template.yml

# This is the SAM template that represents the architecture of your serverless application
# https://docs.aws.amazon.com/serverless-application-model/latest/developerguide/serverless-sam-template-basics.html

# The AWSTemplateFormatVersion identifies the capabilities of the template
# https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/format-version-structure.html
AWSTemplateFormatVersion: 2010-09-09
Description: >-
  IOT message processing stack, including connectors towards devices (eg Kerlink WMC/SPN http apis), generic message decoding, and IOT Thing/ DynamoDB integration

# Transform section specifies one or more macros that AWS CloudFormation uses to process your template
# https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/transform-section-structure.html
Transform: AWS::Serverless-2016-10-31

Parameters:
  AppId:
    Type: String
    Default:
  # TTN config
  P_TTN_APPID:
    Type: String
    Default:
  P_TTN_PROCESSID:
    Type: String
    Default:
  P_TTN_KEY:
    Type: String
    Default:
  P_TTN_SERVER:
    Type: String
    Default:
  # WMC config
  P_WMC_SERVER:
    Type: String
    Default:
  P_WMC_USER:
    Type: String
    Default:
  P_WMC_PASS:
    Type: String
    Default:
  # internal setup config : keep defaults unless good reason not to
  P_DDB_TABLE_DEVICES:
    Type: String
    Default: IOT-DEVICES
  P_DDB_TABLE_MSGS:
    Type: String
    Default: IOT-MSGS
  P_SNS_UL_RAW:
    Type: String
    Default: iot-ul-raw
  P_SNS_UL_DECODED:
    Type: String
    Default: iot-ul-decoded
  P_SNS_DL_DECODED:
    Type: String
    Default: iot-dl-decoded
  P_SNS_DL_RAW:
    Type: String
    Default: iot-dl-raw
    
# Shared configuration for all resources, more in
# https://github.com/awslabs/serverless-application-model/blob/master/docs/globals.rst
Globals:
  Function:
    # The PermissionsBoundary allows users to safely develop with their function's permissions constrained
    # to their current application. All the functions and roles in this application have to include it and
    # it has to be manually updated when you add resources to your application.
    # More information in https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_boundaries.html
    PermissionsBoundary: !Sub 'arn:${AWS::Partition}:iam::${AWS::AccountId}:policy/${AppId}-${AWS::Region}-PermissionsBoundary'
    CodeUri: ./
    Runtime: nodejs12.x
    MemorySize: 128
    Timeout: 60
    Layers:
      - !Ref iotUtilityLayer      
    Environment:
      Variables:
        CONFIG_NAME: iot-msg-stack
        CONFIG_ID: ${AppId}
        DDB_TABLE_DEVICES: !Ref P_DDB_TABLE_DEVICES
        DDB_TABLE_MSGS: !Ref P_DDB_TABLE_MSGS
        SNS_UL_DECODED: !Ref P_SNS_UL_DECODED
        SNS_UL_RAW: !Ref P_SNS_UL_RAW
        SNS_DL_DECODED: !Ref P_SNS_DL_DECODED
        SNS_DL_RAW: !Ref P_SNS_DL_RAW

# Resources declares the AWS resources that you want to include in the stack
# https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/resources-section-structure.html
Resources:
  # Add API Key TODO
  # Add API Usage plan TODO

  # IAM Role and policies for the Lambdas/API to access other resources
  IOTPolicySNS:
    Type: AWS::IAM::Policy
    Properties:
      PolicyName: "IOTPolicy_SNS"
      Roles: 
        - !Ref IOTOperationRole
      PolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Action:
              - 'SNS:*'
            Resource: '*'

  IOTPolicyIOT:
    Type: AWS::IAM::Policy
    Properties:
      PolicyName: "IOTPolicy_IOT"
      Roles: 
        - !Ref IOTOperationRole
      PolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Action:
              - 'IOT:*'
            Resource: '*'

  IOTPolicyDDB:
    Type: AWS::IAM::Policy
    Properties:
      PolicyName: "IOTPolicy_DDB"
      Roles: 
        - !Ref IOTOperationRole
      PolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Action:
              - 'DynamoDB:*'
            Resource: '*'

  IOTPolicyCWL:
    Type: AWS::IAM::Policy
    Properties:
      PolicyName: "IOTPolicy_CWL"
      Roles: 
        - !Ref IOTOperationRole
      PolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Action:
              - 'CloudWatchLogger:*'
            Resource: '*'

  IOTOperationRole:
    Type: AWS::IAM::Role
    Description: "Role used by lambdas to access resources for this stack"
    RoleName: "IOTOperationRole"

  # configuration block in AppConfig
  IOTStackApplication:
    Type: AWS::AppConfig::Application
    Properties:
      Name:"IOTStack"
  IOTStackConfigurationProfile:
    Type: AWS::AppConfig::ConfigurationProfile
    Properties:
      ApplicationId: !Ref IOTStackApplication
      Name: "ConfigProfile"
      LocationUri: "hosted"
  
  BasicHostedConfigurationVersion:
    Type: AWS::AppConfig::HostedConfigurationVersion
    Properties:
      ApplicationId: !Ref IOTStackApplication
      ConfigurationProfileId: !Ref IOTStackConfigurationProfile
      Description: "Generic hosted config version"
      Content: "{ \"DDB_MSGS_TABLE\":\"DDB-${AppId}-IOT_MSGS\", \"SNS_ARN_ROOT\":\"arn:aws:sns:${AWS::Partition}:${AWS::AccountId}:topic-${AppId}-\", }"
      ContentType: "application/json"

  # SNS topics
  iotDlRawSNSTopic:
    Type: AWS::SNS::SNSTopic
    TopicName: P_SNS_DL_RAW

  iotDlDecodedSNSTopic:
    Type: AWS::SNS::SNSTopic
    TopicName: P_SNS_DL_DECODED

  iotUlRawSNSTopic:
    Type: AWS::SNS::SNSTopic
    TopicName: P_SNS_UL_RAW

  iotUlDecodedSNSTopic:
    Type: AWS::SNS::SNSTopic
    TopicName: !Ref P_SNS_UL_DECODED
  
  # Dynamo DB table
  iotMsgsDDBTable:
    Type: AWS::DynamoDB::Table
    Properties:
      TableName: "IOT-MSGS"
      AttributeDefinitions: 
        -
          AttributeName: "DevName"
          AttributeType : "S"
        -
          AttributeName: "TimeStamp"
          AttributeType : "S"
      KeySchema : 
        -
          AttributeName: "DevName"
          KeyType: "HASH"
        -
          AttributeName: "TimeStamp"
          KeyType: "RANGE"
      TimeToLiveSpecification:
        AttributeName: "expiryTime"
        Enabled: true
      ProvisionedThroughput: 
          ReadCapacityUnits: "5"
          WriteCapacityUnits: "5"

  iotDevicesDDBTable:
    Type: AWS::DynamoDB::Table
    Properties:
      TableName: "IOT-DEVICES"
      AttributeDefinitions: 
        -
          AttributeName: "id"
          AttributeType : "S"
      KeySchema : 
        -
          AttributeName: "id"
          KeyType: "HASH"
      ProvisionedThroughput: 
          ReadCapacityUnits: "5"
          WriteCapacityUnits: "5"
  
  # API Gateway api definition
  iotApiDef:
    Type : AWS::Serverless::HttpApi
    Properties:
      StageName: prod
#      Description: API for device access and connectors to network server resources

  # Lambda functions, hooked to eithe APIGateway REST API endpoints or SNS topics
  # Each Lambda function is defined by new SAM specific Function Resources:
  # https://github.com/awslabs/serverless-application-model/blob/master/versions/2016-10-31.md#awsserverlessfunction

  # The lambdas require a layer (with utility functions and an api to the DDB)
  # Layers:
  iotUtilityLayer:
      Type: AWS::Serverless::LayerVersion
      Properties:
        LayerName: iotUtilityLayer
        Description: IOT DB and processing utilities
        ContentUri: src/layers/iot_utility
        CompatibleRuntimes:
          - nodejs12.x
        LicenseInfo: 'PROPRIETARY'
        RetentionPolicy: Retain
      Metadata:
        BuildMethod: nodejs12.x             # Required to have AWS SAM build this layer

  # Lambda iot-dl-encode-appcore
  iotDlEncodeAppcoreFunction:
    Type: AWS::Serverless::Function
    Properties:
      Handler: src/lambdas/iot-dl-encode-appcore/index.handler
      Description: Lambda function to encode DL for appcore protocol
      Role: !Ref IOTOperationRole
      Events:
        iotDlDecodedSNSSubAppcore:
          Type: SNS
          Topic: !Ref iotDlDecodedSNSTopic
          FilterPolicy:
            msgProtocol:
              - app-core

  # Lambda iot-dl-raw-to-DB
  iotDlRawToDBFunction:
    Type: AWS::Serverless::Function
    Properties:
      Handler: src/lambdas/iot-dl-raw-to-DB/index.handler
      Description: Lambda function to write raw DL messages to the DDB
      Role: !Ref IOTOperationRole
      Events:
        iotDlRawSNSSub:
          Type: SNS
          Properties:
            Topic: !Ref iotDlRawSNSTopic

  # Lambda iot-http-action-to-dl
  iotHttpActionToDlFunction:
    Type: AWS::Serverless::Function
    Properties:
      Handler: src/lambdas/iot-http-action-to-dl/index.handler
      Description: Lambda function to interpret http rest api action to create a DL
      Role: !Ref IOTOperationRole
      Events:
        iotActionHTTPAPI:
          Type: HttpApi
          Properties:
            Path: /iot/action
            Method: ANY
            RestApiId:
              Ref: iotApiDef
        iotConfigHTTPAPI:
          Type: HttpApi
          Properties:
            Path: /iot/config
            Method: ANY
            RestApiId:
              Ref: iotApiDef
                         
          
  # Lambda iot-ul-decode-appcore
  iotUlDecodeAppcoreFunction:
    Type: AWS::Serverless::Function
    Properties:
      Handler: src/lambdas/iot-ul-decode-appcore/index.handler
      Description: Lambda function to decode UL using the appcore protocol
      Role: !Ref IOTOperationRole
      Events:
        iotUlRawSNSSubAppcore:
          Type: SNS
          Topic: !Ref iotUlRawSNSTopic
          FilterPolicy:
            msgProtocol:
              - app-core
  
  # Lambda iot-ul-decoded-to-DB
  iotUlDecodedToDBFunction:
    Type: AWS::Serverless::Function
    Properties:
      Handler: src/lambdas/iot-ul-decoded-to-DB/index.handler
      Description: Lambda function to send UL decoded messages to the DDB
      Role: !Ref IOTOperationRole
      Events:
        iotUlDecodedSNSSub:
          Type: SNS
          Topic: !Ref iotUlDecodedSNSTopic

  # Lambda wmc-http-dl-event-to-sns
  wmcHttpDlEventToSnsFunction:
    Type: AWS::Serverless::Function
    Properties:
      Handler: src/lambdas/wmc-http-dl-event-to-sns/index.handler
      Description: Lambda function to map WMC DL-Event http post to an SNS message
      Role: !Ref IOTOperationRole
      Events:
        iotWmcDlEventHTTPAPI:
          Type: HttpApi
          Properties:
            Path: /iot/wmc/dlevent
            Method: ANY
            RestApiId:
              Ref: iotApiDef

  # Lambda wmc-http-ul-to-sns
  wmcHttpUlToSnsFunction:
    Type: AWS::Serverless::Function
    Properties:
      Handler: src/lambdas/wmc-http-ul-to-sns/index.handler
      Description: Lambda function to map WMC http POST for an UL to an SNS message
      Role: !Ref IOTOperationRole
      Events:
        iotWmcUlHTTPAPI:
          Type: HttpApi
          Properties:
            Path: /iot/wmc/dataup
            Method: ANY
            RestApiId:
              Ref: iotApiDef

  # Lambda wmc-sns-dl-to-http
  wmcSnsDlToHttpFunction:
    Type: AWS::Serverless::Function
    Properties:
      Handler: src/lambdas/wmc-sns-dl-to-http/index.handler
      Description: Lambda function to send DL message to WMC via HTTP POST
      Role: !Ref IOTOperationRole
      Environment:
        Variables:
          WMC_SERVER: !Ref P_WMC_SERVER
          WMC_USER: !Ref P_WMC_USER
          WMC_PASS: !Ref P_WMC_PASS
      Events:
        iotDlRawSNSSub:
          Type: SNS
          Properties:
            Topic: !Ref iotDlEawSNSTopic
            FilterPolicy:
              connector:
                - KLK-WMC-V3-HTTP
       
  # Lambda ttn-http-ul-to-sns
  ttnHttpUlToSnsFunction:
    Type: AWS::Serverless::Function
    Properties:
      Handler: src/lambdas/ttn-http-ul-to-sns/index.handler
      Description: Lambda function to map TTN http POST for an UL to an SNS message
      Role: !Ref IOTOperationRole
      Events:
        iotWmcUlHTTPAPI:
          Type: HttpApi
          Properties:
            Path: /iot/ttn/dataup
            Method: ANY
            RestApiId:
              Ref: iotApiDef

  # Lambda ttn-sns-dl-to-http
  ttnSnsDlToHttpFunction:
    Type: AWS::Serverless::Function
    Properties:
      Handler: src/lambdas/ttn-sns-dl-to-http/index.handler
      Description: Lambda function to send DL message to TTN via HTTP POST
      Role: !Ref IOTOperationRole
      Environment:
        Variables:
          TTN_SERVER: !Ref P_TTN_SERVER
          TTN_KEY: !Ref P_TTN_KEY
          TTN_APPID: !Ref P_TTN_APPID
          TTN_PROCESSID: !Ref P_TTN_PROCESSID
      Events:
        iotDlRawSNSSub:
          Type: SNS
          Properties:
            Topic: !Ref iotDlDawSNSTopic
            FilterPolicy:
              connector:
                - TTN-HTTP
       
  # Lambda iot-devices-list
  iotDevicesListFunction:
    Type: AWS::Serverless::Function
    Properties:
      Handler: src/lambdas/iot-devices-list/index.handler
      Description: Lambda function for REST API to list devices in DB
      Role: !Ref IOTOperationRole
      Events:
        iotDevicesListHTTPAPI:
          Type: HttpApi
          Properties:
            Path: /iot/entities/{entity}/devices
            Method: GET
            RestApiId:
              Ref: iotApiDef

  # Lambda iot-device-CRUD
  iotDeviceCRUDFunction:
    Type: AWS::Serverless::Function
    Properties:
      Handler: src/lambdas/iot-device-CRUD/index.handler
      Description: Lambda function for REST API to create/read/update/delete a device in DB
      Role: !Ref IOTOperationRole
      Events:
        iotDeviceCRUDHTTPAPI:
          Type: HttpApi
          Properties:
            Path: /iot/entities/{entity}/devices/{id}
            Method: ANY
            RestApiId:
              Ref: iotApiDef