scheduler.yaml

AWSTemplateFormatVersion: '2010-09-09'
Description: Reading scheduler workflow
Transform:
  - AWS::Serverless-2016-10-31
  - AWS::LanguageExtensions
Globals:
  Function:
    Layers:
      - arn:aws:lambda:us-east-1:546275881527:layer:xray-python3:3
      - arn:aws:lambda:us-east-1:580247275435:layer:LambdaInsightsExtension:38
    MemorySize: !Ref pFnMemory
    Runtime: python3.11
    Timeout: !Ref pFnTimeout
    Tracing: Active
Parameters:
  pSourceEmail:
    Type: String
  pSendType:
    Type: String
  pEndpoint:
    Type: String
  pPlanId:
    Type: String
  pApiKey:
    Type: String
  pEmailTemplate:
    Type: String
  pEmailSubject:
    Type: String
  pDomainEmail:
    Type: String
Resources:
  # Secret
  Token:
    Type: AWS::SecretsManager::Secret
    Properties:
      SecretString: !Ref pApiKey
      Tags:
        - Key: application:group
          Value: reading
        - Key: application:subgroup
          Value: infrastructure
        - Key: application:owner
          Value: heeki
  # Events
  EventsRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - events.amazonaws.com
                - scheduler.amazonaws.com
            Action:
              - sts:AssumeRole
      Path: /
      Policies:
        - PolicyName: step-functions
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Effect: Allow
                Action:
                  - states:StartExecution
                Resource:
                  - !GetAtt SFn.Arn
  Rule:
    Type: AWS::Events::Rule
    Properties:
      # ScheduleExpression: cron(0/1 * * * ? *)
      ScheduleExpression: cron(0 6 ? * MON-FRI *)
      State: DISABLED
      Targets:
        - Id: reading-workflow
          Arn: !GetAtt SFn.Arn
          RoleArn: !GetAtt EventsRole.Arn
          InputTransformer:
            InputPathsMap:
              id: "$.id"
              source: "$.source"
              time: "$.time"
            InputTemplate:
              Fn::ToJsonString:
                id: "<id>"
                source: "<source>"
                time: "<time>"
                detail:
                  source_email: !Ref pSourceEmail
                  reading_endpoint: !Sub "${pEndpoint}/reading"
                  user_endpoint: !Sub "${pEndpoint}/user"
                  plan_id: !Ref pPlanId
                  send_type: !Ref pSendType
  Schedule:
    Type: AWS::Scheduler::Schedule
    Properties:
      FlexibleTimeWindow:
        Mode: "OFF"
      # ScheduleExpression: cron(0/1 * * * ? *)
      ScheduleExpression: cron(0 6 ? * MON-FRI *)
      ScheduleExpressionTimezone: "America/New_York"
      State: ENABLED
      Target:
        Arn: !GetAtt SFn.Arn
        RoleArn: !GetAtt EventsRole.Arn
        Input:
          Fn::ToJsonString:
            id: "<aws.scheduler.execution-id>"
            time: "<aws.scheduler.scheduled-time>"
            detail:
              source_email: !Ref pSourceEmail
              reading_endpoint: !Sub "${pEndpoint}/reading"
              user_endpoint: !Sub "${pEndpoint}/user"
              plan_id: !Ref pPlanId
              send_type: !Ref pSendType
  Connection:
    Type: AWS::Events::Connection
    Properties:
      AuthorizationType: API_KEY
      AuthParameters:
        ApiKeyAuthParameters:
          ApiKeyName: Authorization
          ApiKeyValue: !Sub "{{resolve:secretsmanager:${Token}}}"
  # SNS
  Topic:
    Type: AWS::SNS::Topic
    Properties:
      Tags:
        - Key: application:group
          Value: reading
        - Key: application:subgroup
          Value: infrastructure
        - Key: application:owner
          Value: heeki
  # Step Function
  SFnExecRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - states.amazonaws.com
            Action:
              - sts:AssumeRole
      Path: /
      Policies:
        - PolicyName: cloudwatch-logs
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Effect: Allow
                Action:
                  - logs:CreateLogDelivery
                  - logs:GetLogDelivery
                  - logs:UpdateLogDelivery
                  - logs:DeleteLogDelivery
                  - logs:ListLogDeliveries
                  - logs:PutResourcePolicy
                  - logs:DescribeResourcePolicies
                  - logs:DescribeLogGroups
                Resource: "*"
        - PolicyName: events
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Effect: Allow
                Action:
                  - events:RetrieveConnectionCredentials
                Resource: !GetAtt Connection.Arn
        - PolicyName: secrets
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Effect: Allow
                Action:
                  - secretsmanager:GetSecretValue
                  - secretsmanager:DescribeSecret
                Resource: "arn:aws:secretsmanager:*:*:secret:events!connection/*"
        - PolicyName: http
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Effect: Allow
                Action:
                  - states:InvokeHTTPEndpoint
                Resource: "*"
                Condition:
                  ForAnyValue:StringEquals:
                    "states:HTTPMethod": ["GET", "PUT"]
                  StringLike:
                    "states:HTTPEndpoint": !Join ["/", [!Ref pEndpoint, "*"]]
        - PolicyName: sns
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Effect: Allow
                Action:
                  - sns:Publish
                Resource: !Ref Topic
        - PolicyName: ses
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Effect: Allow
                Action:
                  - ses:SendEmail
                  - ses:SendTemplatedEmail
                Resource: "*"
                Condition:
                  StringLike:
                    "ses:FromAddress": !Join ["@", ["*", !Ref pDomainEmail]]
  SFn:
    Type: AWS::Serverless::StateMachine
    Properties:
        DefinitionUri: ../asl.json
        DefinitionSubstitutions:
          Connection: !GetAtt Connection.Arn
          EmailSubject: !Ref pEmailSubject
          EmailTemplate: !Ref pEmailTemplate
          Topic: !Ref Topic
        Logging:
          Destinations:
            - CloudWatchLogsLogGroup:
                LogGroupArn: !GetAtt SFnLogGroup.Arn
          IncludeExecutionData: true
          Level: ALL
        Role: !GetAtt SFnExecRole.Arn
        Type: STANDARD
        Tracing:
          Enabled: true
        Tags:
          application:group: reading
          application:subgroup: scheduler
          application:owner: heeki
  SFnLogGroup:
    Type: AWS::Logs::LogGroup
    Properties:
      LogGroupName: !Sub "/aws/sf/reading-scheduler"
      # RetentionInDays: 7
      Tags:
        - Key: application:group
          Value: reading
        - Key: application:subgroup
          Value: scheduler
        - Key: application:owner
          Value: heeki
Outputs:
  outTopic:
    Value: !Ref Topic
  outSchedule:
    Value: !Ref Schedule
  outConnection:
    Value: !GetAtt Connection.Arn
  outSFn:
    Value: !Ref SFn