW2LckyB22+fYgdaQGW0zslU47ZcP+b1oSs/J9s4ZOmgGT2WWCbB/nMDjiabtBxoEzhpVrZbM3+PBLe49zcuW5+rlSt/2MKNnc4QAvEMwmDpzACY1P0Kp/sBlQyhad5f5aUN0LXUFKwUL38nzioeN2EYl9ZL4dRdBt3hbG/Inq/7EH7VX/FdeU0L9qIL1kzrxFWKVdjJcxJEdqUqTuGc9xapF0RqjaJh/XQxFFUWA63h7eV502LppxD2TIPnqgAKE/Vh75OnUZ4ei8uup4Qo/9zQV4Oy9iXPjTxMVFtOP+hqYJTn57rmCgGRbewf92btgv6ORCNl3dexX2kCJd/WaKqYFEKnNN3AAaObyKPdnA8fQnAnECUnIqoACjPc4R9IvaUqaR3p/yHHZ+Wq+UlCyN/qVDttDiZYM5DO4YFb/dgsCIui9CfuRC8GTZ+gBJ+FR/KEVQW8z/B5e/GPbx389XecVnTva3O9Z9+QXwEHt8EUh6m4j0QnwlXPIzkzhPgffhA1oLZFiIY6YUR+ax1yMIsUEwtt3W+c15EJBo/2a/T2kywdq6ftSu0ikUZIn7G7gcRupAZn9BvvL12j7RZoy51f47iYsb/9lbFWx07izgPfKtOEgb/mFzXnl9DWWbENSzhIB+EZlaawDnj9dX5dtI00O28zSuSqXBekOA2IkD+yZPA4VO+DBICP6MHqYKu4mo7w6khdIVgH0hi4lv9tuMssuztZpXp1//znvkrOwVbKez4WhCOUtnrjLwYyuri9/D1YPvfW9CM22j6eq/bnRwTmbyyc6aYDd+DkNNKmULG/kNPanMovcsSqeZDRFVZIAsxo3e63B35phrL/F0BeiwlrbsFvZhNuZH8+4mKw9OlNn1AEWvthtA7bxzJ0HjQFKsR/6tbUcKKhbXnmVpCsEb6Lj1KFk16OFEp7HWlqjFrVGHaIK1CRHtrjPiZ2zHG3kN1MbaArO/56/8xT76TrfetZvNXmUnILrL7E33cRLRTj4+nTZaQZTGy8yxCIwRj/ygG84FTWbr6+BkKuYZKp9/lAN3nB9zN8HBwKLPIyjJmII5THez5C3oOYaiS9UfD1ptliTfDcFiD4V3ogmSFq2Rd5qilc4ZIZJd7c16V4p0YOFPpdvd+cHgZpdlQQJ5mXvJuS3r/iX01sTmh4Kg6DaND6e9KL3/ZmRv33BFE7VF+nvwdnIwj0Ko4CLOUPaB6xoDfiqGPxzluYvrD1Z+CODzW3MfoqJAzsrEtkWrrvAkjAbcUMxY/DDSKMKK1vmrRFvFXxLn5Po2YZNHA8DoQLsltF+4SlmcPxkmy0kNl7Gb1wDUtUC5nj/Rj1wVUij2Hw2oPcDrfLOI3NWtxYEtFL+sgKl2NTQbKEnlr7ko0V3C3uThgo9ZBsItpZIou5fAaNN3mMQyfGJqM8H5Pk+VOvDm0ejfM6RStH0VxcO7T30PldcC834GNPbCTriKB+Rza3Dj1MM8zdbX4NxvXoPwei9OKRjW/QDubhAQMuvpF9okRgqzkohLRuNfuNr7KAyKBqkz5eLSDHxJiQGvbWzdv3bzgZd0WBdVv4q/JrWlF9eBoR/GkpGdAudb8frlNvbbMH7pBomrDlk92tgy7KgUNziIk0VZSO5dqFGsZ+weJHVgJYvK1dx2OFtl/FqlVjksZVWoz0E6aqEYHNO+eZ8JoHT4jqCnZQAihTmubl1WcNys+rCYBS47CNI+7oELDpQSYmv2leRP422qoI/VeeL6Az7fgWNIEXLxHLguGpL7zw0jX22XgqiraK383SdUjgnzFjg5tlsAmoDMu2WXrf50DrJylHz2HjdKbxZ7yQ8mYImXVF0E0fKQLoGpaoIL6OnDPs7iuewa2yPsu5kcBDOruA4tdguOlFnOIZt4yPKYufbDusNwkkNeZNVX6mJ8qJbLC0F4ALTBhWXQ4aA2pGVUkU1QHPqVa1RFatDd9o45naHAU1ZNUT1hBezKYvQDOpcAPgkiBjWB6hssooKhvwy6WTDBZwt4evSJph4GpYtinymRJj3PZBIauZBFSiTK5xgymMt8/8FLLiW9kprtDOPs0cCimMz6Gv6HocveWhjBOEisp13hvIdGP1nmJ0vc7lCLzzm2SZDULFaYSPpzj4Rdxw9p+TXyzPZ4GorLxcL+hmJdEhFIfeMPxGcU5qWTaKFpxxtnv12uYkxmR4zuXT1WaEvVHbrE37PwohGT5nPD2PmC/GIpUuu+M3x+YkPmtcU01LTGHdrS3o5Z+jGdquEnwTs3aFSvaz77iNyyec3G6+PWatmUJl15zSvEQHCvSHPIhWk6Bnki83YSKp65gReAs4tvb+C5M7PSMzN5fLGry5v74NYqaVHOkDeDRFiC05hSXx6ENSvnYtAqiAKcKn6ACR26H3I08FBgnG+da1y/pcjcYr1crO/JWeu/4LDXqERpn4NwNhvnCiVqbmesfwvlgPfJ7bFsHqjb7KW/obKP1dTexnefsQR7C636wH9u6Q515AmdFWBrvuKLcYkF00mgkXg1LtUAH09+7JephMfqKUXc1Yb1K3tLpNKE23bYXUjK2B7itJHizgLya7KpkBJlcWmK6GOc98mkpwF/RVrO0GdFigKBCfNK6EafvHaLbs0B10/+Delrx3jHPcEMDh5APK7ZZtrPc7Ysn7Jk/yXsPsYWPA13VlfeT5DqoNNvxaKoLQszTeqOJViYqt/4S5VqERjRctinh5FE0qRf2lZ4mftbUvAt6JhwU4CvF4JOfw6OxGjccWHdI6mWDXarNhasRhXQQlwE3fvjVzunuRvXzVTke33N2/P92/UxNMx7+lU68DpO9yfYulzri8baMNYlor3PaGrp+uod5q3EL2xTh/5hu20GfI+nh+0a8XLfDJKpjpwvnK97LEz22EzJMiiiVdo8IhL2tLLNjNX71RMRKvesHRZZ8lPx+FyO7mW/4XJ2Bp8kBaI4SVi4I3Ru9UAG4QCBWnip60MXvqdmiKCs44nGyblBpEpNbpGdGWpNdWJVM8S23nPVqRO4N2RwINMUukSvDkeATImmcTJRpEa1b4teO4o7ZPNvSguRKd2GSlWmaT5IoBCf3mZk6aVitOXveoOBi/SwmtVcvg8iiCclVnRwu0M79xk//9Qk9Dq4z3PXB4DWQbOKYBrvuQa5b2zSJlj6+D5tJ0VGEd5t4duQLEh8R/yvXfAwKnS5K9MPrYcX5NM2x9Sb6wspg4m7+2xh4AC5ssCUoSHdeM3IMiPcpHw+RDrNHTbF3fRhmjVgml3QmKoiTJIqYbDgxxUVnJKiHkqCU4i7/kbWJmXPpAL5chjIWa/Scl1oT15GkVMIP7rMtrkvRGmBe5MxdLFpiXpfFCTwjgn6DM4aX64ovoTUF0/Ynlsu9SmSfeMrKV4shJ+qxeApjUbNOdzjmWocSPnSgnGh7nJW97GMJG3UttudKfragzwrGw5G02MNW/S3OsPYpNTq0EhJvQ+spJN2m/c3yopibkMqTvlRbifHu9xfz/tYsTbLqpb9Apjk3uL2yl/fxSXzx5RMttrIYT2BTSVf4JRSB+vBGeCMlabXt3+bcr/fv4kpFiVAWa/S5eFFHfgT4qKGQWuE40iSxSlAak8qdgre+MzABuUVeHg+L7N6VZcf2t94rijEAZ0GJjQ+3v6tGKXkWO1G2Ct0cRQ4Buv+zNHCv/SSdgfTsEwcJuQvQb9yk7G4gUzKplOsz92KwjZqNqNUSZ0xVmgmuV4onX7eJ3gvP5FO8v9ouortuLUt+EtiGIqZWTNBi5mlr3+Sc18G8bITd6sP1K7amKmP/dXGckimn34SflqGN8l5v0XB+zb1KYrC1M5LbwNbuui9xKOsp3Tk+NKMC/pEV8Of2HXZ//wXKj/KmNWXcWJ8SVHkvvjYDWsJMdFiula1XXR45kAp8creIDiOY5pJOQITMj5jpBnKgustq2x1iyf6VXoZiMMTJnochoVp8fQ99ich2dOzkB4rc0O7qGQhZ04QtzO+p+8zNeU3OIO3DsaTzeA3A7/f+t3IbTufywp/5nGEME5+j2fCQ0ZdnfBLUtLd+io8wlzFqzAtma92FGEkm2HPuKKyhoRvH97b7emI/aMwNxCgzt89V4guZ/jrLHl6W6k26iHk1NYoyigxm7Hnt+POovqfckMvcIpf8FS13VG5o4gRsien/dUjxncMH/jZpkTmYH1LVSLZ5kcSaU+y1LVljL6GddZKKLMiidr5BQ+28C0oaXUTDVfNUQrdfgFBZbZtcc1ezGHO7xRxHWKepgSRUyIJ5czV5qmjakhLqwUVMBK0MwUZslU6AnDwFPDqVn9dwVf0Z555n3AcisN1afeA8WIAWUa4M3BqsnVnc9vU5CkBpRyAiE9SHX4CXLl0dv08AWa4O2PKgGUf1i5+Ui0uX1nyo9UdLF0UOfS1TH8yesLQev9wG0hCr1Qg9PNOWGuor7V7U+dTMdYoS8t62THQOPFwuZqI7jqhPBJEl0a318KkLp8tTmQJp5SfGaW1ga0xARn+oeIDpeVQZxK5o6pLhwqfraucI66SonfDMuLtFhLfBaS0zDsI0cimHy2//EDbSy8ic2twAcV53tfY6chI7RHIsvrKNu1g7idj4aVgIf2Zj6HswONkpfSkKxdm4o6eI3X4Cz3BxdoWsF2nRAQ6FWvRzPyaHPpap9NimkgdR5lVdjL3QQsUmIuwh7s408kXhjDD757q2+nk1FahKoUhZ4QXO9eL4m04EK46b/McU6mENKYPZJHfH/TpFOVMcVNHu1E+l63Kbz+/AFV/wvJSLBkLDa1NfOXQnevdv8HPIkr+2JIYJcxipcB7XQCZ9usDZuTQMPB4O8EWGEP011JOFRpy3jQ8/AgGZZwMGN/ZwDlFg94wDKM4xaljLNVPGjaNlY6Bw7wEWquJiPRmw1McqBxVBl2r5wcVnXTeh8AAht/buF40ApQt6DA6D/yatxZJCfL2xOkS62NqOKXgPSPDiRumhVX6fKh71QvecJuIrh1eEob4vQMZCfU2iuOqGPxlccfHVxwQdMGu1u1SMwAR6l4u2td6vazTjrF1eUaCoI4qB+5xmXGnRjp58KhViP2W5Gz+Uw6w29q3jPFUrbGlxY32ywneQ9MkSn5cpWj9+Sp4cF0YqkhNorcMscvVLRs8zW9OMvjR0l+dN9V0Q7spzjaKBub4hon0UDd/Cf/fUzI1G1LFPqDs4KEEzWycAYBlfKOW6EbdOMmd4+kIEiGj+41ahykpORb/Z0Six3ORwrls0kcNiyaElOgIFAOue+9hr7Oww/6VLGqB87H2fAtZE4H2fY+iPHLtCmYfgdc+IkYXALrX2Prjv6Aqfd0aYmMaegaZieCPmRX2Cg3Xq2tOwDGsdpLA60d8r9noklXL2Z5x6XS1bHxuMscZ0fr1bHSZ8XfdDtPlkC/f+ZACu97EEARuLwaH9k+V3dwEgx6EyfUXg8ZuNtrncBfo3wZom7khA3wOXnUD1OyANslQg9dJFuru0AZ07VMJDDY6ubYQv6XHoeqC1yPHRtxmH/oj0O/793gGb7jTF0dj2w82KMQXmIOC8BmKcueD3ffCVOds48YL0yRPX3WAzbtMBGGcwPor3PmMSj9UraB4oZNdg/yaefGSG/sJEAwY8lH/PZTFncGaPpB441pg+pGYIJxKqDGjU1Qj68KrEo51cZQ42iIi5K+x9VcPuW5cmCABF5bY8Ugx1OL7mfioVJyz2q+njRv19mULLRveLzc2L7MvlFSnUe29lLyYfkF3RO0LlgfEXL4Zu6xUBN22MYMsnUsWyXTu+sB/brSG4GfNsMPtySLkL2qBymzUJ2vtAK0w4utHp9PnM7I9/onqL+jtmDXguWg9OAaXUr7RzrYfH5U7hTZ/rSqNCNKfuS1Z2mN6vtrGP+8PEkjQcW1bOFlmxA91TmLh43BMM2F58xztCvYGG+q4CZJU7At7/bnR2lHVdVT5Hu1yqwQq6AQkYW32JWE+CRbhvyiHrW3/xN/QE6GCm98ZJIjPbfY7gsXvkanuEcziRN724k8GNtoFhOA0z9NnAHQtU9lZJ4ehsgWzLE2c7B4UJdXl9HTelgubOCg3ef+DoBJWy1WVRltJLXAgbL+/lIcwVYWlPj0nYjUlUFobIQxqWyrCRg1iQlNySNG7xrGCWtCuEJfH89F5Ff5L5tmP40HMGueEWf+S8ehmQJD/ykYkPnCBKBJRPC9H35AeXD9F6XhcXQnGH2wirFPT2s9tteJH550wRmxRL5qa0xfsZhjPXFlfyu6XMT0IIq1B1IXpASR5vGagJhBkFdTd1L39qu8NdQt/dQ36gJEkqkVI6JHYuoWrMokm5WTorvZ1KvQazVSyj0YBME1lrQGgf9ial78FR1URgEZ7HktJfkoOsHXTbAexuSCYZXp5rIlZoe5V5XviWlGN8F+s+TYp3gShs6qBduXXKgMaRgZG1uvDXv5Bu7vQl+23hleylRg8Dgu99wz/5fNfSUAzXX+R5Jg6+Wruzfk7Cw9exACpOP39gfHL5XiunKEYg75DUfz52+mO1E7ngA6s+374NeHlH6AloWsLfTDjoqpAaPwvCg5iZOQ3MmrXEyfRXPQrC/3FVZzIuMDkT41BqCZoLlS62Pb93uEIEc4Di3iFz2iRJg+2nwdjyQLEcLv721gH/tJUEE4/WqEURx0+nN3Oz+HG1zBd69uaXRVofp7m/g0JS2nEBPq1NPm9VLtSvP9ynDi5dFDVBDAq8ZwzlOfsz9FwzHHJQgtm2A0GnONFZNBgElg4PyZKRfhHAZXPHY+w3CPlUFEWMiRnH+Hf3IZIb87D2lcxYpD4jW/C+J0i5m8qAN+ogGXhG9YwgYlI3xMc9XVWZa1bahngcPDZlYe/scYAOaSCBSoRKS5FZimjae9HDNWqaJD5spA6/jCrIjT5tgOPosA1uoO45W7S9fuSpsjGqe6xkJUO7QudRX/xgr88NBH7HLlaBCia1jsvXiP+ITH0xHPnmYtkUlmfpOCTgxeB5VbMzPZwHRc5bGxfwCmIqKbJDxXNUjhKxkG3OPsxgCAE+5vrQ8DDqmOSYt38zIvMVW1LlyGjlYweIO8lZTW4teiCEg2rqSNJ5gbRp2uGnNA6z+rXOgmX65mlqnY1nJZ4EX0rzXLfzWJ0Fd8+iXCtHKOh74ZfTYDnuxmG25Z/TcIq9S5GqfUVNZN+2Kq/lPJHPd1Hf8G/3r+WKflsbxhhs5vbp+5FrdAxU583tfcUjCK0pwsY+Ey2LjgyGxnEP18sYVZASxO995jpywZfXgbdp21JoL29YOiJL/Um/iaBo+j0hQHYr/6NaewmFZMK5+MrCLWj+0m4xGAs4qUu/t32uzA23VluzWjpizNiXA1ScfX9rQ1VSzLN5zwfAflOrnwtyI1hCG5R71ttwoM8X/oSnRHY1eq1yKDIbFI6kaQfkOPgKzkqxDfE9fKT4okW+Fu+lwZURFrQcDvjiSrzzEHq71fYyiq/PHlr0ERRvHk/Kf/qBByyNGzRM80UsAOVCJOso91H3rAOzdiR7JFRZC4kLYwgnuRN7EtHeY2xujVs0+ScelwE4e5feqSns38OHtWk2zs3L09gAuko1qk4GwElkMgLoVDwnFdpZRFESbz7eW8O6bM/P5s21LOkFOLlS+yF3lQU4z5JUd1cxvbEXYlRARSSjxyhmeLk0iRJ8hwLt+hus6haM0lVfBF1KLMBvjFfxY3+GewZ4Jx0VCZB65peHJ+Bh1A3AchHIRhPUlOIgH1CK/+SEanLTMoHXE+wbscLRFgMFIflB6cfRBJKHqGY0bmgsok7cr8MXR4spa686zVlxdOcUbMHfdxPJUjb1S2SGkpHR/SFZ5bVMFlUI4sKNh2iYzjlDqW4na9BKJjfX4HOgv9Ffu+XvbH6d7KGE5K4K+uojh6a4JqTA0HxNU+hMljNHAFCjY4jx7m3G7QA4/6C7i6YVZ+5pqVwKcL9YZp3TRHvlH+tsi0eiDCZ6MwswwNUr2mMZtfOd3w5nWVfc+JimdytKdAf/a/Nv1KnYpVGxo6UU0xs2/vjNDAcvJi2xk/9AnYSfv02acZJ20N/rnFv75YA5mWtIHfmUMU7sGwhGgzPWC0W3Y9EEWv5pS7135km0Jeeii3TxNJ7fP0QBK7P+uQBjIkVrb6gBOGB11a2rqlRLkZajmBmySOshfdN+h+FeaoWSsPFCDs55JEELBkS/SuMTmDgl+jPX9orXuRYo2nVVGcWRn9spMEqLskE6mTEjAfFpw/3g0X++tzf3xWCDna2lUVK4c/xCfmUNyTNYRAfgahpULRyHHOASMSK4UODcgHzE4fCxfteAVJF8Et4tsM9p/AlKtvnZ18VxwSv6Qtjwd5uLbHY9MeONN+gaEg0ktrT1PJSwlFbzi94TdVh9VVT65STWfPcC+krxznXcosOyb0Q316FzwqWwHgIXF+GFUaLw89R5LGXOoIe2Oy9LCl94+Tqni8tJhFB4fHFFnqIhLb5CbWatuOAE3F3eYv8XzYuwHxPPyVf9Ytu/jz38TkbTtagM73BBvOMnaArODfoHqp9cUlThIJ+mpNEOeAwcv/yYjNzVhvhrwgTiYIfivqh3v3+YAHDCfdz3qmXXCNXNKbuPWMFPugzXijqgzV5llrEjfOnwnhmwNiCJdGUxVAjp9YnI9WzvVTVHQrcZw2Jv94hbtaf+k99reZ6+IJ6UyixkLpoDMVnTT7sJVXXgTatHjZyUgetTkamhShkXjPh177iatnoL+Tv8bODumyaAZTZB2LS6HULQX8tlkaTI13rSHrzYoDvGvDDjNa9luQIhxZhiM1XEgVb1osrCAI/huOweyh95dRvwXY6/5C/RoZQ7Zgmrn/vdQBKnaNUaaSGr3ik0AOA/NdPE7Sy2jsYL836dpq5rU30TrRCwCm+uJ/06+zMB3RlSWcmXfBX6Jqb5BdTidYagjdi0FniDaoxTqJ44ibknk+J163UsmQAnedAcrAuEmfU8QGuOc/XFkeA1JYRTY3U363gFufL2yo/1tZRBxXQeNBDcjXWI6SXXwsrhtCVrLVfuvOZSzS0BVZc99kP1r06/Urt/8p5cHPRHx6tKJhIWRV4byf6836XZgGxH3Vf0DChaMP6QoavQH5iArW4qAxO0pOpFJex6LKyAvamPe7nZsptnl6rTjo3EWSnLlBg7nO98pZ/YwUpEzBq68rYv7ZByMD91/8AHTiActzIINaWNopLp9H2upuUXZ7YGfJ6CJ1ALwx7Jhz6qWVx5SH9V1hw3wgI/kZX/JoSp7tOeSWpaAR+lAX8tH6DPjB4Bc8iCBCJ18iotDfXNR29Kqv7ya/xVy4puSfRkO19qAZdfPBA+y4nO5YjVfo8THFSxlCRQFkCDUghBUGNcI+4Lz0108Ui6yAjXXT/eNpr9mKWGgqoTD7BIqTMEoo9JLi3Mp2ilm8g4/Na+e1EiJnpcUh+36Ck0dalu1CyHNZthBcTrWXYZooo+aPtlykNZXzqF1/eyd29R9swtg+r3HjKrf78xuVoMEYv5JK4FurQXuaCh/aANTP1Rs6qGwdAIOHB+TR5E5kGQ/rbforIfAI2iOvMXIA5xiYP+/mu3N73i3ZtzDE9aEjUcsw+gmEBlAEsV30BSKz+8h8dBMuNxPIGd45CvgrjGtlUaWAPef2UdOClVLh+6Ue6XtR2xhU1sutnB+HghD0Sutgaz130KFLZH/v0T+l+Ev4s/9DDQiyKQ5cEasYVMmF2OXCxKIRE/6Nuzzj6eYq6tdR9To1vsyuwdIJmxjnro43BunbZ52RKTiNZv4YUkLMSjU+paYBgO8hy/kaunwuKp42yMX7pbrA24CJ9TzfvJ5O02bNNc5ALQh0u6HNqHk9hTZZGjeCufrDbs0oOoyxq5a3R4jsDBhaphEzjeMNYnxn9wWqk9ZZUHcDMeIeT4i+dcvtx3bS7QPVRFlNAry3ixb0wdZf2b8oix5hWrh55vx7dItmA7RmarFvB7GTM79MzFH5x27jCgwsNz9bH9DwvY1VyZt2xkp5dvfIZ91/V7X5Bs+7LxVPhux7ZIXaPQv7NDkfMdL3NK3Co063Yj5Kun5V362ib6vYfkjCoQNNM2LxI/zcjqAE21UmPly/3684oscJiNzrcGBpTaDW685i2DIezSUo82HqZiC5qoDCVSYjosqPryUDZoavwnd3XHhlIPJ/FF3ev2tlxXboX8mePcf5CUKNpQLvS2uv7tMDuSL+hBd7DlXzxj5oJvrWffj89wYOJhsnm2tIXXQuSG4C0525xBfRwNzxM5lPNAneAEiGqJPN6rO5jadaPt/F3ucNTKMmf30eozlbVfwxUBY7UgTumRVxFL2VGGSf5cM0fEfwh081TZu3KEi8ZHsguiMrWlo7ABRefTbOT5rYNoB/Qy43nDaCGfqhqGES5DFVyRilSnvDxg5IXB1qSmA+uZ02mMrcdi1fEjjMFMtqmxvDKSMvLqD+iVUU/ubzQ3XxXF0nNjZ80CJ/3epyU3o1XSOEUPuDnHd2S/+YHCBIy5xYcvaToyOF6vj0JWGiqvFcXkDvG9jUPyeBTPNdZBCOCfG1BggYdm25jlH1mdweKfz6zRuxbXsc52S/3qcj/3A1Og/e/n6AORmlejxEH02tSa0xf5n0fkYy6z1GyDalSBeGodcDFS8xS9ZP3JfqTNSPGxQjkkBEJaYYLC58ZCV386zDMl9u27cppXgUJDwCuU7QqtxYwsylKyS85sat8thl2pWS0G6L0yH8Xjg8Xu4gbkRhtJzTOkjKH0Ha/Ggs5Q/mt43mowbb8LU2zUEV0EarmGfRJU5VENT5HcVNfcf/2ojboUkHSTu5tKy3yfN67sIstj2IG/tU+g/x4Dgmuq6FXWxrqPV5YMX7AHF/q/d6DsAHBSZgGmjh8DcK3JfhOWYOH6+fkFhDJina5wq+NTfs9UGt/0V94JPSAyW1nTmZLo5Hrh7Qs0PhK+0rb0/TfxYXhfzVpfAv8DFHs4Rj+rFz+Al/wgjSGf+XKWSItUtPFfnr9HMARe5H+zSY/gRi4JSqM12k3+a8kTtrJ6bMIK0JgsBNV0pdPwRD7IPw1mNmL7XFzQrh+UNwNfWvSfdVL3CevKfxz5DEYuulS6cmMRqLl2WY5curJws0DgaeTMwycmLhxbmNEglvJjskw/GW3rVihM1w3itDglC+x8cP9zvW18nC1NqXw5c4tT1ClSl2G+YpsmaO7KRGW8MMpsyx98wC24AjXQWzezdfLRH6tA2txJ0/P4lhLDaL+Y5u83ZSUK3apaMDBXLLvBeHKJ27vwfh3OYgWkutoxeZfk1hzxkVDcErjai0LrMcNJNvMl9Rab2VnbfiSf6Q6/LFgQPZWo829bGHkTgzTfy+WRWmTbAHsFA1YVFQ18nPLttHWLjIoY3/DkFvHUb57o9YH1D8+Ozw5iK13GK/3B2KYqk42LlgLnSIGQut/5Set6BYbTuTK48EhNFsmVdRtcEmOLJPbC2cs27J2c2K+ts5FJPZbl4cQcoxNvKgFhYJyd5fRT/yoO3q1FO46PhX31p81Sul8SCdkggEP4K0IyQldhdmiVFxCl5mFIYY0+h6s2+eimEAqseAX1UmvkyYKDUCfReEldIKEOHBjj1JTFJR+rBnrMxgKzXk+xSmjXfkbIFfflpTcUxE0O5yqY7WdXKfW2AaqwmoPdSK2vdHtC1jDbACxJKZBW1Wc0io3ZEclce8WV19sqy/TKlx/OccvjcFjKzU+hQAksd5fo6jBJnc8onojh9q+9omt+x4u7bqLmCiQXlM4kCKIGPD7T0BhzTIYHKb5aUtUTRRiOBSDCkPZpumn9xSleE8EJL7oKEO8wK8yJwtTXaupT2+cPCY0DBztLUsC6VRjYCyJGm6z6Kbspop71HeT4EGJrnSH4ojqSkXgXvJ6ZFvByyW6A0uQi56xA4B6GqZSl/KJ1qFdPDsfW0lPpkD610jLsMxa5vbFpZ77o6avkf/zsHmD+JotWvbI1vqWVqBPphL/xVUx+jKpP6NdepREWa5/GbI7HjP2OyYEvH9BAGEj1tFNdOmfhN+6HeI13ZGzHeTv4ndiSADGQdN6+wKr7CLkOuNPcdy/ZIwH76+PjNp4bRz5bU8d1eMgaQ0Z6WgPYpQuN7takAcxZh79KvpzVqpObXVyPJxN+TM/7cjWKS99CsNwFkC8uSW6IDN7CSckfo3BaOxr10Hbm61scJmGaxntcD1N7oQuX3Eob5rY5ykh4c8Lga+Xy2L4as+TXcgPgFCYoHAYx8Teqxq///1S14/VuwCoul6nOSLzgBTW1mO/eh3tuEogqVkIxWkIbrnlJUoEw8PtcupP7GowdSdjcJk4Zf/a4hWRRKItFgHDJ7AnoUbrOE2xvf2dQKqe8uBYTBo34QBfuqPcsW34NnsezhiTirqPgmlwoP1kvXaQKb7nmTd8yu3dw7N+b0kljN434oKXhD8JB9AE04aszoav6fVj32v/kiJf8nUyr4n5TKU5/Tw2+ZaV9q5RjbXSx4LE/EE/4bJsVXuZcN7ktcKt7f1LGJbhbGzgbYJ2A+YoApfobyJSTRn00OEFgN2BghgFp0im/wZLeEwPKECEtfJhRGyrRu/3cP43EedbjY+l3l/qF22ookz/epRrlA2bMgg2b6BBblYKp2CHiNGT/Xow7McnlMfeD+G6yFq4i2f/pofwy6zM88vFZbicyXNbPd/rpRpZH76+kVBe0QxLnDZGbN4aKOP92mK95VTE8yrC91ywIXZ/mWLUUf9MMVC+9kQ2kxvDLOUiDGqVF/K5BoEgSTkOhYjY1b1wWL0G7q9VXa5oWdiN24bWBQ8GaHzQY6PT7XYSK48Bopp5o2lT2uHRqHymvOxDqT7RU2wdQ+xx30swcl1y//d0/BiqYkBLswif+ydgpCugednx9towcFThf54vZkitamjDpkVYHgHxwoyjCveNdsjdkVceKvFjoowHedzpvUtFRPokMrE7l2IYBLxSdabbMECqzw9eaIFC32InfL2OrJuuShHtDWWb6xHt4vnz5ODcH4Bs5Xx5enR4YpibDetDGLPGSojk4Wnv1UplZulFyyP/kr+MiNMrAWBL0IT0mEWmNyz3QbZS7iiDQ32gXzEcgwiWhA815S9P+kQotDnTiwFX1O2nORDFiBl1zeZGK+M2zvfPrN7EwOIExpgvGSBCUvm95IPeXAfM859/n4LmC+QXtvYHvGhMWgB2v9dIqFNwO/J3a5K45TJN/0fe/pNBrkJXcOCKi9IaNclXe36/2o7joQpufn16WZcRiZTAJeXzRRo1zb0GzQ3okqMpSaRtaaXpaC/MHthdeY/+0QO+ijnDv22/goL95CTURlrrCnm/QZ25qOgBYGU2xiWNvsqc1U5AQnnPj6nB/ikDVh3Hkq7XVEoGpRvVfS/Thnl80C6ZUCKZgZCAqRPsYcny/hW51Tl4wjZDulQioQgDepYLNJrhUYtuU52jN96uOIOhhcUu52p9vds3UK2LKvWoyPhaCq3lYDxiPbBatBP9EZf/Rhgi0r+vhfW8eGfYAw6c9PtwhNLg/PkbOJCwCtZDsXwKR79HyKlgk8ypcdGs9Lkdr5+dLOTVc40f1RMuqR32CbGZSsl8HxOF/H2AvOeC4rk+odk39besOWeWr7xsN+i5LOffzxjKFqRTXQtJ2nq+KpKmdDcIg6FMw4Mfy69B/9MF2EFfOfdFUQT1H7fC8Wu4cqCUlJj7YS+pul76cCkDY5Y/D6f2sewCOFpNxBK5Z9VbIJ0EX1kqHDBPsveR2vJxbiQFCLnQmnpf5TwdZIhK1cCNay0KrCOAO5A5EZsAdgbbACbysz8Teyb3J6ZVn86WtkmKAyrE5R8BDwAg/03tCw7hTz0UxKR/K6ylxI9WNJTDbNklppi82SgI+nrKmzjpS0AdEG36vG8ch+VOeoGZIEC4L+s7D5wzvREGA/NBPIT489R/na09kMr+z6fqK6Ot5BWq/TrYNfKJFE07LSRvr387PCTzkuzPYZ6fUeetRsL0kUhejS1jP7u/xJx5GV+71hbxIeVPT9mAw061wjiOeO5VHH+IZcm80CYrcC7YK7pLLqO5RUtlPBUuLlRVGzfzeNqn2kjNwokJNrSz3dBBbD87UHa9SU0TFB/C++VjcR/nuqHrLzYDwFQUal+YX65h/QV4VPQq42M3wOPJbJNVJ43NJcXrX0J4+ERo0t6ppHf8I5WJOZ0rrBNQShs4rWyzcViSxb/mru9HVjFHIBA7effo/ypa+bS1vYUdJ2k283f0ZFIi2I8DsxgzeOhWOFoVM63m/VhBwDbfAUqWy3jr/qhV1FAO+z5IDXSKqzhcdZS/KqmIZuLkLNet3lGIdxEHcU6X49i8ZOSVcp6aaVV2y9XA4wu0O47hoQj5CmhfmY/a1egwlVsmD32QNGUOKyK0vHg5bfpWsCEtIkwugTB8nCHIviRm+6+4SnWCv+wrT+CPcGlhmM1T8s9l0RgJSTiKvcvjCPR1FZdrNAXGy19MX4nkngryfusxXGyi/FlMU14Tfc4KpBykmkB5dxq81fvLMFHLdzEd6mWLLw+JpPNPDQvqXkbNyFAvckJcUO5p/57hZbkNHvgmIHqYYMSYXkoUC2OpDD7UEY85xcXKH3NDiN8UK442z/tSCqjRbxnoc6ZRpeDCTFMJv9e3+euAeHw19KfFumpHrW3MdxLy8vqd4X1eeKDD4/yYThDVZEzFnrEVYuR2ZkyhFyLDFqrP2zezfdn74Warldp3c9KAEI4DfPX4W2xzDPiK0IRnv3CQjMTYuVl6Kz0qKOY5BWaNclIB11t2q/rcbC7WbEW2sTaV5FuDcgqDO2n6MKobqaof31PaaMLVLz/jEuX/OJpGRTYn2TPLo57m/NmVkmUMqgs2IaiW/LeuGy/R27Pj+e8ufW+2Yg2KLAMDonq1DUVPtlfsvwRoxdK/tnbj5qnQGY/cdXY9L3u56Lq+n+exp1uxkZ+t0/9mS+o/e2CyE4azJWhxoftpVN6wxL8OtQtf84rEy8+csxXYcXys+aOcAO+NoNDvE6h5NTv6SNvpp04PYfHnJS8KU+S9xvWrNNFYKf2oTVZrWb5OAWlOzuobOvDup357ijXhivhydsCQHI7jOx7AwJVOb6+3ZrfI9W3S/jWHuJaNN5Vhr6XO/NMqfMV9WmUNK/+Kzz9806KV4rUiQZG4y1sf7X8hERmLN8eO33lehtI/pzWNn4E/7WjB5KGvsWrB2SokevAJwkRLIruj8yxf+niIwa4CgMiF5agl9Goi1n34YA8nL6JM0fV49u60mWSYxMYFSCmRW1xbooxlwEu7/S6EMfq9rL+xFjj/Fbv2mtzdFHw1FRNTPTg+DEObF7+97yRCw24JFz5NHcSvLKeutPWdMjdDRFmKJ1s/V1/C1FpaNvvET3r1Xljz4xkhm1HHPn37xpbkmWbecsddG4jfFcdQQn/CZmIR5foY5CnSlFMJJRkG2WV/cCewmqTxEOOewYhYL0WtBRpdodS+2hiLI9jsUl04J+YKWBp2q+Amn/T6HrM+WJf13yM/kaD8/oJeiwEKm08KApxcDX95NnduyDSFXH/9Ol6G0rpYg2JdfoB3bg6VpWK+LdgEQbDdCXnYRv32Is/BDcL1Mgbz9Kv4vmPi4H5rkJr9gpI43nSQ7RJrkscKgGJeWTS61gInLjqbODvH7Yxbxc/FkPj2a/hsc+Fn8RK/O8GO9P3XE4IwH/CfFaYZc7SlDHoy3eAHNZT4f5qXjr51YspdvWnr/1bhFdiB/zLPemDjDW7lM+GYeexkObFbn58y7RtFM2MKU9Yqh7tQsYVcRWknoV5MJW2/FDgExnStNdwfdvJc/CKY+BjGFasAo0i+ZJVEibX+ib/RKls/DkhQ68w0VBRufEb/3kM1yfA1yN53dl/1wd1X2EeHfdXRjCq/ocGr0vUXaI6NPlyw+a/hAPLy8usJkmmAKGLfT9JnIItA0Yn2zL5FuiGQMm0FxO3dV5LUlCuKEa+eR16z3bgpaTnReu+kw5FuQ7RyWu/blfrZN4eWQQQBcudTcbD6s66R5IsOCn/fAFG+hhgSksdXO/lYstisncE+lYbZdoUd+RcJjvx5I0EYLN7rFmBk9e6+Xjzhb+e/g51ig1itSD7f7i6bz5PiyrUnMdZsAIt7/l4SxYU78e16ZV6qNJUwJUN7FMDLHc39f8+oMqtHR5r1JjHmuR+xH8XapThvL0bsLStlYeYKF0+vhfhEAf9qA84QImf5qEGA5UuqOh4dQsZaqnMYm/mRCPSgcHZvJGvpHvmQLut57lFkp0uU//nmiE3uvaieJyy1PV9/MbChHm7XFI31TVvnNB5LdbdS5qhbNa1EOnWmCFzgi6GcAWFgEh80+tla0hblLTnvUzZxF7+wpXyAUnNY372RKsjP5tP2lPi1pG4orYEaPx6g0x+KbS+ulOunp//6qwY4iOUFoqr4ZVWtRPKoUf1KM1nAmp55brmp7mtu8p7z8kolYQPEQS7qtnburs6JxLSNXXkoaGV9snoZgNcmuBdUZDRxv+uEjAW4PsqzMLG4heKtocQIwPBUOgzlvjbGbYxp0l0PAne4ONS9vU1o4OvKczMG+xEwQxpenAi5BX/uh3SHg6MM6WRPXTsj340dweaCh+PIQw3Ltq7ryAExecyJOSrfQn0Dy9SWD1n58+k8gbfEvwK2w1c5xJhhPoucX61E2OMN8xnJw+5xHLohZTgs2S1qNJWZ5rIDDtV3Hv/m06NfVllhEB2FC7K26E0E0bAOkUZhfzd0ZYgst6BrPMGh0dRTJkFCapJQGNUcf0Txb4JhtyYHQElDoWNHEVhLl7HyUxMma4oChCGnBYom10fWqfb1T0RvuNig1dtJQENuPf/9IMB5er8E4M81AsNChj4xx5W1ZlByJRKWLSLh6DH/10SuUbe08GuWVz7/cp/vYsZDmHwUfHygXrT18u8cyJAS3BQsoDAJ4eU3npc3oMoof08Nz/OiyE4PGXalsOo9loAVd/d4iu0kaY5OFQtbSme4LHY/Y12j1I+cswA+HAaik0f9Wt/Sqc+gH6QN4u/fMMErMzWdKmVtd2P0XTd82HW+DixOrNC9/PzS5yUNV1RioyGGuUMJcgnkKGor8BddiST6cFF3Ol7idCEeWHPkXn1y9Auv3S1CPo5THSF+IW1optvxCMCiOqEGeR1EXXvZqs+CeIQ5HcUcTDDL0IP8it00nTb6Dl96MatSPosEy2GVraZBbectqU0ipRSVwHqU3i4w9B5zqjkngdyczkTKENu5LgxFgReQA60AjiEGytTAVommj/1kebIGFpEbgytJkzVyyPAchIIauEAT/GGiX9yPOU3CRrVMXUXsCyYbfzT9Na6FeWrDR7qoa67UTBWPyoQbk/7+Wfy0LM8aQb3+xKsrn5ZHhM+hK6T22Hrp16X1OymzYQzP7izuI5uR5G0APqYY/Rs2+sWQTwNgOXUzM96taoRHvVxbm4UOoabEi/gFbEC7M9td37eXZWHGUCo1cT+CTh9bkDhLcu1VhD5P9OzUnqDs71VsT5ZCuAb8BZVuciNR7D4XRh+GO6byld5/zfGyahwSvBxSG/Pouptdy9Yj3r1D/zNOBjadcP03F5dd87RAfPNbKSqbQwqZis9VEPbWUaX7t8r6Hf2ewmK//PNzzfpN5b4Le+qEWzv0yZVNJuAFUWuksQnFv8Dzy3xEqz4Fu0QiiT8Udnnow6BAfK24IzPOJqSO6ujPgO4E5JXZ0N/EpHrdNTr4G10aWX6FRgnA7dc48K0PzdRf/ArulkWN2isSwUTdAaV7mlswcnN55AZIWYUUpTRO6wFooes7uUrEe0Bj7EPANRVjgnJbrh/mqMVqIjIN+7OEpGdaA8Bfn9uvZY27QgARz7ocVNfqigS6YGbY5v5WnS73ZRIWC9DOai2VRQZxpOK2X5jrQoQU6D2zvebU0l9Vih8eP9tpqf30gI5NehJuLcJXp0EzamrB1fKpzRg1EwIEDB7jv1YPHyQqnnRr27tLqJtJxFbpBymIN8fptuJljcluYEHBoGDFlmtR9m6nUDFqoDxrGTdRoVh82/oCxfu3Bn/F5DwGK6jfXc/jen8JcvEWPKLxHfyTIRROu68fju6f/e/uv24EUYfQs06bh0zNFdss7HvOOfdDL9WLNFSbiim2fBXtv6ph7vlH6z5fsvmZJeEp6ciTZ49IiWlDn7VyVyGzVRANHPYy8M0sI/iEf6FgRBhQzfBWa1OQ9MP4Xd7lZVxArxja82RUeflIPBHUXIyxw3tbsJcYDyHnd0ANhN99JP0emzMysrNpSQpZiqMVAYt0Rm1K71+ERW2rUi4M/3OplcfQLCajtMy4hvW4q3iS3hdkievnGlfqEbttL+cvgBpYYJ2fHiyGQIsFCfIjreDaL1FMq2sLJurz8qFNVcjQ+1i/h2c+Ko8+ILcLJ+WQ1SJNUpmBnRQ/ykKiu7FO4JSnx7KB++sVQ2OuA5jO37SZhQB53U2Aro9mrVGn6CVVx7Rzhom13pcIMmau2TuWRv03MYVlWTJrHJY7ilV3JcutwkjgM8v1d6Iye6ty9S57MBGxJiKQGNsTdReSHd8SY6HuHUjOYufdE4uZi18wux9TZ5CtV3kH6mw4JeV2Hz2Lm4+vXDjBb7Cufe3dICKG+J1jWrvSqpT4bDNXjzSLu4ZT6FFEyy+BlRhYzZS/aY2H5L6PFi3F5xX2CpIXVROL71i6PmfLaWXK1y6Fw1hHAv5OTk2LhURWhGJu7jfXnFYIl72sOGktRRXa5Z+Cbxwgw33ou93s1mo/6faDkTCHBOSDL21owz32r2beQ0WBzKnf8Qp8Eo0qC0VJjMk+adQhbqKaV8EdwA8B8L+YCW4D1gqoQOWZDqCR3CDulAnbctZNCVTfGfIMfSRexAdVQIgegAY15hlmyScEnWJ2vV9cwcIuKO5sxMxcd1Q6a6ap2gYWuw2EFNdvoAgb8qlrtTMp5P+d1tFk1Of/p1Wj7ES41vHzuaH4X7DqknpX1bj4p/l0116GO9uH+SryJ0ZIAFb2UwOp5nM8Gpp8A7nW1fsRBgHEuny4GcsnDMhnOYAL+/3iAffiR6oSUaX7TAffPyqj0Wobc8HfeMKn4IlhlFBJhG/LBY/iRxC1N5Zk7vEffBxjApPDvSaK8Ddag/I1gVDudlJea7UWg09fKBKJ28s/QduRvRnkoh8sv2AYlAxoGn178X/QdPswVVsywIyzU2l2K7Tnop2c0hqqVzYOl+mdj7luOGHfmAZ+ojX8ZSsdE37B7cW0Kom7vo/2YtkkeyezfiXKFmWxVU+B9dj/1RTcg3IxnNpun3lDLIN2OAP9gR9YcTP6iH9jcUiNE8Xn4fEwaMt37Q5R6l5SvST6rG/dVk2E68AeKnMIjtYYxbDtrUQs6b0gbFrs9DvRKmoKet8MUBCAFtnK0pe5GNo0fy64WwsawUBBsTcn27QbMozUb3wfHXEG0iVcdG95UYR+SpM9GcG37tBIZTfHHOEus98xsHH9LHa48iXebULIhnBRpYNu0eBLYR4Tz/ePCoDGyJoRr5MgAACztV3ZOQ0DEnb7nyBBrAvAmW9mJF0hdfty2dP0IR43YmsiS4UGIoaSeKdBnFnSrH8kt7S40uN5O8k7EwpAKFsDVA1Vau7vAKvi4DGBAz5Ty/JedBexcUreo/UZ0Hl+kbRlYnPYKnlWS4mE9K+rFz2cqnRoTS0AD+azQOUqX8p8+WtKavz41i5u7IccxhVkamkb2nZ3D279zbg0M3VMODtB/uYHY6+M0dTmcg8TpwplfLDGZ8md4EKQQ0cPXQWKoimK6zjLf9Vm9jdU4J+VIklcbZHWnRcK3rlr3iAaKvub6QMEA+PrZXHl/civpIye5sdaZURHEXPlTXyJEdKQd/vFadwdepR8+lIKWQl27LNWKfJTgpLlhNBLrsUb5Ef15bjSqJqpoXuNC6cfcvj4CIi+e/rX7amo4JSpZQKf+1W7IN+HXOIniOKF0HtYRrH9WvS/lUsUNozLVGLSQset0D56H75owuEqKdtVIohORO61j653es+sXfvaTQVh1dg1FbRPdRg7h5e2xkSIrWPpTKBWkcfWOwxZtrnuP08SSjIG67EMijsU4z0MwzhOS/J2IPrt4cI1IqAqpQPGHT7LtXzbu8F4I39J2guD/wWDl8/DQ0SVhIuKLFMR/zXca/z3BGhRRf0/87ZkVGohyCcT1WXbun37fFKd758vcjJJh2VTPIt0VlDCPg88Hb86cO5BqIHxBgqw7rM6tlfkc74kwbAA63ccuvLMTC6/G4D0lmWWXwX0HSzH1gavsz1QKdMUJFhk9Zu4jwWg/KuBYCH4i8JsttMeytzh6aH5OK45shIAP/yx4/Yb1WG3+H/DVXjXGjBtbMp7xABh+yuXOlMKXojqzLWIZ4w4DnqbPrvaXMTMNxrI1IuQfobVnlNGyWmLI0LgfKUfc9BWF1OL+srhMYOuRad3bjzx7iQ/qCKD0otXRdPlGosT5kf9vrRk4l8YC8dxmaFbwoH8lGnWV7hKDCZaLt22UvPyfPWGJqppJHSAIzBF/2okVoMfJCaoKpTcFkh51ex6s8FH6UTEnRPxcF+x+wKxKuxlhUPsX+wZYkI/mrEeZHccpA9uHTfLJEXI3SobBWncZ4q/GZKmdB3k+Xu+EBGtOnOsV8KiZYlCSwqBvceU8mbKTda06Et4JJpP+FwLkSJq+20etT4Du1tk/YwhHOZeb/bqwgrU51v6wJ6q67r9kxTIudKqSq1+ejTXZ3Vd/L/cOkOxjhVqQOxYJeb56w0C47+IZapsq+IVa/7yup8BzkhLH1menwK/y7/+TN9vr4jookSvxMbgLe/JJ4rHiqBAsvTYzxqoSvbNWXtjjOt4DVorm3vxQe9xwL+aCvrlNUdzr+CVAvB+/mDha2DPS4o2uec8FQGfuYCB2faTM995oq2d0VFGVtAwPHreZ526vdp0+PWRXbcBGeVo9kmRBooZiR6EfH017zEepoyLYZbiBZSpck3NTke95gwpbrG/c3zP8BcKSaGHVuSXxai2YxX+tRtmfplBIry1/jZMgb+fCFzmkPPjxNhLg2/QoEEhBH+KYXOxYJaE/8JEjuyEknefwmV/RR+R5kesrjxjfeWv97rw4Tz91e0bmH6Lhx3cLHHPcv0yXP66rqQREfN9cBtKalyz6pRTim+0JS90FZhKnMM8s3X6cpKXLEPDkUxq3/g7WnyJ9N84UVETcbVkNs8zTp6qsr/4oFq59/ht5H9ZANSPEWibSjL+vV5+wH3dSfrAqfCh8dx6ShSQTMlelPoqEOHzPcA2bDayjBK1PPWniAkHHHK4G5cnkki9B3GUr8Rmj7pncanulMDoXrhQj66TZ2r3nM7hJr94rSwR5p8iG0ROFZhWcsFYC4RnnVa5/qtAQkHNcvY9Eli+tCgHCpYIFyCbWNF3v+nkGLqIa1cjjHVcGFGycq34fFa1PM5fnuAaqdgCpV4/PwVoPNWUIVpJ0AdJF9Wk3++7mGcV/J4doXGSnhiYrUIYGUpoW7ZzkBpI6F7NGjteZ9668ORQU2ZQc11uvXyXRcpu2rN8h3xQ+KuT+CQv3frcFaEzQ9oxg62BoXNkiV2E+KrroBLRmFh7ILyQY17uz1f0c4yTLILt3A8fuarHKBjss+TwK2BueGy7YL1sWRJZmrMZDhvlgmoEigDeO42ETHp8Bcy0/O13ANUfBPO9GQeO60qT7u1isufutJkQsqrsmV3NTR5tkPauKA9jmpzN+RttXdCrRXS3dGXbvOUWvl2L1G42qNiewdntLPtLtI94yvjLh1nQFjt4OzApZFNSxiQPKSiY3NkkAUUrC8kMjg5Vdf+rEXo+7njqoEn+Ip8KGauTFVdU3fBLBH65tCR/dR/PXEMWZDUUgyILvQs+N89eN01rAgbmVFiT4l1biRVyH8askjro/DEHwnZOgVuR4cxJCUVtlE2sLCC9/dwgofr68wMo7SE5eztbfkQw854V5kyOuPURD1q7V5aEQjrWvJyM8fM3P+QLsMCIVud/U6HF+Xlx7JPxH4oUu6sZIl5doKCl0h1/l9ehhRTgnM3ifiT4CpvLgC63gX2YLs8KuYwLQEaahFoY0Z9FRORLbGPayNyUwsS5QJqFf0b9XsYihn8bcz0khUAgXYkUOM5XQ05/fSQ/scDc0t1n1YMDN4i4QpZBiF5TRCt6GDDvMtcEEJ2umvbahPCT1tdH7vm9F/C1EdHFNAhbnZCvfRy2K6jfK21k09QmTqnVqjcbS7UbzWozRvCq1RYX7BHQGunlkn0ZUUU63ymgfK6q9+5p5igVt0HSMXyb0ou6Ne6Piw3QcjkQzfJbD+lRVr+VSUzwjcQqHZ/KtbXqfaKpGoOVjv9R9VZLlmpdF+DT9D26gUvc3bnD3Z2nb8g639/RFVURZZkb1poyxlQJ2nAYKCrtgJ4P7iDtQfvDC1MGTnHcuu3pfppqQ3UFS9OS8XTo36Drqwae8mQyJqRVIj0QL43e71b63nP4BUEBMq2JB6T+khP4ljet+kSsf21OZIWg+mDZN1qJazzMqB1Hjd3+J12n3+Uelkxs8jhTJtB0CS7l2kLNcG4CC2jgnjBhBzMHF5L49qcHx5lsawO6n3g3ZGo/yHfeAw4V4y8v5NZ4GdzPscQL5t0hNH9/Rhb1x6YhMDr6+r+jROp2ExMSYGSaVe1bcoNAlfrbAl5k2bWaXwP49IUAGnl+abC/W8IJ0xkp6kqCsKYvgcfVIheB/QsYUUPnc8E6J+QzmkiBoPyfegkIZ53GTcfrirD5B7sCkDDBsxxYGgFrVbflcYNbpW4eZ7NKnPfj6vjtFgrYRWQ1zishDPPs3U8aTgicDfxvrcsSbxbRz+5hKdiwBmyECGT9r19eNG/kJ7AjGzIGbdwRZBJ6G3lZapproCA2SKQVvtujCHRS7LZiomGXmhUe+Lde0fyikvsHSsFNd1as+BsqU5ZnnhfHNN0YvLoqGmzMF7ph3Uqy4xA7hhEDs8DbhgP6gTWE/4UQgmihRjEKwMrpmllRFBQumpgqSd+IYu/94YtpFiXsQ8ZHiVQS5cocE5qz6PysdJBvxALPtfWRlSvjh2Jo8OBovstelziig10u8p3jnszVhpghMwC+lh9qG/EBViPgwznUYEAIAgxOFRrfiAon8pXcteSHA5ilFR33wEnrwUoE/jDCxBm1aqzF/pqYOcw4mxrkLsv1+KSXXjb8Kd0DmB/aKJejVGURVx/14Y+iNoUfCzEdy6UNqf9qjNKhk8k+fTgNH6H31E1uw6BIXi5t3TuAv7o1LKzqD4RnmWTEvtB97adTWSogQcqHu0Pd/gV1hHZ8MP7GRpIALtb8LKTi+oUblP38NxFGxKOXZWSoEtZ11y6VkdbMLOn9iyQu5xVIzDzR02Vy3Xbx/lFOXNTapEzQg+wI6Ud/9O3c6etCFA3WGlEko1PfAl1Jw/xJUlgcbwrs5ApWvmjiqp+NK7uF5T29qNJ1zsq1c//Fyz9WZNPqFwWrVp8ySs4LpJttYfmx4Lvyvb8QfFS4XJye9lfus/M+z35InonWLNlibzt2stGNfOEhNCyvnH/g4Td/qOymTGWoS0qZmRJ63bqDghPo6n5Eqxzmk8T0xRzR3faX14nqS5jPRR+J32pMLuWixfsZlH7d7EMDm8gRBGIBHmfR7a76oQgWBJr2jTZotdtLsrhpDYB+OQK4CVUmBBjcd67oQtDK/ttGWVQi7Kr+PC6x9mPlwx+1v9ALTZa/MNwM59UCeOHcJVJS85rXKpum8AZ8weDWdSeiNBA6Zf4poFg/BixPa3HEK+Xp1SF+JqRXP3dWn052Gxg1GPdtMu2sGmo0TwattINpUkBA50kYAs9Lk7/goCQIMOx+a6TGpbgCRv8qKwbV3GzPhL1dyWrwKPD6QayeRS42ekkhmG3xyeGfAMrZsrYYQwX1SG7JssnMGjyACP0WkQBzoPS/my+xdnAPc2mt1bhQoj4Svxpn/fxZzf23NNq9v6BM4Lg8fhmLyjBCGKYpOt2TOVGUxzOBhn/vpyHkbqDGMaf1ghSX9eUIyjKMnLu4pV7f/yaIgkz0j8XwDw/SR5tuCy2lodE0w/U+GEbqOi75QNXSpcXzJEfN7PtpmpClNE/SRjTyX/lvfBIeBQnJ9Rp7VEB+aqbx9uUeI6Rwr0uX7bY9rvIQB9rs44NPtH7Jixz4mfPClHV6UaLJ2E1VWUvSfKQOvA5GXrJU8sIsxCUvyV7COoSIW7mjuvDW3KSgr1io2fxKmCkSUc0qZpEAw0+vNflBIaA1iUZWdJjrgRKyxdYLKoRGzLcjhhJasOaTnzPUe6bUggGCZ98k/p9Xlte/WbywVy8HAs1jZ7/Ht21HWTUD/hrttZ/UOUQ/7jtu7F30uaA9L0vMI+6r23Kkbyn2RrudVCqfhu69qai/3xefCmZZWCrK4psIaXZKIiPatwTKFkru4EH4QmTetsrPA8iRY3AQw2F3phSJEqqurxDcrKa8Zym3pCQPQuBDJ6nY71CbkKWyzWcmYP7C1nVerKxmih6ipQrrosxELY31kv7FYZ76w1aWsR7nnEhityJxblwIcy1xQKkzjgp0E8lZuvtKtrNZH1eP/LKrXk1h/POuXzZh0q4I3doQqyi3mr7A++Bwr79bLXDrfD1pGiU4mZbT2FiCozZpBfoCH0x5zWhrq8LnyEJVyV96epMyboMcMtQXseIUbXiJlIQxgGVp2eyXiZS/9DiVx9H3cEQsiO54FQFJogrUQWXTfjLOu0qEOrMXo/Vh1zygSOQAjlfxIuUR7ppmOrW7TM2Zn1i2rFWJlBlXPNvDFviQNWB0iTpexN/kjfi7oQhJzcOj5jKZMhbDsGuZf/c6jGxQf7E6TkDMvwkLzHp6G0MMYtu2THlQ1GitzNe3v03rPMfLEwseMnFhCtSjlCFLECyvW0RzbsOl/kJAAP3Yi3b+LfIOawVrLBrO+a7QBmZ4Us7zVCKqONkY7R41uz2E5GMGFcf3bPSL0iW6DQNeOREuzkN2x7NGLFUIXmbkT5+h8+eljuRJS5nMngjdKIurvQHoT+IiOLQxNYNu+POerXrLFfMxMnDH1ldnuTO13Eyw8zaas2U6N90iv8W3HIkipE8Cc8bBPGUmjJ4OPtiFxa1SmMiclKKNySrUcCLtJ2Tg5IcToQJhuhI9t8R88TqmP6s90UPwU9X92+TAscagzfKGHhmiyQoeJIn90vGHylnVKAvsuj5z9RLMG8EF11wQfVyvZxCfQx+Ryf1rPslmDmfGlc0xVwEhGv59ITXxbyG1EH7OTMsQpH5R49DkFJKfTwWF5bNiMmvnfvCpwkfEWtUZUjDS1PEVMU9uReX8m43ucO1oPkKRK9itj04IFcw3uIKqBt9OHyBPDCZcEKfQS07XxOU8c/P5pKTAMHbDtcEjbF5Ys1pX+U1pBRTN66PcukUIr782qPd7g9G3SIxRM52bhtqauKI8EHg0Tqsx1rCp4Q8JZf8tcyx24tRP5VAf6YRP283i12sxEUqLNW1aPPfPNrvJJkQ+65PBHd+Ga+wX3YdjaxbY1lSGAP1Shd+p9xq+pBWpMc9znmI0DDAEJfOjB/i1RBQ9zvEPKncI0pjcEswkySlQ1SrSVfhHLLWBd9l+69kHLXiAPWxGvtf7BI34x9pz/xFKyvF1m+WG1Cf/zODn5EHiO1erGiv7bm1UgLyJYEEvG2btR3AXZgO0ZxPTCBScv369Xt4dXSwgQTXZFqSizt+MJxu2c9rNFyoai58yd1uAf5uLcjZgLlXpZSxdXoJeNKCYae2k2J+9d/1NEQNlqDDTO35b4HaCDT8+/2xJgIa91xSUoiCuGF20LursK7lWi1CK/JIav/N909val8h6TU3cpBR1nNXaAXeaXz5RGPgJ3I3IZUnbUEgOGT8DR1s+nNgkr78SPIl6qBp/PaP7HQ4wDPHFV0ihyUwq53eEc83Av05Li2jL6d6/BON5mb/IeBNlyANQnYMoTQWGyJ5X0P+y5Vy6J6qnvBI9ThDBK6maAymTEuQ5LUCZ06dHz7v+LN80s5aOtnLYQC5QwZHDgrL8bWtOYVXZKvbvcltp8x8ZXIY7FD064BMUFPgkrLDaEnQmogT59d0Lq7cL1zQfUjbYXDdLKQ1S6GnUrf5N3STuDEHmYm0gCc3c9h3QdsAvFNoEJo6p15bPB4P3rThcHlKqmijSrAgCY/2h4jVcyaO+NuWunOg7m8eWAux7V4yU7TkWWx/UpSoBFPirLLuOYAExQ5AkliVHjT513HCpba3QF2cgfbYqZDth9HkJIttGtmtzdWOS3uiyIDzjzoZpr004kcLI5n0ssxu4NUlodtQAIbv9Gqa4h91LbR17x0U+jfbJ+JdHLb6ODm1hWQmhGCOcvwunZ3lSajZJB+PbC05dUxVgeghGX1mhhKYgpXPKY9Vb4e3fYHRutrt9iEyAvgdQquZ9N1/XcP/QbpDRBjAstra5eZDlNhCu8UngR8eHoGCvNqyK0nCP9oLqC0iz32wUGaGZsMJTwlBewRNQDgjaQv0r4oxxV83uPfTr5s/prCnb4AP/QPe3m+bDN/dq6mtG/M3OMvBbWHvW+OpaiJ2BRbOTqjJhf59vv+Y8S4rrxfHablAwsfnyC9y4nmgCP9UhyRC/2R3imXznRFaV5gJFglhfMj/71Wz2jd0IxQ8tNc+ZLz9934bQhsslb9q/sdDJ36SfGMicB0Mj4W+a5q4GBiM8pC2QxvKrEf16KbQlJYr67dum+m4V9LjUv/AojoRrQlLKYSKpQVrb/tDzpjSC5vaQ9/O4Z+5DXmCPc/1b0CplWtb0uUb7+ktoJHcbWZbeE83mFSRmM5bubhs0CyranVQHoR4D2VaA0XCb6QCwY3zbtT2drHuFF1xa0BNCOsTmyBcdb39bNOC/BYpTeVrTZDtSwn9jQBC24cr2v47Pr1Hg+qvpbvjRcouGMjn/gESmHYYzUcPZJ1NDGORC77xT8i9aksttIjcJDGqURV5L3V7XSwJyOMVyyXOXk0Yfrk5u1wA/dMcFD9ZVXuLXCfbFSb91jxQi2XBySoMIXNnqxywKKs2lljRrGYIZYWbSeEeBAPim00PLCNYodj/ZMX7u7AsPMR1L3cSfVx0RTc2sXYmdRpROr2sQdGDaZA4yX9krN6Uu3CyvzoUeqy307IVYY/GAtVri6zbV5V//kvY3SXjaPMBWI+AsWVryFNmXm3CoonhYPFag0s/6F8PLPszILD3fqNUvpETaKe3pasWnwPp8ORdet6RxelKB3vTv63429wmtr9deWQSoDkB+AkasILUu6lUejVbnXfi0/jhdsAqyr/+yIkImAjirDFeICcu9R54cv3M8WdM/L51f0DTHwTBLheemf9a0BFK+n/pIAx4f8VAtlpIj7ZDF9aX914vE/27Z+/pBNXvcy6thfdYsLfm1KNGsarbgV3EylWXe/Hzgnz1HCQX4q6RJbcy9nQzK2zaur1rUTWAjq4vkfknqcWBmEjuU2OprJvq161OpxO8KuTQV6km1wTbfHE5QAqr0q7cjJ+0lILYUeuyruatPzpYwhUuIO78ldZToPq/ao87a9MKF5GgL2YRPVRmyMpEE84FQIan33xoZYloF9HywtSvH/CoTKYi21Cx0BjJl7XVT/FN/9fys78eXQ7MUdN4gxvFA/zrZ/v/9WVF8li/9UJLEMS8NyeOVpbkczJLQE67sRX8FBebN+i1aRZjZko4WL+Lqq3n46thTktB6r4u+micn2KVIVxGDmrKlqybUdwdSNAp88I3sWuwqXs4K7133LqGyz2hndE6+QMaV6uMVEn3ST8y4tSd+LajEJ1RkSrh77rXvPrbByatySI/3aF/FidunIyzXcqUOBzecb3rstYBqhFHDbpSkJecQckK85Hglz0DoU5WN/G9q3X8zufK/E6jQFziqiHnStpzu/W+TFBTU6rCWieMFYAhsUYCnOARdhAmLfPWmx67T3xDq/iebLhIo0zIdrw+csumXSmbVsTXHn78kbD3B8iTdKX/tKyW1K7PnfCr1sUXUNFznSD63xWF254Tyq3IR2yscxS8ltJwyOWPN9C1JpiTwqN1kXs+2sI1rR7MfIRN470t0l352JHcpvFcdNM4EYLaDLgpzRrkAXWiUqNCHR99pysuhvhKa6nk8MHKvXEHYP6VsVihW45VToEWn3c3y/68a2uQbhCw90RCczcZtiirNRnNr7y8a0i4Ekeq2XKf+lPSobtZu3vhEhEjuYP/SOGp+xhnSVMvZRPwzPcPnMKnREyy19KPL9Jd77ndZA633l9UwlJHAVstbF0yC5owCTNF4pbytBpd/6WKlx6GZ8m7nKJAbBM1WvX7oLGISNVaJ+aBJlZZO/1rmDlTrjqWclxjjxhTYNXBxgdMwuMHvZn9bJ+hz1kWeh+GHaNwftGxgwofd0iWPON33ZE/2Z1Rs7okY475FB8XYzm8E09b+MnXMKxE9qVi4No7l/oKPX4xmDwJ5uS6djPY4MfmrCDosP0ky5y9a9P+v8mbXv+z392WnXZOsKp2SWdgcu4c5UfAFSbQcfEGmXJoapjjkVo9eN+CFQy+rw3wjLCn9BdQ7cfHBt0AmUCSBFU9r8aFlQHRwSj8v3XXqiat/I6gfC1q8fwm59082r0plcr5yE+ZtX9UDe14r5M16WXkb0kJ4E1Oq2unQ7H2BLFl9rbN4l8E3t4GTFK/RpxUE7sOGuGSEUFFl2EP5UuUk47kgJse/D2xsfvrhCupSE15UqGPaXWLVD4VStn2bXT/HIu9a2jzx6m2IY0bDCuvbtv2HOszpziNtc/0UC5ZrOQfRMOvqAxcfvj2hDBhsL9oZIb6m8ARuu20kQv3oi1YfZPAh/+Ob0H19wSrW9pdpnCq/iZGq5JVAE6mLwSXNMPp2VexOAkxoM+nkEYHep4FiK9WA/BP9vx71v5kpV94L3KaNFqK6w4yhLpi91yGqwSiASq/+eD7Zu2IvE+aL/v1t0nL0cWwwc/zKEMhN6UenKAoxTZ3hGPYE0XWqXphjDZhNnHszxum1DsTJ0RNAwMGZ0TkY9n6oeCzej9DLWfmdTRhRbdmkgu9Na8Sd2cLZJxbhUDyFLQxysMnPHSO1aCF76Sh60Jfp9JAkcj/TUFQjXRUa2znj3GpptABQU9eNUKXT2LfQoJ0fOopJhw+Y1VXpuGD2kq/oQtzjrKz3VCuf961dQMfzInLkux5X4OfnKFLc6jd/jE2VIyNUkomh7+ZBzm1S/+wOyiHHnzlsfPnNX6V+0wx/EvJ1qVMwa8CYK4QaqTO85SXbPhzy3yblu8kIW0sXOkT15W5Mqx+xadc4b1RXWr+dkcHmwb2ZX94pS/DjBvAHMXCWFQBir5YiNu8Hh45NfWK7A5gxL9GhB6D/Nza2Og392Jze/Qagc0QWvN66mAfVx/937/HfvS9W3gfsLoZsGZP+pMy8tdTkMgpqLUA+42ARFsQKJXhb6UF1BEWty24KjQUoNN/bRym+N22OXjvwNaudiJCnQZ54xhxE+I5uz/2vxOVD2SjgeUlQmMdLuWZJZuOZAPKfy/eCTS7Zii4cUwFIXnUHpFck8EXHxW/Ni8uOD4jjIEGw17aix8RCS+9k+rNGWkXV3M/SSGvtdlmeNAdi7Lp22h2IIrmeOBacJG1wTKmpWbmFqCLiV5uystIm3kfpT14MhSB9DXW9XszmV+dxm272kYJrWJITzBnGKYshxsS6zNpaTfYmA0gAuL+oAlmjsC58J9CLGACKRlzyy6Yv8zyOPFmWMk8Er/Liw/R6378ZOgIzAlPkJqeAQIWlzgXxZeB+GId2tRCNsBO8Hk+KdydQFVBvH2E5zLpcTQvYFXXraNsjpGqxzdZ1OQNE/4qIjOfSCPgh5scaXoQk8yqlNI36fDkjUMglrj6Nnv+LABQBpk0AdOxdF45Gu/Qp8EuwMAB/32NMfAE8LK3+1ygkNcw34UpNcs1yn98oki36TYnm1ICZdO5/mwDiwWAWnDcRKq/jsNeaOIU+jvcCgd+ADVCDHH7Fq530b6wy4HHSCWFOBCkBDHmc5XwjOq3s1MI0wWuyFkrQ/8OO1GtiPOYkDkzqBo++hAb/OQ6feF53BDh1EfiqP9P0t7OiHqrxtWVpEVrNOFpsHvT2FM+Bxu51RNHU71UuyXWSWCkc0+5+7DaocWxPUNRsjiCiEsgl8SNOaW1/ARSNNUfWaXw6THJRpxrvi5QibOte3yvnFQATaXkv1HcGTCER3Sli89/OvLRcKkdrph9BlZ2kWk4+jPFhcFRNUDXfsxgvkD0EoNXqYiBjAmUMpcVn2HOedda5eSHEV+Ngww7pf/nCeauMkHV6vLqHCI3G54ae2DCZAN1f2Ga9d+UCvsYN6hxsxp8Lm4iulK8NZJwFlhR6QQbt49neV9+W5Tg++0MzZTRMx55umoOKgmcHYnlMC0KWuqjaARNla18x5PMs6/eGX2HGXpOBtUU7jztXC484vkJo9tIjmJvM/TYobjr/6+ZXz78MYf9FVlgE3ulWe0F8l/irKL/U3hIPEujPDLrQ+KEpSr0lwSPr+/X3dinOppXj6Lp43cWliXD5+ha4g/a04FTAKEnKbkSn0LFEYfjljZgJ97+OkTtfAi0jQBCDNTDLdP0T5+JTTEfQycJ9eqNLM8FF1BrLlEzLISbzTuylXoulEmaNd/x0O7LG4utPFLHddVrQppqXLqG8kNaU3bcnJJltUNou0+4B7kOcRYeb5YorzJRPhwH4yXOLU90oB+IELhizej6UZOVMxrPVSxZPxLT/acwhcv0jVRRBXA+D85pOWmnhyJBKv0cOvTxnw34CmeICUN4v3BrTTJa5OIxTO3s/0neQxXMq7SLxEOXtzfbdSEom95Kmqy1bS61OdNt+kuk1UqXYu/ERsToNi67J0meLS8ORya98wh0DdIl1RDK/9DV++NMAfgmcaTGhrnf/6ta/ak59w/Re41D48SUQn81Ufb7oIDxYvPWyyq4qVrClbQqlSJlVA9m/ppYCF8kArOdiJCzrfcJp0zAHyiuoorMUXigLjdrle51VC0x1jS9uyJYi7tHXNAZ69vMjsbiST+wouJg8q0q/yLqq6nBtydZ/BJeUmL/JuKxKj1DFigyFUFrJEUnbbxtca5Sq/ILhWVmGg+AstwX1BFeFFrcm7F5yfSK5+82adw4P+Wvx+NivtznuiG5/Y47/n3/11rnXTXFeLovZMqOpa8XVwA3aSku+cL1Yd7tos71EL537lWrBv9RUpvURLbVv6SuL29aaHbvseq70W4u+2tFTBwmVmGaNLh0Yahv3qUTqgYosXfGlLtArxpjaFq4SLV3/oCaTl9svYxpRKaMwqvg5VJQg3aJU4I8XSp8nGkAi/PtmNVhWb16KtKRAeVbvp0Xu8Le1bTxK0/3uM+17xQa6Xpn60Vd5mK9cwHHMl4dj/Fm7JSFq1C+g4LrVSjSNpDnce879SDnVgpK/5UWBTTKPXcxqnlYzlBZ9a1GaxIx+GR90RR2RCwc3j12sHX+RnaTIlC7DUmp4hu1KjaP9sQtbcXS3VIfV4rSWVgXftJrd/BoUP8EEhtuzXOjzwXKqFfBRTkNcxkzp1GPgxohIwJskOcKXOfJeGhfT1MdU951GeVMRor5kuYOwyjgWLcHSGztc7CmwhB0JK81JYfks6WUJoe0XuZ5kTa8oZPQxM/4iaV6of8aSixHri6etcyz8U9qkyPN1m5ef3kNky/4PRVEu9aFnhVRePd1NE2EKZmXSsG2DL1oQ/mIOpisseBK6ywsO5xASIrYPGBbGCUiYbgFoOpn/ZM23g3R/hdpq8w9TFwJA1T/N+erruU8ZyukAGIiLL36nQjsBPYKdksRrfOjXpsPhQH3Du0m61+hKrekevbIHz3k9tg4SupTdOgObhCLGiRlAcQsIaswT4uAgZ0kEx+cgGEdbUbHhGr7QRw+Fe4LCu+RPZGW04FqTN8nSrM2TW6NqvyqSm/u9dHvwDN2sij99cTWjRSy3WuaM/iDAAPlnNS2zv80XcmsIDGuWJ5jqlpLTvf6y4UelGOahXxGD9+g6g22y/WoxcqnplRNBMxJt8yLeLut7+PYgxzR+TWul82yZ/iY6H32LxGkEUnsnip1e/DX6oRW2OWHvBKiLA8qInjrdBXWQkoxQIcKImKUph3M19aq95V9Bw5g5mlPsMmevuiONwM/qQ3ZD24xojgTatiGQ7ynrLkw1pVfaT8oZWxuDfkzvn73VAD+b4sJeTIz9tdIyCnXt7wKpFyOPnZe2kIg2ZMaFi7AmTc/Ntqm0gub9bTSV4MUrt902STqAzpr2j+00PNOcg9kEDf9Uto32Vzvgn08ooZCavW6r5nFd/79obkX9RXNb/rS8tGkAqossVwAW9+uWcf+i2zdChLMLyk4eRF/6NrezIYI8UGdUvPrcNIMoxV1b5i7dWbAbwTbeaAgnYkVkUT/1fylYa48HnHQQSYnOhOeQFxSlS5508wsL0spEv0JcddTp1UNmaZz1SpvmRrwzU0Yqu3N+LBlICrOKXTsr/EWe9erQ0H0SosN19llXv4c0Yk/bGjaJu9BNDKBlYEAtjiu2EJk3aJoCelnO3Mrr1A7cNG9ie64i6ZXVVtf9aXfdY2gH/XLoG0z4l7EM3ctqI4xuXxPVpb7SKB532Y4YcFYWiWOQisHaNJ+GP19q4lcLiJuxu0AWVs5xppQX9PzXoSHPLvbyUcCCpbL6KbrI5wzhmpDa8xH/Aevb+6fCFiHH2tXt6C83f9/WUi61IA/IArvU0ahbX6OHkvmFJdBfbO0j9Gk/aC54QhTgmIJip0lbP+08uxT3nGWwDREjZedNtvm3r5oT9MGJgHW3Dep5cQq6G/1UhbNir81fN3gwvbCFTkpzzr+KkvfJLxPlzjs1iXgpIsOngCmnCCqpcSr4+FtE5N8k5/hE3SA3/2E4k6bO0BJGvN7Q0EzrvEpFhkxpJwW1F83hdOUjbn9soOBf6vUQlQ849430uob9FWSziCh4LM0FQZrQTVkHo36vT/3HV5ATFNUG1ctgKYsLeOGB6N8H+EI3+TN6Q2OcNyJPcu5wUklPdocAm/bYGfvccaOOMvnw9oEJgkIzpvy94RVJ4ebiuRzDnPrt4aDSY/GgVeNhpOLhj7j7lJfUkPMibhrEuKvGT5izyLmmgDr6rdUhkHkln9qln6ghay8wQkzai63fb6xwz7NxmNVgGAftDkacHCeaK5nzKpFvde+r6sJoGhF5WMXxCkS5vAsjgs/9hbXoxod3KfrKAykU0dZsrELo1EgkI6b0y1zoYFRa0q8bBCXlqUrvDm/a/xbxwAA2VDecTKAiAl8ccgzA7G+z96O/TvhSvpWClLTdlNgeGVOnUIJkfwtH5i6AZ+6VktFvWv0rcJzP1BBmaRjgXb/bRWH23cYT/SV9n1/Te5NhSUD6Z0946pQrcjTWj7b/yrCtatbkmZFlK8P+aYdxmOWW+NkHDKtKVsPGj7AwVPCLE6EsvfaVmepscAN4wTBjXYy/vM1HlX0w8RKc/mJcf7t7Auw/gDWdiSAisqBmk5RhCIfyDltJGydfRuVYk1wlG4vRBZmFd1ecNya9QFkplwjkSIoNyPSUERfbNPYrTz9T635Jggpz1xDWUl/4lNgLXNXSwe4Hpbt2NjTWLs9H1riKdkcKr4Ei6oav/iZRl9zdd4g006ePC91yv/Br39mU1/5G1tsHVxe5QFMBlB4B8+rlwWHO/NJCQwyokH6/K1HMzUxFnPdhIfkFZshSbXOyWs/n47iBCCMAs02EF39Pv4eH1e3U5QCT8SC02nTfBZ6LJjd74RUr6kpKo/M8+LD6/6bKiXRZaAJCf1gp1oui9Ktv0XXF+jS4Yd2jYL1p/kW7+5/nHhw0XrJtY/6tnzMiU/Q2xqqgKdgPESbZoVH6s0N1zaubFcZD8ppgWTK/5XkS7dGZVaOdvOqhr0KdPV63T65yZTa5xsmCQ+p6uXX7YvamIpERFZ7GfK5+Z29YsJIMtyeXuyEIGZEcnnDHgTRewtahxF7yJRzIZfBhE8uRDIqHhTfk3VWiZCL+wdmSFQ+RQlAdxPvKhwhNvMcNCpU2QihxolIYKj2/waKsP5Q+qbAI8xQO6cmlrlRhfEqYvH6ml7lo/hoh48Q6lH3BhKZd+w9YnE2BSbC7qY/UGz/1cDbmYcv/zUxVKNU0oKXGMV1bgP4qDQJx2l8HbxgqLBgE8RlWbfTfbD8H/yDIQTUII+NfxQ9OMMTxMoKZs7AzpespWrmXWmsi7b3XXFnjVLknwQWRUOtDewmpdbHvM1nIWhsQYjpXRSUQqFSoj0uhKAnml3cMDAFQDa1kiSfcRFcvsc28eh4wrUSqyK8ry3FieZFwMOp+dDRvlurO6VHPczpFTFwUpDPZMRza0t0bk400LRkuUXX0ozewLpGqBahL2PGVJYfpbFXxyL/AxtaL0Dvaeq57qPttIvkKRWOzeevn6pa8vOkRbsmboZ+D6EcDU0ESlYIyjcH/JVZefIy/f6C14EToKebMWuVLJ4wcrQYJehH/pjZtS1jeqlhIwV+B8vtrAWOcMMCQyNqcIHzZ9zMyRzESRQBBd3z8xy1b6s4qp5FdHzslB5JHuLeVPf6o3oo4NfNWKmEJbs+cxo361snB41nRKffwihYABVv27CcYKj08/VMuYDcg6s/Yq6K3I5cgzwLmF6Z7Kg/Jrte6c1PbohVzrcMSRu5+pXIcg235fj+318mgLc9fnD5ZNiOt33RWvwFGMCbtiBsGhMXyJ6iW+sg6yI2YlS2zbG73rrYhYdrjvbtjvm/qUdRCnIOQ2xo2apHQOUn+4x9Pccy9b2n4pA1I1nE2U3UvfZRJXIq1XX6B4OcamtLOn7s290OUFCDt7hP1eedMHJcHtyIJvWWTRBQaVrRCYO+LxtoRGMNooCOPCXKxnXviA/JA9L/cMSkyNE6XHflZipowd5Vkt35+f0Cmdw3nnr+stv6r3ONVLRqRAxSnYvlZ2wz+IONLUxtj8lda/Wg1G/8wjfqyX/fjgUR2f6HGldBpBn6/8HPP82HSdYp8U5Wr+3XRXzgMmFKNv+zY2+2220a2reX6jsPBFGbXkfAxJaNqUqXAr9GptG554i1bo1PWcSKx6swbScQUnk1pqrUwASS/4ryOVcEFPJaHIe2snOpnkTYUS4HkK83IIh7ZC1fONTgkGiMmlJ5TSTXUXX6wPPqLMhWXbwuEPGhBa12nGc1MGYnZaU5w5bMtUpZeQKyAIXoiC6KwwUffYNTYbOwk6Hsay7KGg6qco1XZMM3pvXryy3VFtBVwHdl5e/7wXDtfsxVHSEs/OCt+BRWIQTqS6O733Uy7jxVmyauopb0W59Zhwfabc8fQn//YhHyMLHBACkc37iTbhQUagJPSQjfNIa8Pr7qqWUNuLUJ+tEf4epw0xC/5oC5eMrUqnBM6TwV97RzU34gu9fsd1fD6ePeUmnWb68nJjqcOg/441+1GubpsBE2202KQXUFywbiIXvTYNhy3zigYkjy7LbG0ROsxlQe2ikZC2dt4/b8FL69LYs1Kn+uDv2qA1LhSg/oF/HDxMM8LEvfI/ZO28WWkL033a7CKngRslRrM9snuHRSHNBXKp8h/acrLG/7KWuFhwIxCBrQmbRgVKcYN/uID8PUZaEv34cxmmAcbX2fyRWzxoF+/uv7mj7BL02eUqjuBASjFH5rDlFX5CUGk504eU54hjnbYeJSIx9RaUs0OzF+JX3yZsG+I58JwzzCWYddYQg62G9p5ftdl9B3mfpplw7UrBKh3Rh3OsAuwztRhQdfF0xjXbAuCpLiY2iiHmeaSC+sa+jRtZvP4Y3d5HM+OaPRC50KGYEeuS9AsY8X629/3MYOgKtjJwJMNUNHVmA1GjTmGzTgaiMK/5O3cEJ56dw4O6msQhy0sRFKrZpz8xDK5eEC/kLKJlku2PboZ1qTw67NYMNOS01WsNK8Wau/vwPw8iy510hRnRYtlXxJb5HBd4AKVTHVIeKqzFWe5/oEKvOgWVdojcayMa1NedpKtzTwbBeZHsACBcuvQwkEYsd8Z0V8n/aUWDz8xeMaUkOyhx+WsEIPqT0l6iQ5oRJvegulWbYrY0QkKBpyO2SXhxO+j/aYW5ue/JsJCjQJJ91rEgZa/alyooXv0gzqkfaJKyOSsaXnqv57+b5qq+q8e8BxpBWtDnzQ/8kxtL19sSLOiWsPjCX4b9kWDMeyZJ02vHyh3ToIlMFj9MK1dttx91h7UrnhwkMoC+tfI1t44Tf3cD/IrACXGsAYGuzSDJ/FLahgIKwYA646j1zC+a2bB+vYg8dfvv4nPGa5EH5Akfj/d+msFTJ1+ST69bZkehyGWi8mkdR+knxqQL7y/1QO/f4D79bCRlUZw0Bfey9Syv/a0O5587AXBHzrlcVc+GSasrtGWXvK/JrRGl6uelrnNqmin0rIlkbXt0BHCSHhP8dbZHCLVCiqp2wglBgctJ/y9FlH2c3Mig/9aGJIEw/Z5y+LBU47vg75fOTy/N54fGHx4DkzA2AEXS5Gk8yneHOsmw1btesrdLmn2K2z/LZkitU5G1sWdEkzw5rg8kZw3vrj+ueodFl7CVzZPs3dsdQ+wSsCLPa71lYhbZDfzFnRz4rzNTKBG10i5FJF6I9TpXlqJ3ukwqmkYAOiYGtXPjUUvwE29FVoKY5rBE3i2g13hUAsDG5OXpENYwBzckyxksQ/Ttb4mSrzG06agdAPjBsS+GMDn6MmBNvbUbNl2//aULoJlpXkHDszkuybTx5p45cGgfrXlKL0iyYHiNMdp27mFoa1+YNLDD70gnAEHc8FsuexCUx0kFua0xoEBVcBvxc6NiisGGDUAgF8P90L/PoV0vrjqE/Fk26Gl5b4Us7q5qBPrWXoUGURk4Xb4wdT/tRAg9nq3X6pYAIDPBwsOkqHo8EVO9nHctcEFxxi9VN0cv3dLnF8QIH3qydGEfq78eTW+0SFmyqvP+MRwpdoV+0IHjjIpKlxe8z568+oBWG/YLPub+PtHGzCc518QQIHATgJNAO0XTT2vcePFDrrhnVeFdrv7PtXqRgnWwdjsX2FBizIsbGIWFdmSHps8MZLMKfDUleIVFrEre9mBmeCY/HeXuOn8Ux/Ix+Y7TgW/+vqiKXA/FJ+Y/L/AbuIo28tBQXCakAISP7uju79boIUY2pZZyYe/SELX1ofC/MJYBw6if8ltF3DksDXS3ejBqxSsQ6CJekUEOsAN5yFQCp/Odx7+ZYaaImxK0zSQaDnuGv0t+Fza1VA4IENfDHvTpEK9FqqxbGL4IxOkGvOc0vsjXLZ2OuiKDvBpMnIq0eD8i31Y9GEB5ePPXAahAOG9+NITtba8bp5nZXe7AkkMk/G6cjrzs88x9fzWZHPJMZpbHYJUVa57UT614C/iUvWEXoav4g5SHgRzqn5da0AFvO3o/MHAZ2jnNsO//puRlsbaIRoa5XyBhm8XqgpuII4jcHyNQCJTyPGHK3rsVNYPPugpoJEwZf3qaR4gwkgQeHge56+HoUQyevDgDIOzVT/5mhgICNOayvcW4efLfXZvCMSx1Ey0BYILqlB4oFawSeiD+eaLnBXrK6ISxbUIRnRUyXck7Uh33wNsWuJ7Oxyu/hcj+Tg1PBOvQwBVEoKtQjzdBXzg0iugrX9Nkj3cL0d5f5YruYo1zcZVQnUxNggIR4oso3Q19FEjpFf7UhAyxYe2jVUUDCUjnIDwXlRfFZR1YFK+EMTjaZkX61Rdr4d481UZjgaMEbUmJHI4dziiLThc4rnJVvWJfwZ/6XKF/7fzjHoGwhCPAmgFF4N3uAW6F9kQCd9D4lFNLvOl6hT2oSD9IM7I36Cw5rv8d1+155bEFSJuLaZjbvy84hCIL17k7cAQP0N9SKW4FofNcyGYgDWkDkLlm8DRqkTkPsqVTl91TKO1H/4BTsURrfNBdHoo1cCwijlflqQaAGLSbRs1tEGOs0thf/59mOuS7GZ/obOT/OtSfL8DBoSfAs2tzb+I1gRgUVy54qtHBwFpdT3zYXWuP9Wuc8tNHb+5SWdp17+UrwCZZNi/91ypljZ7x02oebXb295eXT0oQ7mXlL+Re+iOygzzpP9EOPguO42qkEUpuP0MgYzMrRdCKmB4m7hobIB6Khn4giL8JeoUeAiW6CvjoMhqH6VuCX+lZlsupDmJ1T8va5rtvPBHpXjM7AUZM29Uvzj+jLSzFHn+xdZxzcyev7p2RjleJxtYX+oQEHOI7UX9CBoRCDtceUz/QtItIFDRA39oU4/z/c1q/czUxhngz3zmYn0t6o18UgDlh/c1WYUviZbpkqbPlOLCziBCBTyRyI/pU3St8AXY4BK+/5nnvjBBA2ogIvTOqDhPrIEzkVi/zV/Kc/M92ZAIzCxCyibzwtSHB1Gpr/L32wsBSHuAgfvVKRgyZRRMHFmREZsB9ZusHiH6x9H071GPyPmMpx5whgGY7eLYROHFL5ADW3tsaMUi6l8/2J9QKy4bFFlfrlPExvxU+tMSV5y4gFxnOUO9cFI7+H31XxHJ9icAPJPOfzMq0JoG7h1Sl7Y1BdyMSBOZ95InXz2XNQpPNa30bMrQ2IhVeGdlysqcCN186JoBTL2r4y+mz7FQCdP0DSrunalSRMNyFcjAZnXEwBpMVXKr8Pk7Duc2SrHxoOzVWmGD8eWLrs24J0d4obZ5dbf5p8x4ENORIbHEYtiJ6vVUTkI1PzL4mbwF1lhEQdLjMI7BRnqchMBuelJH4fdxo+vHg8eb/bOa29BW3XM+w/3Sia4mb+6kDIdzXmjPSBZncC628OSW0txK4fZgKykGcje2ZCXD3Aww9/PY4gG4YfLNjldRmFl/5Mn8l/KoIAIjXnPVI9OHX+kkwVeDaAMP2G52F6lKlLBCOF7kpasTCBeG7AzwU8/gH8Zc6VZHQboEGlnxWPpXxYVxfb4MxzEYeI0/j4Gok4SLd5xK5SosA0/7fnDf2xnI38TO/0Y84dJdSzROfkVF3HPjABLC0ld/xLnc+eJtVyjTNigHMohQc6YHI+/qk0rKps5vUrb6r7yTpgG1V2jQJLfjwRgN+B2lxNJ9BnbQ1TTRDrWM53muW+a7KSCbsHRbaBsLjnFD/00j/2pqCrfL7zLRkFOGgQ6Kq5zHwTvQNFMPMFzXHDyYrWH4J9Pl0f7U5j2opXBFeWTip0TEX890n2Hk/Jletr4YyUl8HBdSbC08d6qqcK1krKV3x437KxEl022CCE1aqouhM0oVueQvx6ieAjDaqxtjDgWLJymnr3OdUSEgpUoMJCxNBq6058EOEoeXu16VkDic0dgdW7V6SWtg4w/az5TR+0qM+ME/40G1SGWVnTthpfqaKH6ltDFII9p68ckwm1PNoJ7czBPZywvlFD0iIGdXc8ZTYibLxqOHdCrr+zJsCJVdNuS1++wL00qZq6U1/24MLVKZszPjrAm8pHQCJHvu3JZXB9jEau6V7IAwvpiS0DVEr8H0ICbYe0/rxVHpQfNVrN7tw8rUCrF/YZ+n3UDig1uiZLpKFPcWkysLTtOoWNRw4Z1+5gdazWw8yxwhz4ffENpTCzOp93nEPIb014E5VVn1jvVlR07FQvhRN6AzNM1IZ+VBi0i+iKLGpk4N2xGFA+TxXy/FJVQ7qbY0bQc4LpsiOcpflFJUmJC1qqitIbhWO4IKaVGU3ufLdz/4bDz7o8CWyj4T+4cz3InBdzZuGM75ORModg48f8vCJi9TXS/GLs5zXkshVhruDFdZAveNot1JyB5JfX1Q4Hl/Zo+DR61+qe2t5ZYCEUfhyN/cN85cvjweolkglWuSJHXqIqpicOljjv6uPonHXz+LnoRqLlVJluuBOp5I9vMoXCRPZtk1xpXLnUbS3Jb7W5xnZgZ9JMyP8ewcv9phBhLNlraEQdLpSCllWnJf0+szEded4K1/Q9xelMBoCkFgOhi7U5djamIb5fgwSjNSfNcqgFICDNeK7Ngt5ngJAqFqmnc2DA8UQKfKC4coYkDZvVTSi2BKY61LargwT274UAieV/YaNR2ItqSMVXcoFjS9MMLIuaUWUD5LXWxtSuDVDkqne+omZOEmYiM3HxLfXKbdUq0HzYG9F7UwGYFFK5jt0MPloK+B7rvu+8U4TzziMxgUqZvLyqUiSdLZIFWsFkzSAcDBVFifg4MC/RfMT/NZ94vshTH9p7LmT3/h769p+HGeL8qFb9JqwfXon2j76o7VR1D9EPngQMF4IEE0L5/uGrbqh6kq+8aBkghC19u83SKdeLihw9Cc528YOsCRLkey0odbKNEyny9qAamHmIoqeX3rEah/PykJPBVvj5kWz2cXr1GtPEdjT+yzhTLfCEDyh0OOs2Bwz/fT+M2si+hyAN33PQ4jbqzAggxvz3lB/sp2JjTXBQfkv9fDag42RWQoMHDKTJAYxzJ4RUFir1DkVMkfti8KMU/MzAWc53sb70xsNWmIVIVq3i/zfJdOT4HWl4P9jk8lwGNoym6ajynezWwLxQnvpOnX42KbLgbe++3Zb1KTvsB26sryNsVVnaQLXgCfcV9iR5uFOHnkbJ82ikQeiMqj5lGXOqCGWaHKTufXT0dg3Q2KroS+/gJKBmQ6VM1HzhsFjy9NWIVrqb8EI25sLYg1Y/xrvsmWMFkc+i3wF+Yk6Dn0QS1AsjJMW66t1+/WR0EIjw/HtUqX74YAninzTSulg/V+HJxwjNPc1YkSHrR8RetEnb0/CvQ19XXOQwWtcoebKJytY4famczIB/98ofdFFX/JQWBDEB/TYJm5pJMwKbj4KWNkZTniA3KWl+AcQ+S59V+5EY6fz3OCC8eiMC4LT+nQWpMTuFjJkiNplzN84SCg+3ZyfR6VK+fyZdzROKebtLs2aTJtag2wyYUNM1d7onxClaJy/djwluTODiJS/lJkTnNKnHnpggPxEHYGxokMu1xb+kh/n+B+bhQ4jAOoNsOCAA2xT4mr+33q1CqisPv/re09mqRVlrTBX9PLMUsSErFEJlrrHVprza8fIt9z7j23u+2bmcWU1aKKopIg3MP9ce3zt7k8gmvPIRNKcpueoIS2pon8PtaJXJw+6XhoiNB0aPtMqY2xsdjPEfKzwR1vEYpO5POKXZTIhvtOABBxZ/sXLzd9YChW+vS+P0rhkx6ifC9KviRez5CapEtF/N0XFLX3WIgBy10GVy5Vo12vw1mc16mf9n0oZaV8dfbF4p+KrLCPzTUKMz52tN66sQLLUbjp+nS8k7ZORjWxBoLrWTraxAS8fqPjHOqSmCoFxhkzjEaRv6JRk4J5JF49ujQwDGGxoPRfTMcO+Zv99dUElTacCN2vuBrq7dklDAS3ULIVZPtDDcNMyNtGyYpYix0wGJpJj7OY/GRZqkF28a7PGA+9b7Cejy2gyJalPSgaxtS+hp8vP8lPP68xWO3mKkrtfs2PsEMKHjB6olRQ+qenCuU96o8nBM6i/u2Zqf94ZhT3BXf6l2WtZpVRJYrjwVy24eclDKzYjpcHO/jiqPVj+EFbfq6b1pLfCD6o6LtnWnMpKI6vtzxVq+Y8S/ig4WELKWPy0uCRMlK8LSKYQbTN4Wv4EpzIJqf/Ga+wHXXPwdzFNSGE4JyNl0moktvRol6Ortbu5SFsgGw6lTT84Fab8/7OA3DgH6xVv5xg6D7+/sYy4NiNAZFQayI+mbV/KyP3dQEwOoC/gA5L50MflpsKgmbpB4yx7rMGcnrxjwmH5DNf2o8hdHqVX7TpqszHp3A90bwcsebr+/C3TZyV+V7fPodUfZXqhAaHLZYQ0puI32915b1SQWtSNfAdU1YgsQW+ZWsF+RinlhzUjeIRrm3fCgLGsEgEvCk4gTL306FtLjUsIwO85PfpI7XwSYkC2+MOyf7IgLrd9Azkl0jxioKUwSh9wP0dAsBtgSZuVK+07oNCH3ik774wA+e8xhncycP7smTY+sYAlK4Evs4G+llxthXCQ1kWUY0vxYSq+hAyHi2TRmKKJ0lIf4dRz4JomHRRHuvZ5wV8SAbGNgVWwS38GvjOtHZZExrMIizvSyrpR4beV6hgOt1YrN+EyevD1ubRiFbWrjG2afGMjWFhuy08bflHSxtFoL7YXbinJehz5YXz5rJfR+g0C6DaeQALYOW8Wum5ofYdot/3mmFqKjFvS5MAzJ71EPM4+eUMhkz4wSac1ZIWH7nnltGTTWZA5CuhY/nTKsZC1s9Kln7XkaPAR3cbPRgLRg7DW2rM3q9msKsegLtLmPiJHJXxmO8pMMi0aAQ6S+uqoh+xVTVU0j2wvdqqvAZh1wQ+1SGIkr6Yl+pUQ85Fma6Zco2CsREwp4l9mlwWTg6K9QJxhLkPNGQUkqtTsNLn7kmdHlVultuhbpkGHYBpT/pRiaGnGlY6UJYmZE078RTh8BLGrCQxfdJfSw5JXfv98KSJwRcNpg5ThyORoyNRE32A9Sjz9WH+WFqvximKVsf8wAhjQXHzXyMwiENRS7npzuIhClnKOHHnRS6xxSXd4eLjYiEVQaFPpwC5QwLwTuU1b96wqZIkKS2paLKcI9Ads/IYoT0HtJSGFz9u1q8j5i8QUZZWyl2fOlnb4GO9y2GxU8Ci5B/hhIg+yCvGd9p9hyL/hjEbxqAWvbEg+JajoNEYR0QVDAVq7DVj0jarn84FmEPHQVuF953d6cwZvemCR8bWSkZyU8RrMNHNXHr3i3eq61ZaDvtfpr1hzd3v1iMTu6PnASK8S1XLj8sf5Eg8+wdCOPwWp2vefhgXCaJWag/Rw83B0Xu6c+lQr6rYijMmpTBeKB574bIyt7jMmUWNm15Gi8zffxrPHI2SEO9bcly0H4iyWdZvoEeDaJwvoUAmIZ1eac6zyfKq2z2bm1716EH+2xoBBglbcNn7Tukw97+U3WGmjYy6cHeKwNw6kG+sQ8MXfe22DxcCwSotdgIIlomfyIPG8YVGaqrALnQxuoM4vgMMrvZtPed2PF4Z/Bw+/w3yGnFWz2tayBknuhWol5NNnVRe8jHzq69/RaH2vSYNIMm/aqYUIHKhSJiR0q4XCysrQKkL4OSIHIfzlpyiPKxFkVSbPFCuq5qqeX8keri+SuyxD1C6m8/euQ0FBVXsGiPDpJMYF4mHS9+O0gSmV9L6rkvmlEt7vnAzlLUIV9MivE5jovo4kd7P2VnX6lPWLL98opTqLUo00M+n4oiHZRw+7vJU4Mv0UR9YdFlDQCTMtbjp8cuGi+E6FEBr73/tt0QfsvGYwwL0yJwGD4/qpV4PccYgCGPeNUc2JXdn5XCCDUpwEmLt1ivg6/3AxoQc8DfurX3Pg/k9A0exDgG4zKu/kaiPQOjOR+zm3XuiJidWIe8CuQRi8ucUxKhXPmS7J8Zv3r0lRGe6JVJZe+MrPxXgQNl2qlTRuXGdnC6scZznqEIWNM0Fh3AUqKggK3ukU5eUzJgVZdLo8mWcWekF82W704uy2appbBtWkWnUomRgX0PeHLgn1992C99f3lzuiOplDlXnvffMQuaHLYsgxMoefHxRu0v1Hq7Wz0GORJVCz4TPaItOFL5+WcyjhDrGeyy2jekUz/6OyDwfHcyjA8HAn9aRGo957NepO+x+s8kxPPY+lTEZhw/p0bgPIZ7vXlMLWcSIN7aiUZan4xR3GNx3vEKQZrsTJWsYtY99lUVoXlzxOSNVWtNa9z/WCF+cuXHSxc8QmlQjJ9A3t9m922QHJxDm9evW6bowcVnhHPutiipTOxKVoPx6r08o6OfLbVqvo+6z2n7f9PY7NTLtV/bWixIY1k1xi09mVe4NyPCgZ9xJP9xHrrjVqSTvxRibPuPV2Jz4mx2iMIM473ZdLdkVUczmLom8rkzJ0JPE8u3TjnK0ph7PtDSr5DfZofnSY5dhvjlZsnT1qAz3yxdLisipzyrd68J41mGCQITozBCDLUK04jMztJAq+vVwLh+ccGGkafOz259jnITvX7MRpmg325uEUiuVS2C0TMj1RvbMNR/ng8HRTxFi3IsogbDW2McuCGvFTc/XXmRhVmJgSNOjg9g8+CUyaxgp0+0H4/zk8+4lB78lTWL6QZkcYwSVOD9KbkqNK2BnuZqJoPQ3uWCDozpQdT33nbe958SNauUJIrkxA/SudnfXRpGGMXvIvGatAi2d3eY+ytvJTKjSI/W2jv10MFAX+QKJl7KUAcSVsj5v35oEqBdAr8lgjJKmWQQIc9sazqh3WWYi9boSioKQGOvrtg0mtYyAKbpo/xzteR7GUSOdd+Yq9uyi2Gc+cRtS4m+epqorlRvK60fiq8EtKqFfUdaHSUBO4pSLX/2gMjuxAz6dFDPMdnGkYU5lfYkWWIDPzJEcd1KWL5X99dRUVBEWZvN+v2WZlfl2RLC+Or4sbx+Wqovrfb4qSrdS+oEkNUo4ZLSbu4UQr8JdXwcPB1U7tbbxRrr8Q6OvR1+7mHo5pnfrZinQFSu697Q/x3heux3z+75tI1ZeQD2nCwDkZ1JfAkpvUBwzrGb5z7b8kYMMmZHzi5nMlRxktJlYpGpiK8s0GVCyg3sMK7cWtcMvMJHPM25zWvWr/YvIOREvyHMQw8W9X54mO2jID5CQNkVwFqeVF06efky6jyfDyq4WkqRdvNOUwjtSdOxAEwuAdVUpc1z6LXUfWic70rTFcsm7nCPfN+Nqims+pxa0gqMC71N8G2+dQIIywvSNJ+Gvt3viG0Enl5OdRgzwRf0yj0GoPwFmuPPEmMWeVFRasG+5Od3gk7gM60mlTCosvZjTKbp7xD7nSqsEDVIhF+FS+rDkEe+2xyzbM9+YawzXLo79UrX4Pt8L1Xkr3xzoSxteCYicgSAJEDW2ONgW8Bh/pK6GBIN6nes5ep9GcMdQQ6/EYVm+h1+vxHrHKTBSOC4itE2ei2v/6nxRcspqco52KkNU9v28LBGuI8xSmSZpPMeEMh4UQ3GmW3xQx/qM3U6pG5b74f51Kn4fTRcEzyo1voJvlJ0Yh7xosiq92vKjhtNciV09yI7oRHqtL/hExmn69g76C6LZCYYEsBGKsacSdHaEkGksHrLDYkjGEW20+ynJJzsssP4dvsCmwVQHx+51Y3NiNipHQm9faQJ4ETQEX4terj5shxiwa0iZLbYXNIsUgSCvy5xsTucJEtn76bJWnKkYSSjeEzkoxjTp1hlUgwQwzUOcEk/whi4QjigmdArT07thl1dfn8mLUA6/steqkGRGJcJ4R3a90WLvCi+U1PeRlUPq58jIjEyOREr2sQ6UherS8Ct2pCpMZ79tjd9grLTTO2Dvcmo+wnDPvZ2ym1cn/k6JTBYNVbyJCEQ6er2/tz8KfHj3cY9wBURPLOkfaBt/X+afJtHgOyNAhBEneU322EYaOKAM1KMpXVVnMFgc5pTSGjoC8dhuMKmsxDUhuSVTSIOvl4z+y1c1Em2h1qnfXpMwVgG7X9kz+Kni60bgqkfiA1Fjp8v1GbdvdoxBmwt42y4eXLMPRVuxx0P0uKBKPdav4ocM8oK277mNfZtHqdZHIuufRJqmTidVmwy2ACQe3sxVSvXHT5fcFl7Ilo+L7N7L9zHCi45pPvUGN3iUMgoKFgC9UMzcYjVazEC1qk9zI0SGlx4sXN3EjGMB9iTYc82c37gPVO+flHhRIJB/ITFfNsR4XW+oB5VL3O5soPM0h6XTBurJPMJzdSwACaSugwGshWFg/ONvOM6MaKSgcHVoc7VAGtPi4sRjW2IVkpx6iPuT9lWGt0bow2guK+WVwzikpt1jmiUsj6QkuY9T3sKxfJ/XdYVSEJu5YVNnXYaYgyp8M4vaJY7bXOF5cZQgPB/9vahnTbH9XqXglThjfSWPVEnFGGvKdPnkgeW9WTzVkQEdHFW/xF3GNA+2byoPQOJ2tdCn+SLFqFEuyjjf5FsroEBbKBe8t4t7r1HFAnzqYtiPsE5DIWN+ZXSUO8XxSeT64H5zVUZyZ6Wr0CXbSYieCs0/HgRAxJlAUfpWbiJGXfZvbyHJUiTL0kQLagX6fbFVIs8L+F001bPpXo9iaYc3elevMLZj8+yue5gDxCoFS0BanANSKevK9vZJZoHL0h9GQywqeOcORepH8+qSyQp4HBBHyz0DhJLWzHdesSZZ6xnV16+YxUwfcOgoYrMq0VgcjK8EYm0uqTPqyQvWYL8lBpgI0vuwzvwdhQOyaMi3ziMzzJ2KhFhgM6N34XwDJOyCOoTE35ASkA/QqwGXKmNXrXvwlmF0StLmqiFG7eQlZ19lvwh5csSEmQvsHY2xlpL58CZ3TGK/2KV2f7Yw0k7Dzw54zP120y74O2DEvB5WGIdrqZpJmmhlJEqe97ZFIFcySDXZ6Po+RxVwNyouGD+FL2l9IYoMzDBrkoj5BYNM1ctSKQN45f6W61RCfVGCcAMv02f9PLH4Y1ca4XbNMRctqv/6tXb++0UDNOW1DEF8xCtT2lgUWJOiV6fYYcHq7jDqxhvJR77qiv0uRc+MXsr5Rl+tjzbPOes4bbJA0fNYDlpQu820OU7BBHdzKSlUeroo8MEiDlRzDp2jV/nAxsX7Ofaq8K2sxTPRE9GR+3PC/H4y/a0BboWQCH9EYGSg4c10knnvIqN5o4Z0wKm4pp/UUGXmu8do6+VM5BqPVoJ60/5lzWj6hd5omnIFDhPhiinZ0d6gp+HXoC4NgCkccpyIkue6Y+jcV3W4+nVoX6+d2OD4ItKxc/dkDibsBdAgXC4vfMbBS/ZYi5Pyq/FC4yumF5oK36i9PVTzqQkA5f2XsHAlC/5gt/SyKsMSeJAd4XNTb7S8QvXGWH6nTh7rl3D823asBY0c517vphgT83rqH9vkYALQa5s7B310z33vWfbPSTyaeN/Qsuu77MyQnxd2Lrh3naBxdyjae4UsEFZypOS6BLxXIOYxbzNjtn3q5jQVi34xXy2Jm9gbeH4OnWQKlejqirdJahZO3nbYWcVHsaW7PteO4flbe7C4HdZVfUE19uB+KkSxzgtLJPsUh2J/bzmuRsHXrGhLCyiRnme4lZi9mrNDuWYRRWeQ1laq57ExiQXMO+PGSspqw68nj3w16zfO5QglffirJN4xe4V5M1KCQwqAROtf2R1SNqwTH2VVN+vIcQ5xH7fOYwe90OR74SthnB/lXq67gLu5KRqn6NuVWFcPbnVl9DC60x1jlWob+B8kdPYqI3HSAl27GZI2YJpMjZG4Z/dYzQlwtHJ9cIn2A7vR0iGrTx1IiMwOgu9otD8Mf+yUvyh4MwEN5kOsfr7BeqeEmR/HSbpPwowJoCy5g8PkxpKaYYCXA/Q15/IkAUg0EdewiT/zhnVYpfHU2xTHBckjfNxofp3vTuNhVJV8OwpmHsHMX9G3LKZzOqDHVnpL5cdddtfXUIumgdJwhjelbFB4JXh4rYZqbtKESVr7YjmToELitpjWYeO1UvYfvcIZ170M5iEa74+7gOUVuXUkaotVkHlWqEkUwksm/cBgAFLwB1xcI+AvGjfEVbnn87tLbbU0piUJg7V6RXXm7XQJtt8s71l/tBeoxTHC/upXinzIPO1FMDdqEqmMXHkt+uEn2WBihl6YCgXuTd6HC52h7lvFaG4e+9urn6ftVWwYE25dpq4GGG9olGlqgerOil82IP8aqO+oYFuksX8hKgdPEGCRZpLT3hPIRsNAQS1zJAh0SJLJW6/Z6cZh8h6u/NoOpLpCYpSVmYiFAtZMLo5/2ciZ6xF6WEXtqFZAuiakM8H59vPg336fgiYP/KhIV/NPAE9++YLxCpSW7VRHzul7jEChXm9XPGn4ZtlgYdgvR+lfCG97DB7YX/i+SxWGPAwy0Xid8ZhJnTl/T2rZyxAeUsb5GlgJrK/jGMiI6HmJOZNW3UHR/Fum5QJbbUCrHG4rjp6KhIhV49hVi+wepWxJNTsF42S1TrG45NdyGpBvvGlOKLAvEB5RmldDP3ar8UJeSnWrDDcjm3TyipHiSQ6mJSy5i9ag5OSDuJJ/sNn7c/mMDrc/ID+P464OA/D6eSbvnOa6XF3KXa0ruNoUFumVZA4UtsFan491B3xbkvFAd9K+34MZtghfR/ax/gGPFK9UlDo1mZapcuFGmqSe9oTvdc+b11bdgzx41v3rtYAvnI26InbUvKPlon5/7dEys07IbEm1aNOB3dKnXv07DJHYf0Prw/iPrcgkt51bvboe32zrnuMxZoIeT3mNbnKgQtXKAYzzJ+r1KFftIXt0uD5XTfUixp/Xsh1Vu0AEPD37pRPHu4HNv2lKKVn+q5zHYGLBOFgvVWPlczAVVDz5iS/VIxLjmOerUcN+sQB5P7Ml8TuCHSBWQhB2g96p/lU2WiAEhIH1HhnvLkCuMPsAzMVjaj599Y1iOwClXEaUnn/9rMnQHJ1BJyz/qypBRiMImrF4QQ5VDMEny+ZnJ+W6eptxMg/HILFRQBZl9eqNB8KxNORLJqtm1J4EQFg7tAdZ3+9hATBy89bxRpWBLxE7oErl0QoYQ6TtuEnEmyh7w8a1XwtQ73MWkhffETQ/KtwPrbUyxXdY2N+pvl3j8szXdA9OTdKpEa0d/4nTl+YpJRJysiBaGjmLQNj1+cZzJdTV7vJFgR4QQAoQ4vNjM9miyvcuGY6XoBdmpx0MXe5dND6gDpjvL1WRRF1kVoJ9+IeB3pn0y3xVJxJh0fYdx88Ol68eInLHMRB0fq1CMHOk0HqyfmecJXASd58pxn/GmfoNdIF1czmDXd7aItYs5O/z//tWkIQE5hxBYN6aa+clu/4Ros5jrSvxJ1LoHbSyhTcMTt/9o1xDLHmrntvHswX87pQMGbwLrU4mVd1+5FXIxxj2ESvPtgL8mP/0BuDgaedPZJDBf8RHhUJhDO/x+z7p07LXpBrpSQqv1QY+MTSAW8OZHo38Pb5GfNKc6pnBZTHGYononfrA6fXIACC5YEg4EzuEQbxIsy/0swxUeYRfjVf7mzjIklQ6mnF8E9furqNtV5GV6Cz0ELmXGk/E2kdFhAvK66u4IpwJQJhgBCqjiIJkdlCcKo1Q5GL7uqjo0H0J5dwOzfcy1vpNfMiQj6gG5iZ7JktnjJSzR2EeMVVvnquIMVPafbmbp7pmk6jCw8fdpmdmseJ+jdOvWKmjk81O5HOH/a6Wo9YFXwjr4f08v2AhGfb5dXt85Ydx0kC5a8BF2X2YXqwE6xxuFusiOrF5E/4el5V9yJuT/O7uiXiwpRopd/v9JbCN8PQCxaU2obVYFvrrW/w57YjddU7XHxmdr8BxuN54aS0Zf4dc8W9biSLBzEDq72+OJ+RRg3DYNiBpL+8g7u8AI/Q9Ak6FEsoM/Y8LdMf2uq7XTo8i6TJpXhYOwGgM7e9ui8AJ11Se1ryp0cXIANkKCLt3Bh1lyvv6MO7sr6X8zouErsabyOhUoudmELVv3D7E9aeAbSKrszGyeUQ6T44nJUySlDlB3+QjRtlV6UGkIVDtfTTLg/sS8zGBPJ4+1X3ZmAi/9FA4c/Jd3ZHS0t9OUUyy2jPdfWB8mb9rGOL6kHzrAXwGZUK/P+bW5HSpo7aUKp3zaJ+cM8RjOZm4baGxXK7AJRz3IlPo4B4rfCXBdimzc4i/sy8lBTGi8yN+SJIbHryFa18WHOxHE77Q+BVxvONC+ld4obsunBBfC4wxMS+fEr8x2SUWFmj8RM1zGg0IGjj6XH5GZH0PWjjbCWoTp6u/v42PdUGgrK7AFQUZ8BSSiFByKkVHSLZkSOoFTrNOvSo3LH75OfiH+Xjz9GCQmpxKqSBrDPlHdIg66kOMps8Wd8q1erO+Wcim8Og6Ed3EJ/CHEF6Jmmd5/ZC7d2BydDkWpPItelzcpxpmMJ3yagCMJJYOfEOTE1i+9Br7pnlZKqF25Qy2n+7aCtrN4SmhoGP14n4i74Rr9ZhQ3tYv+ogoHziSV/3hEGhOSX59+77Jo78PfvYHtEysUeh8l9KoX0GWyY+AtyscEl6hOAfBSnkfpOLSC6NKgX6QgSHGgvfwi9c70kF5eiPT3uwsW1IHo7qtj8hcspbGSrBjLir3/VJPOT0Nhl8RXXkalRkIMtsAd9Gi6fjNn+icMHJM9n0lylGGORlkpGQBBbH8WaTq45M4uyIrH3/iwbBbq7ollyq/WokO1uLKF/42BneNzi/OyXLdSUE0ovHE0PEocYox3vIlMM+CKxvuM8YG7lOcnljuwr0ArzRH5U8Qep+9kH/s7by2+w4zFOr4LjV0nZYlYPf1BpqxJj4eZ2aL8u49qpwjypD9wgOx1feNi/Wirm8p2pjHjqUn/yJfM3q3/He6HLScoIvGHpO/RFRqz4hMn+CPrB+seApi9siFMtxFW/8EIiz8akrrD468pSrERTBKgyPbwWJBiTTBvl8DYTjkv70yYvmhWHrg5UuboQlCjBWZRth1dcf2ZJ9o3Hdb0pSDm4kxNfVvVE9xvy9NBkl4d74TRBwQtget0pcx1y+1PRyJJjDc16BdAVXiWOz7WSMEJoJnvDvpByV/Q6ETuSUT1Tt4Z4UlU9ZH6+t7bKym87FrC0bRc12Xk6BowUWDNY+HkRKWxTSGKgg7fGeNqb4xXRTueEHqL5jGg4TfuXOn2Xcilm7YhzTjR1SBw+/GVxM/EIOjQ5rXK/riD15V03YqdzL8FIyrmbXRu+8o14XmlYhvdWRbUpkRUvrqua3lGA+chwgQ3we28UyLNfJnPF8XX50yp2AMzTPldRlqWfjG+BiMlf3N7XoMufajkxobVMMX3/lVGReZkyI6L1QQ1KbntQx9XwXzmUeTZ3UIhJv2EROnfuIx5fqNLnUvPqHjdzCgnOmlMQ2yaY9357VYHYQiuz6mPIDwBZY5J69mFa98ZpanW1xEWMsZR2Z3mNNCFIjc9Y0PXhhmOujMqcbwia6N+tgCerWqirfKKwyZIbw2liq2riCC9krWbP0dNADSCB71kQing/QrENMVGksgOEZIV6mtMQyPwYeNUARyfRov6tpfhzGq00KUlFnAhIEVOr0LpXDxkirDwZJQ+ehJelw+/S9UBGJ6CjlQYusCs+VeOAP/+JyirKWVa9gR4ueQfJ03QJq/nEWqrU6gs+t9FNNtCLx4FZDExkk1dvdmTiu+KXEZR8orwNgQQRZDjDpiJ67zV65BR7MTKoVeI4PzmFDk4rPnezvBho6ddzwwQX6p3MUTMF92NPpWS8fnh5wHM8rqAdGwk4p3t476JO0qyKeixWtqxUE2cE7GduthRX2FN8dh/p4xgt0hLVvQKIqwkfdgWJdc+oLaGRmMZePqsjPM967veDic1mKlaGmMMJAPZw3tLizcno01nfU1nG9Fda5Efkj/xDdygXZymnUmrY44CYTCpb8HoxibkGnb4QYjKjSzNJ3atnwn5nMTlQvfZ/VRGCGRPPK215qTwURJWUWyebvXAxjte82dQUcd0SEkFC6WGgTsYubNN/ugXb+Cw5s8OvwLSR+dgFhYZGw0CJboUnhr1KZD7XzBVvTzpcQ76e1AYciflG621cfsZXtXoAI+gkmdiLqz81/otO2vnK9PMJV69BHcCPqQlvKHn+7Ok6He1hLxEE5XrvhdmBYs1rf+fvufq6xp49/Iujo9KgC21M8o3D0/d7gT4d/9z2QtQYT512mU6ps4rM9fGUmeEgQBs8EpCCumzvxMfDni5sPA2c3F0/ldrZbV2/2sDbq1vCFCN5FQAKkXFFFeZ+CJ3JZdSF1CYlslMrKK7KidyzvXszHqxinqHvFULYvbTNN7vWMVAR2ou2qYpRueOQmY9hl1bz2C32RmnFaXFEDrlq2Blt/XN+wOzeIZ8+UDAF3HpYoHybm2L2Qe+OvgBPo7oIl9RxjFymV9ZPdqWuFgmaFDUfrpn6haItPtpAzun6SaC4LuG5CBZFM/RoxYD73fi64oTdz0QectJi/DRRK6pBhgx3iwkMksjrP8jah7rXUJMECX6oP0+3p0W5m3Nr+tK3t/Po34nHcDbWgW/epmdbZJYylawUfdC4GLt1iVIFesPIHP3EK0A8U46LJNqv0y+XKcy3GJber5Ar7kAqyr3NmFb3r8OJvktZ847KVwSwUrdqQ/UNpob+ftxEZjTTDS5PGfgUsGx7xLu8tGdtybGy5gtlprDww25YKwknNW7SJLtmbr31JHIKukfJG3zIGG2Qe+fh1wJgOo3nwoAMz7puzfh4MosAWkh/wb2WtBgkukn9qMkboRE05UJnnbi2y1jRdDVtnCenIcJFx6kG8L2u9wgPo90b0PjeTON+vT5IwlqLIg02YjrnotgViNzWPYv9+BzMqCCarFueWsk5NYoHTC0ouAkARYbNZrk0PsNdV7FtGj5dPg/y9SUa3KbScMxXu0cb7CviPbCTQaWpUhwM3XL5OISx48wP+a0BVrIFp8ik9dFJrVVEYb/6Zzn+4WqS4yENmp0gotxxd+kQ9weBHKLyPMdli0xnQPmTKGkl8bw1Vc62FlbgqP1Ve6Dkv2ZUSE5Nje2en76JDlCEJvm/pGH7HJ0PDLmEIGTZmXPH20UG5ZOzd+IcyaWVT0XQTpWB6wDSD9l/2AsFMjBo5ZM/l8nieeA0yTKZi27+ixEOAUWbdihkGnEZYDQQ+uFRBYa9Ap0m76zqRsIVg/Lj+3/htI9Y3pGcKSQh6w7eLeSKzt2zZOWKDCMfHwK6zZuOFQ/8ZLfOGTppPRfjjvzRcWFpQTNA81sLSw8rxEQbQFeKD3xzYBfrogE6F42H5GXysyH6WvZ75KhJYOHJkJpexwu+/MAQz96ETMl0+yElt1waxhiwWuuk5/BwlZWNgHREoX218tYgE27qTzhF/X8NZm91FMyF1X4K+j+tmvQ+DCcpQ7gkZcvCVSOHRmX6Sr8cP170AKA9ofgkBsoFuVYeeVOpaC2ogcE5NHP4zxoc3LdcluPMgoBrUMnC7o0cEAvShSJv8Zv0hGKLY30f6hDQw82O4b8NSQbmXxncPvclaBCZUOM7DagmFTIvpsl7FhXc4ZhVfSspPtR9XDb51TSpYO3tiKnoPasjvfi4xrwCzmArT0ZvekRmjXELKXWXciosmHfzOdcpx9NJ198PvSLzCckWxfoQ5BGDF6AvnEDTbNX5yNc4revgPsWkrkWOh/ZQ2NCUm2JYiUm1zS16raH29YiI7e3SYw9HHrqSM2bQ/bNyU8y6D+ZqKzzQu6p6giNyWRTLH4nLfWVca52LJDP5U4eLDHq3MUr2W/+q+4uhAVUzuM+XQTG96Ko3VBH0Zq5z46hznRTJ+x3+P1O3S+g9euMYWPM7pgVQZ1MFSbvxmUJlAF4yJoozYo2JHwiWCf1cBHISZAnyw0qfz2KPeR+z9XKsa9tJH5tdA+txKzkXM8XP48QVyKBXiYn/WyBtqcrX9NJD1+IJ8DFGLwdvG5ALALGTc1P69Emo8fobVTXXas9DCGFVEL4G9AcKgLIJ2zB1vtva2EJu1Gcv9zo6nU0nxWv19x3mjh3dfS+x++74KmjLqgs6wSVZhlb+6+MaKcWRwEPtKtZoM1Xdv8EfGS5X7PMHosd3KPfSEXf6dEl+cr+0b7w3UbJ/ulClgSCtyQdCm4XxUoLOkz5x2exfK1Vt6v6zW2Uwf30iQ8Jrf2qXGn7fh+Y5tFpidDbXeujeAARf1fsKW6FX2036KgF7/65hxuu5fJJ88jquqF3gIeB1Y1d7NKyTdpSHiwxO+rgoBSIKgShMvS8fQEsbre6okXUXTnVQWaPVP9gSRK0midc24ab13S+XoDZ/T5mjynMP4hZbjisL7kwt/aFC0gNZ2jX9vRgJxBhcZobNM06YPNgNZxMe4gUkkpUXUVLvSOrZPvntOnPlrfk1eiiU7DAvz8zunHVvGQ0+kc7gpMmUf5UzkF164H28P707VT4Cf6laU5N+CTWUols9maEtLiU2AV5tdnIm+uOD6Mv0IR+tVJ6bz2frj3W67YbfKG4UZO9RRClF4i24kImBV8qBtiOgaf2qOIE/GFJiOX/lIyHPlDJJpIMtj2cUBPRPCxDaZ29d7zkJCl9/EfPEQdnaWR1GMkgT7j1KJCMKp/5aV70cs2qyF6blKPfU5MoU3Ty1Jk2UVRaIisi2pF7CvCQPXDQhlMCeB+8CaFQez10woEv4aeVAQrt+576KSymb2gr10iy/zAfA654X1jwsx9h0hFWZIrrp+D67atcOx+TdPEAAz0ucDpMKzrj5w2xXB8ua4f56IC6zpgqSWTVBx0Oqeua3EIKLRTgEs/n+qDASh6P4hAuStBec3Of8QNbepLfbaw42O5+l6cTwwZ+uhyPa6n+4E5hhc2PLa+34vk2zJsSzYfdBHcoQ7AKtz5oP5GaSILQBkfInL7Gp1ZD0TXl1KkI9KGCgSYz54lwX3ISmNFfn3s1bAFy9bk/JEZ4PigBJ0hkWYx1x1AQCPHrWTId7Jw9OO2/ZOgFbZK6Qfh7PkZot6t2T8AGVNGmP7m5igJXi/JrTG3hYPMPm50eB4+jUs1FRL06DP+6SM3yFFlP2aCdJPUQCgK+sKIJ/Kr04ovYs1fwPX/vtHX6G/fcu6areOqkxV8W7gDa3Fp9nVtZrHGHItGAXohTLsNIkm4pOl+9vdhBvKfrGhOKBc+R6/4RSrDvGHXsRz9lyBT9s0vwyVSr0UyTIvL9172wfyAwPLktgeRlLTur1bmwu+8T6BS5HLIkPcfwatmSs7D8zAE+l2Do67Ixz+zwOVewGlvisxRLl7hCRqy8MFOaDpDad7d3xo6xPmXif/wEp60A4i/7R94ERICqgkYbyTdaYDQ6XcuBhSpMzSRDjDwh7M7UeEAZNKmn6gIAVpFw1ozFRnyKueTa5VRULqAnjhcT93ExvuQaHyrv3imusB6c9VmXpUFPADdNZQ4mhS2yLVn/UJDdeX5uiz5dv80nTt4cRHoy3W+0l8IOwxhlNqk1vfT7PLubzjfN44zf1qOcCHHP7bqo1KN6l/6+JcTSrOkqI11mqYrPiofG2GCwM8FyB+L92Nd3ihByGq8EmCbpa/WfXY5Whp30hKb1OTE8VBSC9g3EiS60U3boXfyWYVKb8ODvhEt7bptiLrdRS9Zr7V46XIqZ6/DSpNmESd9+qcMiiJ8zAV8S2TStC8Kk0kVjTrFpKymz3nnzA93+Iaz9c/bkFAErVjGswYLBo78MoH8+tMxQTzaISJ/VaT0TvZe3/GbJ8oXcooCLGfU27/9+1On5wEVIBzK3nAoecQ/JV1lMWTcIwLtVq4Nyic4riAaDBcfxPxZ1B1XT+MnNNIQi0sinztEu3u84/ePNg64DMWwoVjPdjMbFKvNVd9GqsGRQhUJP8Xfs3GkstFy6hTASPPOpc82mO8gZlEFWS1bTkB951asIM9oL7kDODq9Nf7ApKhXkEBumSZ1PHP+eeu7/3Xh4XKIAAHtX4lubo/Bb1Bm5k/TnZtN2b7IzA5kHplwYpx3VGAogDBNNNV6ZSW1PPFdArwqhtIKxreogShV86+oKmlR13lQfpUHv2kbUG//AiAv/Fm/7LiPOZFdRga0Jlz1v6y/c77sKQBtXanAF2yNteouH6XcNCcmzzQs2XcptEoUcr53uhHSqZ0InhPQr7UQa7j0nqsJ2q1z5LssxdVO7Zub6aNfbU1p1Q0mBfjtDI/8sgmtNrVC7P6t63mKM5M9na4BMn6SXAe7R9G8dXrnEKiAh+uue6NdJt8O/YDTn2+1F9qbSuMmoyD8auwRJeh6hfNlutVydVf01ZQkkbMxHLkEkiqZ1r7zI5WM+T+9ukVJqcUVuv3kVSk4/nWmQsAhcoTWZN8+2q/TvMjv//o7a8/OOyh565eTum7o8glXJwUAh3iM3XRm56FRWvqJdvjOX813TsthVQTrZPtXAH2HS+erOgGxsqFNib4kDmLjVJc7eROt5wnTgCASRulaZr22rtsMembmSL4d9zwxvak5OgR93x7ZHds8RxoeP1j6db5WtlGXkA9NKbU49+EAOviSYrx2hxiNP7DrPGjtumJ1X3FvvhrxGy1erEcXlHP265SsSXCKairGqe/phL8ZIqALTxQdEn1/pGQrDzwvAjlnLeuwiNLgHjzm+iPnxkY+nXaEp2Xtnwk0CG36nZr23/6CWpEMmYn7j68J808dkokHm+mfusk3iLwgXObujaNCVmdIbmV2yo7bM5DXOqQ0jswpvtBq3GKMIJ0110EuRpmAZHoClSMOQXzYaHF/wnPw94y7BxuxJ6F7ScEBxqGVMEFIHMFCWO9TjzSTNLMBCwHxo4L8iu641egcTHVenKUd5yX0fh9j8DD/TMbB1+W2PGkqUBtUKTJf8b8ifeAQiO2vM9eSs/rumcZDXe3cF7E6mZnDnsbeAE8i15w5za8lePyHg+Ydiw+4bhDObOn/yISQIvKgf+HJ7POYtL+Bpe2fEjGwXD309Q9FvOCMyvO8ZkCWbagO9rbTZowrL3QY68m3sG/64BIZj2ZJs6DnuRaGYSgG87wTQVYa90ryiZPkDU0Ptt01G9IelPttrfbL9/0aKN++TdbOfLA8BKWBkwNFNW9gERS3JNnrNvTiW6XvWO2ZKzvbSviPiD19klQ99tGq9ejYA+82freqm2G2K73A1GkqyEA7Lgrsp96kKXGcc1iMgmvdGf7lHOW17auEPfIupUR7fWM5BlRyj2e97KZop72zCo1Kb3GP9zYdRkpl8/yRIhOaBs6UFt7ZDl5+iH06R0MAYVJQNyEEPX2aDQzTTYn904ZoH3kNezG0uO8ZOD1fQMf0cTPLV3y5YP3AB4f4EAZYtebqOQrZsZ8HY1o7omClISzTHHVfRkexv1Bq7/5wLRHSZOAgPr4FEmmZ/jVZfmBXWvHCJayAXxsyZQkAnfBgvi9x6dIm0Fr2PzjiG7ikdX/bIPvDO3mxLuxImK3upOgUNTNz3eAN7VUjGQ/Ls8Pm9ReMINJgTm6FlywUiUM4ppXkwv8h+f56SvA9WH7H3umbMFw9ubdpIlzIc/NanfV38W0BRIJ++ZGNJ0ehMvKtI0BpHdyEneFG5V5SrHOKbNXXP72E/6peeV79ptvsN7Nor3epwtIBraPsl3aSXmWvpbhMeYIey/u8lk3toNrzvsQD7UljqhvWQwLrl4P7z9XLFc7yZQOdSu5SNzpLyBihJJIm5rsHaYfYxc+XXHF2ix++YdSu6Cvjx/nPd//tMBVYZL2+9Z3dDhhoSJdxccClXz0lbqUDijGxK4B4IEK2XgPxuYcqhl8CCuMrJDfSIK/JDIzuZP2f70/P9LfSfG9BOY5L8LNTW+7ddT6GByC0hT32a0yLXeRmj3XUq1A8ZPbL+G9vC9Yr8DJ5fGtVn+oBcAJRSizaIyNIYWWASsTHr06QU7jt1ra71SDP0Cx1SfM/1iSTJKuCejRk2AmUiNYM8/YY66Aw2aBe+zRrBdkwj2fz6ysE1kFSNJpKMY3Q5Aywd33tkpavjfn+j3jUvz+fGViFrnrk9etmyk0ebz02z2GHrYyzQ+V+SC7l1VQOq+Y/JMe/PqVY0iLHdbdtvpb2Nhs2IcGX5biaKX3oQBD+C2b+C6aiZcyS9fk5r84sfS78F5jd8hqjOevB5edXrnA6o+ACul4Yz5xf1cc8/i/oz317Nq/Z+ee+3yWY/S+Y7s5vNnTZOj9n+PX3Xz+vP/9y/fn971+PKl3LP5cQBPlzrcyqovzr6TD2143R8udC8a+PBt7qPw8E6Omks7b9+/m/n9+vKv0/vMJfD9ujdsv+um1ItocPXsPDsa+1rMDPxVYBrA7uXNar/evO56Wf9VHl2j2PZKDnx2Wdhyajh3aYnyv90D93UnnVtv/tUtRWRf/8mjz7mz3XKbCFVRK15F9/6Ko0BY+hjrJaM2uMEvDMY47G59o8bI/pAN7qBT5+6FerusHfIfSv3/9+3H+94TwH/TT+vu+vxUP/vxEY+U8CI/j/pPD773v+SeH3/18E/vwPAv8POi5lNIIf8zY7yXkejme3sj7960cmaaNlqZL/pPT/211vozhrqShpih/V/lfC/IM//nn9f2Wm/2+Ey9Ii+z+S7R9k+fwvVPn72py10Vrt//ys/51Ufz1BH6pnef/iijf637jivx/nZdjmJPvrv/5N8P/nD/rvbLNGc5Gt/+ODfpzzr9f+35gJ4MlhWP95+3PYSmVIM3DH/w0=7ZpbV+I6FMc/DY+4em95VBCdNePljDPOcd5iG9pIaDANNz/9JG0KbRMVOYDMOvCg6U5Iy/79k+zstGV3R/MLCsbJFYkgbllGNG/ZvZZl2bbl83/Csigs/GMUlpiiqLCZK8MdeoHSWDaboAhmtYaMEMzQuG4MSZrCkNVsgFIyqzcbEFy/6xjEUDHchQCr1l8oYklhDVxjZb+EKE7KO5uGrBmBsrE0ZAmIyKxiss9bdpcSworSaN6FWHiv9MvTpYN+wq9Z95dnT3u/L749XxvtorP+R76y/AkUpmzjrr8kp6PO8+/O8MuZ8fDc67z8ePHaTtH1FOCJ9Jf8rWxROpCSSRpB0YnRss9mCWLwbgxCUTvjmuG2hI0wvzJ5cUBSJjVgevK6SzCheV/2YGDzj7AjjEt7SlLe/ixjlAxhpbGRf3hNBLIkfwBxhzV9IX02hZTBeUUJ0jcXkIwgowveRNa2Tc+ToKXU274jDbOVcMyyUVIRjS9tQGo1Xva+4sELEskHyLsHgCe3P9qepzCS4HZHxDXWIWLtk4j3/yZiB00igYaIqyFimrtC4u8aieJ61zdec31MQYTgiqE0E343xITTXGOngPi0WQfUMVRAlm4SW35z64ACBdAtJU9isbeMOybW7yYv/nNZHYrW2ZpVBGAUp/wy5J6F3H4mnId4OHAqK0YoisRttCqo6+Sdsblcn3ZH02lOgJ7pKjQdHcxdsewoLPvCZ4AhkrYsDwtsj5SXYlE60n2L7nJKPBi65QMd51Ixc/rNqdTTTKW2jk9nC4AWT53n74vv9uIRu9cevn2YPN23VT7ngOKFOvLO52NI0Yj7JDuOv1cDfvf98acN+LcxALV8TYXvTRoTlMYnJydHjnqOQXPfts9pVEvRUij24FQzRtMpoiQ9DtIP7QEDWzNIzX3itTXxLGzzmDbi1h8wE3EtSMVFYTty32Sn2RzVQUez09wrdzVZdhqRcRH5GkBQz/K848EjtZzDiHdNw9ZEVMaOmOI+8NvgZnJ/mV3eX1zF/reruSag6pNwwoelQQb8D0uQKOdJ7MPn+nYGSbSTD79uRnkb87WrWY13thxrGatBlYIyS8BYFAcYzk/FqQN3GEwjWeyFGGQZCjdL3WHwCPEZCIdxDm6t7J60byG7B6Pa+YhKroJFl7crbRRivsmfVvvSo5J3uOVRK3szdehabr2XjExoCOUXrcpJxhp9+Y2+GKAxZEpfuX6WP35zSalLQR/RfOEfwJn4S+gIiF5mhA4xAdFfsNB/0qrgKNtsXUo52OeEoWaUr0kOdZXpOnSYn7Wldhowfd2WeldR2/DrTdT7J/vZDefBg9sH//bCK80KX0bkwj01jN7zhJQV7Sx35Clv4Fjj+aqyjOLzHXnREX+uoq+i5qgOvTp8S9nK+SdrysN2/7s8tCfg78ojXLpopYDSWRXT+zIyHZ2M+iBfNvoEY/Guw5qK2jgJq5njP3jGWJXKnmJKRzmZtzRLRCmRmmy2MKtoZaOLKT82q1iuTg7mugrgz4jG2Wsjv0IfZOPivZoBmgvFqDi9MICPA1UAEYDBIGwIiIPa32mm08zQ+p31UnvOrrirqb3tcLeP3KvxvdXgrkv67ZW7mvPbDnfryP2t827f+2Tu6htY/b9oF2CViZ/97gKW559LjLqc/Za2dPxy9Q5msb9fvcpqn/8B7ZVRT4MwEMc/DY9LoHU4Hx1OTYwvLtHEtwoHNJYdlm4wP73H2g6ID2aJGh/cC+3vbnft/f+EgCdVd6NFXd5jBipgYdYF/CpgjHN2To+e7C2hX2hJoWVmWTSAtXwHB33aVmbQTBINojKynsIUNxtIzYQJrbGdpuWopl1rUcAnsE6F+kyfZGZKSxfzcOC3IIvSd45CF6mET3agKUWG7QjxVcATjWjsquoSUP30/FzEI5MVJvru8WH53Mo4qVd8Zotdn/KX4xU0bMz3lma29E6orZtXwGJFTZY5Ui+6tNm7ScZvW/SBWXPQ+ZISzsK6G4K0Kvpn5MvQeWwly90kj0UZnZGcQJtlW0oD61qkfaQlNxIrTaVoF9FSNLW1Ry47oCstG6PxFRJUqA+leJwu4CXvTyiVGvFMwCJP3cmdQaML2iM1k6Y3NrnBn+3LKTs1dqANdCOPuanfAFZg9J5SXHQWxdxZaO9JGM0taUeedEnlyI6eCfcWFMfqg9K0cGKfIPz8h4Rn/8KPhD+L/5zw8Q8Jz/+FHwnPLn5ReNoOX6FDbPQx56sP7Vxbc9o6EP41POKxLF8fgZDeSJspTdP0paNgAW5ti9giCf31R8I2tiURCGASTkNmEiRbF+/37Wp3LaUFe9HjuwTNphfEx2HL0P3HFjxrGQaEhsP+8JpFVgOAoWc1kyTw87qyYhj8xXllcds88HFau5ESEtJgVq8ckTjGI1qrQ0lCHuq3jUlYH3WGJliqGI5QKNdeBz6dZrWupZf173EwmRYjAz2/EqHi5rwinSKfPFSqYL8FewkhNPsWPfZwyKVXyOUWtG9t2L666n5L9S/9v8N3/e/trLPz5zRZPUKCY7pz1z/w4qI7T2hv8O3rYDC7+3zTt9sg7/sehfNcYOdkHvuIBiRm9d8witifM3yPQzKL+Pg9o9VhI9ktAzKMYbdzPWR3dEYj1o5W6r9ctWCHM6fSNpMjXRTgjIMw7JGQJMsixDb/YW1TmpA/uHLF6tg9l1+5xwkNGLqdMJjE7BolM1Y7JjEd5t2CvKxqnfVb8IAh2N1StIWY2Oj4sUKsXNTvMIkwTRbslvxq27Zz2hSKU5QfShaaBbWmFQaaXl6JcuZPVp2X6LIvOcBqsK+98OfHwfAHDHUcL9ro/sv1MOdHFesc3s4bxLtA7MA6xAZUQGyqIHYPALETQuvzWO+D6eXlz0/jc3B1ThQQ90Iy9zl6fhTEqQQPmdMwiBkOhfXluE4S5Ae4lG9MYqwQuWl1bVOCsri5jrvreMDj+PgonWI/H6iAeoBucXhJ0mBpduDZLaGURGu5gPLSiM0RswG6UxqFFV7kqxAwFLxB6Sx70HHwyOfRZWZ9xi9GjxO+BGroITU1Nvk5e6ylGfw1T3HCgOrOSMDH69+zYdNld00xC9hWnVorxlSoZSmYZR2AWMqFQibWBUq58BmzNliHr3yF/IfMAjAcwS4YCrugq9Azm4JPXuYz1IbDLwyxkI3fvWVY2hP+7RInUZCmmQcwxDJ4CXcRlkrMRf4wDSgeztCIX31gOlRXSDVuDUof1KVvKaQPVAsvMB3Nakj+UJL/EEUzJk8+EVH+HzoXrP6Dz0QTUP5szGhhbsMvSRiMFvvBkbIrQTzhJb1RHEzXKMRZIGHZmmFtB4bTFBKmhAQaRbh9y0TcpswdajNnRvudcu4LYmZPTgVZblr48ippvRJ1Igp8nw+jBK+EV5cMXnPoeXXs7FI5qtCp1iCjKSNmbQFd+3YZviQLbcFg+qchtErICi8CyhAq3YjGILTV/uk5SaIy5GSGEVEs20W5ZmVEe8xbY1Pk7sgFillMz81lZke7OSFOzn4KGmh4Cv0zLcU6BptCz9uM3pCi0Z+9fYbjeQcQKO2aaklym1qSwJqorSJXifhczJzicUpRzKT4OsVtO6K0t5T1IXIgalnL6z+T6d2cJ/G6tTxGUSkLnwU2r1PcQDcEeavcLVXk4TQmb2eLRfvfXqcNQ3C1HKg5L+1rAfc5ztY/DqBg5UxdtaYc19Ey5IhzEKTMrOlkzH7RLPFbM3h5IgdliRw5VfhabJwuxPeWq1SXpszc3X3/7is8+0tvcJT+vL/xv031Ij1WkRb2J7jgHknolExIjMJ+WStwtbxnQHiGZCnF35jSRZ7NRHNKRJVCCe3wd2Sl+izrzgM++2W3ct6LAZIsfuSXl4UbXmCMzYtnj9WLZ4u89DxE2TQmmG7h9HA5PQl8glk0ENzXX+epAMybXvIsbYUwnrgm2gIJUjJPRjhvZlReoIk9Sd6MbdR7yh5a6olBhBaV25Z55PSJKTtrprx2ZhsasC/ZHEqCrwS8O+fBCXH+MaA/8h749wrjWakkPC8squxvXE8y8m1hyKsKNb9AYfvnAL3vjQe+aV/e/P74u300fSreGRfuCoA76pPliT3Ze+pTzYYfgOLGCVF8R7ruohoHpvi2S0ahCo1THOjC6zeJmdtz3BV6MuCeHF87Z2EkyzOfntqmFg2tGnKyIxOB7HDKQcT2wUGC0+Avul12pRfvbpeytLot64zVhPydcxeN/kyWGiuEITLFnzIQkv+62s+UT6FV3TKk8mt1TTeKWHm11Sor7slmU3Pq/bY9Tede9OojeDFkPE4xFZhwEOzhmzk9gjn1tjSnRSrsCOZUcpyhBiyv/Dg7Wlc54cV6NvX1PR/O2kqPtMFF39SiGWsrZ+xP2NgWKY29jW2bWVvHNOrWdj9jW9hWADUorPDN2VPz/29Pn2cbN9o871gmD1qHyjoAw5XSDpq4PeJgdm3dvBu1UtYJ8fh0MwmKRMJT4dgRdMQUYiNx+9szdASKAZvQ1cEURNTGzWHWhhbNqJR9Qip1uq52wbKqTt0l3yPPvVp0fnX/XHy6tsF369fRknOWZL53Tc6Zdv2tJLQ8za58HLMZBbP0ZzrWGxo0o17O6ajX7pR/0TSzJS4OYNcg0dSFXXDi6YtDUVcc6CiGXn5Pn+AxZmCP8EkGecV+kUMEecDTvToiOUB7ktPxtHrwWMQVBw35nlI/aSP/atejejP5sHMxaPGjGOGeW8WOvJtfPEVnGUBzVW/71Rv6oRQo7fLGXwmEfKJCEqzybJVwQIX9nPNR1565qp+T6TkAgvPWmu00L3m2ig8pna2ST0ytOW+VkKWNWWNB2IOPl5+seXYKt9Hdt7ZnabZZX4Cgq0FQSS1KJLRdmYO8kd0QBY03Ch6QgrPVqae0UWYZjsgsyzE06JbvY4DELKtk46G3MymZJW8ee2PWq2cWAI6juYZELUt/IWo9FQlXqNXIMQ01/sc6vCEGz6v97JtdlqbkLvsrb/t51eBZQi7RNE0JvMY28yqxe1voT9Acm9DQ3Kq/WF/0oWkqNokfzhqzYvmvabLos/wPP7D/Hw==7V1pc9o6F/41zNz3Ax5Ltrx8BLI0TdKmyW3T9kvG2AbcGExtk5D++lfyrsWEBJull7YzxcLIQuc5R89ZJDrKYLo8D6355DpwXL8DZWfZUU46EEJV1/F/pOUlbQEAymnLOPScrK1suPP+uFljftvCc9yIujEOAj/25nSjHcxmrh1TbVYYBs/0baPAp586t8Yu13BnWz7feu858SRtNZBctn9wvfEkfzKQs3emVn5z1hBNLCd4rjQppx1lEAZBnL6aLgeuT2Yvn5ebawWce1/lb6fzJ+1H9+ONNRh2087O3vKR4iuE7ix+d9e6+nXsL8DTlXUPgp/97p/o8VP2EfnJ8hfZfPXu73DDwA8WTva145d8LueBN4sTeaA+/oc/PJA7CL8zIFcSREwDe63TDYC/In3QDey1TjcAtnvAPB+wA6w0cFdU9zLzfLkyQPxP6QeL2Pdm7qBArowbx6HleFhOg8APQtw2C2Z49vqTeOrjK4BfPk+82L2bWzaZ1WesdrhtFMziTHcAzK+ziSefwdibk9fT5ZjoqWQ9R6o0DoPFPHnkBdYe4bsP+OWDTYT5YPkx6SgOg0c3H1wHKvjvGQFMf+T5PjPoJzeMPaxKPd8bk/7jgDzOyq58d5T0iL+JNxtfJVcnipyNXvQIx4omrpNN1JqgzsBPhuIuKyqdgfzcDaZuHL7gW/J31QzUL8z1c6n+wMgbJxXd15Ws0cpszrjovNQr/CJTrTdoMOTUrAO1RB5D/GJMXvQXnu+4Yd6OH1O8xemhEHh1k14DyKq4q7fTAMlupgSXo+LKGrr+TRB5sZegbxjEcTB9FTY2Hgv+npRKrII/eaQVzdMvOvKWZBz9xBK54emTmxqkWh1ZRMmzfDLWvmU/Eq2YOczXawuKXaRSUFQhD0VDAESjARzOhpE1+eXAcHoZwvDGXtwjo9bc3919bhZk+L0zpOqqWXnvxAtxRylWZkFIJoBF4UAHCjgTmalR8mfHUAQiKAphF7pRsAhtNzXMfXwpMtERtpu++xDh0Twk97VmEw2NBqIiSzLgsKgbAqNobI5FhM4G8Pn8y+jy48Xd18dzEDtmjsUK4lwHM7fskuAjGAczyz8tW/uJ8hbSL++5CohcE/n8cuP4JROgtYgDWrpRbIVxj9DKUvuTtjOPjD7pNsVeThbhm8WSSv711YB83ZXCC13fir0nmsiK5JB99IYYxVLoCiNznbEq6TizD1WJI9MPBx62Izx/YzfmOsLTbL1UbsvYY+14kfgxdcNafTt+kT6/BGgxs2th9o8Dbh5vr36Ou71P8oV1v7y8/N1VOPsJJHzNrN3DkMK19ntBXITEknSjBJk9fANQ58vyzXytx5CdYJRhmxW7EachWN1jGtCcKWMt3tRznFR3XPxsa1isqTSZP6lfJKvWt2odVaFmrNJ1zmAVbl82LsqzEq6osgSgka2qG+pHF9BEEaqSZsiVPwrdYzAaRW7cYe3e22D11b7+pPyrnS5vPoT3P28e5O/PV4Jl+V/XmuIWgpMT98n1g/mUzPAAdnr4Zox8BRAZpqt3z7axvOJK++evKcacymdZLDFLr6uRv6KlF/W0gaHVLqbsAslQhOLTm5rV9Vc7VWM8AFPgARRWrLrYoSY8AA3Z15OH3gWKH88jK7iYXsjntczr2ppZY7yiVUxHaggueteEmPWur/B/twGeXlaA5WJY51VW7MQ6smtJHJpMi0MxdQkovESgQCBAVRK3vhWZiLyyo6d1kJ6Wzjj9CGocwFQtCQCxEKs0b4IwIV/gtT5V6z6ZGiv5AjeB79kvbSh3Fpgh98jb0nVDRfSaqghMr1jRG7C8QhkATgaWPXW7QytyuzFeZrt4kewOC4G8yriEaisInq3PzETSpT2drchONxg7rSMJcdKDSCA92JbweIu8t04ilkb48j17O7n4QS7wFGaXJ8vqmycvnffEQavO5aoQT+qTvU5IWndCDYMClaqZdBfreqGIIXWqZkiM2X6zH7oBjxeiVeVMDaTcQzlyfby6Rk04iil9tHLqjyen30S3FO0MRbTzAHzQVaakER8UaopJoTHraVOPNGegOcYZs9qIByqcHCSgwimYMIuY1cPpOVsECKBmQTi1yJMSmchrwU2h9QPD2Y0iEviQU3xjTvnk2UkDWbCxnyQHZDjxxCVfieAtyoLK+J0RwYEbTr0owi1R3pTcrFlTsq5imzkXwxwPmAwhTj1vynOWrZnD9lBJ1KRTlOdq3jptKnGPuDDQfI5pYYJIPMzBTVT7uAPgK+uobEOeP0NhkK4KCIzACdC0BgiM+ti77f5+WAzhiacPf4/BJ/+QotwlgSk5y4+sx1UExl168ff8Pvy6QnvwVfkhcvE+0lMlM6s4fttkRoeyBJQyQMhYa0ORquFDmcHUukwH+1CSXnkKoD0q05SYlExD8XcdMgwri7PWjdOU0ar7N4/Ai/SJ9+ZCd+RiGNn7Ei6vjXSssg/NRMZNmWYluaXblMMz4VRNMnSz8oeh4Y2wFGe4vPym/5hcTz3MErryn9NPoD59XbCEIgL+T+/mIvofhwgmFjcaDZFeWsN1YnEcUF6JfyfhvpOaVTMgIZqYzKveZkmMZhpFxDUToq4LAjOKwLVnk33vqkX41Bv2b5bd3sP80bwwTs0HZAmEmXMcMoPreDCqLKKUoEKV0p5qqBIeozeP6ghN1WhwKX82RaLZhjsc8bFex3KNkc0QIJMSPGpT8EyOVBEkQjSBzLW2ZM5b72ZkDo8yL621wqZbdix0UZqlCaErR6GXFp5xfDQkF3mzXcmdL5ZoRu7qUe4lB2fkrqqGqLBrq3JXeUEcmstbOrlNx+xXJaKrbu4q/tu6m6vRXBGxUFnXkzUB4yGyLvE2I/ZCrGqcjUo9itusfpP3Kd9vVFb7iztJz2qA5watFSSL5l8/fFux+/BY1b6sshtV+7JKG1q3LzpjXwwoQQAwZ5ENbDOMd8bN2G51FrU7tzZGLSNqN8uikizL3WL4ixgksv+uk2dQ6rIlsiBBgr+zPCxSNXbopiWq8nMQPvqB5ZDxY5PnjTy76CDL32R9JM+Y+WSyPT5XU9ZgyB65tuLYsidlbdwx9bHKtAN235NimpJpcuZdkQX2XS23AzTv8x9kCqSzpRqOdfmgcGrNo71u1V4DkQvLYPlYIXoYFaIAmrR93H6JqBhjfNHQMamxnkBVQwKQNiE7z2rkHu9hrXZtRj/aXp2AAqDERix0IAF54xVK1LWuGZLB1DDufqHi4xjvLER6i1uB6OKtuZWVbqXUP6uqSpyNZAhURdeR1K9H6plkjqYJDJxoJ1MTFdliqOm1UNssrI+OYf2K4WHlLjjEYruZWz528VdHSoHK5M6RiUQZta1GS4F5iOTiba70dqsJV2K9feaicwzWkBlHY22uoiqI7UwzN/Wo657FbJ3OR10/OOYDWnY4QVO1guLCg7ZKjLTjUlWKVkN7tlTlinj0qN8sSoZ17N6dFgTcjiveRgHnlSveq0sj3JJTr5tlyK0oZn7nzkEgs5vD2Z6aWhYRW4VFr3Kvf4BZR1taFusLs1oMFmgkWNBL9nflUQFui1eyzUoOS48iTQT63hTbRKdDZS5Fe79eyWlWEozzbNc9yWkK9loNisFUs6F0MvMYwVhrTWH37SLBGXiK6DTGJryoz/bnjx9GPefLIjqD3Tn89e3b5SFtyXqbVF53bJTtWG8A2FyLuj+2e4PYqxBO4HDg9N6A/3YZyqqTVPYmJc4wZdVU3gfw5ksk61SS2d2X14E0RTWEugE5ppEV9ez7Xr1Vmr7Xe/W6jJgBG09qZHfe4tv49uPJ072igbllRS/mow12dJxWzZGxB18skVDMtc7DKM6lb3cnGR1aRABIGr+5XhOcIKsYktLA9noh5nZToPO3Yq7qObW4V0lRJfZsWsQ7BQgVAGs61CSEEl+Hc4TSvkPJ0HUJGLVHJRiiA8y2jStRaQaDqwYO+2trhoHMnruVF79Qh6m2daLfKo7Pnap4V8RnDvq8VEzZmCnXtznlQhCLzoc6Gsf9No5ANqEE6OP3EOQ527YNougQgCOWNvQT2gMR41DW1MG0SPx/336fTK4s5N/KU2NgPYwunEntUTB/azmSzobRTV6R26pFEgrgLwh77tfOzZX51mrcc5U+tB7ZR1y1x3trqzVVnPtsPPJpyOIHNZZkvRo4cPDDAKPz6e97qF4+ngz+eyd/c4k+3CLwvto7/FsohiPXOEDeikxNYqLjUDMlE3JoUnXJgDyeNFkCDRAPIaL4KPff5XwWBj3PExk6r8RC57OJ304RTvkakbm2yB1TRMnVBY6gbXN6TqoytaGG+F+9UdpUGw2ZkkL/4KCi8iwR5BlGSnhs2rEx4a0ROdiN8IrC2fpS220KD5gSNnzlH9r8mbLwaFlKrEbh7NOSLdsbF+4asc3j8ro3rjz7Q0yqrm85h2d/WM7G37pgcKki8/HXr2uofBFQ5c/h2Jp5f6w4q+Er11YMIyxzP2fPXlIk+A8p2uOLuA+VSOuqvlMiLRTSGkR6R2uwYbviNXhoIBXxEYF2zbhpSgjWnRAORT9EJxfSpc02Yn/epDFZHpPmB+gU6eR0eYYVGFBgGNr1iYSAOqbODxBQmoGJYeUcd+Z3msS/EL0DcPEOxH+aHiBTl1RaVnjZl1D1RH5j12xhDb/gyBaw1qjUD30wZEFo3XdAF0QHPhyt+35bd01RJKTVhhMMICHeSOzAuItOxNwPQ7FPoT1Npj1CRYMi+bUX2RPKji/D4mT3Ts2sZnwZHRpakWdL+DOPQgkwUpRl25ZrN263p3ysuBRJ57mUQvgXLzBoSNBsSWSAj7UcZZZ77ooEmdSHIHreqNDwZRiQXbLFe+dkwq4DxyV3/B8= \ No newline at end of file diff --git a/layouts/partials/logo.html b/layouts/partials/logo.html new file mode 100644 index 0000000..a4e4507 --- /dev/null +++ b/layouts/partials/logo.html @@ -0,0 +1 @@ +AWS-Logo_White-Color diff --git a/layouts/partials/menu-footer.html b/layouts/partials/menu-footer.html new file mode 100644 index 0000000..04ed0f4 --- /dev/null +++ b/layouts/partials/menu-footer.html @@ -0,0 +1,4 @@ + +