cloudformation.yml

AWSTemplateFormatVersion: 2010-09-09
Transform: AWS::Serverless-2016-10-31

Parameters:
  PROJECT:
    Type: String
  ENVIRONMENT:
    Type: String

Mappings:
  dev:
    api:
      hostname: aws.triplehead.net

Globals:
  Function:
    Runtime: nodejs16.x
    Timeout: 30
    Handler: index.handler
    Tracing: Active
    Environment:
      Variables:
        API_BASE_PATH: !Sub ${PROJECT}
        ENVIRONMENT: !Sub ${ENVIRONMENT}
        JOBS_TABLE: !Sub ${PROJECT}-jobs-${ENVIRONMENT}
        LOG_LEVEL: info
        PROJECT: !Sub ${PROJECT}
        TIMER_QUEUE_URL: !Ref TimerQueue
        EVENTBRIDGE_HANDLER_ARN: !Sub arn:aws:lambda:${AWS::Region}:${AWS::AccountId}:function:${PROJECT}-eventbridge-${ENVIRONMENT}
        EVENTBRIDGE_ROLE_ARN: !GetAtt EventbridgeExecutionRole.Arn

Resources:
  #region REST API
  ApiGateway:
    Type: AWS::Serverless::Api
    Properties:
      Name: !Sub ${PROJECT}-${ENVIRONMENT}
      StageName: !Ref ENVIRONMENT
      Cors:
        AllowMethods: "'POST, GET, OPTIONS'"
        AllowHeaders: "'Content-Type'"
        AllowOrigin: "'*'"
      DefinitionBody:
        Fn::Transform:
          Name: AWS::Include
          Parameters:
            Location: swagger.yaml

  BasePath:
    Type: AWS::ApiGateway::BasePathMapping
    Properties:
      BasePath: !Sub ${PROJECT}
      DomainName: !FindInMap [!Ref ENVIRONMENT, api, hostname]
      RestApiId: !Ref ApiGateway
      Stage: !Ref ApiGateway.Stage

  ApiLambda:
    Type: AWS::Serverless::Function
    Properties:
      FunctionName: !Sub ${PROJECT}-api-${ENVIRONMENT}
      CodeUri: dist/src/
      Handler: apiHandler.handler
      Policies:
      - Version: 2012-10-17
        Statement:
          - Effect: Allow
            Action:
            - dynamodb:GetItem
            - dynamodb:PutItem
            - dynamodb:UpdateItem
            - dynamodb:Query
            - dynamodb:Scan
            Resource: !Join [ "", [ !GetAtt JobsTable.Arn, "*" ]]
          - Effect: Allow
            Action:
              - sqs:SendMessage
            Resource: !GetAtt TimerQueue.Arn
          - Effect: Allow
            Action:
              - scheduler:CreateSchedule
              - scheduler:UpdateSchedule
              - scheduler:DeleteSchedule
            Resource: !Sub arn:aws:scheduler:${AWS::Region}:${AWS::AccountId}:schedule/*
          - Effect: Allow
            Action:
              - iam:PassRole
            Resource: !GetAtt EventbridgeExecutionRole.Arn

  ApiLambdaInvokePermission:
    Type: AWS::Lambda::Permission
    Properties:
      FunctionName: !Ref ApiLambda
      Action: lambda:InvokeFunction
      Principal: apigateway.amazonaws.com

  ApiHandlerLogGroup:
    Type: AWS::Logs::LogGroup
    Properties:
      LogGroupName: !Sub /aws/lambda/${ApiLambda}
      RetentionInDays: 60
  #endregion

  #region DynamoDB table and stream handler lambda
  JobsTable:
    Type: AWS::DynamoDB::Table
    DeletionPolicy: Retain
    Properties:
      TableName: !Sub ${PROJECT}-jobs-${ENVIRONMENT}
      BillingMode: PAY_PER_REQUEST
      PointInTimeRecoverySpecification:
        PointInTimeRecoveryEnabled: true
      SSESpecification:
        SSEEnabled: true
      StreamSpecification:
        StreamViewType: OLD_IMAGE
      TimeToLiveSpecification:
        AttributeName: ttlUnixSeconds
        Enabled: true
      AttributeDefinitions:
        - AttributeName: id
          AttributeType: S
      KeySchema:
        - AttributeName: id
          KeyType: HASH

  DynamoStreamLambda:
    Type: AWS::Serverless::Function
    Properties:
      FunctionName: !Sub ${PROJECT}-dynamodb-${ENVIRONMENT}
      CodeUri: dist/src/
      Handler: dynamoHandler.handler
      Policies:
        - arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole
        - Version: 2012-10-17
          Statement:
            - Effect: Allow
              Action:
              - dynamodb:GetItem
              - dynamodb:PutItem
              - dynamodb:UpdateItem
              - dynamodb:Query
              - dynamodb:Scan
              Resource: !Join [ "", [ !GetAtt JobsTable.Arn, "*" ]]
            - Effect: Allow
              Action:
              - dynamodb:DescribeStream
              - dynamodb:GetRecords
              - dynamodb:GetShardIterator
              - dynamodb:ListStreams
              Resource: !GetAtt JobsTable.StreamArn
            - Effect: Allow
              Action:
              - cloudwatch:PutMetricData
              Resource: '*'
              Condition:
                StringEquals:
                  'cloudwatch:namespace': !Sub ${PROJECT}
            - Effect: Allow
              Action:
                - sqs:SendMessage
              Resource: !GetAtt TimerQueue.Arn
            - Effect: Allow
              Action:
                - scheduler:CreateSchedule
                - scheduler:UpdateSchedule
                - scheduler:DeleteSchedule
              Resource: !Sub arn:aws:scheduler:${AWS::Region}:${AWS::AccountId}:schedule/*
            - Effect: Allow
              Action:
                - iam:PassRole
              Resource: !GetAtt EventbridgeExecutionRole.Arn

  DynamoStreamLambdaLogGroup:
    Type: AWS::Logs::LogGroup
    Properties:
      LogGroupName: !Sub /aws/lambda/${DynamoStreamLambda}
      RetentionInDays: 60

  DynamoStreamLambdaStreamSubscription:
    Type: AWS::Lambda::EventSourceMapping
    Properties:
      BatchSize: 100
      Enabled: true
      EventSourceArn: !GetAtt JobsTable.StreamArn
      FunctionName: !GetAtt DynamoStreamLambda.Arn
      StartingPosition: LATEST
  #endregion

  #region SQS queue and handler
  TimerQueue:
    Type: AWS::SQS::Queue
    Properties:
      QueueName: !Sub ${PROJECT}-timers-${ENVIRONMENT}
      MessageRetentionPeriod: 1209600

  TimerQueueLambda:
    Type: AWS::Serverless::Function
    Properties:
      FunctionName: !Sub ${PROJECT}-sqs-${ENVIRONMENT}
      CodeUri: dist/src/
      Handler: sqsHandler.handler
      Events:
        EmailSqsEvents:
          Type: SQS
          Properties:
            Queue: !GetAtt TimerQueue.Arn
            BatchSize: 10
            Enabled: true
      Policies:
        - Version: 2012-10-17
          Statement:
            - Effect: Allow
              Action:
                - sqs:ReceiveMessage
                - sqs:DeleteMessage
                - sqs:ChangeMessageVisibility
                - sqs:GetQueueAttributes
              Resource: !GetAtt TimerQueue.Arn
            - Effect: Allow
              Action:
                - sqs:SendMessage
              Resource: !GetAtt TimerQueue.Arn
            - Effect: Allow
              Action:
              - dynamodb:GetItem
              - dynamodb:PutItem
              - dynamodb:UpdateItem
              - dynamodb:Query
              - dynamodb:Scan
              Resource: !Join [ "", [ !GetAtt JobsTable.Arn, "*" ]]
            - Effect: Allow
              Action:
                - scheduler:CreateSchedule
                - scheduler:UpdateSchedule
                - scheduler:DeleteSchedule
              Resource: !Sub arn:aws:scheduler:${AWS::Region}:${AWS::AccountId}:schedule/*
            - Effect: Allow
              Action:
                - iam:PassRole
              Resource: !GetAtt EventbridgeExecutionRole.Arn

  TimerQueueLambdaLogGroup:
    Type: AWS::Logs::LogGroup
    Properties:
      LogGroupName: !Sub /aws/lambda/${TimerQueueLambda}
      RetentionInDays: 60
  #endregion

  #region Eventbridge handler and IAM execution role
  EventbridgeLambda:
    Type: AWS::Serverless::Function
    Properties:
      FunctionName: !Sub ${PROJECT}-eventbridge-${ENVIRONMENT}
      CodeUri: dist/src/
      Handler: eventbridgeHandler.handler
      Policies:
        - Version: 2012-10-17
          Statement:
            - Effect: Allow
              Action:
                - scheduler:DeleteSchedule
              Resource: !Sub arn:aws:scheduler:${AWS::Region}:${AWS::AccountId}:schedule/*
            - Effect: Allow
              Action:
                - sqs:SendMessage
              Resource: !GetAtt TimerQueue.Arn
            - Effect: Allow
              Action:
              - dynamodb:GetItem
              - dynamodb:PutItem
              - dynamodb:UpdateItem
              - dynamodb:Query
              Resource: !Join [ "", [ !GetAtt JobsTable.Arn, "*" ]]
            - Effect: Allow
              Action:
                - scheduler:CreateSchedule
                - scheduler:UpdateSchedule
                - scheduler:DeleteSchedule
              Resource: !Sub arn:aws:scheduler:${AWS::Region}:${AWS::AccountId}:schedule/*
            - Effect: Allow
              Action:
                - iam:PassRole
              Resource: !GetAtt EventbridgeExecutionRole.Arn

  EventbridgeLambdaLogGroup:
    Type: AWS::Logs::LogGroup
    Properties:
      LogGroupName: !Sub /aws/lambda/${EventbridgeLambda}
      RetentionInDays: 60

  EventbridgeExecutionRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Statement:
          - Effect: Allow
            Action: sts:AssumeRole
            Principal:
              Service: scheduler.amazonaws.com
      Policies:
        - PolicyName: InvokeEventbridgeHandlerLambda
          PolicyDocument:
            Statement:
              - Effect: Allow
                Action:
                  - lambda:InvokeFunction
                Resource:
                  # using !Sub because !GetAtt EventbridgeLambda.Arn would cause a circular dependency
                  - !Sub arn:aws:lambda:${AWS::Region}:${AWS::AccountId}:function:${PROJECT}-eventbridge-${ENVIRONMENT}

  EventbridgeScheduleGroup:
    Type: AWS::Scheduler::ScheduleGroup
    Properties:
      Name: !Sub ${PROJECT}-${ENVIRONMENT}
  #endregion