template.yaml

AWSTemplateFormatVersion: '2010-09-09'
Transform: AWS::Serverless-2016-10-31
Description: >
  Media App API

  SAM Template for Media App API

Parameters:
  CodeBucketName:
    Type: String
    Default: 'aws-websockets-adaptor'
    Description: (Required) The name of the S3 bucket where the Lambda function code is stored. Minimum 3 characters

  ExposeType:
    Type: String
    Default: 'FunctionUrl'
    AllowedValues: ['FunctionUrl', 'ApiGateway']
    Description: (Required) The type of exposure for the API. FunctionUrl or ApiGateway

Conditions:
  IsFunctionUrlAuth: !Equals [!Ref ExposeType, "FunctionUrl"]
  IsApiGatewayAuth: !Equals [!Ref ExposeType, "ApiGateway"]
  
Resources:
  MediaApi:
    Type: AWS::ApiGatewayV2::Api
    Properties:
      Name: media-api
      ProtocolType: HTTP
    Condition: IsApiGatewayAuth
    
  ProxyRoute:
    Type: AWS::ApiGatewayV2::Route
    Properties:
      ApiId: !Ref MediaApi
      RouteKey: 'ANY /{proxy+}'
      AuthorizationType: NONE
      OperationName: ApiEndpoints
      Target: !Join
        - '/'
        - - 'integrations'
          - !Ref ProxyRouteAnyMethod
    Condition: IsApiGatewayAuth
    
  ProxyRouteAnyMethod:
    Type: AWS::ApiGatewayV2::Integration
    Properties:
      ApiId: !Ref MediaApi
      PayloadFormatVersion: '2.0'
      Description: ProxyRoute Integration
      IntegrationType: AWS_PROXY
      IntegrationUri:
        Fn::Sub:
          arn:aws:apigateway:${AWS::Region}:lambda:path/2015-03-31/functions/${MediaApiLambdaFunction.Arn}/invocations
    Condition: IsApiGatewayAuth
    
  Deployment:
    Type: AWS::ApiGatewayV2::Deployment
    DependsOn:
      - ProxyRoute
    Properties:
      ApiId: !Ref MediaApi
    Condition: IsApiGatewayAuth
    
  Stage:
    Type: AWS::ApiGatewayV2::Stage
    Properties:
      StageName: prod
      Description: Prod Stage
      DeploymentId: !Ref Deployment
      ApiId: !Ref MediaApi
    Condition: IsApiGatewayAuth
    
  MediaApiLambdaFunctionPermission:
    Type: AWS::Lambda::Permission
    DependsOn:
      - MediaApi
    Properties:
      Action: lambda:InvokeFunction
      FunctionName: !Ref MediaApiLambdaFunction
      Principal: apigateway.amazonaws.com
    Condition: IsApiGatewayAuth
    
  MediaApiTable:
    Type: AWS::DynamoDB::Table
    Properties:
      AttributeDefinitions:
        - AttributeName: "pk"
          AttributeType: "S"
        - AttributeName: "sk"
          AttributeType: "S"
      KeySchema:
        - AttributeName: "pk"
          KeyType: "HASH"
        - AttributeName: "sk"
          KeyType: "RANGE"
      BillingMode:
        PAY_PER_REQUEST
      SSESpecification:
        SSEEnabled: True
      TableName: galleries

  MediaApiLambdaFunction:
    Type: AWS::Serverless::Function
    Properties:
      FunctionName: MediaApiLambdaFunction
      CodeUri:
        Bucket: !Ref CodeBucketName
        Key: deploy.zip
      Handler: Api
      Role: !GetAtt MediaApiLambdaFunctionExecutionRole.Arn
      MemorySize: 512
      Timeout: 180
      Runtime: dotnet8
      Environment:
        Variables:
          TABLE_NAME: galleries
      Policies:
        - DynamoDBCrudPolicy:
            TableName: galleries
            
  MediaApiApiFunctionUrl:
    Type: AWS::Lambda::Url
    Properties:
      AuthType: NONE
      TargetFunctionArn: !Ref MediaApiLambdaFunction
    Condition: IsFunctionUrlAuth
  
  MediaApiFunctionUrlPermission:
    Type: AWS::Lambda::Permission
    DependsOn:
      - MediaApiLambdaFunction
    Properties:
      Action: lambda:InvokeFunctionUrl
      FunctionName: !Ref MediaApiLambdaFunction
      FunctionUrlAuthType: 'NONE'
      Principal: "*"
      
  MediaApiLabelCheckerLambdaFunction:
    Type: AWS::Serverless::Function
    Properties:
      FunctionName: MediaApiLabelCheckerLambdaFunction
      CodeUri:
        Bucket: !Ref CodeBucketName
        Key: deploy.zip
      Handler: LabelChecker::LabelChecker.Entrypoint::Handler
      Role: !GetAtt MediaApiLambdaFunctionExecutionRole.Arn
      MemorySize: 512
      Timeout: 180
      Runtime: dotnet8
      
  MediaApiEventBus:
    Type: AWS::SNS::Topic
    Properties:
      TopicName: MediaApiEventBus
      
  MediaApiLambdaFunctionLogGroup:
    Type: AWS::Logs::LogGroup
    Properties:
      LogGroupName: !Sub "/aws/lambda/MediaApiLambdaFunction"
      RetentionInDays: 14
    
  MediaApiLambdaFunctionExecutionRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - lambda.amazonaws.com
            Action:
              - sts:AssumeRole
      Policies:
        - PolicyName: allowLambdaLogs
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Effect: Allow
                Action:
                  - logs:*
                Resource: arn:aws:logs:*:*:*
        - PolicyName: MediaApiLambdaDbPolicy
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Effect: Allow
                Action:
                  - dynamodb:*
                Resource: !GetAtt MediaApiTable.Arn
        - PolicyName: MediaApiLambdaS3Policy
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Effect: Allow
                Action:
                  - s3:*
                Resource: '*'
        - PolicyName: MediaApiLambdaSQSPolicy
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Effect: Allow
                Action:
                  - sqs:*
                Resource: arn:aws:sqs:*:*:*
        - PolicyName: MediaApiLambdaSNSPolicy
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Effect: Allow
                Action:
                  - sns:*
                Resource: arn:aws:sns:*:*:*
        - PolicyName: allowParameterStore
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Effect: Allow
                Action:
                  - ssm:GetParameter
                  - ssm:GetParametersByPath
                Resource: '*'
        - PolicyName: allowRekognition
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Effect: Allow
                Action:
                  - rekognition:DetectLabels
                  - rekognition:DetectModerationLabels
                Resource: '*'
  
  MediaApiEventBusParameter:
    Type: AWS::SSM::Parameter
    Properties:
      Name: /media-api/EventBusSettings
      Type: String
      Value: !Join [ '', [ '{"IsEnabled":true,"TopicArn":"',!Ref MediaApiEventBus,'"}' ] ]
      Description: EventBusSettings
      
  MediaApiLabelCheckerImageModerationConfigParameter:
    Type: AWS::SSM::Parameter
    Properties:
      Name: /media-api/ImageModerationConfig
      Type: String
      Value: !Join [ '', [ '{"AlertConfidence":90,"MinConfidence":60,"ForbiddenLabels":[],"IsEnabled":true,"TopicArn":"',!Ref MediaApiEventBus,'"}' ] ]
      Description: EventBusSettings      

  MediaApiUploadSettingsParameter:
    Type: AWS::SSM::Parameter
    Properties:
      Name: /media-api/UploadSettings
      Type: String
      Value: '{
    "ExpireTime": 5,
    "BaseFolder": "orginal",
    "BucketName": "cdn.xxxxx.com",
    "DefaultTags": {
      "tag1": "value1",
      "tag2": "value2"
    },
    "AllowedContentTypes": {
      "image/jpeg": "jpg",
      "image/png": "png",
      "image/gif": "gif"
    }
  }'
      Description: UploadSettings

  MediaApiApiKey:
    Type: AWS::SSM::Parameter
    Properties:
      Name: /media-api/ApiKeyValidationSettings
      Type: String
      Value: !Join [ '', [ '{"IsEnabled":false,"HeaderName":"x-api-key","WhiteList":["/swagger"],"ApiKey":"',!Ref AWS::StackId,'"}' ] ]
      Description: MediaApiKeyValidationSettings