template.yaml

# Build and Deploy Template for DC API
#
# Note: Any comment starting with `#*` will be removed
# at build time. This allows us to run without the
# dependency layer in development without removing the
# layer from the build.

AWSTemplateFormatVersion: "2010-09-09"
Transform:
  - AWS::Serverless-2016-10-31
  - AWS::LanguageExtensions
Description: dc-api-v2
Parameters:
  ApiConfigPrefix:
    Type: String
    Description: Secret Name for API Configuration (if not provided, will use SecretsPath)
    Default: ""
  ApiTokenName:
    Type: String
    Description: Name of the jwt that DC API issues
  ApiTokenSecret:
    Type: String
    Description: Secret Key for Encrypting JWTs (must match IIIF server)
  CustomDomainCertificateArn:
    Type: String
    Description: SSL Certificate for the Custom Domain Name
  CustomDomainZone:
    Type: String
    Description: Hosted Zone Name for Custom Domain
  CustomDomainHost:
    Type: String
    Description: Hostname within ApiDomainName for Custom Domain
  DcApiEndpoint:
    Type: String
    Description: URL for DC API
  DcUrl:
    Type: String
    Description: URL of Digital Collections website
  DeployAPI:
    Type: String
    Description: Set to true to deploy API
    Default: "true"
  DeployAVDownload:
    Type: String
    Description: Set to true to deploy AVDownload
    Default: "true"
  DeployChat:
    Type: String
    Description: Set to true to deploy Chat
    Default: "true"
  DeployDocs:
    Type: String
    Description: Set to true to deploy Docs
    Default: "false"
  DevTeamNetIds:
    Type: String
    Description: Northwestern NetIDs of the development team
  EnvironmentPrefix:
    Type: String
    Description: Index Prefix
    Default: ""
  HoneybadgerApiKey:
    Type: String
    Description: Honeybadger API Key
    Default: ""
  HoneybadgerEnv:
    Type: String
    Description: Honeybadger Environment
    Default: ""
  HoneybadgerRevision:
    Type: String
    Description: Honeybadger Revision
    Default: ""
  MediaConvertDestinationBucket:
    Type: String
    Description: S3 bucket destination for transcoded AV resource
    Default: ""
  MediaConvertEndpoint:
    Type: String
    Description: MediaConvert endpoint
    Default: ""
  MediaConvertJobQueueArn:
    Type: String
    Description: Job Queue ARN for MediaConvert
    Default: ""
  MediaConvertRoleArn:
    Type: String
    Description: MediaConvert role ARN
    Default: ""
  ProviderCapabilities:
    Type: String
    Description: Currently enabled features per auth provider
    Default: |
      {"magic":["chat"],"nusso":["chat"]}
  PyramidBucket:
    Type: String
    Description: Meadow Pyramid Bucket
  ReadingRoomIPs:
    Type: String
    Description: Comma-delimited list of IP addresses to serve private resources to
  RepositoryEmail:
    Type: String
    Description: Verified email address to use as sender
  SecretsPath:
    Type: String
    Description: Prefix to use when loading configs from Secrets Manager
  StreamingBucket:
    Type: String
    Description: Meadow Streaming Bucket
  WriteConfigSecret:
    Type: String
    Description: Set to something other than "true" to _not_ write configuration secrets
    Default: "true"
Conditions:
  CustomConfigSecret:
    Fn::Not: [!Equals [!Ref ApiConfigPrefix, ""]]
  DeployAPI:
    Fn::Equals: [!Ref DeployAPI, "true"]
  DeployAVDownload:
    Fn::Equals: [!Ref DeployAVDownload, "true"]
  DeployChat:
    Fn::Equals: [!Ref DeployChat, "true"]
  DeployDocs:
    Fn::Equals: [!Ref DeployDocs, "true"]
Resources:
  readSecretsPolicy:
    Type: AWS::IAM::ManagedPolicy
    Properties:
      PolicyDocument:
        Version: 2012-10-17
        Statement:
          - Sid: GetSecrets
            Effect: Allow
            Action:
              - secretsmanager:GetSecretValue
            Resource: 
              - !Sub "arn:aws:secretsmanager:${AWS::Region}:${AWS::AccountId}:secret:${SecretsPath}/*"
              - Fn::If:
                - CustomConfigSecret
                - !Sub "arn:aws:secretsmanager:${AWS::Region}:${AWS::AccountId}:secret:${ApiConfigPrefix}/*"
                - !Ref AWS::NoValue
          - Sid: BatchGetSecrets
            Effect: Allow
            Action:
              - secretsmanager:BatchGetSecretValue
            Resource: "*"
  api:
    Type: AWS::Serverless::Application
    DependsOn: rootApi
    Properties:
      Location: ./api/template.yaml
      Parameters:
        ApiConfigPrefix: !Ref ApiConfigPrefix
        ApiTokenName: !Ref ApiTokenName
        ApiTokenSecret: !Ref ApiTokenSecret
        ChatWebSocketURI: !If [DeployChat, !GetAtt [chatWebsocket, Outputs.WebSocketURI], ""]
        CustomDomainCertificateArn: !Ref CustomDomainCertificateArn
        CustomDomainZone: !Ref CustomDomainZone
        CustomDomainHost: !Ref CustomDomainHost
        DcApiEndpoint: !Ref DcApiEndpoint
        DcUrl: !Ref DcUrl
        DeployAPI: !Ref DeployAPI
        DeployAVDownload: !Ref DeployAVDownload
        DeployChat: !Ref DeployChat
        DevTeamNetIds: !Ref DevTeamNetIds
        EnvironmentPrefix: !Ref EnvironmentPrefix
        HoneybadgerApiKey: !Ref HoneybadgerApiKey
        HoneybadgerEnv: !Ref HoneybadgerEnv
        HoneybadgerRevision: !Ref HoneybadgerRevision
        ProviderCapabilities: !Ref ProviderCapabilities
        PyramidBucket: !Ref PyramidBucket
        ReadingRoomIPs: !Ref ReadingRoomIPs
        RepositoryEmail: !Ref RepositoryEmail
        SecretsPath: !Ref SecretsPath
        SecretsPolicy: !Ref readSecretsPolicy
        WriteConfigSecret: !Ref WriteConfigSecret
  avDownload:
    Type: AWS::Serverless::Application
    Condition: DeployAVDownload
    Properties:
      Location: ./av-download/template.yaml
      Parameters:
        MediaConvertDestinationBucket: !Ref MediaConvertDestinationBucket
        MediaConvertEndpoint: !Ref MediaConvertEndpoint
        MediaConvertJobQueueArn: !Ref MediaConvertJobQueueArn
        MediaConvertRoleArn: !Ref MediaConvertRoleArn
        PyramidBucket: !Ref PyramidBucket
        RepositoryEmail: !Ref RepositoryEmail
        SecretsPath:
          Fn::If:
            - CustomConfigSecret
            - !Ref ApiConfigPrefix
            - !Ref SecretsPath
        SecretsPolicy: !Ref readSecretsPolicy
        StreamingBucket: !Ref StreamingBucket
  chatWebsocket:
    Type: AWS::Serverless::Application
    Condition: DeployChat
    Properties:
      Location: ./chat/template.yaml
      Parameters:
        ApiConfigPrefix: !Ref ApiConfigPrefix
        ApiTokenName: !Ref ApiTokenName
        EnvironmentPrefix: !Ref EnvironmentPrefix
        HoneybadgerApiKey: !Ref HoneybadgerApiKey
        HoneybadgerEnv: !Ref HoneybadgerEnv
        HoneybadgerRevision: !Ref HoneybadgerRevision
        SecretsPath: !Ref SecretsPath
        SecretsPolicy: !Ref readSecretsPolicy
  docs:
    Type: AWS::Serverless::Application
    Condition: DeployDocs
    Properties:
      Location: ./docs/template.yaml
      Parameters:
        CustomDomainHost: !Ref CustomDomainHost
        CustomDomainZone: !Ref CustomDomainZone
        RootApiID: !Ref rootApi
  # API Gateway Resources
  # root API
  rootApi:
    Type: AWS::Serverless::HttpApi
    Properties:
      StageName: latest
      Domain:
        DomainName: !Sub "${CustomDomainHost}.${CustomDomainZone}"
        BasePath: ["/"]
        CertificateArn: !Ref CustomDomainCertificateArn
        Route53:
          HostedZoneName: !Sub "${CustomDomainZone}."
Outputs:
  Endpoint:
    Description: "The base API endpoint for the stack"
    Value: !Sub "https://${CustomDomainHost}.${CustomDomainZone}/api/v2"
  WebSocketURI:
    Description: "The WebSocket URI for the chat application"
    Value: !If [DeployChat, !GetAtt [chatWebsocket, Outputs.WebSocketURI], ""]