template-export.yml

AWSTemplateFormatVersion: 2010-09-09
Transform:
- AWS::Serverless-2016-10-31
- AWS::CodeStar
Parameters:
  ProjectId:
    Type: String
    Description: CodeStar projectId used to associate new resources to team members
  CodeDeployRole:
    Type: String
    Description: IAM role to allow AWS CodeDeploy to manage deployment of AWS Lambda
      functions
  Stage:
    Type: String
    Description: The name for a project pipeline stage, such as Staging or Prod, for
      which resources are provisioned and deployed.
    Default: ''
Mappings:
  TagsMap:
    Tags:
      Center: TECH
      Team: DS
      ProjectName: Prototype Validation Server Infrastructure
      ProjectCode: 102213-0001-001-00003
      Name: validation-server-backend
Globals:
  Function:
    AutoPublishAlias: live
    DeploymentPreference:
      Enabled: true
      Type: AllAtOnce
      Role:
        Ref: CodeDeployRole
    Tags:
      Center:
        Fn::FindInMap:
        - TagsMap
        - Tags
        - Center
      Tech-Team:
        Fn::FindInMap:
        - TagsMap
        - Tags
        - Team
      Project-Name:
        Fn::FindInMap:
        - TagsMap
        - Tags
        - ProjectName
      Project-Code:
        Fn::FindInMap:
        - TagsMap
        - Tags
        - ProjectCode
      Name:
        Fn::FindInMap:
        - TagsMap
        - Tags
        - Name
Resources:
  QueryFunction:
    Type: AWS::Serverless::Function
    Properties:
      EventInvokeConfig:
        MaximumRetryAttempts: 0
      FunctionName: validation-server-engine
      PackageType: Image
      ImageConfig:
        Command:
        - index.handler
      Timeout: 300
      MemorySize: 256
      Role:
        Fn::GetAtt:
        - LambdaExecutionRole
        - Arn
      ImageUri: 672001523455.dkr.ecr.us-east-1.amazonaws.com/validation-server-engine:queryfunction-3fe62b273d28-python3.8-v1
    Metadata:
      Dockerfile: Dockerfile
      DockerContext: ./src
      DockerTag: python3.8-v1
  LambdaExecutionRole:
    Description: Creating service role in IAM for AWS Lambda
    Type: AWS::IAM::Role
    Properties:
      RoleName:
        Fn::Sub: validation-server-engine-role
      AssumeRolePolicyDocument:
        Statement:
        - Effect: Allow
          Principal:
            Service:
            - lambda.amazonaws.com
          Action: sts:AssumeRole
      Path: /
      Policies:
      - PolicyName:
          Fn::Sub: validation-server-engine-policy
        PolicyDocument:
          Version: 2012-10-17
          Statement:
          - Effect: Allow
            Action:
            - s3:ListBucket
            Resource:
            - arn:aws:s3:::ui-validation-server
          - Effect: Allow
            Action:
            - s3:GetObject
            Resource:
            - arn:aws:s3:::ui-validation-server/*
          - Effect: Allow
            Action:
            - ecr:BatchGetImage
            - ecr:GetDownloadUrlForLayer
            Resource:
            - arn:aws:ecr:::repository/validation-server-engine
            - arn:aws:ecr:::repository/validation-server-engine/*
          - Effect: Allow
            Action:
            - kms:Decrypt
            Resource:
            - arn:aws:kms:::key/8910e308-71bf-4951-9cc3-193b515631c3
          - Effect: Allow
            Action:
            - secretsmanager:GetSecretValue
            Resource:
            - Fn::Sub: arn:aws:secretsmanager:us-east-1:672001523455:secret:validation-server-backend-UGy5Ro
          - Effect: Allow
            Action:
            - logs:CreateLogGroup
            - logs:CreateLogStream
            - logs:PutLogEvents
            Resource:
            - arn:aws:logs:*:*:*