aws/template.yaml

# SECONDARY — AWS parallel; GCP is the primary narrative of this demo.
# 次要. Not deployed. No VPC, no load balancer, no NAT.
AWSTemplateFormatVersion: "2010-09-09"
Transform: AWS::Serverless-2016-10-31
Description: SECONDARY AWS parallel for insights-api. GCP is the primary narrative. Not deployed.

Parameters:
  SigningSecretArn:
    Type: String
    Default: arn:aws:secretsmanager:us-east-1:000000000000:secret:insights-api-signing-key-placeholder
  LogGroupName:
    Type: String
    Default: /thistle/insights-api
  KmsKeyArn:
    Type: String
    Default: arn:aws:kms:us-east-1:000000000000:key/00000000-0000-0000-0000-000000000001

Globals:
  Function:
    Timeout: 10
    MemorySize: 256
    Runtime: python3.12
    Architectures:
      - x86_64
    Tracing: Active

Resources:
  InsightsFunction:
    Type: AWS::Serverless::Function
    Properties:
      FunctionName: insights-api-secondary
      Handler: handler.handler
      CodeUri: lambda/
      Role: !GetAtt ExecRole.Arn
      ReservedConcurrentExecutions: 5
      KmsKeyArn: !Ref KmsKeyArn
      DeadLetterQueue:
        Type: SQS
        TargetArn: !GetAtt DeadLetter.Arn
      Environment:
        Variables:
          SIGNING_SECRET_ARN: !Ref SigningSecretArn
          LOG_LEVEL: info
      Events:
        Health:
          Type: HttpApi
          Properties:
            ApiId: !Ref InsightsHttpApi
            Method: GET
            Path: /healthz
            PayloadFormatVersion: "2.0"
        Ready:
          Type: HttpApi
          Properties:
            ApiId: !Ref InsightsHttpApi
            Method: GET
            Path: /readyz
            PayloadFormatVersion: "2.0"
        Metrics:
          Type: HttpApi
          Properties:
            ApiId: !Ref InsightsHttpApi
            Method: GET
            Path: /metrics
            PayloadFormatVersion: "2.0"

  InsightsHttpApi:
    Type: AWS::Serverless::HttpApi
    Properties:
      StageName: prod
      Description: SECONDARY HTTP API. Not deployed.
      AccessLogSettings:
        DestinationArn: !GetAtt LogGroup.Arn
        Format: '$context.requestId $context.status $context.integrationErrorMessage'

  ExecRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: insights-api-exec
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Principal:
              Service: lambda.amazonaws.com
            Action: sts:AssumeRole
      Policies:
        - PolicyName: insights-exec-least
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Sid: LogsToSpecificGroup
                Effect: Allow
                Action:
                  - logs:CreateLogStream
                  - logs:PutLogEvents
                Resource: !Sub arn:aws:logs:us-east-1:000000000000:log-group:${LogGroupName}:*
              - Sid: ReadOneSecret
                Effect: Allow
                Action:
                  - secretsmanager:GetSecretValue
                Resource: !Ref SigningSecretArn
              - Sid: PublishToDeadLetter
                Effect: Allow
                Action:
                  - sqs:SendMessage
                Resource: !GetAtt DeadLetter.Arn

  DeployRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: insights-api-deploy
      Description: SECONDARY deploy role. Update this function only.
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Principal:
              Service: codebuild.amazonaws.com
            Action: sts:AssumeRole
      Policies:
        - PolicyName: insights-deploy-one-function
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Sid: UpdateThisFunctionOnly
                Effect: Allow
                Action:
                  - lambda:UpdateFunctionCode
                  - lambda:UpdateFunctionConfiguration
                  - lambda:GetFunction
                Resource: arn:aws:lambda:us-east-1:000000000000:function:insights-api-secondary

  DeadLetter:
    Type: AWS::SQS::Queue
    Properties:
      QueueName: insights-api-secondary-dlq
      KmsMasterKeyId: !Ref KmsKeyArn
      MessageRetentionPeriod: 1209600

  LogGroup:
    Type: AWS::Logs::LogGroup
    Properties:
      LogGroupName: /thistle/insights-api
      RetentionInDays: 30
      KmsKeyId: !Ref KmsKeyArn

Outputs:
  HttpApiId:
    Value: !Ref InsightsHttpApi
  FunctionName:
    Value: !Ref InsightsFunction