infrastructure.yml

Parameters:
  VpcId:
    Type: AWS::EC2::VPC::Id
    Default: vpc-0d5462fe36e408984
  InternetGatewayId:
    Type: String
    Default: igw-02ca961c369600f90

Resources:
  CodeRunnerRepository:
    Type: AWS::ECR::Repository
    Properties:
      RepositoryName: coderunner
      EmptyOnDelete: true
      ImageScanningConfiguration:
        ScanOnPush: false
      RepositoryPolicyText:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              Service: lambda.amazonaws.com
            Action:
              - 'ecr:BatchGetImage'
              - 'ecr:DeleteRepositoryPolicy'
              - 'ecr:DescribeImages'
              - 'ecr:DescribeRepositories'
              - 'ecr:GetDownloadUrlForLayer'
              - 'ecr:GetRepositoryPolicy'
              - 'ecr:ListImages'
              - 'ecr:SetRepositoryPolicy'
              - 'ecr:BatchCheckLayerAvailability'
              - 'ecr:CompleteLayerUpload'
              - 'ecr:InitiateLayerUpload'
              - 'ecr:PutImage'
              - 'ecr:UploadLayerPart'

  Bucket:
    Type: AWS::S3::Bucket
    Properties:
      BucketName: !Sub 'coderunner-${AWS::AccountId}'

  ClusterCredentials:
    Type: AWS::SecretsManager::Secret
    Properties:
      GenerateSecretString:
        SecretStringTemplate: '{"username": "app_user"}'
        GenerateStringKey: password
        PasswordLength: 30
        ExcludeCharacters: '"@/\'

  DbCluster:
    Type: AWS::RDS::DBCluster
    Properties:
      DatabaseName: coderunner
      DBClusterIdentifier: coderunner-dbcluster
      Engine: aurora-postgresql
      EngineMode: provisioned
      MasterUsername: !Sub '{{resolve:secretsmanager:${ClusterCredentials}::username}}'
      MasterUserPassword: !Sub '{{resolve:secretsmanager:${ClusterCredentials}::password}}'
      Port: 5432
      # PubliclyAccessible: true
      VpcSecurityGroupIds:
        - !GetAtt RdsSecurityGroup.GroupId

  DbInstance:
    Type: AWS::RDS::DBInstance
    Properties:
      DBClusterIdentifier: !Ref DbCluster
      DBInstanceClass: db.t3.medium
      Engine: aurora-postgresql

  RdsSecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupName: rds-sg
      GroupDescription: Allow traffic from Lambda to RDS
      VpcId: !Ref VpcId
      # SecurityGroupIngress:
      #   - IpProtocol: tcp
      #     FromPort: 5432
      #     ToPort: 5432
      #     CidrIp: Your IP Address
      SecurityGroupEgress:
        - IpProtocol: -1
          FromPort: -1
          ToPort: -1
          CidrIp: 0.0.0.0/0

  RdsSecurityGroupIngress:
    Type: AWS::EC2::SecurityGroupIngress
    Properties:
      GroupId: !GetAtt RdsSecurityGroup.GroupId
      IpProtocol: tcp
      FromPort: 5432
      ToPort: 5432
      SourceSecurityGroupId: !GetAtt LambdaSecurityGroup.GroupId

  LambdaSecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupName: lambda-sg
      GroupDescription: Allow traffic from Lambda to RDS
      VpcId: !Ref VpcId
      SecurityGroupEgress:
        - IpProtocol: -1
          FromPort: -1
          ToPort: -1
          DestinationSecurityGroupId: !GetAtt RdsSecurityGroup.GroupId
        - IpProtocol: tcp
          FromPort: 443
          ToPort: 443
          CidrIp: 0.0.0.0/0

  LambdaSecurityGroupEgress:
    Type: AWS::EC2::SecurityGroupEgress
    Properties:
      GroupId: !GetAtt LambdaSecurityGroup.GroupId
      IpProtocol: tcp
      FromPort: 443
      ToPort: 443
      DestinationSecurityGroupId: !GetAtt SecretsManagerEndpointSecurityGroup.GroupId

  LambdaPrivateSubnet1:
    Type: AWS::EC2::Subnet
    Properties:
      VpcId: !Ref VpcId
      CidrBlock: 172.31.96.0/20
      AvailabilityZone: us-east-1a
      Tags:
        - Key: Name
          Value: LambdaPrivateSubnet1

  LambdaPrivateSubnet2:
    Type: AWS::EC2::Subnet
    Properties:
      VpcId: !Ref VpcId
      CidrBlock: 172.31.112.0/20
      AvailabilityZone: us-east-1b
      Tags:
        - Key: Name
          Value: LambdaPrivateSubnet2

  LambdaPrivateSubnet3:
    Type: AWS::EC2::Subnet
    Properties:
      VpcId: !Ref VpcId
      CidrBlock: 172.31.128.0/20
      AvailabilityZone: us-east-1c
      Tags:
        - Key: Name
          Value: LambdaPrivateSubnet3

  LambdaPrivateSubnet1RouteTableAssociation:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      SubnetId: !Ref LambdaPrivateSubnet1
      RouteTableId: !Ref LambdaPrivateRouteTable

  LambdaPrivateSubnet2RouteTableAssociation:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      SubnetId: !Ref LambdaPrivateSubnet2
      RouteTableId: !Ref LambdaPrivateRouteTable

  LambdaPrivateSubnet3RouteTableAssociation:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      SubnetId: !Ref LambdaPrivateSubnet3
      RouteTableId: !Ref LambdaPrivateRouteTable

  LambdaPrivateRouteTable:
    Type: AWS::EC2::RouteTable
    Properties:
      VpcId: !Ref VpcId
      Tags:
        - Key: Name
          Value: LambdaPrivateRouteTable

  LambdaPrivateRoute:
    Type: AWS::EC2::Route
    Properties:
      RouteTableId: !Ref LambdaPrivateRouteTable
      NatGatewayId: !Ref NatGateway
      DestinationCidrBlock: 0.0.0.0/0

  NatGatewayEIP:
   Type: AWS::EC2::EIP
   Properties:
      Domain: vpc

  NatGateway:
    Type: AWS::EC2::NatGateway
    Properties:
      AllocationId: !GetAtt NatGatewayEIP.AllocationId
      SubnetId: !Ref PublicInternetSubnet1

  PublicInternetSubnet1:
    Type: AWS::EC2::Subnet
    Properties:
      VpcId: !Ref VpcId
      CidrBlock: 172.31.144.0/20
      AvailabilityZone: us-east-1a
      Tags:
        - Key: Name
          Value: PublicInternetSubnet1

  PublicInternetSubnet1RouteTableAssociation:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      SubnetId: !Ref PublicInternetSubnet1
      RouteTableId: !Ref PublicInternetRouteTable

  PublicInternetRouteTable:
    Type: AWS::EC2::RouteTable
    Properties:
      VpcId: !Ref VpcId
      Tags:
        - Key: Name
          Value: PublicInternetRouteTable

  PublicInternetRoute:
    Type: AWS::EC2::Route
    Properties:
      RouteTableId: !Ref PublicInternetRouteTable
      GatewayId: !Ref InternetGatewayId
      DestinationCidrBlock: 0.0.0.0/0

  SecretsManagerEndpointSecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupName: secretsmanager-sg
      GroupDescription: Allow traffic from Lambda to SecretsManager
      VpcId: !Ref VpcId
      SecurityGroupIngress:
        - IpProtocol: tcp
          FromPort: 443
          ToPort: 443
          SourceSecurityGroupId: !GetAtt LambdaSecurityGroup.GroupId
      SecurityGroupEgress:
        - IpProtocol: tcp
          FromPort: 443
          ToPort: 443
          DestinationSecurityGroupId: !GetAtt LambdaSecurityGroup.GroupId

  SecretsManagerEndpoint:
    Type: AWS::EC2::VPCEndpoint
    Properties:
      ServiceName: !Sub 'com.amazonaws.${AWS::Region}.secretsmanager'
      VpcId: !Ref VpcId
      PrivateDnsEnabled: true
      VpcEndpointType: Interface
      SecurityGroupIds:
        - !GetAtt SecretsManagerEndpointSecurityGroup.GroupId
      SubnetIds:
        - !Ref LambdaPrivateSubnet1
        - !Ref LambdaPrivateSubnet2
        - !Ref LambdaPrivateSubnet3

Outputs:
  ClusterCredentials:
    Value: !Ref ClusterCredentials
    Export:
      Name: coderunner-ClusterCredentials
  ClusterUrl:
    Value: !Join [ ':', [ !GetAtt DbCluster.Endpoint.Address, !GetAtt DbCluster.Endpoint.Port ] ]
    Export:
      Name: coderunner-ClusterUrl
  BucketName:
    Value: !Ref Bucket
    Export:
      Name: coderunner-BucketName
  LambdaSecurityGroupId:
    Value: !GetAtt LambdaSecurityGroup.GroupId
    Export:
      Name: coderunner-LambdaSecurityGroupId
  SubnetsId:
    Value: !Join [
      ',',
      [
        !Ref LambdaPrivateSubnet1,
        !Ref LambdaPrivateSubnet2,
        !Ref LambdaPrivateSubnet3
      ]
    ]
    Export:
      Name: coderunner-SubnetsId