template.yml

AWSTemplateFormatVersion: "2010-09-09"
Transform: AWS::Serverless-2016-10-31
Description: AoC Telegram Bot

Parameters:
  Bucket:
    Type: String
    Description: Package bucket name
  Package:
    Type: String
    Description: Package file name
  Version:
    Type: String
    Description: Package version

Resources:
  # Scheduled function to processes leaderboards and invites
  AocBotScheduleFunction:
    Type: AWS::Serverless::Function
    DependsOn:
      - AocBotTable
    Properties:
      FunctionName: !Sub ${AWS::StackName}_AocBotSchedule
      Description: !Ref Version
      CodeUri:
        Bucket: !Ref Bucket
        Key: !Ref Package
      Handler: src/leaderboards.handler
      Runtime: nodejs20.x
      Architectures:
        - arm64
      Timeout: 300
      Policies:
        - AWSLambdaVPCAccessExecutionRole
        - AWSXrayWriteOnlyAccess
        - DynamoDBCrudPolicy:
            TableName: !Ref AocBotTable
        - SSMParameterReadPolicy:
            ParameterName: aoc-bot/advent-of-code-secret
        - SSMParameterReadPolicy:
            ParameterName: aoc-bot/telegram-secret
        - SSMParameterReadPolicy:
            ParameterName: aoc-bot/webhook-secret

  # API function to process HTTP requests
  AocBotApiFunction:
    Type: AWS::Serverless::Function
    DependsOn:
      - AocBotTable
    Properties:
      FunctionName: !Sub ${AWS::StackName}_AocBotApi
      Description: !Ref Version
      CodeUri:
        Bucket: !Ref Bucket
        Key: !Ref Package
      Handler: src/api.handler
      Runtime: nodejs20.x
      Architectures:
        - arm64
      Timeout: 300
      Policies:
        - AWSLambdaVPCAccessExecutionRole
        - AWSXrayWriteOnlyAccess
        - DynamoDBCrudPolicy:
            TableName: !Ref AocBotTable
        - SSMParameterReadPolicy:
            ParameterName: aoc-bot/advent-of-code-secret
        - SSMParameterReadPolicy:
            ParameterName: aoc-bot/telegram-secret
        - SSMParameterReadPolicy:
            ParameterName: aoc-bot/webhook-secret

  # Dynamo DB table to store all data
  AocBotTable:
    Type: AWS::DynamoDB::Table
    Properties:
      AttributeDefinitions:
        - AttributeName: id
          AttributeType: S
        - AttributeName: sk
          AttributeType: S
      BillingMode: PAY_PER_REQUEST
      KeySchema:
        - AttributeName: id
          KeyType: HASH
        - AttributeName: sk
          KeyType: RANGE
      TableName: aoc-bot
    DeletionPolicy: Retain
    UpdateReplacePolicy: Retain

  # Dynamo DB backup plan
  AocBotBackupPlan:
    Type: AWS::Backup::BackupPlan
    Properties:
      BackupPlan:
        BackupPlanName: AocBotBackupPlan
        BackupPlanRule:
          - RuleName: AocBotDecemberRule
            TargetBackupVault: Default
            ScheduleExpression: "cron(0 4 * DEC ? *)" # every day at 4:00am, only in December
            StartWindowMinutes: 60
            CompletionWindowMinutes: 180
            Lifecycle:
              DeleteAfterDays: 35
          - RuleName: AocBotNotDecemberRule
            TargetBackupVault: Default
            ScheduleExpression: "cron(0 4 ? JAN-NOV 1 *)" # every week on Sunday 4:00am, January through November
            StartWindowMinutes: 60
            CompletionWindowMinutes: 180
            Lifecycle:
              DeleteAfterDays: 400

  # Select resources for the backup plan
  AocBotBackupSelection:
    Type: AWS::Backup::BackupSelection
    Properties:
      BackupPlanId: !Ref AocBotBackupPlan
      BackupSelection:
        SelectionName: AocBotTableBackupSelection
        IamRoleArn: !Sub arn:aws:iam::${AWS::AccountId}:role/service-role/AWSBackupDefaultServiceRole
        Resources:
          - !GetAtt AocBotTable.Arn

  # Rule to regularly trigger AocBotScheduleFunction in December
  AocBotDecemberRule:
    Type: AWS::Events::Rule
    Properties:
      ScheduleExpression: cron(0/15 * * DEC ? *) # every 15 minutes, only in December
      State: ENABLED
      Targets:
        - Arn: !GetAtt AocBotScheduleFunction.Arn
          Id: AocBotRuleTarget

  # Permission that allows Events to call AocBotScheduleFunction in December
  AocBotDecemberSchedulePerms:
    Type: AWS::Lambda::Permission
    Properties:
      Action: lambda:InvokeFunction
      FunctionName: !Ref AocBotScheduleFunction
      Principal: events.amazonaws.com
      SourceArn: !GetAtt AocBotDecemberRule.Arn

  # Rule to regularly trigger AocBotScheduleFunction in January to November
  AocBotNotDecemberRule:
    Type: AWS::Events::Rule
    Properties:
      ScheduleExpression: cron(0 12 * JAN-NOV ? *) # at 12:00, January through November
      State: ENABLED
      Targets:
        - Arn: !GetAtt AocBotScheduleFunction.Arn
          Id: AocBotRuleTarget

  # Permission that allows Events to call AocBotScheduleFunction in January to November
  AocBotNotDecemberSchedulePerms:
    Type: AWS::Lambda::Permission
    Properties:
      Action: lambda:InvokeFunction
      FunctionName: !Ref AocBotScheduleFunction
      Principal: events.amazonaws.com
      SourceArn: !GetAtt AocBotNotDecemberRule.Arn

  # API Gateway to handle HTTP requests
  AocBotApi:
    Type: AWS::Serverless::Api
    DependsOn:
      - AocBotApiFunction
    Properties:
      StageName: Prod
      MethodSettings:
        - DataTraceEnabled: false
          HttpMethod: "*"
          LoggingLevel: INFO
          MetricsEnabled: false
          ResourcePath: "/*"
      AccessLogSetting:
        DestinationArn: !GetAtt AocBotApiLog.Arn
        Format: >
          {
          "requestId": "$context.requestId",
          "extendedRequestId": "$context.extendedRequestId",
          "ip": "$context.identity.sourceIp",
          "caller": "$context.identity.caller",
          "user": "$context.identity.user",
          "requestTime": "$context.requestTime",
          "httpMethod": "$context.httpMethod",
          "resourcePath": "$context.resourcePath",
          "status": "$context.status",
          "protocol": "$context.protocol",
          "responseLength": "$context.responseLength"
          }
      DefinitionBody:
        openapi: "3.0.1"
        info:
          title: !Sub "${AWS::StackName}_AocBot"
          version: !Ref Version
        paths:
          /telegram:
            post:
              x-amazon-apigateway-integration:
                uri: !Sub
                  "arn:aws:apigateway:${AWS::Region}:lambda:path\
                  /2015-03-31/functions/${AocBotApiFunction.Arn}/invocations"
                passthroughBehavior: when_no_match
                httpMethod: POST
                type: aws_proxy
          /start:
            options:
              x-amazon-apigateway-integration:
                uri: !Sub
                  "arn:aws:apigateway:${AWS::Region}:lambda:path\
                  /2015-03-31/functions/${AocBotApiFunction.Arn}/invocations"
                passthroughBehavior: when_no_match
                httpMethod: POST
                type: aws_proxy
            post:
              x-amazon-apigateway-integration:
                uri: !Sub
                  "arn:aws:apigateway:${AWS::Region}:lambda:path\
                  /2015-03-31/functions/${AocBotApiFunction.Arn}/invocations"
                passthroughBehavior: when_no_match
                httpMethod: POST
                type: aws_proxy
          /stop:
            options:
              x-amazon-apigateway-integration:
                uri: !Sub
                  "arn:aws:apigateway:${AWS::Region}:lambda:path\
                  /2015-03-31/functions/${AocBotApiFunction.Arn}/invocations"
                passthroughBehavior: when_no_match
                httpMethod: POST
                type: aws_proxy
            post:
              x-amazon-apigateway-integration:
                uri: !Sub
                  "arn:aws:apigateway:${AWS::Region}:lambda:path\
                  /2015-03-31/functions/${AocBotApiFunction.Arn}/invocations"
                passthroughBehavior: when_no_match
                httpMethod: POST
                type: aws_proxy
        x-amazon-apigateway-binary-media-types:
          - "application/json"

  # Permission that allows API Gateway to call AocBotApiFunction
  AocBotApiPerms:
    Type: AWS::Lambda::Permission
    DependsOn:
      - AocBotApi
    Properties:
      Action: lambda:InvokeFunction
      FunctionName: !Ref AocBotApiFunction
      Principal: apigateway.amazonaws.com

  # Log group for API Gateway access logs
  AocBotApiLog:
    Type: AWS::Logs::LogGroup
    Properties:
      LogGroupName: !Sub API-Gateway-Access-Logs_${AocBotApi}

# Output the API endpoint, to be used for Telegram registration
Outputs:
  Endpoint:
    Description: "API Endpoint"
    Value: !Sub "https://${AocBotApi}.execute-api.${AWS::Region}.amazonaws.com/Prod/"