template.yml

AWSTemplateFormatVersion: 2010-09-09
Transform:
- AWS::Serverless-2016-10-31
- AWS::CodeStar

Parameters:
  ProjectId:
    Type: String
    Description: AWS CodeStar projectID used to associate new resources to team members
  CodeDeployRole:
    Type: String
    Description: IAM role to allow AWS CodeDeploy to manage deployment of AWS Lambda functions
  Stage:
    Type: String
    Description: The name for a project pipeline stage, such as Staging or Prod, for which resources are provisioned and deployed.
    Default: ''

Globals:
  Function:
    AutoPublishAlias: live
    Tracing: Active
    Environment:
      Variables:
        PICTURE_BUCKET: picminder.aleonard.dev.pictures
    DeadLetterQueue:
      Type: SNS
      TargetArn: arn:aws:sns:us-west-2:917159232232:DeadLetterTopic
  Api:
    Cors:
      AllowMethods: "'OPTIONS,GET'"
      AllowHeaders: "'Content-Type'"
      AllowOrigin: "'*'"

Resources:
  # begin frontend
  S3WebsiteBucket:
    Type: AWS::S3::Bucket
    Properties:
      BucketName: picminder.aleonard.dev
      BucketEncryption:
        ServerSideEncryptionConfiguration:
          - ServerSideEncryptionByDefault:
              SSEAlgorithm: AES256
      WebsiteConfiguration:
        IndexDocument: index.html
      Tags:
        - Key: Project
          Value: PicMinder
  OriginIdentity:
    Type: AWS::CloudFront::CloudFrontOriginAccessIdentity
    Properties:
      CloudFrontOriginAccessIdentityConfig:
        Comment: "picminder.aleonard.dev origin"
    DependsOn: S3WebsiteBucket
  S3WebsiteBucketPolicy:
    Type: AWS::S3::BucketPolicy
    Properties:
      Bucket: !Ref S3WebsiteBucket
      PolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Action:
              - "s3:GetObject"
            Effect: "Allow"
            Resource: arn:aws:s3:::picminder.aleonard.dev/*
            Principal:
              AWS: !Join ["", ["arn:aws:iam::cloudfront:user/CloudFront Origin Access Identity ", !Ref OriginIdentity] ]
    DependsOn: OriginIdentity
  WebsiteDistribution:
    Type: AWS::CloudFront::Distribution
    Properties:
      DistributionConfig:
        Origins:
          - Id: S3WebsiteBucket
            DomainName: picminder.aleonard.dev.s3.amazonaws.com
            S3OriginConfig:
              OriginAccessIdentity: !Join ["", ["origin-access-identity/cloudfront/", !Ref OriginIdentity] ]
        Enabled: 'true'
        DefaultRootObject: index.html
        Aliases:
          - picminder.aleonard.dev
        DefaultCacheBehavior:
          AllowedMethods:
            - GET
            - HEAD
            - OPTIONS
          CachedMethods:
            - GET
            - HEAD
            - OPTIONS
          Compress: true
          ViewerProtocolPolicy: redirect-to-https
          TargetOriginId: S3WebsiteBucket
          ForwardedValues:
            QueryString: false
          CachePolicyId: "658327ea-f89d-4fab-a63d-7e88639e58f6"
        PriceClass: PriceClass_100
        ViewerCertificate:
          AcmCertificateArn: arn:aws:acm:us-east-1:917159232232:certificate/408296a8-d7c1-494a-b9ff-abe529616322
          MinimumProtocolVersion: TLSv1.2_2018
          SslSupportMethod: sni-only
        HttpVersion: http2
        IPV6Enabled: true
      Tags:
        - Key: Project
          Value: PicMinder
    DependsOn: S3WebsiteBucketPolicy
  DnsZoneIPv4:
    Type: AWS::Route53::RecordSet
    Properties:
      AliasTarget:
        DNSName:
          Fn::GetAtt:
            - WebsiteDistribution
            - DomainName
        EvaluateTargetHealth: false
        HostedZoneId: Z2FDTNDATAQYW2
      HostedZoneName: aleonard.dev.
      Name: picminder.aleonard.dev.
      Type: A
    DependsOn: WebsiteDistribution
  DnsZoneIPv6:
    Type: AWS::Route53::RecordSet
    Properties:
      AliasTarget:
        DNSName:
          Fn::GetAtt:
            - WebsiteDistribution
            - DomainName
        EvaluateTargetHealth: false
        HostedZoneId: Z2FDTNDATAQYW2
      HostedZoneName: aleonard.dev.
      Name: picminder.aleonard.dev.
      Type: AAAA
    DependsOn: WebsiteDistribution
  # end frontend
  # begin backend
  API:
    Type: AWS::Serverless::Api
    Properties:
      Name: PicminderApi
      Domain:
        DomainName: picminder-api.aleonard.dev
        CertificateArn: arn:aws:acm:us-west-2:917159232232:certificate/ba2d0a69-0de2-44ff-b3bd-e3acef4c9122
        Route53:
          HostedZoneId: Z21QA4NBX4IRX8
      StageName: prod
      TracingEnabled: true
  OptionsFunction:
    Type: AWS::Serverless::Function
    Properties:
      FunctionName: PicMinderOptions
      Handler: api/options.handler
      Runtime: python3.7
      MemorySize: 128
      Timeout: 3
      Role:
        Fn::GetAtt:
          - LambdaExecutionRole
          - Arn
      Events:
        GetEvent:
          Type: Api
          Properties:
            Path: /
            Method: options
            RestApiId: !Ref API
  GetUploadUrlFunction:
    Type: AWS::Serverless::Function
    Properties:
      FunctionName: PicMinderGetUploadUrl
      Handler: api/get_upload_url.handler
      Runtime: python3.7
      MemorySize: 128
      Timeout: 3
      Role:
        Fn::GetAtt:
          - LambdaExecutionRole
          - Arn
      Events:
        GetEvent:
          Type: Api
          Properties:
            Path: /get_upload_url/
            Method: get
            RestApiId: !Ref API
  ProcessUploadFunction:
    Type: AWS::Serverless::Function
    Properties:
      FunctionName: PicMinderProcessUpload
      Handler: api/process_upload.handler
      Runtime: python3.7
      MemorySize: 512
      Timeout: 120
      Layers:
        - !Ref Libs
      Role:
        Fn::GetAtt:
          - LambdaExecutionRole
          - Arn
      Events:
        S3Event:
          Type: S3
          Properties:
            Bucket: !Ref PictureBucket # creates circular dependency
            Events: s3:ObjectCreated:*
            Filter:
              S3Key:
                Rules:
                - Name: prefix
                  Value: input_
  Libs:
    Type: AWS::Serverless::LayerVersion
    Properties:
      LayerName: PythonPilLayer
      Description: PIL dependency for ProcessUploadFunction
      ContentUri: api/pillow.zip
      CompatibleRuntimes:
        - python3.7
  GetDownloadUrlFunction:
    Type: AWS::Serverless::Function
    Properties:
      FunctionName: PicMinderGetDownloadUrl
      Handler: api/get_download_url.handler
      Runtime: python3.7
      MemorySize: 128
      Timeout: 3
      Role:
        Fn::GetAtt:
          - LambdaExecutionRole
          - Arn
      Events:
        GetEvent:
          Type: Api
          Properties:
            Path: /get_download_url/
            Method: get
            RestApiId: !Ref API
  PictureBucket:
    Type: AWS::S3::Bucket
    Properties:
      BucketName: picminder.aleonard.dev.pictures
      BucketEncryption:
        ServerSideEncryptionConfiguration:
          - ServerSideEncryptionByDefault:
              SSEAlgorithm: AES256
      CorsConfiguration:
        CorsRules:
          -
            AllowedMethods:
              - HEAD
              - GET
              - PUT
              - DELETE
            AllowedOrigins:
              - '*'
            AllowedHeaders:
              - '*'
      LifecycleConfiguration:
        Rules:
        - Id: DeletionRule
          Status: Enabled
          ExpirationInDays: '1'
      Tags:
        - Key: Project
          Value: PicMinder
  PictureBucketPolicy:
    Type: AWS::S3::BucketPolicy
    Properties:
      Bucket: !Ref PictureBucket
      PolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Action:
              - "s3:GetObject"
              - "s3:PutObject"
              - "s3:DeleteObject"
            Effect: "Allow"
            Resource: arn:aws:s3:::picminder.aleonard.dev.pictures/*
            Principal: "*" # TODO: change to lambda arn
    DependsOn: PictureBucket
  LambdaExecutionRole:
    Description: Creating service role in IAM for AWS Lambda
    Type: AWS::IAM::Role
    Properties:
      RoleName: !Sub 'CodeStar-${ProjectId}-Execution${Stage}'
      AssumeRolePolicyDocument:
        Statement:
        - Effect: Allow
          Principal:
            Service: [lambda.amazonaws.com]
          Action: sts:AssumeRole
      Path: /
      ManagedPolicyArns:
        - !Sub 'arn:${AWS::Partition}:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole'
        - arn:aws:iam::917159232232:policy/XRayPutTraceSegments
      Policies:
        -
          PolicyName: !Sub 'CodeStar-${ProjectId}-Execution${Stage}-inline-policy'
          PolicyDocument: {
              "Version": "2012-10-17",
              "Statement": [
                  {
                    "Effect": "Allow",
                    "Action": "s3:*",
                    "Resource": "arn:aws:s3:::picminder.aleonard.dev.pictures/*"
                  },{
                    "Effect": "Allow",
                    "Action": "sns:*",
                    "Resource": "*"
                  }
              ]
          }
  # end backend