template.yml

# This is the SAM template that represents the architecture of your serverless application
# https://docs.aws.amazon.com/serverless-application-model/latest/developerguide/serverless-sam-template-basics.html

# The AWSTemplateFormatVersion identifies the capabilities of the template
# https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/format-version-structure.html
AWSTemplateFormatVersion: 2010-09-09
Description: >-
  The main AWS CloudFormation stack to integrate features with SugarCRM.

# Transform section specifies one or more macros that AWS CloudFormation uses to process your template
# https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/transform-section-structure.html
Transform:
- AWS::Serverless-2016-10-31

Metadata:
  AWS::CloudFormation::Interface:
    ParameterGroups:
      - Label:
          default: S3 Bucket
        Parameters:
          - InstallationS3BucketName
          - InstallationFile
      - Label:
          default: Sugar Instance
        Parameters:
          - SugarURL
          - SugarSecretARN
      - Label:
          default: Sugar Portal Chat
        Parameters:
          - EnableSugarPortalChat
          - AmazonConnectInstanceID
          - ContactFlowID
      - Label:
          default: Call Recording Link
        Parameters:
          - EnableCallRecordingLink
          - AWSConnectInstanceName
          - AWSConnectDomain
          - CallRecordingPartialURL
      - Label:
          default: Call Transcript Upload
        Parameters:
          - EnableCallTranscriptUpload

# Environment variables
Parameters:
  InstallationS3BucketName:
    Type: String
    Description: The S3 bucket containing the files needed by this template.
  InstallationFile:
    Type: String
    Description: >- 
      The path to the installation file located in your S3 bucket (e.g. "my/path/Lambda-v1.0.zip").
  EnableSugarPortalChat:
    Type: String
    Default: 'false'
    Description: Turn this on to allow the chat window to be enabled in Sugar Portal.
    AllowedValues:
    - true
    - false
  EnableCallRecordingLink:
    Type: String
    Default: 'false'
    Description: >-
      Turn this on to save call recording links in Sugar. Call recording must be enabled
      in Amazon Connect to use this feature.
    AllowedValues:
    - true
    - false
  EnableCallTranscriptUpload:
    Type: String
    Default: 'false'
    Description: >-
      Turn this on to save call transcripts in Sugar. Call recording and Contact Lens must
      be enabled in Amazon Connect to use this feature.
    AllowedValues:
    - true
    - false
  SugarSecretARN:
    Type: String
    Description: The ARN of the secret that holds credentials to your Sugar instance.
  SugarURL:
    Type: String
    Description: The URL of your Sugar instance.
  AWSConnectInstanceName:
    Type: String
    Description: >-
      The name of your Amazon Connect instance. For example, in the Amazon
      Connect URL "https://example.awsapps.com/connect/ccp-v2", the instance name
      is "example".
  AWSConnectDomain:
    Type: String
    Description: The domain name of your AWS Connect instance (e.g "example.com").
  CallRecordingPartialURL:
    Type: String
    Default: '/connect/get-recording?format=mp3&callLegId='
    Description: >-
      The partial URL used to construct call recording links. This value should not be
      changed unless AWS updates how call recording links are generated.
  ContactFlowID:
    Type: String
    Description: >-
      The ID of the contact flow you wish to use in the Sugar Portal chat. If a contact flow's
      ARN is "arn:aws:connect:us-west-2:123456789012:instance/1111/contact-flow/2222", the
      contact flow ID is "2222".
  AmazonConnectInstanceID:
    Type: String
    Description: >-
      The ID of your Amazon Connect instance. If your instance ARN is 
      "arn:aws:connect:us-west-2:123456789012:instance/1111", the instance ID is "1111".

Conditions:
  ShouldEnableSugarPortalChat: !Equals [ !Ref EnableSugarPortalChat, 'true' ]
  ShouldEnableCallRecordingLink: !Equals [ !Ref EnableCallRecordingLink, 'true' ]
  ShouldEnableCallTranscriptUpload: !Equals [ !Ref EnableCallTranscriptUpload, 'true' ]
  ShouldInstallCreateCaseFunction: !Condition ShouldEnableSugarPortalChat
  ShouldInstallAddNoteToCaseFunction: !Condition ShouldEnableSugarPortalChat
  ShouldInstallCaseStatusFunction: !Condition ShouldEnableSugarPortalChat
  ShouldInstallLexGetStringFunction: !Condition ShouldEnableSugarPortalChat
  ShouldInstallStartChatFunction: !Condition ShouldEnableSugarPortalChat
  ShouldInstallStartChatLambdaExecutionRole: !Condition ShouldEnableSugarPortalChat
  ShouldInstallStartChatApiGateway: !Condition ShouldEnableSugarPortalChat
  ShouldInstallSaveCallTranscriptFunction: !Condition ShouldEnableCallTranscriptUpload
  ShouldInstallCallRecordingFunction: !Condition ShouldEnableCallRecordingLink
  ShouldInstallS3CloudwatchLambdaExecutionRole: !Or
    - !Condition ShouldInstallSaveCallTranscriptFunction
    - !Condition ShouldInstallCallRecordingFunction

# Resources declares the AWS resources that you want to include in the stack
# https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/resources-section-structure.html
Resources:
  # Each Lambda function is defined by properties:
  # https://github.com/awslabs/serverless-application-model/blob/master/versions/2016-10-31.md#awsserverlessfunction

  # This is a Lambda function config associated with the source code: create-case.js
  CreateCaseFunction:
    Condition: ShouldInstallCreateCaseFunction
    Type: AWS::Serverless::Function
    Properties:
      Handler: src/handlers/create-case.createCaseHandler
      Runtime: nodejs18.x
      MemorySize: 128
      Timeout: 100
      Environment:
        Variables:
          region: !Ref AWS::Region
          secretManagerArn: !Ref SugarSecretARN
          sugarUrl: !Ref SugarURL
      Description: A Lambda function that creates a case.
      Policies:
        # Give Lambda basic execution Permission to write CloudWatch logs
        - AWSLambdaBasicExecutionRole
        - SecretsManagerReadWrite

  # This is a Lambda function config associated with the source code: add-note-to-case.js
  AddNoteToCaseFunction:
    Condition: ShouldInstallAddNoteToCaseFunction
    Type: AWS::Serverless::Function
    Properties:
      Handler: src/handlers/add-note-to-case.handler
      Runtime: nodejs18.x
      MemorySize: 128
      Timeout: 100
      Environment:
        Variables:
          region: !Ref AWS::Region
          secretManagerArn: !Ref SugarSecretARN
          sugarUrl: !Ref SugarURL
      Description: A Lambda function that adds a note to a case.
      Policies:
        # Give Lambda basic execution Permission to write CloudWatch logs
        - AWSLambdaBasicExecutionRole
        - SecretsManagerReadWrite

  # This is a Lambda function config for source code: case-status.js
  CaseStatusFunction:
    Condition: ShouldInstallCaseStatusFunction
    Type: 'AWS::Serverless::Function'
    Properties:
      Description: AWS Lambda Function to get case status by case number
      Handler: 'src/handlers/case-status.handler'
      Runtime: 'nodejs18.x'
      MemorySize: 128
      Timeout: 60
      Environment:
        Variables:
          region: !Ref AWS::Region
          secretManagerArn: !Ref SugarSecretARN
          sugarUrl: !Ref SugarURL
      Policies:
        # Give Lambda basic execution Permission to createCase
        - AWSLambdaBasicExecutionRole
        - SecretsManagerReadWrite

  # This is a Lambda function config for source code: lex-get-string.js
  LexGetStringFunction:
    Condition: ShouldInstallLexGetStringFunction
    Type: 'AWS::Serverless::Function'
    Properties:
      Description: AWS Lambda Function to be called by Lex to return whole input
      Handler: 'src/handlers/lex-get-string.handler'
      Runtime: 'nodejs18.x'
      MemorySize: 128
      Timeout: 60
      Policies:
        # Give Lambda basic execution Permission to createCase
        - AWSLambdaBasicExecutionRole

  SaveCallTranscriptFunction:
    Condition: ShouldInstallSaveCallTranscriptFunction
    Type: 'AWS::Serverless::Function'
    Properties:
      Description: AWS Lambda Function to save call transcripts based on S3 Trigger
      Handler: 'src/handlers/save-transcript.handler'
      Runtime: 'nodejs18.x'
      MemorySize: 128
      Role: !GetAtt s3CloudwatchLambdaExecutionRole.Arn
      Timeout: 60
      Environment:
        Variables:
          region: !Ref AWS::Region
          secretManagerArn: !Ref SugarSecretARN
          sugarUrl: !Ref SugarURL

  CallRecordingFunction:
    Condition: ShouldInstallCallRecordingFunction
    Type: 'AWS::Serverless::Function'
    Properties:
      Description: AWS Lambda Function to perform actions on the call recording
      Handler: 'src/handlers/call-recording.handler'
      Runtime: 'nodejs18.x'
      MemorySize: 128
      Role: !GetAtt s3CloudwatchLambdaExecutionRole.Arn
      Timeout: 60
      Environment:
        Variables:
          region: !Ref AWS::Region
          secretManagerArn: !Ref SugarSecretARN
          sugarUrl: !Ref SugarURL
          awsConnectInstance: !Ref AWSConnectInstanceName
          awsConnectDomain: !Ref AWSConnectDomain
          callRecordingPartialUrl: !Ref CallRecordingPartialURL

  # Function to start connect Chat from API call
  StartChatFunction:
    Condition: ShouldInstallStartChatFunction
    Type: 'AWS::Serverless::Function'
    Properties:
      Description: AWS Lambda Function to start chat from incoming API call
      Handler: 'src/handlers/start-chat.handler'
      Runtime: 'nodejs18.x'
      MemorySize: 128
      Role: !GetAtt StartChatLambdaExecutionRole.Arn
      Timeout: 60
      Environment:
        Variables:
          instanceId: !Ref AmazonConnectInstanceID
          contactFlowId: !Ref ContactFlowID
      Events:
        GetRoot:
          Type: Api
          Properties:
            RestApiId: !Ref StartChatApiGateway
            Path: /
            Method: post

  # Role to combine S3, CloudWatch, and Basic Lambda permissions for saving
  s3CloudwatchLambdaExecutionRole:
    Condition: ShouldInstallS3CloudwatchLambdaExecutionRole
    Type: "AWS::IAM::Role"
    Properties:
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: "Allow"
            Principal:
              Service:
                - "lambda.amazonaws.com"
            Action:
              - "sts:AssumeRole"
      Path: "/"
      ManagedPolicyArns:
        - "arn:aws:iam::aws:policy/AmazonS3FullAccess"
        - "arn:aws:iam::aws:policy/CloudWatchLogsFullAccess"
        - "arn:aws:iam::aws:policy/AWSLambdaExecute"
        - "arn:aws:iam::aws:policy/SecretsManagerReadWrite"

  # Role to give StartChat lambda access to the client amazon connect instance
  StartChatLambdaExecutionRole:
    Condition: ShouldInstallStartChatLambdaExecutionRole
    Type: "AWS::IAM::Role"
    Properties:
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: "Allow"
            Principal:
              Service:
                - "lambda.amazonaws.com"
            Action:
              - "sts:AssumeRole"
      Path: "/"
      Policies:
        - PolicyName: start-chat-contact-execution-policy
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Effect: "Allow"
                Action:
                  - 'logs:CreateLogGroup'
                  - 'logs:CreateLogStream'
                  - 'logs:PutLogEvents'
                Resource:
                  - !Sub "arn:${AWS::Partition}:logs:${AWS::Region}:${AWS::AccountId}:log-group:/aws/lambda/*"
              - Effect: "Allow"
                Action:
                  - "connect:StartChatContact"
                Resource:
                  - !Sub "arn:${AWS::Partition}:connect:${AWS::Region}:${AWS::AccountId}:instance/${AmazonConnectInstanceID}"
                  - !Sub "arn:${AWS::Partition}:connect:${AWS::Region}:${AWS::AccountId}:instance/${AmazonConnectInstanceID}/*"

  StartChatApiGateway:
    Condition: ShouldInstallStartChatApiGateway
    Type: AWS::Serverless::Api
    Properties:
      StageName: Prod