cloudformation.yml

AWSTemplateFormatVersion: 2010-09-09
Description: >-
  Cards of Keyforge backend template
Parameters:
  GithubHash:
    Type: String
Resources:

  # Lambda functions
  GetCards:
    Type: AWS::Lambda::Function
    Properties:
      Code:
        S3Bucket: 'cards-keyforge'
        S3Key: !Sub
          - "functions/getcards-${GH}.zip"
          - { GH: !Ref GithubHash }
      Description: fetch card
      FunctionName: getcards
      Handler: getcards/main
      Role: !GetAtt LambdaExecutionRole.Arn
      Runtime: go1.x
      Timeout: 60
      MemorySize: 512


  AGWLambdaPermission:
    Type: 'AWS::Lambda::Permission'
    Properties:
      Action: lambda:InvokeFunction
      FunctionName: !Ref GetCards
      Principal: apigateway.amazonaws.com
      SourceArn: !Join
        - ''
        - - 'arn:aws:execute-api:'
          - !Ref 'AWS::Region'
          - ':'
          - !Ref 'AWS::AccountId'
          - ':'
          - !Ref KeyforgeApi
          - /*


  ImportTTSDeck:
    Type: AWS::Lambda::Function
    Properties:
      Code:
        S3Bucket: 'cards-keyforge'
        S3Key: !Sub
          - "functions/importttsdeck-${GH}.zip"
          - { GH: !Ref GithubHash }
      Description: fetch tts deck
      FunctionName: importttsdeck
      Handler: importttsdeck/main
      Role: !GetAtt LambdaExecutionRole.Arn
      Runtime: go1.x
      Timeout: 60
      MemorySize: 512


  ImportTTSDeckPermission:
    Type: 'AWS::Lambda::Permission'
    Properties:
      Action: lambda:InvokeFunction
      FunctionName: !Ref ImportTTSDeck
      Principal: apigateway.amazonaws.com
      SourceArn: !Join
        - ''
        - - 'arn:aws:execute-api:'
          - !Ref 'AWS::Region'
          - ':'
          - !Ref 'AWS::AccountId'
          - ':'
          - !Ref KeyforgeApi
          - /*


  RandomVaultDeck:
    Type: AWS::Lambda::Function
    Properties:
      Code:
        S3Bucket: 'cards-keyforge'
        S3Key: !Sub
          - "functions/randomvaultdeck-${GH}.zip"
          - { GH: !Ref GithubHash }
      Description: fetch vault random deck
      FunctionName: randomvaultdeck
      Handler: randomvaultdeck/main
      Role: !GetAtt LambdaExecutionRole.Arn
      Runtime: go1.x
      Timeout: 60
      MemorySize: 512


  RandomVaultDeckPermission:
    Type: 'AWS::Lambda::Permission'
    Properties:
      Action: lambda:InvokeFunction
      FunctionName: !Ref RandomVaultDeck
      Principal: apigateway.amazonaws.com
      SourceArn: !Join
        - ''
        - - 'arn:aws:execute-api:'
          - !Ref 'AWS::Region'
          - ':'
          - !Ref 'AWS::AccountId'
          - ':'
          - !Ref KeyforgeApi
          - /*


  # Roles
  LambdaExecutionRole:
    Type: 'AWS::IAM::Role'
    Properties:
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - lambda.amazonaws.com
                - apigateway.amazonaws.com
            Action:
              - 'sts:AssumeRole'
      Policies:
        - PolicyName: DynamoDBAccessPolicy
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Sid: ReadOnly
                Effect: Allow
                Action:
                  - dynamodb:BatchGet*
                  - dynamodb:DescribeTable
                  - dynamodb:Get*
                  - dynamodb:Query
                  - dynamodb:Scan
                Resource:
                  - !Sub "arn:aws:dynamodb:${AWS::Region}:${AWS::AccountId}:table/cards-*"
                  - !Sub "arn:aws:dynamodb:${AWS::Region}:${AWS::AccountId}:table/sets-*"
        - PolicyName: S3AccessPolicy
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Effect: Allow
                Action: s3:*
                Resource:
                  - arn:aws:s3:::cards-keyforge
                  - arn:aws:s3:::cards-keyforge/*
      ManagedPolicyArns:
        - 'arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole'

  ApiGatewayCloudWatchLogsRole:
    Type: 'AWS::IAM::Role'
    Properties:
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - apigateway.amazonaws.com
            Action:
              - 'sts:AssumeRole'
      Policies:
        - PolicyName: ApiGatewayLogsPolicy
          PolicyDocument:
            Version: 2012-10-17
            Statement:
              - Effect: Allow
                Action:
                  - 'logs:CreateLogGroup'
                  - 'logs:CreateLogStream'
                  - 'logs:DescribeLogGroups'
                  - 'logs:DescribeLogStreams'
                  - 'logs:PutLogEvents'
                  - 'logs:GetLogEvents'
                  - 'logs:FilterLogEvents'
                Resource: '*'

  # API GW configuration
  KeyforgeApi:
    Type: 'AWS::ApiGateway::RestApi'
    Properties:
      Name: Cards of Keyforge API
      EndpointConfiguration:
        Types:
          - REGIONAL
      Description: Keyforge cards database API
      FailOnWarnings: false
      Body:
        Fn::Transform:
          Name: AWS::Include
          Parameters:
            Location: !Sub
              - "s3://cards-keyforge/openapi/openapi-${GH}.yaml"
              - { GH: !Ref GithubHash }

  ApiGatewayAccount:
    Type: 'AWS::ApiGateway::Account'
    Properties:
      CloudWatchRoleArn: !GetAtt
        - ApiGatewayCloudWatchLogsRole
        - Arn
  KeyforgeApiStage:
    DependsOn:
      - ApiGatewayAccount
    Type: 'AWS::ApiGateway::Stage'
    Properties:
      DeploymentId: !Ref ApiDeployment
      MethodSettings:
        - DataTraceEnabled: true
          HttpMethod: '*'
          LoggingLevel: INFO
          ResourcePath: /*
      RestApiId: !Ref KeyforgeApi
      StageName: LATEST
  ApiDeployment:
    Type: 'AWS::ApiGateway::Deployment'
    DependsOn:
      - KeyforgeApi
    Properties:
      RestApiId: !Ref KeyforgeApi
      StageName: prod

  ApiCustomDomain:
    Type: AWS::ApiGateway::DomainName
    Properties:
      DomainName: api.cardsofkeyforge.com
      EndpointConfiguration:
        Types:
          - REGIONAL
      RegionalCertificateArn: arn:aws:acm:eu-north-1:329814883837:certificate/e980974a-5f35-4944-b61f-0745c96cdd10
      SecurityPolicy: TLS_1_2

  ApiMappings:
    Type: AWS::ApiGatewayV2::ApiMapping
    Properties:
      ApiId: !Ref KeyforgeApi
      DomainName: !Ref ApiCustomDomain
      Stage: prod

  ApiRecord:
    Type: AWS::Route53::RecordSet
    Properties:
      HostedZoneId: Z00673343JUANBEQK3AUL
      Name: api.cardsofkeyforge.com
      ResourceRecords:
        - !GetAtt ApiCustomDomain.RegionalDomainName
      TTL: '300'
      Type: CNAME

Outputs:
  RootUrl:
    Description: Root URL of the API gateway
    Value: !Join
      - ''
      - - 'https://'
        - !Ref KeyforgeApi
        - .execute-api.
        - !Ref 'AWS::Region'
        - .amazonaws.com
  GetCards:
    Description: New function files
    Value: !Sub
      - functions/getcards-${GH}.zip
      - { GH: !Ref GithubHash }