template.yaml

AWSTemplateFormatVersion: '2010-09-09'
Transform: AWS::Serverless-2016-10-31
Description: >
  simple schedule serverless application setup
Globals:
  Api:
    MinimumCompressionSize: 0
    TracingEnabled: true
  Function:
    Tracing: Active
    Timeout: 3
    Runtime: nodejs14.x
    Environment:
      Variables:
        ENV: Production
        PGDBCLUSTERARN: !ImportValue "default-db-cluster-arn"
        PGUSER: !ImportValue "default-db-admin-username"
        PGHOST: !ImportValue "default-db-cluster-endpoint"
        PGPASSWORD: !ImportValue "default-db-password"
        PGDATABASE: !ImportValue "default-db-name"
        PGPORT: 5432 
        SECRET_ARN: !ImportValue "default-db-secret"

Conditions:
  isSamLocal: !Equals [!Ref "AWS::StackName", ""]
  isMaster: !Equals [!Ref "AWS::StackName", "schedule-service"]

Resources:
  ScheduleServiceApiGateway:
    Type: AWS::Serverless::Api
    Properties:
      Name: schedule-service-api
      StageName: prod
      DefinitionBody:
        Fn::Transform:
          Name: AWS::Include
          Parameters:
            Location: ./docs/api.yaml

  CloudwatchSceduleFunction:
    Type: AWS::Serverless::Function
    Properties:
      CodeUri: dist/
      Handler: cloudwatch-schedule.lambdaHandler
      # FunctionName: String
      Timeout: 100
      MemorySize: 128
      Description: set a schedule lambda.
      Policies:
        - Statement:
            Effect: "Allow"
            Action: 
              - "events:PutEvents"
              - "events:PutRule"
              - "events:PutTargets"
              - "events:ListRules"
              - "iam:PassRole"
              - "lambda:AddPermission"
              - "lambda:InvokeFunction"
            Resource: "*"
        - AWSSecretsManagerGetSecretValuePolicy:
            SecretArn: !ImportValue "default-db-secret"
        - Statement:
          - Effect: Allow
            Action: 'rds-data:ExecuteStatement'
            Resource: !ImportValue "default-db-cluster-arn"
      Environment:
        Variables:
          TARGET_FUNCTION_ARN: !GetAtt CloudwatchTargetFunction.Arn
          TARGET_FUNCTION_NAME: !Ref CloudwatchTargetFunction

  CloudwatchDeleteScheduleFunction:
    Type: AWS::Serverless::Function
    Properties:
      CodeUri: dist/
      Handler: cloudwatch-delete-schedule.lambdaHandler
      Timeout: 100
      MemorySize: 128
      Description: delete a schedule lambda.
      Policies:
        - Statement:
            Effect: "Allow"
            Action: 
              - "events:*"
            Resource: "*"

  CloudwatchDeleteAllScheduleFunction:
    Type: AWS::Serverless::Function
    Properties:
      CodeUri: dist/
      Handler: cloudwatch-delete-all-schedules.lambdaHandler
      Timeout: 100
      MemorySize: 128
      Description: delete a schedule lambda.
      Policies:
        - Statement:
            Effect: "Allow"
            Action: 
              - "events:*"
            Resource: "*"

  CloudwatchTargetFunction:
    Type: AWS::Serverless::Function
    Properties:
      CodeUri: dist/
      Handler: cloudwatch-target-function.lambdaHandler
      FunctionName: target2
      MemorySize: 128
      Timeout: 100
      Description: cloudwatch/eventbridge target function.
      Events:
        EventBridgeTrigger:
          Type: CloudWatchEvent
          Properties:
            Pattern:
              source:
                - "WebApp"

##########################################################################################################
# Function permissions grant an AWS service or another account permission to use a function                                                               #
#########################################################################################################
  AuthorizerFunctionResourcePermission:
    Type: 'AWS::Lambda::Permission'
    Properties:
      Action: 'lambda:InvokeFunction'
      Principal: apigateway.amazonaws.com
      # lambda name imported from auth-service
      FunctionName: !ImportValue "authorizer-function-name"
      SourceArn: !Sub 'arn:aws:execute-api:${AWS::Region}:${AWS::AccountId}:${ScheduleServiceApiGateway}/*'
  
  CloudwatchSceduleFunctionResourcePermission:
    Type: 'AWS::Lambda::Permission'
    Properties:
      Action: 'lambda:InvokeFunction'
      Principal: apigateway.amazonaws.com
      FunctionName: !Ref CloudwatchSceduleFunction
      SourceArn: !Sub 'arn:aws:execute-api:${AWS::Region}:${AWS::AccountId}:${ScheduleServiceApiGateway}/*'

  CloudwatchDeleteScheduleFunctionResourcePermission:
    Type: 'AWS::Lambda::Permission'
    Properties:
      Action: 'lambda:InvokeFunction'
      Principal: apigateway.amazonaws.com
      FunctionName: !Ref CloudwatchDeleteScheduleFunction
      SourceArn: !Sub 'arn:aws:execute-api:${AWS::Region}:${AWS::AccountId}:${ScheduleServiceApiGateway}/*'

  CloudwatchDeleteAllScheduleFunctionResourcePermission:
    Type: 'AWS::Lambda::Permission'
    Properties:
      Action: 'lambda:InvokeFunction'
      Principal: apigateway.amazonaws.com
      FunctionName: !Ref CloudwatchDeleteAllScheduleFunction
      SourceArn: !Sub 'arn:aws:execute-api:${AWS::Region}:${AWS::AccountId}:${ScheduleServiceApiGateway}/*'


Outputs:
  API:
    Description: schedule service api gateway
    Value: !Sub "https://${ScheduleServiceApiGateway}.execute-api.${AWS::Region}.amazonaws.com/"