template.yaml

AWSTemplateFormatVersion: 2010-09-09
Transform: AWS::Serverless-2016-10-31
Description: A serverless API service for the project Ramen Pocket

Parameters:
  ProjectName:
    Type: String
    Default: ramen-pocket
  Stage:
    Type: String
    Default: production
  TopDomainName:
    Type: String
    Description: A top domain you own and are going to use it for this application. (e.g. rameniac.org)
  ApiDomainName:
    Type: String
    Description: A API domain you own and are going to use it for this application. It must be the same of or a subdomain of the top domain. (e.g. api.rameniac.org)
  DBUsername:
    Type: String
    Description: The username of the database admin.
  DBPassword:
    Type: String
    NoEcho: true
    Description: The password of the database admin.
  GoogleClientId:
    Type: String
    Description: The client id of your Google OAuth Client.
  CertificateARN:
    Type: String
    Description: The ARN of a certificate for the custom domain.

Globals:
  Api:
    Name: ramen-pocket-api
    EndpointConfiguration: REGIONAL
    Domain:
      CertificateArn: !Ref CertificateARN
      DomainName: !Ref ApiDomainName
    GatewayResponses:
      DEFAULT_4XX:
        ResponseTemplates:
          application/json: '{"reason": $context.error.messageString}'
    Auth:
      Authorizers:
        LambdaTokenAuthorizer:
          FunctionArn: !GetAtt Authorizer.Arn
    Cors:
      AllowOrigin: !Join ["", ["'", !Ref TopDomainName, "'"]]
      AllowCredentials: True
  Function:
    Runtime: nodejs10.x
    Timeout: 60
    Handler: index.default
    MemorySize: 128
    Environment:
      Variables:
        PROJECT_NAME: !Ref ProjectName
        STAGE: !Ref Stage
        DB_HOST: !GetAtt Database.Endpoint.Address
        DB_USERNAME: !Ref DBUsername
        DB_PASSWORD: !Ref DBPassword
        DB_DATABASE: ramen_pocket
        GOOGLE_CLIENT_ID: !Ref GoogleClientId
        TZ: UTC
    Tags:
      Owner: Ramen Pocket Dev Team

Outputs:
  DatabaseEndpoint:
    Description: The endpoint of the RDS instance
    Value: !GetAtt Database.Endpoint.Address

Resources:
  IAMRoleForLambda:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - lambda.amazonaws.com
            Action: sts:AssumeRole
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole
      Description: A role used by lambdas in the application Ramen Pocket. It enables the lambdas to log their activities to CloudWatch, which is useful for solving issues.
  IAMRoleForEC2Initializer:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - ec2.amazonaws.com
            Action: sts:AssumeRole
      Policies:
        - PolicyName: EC2ReadSpecifiedBucket
          PolicyDocument:
            Version: 2012-10-17
            Statement:
              - Effect: Allow
                Action: s3:ListBucket
                Resource:
                  Fn::Sub:
                    - arn:aws:s3:::${BUCKET_NAME}
                    - BUCKET_NAME: !Ref ProjectName
              - Effect: Allow
                Action: s3:GetObject
                Resource:
                  Fn::Sub:
                    - arn:aws:s3:::${BUCKET_NAME}/*
                    - BUCKET_NAME: !Ref ProjectName
      Description: For an EC2 instance in the application Ramen Pocket to have permission to get files from a bucket.
  InstanceProfileForEC2Initializer:
    Type: AWS::IAM::InstanceProfile
    Properties:
      Roles:
        - !Ref IAMRoleForEC2Initializer
  EC2Initializer:
    Type: AWS::EC2::Instance
    Properties:
      InstanceInitiatedShutdownBehavior: terminate
      CreditSpecification:
        CPUCredits: standard
      InstanceType: t2.micro
      ImageId: ami-01d025118d8e760db
      IamInstanceProfile: !Ref InstanceProfileForEC2Initializer
      UserData:
        Fn::Base64: !Sub
          - |
            #!/bin/bash
            function perform {
              echo Action: $2
              $1
              while [ $? != 0 ]; do
                echo Failed to $2
                echo Retry the attempt to $2 in $3
                sleep $3
                $1
              done
              echo
            }
            perform "sudo yum update -y" "update packages" 5s
            perform "sudo yum install mysql -y" "install mysql" 5s
            perform "aws s3 cp s3://${BUCKET_NAME}/db-init.sql db-init.sql" "download database initialization file" 5s

            echo Action: initialize all tables in the database
            mysql -h ${DB_HOST} -P ${DB_PORT} -u ${DB_USERNAME} --password=${DB_PASSWORD} ramen_pocket < db-init.sql
            while [ $? != 0 ]; do
              echo Failed to initialize all tables in the database
              echo Retry the attempt to initialize all tables in the database in 10s
              sleep 10s
              mysql -h ${DB_HOST} -P ${DB_PORT} -u ${DB_USERNAME} --password=${DB_PASSWORD} ramen_pocket < db-init.sql
            done
            echo

            echo Finished the database initailization.
            echo Now terminating this instance ...
            sudo poweroff
          - BUCKET_NAME: !Ref ProjectName
            DB_HOST: !GetAtt Database.Endpoint.Address
            DB_PORT: !GetAtt Database.Endpoint.Port
            DB_USERNAME: !Ref DBUsername
            DB_PASSWORD: !Ref DBPassword
      Tags:
        - Key: Owner
          Value: Ramen Pocket Dev Team
        - Key: Description
          Value: This instance is belonged to Ramen Pocket and used to initailize tables in the database.
  DatabaseVPCSecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: A VPC security group for the database.
      SecurityGroupIngress:
        - IpProtocol: tcp
          CidrIp: 0.0.0.0/0
          FromPort: 3306
          ToPort: 3306
  Database:
    Type: AWS::RDS::DBInstance
    Properties:
      DBInstanceClass: db.t2.micro
      AllocatedStorage: "20"
      AvailabilityZone: us-east-1a
      BackupRetentionPeriod: 0
      DeleteAutomatedBackups: true
      DeletionProtection: false
      EnablePerformanceInsights: false
      Engine: mariadb
      MasterUsername: !Ref DBUsername
      MasterUserPassword: !Ref DBPassword
      MonitoringInterval: 0
      MultiAZ: false
      Port: 3306
      StorageType: standard
      VPCSecurityGroups:
        - !GetAtt DatabaseVPCSecurityGroup.GroupId
      Tags:
        - Key: Owner
          Value: Ramen Pocket Dev Team
  CommonLayer:
    Type: AWS::Serverless::LayerVersion
    Properties:
      CompatibleRuntimes: [nodejs10.x]
      ContentUri: ./dist/layers/common.zip
  OAuthLayer:
    Type: AWS::Serverless::LayerVersion
    Properties:
      CompatibleRuntimes: [nodejs10.x]
      ContentUri: ./dist/layers/oauth.zip
  Authorizer:
    Type: AWS::Serverless::Function
    Properties:
      CodeUri: ./dist/lambdas/authorizer
      Role: !GetAtt IAMRoleForLambda.Arn
      Layers: [!Ref CommonLayer, !Ref OAuthLayer]
  ReadUserProfile:
    Type: AWS::Serverless::Function
    Properties:
      CodeUri: ./dist/lambdas/read-user-profile
      Role: !GetAtt IAMRoleForLambda.Arn
      Layers: [!Ref CommonLayer, !Ref OAuthLayer]
      Events:
        APIGateway:
          Type: Api
          Properties:
            Path: /user/profile
            Method: GET
            Auth:
              Authorizer: LambdaTokenAuthorizer
  ReadUserCollections:
    Type: AWS::Serverless::Function
    Properties:
      CodeUri: ./dist/lambdas/read-user-collections
      Role: !GetAtt IAMRoleForLambda.Arn
      Layers: [!Ref CommonLayer, !Ref OAuthLayer]
      Events:
        APIGateway:
          Type: Api
          Properties:
            Path: /user/collections
            Method: GET
            Auth:
              Authorizer: LambdaTokenAuthorizer
  CreateUserCollections:
    Type: AWS::Serverless::Function
    Properties:
      CodeUri: ./dist/lambdas/create-user-collections
      Role: !GetAtt IAMRoleForLambda.Arn
      Layers: [!Ref CommonLayer, !Ref OAuthLayer]
      Events:
        APIGateway:
          Type: Api
          Properties:
            Path: /user/collections/{storeId}
            Method: POST
            Auth:
              Authorizer: LambdaTokenAuthorizer
  DeleteUserCollection:
    Type: AWS::Serverless::Function
    Properties:
      CodeUri: ./dist/lambdas/delete-user-collection
      Role: !GetAtt IAMRoleForLambda.Arn
      Layers: [!Ref CommonLayer, !Ref OAuthLayer]
      Events:
        APIGateway:
          Type: Api
          Properties:
            Path: /user/collections/{storeId}
            Method: DELETE
            Auth:
              Authorizer: LambdaTokenAuthorizer
  ReadUserComments:
    Type: AWS::Serverless::Function
    Properties:
      CodeUri: ./dist/lambdas/read-user-comments
      Role: !GetAtt IAMRoleForLambda.Arn
      Layers: [!Ref CommonLayer, !Ref OAuthLayer]
      Events:
        APIGateway:
          Type: Api
          Properties:
            Path: /user/comments
            Method: GET
            Auth:
              Authorizer: LambdaTokenAuthorizer
  ReadSpecifiedUserProfile:
    Type: AWS::Serverless::Function
    Properties:
      CodeUri: ./dist/lambdas/read-specified-user-profile
      Role: !GetAtt IAMRoleForLambda.Arn
      Layers: [!Ref CommonLayer, !Ref OAuthLayer]
      Events:
        APIGateway:
          Type: Api
          Properties:
            Path: /users/{id}/profile
            Method: GET
            Auth:
              Authorizer: LambdaTokenAuthorizer
  ReadSpecifiedUserCollections:
    Type: AWS::Serverless::Function
    Properties:
      CodeUri: ./dist/lambdas/read-specified-user-collections
      Role: !GetAtt IAMRoleForLambda.Arn
      Layers: [!Ref CommonLayer, !Ref OAuthLayer]
      Events:
        APIGateway:
          Type: Api
          Properties:
            Path: /users/{id}/collections
            Method: GET
            Auth:
              Authorizer: LambdaTokenAuthorizer
  ReadSpecifiedUserComments:
    Type: AWS::Serverless::Function
    Properties:
      CodeUri: ./dist/lambdas/read-specified-user-comments
      Role: !GetAtt IAMRoleForLambda.Arn
      Layers: [!Ref CommonLayer, !Ref OAuthLayer]
      Events:
        APIGateway:
          Type: Api
          Properties:
            Path: /users/{id}/comments
            Method: GET
            Auth:
              Authorizer: LambdaTokenAuthorizer
  ReadStores:
    Type: AWS::Serverless::Function
    Properties:
      CodeUri: ./dist/lambdas/read-stores
      Role: !GetAtt IAMRoleForLambda.Arn
      Layers: [!Ref CommonLayer]
      Events:
        APIGateway:
          Type: Api
          Properties:
            Path: /stores
            Method: GET
            Auth:
              Authorizer: LambdaTokenAuthorizer
  ReadStoreComments:
    Type: AWS::Serverless::Function
    Properties:
      CodeUri: ./dist/lambdas/read-stores-comments
      Role: !GetAtt IAMRoleForLambda.Arn
      Layers: [!Ref CommonLayer, !Ref OAuthLayer]
      Events:
        APIGateway:
          Type: Api
          Properties:
            Path: /stores/{storeId}/comments
            Method: GET
            Auth:
              Authorizer: LambdaTokenAuthorizer
  CreateStoreComment:
    Type: AWS::Serverless::Function
    Properties:
      CodeUri: ./dist/lambdas/create-store-comment
      Role: !GetAtt IAMRoleForLambda.Arn
      Layers: [!Ref CommonLayer, !Ref OAuthLayer]
      Events:
        APIGateway:
          Type: Api
          Properties:
            Path: /stores/{storeId}/comments
            Method: POST
            Auth:
              Authorizer: LambdaTokenAuthorizer
  UpdateStoreComment:
    Type: AWS::Serverless::Function
    Properties:
      CodeUri: ./dist/lambdas/update-store-comment
      Role: !GetAtt IAMRoleForLambda.Arn
      Layers: [!Ref CommonLayer, !Ref OAuthLayer]
      Events:
        APIGateway:
          Type: Api
          Properties:
            Path: /stores/{storeId}/comments/{commentId}
            Method: PUT
            Auth:
              Authorizer: LambdaTokenAuthorizer
  DeleteStoreComment:
    Type: AWS::Serverless::Function
    Properties:
      CodeUri: ./dist/lambdas/delete-store-comment
      Role: !GetAtt IAMRoleForLambda.Arn
      Layers: [!Ref CommonLayer, !Ref OAuthLayer]
      Events:
        APIGateway:
          Type: Api
          Properties:
            Path: /stores/{storeId}/comments/{commentId}
            Method: DELETE
            Auth:
              Authorizer: LambdaTokenAuthorizer
  CreateStore:
    Type: AWS::Serverless::Function
    Properties:
      CodeUri: ./dist/lambdas/create-store
      Role: !GetAtt IAMRoleForLambda.Arn
      Layers: [!Ref CommonLayer]
      Events:
        APIGateway:
          Type: Api
          Properties:
            Path: /stores
            Method: POST
  ReadTags:
    Type: AWS::Serverless::Function
    Properties:
      CodeUri: ./dist/lambdas/read-tags
      Role: !GetAtt IAMRoleForLambda.Arn
      Layers: [!Ref CommonLayer]
      Events:
        APIGateway:
          Type: Api
          Properties:
            Path: /tags
            Method: GET