template.yml

Description: ACE Serverless Demo Application
Transform:
  - AWS::Serverless-2016-10-31

Parameters:
  AppName:
    Type: String
    Description: Application name
  AppNamespace:
    Type: String
    Description: Globally unique namespace, used to, e.g., prefix S3 buckets.
  AppEnv:
    Type: String
    Default: sandbox
    AllowedValues:
      - sandbox
      - dev
      - staging
      - prod
    Description: Environment/stage of the application.
  ModeratorEmail:
    Type: String
    Description: Email address of a person who is authorized to approve image uploads.
  AllowedImageLabels:
    Type: String
    Description: Comma-separated list of image labels that are used for bypassing image moderation.

Resources:

  ServerlessDemoSourceFiles:
    Type: AWS::S3::Bucket
    Properties:
      BucketName: !Sub ${AppNamespace}.awsserverlessdemo.${AppEnv}.files.source

  ServerlessDemoOutputFiles:
    Type: AWS::S3::Bucket
    Properties:
      BucketName: !Sub ${AppNamespace}.awsserverlessdemo.${AppEnv}.files.output

  ImageModerationTopic:
    Type: AWS::SNS::Topic
    Properties:
      TopicName: ImageModerationTopic
      DisplayName: ImageModerationTopic
      Subscription:
        - Protocol: email
          Endpoint: !Ref ModeratorEmail

  ServerlessDemoApi:
    Type: AWS::Serverless::HttpApi
    Properties:
      Description: A demo API for serverless workflows

  HelloWorldFunction:
    Type: AWS::Serverless::Function
    Properties:
      CodeUri: src/functions/hello-world
      Handler: index.handler
      Architectures:
        - arm64
      Runtime: nodejs16.x
      MemorySize: 128
      Timeout: 60
      Description: A Lambda function that returns a static string.
      Policies:
        - AWSLambdaBasicExecutionRole
      Events:
        HelloWorld:
          Type: HttpApi
          Properties:
            ApiId: !Ref ServerlessDemoApi
            Path: /hello-world
            Method: get
    Metadata:
      BuildMethod: esbuild

  LatestApiFunction:
    Type: AWS::Serverless::Function
    Properties:
      CodeUri: src/functions/latest-api
      Handler: index.handler
      Architectures:
        - arm64
      Runtime: nodejs16.x
      MemorySize: 128
      Timeout: 60
      Description: Retrieve info about the latest image processing result.
      Environment:
        Variables:
          OUTPUT_BUCKET: !Ref ServerlessDemoOutputFiles
      Policies:
        - AWSLambdaBasicExecutionRole
        - S3ReadPolicy:
            BucketName: !Ref ServerlessDemoOutputFiles
      Events:
        Images:
          Type: HttpApi
          Properties:
            ApiId: !Ref ServerlessDemoApi
            Path: /images/latest
            Method: get
    Metadata:
      BuildMethod: esbuild

  ModeratorApiFunction:
    Type: AWS::Serverless::Function
    Properties:
      CodeUri: src/functions/moderator-api
      Handler: index.handler
      Architectures:
        - arm64
      Runtime: nodejs16.x
      MemorySize: 128
      Timeout: 60
      Description: Retrieve and approve / reject images that are being uploaded.
      Environment:
        Variables:
          MODERATOR_ACTIVITY_ARN: !Ref ImageModerationActivity
      Policies:
        - AWSLambdaBasicExecutionRole
        - Statement:
            - Effect: Allow
              Action:
                - states:GetActivityTask
                - states:SendTaskSuccess
                - states:SendTaskFailure
              Resource: !Ref ImageModerationActivity
      Events:
        Moderator:
          Type: HttpApi
          Properties:
            ApiId: !Ref ServerlessDemoApi
            Path: /images/moderator
            Method: get
    Metadata:
      BuildMethod: esbuild

  UploadTriggerFunction:
    Type: AWS::Serverless::Function
    Properties:
      CodeUri: src/functions/upload-trigger
      Handler: index.handler
      Architectures:
        - arm64
      Runtime: nodejs16.x
      MemorySize: 128
      Timeout: 60
      Description: Listener for new S3 objects that triggers the image upload workflow
      Environment:
        Variables:
          STATE_MACHINE_ARN: !Ref ImageUploadWorkflow
      Policies:
        - AWSLambdaBasicExecutionRole
        - StepFunctionsExecutionPolicy:
            StateMachineName: !GetAtt ImageUploadWorkflow.Name
      Events:
        ImageUploadEvent:
          Type: S3
          Properties:
            Bucket: !Ref ServerlessDemoSourceFiles
            Events: s3:ObjectCreated:*
    Metadata:
      BuildMethod: esbuild

  BypassModerationDeciderFunction:
    Type: AWS::Serverless::Function
    Properties:
      CodeUri: src/functions/bypass-moderation-decider
      Handler: index.handler
      Architectures:
        - arm64
      Runtime: nodejs16.x
      MemorySize: 128
      Timeout: 60
      Description: Determine if image moderation is needed.
      Environment:
        Variables:
          ALLOWED_LABELS: !Ref AllowedImageLabels
      Policies:
        - AWSLambdaBasicExecutionRole
    Metadata:
      BuildMethod: esbuild

  ImageGrayscalerFunction:
    Type: AWS::Serverless::Function
    Properties:
      CodeUri: src/functions/image-grayscaler
      Handler: index.handler
      Architectures:
        - arm64
      Runtime: nodejs16.x
      MemorySize: 1536
      Timeout: 60
      Description: Generate a grayscale image.
      Environment:
        Variables:
          OUTPUT_BUCKET: !Ref ServerlessDemoOutputFiles
      Policies:
        - AWSLambdaBasicExecutionRole
        - S3ReadPolicy:
            BucketName: !Sub ${AppNamespace}.awsserverlessdemo.${AppEnv}.files.source
        - S3WritePolicy:
            BucketName: !Sub ${AppNamespace}.awsserverlessdemo.${AppEnv}.files.output
    Metadata:
      BuildMethod: esbuild

  ImageThumbnailerFunction:
    Type: AWS::Serverless::Function
    Properties:
      CodeUri: src/functions/image-thumbnailer
      Handler: index.handler
      Architectures:
        - arm64
      Runtime: nodejs16.x
      MemorySize: 1536
      Timeout: 60
      Description: Create a thumbnail image.
      Environment:
        Variables:
          OUTPUT_BUCKET: !Ref ServerlessDemoOutputFiles
      Policies:
        - AWSLambdaBasicExecutionRole
        - S3ReadPolicy:
            BucketName: !Sub ${AppNamespace}.awsserverlessdemo.${AppEnv}.files.source
        - S3WritePolicy:
            BucketName: !Sub ${AppNamespace}.awsserverlessdemo.${AppEnv}.files.output
    Metadata:
      BuildMethod: esbuild

  ImageTransformationSummaryFunction:
    Type: AWS::Serverless::Function
    Properties:
      CodeUri: src/functions/image-transformation-summary
      Handler: index.handler
      Architectures:
        - arm64
      Runtime: nodejs16.x
      MemorySize: 128
      Timeout: 60
      Description: Publisher function
      Environment:
        Variables:
          OUTPUT_BUCKET: !Ref ServerlessDemoOutputFiles
      Policies:
        - AWSLambdaBasicExecutionRole
    Metadata:
      BuildMethod: esbuild

  ImageModerationActivity:
    Type: AWS::StepFunctions::Activity
    Properties:
      Name: ImageModerationActivity

  ImageUploadWorkflow:
    Type: AWS::Serverless::StateMachine
    Properties:
      Name: ImageUploadWorkflow
      Type: STANDARD
      DefinitionUri: src/state-machine/image-upload-workflow.json
      DefinitionSubstitutions:
        BypassModerationDeciderFunctionArn: !GetAtt BypassModerationDeciderFunction.Arn
        ImageModerationTopicArn: !Ref ImageModerationTopic
        ImageModerationActivityArn: !Ref ImageModerationActivity
        ImageGrayscalerFunctionArn: !GetAtt ImageGrayscalerFunction.Arn
        ImageThumbnailerFunctionArn: !GetAtt ImageThumbnailerFunction.Arn
        ImageTransformationSummaryFunctionArn: !GetAtt ImageTransformationSummaryFunction.Arn
        OutputBucketName: !Ref ServerlessDemoOutputFiles
      Policies:
        - RekognitionDetectOnlyPolicy: { }
        - S3CrudPolicy:
            BucketName: !Sub ${AppNamespace}.awsserverlessdemo.${AppEnv}.files.source
        - S3WritePolicy:
            BucketName: !Ref ServerlessDemoOutputFiles
        - SNSPublishMessagePolicy:
            TopicName: !GetAtt ImageModerationTopic.TopicName
        - LambdaInvokePolicy:
            FunctionName: !Ref BypassModerationDeciderFunction
        - LambdaInvokePolicy:
            FunctionName: !Ref ImageGrayscalerFunction
        - LambdaInvokePolicy:
            FunctionName: !Ref ImageThumbnailerFunction
        - LambdaInvokePolicy:
            FunctionName: !Ref ImageTransformationSummaryFunction
      Tracing:
        Enabled: true

Outputs:
  ServerlessDemoApiURL:
    Description: "API endpoint URL"
    Value: !Sub "https://${ServerlessDemoApi}.execute-api.${AWS::Region}.amazonaws.com/"