build-book-db.yml

# create-stack --stack-name s3-trigger-lambda --template-body file://s3-trigger-lambda.yml --capabilities CAPABILITY_NAMED_IAM
# ...wait a while...
# aws cloudformation list-stacks
# ...to see if it's been created...
# aws lambda invoke --invocation-type RequestResponse --function-name s3-trigger-lambda out.txt
# cat out.txt
# rm out.txt
# ...explore stack, lambda, role in the console if so inclined...
# aws cloudformation delete-stack --stack-name s3-trigger-lambda
AWSTemplateFormatVersion: 2010-09-09
Description: Offline portion of Book Finder App

Parameters:
  Unique:
    Type: String

  ApiGatewayName:
    Type: String
    Default: bookfinder-gateway

  RekogFunctionName:
    Type: String
    AllowedPattern: ^[a-zA-Z0-9]+[a-zA-Z0-9-]+[a-zA-Z0-9]+$
    Default: bookfinder-rekog-lambda

  SearchFunctionName:
    Type: String
    AllowedPattern: ^[a-zA-Z0-9]+[a-zA-Z0-9-]+[a-zA-Z0-9]+$
    Default: bookfinder-search-lambda

  ResultsTableName:
    Type: String
    Default: bookfinder-table

  ImageBucketName:
    Type: String
    Default: bookfinder-uploads

  ResultsBucketName:
    Type: String
    Default: bookfinder-results

  # Created in another stack--passed in--so no default
  ZipBucketName:
    Type: String

  ZipVersionId:
    Type: String

  ZipS3Key:
    Type: String
    Default: lambda.zip

Resources:
  # ------------------------------------------ API GATEWAY
  BookFinderGateway:
    Type: AWS::ApiGateway::RestApi
    Properties:
      Name: !Sub "${Unique}--${ApiGatewayName}"
      EndpointConfiguration:
        Types:
          - REGIONAL

  # ------------------------------------------ API GATEWAY (resources)

  BookFinderSearchResource:
    Type: AWS::ApiGateway::Resource
    Properties:
      ParentId: !GetAtt BookFinderGateway.RootResourceId
      PathPart: "search"
      RestApiId: !Ref BookFinderGateway

  # ------------------------------------------ API GATEWAY (methods)

  # Don't understand why HttpMethod and IntegrationHttpMethod are specified?
  # Why not just one? What happens if they differ?
  BookFinderSearchPOST:
    Type: AWS::ApiGateway::Method
    Properties:
      AuthorizationType: NONE
      ApiKeyRequired: false
      HttpMethod: POST
      Integration:
        Type: AWS_PROXY
        IntegrationHttpMethod: POST
        Uri: !Sub
          - arn:${AWS::Partition}:apigateway:${AWS::Region}:lambda:path/2015-03-31/functions/${lambdaArn}/invocations
          - lambdaArn: !GetAtt BookFinderSearchLambda.Arn
      OperationName: "search"
      ResourceId: !Ref BookFinderSearchResource
      RestApiId: !Ref BookFinderGateway

  BookFinderSearchOPTIONS:
    Type: AWS::ApiGateway::Method
    Properties:
      AuthorizationType: NONE
      ResourceId: !Ref BookFinderSearchResource
      RestApiId: !Ref BookFinderGateway
      HttpMethod: OPTIONS
      Integration:
        IntegrationResponses:
          - StatusCode: 200
            ResponseParameters:
              method.response.header.Access-Control-Allow-Headers: "'Content-Type,X-Amz-Date,Authorization,X-Api-Key,X-Amz-Security-Token'"
              method.response.header.Access-Control-Allow-Methods: "'POST,OPTIONS'"
              method.response.header.Access-Control-Allow-Origin: "'*'"
            ResponseTemplates:
              application/json: ""
        PassthroughBehavior: WHEN_NO_MATCH
        RequestTemplates:
          application/json: '{"statusCode": 200}'
        Type: MOCK
      MethodResponses:
        - StatusCode: 200
          ResponseModels:
            application/json: "Empty"
          ResponseParameters:
            method.response.header.Access-Control-Allow-Headers: false
            method.response.header.Access-Control-Allow-Methods: false
            method.response.header.Access-Control-Allow-Origin: false

  # ------------------------------------------ API GATEWAY (deployment/throttling/stage/logging)

  BookFinderDeployment:
    Type: AWS::ApiGateway::Deployment
    # An entry for each method
    DependsOn:
      - BookFinderSearchPOST
      - BookFinderGatewayLoggingRole
      - BookFinderSearchOPTIONS
    Properties:
      RestApiId: !Ref BookFinderGateway

  # Enable logging of all HTTP requests
  BookFinderStage:
    Type: AWS::ApiGateway::Stage
    Properties:
      DeploymentId: !Ref BookFinderDeployment
      # https://kb.novaordis.com/index.php/Amazon_API_Gateway_Deployment_with_CloudFormation#Access_Logging_Configuration
      AccessLogSetting:
        DestinationArn: !GetAtt BookFinderGatewayAccessLogGroup.Arn
        Format: >-
          {"requestId":"$context.requestId", "ip": "$context.identity.sourceIp",
          "caller":"$context.identity.caller",
          "user":"$context.identity.user","requestTime":"$context.requestTime",
          "eventType":"$context.eventType","routeKey":"$context.routeKey",
          "status":"$context.status","connectionId":"$context.connectionId"}
      MethodSettings:
        - HttpMethod: "*"
          LoggingLevel: INFO
          ResourcePath: /*
          DataTraceEnabled: true
      RestApiId: !Ref BookFinderGateway
      StageName: dev

  # https://gist.github.com/villasv/4f5b62a772abe2c06525356f80299048
  BookFinderGatewayAccountConfig:
    Type: "AWS::ApiGateway::Account"
    Properties:
      CloudWatchRoleArn: !GetAtt "BookFinderGatewayLoggingRole.Arn"

  BookFinderGatewayLoggingRole:
    Type: "AWS::IAM::Role"
    Properties:
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - "apigateway.amazonaws.com"
            Action: "sts:AssumeRole"
      Path: "/"
      ManagedPolicyArns:
        - !Sub "arn:${AWS::Partition}:iam::aws:policy/service-role/AmazonAPIGatewayPushToCloudWatchLogs"

  BookFinderGatewayAccessLogGroup:
    Type: AWS::Logs::LogGroup
    DeletionPolicy: Delete
    UpdateReplacePolicy: Delete
    Properties:
      LogGroupName: !Join [/, ["/aws/apigateway", !Ref BookFinderGateway]]
      RetentionInDays: 3

  BookFinderUsagePlan:
    Type: AWS::ApiGateway::UsagePlan
    Properties:
      ApiStages:
        - ApiId: !Ref BookFinderGateway
          Stage: !Ref BookFinderStage
      Quota:
        Limit: 50
        Period: DAY
      Throttle:
        BurstLimit: 2
        RateLimit: 1

  # ------------------------------------------ API GATEWAY (lambdas/roles/logs/invoke)

  BookFinderSearchLambdaRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Action: sts:AssumeRole
            Effect: Allow
            Principal:
              Service: lambda.amazonaws.com
      # So lambda can write logs
      ManagedPolicyArns:
        - "arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"

  BookFinderSearchLambda:
    Type: AWS::Lambda::Function
    Properties:
      FunctionName: !Sub "${Unique}--${SearchFunctionName}"
      Role: !GetAtt BookFinderSearchLambdaRole.Arn
      Environment:
        Variables:
          DB_TABLE_NAME: !Sub "${Unique}--${ResultsTableName}"
          RESULTS_BUCKET_NAME: !Sub "${Unique}--${ResultsBucketName}"
          UPLOADS_BUCKET_NAME: !Sub "${Unique}--${ImageBucketName}"
      Runtime: nodejs16.x
      Handler: search.handler
      Code:
        S3Bucket: !Ref ZipBucketName
        S3Key: !Ref ZipS3Key
        S3ObjectVersion: !Ref ZipVersionId
      Layers:
        - arn:aws:lambda:us-west-2:136545519964:layer:canvas-nodejs:4
      MemorySize: 1024
      Timeout: 60

  # Thanks https://ldoughty.com/2020/01/aws-http-api-gateway-cloudformation-setup/
  BookFinderSearchLambdaLogGroup:
    Type: AWS::Logs::LogGroup
    DeletionPolicy: Delete
    UpdateReplacePolicy: Delete
    Properties:
      LogGroupName: !Join [/, ["/aws/lambda", !Ref BookFinderSearchLambda]]
      RetentionInDays: 3

  BookFinderGatewayInvoke:
    Type: AWS::Lambda::Permission
    Properties:
      Action: lambda:InvokeFunction
      FunctionName: !GetAtt BookFinderSearchLambda.Arn
      Principal: apigateway.amazonaws.com
      # Specification of ARN allows only that endpoint to execute lambda? Check this out.
      # note: if route *not* at API Gateway root, `SourceArn` would take the form of:
      #               arn:aws:execute-api:${AWS::Region}:${AWS::AccountId}:${apiGateway}/${apiGatewayStageName}/${apiGatewayHTTPMethod}/PATH_PART
      #SourceArn: !Sub arn:${AWS::Partition}:execute-api:${AWS::Region}:${AWS::AccountId}:${BookFinderGateway}/${BookFinderStage}/${BookFinderUsersSignupPOST}/

  # ---------------------------------------------------------------- DYNAMODB
  ResultsTable:
    Type: AWS::DynamoDB::Table
    DeletionPolicy: Delete
    UpdateReplacePolicy: Delete
    Properties:
      TableName: !Sub "${Unique}--${ResultsTableName}"
      AttributeDefinitions:
        - AttributeName: "Id"
          AttributeType: "S"
        - AttributeName: "Image"
          AttributeType: "S"
      KeySchema:
        - AttributeName: "Id"
          KeyType: "HASH"
        - AttributeName: "Image"
          KeyType: "RANGE"
      ProvisionedThroughput:
        ReadCapacityUnits: 1
        WriteCapacityUnits: 1

  S3ResultsBucket:
    Type: AWS::S3::Bucket
    DeletionPolicy: Delete
    Properties:
      BucketName: !Sub "${Unique}--${ResultsBucketName}"
      LifecycleConfiguration:
        Rules:
          - Status: Enabled
            Id: "results expiration rule"
            ExpirationInDays: 10

  # ---------------------------------------------------------------- POLICIES
  ReadImageBucketPolicy:
    Type: AWS::IAM::Policy
    Properties:
      PolicyName: readFromImageBucket
      PolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Action:
              - s3:GetObject
            Resource: !Sub "arn:${AWS::Partition}:s3:::${Unique}--${ImageBucketName}/*"
      Roles:
        - !Ref BookFinderSearchLambdaRole
        - !Ref S3TriggerLambdaRole

  WriteResultsBucketPolicy:
    Type: AWS::IAM::Policy
    Properties:
      PolicyName: writeToResultsBucket
      PolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Action:
              - s3:PutObject
            Resource: !Sub "arn:${AWS::Partition}:s3:::${Unique}--${ResultsBucketName}/*"
      Roles:
        - !Ref BookFinderSearchLambdaRole
        - !Ref S3TriggerLambdaRole

  ReadFromResultsBucketPolicy:
    Type: AWS::IAM::Policy
    Properties:
      PolicyName: readFromResultsBucket
      PolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Action:
              - s3:GetObject
            Resource: !Sub "arn:${AWS::Partition}:s3:::${Unique}--${ResultsBucketName}/*"
      Roles:
        # This is needed because Rekognition needs bucket/key (can't use in memory image)
        - !Ref S3TriggerLambdaRole

  ReadFromResultsTable:
    Type: AWS::IAM::Policy
    Properties:
      PolicyName: readFromResultsTable
      PolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Action:
              - dynamodb:Query
              - dynamodb:GetItem
            Resource:
              - !GetAtt ResultsTable.Arn
      Roles:
        - !Ref BookFinderSearchLambdaRole

  WriteToResultsTable:
    Type: AWS::IAM::Policy
    Properties:
      PolicyName: writeToResultsTable
      PolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Action:
              - dynamodb:DescribeTable
              - dynamodb:PutItem
            Resource:
              - !GetAtt ResultsTable.Arn
      Roles:
        - !Ref S3TriggerLambdaRole

  # Must create a new bucket. CFN can "import" existing resources but it's a pain.
  # You must use the console or the CLI.
  # CDK seems to handle the problem of importing exting resources better.
  S3ImageBucket:
    Type: AWS::S3::Bucket
    DependsOn:
      - S3TriggerLambdaPermission
    DeletionPolicy: Delete
    Properties:
      BucketName: !Sub "${Unique}--${ImageBucketName}"
      NotificationConfiguration:
        LambdaConfigurations:
          - Event: s3:ObjectCreated:*
            Function: !GetAtt S3TriggerLambda.Arn
            Filter:
              S3Key:
                Rules:
                  - Name: suffix
                    Value: .png

  S3TriggerLambdaPermission:
    Type: AWS::Lambda::Permission
    Properties:
      Action: "lambda:InvokeFunction"
      FunctionName: !Ref S3TriggerLambda
      Principal: s3.amazonaws.com
      SourceArn: !Sub "arn:${AWS::Partition}:s3:::${Unique}--${ImageBucketName}"
      SourceAccount: !Ref AWS::AccountId

  S3TriggerLambdaRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Action: sts:AssumeRole
            Effect: Allow
            Principal:
              Service: lambda.amazonaws.com
      # So lambda can write logs
      ManagedPolicyArns:
        - "arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"
      Policies:
        - PolicyName: detectTextRek
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Effect: Allow
                Action: rekognition:DetectText
                Resource: "*"

  S3TriggerLambda:
    Type: AWS::Lambda::Function
    Properties:
      FunctionName: !Sub "${Unique}--${RekogFunctionName}"
      Role: !GetAtt S3TriggerLambdaRole.Arn
      Runtime: nodejs16.x
      Environment:
        Variables:
          DB_TABLE_NAME: !Sub "${Unique}--${ResultsTableName}"
          RESULTS_BUCKET_NAME: !Sub "${Unique}--${ResultsBucketName}"
          UPLOADS_BUCKET_NAME: !Sub "${Unique}--${ImageBucketName}"
      Handler: rekog.handler
      Code:
        S3Bucket: !Ref ZipBucketName
        S3Key: !Ref ZipS3Key
        S3ObjectVersion: !Ref ZipVersionId
      # https://github.com/charoitel/lambda-layer-canvas-nodejs/wiki
      # https://docs.aws.amazon.com/serverlessrepo/latest/devguide/sharing-lambda-layers.html
      Layers:
        - arn:aws:lambda:us-west-2:136545519964:layer:canvas-nodejs:4
      MemorySize: 1024
      Timeout: 120

  S3TriggerLimitRetries:
    Type: AWS::Lambda::EventInvokeConfig
    Properties:
      FunctionName: !Ref S3TriggerLambda
      MaximumRetryAttempts: 0
      Qualifier: "$LATEST"

  # Thanks https://ldoughty.com/2020/01/aws-http-api-gateway-cloudformation-setup/
  LambdaLogGroup:
    Type: AWS::Logs::LogGroup
    DeletionPolicy: Delete
    UpdateReplacePolicy: Delete
    Properties:
      LogGroupName: !Join [/, ["/aws/lambda", !Ref S3TriggerLambda]]
      RetentionInDays: 3

Outputs:
  BookFinderGatewayInvokeURL:
    Value: !Sub https://${BookFinderGateway}.execute-api.${AWS::Region}.amazonaws.com/${BookFinderStage}