template.yaml

AWSTemplateFormatVersion: '2010-09-09'
Transform: AWS::Serverless-2016-10-31
Description: >
  SAM Template for serverless image uploading and download.

Parameters:
  ImageApiName:
    Type: String
    Default: image-api
  SSMParamRootPath:
    Type: String
    Default: /applications/ServerlessDemo

Globals:
  Function:
    MemorySize: 512
    Runtime: go1.x
    Timeout: 10
    Tracing: Active

Resources:
  ImageApi:
    Type: AWS::Serverless::Api
    Properties:
      Name: !Ref ImageApiName
      StageName: Prod
      TracingEnabled: true
      MethodSettings:
        - ResourcePath: '/*'
          HttpMethod: '*'
          LoggingLevel: INFO
          MetricsEnabled: true
          ThrottlingRateLimit: 5
          ThrottlingBurstLimit: 10
      Cors:
        AllowOrigin: "'*'"
        AllowMethods: "'GET,POST,PUT,DELETE,OPTIONS'"
        AllowHeaders: "'Content-Type,Authorization,X-Amz-Date,X-Api-Key'"
      GatewayResponses:
        DEFAULT_4xx:
          ResponseParameters:
            Headers:
              Access-Control-Allow-Origin: "'*'"
              Access-Control-Allow-Methods: "'GET,POST,PUT,DELETE,OPTIONS'"
              Access-Control-Allow-Headers: "'Content-Type,Authorization,X-Amz-Date,X-Api-Key'"
        DEFAULT_5xx:
          ResponseParameters:
            Headers:
              Access-Control-Allow-Origin: "'*'"
              Access-Control-Allow-Methods: "'GET,POST,PUT,DELETE,OPTIONS'"
              Access-Control-Allow-Headers: "'Content-Type,Authorization,X-Amz-Date,X-Api-Key'"

  GetUploadUrlFunction:
    Type: AWS::Serverless::Function
    Properties:
      CodeUri: fn/get-upload-url/
      Handler: get-upload-url
      Policies:
        - S3WritePolicy:
            BucketName: !Ref ImageBucket
      Environment:
        Variables:
          S3_BUCKET: !Ref ImageBucket
      Events:
        GetUploadUrl:
          Type: Api
          Properties:
            RestApiId: !Ref ImageApi
            Path: /get-upload-url
            Method: POST

  GetDownloadUrlFunction:
    Type: AWS::Serverless::Function
    Properties:
      CodeUri: fn/get-download-url/
      Handler: get-download-url
      Policies:
        - SSMParameterReadPolicy:
            ParameterName: 'applications/ServerlessDemo/*'
      Environment:
        Variables:
          CF_DOMAIN_NAME: !GetAtt CloudfrontDistribution.DomainName
      Events:
        GetDownloadUrl:
          Type: Api
          Properties:
            RestApiId: !Ref ImageApi
            Path: /get-download-url
            Method: POST

  ResizeImageFunction:
    Type: AWS::Serverless::Function
    Properties:
      CodeUri: fn/resize-image/
      Handler: resize-image
      # cannot specify ImageBucket because of circular dependency
      Policies: AmazonS3FullAccess
      Events:
        OnObjectCreated:
          Type: S3
          Properties:
            Bucket: !Ref ImageBucket
            Events:
              - s3:ObjectCreated:*
            Filter:
              S3Key:
                Rules:
                  - Name: prefix
                    Value: 'resize/'

   # To display S3 trigger on Lambda console only
#  LambdaInvokePermission:
#    Type: 'AWS::Lambda::Permission'
#    Properties:
#      FunctionName: !GetAtt ResizeImageFunction.Arn
#      Action: 'lambda:InvokeFunction'
#      Principal: 's3.amazonaws.com'
#      SourceAccount: !Sub ${AWS::AccountId}
#      SourceArn: !GetAtt ImageBucket.Arn

  ImageBucket:
    Type: AWS::S3::Bucket

  ImageBucketPolicy:
    Type: AWS::S3::BucketPolicy
    Properties:
      Bucket: !Ref ImageBucket
      PolicyDocument:
        Statement:
          - Effect: Allow
            Action: s3:GetObject
            Resource:
              - !Sub 'arn:aws:s3:::${ImageBucket}/*'
            Principal:
              CanonicalUser: !GetAtt CloudFrontOriginAccessIdentity.S3CanonicalUserId

  CloudFrontOriginAccessIdentity:
    Type: AWS::CloudFront::CloudFrontOriginAccessIdentity
    Properties:
      CloudFrontOriginAccessIdentityConfig:
        Comment: "Serverless image download"

  CloudfrontDistribution:
    Type: AWS::CloudFront::Distribution
    Properties:
      DistributionConfig:
        Comment: "Cloudfront distribution for serverless-demo image download"
        Enabled: true
        HttpVersion: http2
        Origins:
          - Id: imageBucketOrigin
            DomainName: !GetAtt ImageBucket.DomainName
            S3OriginConfig:
              OriginAccessIdentity: !Sub 'origin-access-identity/cloudfront/${CloudFrontOriginAccessIdentity}'
        DefaultCacheBehavior:
          AllowedMethods:
            - GET
            - HEAD
            - OPTIONS
          Compress: true
          ForwardedValues:
            QueryString: true
          TargetOriginId: imageBucketOrigin
          TrustedSigners:
            - self
          ViewerProtocolPolicy: redirect-to-https

Outputs:
  ImageApi:
    Description: "API Gateway endpoint URL for Prod environment"
    Value: !Sub "https://${ImageApi}.execute-api.${AWS::Region}.amazonaws.com/Prod/"
  GetUploadUrlFunction:
    Description: "Get Upload URL Function ARN"
    Value: !GetAtt GetUploadUrlFunction.Arn
  GetDownloadUrlFunction:
    Description: "Get Download URL Function ARN"
    Value: !GetAtt GetDownloadUrlFunction.Arn
  ResizeImageFunction:
    Description: "Resize Image Function ARN"
    Value: !GetAtt ResizeImageFunction.Arn
  ImageBucket:
    Description: "Image S3 bucket"
    Value: !Ref ImageBucket
  ImageDomain:
    Description: 'Image Cloudfront domain name'
    Value: !GetAtt CloudfrontDistribution.DomainName