template.yaml

AWSTemplateFormatVersion: '2010-09-09'
Transform: AWS::Serverless-2016-10-31
Description: >
  posterit-e-lambdas: Serverless backend for the Posterit-E digital legacy platform.

Globals:
  Function:
    Timeout: 10
    MemorySize: 128
    Runtime: python3.9
    Architectures:
      - x86_64
    Environment:
      Variables:
        DYNAMODB_TABLE_NAME: "{{resolve:ssm:/posterite/dynamodb_table}}"
        S3_BUCKET_NAME: "{{resolve:ssm:/posterite/s3_bucket}}"
        SENDER_EMAIL_ADDRESS: "{{resolve:ssm:/posterite/sender_email}}"
        BASE_URL: "{{resolve:ssm:/posterite/base_url}}"
        TOKEN_TTL_SECONDS: "{{resolve:ssm:/posterite/token_ttl}}"
        OTP_TTL_SECONDS: "{{resolve:ssm:/posterite/otp_ttl}}"

Resources:
  # --- API Gateway ---
  ApiGatewayLogGroup:
    Type: AWS::Logs::LogGroup
    Properties:
      LogGroupName: /aws/api-gateway/posterit-e-mvp-api
      RetentionInDays: 7

  PosteritEApi:
    Type: AWS::Serverless::Api
    Properties:
      StageName: Prod
      Cors:
        AllowMethods: "'POST, GET, OPTIONS'"
        AllowHeaders: "'Content-Type,X-Amz-Date,Authorization,X-Api-Key,X-Amz-Security-Token'"
        AllowOrigin: "'*'" # Production Recommended: "'{{resolve:ssm:/posterite/frontend_url:1}}'"
      AccessLogSetting:
        DestinationArn: !GetAtt ApiGatewayLogGroup.Arn
        Format: '{"requestId":"$context.requestId","ip":"$context.identity.sourceIp","caller":"$context.identity.caller","user":"$context.identity.user","requestTime":"$context.requestTime","httpMethod":"$context.httpMethod","resourcePath":"$context.resourcePath","status":"$context.status","protocol":"$context.protocol","responseLength":"$context.responseLength"}'
      MethodSettings:
        - ResourcePath: '/*'
          HttpMethod: '*'
          LoggingLevel: INFO
          DataTraceEnabled: true
          MetricsEnabled: true

  # --- Lambda Functions ---
  StoreSecretLambdaFunction:
    Type: AWS::Serverless::Function
    Properties:
      CodeUri: functions/store_secret_lambda/
      Handler: app.lambda_handler
      Policies:
        - Statement:
            - Effect: Allow
              Action:
                - dynamodb:PutItem
                - dynamodb:UpdateItem
                - dynamodb:DeleteItem
                - dynamodb:TransactWriteItems
              Resource: !GetAtt PosteritETable.Arn
        - S3WritePolicy:
            BucketName: "{{resolve:ssm:/posterite/s3_bucket}}"
      Events:
        ApiEvent:
          Type: Api
          Properties:
            Path: /secrets
            Method: post
            RestApiId: !Ref PosteritEApi
            Auth:
              ApiKeyRequired: true

  ActivationLambdaFunction:
    Type: AWS::Serverless::Function
    Properties:
      CodeUri: functions/activation_lambda/
      Handler: app.lambda_handler
      Environment:
        Variables:
          RELEASE_LAMBDA_ARN: !GetAtt ReleaseLambdaFunction.Arn
          SCHEDULER_ROLE_ARN: !GetAtt SchedulerToLambdaRole.Arn
      Policies:
        - Statement:
            - Sid: AllowReadAndUpdateStateInDynamoDB
              Effect: Allow
              Action:
                - dynamodb:GetItem
                - dynamodb:UpdateItem
              Resource: "{{resolve:ssm:/posterite/dynamodb_table_arn}}"
            - Sid: AllowSendEmails
              Effect: Allow
              Action:
                - ses:SendEmail
                - ses:SendRawEmail
              Resource: "{{resolve:ssm:/posterite/ses_identity_arn}}"
            - Sid: AllowCreateEventBridgeSchedule
              Effect: Allow
              Action: scheduler:CreateSchedule
              Resource: '*'
            - Sid: AllowPassSchedulerRole
              Effect: Allow
              Action: iam:PassRole
              Resource: !GetAtt SchedulerToLambdaRole.Arn
      Events:
        GetEvent:
          Type: Api
          Properties:
            Path: /activation/{secretId}
            Method: get
            RestApiId: !Ref PosteritEApi
        PostEvent:
          Type: Api
          Properties:
            Path: /activation
            Method: post
            RestApiId: !Ref PosteritEApi

  CancellationLambdaFunction:
    Type: AWS::Serverless::Function
    Properties:
      CodeUri: functions/cancellation_lambda/
      Handler: app.lambda_handler
      Policies:
        - Statement:
            - Sid: AllowReadAndUpdateStateForCancellation
              Effect: Allow
              Action:
                - dynamodb:GetItem
                - dynamodb:UpdateItem
                - dynamodb:DeleteItem
              Resource: !GetAtt PosteritETable.Arn
            - Sid: AllowQueryTokenIndex
              Effect: Allow
              Action:
                - dynamodb:Query
              Resource:
                - !GetAtt PosteritETable.Arn
                - !Sub "${PosteritETable.Arn}/index/TokenIndex"
            - Sid: AllowSendEmails
              Effect: Allow
              Action:
                - ses:SendEmail
                - ses:SendRawEmail
              Resource: "{{resolve:ssm:/posterite/ses_identity_arn}}"
            - Sid: AllowDeleteEventBridgeSchedule
              Effect: Allow
              Action: scheduler:DeleteSchedule
              Resource: !Sub "arn:aws:scheduler:${AWS::Region}:${AWS::AccountId}:schedule/default/*"
      Events:
        ApiEvent:
          Type: Api
          Properties:
            Path: /cancel
            Method: post
            RestApiId: !Ref PosteritEApi

  ReleaseLambdaFunction:
    Type: AWS::Serverless::Function
    Properties:
      CodeUri: functions/release_lambda/
      Handler: app.lambda_handler
      Policies:
        - S3ReadPolicy:
            BucketName: "{{resolve:ssm:/posterite/s3_bucket}}"
        - Statement:
            - Sid: AllowManageStateAndTokensInDynamoDB
              Effect: Allow
              Action:
                - dynamodb:GetItem
                - dynamodb:UpdateItem
                - dynamodb:DeleteItem
                - dynamodb:PutItem
              Resource: "{{resolve:ssm:/posterite/dynamodb_table_arn}}"
            - Sid: AllowSendEmails
              Effect: Allow
              Action:
                - ses:SendEmail
                - ses:SendRawEmail
              Resource: "{{resolve:ssm:/posterite/ses_identity_arn}}"
      Events:
        VerifyMfaEvent:
          Type: Api
          Properties:
            Path: /mfa/verify
            Method: post
            RestApiId: !Ref PosteritEApi
        GetSecretDataEvent:
          Type: Api
          Properties:
            Path: /secrets/{secretId}/data
            Method: get
            RestApiId: !Ref PosteritEApi

  # --- IAM Roles and Custom Domain ---
  SchedulerToLambdaRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Principal:
              Service: scheduler.amazonaws.com
            Action: sts:AssumeRole
      Policies:
        - PolicyName: AllowInvokeReleaseLambda
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Effect: Allow
                Action:
                  - lambda:InvokeFunction
                Resource: !GetAtt ReleaseLambdaFunction.Arn

  PosteriteEApiDomainName:
    Type: AWS::ApiGateway::DomainName
    DeletionPolicy: Retain
    Properties:
      DomainName: "{{resolve:ssm:/posterite/api_domain}}"
      EndpointConfiguration:
        Types:
          - REGIONAL
      RegionalCertificateArn: "{{resolve:ssm:/posterite/certificate_arn}}"

  PosteritEApiBasePathMapping:
    Type: AWS::ApiGateway::BasePathMapping
    DependsOn: PosteritEApiProdStage
    Properties:
      DomainName: !Ref PosteriteEApiDomainName
      RestApiId: !Ref PosteritEApi
      Stage: Prod
      BasePath: ""

  PosteritETable:
    Type: AWS::DynamoDB::Table
    Properties:
      TableName: "{{resolve:ssm:/posterite/dynamodb_table}}"
      AttributeDefinitions:
        - AttributeName: PK
          AttributeType: S
        - AttributeName: SK
          AttributeType: S
        - AttributeName: tokenValue
          AttributeType: S
      KeySchema:
        - AttributeName: PK
          KeyType: HASH
        - AttributeName: SK
          KeyType: RANGE
      GlobalSecondaryIndexes:
        - IndexName: TokenIndex
          KeySchema:
            - AttributeName: tokenValue
              KeyType: HASH
          Projection:
            ProjectionType: KEYS_ONLY
      BillingMode: PAY_PER_REQUEST

Outputs:
  PosteritEApiUrl:
    Description: "API Gateway endpoint URL for Prod stage"
    Value: !Sub "https://${PosteritEApi}.execute-api.${AWS::Region}.amazonaws.com/Prod/"
  PosteritEApiId:
    Description: "API Gateway REST API ID"
    Value: !Ref PosteritEApi