template.yaml

Transform: AWS::Serverless-2016-10-31  # Mandatory declaration of SAM template

# Docs for SAM template specifically:
#     https://docs.aws.amazon.com/serverless-application-model/latest/developerguide/sam-specification-resources-and-properties.html

# Docs for the broader and still compatible CloudFormation template:
#     https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-template-resource-type-ref.html

# Developer guide for SAM
#     https://docs.aws.amazon.com/serverless-application-model/

# Intrinsic functions
#     https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/intrinsic-function-reference.html

Resources:

  WeeklyReminder:
    Type: AWS::Serverless::Function
  # Guide:
  #   SAM guide --> https://docs.aws.amazon.com/serverless-application-model/latest/developerguide/sam-resource-function.html
  #   dev guide --> https://docs.aws.amazon.com/lambda/
  #   python handler --> https://docs.aws.amazon.com/lambda/latest/dg/python-handler.html#python-handler-how
    Properties:
    #checkov:skip=CKV_AWS_116: This is not mission critical, we don't need a dead letter queue
    #checkov:skip=CKV_AWS_117: VPC costs money and everything is secure enough for our purposes 
      Description: Gives weekly reminders of upcoming medications and appointments
      FunctionName: weekly_reminder
      Architectures: 
        - x86_64
      CodeUri: lambda_packages/weekly_reminder.zip
      Environment: 
        Variables:
          database_name: pet_table
          sns_topic: weekly_reminder
      EphemeralStorage: 
        Size: 512
      Events: 
        ScheduledEvent:
          Type: Schedule
          Properties: 
              Description: Fire every Monday at 8am
              Enabled: true
              Schedule: cron(0 8 ? * MON *)
      # The following option may need you to increase your reserved concurrent executions limit.
      # Instructions on doing that https://docs.aws.amazon.com/servicequotas/latest/userguide/request-quota-increase.html
      # Can be commented out instead, though not as safe especially regarding DDOS attacks
      ReservedConcurrentExecutions: 1  # limit on concurrency, ProvisionedConcurrencyConfig is what actually reserves a spot for your lambda and keeps it warm
      Handler: lambda_weekly_reminder.lambda_weekly_reminder
      KmsKeyArn: !GetAtt KMSAppKey.Arn
      MemorySize: 128
      PackageType: Zip
      Role: !GetAtt LambdaRole.Arn
      Runtime: python3.10
      Timeout: 5
      Layers:
        - !Ref LambdaLibrariesLayer

  LambdaAPI:
    Type: AWS::Serverless::Function
  # Guide:
  #   SAM guide --> https://docs.aws.amazon.com/serverless-application-model/latest/developerguide/sam-resource-function.html
  #   dev guide --> https://docs.aws.amazon.com/lambda/
  #   python handler --> https://docs.aws.amazon.com/lambda/latest/dg/python-handler.html#python-handler-how
    Properties:
    #checkov:skip=CKV_AWS_116: This is not mission critical, we don't need a dead letter queue
    #checkov:skip=CKV_AWS_117: VPC costs money and everything is secure enough for our purposes 
      Description: Is the REST API for our pet-diary
      FunctionName: lambda_api
      Architectures: 
        - x86_64
      CodeUri: lambda_packages/lambda_api.zip
      EphemeralStorage: 
        Size: 512
      # The following option may need you to increase your reserved concurrent executions limit.
      # Instructions on doing that https://docs.aws.amazon.com/servicequotas/latest/userguide/request-quota-increase.html
      # Can be commented out instead, though not as safe especially regarding DDOS attacks
      ReservedConcurrentExecutions: 1  # limit on concurrency, ProvisionedConcurrencyConfig is what actually reserves a spot for your lambda and keeps it warm
      Handler: lambda_api.lambda_api
      KmsKeyArn: !GetAtt KMSAppKey.Arn
      MemorySize: 128
      PackageType: Zip
      Role: !GetAtt LambdaRole.Arn
      Runtime: python3.10
      Timeout: 5
      Layers:
        - !Ref LambdaLibrariesLayer
  
  APIEndpoint:
    Type: AWS::Lambda::Url
  # Guide:
  #    SAM guide --> https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-lambda-url.html
    Properties: 
    #checkov:skip=CKV_AWS_258: No Authorisation... yet
  #    Further reading on AuthType: https://docs.aws.amazon.com/lambda/latest/dg/urls-auth.html
      AuthType: NONE
      TargetFunctionArn: !GetAtt LambdaAPI.Arn
      Cors:  # Cors doesn't restrict access, it's simply ensures it
      # CORS guide: --> https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-lambda-url-cors.html
        AllowMethods:
          - GET
        AllowOrigins:
          - "*"


  PermissionsToUseAPI:
    Type: AWS::Lambda::Permission
  # Guide:
  #    SAM guide --> https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-lambda-permission.html
    Properties:
      FunctionName: !Ref LambdaAPI
      Action: lambda:InvokeFunctionUrl
      Principal: "*"
      FunctionUrlAuthType: NONE

  DailyReminder:
    Type: AWS::Serverless::Function
  # Guide:
  #   SAM guide --> https://docs.aws.amazon.com/serverless-application-model/latest/developerguide/sam-resource-function.html
  #   dev guide --> https://docs.aws.amazon.com/lambda/
    #checkov:skip=CKV_AWS_116: This is not mission critical, we don't need a dead letter queue
    #checkov:skip=CKV_AWS_117: VPC costs money and everything is secure enough for our purposes 
    Properties:
      Description: Gives daily reminders of upcoming medications and appointments if any for today
      FunctionName: daily_reminder
      Architectures: 
        - x86_64
      CodeUri: lambda_packages/daily_reminder.zip
      Environment: 
        Variables:
          database_name: pet_table
          sns_topic: daily_reminder
      EphemeralStorage: 
        Size: 512
      Events: 
        ScheduledEvent:
          Type: Schedule
          Properties: 
              Description: Fire every morning at 8am
              Enabled: true
              Schedule: cron(0 8 ? * * *)
      # The following option may need you to increase your reserved concurrent executions limit.
      # Instructions on doing that https://docs.aws.amazon.com/servicequotas/latest/userguide/request-quota-increase.html
      # Can be commented out instead, though not as safe especially regarding DDOS attacks
      ReservedConcurrentExecutions: 1  # limit on concurrency, ProvisionedConcurrencyConfig is what actually reserves a spot for your lambda and keeps it warm
      Handler: lambda_daily_reminder.lambda_daily_reminder
      KmsKeyArn: !GetAtt KMSAppKey.Arn
      MemorySize: 128
      PackageType: Zip
      Role: !GetAtt LambdaRole.Arn
      Runtime: python3.10
      Timeout: 5
      Layers:
          - !Ref LambdaLibrariesLayer

  LambdaLibrariesLayer:
    Type: AWS::Serverless::LayerVersion
  # Guide:
  #   Example ----> https://docs.aws.amazon.com/lambda/latest/dg/layers-sam.html
  #   SAM guide --> https://docs.aws.amazon.com/serverless-application-model/latest/developerguide/sam-resource-layerversion.html
    Properties:
      CompatibleArchitectures: 
        - x86_64
      LayerName: lambda-libraries-layer
      Description: A layer for the Lambdas containing all the pip dependencies
      ContentUri: lambda_packages/lambda_libraries_layer.zip
      RetentionPolicy: Delete
      CompatibleRuntimes:
        - python3.8
        - python3.9
        - python3.10

  LambdaRole:
    Type: AWS::IAM::Role
  # Guide:
  #   SAM guide --> https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-iam-role.html
    Properties:
      Description: Allows Lambdas read access to DynamoDB, and publish to SNS topics
      RoleName: lambda-role
      Policies:
        - PolicyName: Weekly_access
          PolicyDocument:
          # SAM guide to policy doc --> https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies.html#access_policies-json
            Version: "2012-10-17"
            Statement:
              - Sid: PetTableRestrictiveRead
                Effect: Allow
                Resource:
                  - arn:aws:dynamodb:eu-west-2:*:table/pet_table
                  - arn:aws:dynamodb:eu-west-2:*:table/pet_table/index/*
                Action:
                  - dynamodb:Query
                  - dynamodb:GetItem

              - Sid: UseKMSKey
                Effect: Allow
                Resource: !GetAtt KMSAppKey.Arn
                Action:
                  - kms:Decrypt
                  - kms:GenerateDataKey

              - Sid: PublishToSNSWeeklyReminder
                Effect: Allow
                Resource: !GetAtt WeeklyReminderTopic.TopicArn
                Action:
                  - sns:Publish

              - Sid: PublishToSNSDailyReminder
                Effect: Allow
                Resource: !GetAtt DailyReminderTopic.TopicArn
                Action:
                  - sns:Publish

              - Sid: SNSFindTopic
                Effect: Allow
                Resource: arn:aws:sns:eu-west-2:*
                Action:
                  - sns:ListTopics
                  - sns:GetTopicAttributes

              - Sid: CreateLogGroups
                Effect: Allow
                Action: logs:CreateLogGroup
                Resource: arn:aws:logs:eu-west-2:*

              - Sid: PublishLogs
                Effect: Allow
                Action:
                  - logs:CreateLogStream
                  - logs:PutLogEvents
                Resource: arn:aws:logs:eu-west-2:*:log-group:*:*

      AssumeRolePolicyDocument: 
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - lambda.amazonaws.com
            Action:
              - sts:AssumeRole
      MaxSessionDuration: 3600

  WeeklyReminderTopic:
    Type: AWS::SNS::Topic
    # Guide
    #   General SNS --> https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/AWS_SNS.html
    #   Topic only ---> https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-sns-topic.html
    #   Dev guide ----> https://docs.aws.amazon.com/sns/
    Properties:
      TopicName: weekly_reminder
      DisplayName: PD_Weekly_Reminder
      FifoTopic: false
      KmsMasterKeyId: !GetAtt KMSAppKey.KeyId

  DailyReminderTopic:
    Type: AWS::SNS::Topic
    # Guide
    #   General SNS --> https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/AWS_SNS.html
    #   Topic only ---> https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-sns-topic.html
    #   Dev guide ----> https://docs.aws.amazon.com/sns/
    Properties:
      TopicName: daily_reminder
      DisplayName: PD_Daily_Reminder
      FifoTopic: false
      KmsMasterKeyId: !GetAtt KMSAppKey.KeyId

  PetTable:
    Type: AWS::DynamoDB::Table
  # Guide:
  #   SAM Guide --> https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-dynamodb-table.html
  #   Dev guide --> https://docs.aws.amazon.com/dynamodb
    Properties: 
      TableName: pet_table
      AttributeDefinitions: 
        -   AttributeName: name
            AttributeType: S
        -   AttributeName: sort_key
            AttributeType: S
        -   AttributeName: medicine_type
            AttributeType: S
        -   AttributeName: record_type
            AttributeType: S
        -   AttributeName: date_time
            AttributeType: N
        -   AttributeName: next_due
            AttributeType: N
      KeySchema: 
        -   AttributeName: name
            KeyType: HASH
        -   AttributeName: sort_key
            KeyType: RANGE
      GlobalSecondaryIndexes: 
        -   IndexName: medicine_type
            KeySchema: 
              -   AttributeName: medicine_type
                  KeyType: HASH
              -   AttributeName: next_due
                  KeyType: RANGE
            Projection: 
              ProjectionType: ALL
            ProvisionedThroughput: 
                ReadCapacityUnits: 5  # Gives ThrottlingException
                WriteCapacityUnits: 5 # if exceeded
        -   IndexName: record_type
            KeySchema: 
              -   AttributeName: record_type
                  KeyType: HASH
              -   AttributeName: date_time
                  KeyType: RANGE
            Projection: 
              ProjectionType: ALL
            ProvisionedThroughput: 
                ReadCapacityUnits: 5  # Gives ThrottlingException
                WriteCapacityUnits: 5 # if exceeded
      BillingMode: PROVISIONED
      ProvisionedThroughput: 
          ReadCapacityUnits: 5
          WriteCapacityUnits: 5
#!################## Anything below this point  in the template file costs money ##################!#
      PointInTimeRecoverySpecification: 
          PointInTimeRecoveryEnabled: true  # costs $0.23772 per GB-month
      SSESpecification: 
        KMSMasterKeyId: !GetAtt KMSAppKey.Arn
        SSEEnabled: true
        SSEType: KMS

  KMSAppKey:
    Type: AWS::KMS::Key  # costs $1 per creation, gets 20,000 requests a year free for encrypting/decrypting
  # Guide:
  #   SAM guide --> https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-kms-key.html
    Properties: 
      Description: For symmetric encryption of all the applications resources
      Enabled: true
      EnableKeyRotation: true  # Creates new one every year
      KeySpec: SYMMETRIC_DEFAULT
      KeyUsage:  ENCRYPT_DECRYPT
      MultiRegion: false
      Origin: AWS_KMS
      PendingWindowInDays: 30