template.yaml

AWSTemplateFormatVersion: '2010-09-09'
Transform:
  - AWS::LanguageExtensions
  - AWS::Serverless-2016-10-31
Description: "EC API app: Lambda, API Gateway"

Globals:
  Function:
    Timeout: 10
  Api:
    BinaryMediaTypes:
      - "*/*"

Parameters:

  AppSecretKey:
    Description: "The SECRET_KEY environment variable passed to the app."
    Type: String

  AppSentryDSN:
    Description: "The SENTRY_DSN environment variable passed to the app."
    Type: String

  GitHash:
    Description: "The Hash of the git commit that's deployed"
    Type: String

  AppDjangoSettingsModule:
    # NB This parameter (and how it reaches the app, and how it's set in
    # developer and CI-managed deployments) is used in
    # `docs/new-development-deployment.md` as a reference to demonstrate how to
    # communicate variables to the app. If you modify this parameter, or remove
    # it, please update the document so developers aren't left without
    # guidance!
    Description: "The DJANGO_SETTINGS_MODULE environment variable passed to the app."
    Type: String

  AppIsBehindCloudFront:
    Description: "The APP_IS_BEHIND_CLOUDFRONT environment variable passed to the app, which modifies various path- and host-related settings."
    Type: String
    AllowedValues:
    - "True"
    - "False"
    Default: "False"

  AppLogRetentionDays:
    Description: "The number of days that CloudWatch Logs will keep logs from the app."
    Type: Number
    Default: 60
    AllowedValues: [ 1, 3, 5, 7, 14, 30, 60, 90, 120, 150, 180, 365, 400, 545, 731, 1827, 3653 ]

  AppPostgresHost:
    Description: "The Postgres database host for this deploy."
    Type: String

  AppPostgresDatabaseName:
    Description: "The Postgres database name for this deploy."
    Type: String

  AppPostgresPassword:
    Description: "The password for the postgres user"
    Type: String

  AppWidgetS3URL:
    Description: "The URL to the widget JS"
    Type: String

  DCEnvironment:
    Default: DC_ENVIRONMENT
    Description: "The DC_ENVIRONMENT environment variable"
    Type: AWS::SSM::Parameter::Value<String>

  AppDomain:
    Description: "The domain the app is on."
    Type: String

  AppLoggerArn:
    Default: AppLoggerArn
    Description: "The ARN of the Lambda function to log to"
    Type: AWS::SSM::Parameter::Value<String>

  DevsDCApiKey:
    Default: DevsDCApiKey
    Description: "The API to use to authenticate to devs.DC"
    Type: AWS::SSM::Parameter::Value<String>

Conditions:
  UseBasicAuth: !Or
    - !Equals [ !Ref DCEnvironment, development ]
    - !Equals [ !Ref DCEnvironment, staging ]

Resources:
  DependenciesLayer:
    Type: AWS::Serverless::LayerVersion
    Properties:
      ContentUri: ./lambda-layers/DependenciesLayer/
      CompatibleRuntimes:
        - python3.12
    Metadata:
      BuildMethod: python3.12
    RetentionPolicy: Delete

  ECApiFunction:
    Type: AWS::Serverless::Function
    Properties:
      Role: !Sub "arn:aws:iam::${AWS::AccountId}:role/ECApiLambdaExecutionRole"
      CodeUri: .
      Handler: ec_api.lambda_awsgi.lambda_handler
      Layers:
        - !Ref DependenciesLayer
      Runtime: python3.12
      MemorySize: 1024
      Environment:
        Variables:
          SECRET_KEY: !Ref AppSecretKey
          SENTRY_DSN: !Ref AppSentryDSN
          GIT_HASH: !Ref GitHash
          DJANGO_SETTINGS_MODULE: !Ref AppDjangoSettingsModule
          APP_IS_BEHIND_CLOUDFRONT: !Ref AppIsBehindCloudFront
          POSTGRES_HOST: !Ref AppPostgresHost
          POSTGRES_DATABASE_NAME: !Ref AppPostgresDatabaseName
          POSTGRES_PASSWORD: !Ref AppPostgresPassword
          WIDGET_S3_URL: !Ref AppWidgetS3URL
          DC_ENVIRONMENT: !Ref DCEnvironment
          APP_DOMAIN: !Ref AppDomain
          LOGGER_ARN: !Ref AppLoggerArn
      Events:
        HTTPRequests:
          Type: Api
          Properties:
            RestApiId: !Ref FrontendAPI
            Path: /{proxy+}
            Method: ANY
        HTTPRequestRoots:
          Type: Api
          Properties:
            RestApiId: !Ref FrontendAPI
            Path: /
            Method: ANY

  ECApiFunctionLogGroup:
    Type: AWS::Logs::LogGroup
    DependsOn: [ ECApiFunction ]
    Properties:
      LogGroupName: !Sub /aws/lambda/${ECApiFunction}
      RetentionInDays: !Ref AppLogRetentionDays

  FrontendAPI:
    Type: AWS::Serverless::Api
    Properties:
      AlwaysDeploy: True
      StageName: Prod
      Cors:
        AllowMethods: "'GET'"
        AllowOrigin: "'*'"
        MaxAge: "'600'"
      Auth:
        DefaultAuthorizer: !If [ UseBasicAuth, "FrontendAuthFunction", !Ref AWS::NoValue]
        Authorizers:
          FrontendAuthFunction:
            FunctionArn: !GetAtt FrontendAuthFunction.Arn
            FunctionPayloadType: REQUEST
            Identity:
              Headers:
                - Authorization
              ReauthorizeEvery: 3600

  BasicAuthGatewayResponse:
    Condition: UseBasicAuth
    Type: AWS::ApiGateway::GatewayResponse
    Properties:
      ResponseParameters:
        gatewayresponse.header.www-authenticate: "'Basic realm=\"Restricted\"'"
      ResponseType: UNAUTHORIZED
      RestApiId: !Ref FrontendAPI
      StatusCode: '401'

  ECAPI:
    Type: AWS::Serverless::Api
    Properties:
      StageName: Prod
      Cors:
        AllowMethods: "'GET'"
        AllowOrigin: "'*'"
        MaxAge: "'600'"
      Auth:
        DefaultAuthorizer: APIAuthFunction
        Authorizers:
          APIAuthFunction:
            FunctionArn: !GetAtt APIAuthFunction.Arn
            FunctionPayloadType: REQUEST
            Identity:
              QueryStrings:
                - token
              ReauthorizeEvery: 3600

  FrontendAuthFunction:
    Type: AWS::Serverless::Function
    Properties:
      Role: !Sub "arn:aws:iam::${AWS::AccountId}:role/ECApiLambdaExecutionRole"
      CodeUri: ./ec_api/
      Handler: lambda_frontend_auth.lambda_handler
      Runtime: python3.12

  APIAuthFunction:
    Type: AWS::Serverless::Function
    Properties:
      Role: !Sub "arn:aws:iam::${AWS::AccountId}:role/ECApiLambdaExecutionRole"
      CodeUri: ./api_endpoints/api_auth
      Handler: handler.lambda_handler
      Environment:
        Variables:
          POSTGRES_HOST: !Ref AppPostgresHost
          POSTGRES_DATABASE_NAME: !Ref AppPostgresDatabaseName
          POSTGRES_PASSWORD: !Ref AppPostgresPassword
      Runtime: python3.12

  V1VotingInformationFunction:
    Type: AWS::Serverless::Function
    Properties:
      Role: !Sub "arn:aws:iam::${AWS::AccountId}:role/ECApiLambdaExecutionRole"
      CodeUri: ./api_endpoints/v1_postcode_lookup/
      Handler: app.handler
      Runtime: python3.12
      MemorySize: 512
      Environment:
        Variables:
          SENTRY_DSN: !Ref AppSentryDSN
          DC_API_TOKEN: !Ref DevsDCApiKey
          LOGGER_ARN: !Ref AppLoggerArn
      Events:
        PostcodeRequests:
          Type: Api
          Properties:
            RestApiId: !Ref ECAPI
            Path: /api/v1/postcode/{proxy+}
            Method: GET
        AddressRequests:
          Type: Api
          Properties:
            RestApiId: !Ref ECAPI
            Path: /api/v1/address/{proxy+}
            Method: GET

Outputs:
  ECApiFrontendFqdn:
    Description: "API Gateway endpoint FQDN for EC API function"
    Value: !Sub "${FrontendAPI}.execute-api.${AWS::Region}.amazonaws.com"
    Export:
      Name: !Join [ ":", [ !Ref "AWS::StackName", "ECApiFrontendFqdn" ] ]

  ECStarletteApi:
    Description: "API Gateway endpoint FQDN for EC Starlette API function"
    Value: !Sub "${ECAPI}.execute-api.${AWS::Region}.amazonaws.com"
    Export:
      Name: !Join [ ":", [ !Ref "AWS::StackName", "ECStarletteApiFqdn" ] ]