template.yaml

# This is the SAM template that represents the architecture of your serverless application
# https://docs.aws.amazon.com/serverless-application-model/latest/developerguide/serverless-sam-template-basics.html

# The AWSTemplateFormatVersion identifies the capabilities of the template
# https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/format-version-structure.html
AWSTemplateFormatVersion: 2010-09-09
Description: >-
  lambda-ppot

# Transform section specifies one or more macros that AWS CloudFormation uses to process your template
# https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/transform-section-structure.html
Transform:
- AWS::Serverless-2016-10-31

Globals:
  Function:
    Runtime: nodejs18.x
    MemorySize: 256
    Timeout: 100
    VpcConfig:
      SecurityGroupIds:
        - sg-06981620dc30c36d1
        - sg-012960140b3022393
      SubnetIds:
        - subnet-0b6f3967bc7afb848
    Environment:
      Variables:
        # Make table name accessible as environment variable from function code during execution
        REGION: eu-central-1
        EMAILS_TABLE: perpetual-powers-of-tau
        EMAIL_FROM: contact@perpetualpowersoftau.com
        EMAIL_RETURN: nico@inno-maps.com
        TOKEN_WEB_PAGE: http://localhost:5173/?token=
        JWT_PRIVATE_KEY: super-secret-sha256-hex-string
        JWT_EXPIRATION_TIME: 300000
        TRIES_LIMIT: 1
        TIME_TO_EXPIRE_SPAM: 10
        TIME_TO_EXPIRE_CONFIRMED_EMAIL: 20
        S3_BUCKET_NAME: perpetual-powers-of-tau
        S3_PREFIX: challenges
        RETRIEVAL_TYPE: Bulk
        DAYS_TO_RESTORE: 1
        ACCESS_CONTROL_ALLOW_ORIGIN: '*'
        ACCESS_CONTROL_ALLOW_METHODS: 'GET, POST, OPTIONS'

# Resources declares the AWS resources that you want to include in the stack
# https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/resources-section-structure.html
Resources:
  # Each Lambda function is defined by properties:
  # https://github.com/awslabs/serverless-application-model/blob/master/versions/2016-10-31.md#awsserverlessfunction

  requestRetrievalFunction:
    Type: AWS::Serverless::Function
    Properties:
      Handler: request-retrieval.requestRetrievalHandler
      Role: arn:aws:iam::490752553772:role/perpertual-powers-of-tau-lambda
      Description: Get request to retrieve images from S3 Glacier Archive.
      Policies:
        # Give Create/Read/Update/Delete Permissions to the EmailsTable
      - DynamoDBCrudPolicy:
          TableName: !Ref EmailsTable
      Events:
        Api:
          Type: Api
          Properties:
            Path: /request-retrieval
            Method: ANY
    Metadata:
      BuildMethod: esbuild
      BuildProperties:
        Minify: true
        Target: "es2020"
        Sourcemap: true
        EntryPoints:
          - src/handlers/request-retrieval.ts

  confirmEmailFunction:
    Type: AWS::Serverless::Function
    Properties:
      Handler: confirm-email.confirmEmailHandler
      Role: arn:aws:iam::490752553772:role/perpertual-powers-of-tau-lambda
      Description: Confirm email ownership to retrieve images from S3 Glacier Archive.
      Policies:
        # Give Create/Read/Update/Delete Permissions to the EmailsTable
      - DynamoDBWritePolicy:
          TableName: !Ref EmailsTable
      Events:
        Api:
          Type: Api
          Properties:
            Path: /confirm-email
            Method: ANY
            RequestParameters:
            - method.request.querystring.token:
                Required: true
    Metadata:
      BuildMethod: esbuild
      BuildProperties:
        Minify: true
        Target: "es2020"
        Sourcemap: true
        EntryPoints:
          - src/handlers/confirm-email.ts

  getPresignedUrlFunction:
    Type: AWS::Serverless::Function
    Properties:
      Handler: get-presigned-url.getPresignedUrlHandler
      Role: arn:aws:iam::490752553772:role/perpertual-powers-of-tau-lambda
      Description: Generate a presigned URL for a file download from AWS S3
      Events:
        Api:
          Type: Api
          Properties:
            Path: /get-presigned-url
            Method: ANY
            RequestParameters:
            - method.request.querystring.file:
                Required: true
    Metadata:
      BuildMethod: esbuild
      BuildProperties:
        Minify: true
        Target: "es2020"
        Sourcemap: true
        EntryPoints:
          - src/handlers/get-presigned-url.ts

  # Simple syntax to create a DynamoDB table with a single attribute primary key, more in
  # https://github.com/awslabs/serverless-application-model/blob/master/versions/2016-10-31.md#awsserverlesssimpletable



  # DynamoDB table to store item: {id: <ID>, name: <NAME>}
  EmailsTable:
    Type: AWS::DynamoDB::Table
    Properties:
      TableName: perpetual-powers-of-tau
      BillingMode: PAY_PER_REQUEST
      AttributeDefinitions:
        -
          AttributeName: "email"
          AttributeType: "S"
      KeySchema:
        -
          AttributeName: "email"
          KeyType: "HASH"
      TimeToLiveSpecification:
        AttributeName: "expiration"
        Enabled: true

  ApplicationResourceGroup:
    Type: AWS::ResourceGroups::Group
    Properties:
      Name:
        Fn::Join:
        - ''
        - - ApplicationInsights-SAM-
          - Ref: AWS::StackName
      ResourceQuery:
        Type: CLOUDFORMATION_STACK_1_0

  ApplicationInsightsMonitoring:
    Type: AWS::ApplicationInsights::Application
    Properties:
      ResourceGroupName:
        Fn::Join:
        - ''
        - - ApplicationInsights-SAM-
          - Ref: AWS::StackName
      AutoConfigurationEnabled: 'true'
    DependsOn: ApplicationResourceGroup

Outputs:
  WebEndpoint:
    Description: API Gateway endpoint URL for Prod stage
    Value: !Sub "https://${ServerlessRestApi}.execute-api.${AWS::Region}.amazonaws.com/Prod/"