template.yaml

AWSTemplateFormatVersion: '2010-09-09'
Transform: AWS::Serverless-2016-10-31
Description: >
  sam-app1

  Sam Template for demo application

Parameters:
  YourEmail:
    Type: String
  Version:
    Type: String
    Default: v1
  DomainName:
    Type: String
    Default: sam.example.com
  CertificateArn:
    Type: String
    Default: arn:aws:acm
  TableName:
    Type: String
    Default: newdb
  ChaosConfig:
    Type: String
    Default: chaoslambda.config

Globals:
  Function:
    Timeout: 3
    Environment:
      Variables:
        TABLE_NAME: !Ref TableName
        POWERTOOLS_LOGGER_LOG_EVENT: "true"
        LOG_LEVEL: INFO
        CHAOS_PARAM: !Ref ChaosConfig

Resources:
  UserPool:
    Type: AWS::Cognito::UserPool
    Properties:
      AdminCreateUserConfig:
        AllowAdminCreateUserOnly: false
      UserPoolName: SamCheckingAuthUsers
      UsernameAttributes:
      - email
      AutoVerifiedAttributes:
      - email
      Policies:
        PasswordPolicy:
          MinimumLength: 6
          RequireLowercase: true
          RequireNumbers: false
          RequireSymbols: false
          RequireUppercase: true
  UserPoolTokenClient:
    Type: AWS::Cognito::UserPoolClient
    Properties:
      UserPoolId: !Ref UserPool
      GenerateSecret: false
      ExplicitAuthFlows:
      - USER_PASSWORD_AUTH
  UserPoolUser:
    Type: AWS::Cognito::UserPoolUser
    Properties:
      DesiredDeliveryMediums:
        - EMAIL
      Username: !Ref YourEmail
      UserPoolId: !Ref UserPool


  CustomServerlessAPI:
    Type: AWS::Serverless::Api
    Properties:
      StageName: Prod
      EndpointConfiguration:
        Type: REGIONAL
      Auth:
        DefaultAuthorizer: CognitoAuthorizer
        Authorizers:
          CognitoAuthorizer:
            UserPoolArn: !GetAtt "UserPool.Arn"

  APIDomainName:
    Type: AWS::ApiGateway::DomainName
    DependsOn: CustomServerlessAPI
    Properties:
      RegionalCertificateArn: !Ref CertificateArn
      DomainName: !Ref DomainName
      EndpointConfiguration:
        Types: 
          - REGIONAL

  APIBasePathMapping:
    Type: AWS::ApiGateway::BasePathMapping
    DependsOn: 
      - APIDomainName
      - CustomServerlessAPI
    Properties:
      DomainName: !Ref APIDomainName
      RestApiId: !Ref CustomServerlessAPI
      Stage: !Ref CustomServerlessAPI.Stage

  Echo:
    Type: AWS::Serverless::Function 
    Properties:
      CodeUri: application/
      Handler: echo.lambda_handler
      Runtime: python3.7
      Tracing: Active  # enables X-Ray tracing
      Events:
        Get:
          Type: Api
          Properties:
            Path: /echo
            RestApiId: !Ref CustomServerlessAPI
            Method: get
            Auth:
              Authorizer: NONE
      AutoPublishAlias: live
      DeploymentPreference:
        Type: AllAtOnce  
        Hooks:
          PreTraffic: !Ref PreTrafficHook
        Alarms:
          - !Ref AliasErrorMetricGreaterThanZeroAlarm
          - !Ref LatestVersionErrorMetricGreaterThanZeroAlarm
      Policies:
        - Version: "2012-10-17"
          Statement:
          - Effect: "Allow"
            Action:
              - "logs:CreateLogGroup"
              - "logs:CreateLogStream"
              - "logs:PutLogEvents"
              - "xray:PutTraceSegments"
              - "xray:PutTelemetryRecords"
              - "ssm:GetParameters"
              - "ssm:DescribeParameters"
              - "ssm:GetParameter"
              - "ssm:GetDocument"
              - "ssm:ListDocuments"
            Resource:
              - "*"

  GetItem:
    Type: AWS::Serverless::Function 
    Properties:
      CodeUri: application/
      Handler: get.lambda_handler
      Runtime: python3.7
      Tracing: Active  # enables X-Ray tracing
      Events:
        Get:
          Type: Api
          Properties:
            Path: /item/{id}
            Method: get
            RestApiId:
              Ref: CustomServerlessAPI
      AutoPublishAlias: live
      Policies:
        - Version: "2012-10-17"
          Statement:
          - Effect: "Allow"
            Action:
              - "dynamodb:GetItem"
            Resource:
              !Sub 'arn:${AWS::Partition}:dynamodb:${AWS::Region}:${AWS::AccountId}:table/${TableName}'
          - Effect: "Allow"
            Action:
              - "logs:CreateLogGroup"
              - "logs:CreateLogStream"
              - "logs:PutLogEvents"
              - "xray:PutTraceSegments"
              - "xray:PutTelemetryRecords"
              - "ssm:GetParameters"
              - "ssm:DescribeParameters"
              - "ssm:GetParameter"
              - "ssm:GetDocument"
              - "ssm:ListDocuments"
            Resource:
              - "*"

  CreateItem:
    Type: AWS::Serverless::Function 
    Properties:
      CodeUri: application/
      Handler: post.lambda_handler
      Runtime: python3.7
      Tracing: Active  # enables X-Ray tracing
      Events:
        Post:
          Type: Api
          Properties:
            Path: /create
            Method: post
            RestApiId:
              Ref: CustomServerlessAPI
      AutoPublishAlias: live
      Policies:
        - Version: "2012-10-17"
          Statement:
          - Effect: "Allow"
            Action:
              - "dynamodb:PutItem"
            Resource:
              !Sub 'arn:${AWS::Partition}:dynamodb:${AWS::Region}:${AWS::AccountId}:table/${TableName}'
          - Effect: "Allow"
            Action:
              - "logs:CreateLogGroup"
              - "logs:CreateLogStream"
              - "logs:PutLogEvents"
              - "xray:PutTraceSegments"
              - "xray:PutTelemetryRecords"
              - "ssm:GetParameters"
              - "ssm:DescribeParameters"
              - "ssm:GetParameter"
              - "ssm:GetDocument"
              - "ssm:ListDocuments"
            Resource:
              - "*"

  AliasErrorMetricGreaterThanZeroAlarm:
    Type: "AWS::CloudWatch::Alarm"
    Properties:
      AlarmDescription: Lambda Function Error > 0
      ComparisonOperator: GreaterThanThreshold
      Dimensions:
        - Name: Resource
          Value: !Sub "${Echo}:live"
        - Name: FunctionName
          Value: !Ref Echo
      EvaluationPeriods: 2
      MetricName: Errors
      Namespace: AWS/Lambda
      Period: 60
      Statistic: Sum
      Threshold: 0
  
  LatestVersionErrorMetricGreaterThanZeroAlarm:
    Type: "AWS::CloudWatch::Alarm"
    Properties:
      AlarmDescription: Lambda Function Error > 0
      ComparisonOperator: GreaterThanThreshold
      Dimensions:
        - Name: Resource
          Value: !Sub "${Echo}:live"
        - Name: FunctionName
          Value: !Ref Echo
        - Name: ExecutedVersion
          Value: !GetAtt Echo.Version.Version
      EvaluationPeriods: 2
      MetricName: Errors
      Namespace: AWS/Lambda
      Period: 60
      Statistic: Sum
      Threshold: 0


  PreTrafficHook:
    Type: AWS::Serverless::Function
    Properties:
      CodeUri: pre-traffic-hook/
      Handler: get.lambda_handler
      Policies:
        - Version: "2012-10-17"
          Statement:
          - Effect: "Allow"
            Action:
              - "codedeploy:PutLifecycleEventHookExecutionStatus"
            Resource:
              !Sub 'arn:${AWS::Partition}:codedeploy:${AWS::Region}:${AWS::AccountId}:deploymentgroup:${ServerlessDeploymentApplication}/*'
        - Version: "2012-10-17"
          Statement:
          - Effect: "Allow"
            Action:
              - "lambda:InvokeFunction"
            Resource: 
             - !GetAtt Echo.Arn
             - !Ref Echo.Version
      Runtime: python3.7
      FunctionName: 'CodeDeployHook_preTrafficHook'
      DeploymentPreference:
        Enabled: False
        Role: ""
      Timeout: 5
      Environment:
        Variables:
              CurrentVersion: !Ref Echo.Version  # [docs] recommended to pass the lambda version through the Environment Variables

Outputs:
  ApplicationAPI:
    Description: "API Gateway endpoint URL for Prod stage for Hello World function"
    Value: !Sub "https://${CustomServerlessAPI}.execute-api.${AWS::Region}.amazonaws.com/Prod/echo"
  GetItem:
    Description: "Hello World Lambda Function ARN"
    Value: !GetAtt GetItem.Arn
  GetItemIamRole:
    Description: "Implicit IAM Role created for Hello World function"
    Value: !GetAtt GetItemRole.Arn
  CreateItem:
    Description: "Hello World Lambda Function ARN"
    Value: !GetAtt CreateItem.Arn
  CreateItemIamRole:
    Description: "Implicit IAM Role created for Hello World function"
    Value: !GetAtt CreateItemRole.Arn
  CognitoID:
    Description: The Cognito UserPool ID
    Value: !Ref UserPool
  CognitoClientID:
    Description: The Cognito UserPool Client ID
    Value: !Ref UserPoolTokenClient