template.yaml

AWSTemplateFormatVersion: '2010-09-09'
Transform: AWS::Serverless-2016-10-31
Description: >
  Postgres Java Lambda Trigger Demo

Parameters:
  DBNAMEPARAM:
    Description: The DB Name
    Type: String
    Default: demo
  DBUSERPARAM:
    Description: The DB User Name
    Type: String
    Default: master

Globals:
  Function:
    Environment: 
      Variables:
        DB_MASTER_SECRET_ARN: !GetAtt RDSStack.Outputs.SecretArn
        DB_ENDPOINT: !GetAtt RDSStack.Outputs.Endpoint
        DB_NAME: !Ref DBNAMEPARAM
    CodeUri: .
    Architectures:
        - arm64         # SnapStart now supports arm
    Runtime: java21
    Timeout: 30
    MemorySize: 3009

Resources:
  
      
  RDSStack:
    Type: AWS::CloudFormation::Stack
    Properties:
      TemplateURL: postgres.yaml
      TimeoutInMinutes: '60'
      Parameters:
        DBNAMEPARAM: !Ref DBNAMEPARAM
        DBUSERPARAM: !Ref DBUSERPARAM
        
  ApiGateway:
        Type: AWS::Serverless::HttpApi
        Properties:
            CorsConfiguration: true
            
  FrontEnd:
    Type: AWS::Serverless::Function
    DependsOn: FrontEndLogGroup
    Properties:
      FunctionName: !Sub ${AWS::StackName}-DemoFrontEnd
      Description: Displays Sample Postgres Table and allows Address Entry
      Handler: demo.FrontEnd
      AutoPublishAlias: SNAPSTART
      SnapStart:
        ApplyOn: PublishedVersions
      Policies: 
        - !Ref SecretsPolicy
      Events:
        HelloWorld:
          Type: HttpApi
          Properties:
            Path: /
            Method: get
            ApiId: !Ref ApiGateway
            
  FrontEndLogGroup:
    Type: AWS::Logs::LogGroup
    UpdateReplacePolicy: Retain
    DeletionPolicy: Delete
    Properties:
      LogGroupName: !Sub '/aws/lambda/${AWS::StackName}-DemoFrontEnd'
      RetentionInDays: 90
            
  CreateAddress:
    Type: AWS::Serverless::Function
    DependsOn: CreateAddressLogGroup
    Properties:
      FunctionName: !Sub ${AWS::StackName}-CreateAddressFrontEnd
      Description: Creates an address row in table and redirects back to /
      Handler: demo.CreateAddressFrontEnd
      AutoPublishAlias: SNAPSTART
      SnapStart:
        ApplyOn: PublishedVersions
      Policies: 
        - !Ref SecretsPolicy
      Events:
        HelloWorld:
          Type: HttpApi
          Properties:
            Path: /create
            Method: get
            ApiId: !Ref ApiGateway
  
  CreateAddressLogGroup:
    Type: AWS::Logs::LogGroup
    UpdateReplacePolicy: Retain
    DeletionPolicy: Delete
    Properties:
      LogGroupName: !Sub '/aws/lambda/${AWS::StackName}-CreateAddressFrontEnd'
      RetentionInDays: 90
            
  MultipleAddress:
    Type: AWS::Serverless::Function
    DependsOn: MultipleAddressLogGroup
    Properties:
      FunctionName: !Sub ${AWS::StackName}-CreateMultipleAddressFrontEnd
      Description: Creates multiple address rows in table and redirects back to /
      Handler: demo.CreateMultipleAddressFrontEnd
      AutoPublishAlias: SNAPSTART
      SnapStart:
        ApplyOn: PublishedVersions
      Policies: 
        - !Ref SecretsPolicy
      Events:
        HelloWorld:
          Type: HttpApi
          Properties:
            Path: /multiple
            Method: get
            ApiId: !Ref ApiGateway
  
  MultipleAddressLogGroup:
    Type: AWS::Logs::LogGroup
    UpdateReplacePolicy: Retain
    DeletionPolicy: Delete
    Properties:
      LogGroupName: !Sub '/aws/lambda/${AWS::StackName}-CreateMultipleAddressFrontEnd'
      RetentionInDays: 90          
            
  DeleteAddress:
    Type: AWS::Serverless::Function
    DependsOn: DeleteAddressLogGroup
    Properties:
      FunctionName: !Sub ${AWS::StackName}-DeleteAddressFrontEnd
      Description: Deletes an address row in table and redirects back to /
      Handler: demo.DeleteAddressFrontEnd
      AutoPublishAlias: SNAPSTART
      SnapStart:
        ApplyOn: PublishedVersions
      Policies: 
        - !Ref SecretsPolicy
      Events:
        HelloWorld:
          Type: HttpApi
          Properties:
            Path: /delete
            Method: get
            ApiId: !Ref ApiGateway
            
  DeleteAddressLogGroup:
    Type: AWS::Logs::LogGroup
    UpdateReplacePolicy: Retain
    DeletionPolicy: Delete
    Properties:
      LogGroupName: !Sub '/aws/lambda/${AWS::StackName}-DeleteAddressFrontEnd'
      RetentionInDays: 90             
            
  DeleteAuditLog:
    Type: AWS::Serverless::Function
    DependsOn: DeleteAuditLogLogGroup
    Properties:
      FunctionName: !Sub ${AWS::StackName}-DeleteAuditLogFrontEnd
      Description: Clears the audit_log table and redirects back to /
      Handler: demo.DeleteAuditLogFrontEnd
      AutoPublishAlias: SNAPSTART
      SnapStart:
        ApplyOn: PublishedVersions
      Policies: 
        - !Ref SecretsPolicy
      Events:
        HelloWorld:
          Type: HttpApi
          Properties:
            Path: /audit
            Method: get
            ApiId: !Ref ApiGateway
  
  DeleteAuditLogLogGroup:
    Type: AWS::Logs::LogGroup
    UpdateReplacePolicy: Retain
    DeletionPolicy: Delete
    Properties:
      LogGroupName: !Sub '/aws/lambda/${AWS::StackName}-DeleteAuditLogFrontEnd'
      RetentionInDays: 90
    
    
  PostgresAddressTrigger:
    Type: AWS::Serverless::Function
    Properties:
      FunctionName: PostgresAddressTrigger
      Description: Address trigger that will geo encode addresses on INSERT/UPDATE
      Handler: demo.PostgresAddressTrigger
      Environment:
        Variables:
            PLACE_INDEX: !Ref PlaceIndex
      ReservedConcurrentExecutions: 2
      EventInvokeConfig:
        MaximumEventAgeInSeconds: 3600
        MaximumRetryAttempts: 2
      Policies: 
        - !Ref SecretsPolicy
        - !Ref GeoCodingPolicy 
  
  PostgresAddressTriggerLogGroup:
    Type: AWS::Logs::LogGroup
    UpdateReplacePolicy: Retain
    DeletionPolicy: Delete
    Properties:
      LogGroupName: !Sub '/aws/lambda/${PostgresAddressTrigger}'
      RetentionInDays: 90       
        
  PlaceIndex:
        Type: AWS::Location::PlaceIndex
        Properties: 
            DataSource: Esri
            DataSourceConfiguration: 
                IntendedUse: SingleUse
            Description: Place Index for GEO queries
            IndexName: PostresDemoIndex
            
  PostgresAuditLogTrigger:
    Type: AWS::Serverless::Function
    Properties:
      FunctionName: PostgresAuditLogTrigger
      Description: Lambda that will fire when changes are made to tables for audit logging
      Handler: demo.PostgresAuditLogTrigger
      ReservedConcurrentExecutions: 2
      EventInvokeConfig:
        MaximumEventAgeInSeconds: 3600
        MaximumRetryAttempts: 2
      Policies: 
        - !Ref SecretsPolicy
        
  PostgresAuditLogTriggerLogGroup:
    Type: AWS::Logs::LogGroup
    UpdateReplacePolicy: Retain
    DeletionPolicy: Delete
    Properties:
      LogGroupName: !Sub '/aws/lambda/${PostgresAuditLogTrigger}'
      RetentionInDays: 90     
        
  SQSQueue:
        Type: AWS::SQS::Queue
        Properties:
            QueueName: !Sub ${AWS::StackName}-AuditLog
            ReceiveMessageWaitTimeSeconds: 0
            MessageRetentionPeriod: 86400
            VisibilityTimeout: 30
  
  SendToSQS:
    Type: AWS::Serverless::Function
    Properties:
      FunctionName: ForwardEventToSQS
      Description: Lambda that will forward payload to SQS Queue
      Handler: ForwardToSQS.handler
      Runtime: nodejs18.x
      MemorySize: 512
      Timeout: 5
      Environment:
        Variables:
          SQS_QUEUE_URL: !Ref SQSQueue
          # Don't need to set anything for this lambda other than above
          DB_MASTER_SECRET_ARN: !Ref AWS::NoValue
          DB_ENDPOINT: !Ref AWS::NoValue
          DB_NAME: !Ref AWS::NoValue
      EventInvokeConfig:
        MaximumEventAgeInSeconds: 3600
        MaximumRetryAttempts: 2
      Policies:
        - SQSSendMessagePolicy:
            QueueName: !GetAtt SQSQueue.QueueName
  
  SendToSQSLogGroup:
    Type: AWS::Logs::LogGroup
    UpdateReplacePolicy: Retain
    DeletionPolicy: Delete
    Properties:
      LogGroupName: !Sub '/aws/lambda/${SendToSQS}'
      RetentionInDays: 90  
            
  PostgresAuditLogTriggerSQS:
    Type: AWS::Serverless::Function
    Properties:
      FunctionName: PostgresAuditLogTriggerSQS
      Description: Lambda that will fire when changes are made to tables for audit logging
      Handler: demo.PostgresAuditLogTriggerSQS
      Policies: 
        - !Ref SecretsPolicy
      Events:
        SQSQueue:
          Type: SQS
          Properties:
            BatchSize: 1
            Queue: !GetAtt SQSQueue.Arn
            ScalingConfig:
                MaximumConcurrency: 2
  
  PostgresAuditLogTriggerSQSLogGroup:
    Type: AWS::Logs::LogGroup
    UpdateReplacePolicy: Retain
    DeletionPolicy: Delete
    Properties:
      LogGroupName: !Sub '/aws/lambda/${PostgresAuditLogTriggerSQS}'
      RetentionInDays: 90  
  
  
   
  DBInitialization:
    Type: AWS::Serverless::Function
    DependsOn: DBInitializationLogGroup
    Properties:
      FunctionName: !Sub ${AWS::StackName}-DBInitialization
      Description: Performs the DB Scripting after DB creation
      Handler: demo.CloudFormationCustomResource
      Timeout: 120
      EventInvokeConfig:
        MaximumEventAgeInSeconds: 600
        MaximumRetryAttempts: 1
      Policies: 
        - !Ref SecretsPolicy
  
  DBInitializationLogGroup:
    Type: AWS::Logs::LogGroup
    UpdateReplacePolicy: Retain
    DeletionPolicy: Delete
    Properties:
      LogGroupName: !Sub '/aws/lambda/${AWS::StackName}-DBInitialization'
      RetentionInDays: 30
  
  DBCustom:
    Type: Custom::DBInitialization
    DependsOn: RDSStack  # Make sure the RDS instance is done before we run DB Scripts
    Properties:
        ServiceToken: !GetAtt DBInitialization.Arn

  SecretsPolicy:
    Type: 'AWS::IAM::ManagedPolicy'
    Properties:
        Description: Allow Lambdas to access the RDS Managed Secret
        PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Effect: Allow
                Action:
                  - 'secretsmanager:GetSecretValue'
                  - 'secretsmanager:DescribeSecret'
                Resource: !GetAtt RDSStack.Outputs.SecretArn
   
  GeoCodingPolicy:
    Type: 'AWS::IAM::ManagedPolicy'
    Properties:
        Description: Allow Lambdas to call geo API for coding addresses
        PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Effect: Allow
                Action:
                  - geo:SearchPlaceIndexForText
                Resource: !GetAtt PlaceIndex.Arn

Outputs:
  ApiEndpoint:
    Description: "API Gateway endpoint URL, Open Browser to this to see demo"
    Value: !GetAtt ApiGateway.ApiEndpoint
  DBName:
    Description: "DB Name"
    Value: !Ref DBNAMEPARAM
  DBUsername:
    Description: "DB Username"
    Value: !Ref DBUSERPARAM
  DBEndpoint:
    Description: "DB Endpoint"
    Value: !GetAtt RDSStack.Outputs.Endpoint
  DBURL:
    Description: "JDBC Connection URL"
    Value: !Sub 'jdbc:postgresql://${RDSStack.Outputs.Endpoint}/${DBNAMEPARAM}'