template.yaml

AWSTemplateFormatVersion: "2010-09-09"
Transform: AWS::Serverless-2016-10-31
Description: >
  proj-pronetplat-aa

  Sample SAM Template for proj-pronetplat-aa
  
Mappings:
  stageVars:
    dev:
      appPackageName: com.aprmp.projpronetplataa.dev
      apiSubDomain: api-dev
      webSocketSubDomain: websocket-dev
    prod:
      appPackageName: com.aprmp.projpronetplataa
      apiSubDomain: api
      webSocketSubDomain: websocket

Parameters:
  Stage:
    Description: Stage of the current build
    Type: String
    AllowedValues:
      - dev
      - prod
  FaunadbSecret:
    Description: Faunadb secret
    Type: String
    
# More info about Globals: /~https://github.com/awslabs/serverless-application-model/blob/master/docs/globals.rst
Globals:
  Function:
    Layers:
      - !Ref dependencies
    MemorySize: 4096
    Runtime: nodejs14.x
    EventInvokeConfig:
      MaximumRetryAttempts: 0
    Environment:
      Variables:
        stage: !Ref Stage
        faunadbSecret: !Ref FaunadbSecret
        appPackageName: !FindInMap
          - stageVars
          - !Ref Stage
          - appPackageName
        usersBucket: !Join
          - "-"
          - - !Ref Stage
            - "proj-pronetplat-aa-users"
        fn_invokeApi: !Join
        - '-'
        - - !Ref Stage
          - "proj-pronetplat-aa-invokeApi"

Resources:
  # Functions
  httpApi:
    Type: AWS::Serverless::Function
    Metadata:
      BuildMethod: makefile
    Properties:
      Handler: httpApi/index.handler
      Timeout: 30
      FunctionName: !Join
        - '-'
        - - !Ref Stage
          - "proj-pronetplat-aa-httpApi"
      Policies:
        - LambdaInvokePolicy:
            FunctionName: !Ref invokeApi
        - S3CrudPolicy:
            BucketName: !Join
              - "-"
              - - !Ref Stage
                - "proj-pronetplat-aa-users"
      Events:
        ApiEvent:
          Type: Api
          Properties:
            Method: any
            Path: /{proxy+}
            RestApiId: !Ref mainBackendApi
  invokeApi:
    Type: AWS::Serverless::Function
    Metadata:
      BuildMethod: makefile
    Properties:
      Handler: invokeApi/index.handler
      Timeout: 900
      FunctionName: !Join
        - '-'
        - - !Ref Stage
          - "proj-pronetplat-aa-invokeApi"
      Policies:
        - LambdaInvokePolicy:
            FunctionName: !Join
              - '-'
              - - !Ref Stage
                - "proj-pronetplat-aa-invokeApi"
        - Statement:
          - Action:
              - ses:SendEmail
            Effect: Allow
            Resource: "*"
        - S3CrudPolicy:
            BucketName: !Join
              - "-"
              - - !Ref Stage
                - "proj-pronetplat-aa-users"
        - Statement:
          - Action:
              - execute-api:ManageConnections
            Effect: Allow
            Resource: "*"
      Events:
        newProfilePicture:
          Type: S3
          Properties:
            Bucket: !Ref usersS3Bucket
            Events: s3:ObjectCreated:Put
            Filter:
              S3Key:
                Rules:
                  - Name: prefix
                    Value: newProfilePicture_
        newEventCoverPicture:
          Type: S3
          Properties:
            Bucket: !Ref usersS3Bucket
            Events: s3:ObjectCreated:Put
            Filter:
              S3Key:
                Rules:
                  - Name: prefix
                    Value: newEventCoverPicture_
  # Websocket
  webSocketCloudfront:
    Type: AWS::CloudFront::Distribution
    Properties:
      DistributionConfig:
        Enabled: true
        IPV6Enabled: true
        HttpVersion: http2
        Aliases:
          - !Sub
            - ${webSocketSubDomain}.entrepic.com
            - webSocketSubDomain: !FindInMap
              - stageVars
              - !Ref Stage
              - webSocketSubDomain
        Origins:
        - Id: webSocketOrigin
          DomainName: !Sub ${webSocket}.execute-api.${AWS::Region}.amazonaws.com
          OriginPath: !Sub /${Stage}
          CustomOriginConfig:
            OriginProtocolPolicy: https-only
            OriginSSLProtocols:
              - TLSv1.2
        DefaultCacheBehavior:
          AllowedMethods: ["DELETE", "GET", "HEAD", "OPTIONS", "PATCH", "POST", "PUT"]
          CachePolicyId: ffac0a92-6907-4751-84fc-c9cd1af51234
          OriginRequestPolicyId: 38846f4d-af2f-411d-aeb5-ce2afcfe00d2
          TargetOriginId: webSocketOrigin
          ViewerProtocolPolicy: https-only
        ViewerCertificate:
          AcmCertificateArn: arn:aws:acm:us-east-1:127336369406:certificate/ffe2d370-424a-4c2b-a944-53a74a8c1b97
          MinimumProtocolVersion: TLSv1.2_2018
          SslSupportMethod: sni-only
  webSocketCustomDomainRoute53:
    Type: AWS::Route53::RecordSet
    Properties:
      Type: A
      HostedZoneId: Z0450109WGLMG82TZFOY
      Name: !Sub
        - ${webSocketSubDomain}.entrepic.com
        - webSocketSubDomain: !FindInMap
          - stageVars
          - !Ref Stage
          - webSocketSubDomain
      AliasTarget: 
        HostedZoneId: Z2FDTNDATAQYW2 # constant for cloudfront
        DNSName: !GetAtt webSocketCloudfront.DomainName
  webSocket:
    Type: AWS::ApiGatewayV2::Api
    Properties:
      Name: !Join
        - '-'
        - - !Ref Stage
          - "proj-pronetplat-aa-webSocket"
      ProtocolType: WEBSOCKET
      RouteSelectionExpression: "$request.body.action"
  webSocketDeployment:
    Type: AWS::ApiGatewayV2::Deployment
    DependsOn:
      - connectRoute
      - disconnectRoute
      - defaultWebSocketRoute
    Properties:
      ApiId: !Ref webSocket
  webSocketStage:
    Type: AWS::ApiGatewayV2::Stage
    Properties:
      StageName: !Ref Stage
      DeploymentId: !Ref webSocketDeployment
      ApiId: !Ref webSocket
  webSocketApi:
    Type: AWS::Serverless::Function
    Metadata:
      BuildMethod: makefile
    Properties:
      Handler: webSocketApi/index.handler
      Timeout: 30
      Policies:
        - Statement:
          - Action:
              - execute-api:ManageConnections
            Effect: Allow
            Resource: "*"
      FunctionName: !Join
        - '-'
        - - !Ref Stage
          - "proj-pronetplat-aa-webSocketApi"
  webSocketApiPermission:
    Type: AWS::Lambda::Permission
    DependsOn:
      - webSocket
    Properties:
      Action: lambda:InvokeFunction
      FunctionName: !Ref webSocketApi
      Principal: apigateway.amazonaws.com
  connectInteg:
    Type: AWS::ApiGatewayV2::Integration
    Properties:
      ApiId: !Ref webSocket
      Description: Connect Integration
      IntegrationType: AWS_PROXY
      IntegrationUri: !Sub arn:aws:apigateway:${AWS::Region}:lambda:path/2015-03-31/functions/${webSocketApi.Arn}/invocations
  connectRoute:
    Type: AWS::ApiGatewayV2::Route
    Properties:
      ApiId: !Ref webSocket
      RouteKey: $connect
      AuthorizationType: NONE
      OperationName: ConnectRoute
      Target: !Join
        - '/'
        - - 'integrations'
          - !Ref connectInteg
  disconnectInteg:
    Type: AWS::ApiGatewayV2::Integration
    Properties:
      ApiId: !Ref webSocket
      Description: Disconnect Integration
      IntegrationType: AWS_PROXY
      IntegrationUri: !Sub arn:aws:apigateway:${AWS::Region}:lambda:path/2015-03-31/functions/${webSocketApi.Arn}/invocations
  disconnectRoute:
    Type: AWS::ApiGatewayV2::Route
    Properties:
      ApiId: !Ref webSocket
      RouteKey: $disconnect
      AuthorizationType: NONE
      OperationName: DisconnectRoute
      Target: !Join
        - '/'
        - - 'integrations'
          - !Ref disconnectInteg
  defaultWebSocketRouteInteg:
    Type: AWS::ApiGatewayV2::Integration
    Properties:
      ApiId: !Ref webSocket
      Description: any websocket routes
      IntegrationType: AWS_PROXY
      IntegrationUri: !Sub arn:aws:apigateway:${AWS::Region}:lambda:path/2015-03-31/functions/${webSocketApi.Arn}/invocations
  defaultWebSocketRoute:
    Type: AWS::ApiGatewayV2::Route
    Properties:
      ApiId: !Ref webSocket
      RouteKey: $default
      AuthorizationType: NONE
      OperationName: defaultWebSocketRoute
      Target: !Join
        - '/'
        - - 'integrations'
          - !Ref defaultWebSocketRouteInteg
  # Lambda layers
  dependencies:
    Type: AWS::Serverless::LayerVersion
    Metadata:
      BuildMethod: makefile
    Properties:
      CompatibleRuntimes:
        - nodejs14.x
      ContentUri: dependencies
      LayerName: proj-pronetplat-aa
      RetentionPolicy: Delete
  # API
  mainBackendCloudfront:
    Type: AWS::CloudFront::Distribution
    Properties:
      DistributionConfig:
        Enabled: true
        IPV6Enabled: true
        HttpVersion: http2
        Aliases:
          - !Sub
            - ${apiSubDomain}.entrepic.com
            - apiSubDomain: !FindInMap
              - stageVars
              - !Ref Stage
              - apiSubDomain
        Origins:
        - Id: mainBackendApiOrigin
          DomainName: !Sub ${mainBackendApi}.execute-api.${AWS::Region}.amazonaws.com
          OriginPath: !Sub /${Stage}
          CustomOriginConfig:
            OriginProtocolPolicy: https-only
            OriginSSLProtocols:
              - TLSv1.2
        DefaultCacheBehavior:
          AllowedMethods: ["DELETE", "GET", "HEAD", "OPTIONS", "PATCH", "POST", "PUT"]
          CachePolicyId: ffac0a92-6907-4751-84fc-c9cd1af51234
          OriginRequestPolicyId: 7404f366-e3d3-47ca-8111-268449baa26e
          TargetOriginId: mainBackendApiOrigin
          ViewerProtocolPolicy: https-only
        ViewerCertificate:
          AcmCertificateArn: arn:aws:acm:us-east-1:127336369406:certificate/ffe2d370-424a-4c2b-a944-53a74a8c1b97
          MinimumProtocolVersion: TLSv1.2_2018
          SslSupportMethod: sni-only
  mainBackendCloudfrontCustomDomainRoute53:
    Type: AWS::Route53::RecordSet
    Properties:
      Type: A
      HostedZoneId: Z0450109WGLMG82TZFOY
      Name: !Sub
        - ${apiSubDomain}.entrepic.com
        - apiSubDomain: !FindInMap
          - stageVars
          - !Ref Stage
          - apiSubDomain
      AliasTarget: 
        HostedZoneId: Z2FDTNDATAQYW2 # constant for cloudfront
        DNSName: !GetAtt mainBackendCloudfront.DomainName
  mainBackendApi:
    Type: AWS::Serverless::Api
    Properties:
      StageName: !Ref Stage
      EndpointConfiguration:
        Type: REGIONAL
  # @todo re-add waf again some time in the future
  # mainBackendWebAcl:
  #   Type: AWS::WAFv2::WebACL
  #   Properties:
  #     DefaultAction:
  #       Block: {}
  #     Scope: CLOUDFRONT
  #     VisibilityConfig: 
  #       CloudWatchMetricsEnabled: true
  #       MetricName: !Join
  #         - "-"
  #         - - !Ref Stage
  #           - "proj-pronetplat-aa-users"
  #           - webacl
  #       SampledRequestsEnabled: true
  #     Rules:
  #       - Action:
  #           Block: {}
  #         Name: RateLimit
  #         Statement:
  #           RateBasedStatement:
  #             AggregateKeyType: IP
  #             Limit: 1500
  #         VisibilityConfig: 
  #           CloudWatchMetricsEnabled: true
  #           MetricName: !Join
  #             - "-"
  #             - - !Ref Stage
  #               - "proj-pronetplat-aa-users"
  #               - webacl-rate-limit
  #           SampledRequestsEnabled: true
  #         Priority: 0
  # #       - Action:
  # #           Allow: {}
  # #         Name: AllowedCounties
  # #         Statement:
  # #           GeoMatchStatement:
  # #             CountryCodes:
  # #               - AU
  # #               - PH
  # #               - US
  # #               - CA
  # #               - GB
  # #         VisibilityConfig: 
  # #           CloudWatchMetricsEnabled: true
  # #           MetricName: !Join
  # #             - "-"
  # #             - - !Ref Stage
  # #               - "proj-pronetplat-aa-users"
  # #               - webacl-allowed-countries
  # #           SampledRequestsEnabled: true
  # #         Priority: 1
  # mainBackendWebAclAssociations:
  #   Type: AWS::WAFv2::WebACLAssociation
  #   Properties: 
  #     ResourceArn: !Sub "arn:aws:apigateway:${AWS::Region}::/restapis/${mainBackendApi}/stages/${Stage}"
  #     WebACLArn: !GetAtt mainBackendWebAcl.Arn
  # S3 buckets
  usersS3Bucket:
    Type: AWS::S3::Bucket
    Properties:
      BucketName: !Join
        - "-"
        - - !Ref Stage
          - "proj-pronetplat-aa-users"
      CorsConfiguration:
        CorsRules:
        - AllowedHeaders:
            - "*"
          AllowedMethods:
            - GET
            - PUT
            - HEAD
          AllowedOrigins:
            - "*"
      MetricsConfigurations:
        - Id: "profilePicture_"
          Prefix: "profilePicture_"
        - Id: "newProfilePicture_"
          Prefix: "newProfilePicture_"
      AccelerateConfiguration:
        AccelerationStatus: Enabled
      Tags:
        - Key: "what"
          Value: "proj-pronetplat-aa users s3 bucket"

Outputs:
  mainBackendApi:
    Description: Rest API Gateway endpoint
    Value: !Sub https://${mainBackendApi}.execute-api.${AWS::Region}.amazonaws.com/${Stage}
  mainBackendCloudfront:
    Description: Rest API cloudfront endpoint
    Value: !Sub https://${mainBackendCloudfront.DomainName}
  mainBackendApiCustomDomain:
    Description: Rest API Gateway custom domain
    Value: !Sub
      - https://${apiSubDomain}.entrepic.com
      - apiSubDomain: !FindInMap
        - stageVars
        - !Ref Stage
        - apiSubDomain
  webSocket:
    Description: Websocket endpoint
    Value: !Sub ${webSocket.ApiEndpoint}/${Stage}
  webSocketCloudfront:
    Description: Websocket cloudfront endpoint
    Value: !Sub https://${webSocketCloudfront.DomainName}
  webSocketCustomDomain:
    Description: Websocket custom domain
    Value: !Sub
      - wss://${webSocketSubDomain}.entrepic.com
      - webSocketSubDomain: !FindInMap
        - stageVars
        - !Ref Stage
        - webSocketSubDomain