cloudformation.yaml

AWSTemplateFormatVersion: "2010-09-09"
Description: Enable streaming Amazon Connect calls to Deepgram

Metadata:
  AWS::CloudFormation::Interface:
    ParameterGroups:
      - Label:
          default: "General Configuration"
        Parameters:
          - deepgramApi
          - deepgramApiKey
          - vpcId
          - subnets
      - Label:
          default: "Trigger Lambda"
        Parameters:
          - kvsDgTriggerImage
          - kvsDgTriggerLogLevel
      - Label:
          default: "Integrator ECS Service"
        Parameters:
          - kvsDgIntegratorImage
          - kvsDgIntegratorLogLevel
          - kvsDgIntegratorDesiredTaskCount
          - kvsDgIntegratorTaskCpu
          - kvsDgIntegratorTaskMemory

    ParameterLabels:
      deepgramApi:
        default: Deepgram API
      deepgramApiKey:
        default: Deepgram API Key
      vpcId:
        default: VPC ID
      subnets:
        default: Subnets
      kvsDgTriggerImage:
        default: Image URI
      kvsDgTriggerLogLevel:
        default: Log Level
      kvsDgIntegratorImage:
        default: Task Image URI
      kvsDgIntegratorLogLevel:
        default: Log Level
      kvsDgIntegratorDesiredTaskCount:
        default: Desired Task Count
      kvsDgIntegratorTaskCpu:
        default: Task CPU
      kvsDgIntegratorTaskMemory:
        default: Task Memory

Parameters:
  deepgramApi:
    Description: The Deepgram endpoint to stream audio to (change this if you're using Deepgram onprem)
    Type: String
    Default: "wss://api.deepgram.com/v1/listen"
  deepgramApiKey:
    Description: Your Deepgram API key
    Type: String
    NoEcho: "true"
    AllowedPattern: "^[a-z0-9]{40}$"
    ConstraintDescription: "Deepgram API key must be 40 alphanumeric characters (lowercase only)"
  vpcId:
    Description: VPC where the resources will be deployed
    Type: AWS::EC2::VPC::Id
  subnets:
    Description: Subnets where the resources will be deployed
    Type: List<AWS::EC2::Subnet::Id>
  kvsDgTriggerImage:
    Description: >
      Docker image of the trigger lambda. Before running this CloudFormation template, build the
      image and push it to ECR in the current region. Then set this field to the image you pushed.
    Type: String
    Default: "123456789012.dkr.ecr.region.amazonaws.com/image:tag"
  kvsDgTriggerLogLevel:
    Description: Logging level for the trigger lambda
    Type: String
    Default: "info"
    AllowedValues:
      - "debug"
      - "info"
      - "warning"
      - "error"
  kvsDgIntegratorImage:
    Description: >
      Docker image of the integrator task. Before running this CloudFormation template, build the
      image and push it to ECR in the current region. Then set this field to the image you pushed.
    Type: String
    Default: "123456789012.dkr.ecr.region.amazonaws.com/image:tag"
  kvsDgIntegratorLogLevel:
    Description: Logging level for the integrator task
    Type: String
    Default: "info"
    AllowedValues:
      - "trace"
      - "debug"
      - "info"
      - "warn"
      - "error"
  kvsDgIntegratorDesiredTaskCount:
    Description: >
      The number of integrator tasks that should be running in the ECS service. The load balancer
      will distribute sessions evenly between these tasks.
    Type: Number
    Default: "1"
  kvsDgIntegratorTaskCpu:
    Description: >
      The number of CPU units to allot to each integrator task. The value you choose determines the
      range of valid values for the memory. See valid cpu/memory combinations here:
      https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-ecs-taskdefinition.html#cfn-ecs-taskdefinition-cpu
    Type: String
    Default: "256"
    AllowedValues:
      - "256"
      - "512"
      - "1024"
      - "2048"
      - "4096"
      - "8192"
      - "16384"
  kvsDgIntegratorTaskMemory:
    Description: >
      The amount of memory (in MiB) to allot to each integrator task. The value you choose determines the
      range of valid values for the CPU. See valid cpu/memory combinations here:
      https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-ecs-taskdefinition.html#cfn-ecs-taskdefinition-cpu
    Type: String
    Default: "1024"

Resources:
  kvsDgTriggerRole:
    Type: "AWS::IAM::Role"
    Properties:
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: "Allow"
            Principal:
              Service:
                - "lambda.amazonaws.com"
            Action:
              - "sts:AssumeRole"
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/service-role/AWSLambdaVPCAccessExecutionRole

  kvsDgTriggerSecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: Security group for kvs-dg-trigger Lambda function
      VpcId: !Ref vpcId
      SecurityGroupEgress:
        - CidrIp: 0.0.0.0/0
          Description: Allow all outbound traffic
          IpProtocol: "-1"

  kvsDgTrigger:
    Type: "AWS::Lambda::Function"
    Properties:
      Role: !GetAtt kvsDgTriggerRole.Arn
      Timeout: 900
      Environment:
        Variables:
          KVS_DG_INTEGRATOR_DOMAIN: !GetAtt kvsDgIntegratorLoadBalancer.DNSName
          LOG_LEVEL: !Ref kvsDgTriggerLogLevel
      PackageType: "Image"
      Code:
        ImageUri: !Ref kvsDgTriggerImage
      VpcConfig:
        SecurityGroupIds:
          - !Ref kvsDgTriggerSecurityGroup
        SubnetIds: !Ref subnets

  kvsDgIntegratorEcsCluster:
    Type: "AWS::ECS::Cluster"
    Properties:
      ClusterName: kvs-dg-integrator-cluster
      ClusterSettings:
        - Name: containerInsights
          Value: "disabled" # If you are load testing, setting this to "enabled" can reveal useful info

  kvsDgIntegratorExecutionRole:
    Type: "AWS::IAM::Role"
    Properties:
      RoleName: kvsDgIntegratorExecutionRole
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - ecs-tasks.amazonaws.com
            Action:
              - "sts:AssumeRole"
      ManagedPolicyArns:
        - "arn:aws:iam::aws:policy/service-role/AmazonECSTaskExecutionRolePolicy"
      Policies:
        - PolicyName: "CloudWatchLogsCreateLogGroup"
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Effect: "Allow"
                Action:
                  - "logs:CreateLogGroup"
                Resource: "*"

  kvsDgIntegratorTaskRole:
    Type: "AWS::IAM::Role"
    Properties:
      RoleName: kvsDgIntegratorTaskRole
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - ecs-tasks.amazonaws.com
            Action:
              - "sts:AssumeRole"
      ManagedPolicyArns:
        - "arn:aws:iam::aws:policy/AmazonKinesisVideoStreamsReadOnlyAccess"

  kvsDgIntegratorTaskDefinition:
    Type: "AWS::ECS::TaskDefinition"
    Properties:
      ContainerDefinitions:
        - Name: kvs-dg-integrator-container
          Image: !Ref kvsDgIntegratorImage
          LogConfiguration:
            LogDriver: awslogs
            Options:
              awslogs-stream-prefix: ecs
              awslogs-region: !Ref "AWS::Region"
              awslogs-group: kvs-dg-integrator
              awslogs-create-group: "true"
          Environment:
            - Name: DEEPGRAM_API
              Value: !Ref deepgramApi
            - Name: DEEPGRAM_API_KEY
              Value: !Ref deepgramApiKey
            - Name: LOG_LEVEL
              Value: !Ref kvsDgIntegratorLogLevel
            - Name: APP_REGION
              Value: !Ref "AWS::Region"
          PortMappings:
            - HostPort: 80
              ContainerPort: 80
              Protocol: tcp
              AppProtocol: http
      Cpu: !Ref kvsDgIntegratorTaskCpu
      Memory: !Ref kvsDgIntegratorTaskMemory
      ExecutionRoleArn: !GetAtt kvsDgIntegratorExecutionRole.Arn
      TaskRoleArn: !GetAtt kvsDgIntegratorTaskRole.Arn
      Family: kvs-dg-integrator-task-family
      NetworkMode: awsvpc
      RequiresCompatibilities:
        - FARGATE
      RuntimePlatform:
        OperatingSystemFamily: LINUX

  kvsDgIntegratorEcsServiceSecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: Security group for kvs-dg-integrator Fargate task
      VpcId: !Ref vpcId
      SecurityGroupEgress:
        - CidrIp: 0.0.0.0/0
          Description: Allow all outbound traffic
          IpProtocol: "-1"
      SecurityGroupIngress:
        - IpProtocol: tcp
          FromPort: 80
          ToPort: 80
          SourceSecurityGroupId: !Ref kvsDgIntegratorLoadBalancerSecurityGroup

  kvsDgIntegratorEcsService:
    Type: AWS::ECS::Service
    DependsOn: kvsDgIntegratorLoadBalancerListener
    Properties:
      Cluster: !Ref kvsDgIntegratorEcsCluster
      TaskDefinition: !Ref kvsDgIntegratorTaskDefinition
      DesiredCount: !Ref kvsDgIntegratorDesiredTaskCount
      LaunchType: FARGATE
      NetworkConfiguration:
        AwsvpcConfiguration:
          # Change to DISABLED if you're using private subnets that have access to a NAT gateway
          AssignPublicIp: ENABLED
          Subnets: !Ref subnets
          SecurityGroups:
            - !Ref kvsDgIntegratorEcsServiceSecurityGroup
      LoadBalancers:
        - TargetGroupArn: !Ref kvsDgIntegratorLoadBalancerTargetGroup
          ContainerName: kvs-dg-integrator-container
          ContainerPort: 80

  kvsDgIntegratorLoadBalancerSecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: Security group for kvs-dg-integrator load balancer
      VpcId: !Ref vpcId
      SecurityGroupEgress:
        - CidrIp: 0.0.0.0/0
          Description: Allow all outbound traffic
          IpProtocol: "-1"
      SecurityGroupIngress:
        - IpProtocol: tcp
          FromPort: 80
          ToPort: 80
          SourceSecurityGroupId: !Ref kvsDgTriggerSecurityGroup

  kvsDgIntegratorLoadBalancer:
    Type: "AWS::ElasticLoadBalancingV2::LoadBalancer"
    Properties:
      Scheme: internal
      Subnets: !Ref subnets
      SecurityGroups: [!Ref kvsDgIntegratorLoadBalancerSecurityGroup]

  kvsDgIntegratorLoadBalancerTargetGroup:
    Type: "AWS::ElasticLoadBalancingV2::TargetGroup"
    Properties:
      VpcId: !Ref vpcId
      Port: 80
      Protocol: "HTTP"
      TargetType: "ip"
      HealthCheckIntervalSeconds: 30
      HealthCheckPath: "/health-check"
      HealthCheckTimeoutSeconds: 5
      HealthyThresholdCount: 2
      UnhealthyThresholdCount: 2

  kvsDgIntegratorLoadBalancerListener:
    Type: "AWS::ElasticLoadBalancingV2::Listener"
    Properties:
      DefaultActions:
        - TargetGroupArn: !Ref kvsDgIntegratorLoadBalancerTargetGroup
          Type: "forward"
      LoadBalancerArn: !Ref kvsDgIntegratorLoadBalancer
      Port: 80
      Protocol: "HTTP"