music-archive-cf-descriptor.yml

AWSTemplateFormatVersion: '2010-09-09'
Description: Music Archive Stack
Parameters:
  Env:
    Type: String
  PublicURL:
    Type: String
  HostedZoneId:
    Type: String
  DNSCertARN:
    Type: String
  S3OriginAccessIdentity:
    Type: String
  DbLibraryTableStore:
    Type: String
  ServeTrackBucketFilePrefix:
    Type: String
  AlbumArtBucketFilePrefix:
    Type: String
Conditions:
  CreateProdResources: !Equals [ !Ref Env, 'prod' ]
Resources:
  # S3 Dist Bucket
  MusicArchiveFeDistributionBucket:
    Type: AWS::S3::Bucket
    Properties:
      AccessControl: Private
      BucketName:
        Fn::Join: [ '-', [ 'music-archive-fe-distribution', !Ref Env ] ]
      VersioningConfiguration:
        Status: Enabled
  MusicArchiveFeDistributionBucketPolicy:
    Type: AWS::S3::BucketPolicy
    Properties:
      Bucket: !Ref MusicArchiveFeDistributionBucket
      PolicyDocument:
        Statement:
          - Effect: Allow
            Principal:
              AWS:
                - Fn::Join: [ ' ', [ 'arn:aws:iam::cloudfront:user/CloudFront Origin Access Identity', !Ref S3OriginAccessIdentity ] ]
            Action:
              - 's3:GetObject'
            Resource:
              Fn::Join: [ '', [ !GetAtt MusicArchiveFeDistributionBucket.Arn, '/*' ] ]
          - Effect: Allow
            Principal:
              AWS:
                - Fn::Join: [ ' ', [ 'arn:aws:iam::cloudfront:user/CloudFront Origin Access Identity', !Ref S3OriginAccessIdentity ] ]
            Action:
              - 's3:ListBucket'
            Resource: !GetAtt MusicArchiveFeDistributionBucket.Arn
  # S3 Music File Bucket
  MusicArchiveFileLibraryBucket:
    DependsOn: TagReaderFunction
    DependsOn: TagReaderLambdaPermission
    Type: AWS::S3::Bucket
    Properties:
      AccessControl: Private
      BucketName:
        Fn::Join: [ '-', [ 'music-archive-file-library', !Ref Env ] ]
      NotificationConfiguration:
        LambdaConfigurations:
          - Function: !GetAtt TagReaderFunction.Arn
            Event: 's3:ObjectCreated:*'
            Filter:
              S3Key:
                Rules:
                  - Name: suffix
                    Value: mp3
          - Function: !GetAtt TagReaderFunction.Arn
            Event: 's3:ObjectCreated:*'
            Filter:
              S3Key:
                Rules:
                  - Name: suffix
                    Value: m4a
  # S3 Album Art Bucket
  AlbumArtBucket:
    Type: AWS::S3::Bucket
    Properties:
      AccessControl: Private
      BucketName:
        Fn::Join: [ '-', [ 'music-archive-album-art', !Ref Env ] ]
  AlbumArtBucketPolicy:
    Type: AWS::S3::BucketPolicy
    Properties:
      Bucket: !Ref AlbumArtBucket
      PolicyDocument:
        Statement:
          - Effect: Allow
            Principal:
              AWS:
                - Fn::Join: [ ' ', [ 'arn:aws:iam::cloudfront:user/CloudFront Origin Access Identity', !Ref S3OriginAccessIdentity ] ]
            Action:
              - 's3:GetObject'
            Resource:
              Fn::Join: [ '', [ !GetAtt AlbumArtBucket.Arn, '/*' ] ]
          - Effect: Allow
            Principal:
              AWS:
                - Fn::Join: [ ' ', [ 'arn:aws:iam::cloudfront:user/CloudFront Origin Access Identity', !Ref S3OriginAccessIdentity ] ]
            Action:
              - 's3:ListBucket'
            Resource: !GetAtt AlbumArtBucket.Arn
  # S3 Serve Music File Bucket
  ServeMusicFileBucket:
    Type: AWS::S3::Bucket
    Properties:
      AccessControl: Private
      BucketName:
        Fn::Join: [ '-', [ 'music-archive-serve-files', !Ref Env ] ]
      LifecycleConfiguration:
        Rules:
          - Id: PurgeStaleTracks
            Status: Enabled
            ExpirationInDays: 1
  ServeMusicFileBucketPolicy:
    Type: AWS::S3::BucketPolicy
    Properties:
      Bucket: !Ref ServeMusicFileBucket
      PolicyDocument:
        Statement:
          - Effect: Allow
            Principal:
              AWS:
                - Fn::Join: [ ' ', [ 'arn:aws:iam::cloudfront:user/CloudFront Origin Access Identity', !Ref S3OriginAccessIdentity ] ]
            Action:
              - 's3:GetObject'
            Resource:
              Fn::Join: [ '', [ !GetAtt ServeMusicFileBucket.Arn, '/*' ] ]
          - Effect: Allow
            Principal:
              AWS:
                - Fn::Join: [ ' ', [ 'arn:aws:iam::cloudfront:user/CloudFront Origin Access Identity', !Ref S3OriginAccessIdentity ] ]
            Action:
              - 's3:ListBucket'
            Resource: !GetAtt ServeMusicFileBucket.Arn
  # CloudFront distro to sit in front of bucket and reduce outbound cost
  MusicArchiveDistribution:
    Type: AWS::CloudFront::Distribution
    Properties:
      DistributionConfig:
        Enabled: true
        Comment:
          Fn::Join: [ '', [ 'MusicArchive Distro [', !Ref Env, ']' ] ]
        Aliases:
        - !Ref PublicURL
        DefaultRootObject: index.html
        HttpVersion: http2
        ViewerCertificate:
          AcmCertificateArn: !Ref DNSCertARN
          SslSupportMethod: sni-only
        Origins:
        - DomainName: !GetAtt MusicArchiveFeDistributionBucket.DomainName
          Id:
            Fn::Join: [ '-', [ 'origin', !GetAtt MusicArchiveFeDistributionBucket.DomainName ] ]
          S3OriginConfig:
            OriginAccessIdentity:
              Fn::Join: [ '', [ 'origin-access-identity/cloudfront/', !Ref S3OriginAccessIdentity ] ]
        - DomainName: !GetAtt AlbumArtBucket.DomainName
          Id:
            Fn::Join: [ '-', [ 'origin', !GetAtt AlbumArtBucket.DomainName ] ]
          S3OriginConfig:
            OriginAccessIdentity:
              Fn::Join: [ '', [ 'origin-access-identity/cloudfront/', !Ref S3OriginAccessIdentity ] ]
        - DomainName: !GetAtt ServeMusicFileBucket.DomainName
          Id:
            Fn::Join: [ '-', [ 'origin', !GetAtt ServeMusicFileBucket.DomainName ] ]
          S3OriginConfig:
            OriginAccessIdentity:
              Fn::Join: [ '', [ 'origin-access-identity/cloudfront/', !Ref S3OriginAccessIdentity ] ]
        - DomainName:
            Fn::Join: [ '', [ !Ref MusicLibraryApi, '.execute-api.', !Ref 'AWS::Region', '.amazonaws.com' ] ]
          Id:
            Fn::Join: [ '', [ 'origin-', !Ref MusicLibraryApi, '.execute-api.', !Ref 'AWS::Region', '.amazonaws.com' ] ]
          OriginPath:
            Fn::Join: [ '', [ '/', !Ref Env ] ]
          CustomOriginConfig:
            HTTPSPort: '443'
            OriginProtocolPolicy: https-only
            OriginSSLProtocols:
            - 'TLSv1'
            - 'TLSv1.1'
            - 'TLSv1.2'
        CustomErrorResponses:
        - ErrorCode: 404
          ResponseCode: 200
          ResponsePagePath: /index.html
        DefaultCacheBehavior:
          AllowedMethods:
          - GET
          - HEAD
          - OPTIONS
          TargetOriginId:
            Fn::Join: [ '-', [ 'origin', !GetAtt MusicArchiveFeDistributionBucket.DomainName ] ]
          ForwardedValues:
            QueryString: true
            Cookies:
              Forward: all
          ViewerProtocolPolicy: redirect-to-https
          Compress: true
        CacheBehaviors:
        - AllowedMethods:
          - GET
          - HEAD
          - OPTIONS
          TargetOriginId:
            Fn::Join: [ '', [ 'origin-', !Ref MusicLibraryApi, '.execute-api.', !Ref 'AWS::Region', '.amazonaws.com' ] ]
          PathPattern: '/api/*'
          DefaultTTL: 60
          MaxTTL: 3600
          MinTTL: 60
          ForwardedValues:
            QueryString: true
            Cookies:
              Forward: none
          ViewerProtocolPolicy: redirect-to-https
        - AllowedMethods:
          - GET
          - HEAD
          - OPTIONS
          TargetOriginId:
            Fn::Join: [ '-', [ 'origin', !GetAtt AlbumArtBucket.DomainName ] ]
          PathPattern:
            Fn::Join: [ '', [ '/', !Ref AlbumArtBucketFilePrefix, '/*' ] ]
          ForwardedValues:
            QueryString: false
            Cookies:
              Forward: none
          ViewerProtocolPolicy: redirect-to-https
          Compress: true
        - AllowedMethods:
          - GET
          - HEAD
          - OPTIONS
          TargetOriginId:
            Fn::Join: [ '-', [ 'origin', !GetAtt ServeMusicFileBucket.DomainName ] ]
          PathPattern:
            Fn::Join: [ '', [ '/', !Ref ServeTrackBucketFilePrefix, '/*' ] ]
          DefaultTTL: 60
          MaxTTL: 3600
          MinTTL: 60
          ForwardedValues:
            QueryString: false
            Cookies:
              Forward: none
          ViewerProtocolPolicy: redirect-to-https
          Compress: true
  # DNS Record Set
  MusicArchiveDistributionDNSRecord:
    Type: AWS::Route53::RecordSet
    Properties:
      HostedZoneId: !Ref HostedZoneId
      Name: !Ref PublicURL
      Type: A
      AliasTarget:
        DNSName: !GetAtt MusicArchiveDistribution.DomainName
        EvaluateTargetHealth: false
        HostedZoneId: Z2FDTNDATAQYW2
  # DynamoDB Table for Library
  MusicLibraryTable:
    Type: AWS::DynamoDB::Table
    Properties:
      TableName: !Ref DbLibraryTableStore
      KeySchema:
      - AttributeName: id
        KeyType: HASH
      AttributeDefinitions:
      - AttributeName: id
        AttributeType: S
      - AttributeName: artist
        AttributeType: S
      GlobalSecondaryIndexes:
      - IndexName: artist-index
        KeySchema:
          - AttributeName: artist
            KeyType: HASH
        Projection:
          ProjectionType: ALL
        ProvisionedThroughput:
          ReadCapacityUnits: 4
          WriteCapacityUnits: 4
      ProvisionedThroughput:
        ReadCapacityUnits: 4
        WriteCapacityUnits: 4
  # Lambda Role Definitions
  TagReaderRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName:
        Fn::Join: [ '-', [ 'tag-reader-role', !Ref Env ] ]
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - 'lambda.amazonaws.com'
            Action:
              - 'sts:AssumeRole'
      Path: /
      ManagedPolicyArns:
        - 'arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole'
        - 'arn:aws:iam::aws:policy/AmazonS3FullAccess'
  DBModelBuilderRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName:
        Fn::Join: [ '-', [ 'db-model-builder-role', !Ref Env ] ]
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - 'lambda.amazonaws.com'
            Action:
              - 'sts:AssumeRole'
      Path: /
      ManagedPolicyArns:
        - 'arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole'
        - 'arn:aws:iam::aws:policy/AmazonS3FullAccess'
        - 'arn:aws:iam::aws:policy/AmazonDynamoDBFullAccess'
  ApiLambdaRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName:
        Fn::Join: [ '-', [ 'api-lambda-role', !Ref Env ] ]
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - 'lambda.amazonaws.com'
            Action:
              - 'sts:AssumeRole'
      Path: /
      ManagedPolicyArns:
        - 'arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole'
        - 'arn:aws:iam::aws:policy/AmazonDynamoDBReadOnlyAccess'
  ApiS3LambdaRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName:
        Fn::Join: [ '-', [ 'api-s3-lambda-role', !Ref Env ] ]
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - 'lambda.amazonaws.com'
            Action:
              - 'sts:AssumeRole'
      Path: /
      ManagedPolicyArns:
        - 'arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole'
        - 'arn:aws:iam::aws:policy/AmazonDynamoDBReadOnlyAccess'
        - 'arn:aws:iam::aws:policy/AmazonS3FullAccess'
  # Lambda Function Definitions for Deployment
  LambdaStaticDeploymentRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName:
        Fn::Join: [ '-', [ 'music-archive-s3-static-deployment-role', !Ref Env ] ]
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - 'lambda.amazonaws.com'
            Action:
              - 'sts:AssumeRole'
      Path: /
      ManagedPolicyArns:
        - 'arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole'
        - 'arn:aws:iam::aws:policy/AmazonS3FullAccess'
        - 'arn:aws:iam::aws:policy/AWSCodePipelineFullAccess'
  StaticS3DeploymentFunction:
    Type: AWS::Lambda::Function
    Properties:
      FunctionName:
        Fn::Join: [ '-', [ 'MusicArchive', 'StaticS3DeployerFunction', !Ref Env ] ]
      Handler: lambda/deployment/static-s3-deployer.handler
      Runtime: nodejs10.x
      Code:
        S3Bucket: 'music-archive-source-code'
        S3Key: %{SourceCodeBucket}
      Role:
        Fn::GetAtt:
          - LambdaStaticDeploymentRole
          - Arn
      Timeout: 30
  # Lambda Function Definitions for Model
  TagReaderFunction:
    DependsOn: TagReaderRole
    Type: AWS::Lambda::Function
    Properties:
      Handler: lambda/services/model/tag-reader.handler
      Runtime: nodejs10.x
      Code:
        S3Bucket: 'music-archive-source-code'
        S3Key: %{SourceCodeBucket}
      Role:
        Fn::GetAtt:
          - TagReaderRole
          - Arn
      MemorySize: 1024
      Timeout: 120
      Environment:
        Variables:
          ALBUM_ART_BUCKET: !Ref AlbumArtBucket
          ALBUM_ART_BUCKET_PREFIX: !Ref AlbumArtBucketFilePrefix
  TagReaderLambdaPermission:
    DependsOn: TagReaderFunction
    Type: AWS::Lambda::Permission
    Properties:
      Action: lambda:InvokeFunction
      Principal: s3.amazonaws.com
      FunctionName:
        Fn::GetAtt:
          - TagReaderFunction
          - Arn
      SourceArn:
        Fn::Join: [ '', [ 'arn:aws:s3:::', 'music-archive-file-library-', !Ref Env ] ]
  DBModelBuilderFunction:
    DependsOn: DBModelBuilderRole
    Type: AWS::Lambda::Function
    Properties:
      Handler: lambda/services/model/db-model-builder.handler
      Runtime: nodejs10.x
      Code:
        S3Bucket: 'music-archive-source-code'
        S3Key: %{SourceCodeBucket}
      Role:
        Fn::GetAtt:
          - DBModelBuilderRole
          - Arn
      Timeout: 120
      Environment:
        Variables:
          TRACK_BUCKET: !Ref MusicArchiveFileLibraryBucket
          DB_LIBRARY_TABLE: !Ref DbLibraryTableStore
  # Lambda Function Definitions for API
  ListArtistsLambdaFunction:
    DependsOn: ApiLambdaRole
    Type: AWS::Lambda::Function
    Properties:
      Handler: lambda/api/list-artists.handler
      Runtime: nodejs10.x
      Code:
        S3Bucket: 'music-archive-source-code'
        S3Key: %{SourceCodeBucket}
      Role:
        Fn::GetAtt:
          - ApiLambdaRole
          - Arn
      Environment:
        Variables:
          DB_LIBRARY_TABLE: !Ref DbLibraryTableStore
  ListArtistsLambdaPermission:
    Type: AWS::Lambda::Permission
    Properties:
      Action: lambda:InvokeFunction
      Principal: apigateway.amazonaws.com
      FunctionName:
        Fn::GetAtt:
          - ListArtistsLambdaFunction
          - Arn
      SourceArn:
        Fn::Join: [ ':', [ 'arn:aws:execute-api', !Ref 'AWS::Region', !Ref 'AWS::AccountId', '*' ] ]
  GetArtistLambdaFunction:
    DependsOn: ApiLambdaRole
    Type: AWS::Lambda::Function
    Properties:
      Handler: lambda/api/get-artist-albums.handler
      Runtime: nodejs10.x
      Code:
        S3Bucket: 'music-archive-source-code'
        S3Key: %{SourceCodeBucket}
      Role:
        Fn::GetAtt:
          - ApiLambdaRole
          - Arn
      Environment:
        Variables:
          DB_LIBRARY_TABLE: !Ref DbLibraryTableStore
  GetArtistLambdaPermission:
    Type: AWS::Lambda::Permission
    Properties:
      Action: lambda:InvokeFunction
      Principal: apigateway.amazonaws.com
      FunctionName:
        Fn::GetAtt:
          - GetArtistLambdaFunction
          - Arn
      SourceArn:
        Fn::Join: [ ':', [ 'arn:aws:execute-api', !Ref 'AWS::Region', !Ref 'AWS::AccountId', '*' ] ]
  GetAlbumLambdaFunction:
    DependsOn: ApiLambdaRole
    Type: AWS::Lambda::Function
    Properties:
      Handler: lambda/api/get-album-tracks.handler
      Runtime: nodejs10.x
      Code:
        S3Bucket: 'music-archive-source-code'
        S3Key: %{SourceCodeBucket}
      Role:
        Fn::GetAtt:
          - ApiLambdaRole
          - Arn
      Environment:
        Variables:
          DB_LIBRARY_TABLE: !Ref DbLibraryTableStore
  GetAlbumLambdaPermission:
    Type: AWS::Lambda::Permission
    Properties:
      Action: lambda:InvokeFunction
      Principal: apigateway.amazonaws.com
      FunctionName:
        Fn::GetAtt:
          - GetAlbumLambdaFunction
          - Arn
      SourceArn:
        Fn::Join: [ ':', [ 'arn:aws:execute-api', !Ref 'AWS::Region', !Ref 'AWS::AccountId', '*' ] ]
  ServeTrackLambdaFunction:
    DependsOn: ApiS3LambdaRole
    Type: AWS::Lambda::Function
    Properties:
      Handler: lambda/api/serve-track.handler
      Runtime: nodejs10.x
      Code:
        S3Bucket: 'music-archive-source-code'
        S3Key: %{SourceCodeBucket}
      Role:
        Fn::GetAtt:
          - ApiS3LambdaRole
          - Arn
      Timeout: 30
      Environment:
        Variables:
          DB_LIBRARY_TABLE: !Ref DbLibraryTableStore
          TRACK_SOURCE_BUCKET: !Ref MusicArchiveFileLibraryBucket
          SERVE_TRACK_BUCKET: !Ref ServeMusicFileBucket
          SERVE_TRACK_PREFIX: !Ref ServeTrackBucketFilePrefix
  ServeTrackLambdaPermission:
    Type: AWS::Lambda::Permission
    Properties:
      Action: lambda:InvokeFunction
      Principal: apigateway.amazonaws.com
      FunctionName:
        Fn::GetAtt:
          - ServeTrackLambdaFunction
          - Arn
      SourceArn:
        Fn::Join: [ ':', [ 'arn:aws:execute-api', !Ref 'AWS::Region', !Ref 'AWS::AccountId', '*' ] ]
  # Music Library API Gateway Definition
  MusicLibraryApi:
    Type: AWS::ApiGateway::RestApi
    Properties:
      Name:
        Fn::Join: [ '', [ 'Music Library API: ', !Ref Env ] ]
      Description: 'API layer for the Music Library application.'
      BodyS3Location:
        Bucket: 'music-archive-source-code'
        Key: %{SwaggerLocation}
  %{MusicLibraryApiDeployment}:
    Type: AWS::ApiGateway::Deployment
    Properties:
      RestApiId: !Ref MusicLibraryApi
  MusicLibraryApiStage:
    Type: AWS::ApiGateway::Stage
    Properties:
      RestApiId: !Ref MusicLibraryApi
      DeploymentId: !Ref %{MusicLibraryApiDeployment}
      StageName: !Ref Env
      Variables:
        ListArtistsLambdaFunction: !Ref ListArtistsLambdaFunction
        GetArtistLambdaFunction: !Ref GetArtistLambdaFunction
        GetAlbumLambdaFunction: !Ref GetAlbumLambdaFunction
        ServeTrackLambdaFunction: !Ref ServeTrackLambdaFunction