template.yaml

AWSTemplateFormatVersion: '2010-09-09'
Transform:
  - AWS::LanguageExtensions
  - AWS::Serverless-2016-10-31
Description: "Aggregator API app: Lambda, API Gateway"

Globals:
  Function:
    Timeout: 30
  Api:
    BinaryMediaTypes:
      - "*/*"

Parameters:
  AppSecretKey:
    Description: "The SECRET_KEY environment variable passed to the app."
    Type: String

  AppDebug:
    Description: "Debug mode"
    Default: AppDebug
    Type: AWS::SSM::Parameter::Value<String>

  AppSentryDSN:
    Description: "The SENTRY_DSN environment variable passed to the app."
    Type: String

  AppWdivApiKey:
    Default: AppWdivApiKey
    Description: "The WDIV_API_KEY environment variable passed to the app."
    Type: AWS::SSM::Parameter::Value<String>

  AppPostgresHost:
    Default: AppPostgresHost
    Description: "The Postgres database host for this deploy."
    Type: AWS::SSM::Parameter::Value<String>

  AppPostgresDatabaseName:
    Default: AppPostgresDatabaseName
    Description: "The Postgres database name for this deploy."
    Type: AWS::SSM::Parameter::Value<String>

  AppPostgresPassword:
    Default: AppPostgresPassword
    Description: "The password for the postgres user"
    Type: AWS::SSM::Parameter::Value<String>

  AppLoggingAssumeRoleArn:
    Default: AppLoggingAssumeRoleArn
    Description: The ARN of the role needed by dc_logging
    Type: AWS::SSM::Parameter::Value<String>

  AppLoggerArn:
    Default: AppLoggerArn
    Description: The ARN of the Lambda ingest function
    Type: AWS::SSM::Parameter::Value<String>

  AppBoundaryReviewsDataPrefix:
    Default: AppBoundaryReviewsDataPrefix
    Description: S3 Prefix for where boundary review data is
    Type: AWS::SSM::Parameter::Value<String>

  AppDjangoSettingsModule:
    # NB This parameter (and how it reaches the app, and how it's set in
    # developer and CI-managed deployments) is used in
    # `docs/new-development-deployment.md` as a reference to demonstrate how to
    # communicate variables to the app. If you modify this parameter, or remove
    # it, please update the document so developers aren't left without
    # guidance!
    Description: "The DJANGO_SETTINGS_MODULE environment variable passed to the app."
    Type: String

  AppIsBehindCloudFront:
    Description: "The APP_IS_BEHIND_CLOUDFRONT environment variable passed to the app, which modifies various path- and host-related settings."
    Type: String
    AllowedValues:
    - "True"
    - "False"
    Default: "False"

  AppSmtpHost:
    Description: "SMTP Host"
    Default: AppSmtpHost
    Type: AWS::SSM::Parameter::Value<String>

  AppSmtpUser:
    Description: "SMTP User"
    Default: AppSmtpUser
    Type: AWS::SSM::Parameter::Value<String>

  AppSmtpPass:
    Description: "SMTP Password"
    Default: AppSmtpPass
    Type: AWS::SSM::Parameter::Value<String>

  AppUseDynamoDBAuth:
    Description: "Enable or disable DynamoDB Auth. Set to 'True' or 'False'."
    Default: AppUseDynamoDBAuth
    Type: AWS::SSM::Parameter::Value<String>

  AppLogRetentionDays:
    Description: "The number of days that CloudWatch Logs will keep logs from the app."
    Type: Number
    Default: 60
    AllowedValues: [ 1, 3, 5, 7, 14, 30, 60, 90, 120, 150, 180, 365, 400, 545, 731, 1827, 3653 ]

  DCEnvironment:
    Description: The DC Environment this application is deployed in
    Type: String
    AllowedValues:
      - "production"
      - "staging"
      - "development"

Conditions:
  IsProd: !Equals
    - !Ref DCEnvironment
    - "production"
  UseBasicAuth: !Or
  - !Equals [ !Ref DCEnvironment, development ]
  - !Equals [ !Ref DCEnvironment, staging ]

Resources:

  UsersDynamoDBTable:
    Type: AWS::DynamoDB::Table
    Properties:
      TableName: "users"
      BillingMode: PAY_PER_REQUEST
      AttributeDefinitions:
        -
          AttributeName: api_key
          AttributeType: S
      KeySchema:
        -
          AttributeName: api_key
          KeyType: HASH

  DCAPI:
    Type: AWS::Serverless::Api
    Properties:
      StageName: Prod
      Auth:
        DefaultAuthorizer: APIAuthFunction
        Authorizers:
          APIAuthFunction:
            FunctionArn: !GetAtt APIAuthFunction.Arn
            FunctionPayloadType: REQUEST
            Identity:
              QueryStrings:
                - auth_token

  APICommonLayer:
    Type: AWS::Serverless::LayerVersion
    Properties:
      ContentUri: ./lambda-layers/APICommonLayer/
      CompatibleRuntimes:
        - python3.12
    Metadata:
      BuildMethod: makefile
    RetentionPolicy: Delete

  PolarsLayer:
    Type: AWS::Serverless::LayerVersion
    Properties:
      ContentUri: ./lambda-layers/PolarsLayer/
      CompatibleRuntimes:
        - python3.12
    Metadata:
      BuildMethod: makefile
    RetentionPolicy: Delete

  APIAuthFunction:
    Type: AWS::Serverless::Function
    Properties:
      Role: !Sub "arn:aws:iam::${AWS::AccountId}:role/AggregatorApiLambdaExecutionRole"
      CodeUri: ./api/api_auth
      Handler: handler.lambda_handler
      Environment:
        Variables:
          SENTRY_DSN: !Ref AppSentryDSN
          USE_DYNAMODB_AUTH: !Ref AppUseDynamoDBAuth
      Layers:
        - !Ref APICommonLayer
      Runtime: python3.12

  V1VotingInformationFunction:
    Type: AWS::Serverless::Function
    Properties:
      Role: !Sub "arn:aws:iam::${AWS::AccountId}:role/AggregatorApiLambdaExecutionRole"
      CodeUri: ./api/endpoints/v1/voting_information/
      Handler: app.handler
#      AutoPublishAlias: live
#      ProvisionedConcurrencyConfig:
#        ProvisionedConcurrentExecutions:
#          'Fn::If':
#            - IsProd
#            - 10
#            - 1
      Layers:
        - !Ref APICommonLayer
        - !Ref PolarsLayer
      Runtime: python3.12
      MemorySize: 512
      Environment:
        Variables:
          FIREHOSE_ACCOUNT_ARN: !Ref AppLoggingAssumeRoleArn
          SENTRY_DSN: !Ref AppSentryDSN
          DEBUG: !Ref AppDebug
          WDIV_API_KEY: !Ref AppWdivApiKey
          DC_ENVIRONMENT: !Ref DCEnvironment
          LOGGER_ARN: !Ref AppLoggerArn
          BOUNDARY_REVIEWS_DATA_KEY_PREFIX: !Ref AppBoundaryReviewsDataPrefix
      Events:
        PostcodeRequests:
          Type: Api
          Properties:
            RestApiId: !Ref DCAPI
            Path: /api/v1/postcode/{proxy+}
            Method: GET
        AddressRequests:
          Type: Api
          Properties:
            RestApiId: !Ref DCAPI
            Path: /api/v1/address/{proxy+}
            Method: GET

  V1ElectionsFunction:
    Type: AWS::Serverless::Function
    Properties:
      Role: !Sub "arn:aws:iam::${AWS::AccountId}:role/AggregatorApiLambdaExecutionRole"
      CodeUri: ./api/endpoints/v1/elections/
      Handler: app.handler
      Layers:
        - !Ref APICommonLayer
        - !Ref PolarsLayer
      Runtime: python3.12
      MemorySize: 512
      Environment:
        Variables:
          SENTRY_DSN: !Ref AppSentryDSN
          DEBUG: !Ref AppDebug
          DC_ENVIRONMENT: !Ref DCEnvironment
          LOGGER_ARN: !Ref AppLoggerArn
      Events:
        ElectionListRequests:
          Type: Api
          Properties:
            RestApiId: !Ref DCAPI
            Path: /api/v1/elections/
            Method: GET
        SingleElectionRequests:
          Type: Api
          Properties:
            RestApiId: !Ref DCAPI
            Path: /api/v1/elections/{proxy+}
            Method: GET

  V1LayersOfStateFunction:
    Type: AWS::Serverless::Function
    Properties:
      Role: !Sub "arn:aws:iam::${AWS::AccountId}:role/AggregatorApiLambdaExecutionRole"
      CodeUri: ./api/endpoints/v1/layers_of_state/
      Handler: app.handler
      Layers:
        - !Ref APICommonLayer
        - !Ref PolarsLayer
      Runtime: python3.12
      MemorySize: 512
      Environment:
        Variables:
          SENTRY_DSN: !Ref AppSentryDSN
          DEBUG: !Ref AppDebug
          DC_ENVIRONMENT: !Ref DCEnvironment
      Events:
        PostcodeAndUPRNRequests:
          Type: Api
          Properties:
            RestApiId: !Ref DCAPI
            Path: /api/v1/layers_of_state/{proxy+}
            Method: GET

  V1SandboxFunction:
    Type: AWS::Serverless::Function
    Properties:
      Role: !Sub "arn:aws:iam::${AWS::AccountId}:role/AggregatorApiLambdaExecutionRole"
      CodeUri: ./api/endpoints/v1/sandbox/
      Handler: app.handler
      Runtime: python3.12
      Layers:
        - !Ref APICommonLayer
      MemorySize: 512
      Environment:
        Variables:
          SENTRY_DSN: !Ref AppSentryDSN
          DEBUG: !Ref AppDebug
      Events:
        SandboxRequests:
          Type: Api
          Properties:
            RestApiId: !Ref DCAPI
            Auth:
              Authorizer: NONE
            Path: /api/v1/sandbox/{proxy+}
            Method: GET
        SandboxOptionsRequests:
          Type: Api
          Properties:
            RestApiId: !Ref DCAPI
            Auth:
              Authorizer: NONE
            Path: /api/v1/sandbox/{proxy+}
            Method: OPTIONS

  FrontendDependenciesLayer:
    Type: AWS::Serverless::LayerVersion
    Properties:
      ContentUri: ./lambda-layers/FrontendDependenciesLayer/
      CompatibleRuntimes:
        - python3.12
    Metadata:
      BuildMethod: makefile
    RetentionPolicy: Delete

  ApiFrontendFunction:
    Type: AWS::Serverless::Function
    Properties:
      Role: !Sub "arn:aws:iam::${AWS::AccountId}:role/AggregatorApiLambdaExecutionRole"
      CodeUri: ./api/frontend
      Handler: frontend.asgi.handler
      Layers:
        - !Ref APICommonLayer
        - !Ref FrontendDependenciesLayer
      Runtime: python3.12
      MemorySize: 512
      Environment:
        Variables:
          SECRET_KEY: !Ref AppSecretKey
          SENTRY_DSN: !Ref AppSentryDSN
          WDIV_API_KEY: !Ref AppWdivApiKey
          DJANGO_SETTINGS_MODULE: !Ref AppDjangoSettingsModule
          APP_IS_BEHIND_CLOUDFRONT: !Ref AppIsBehindCloudFront
          DATABASE_HOST: !Ref AppPostgresHost
          POSTGRES_DATABASE_NAME: !Ref AppPostgresDatabaseName
          DATABASE_PASS: !Ref AppPostgresPassword
          FIREHOSE_ACCOUNT_ARN: !Ref AppLoggingAssumeRoleArn
          DEBUG: !Ref AppDebug
          SMTP_HOST: !Ref AppSmtpHost
          SMTP_USERNAME: !Ref AppSmtpUser
          SMTP_PASSWORD: !Ref AppSmtpPass
          DC_ENVIRONMENT: !Ref DCEnvironment
      Events:
        HTTPRequests:
          Type: Api
          Properties:
            RestApiId: !Ref FrontendAPIGateway
            Path: /{proxy+}
            Method: ANY
        HTTPRequestRoots:
          Type: Api
          Properties:
            RestApiId: !Ref FrontendAPIGateway
            Path: /
            Method: ANY

  FrontendAPIGateway:
    Type: AWS::Serverless::Api
    Properties:
      AlwaysDeploy: True
      StageName: Prod
      Cors:
        AllowMethods: "'GET'"
        AllowOrigin: "'*'"
        MaxAge: "'600'"
      Auth:
        DefaultAuthorizer: !If [ UseBasicAuth, "BasicAuthFunction", !Ref AWS::NoValue]
        Authorizers:
          BasicAuthFunction:
            FunctionArn: !GetAtt BasicAuthFunction.Arn
            FunctionPayloadType: REQUEST
            Identity:
              Headers:
                - Authorization
              ReauthorizeEvery: 3600

  BasicAuthFunction:
    Type: AWS::Serverless::Function
    Properties:
      CodeUri: ./api/basic_auth
      Handler: handler.lambda_handler
      Runtime: python3.12

  BasicAuthGatewayResponse:
    Condition: UseBasicAuth
    Type: AWS::ApiGateway::GatewayResponse
    Properties:
      ResponseParameters:
        gatewayresponse.header.www-authenticate: "'Basic realm=\"Restricted\"'"
      ResponseType: UNAUTHORIZED
      RestApiId: !Ref FrontendAPIGateway
      StatusCode: '401'

  ApiFrontendManagementFunction:
    Type: AWS::Serverless::Function
    Properties:
      FunctionName: ApiFrontendManagementFunction
      Timeout: 60
      Role: !Sub "arn:aws:iam::${AWS::AccountId}:role/AggregatorApiLambdaExecutionRole"
      CodeUri: ./api/frontend
      Handler: frontend.lambda_awsgi.management_handler
      Layers:
        - !Ref APICommonLayer
        - !Ref FrontendDependenciesLayer
      Runtime: python3.12
      MemorySize: 512
      Environment:
        Variables:
          SECRET_KEY: !Ref AppSecretKey
          SENTRY_DSN: !Ref AppSentryDSN
          WDIV_API_KEY: !Ref AppWdivApiKey
          DJANGO_SETTINGS_MODULE: !Ref AppDjangoSettingsModule
          APP_IS_BEHIND_CLOUDFRONT: !Ref AppIsBehindCloudFront
          DATABASE_HOST: !Ref AppPostgresHost
          POSTGRES_DATABASE_NAME: !Ref AppPostgresDatabaseName
          DATABASE_PASS: !Ref AppPostgresPassword
          FIREHOSE_ACCOUNT_ARN: !Ref AppLoggingAssumeRoleArn
          DEBUG: !Ref AppDebug

  ApiFrontendFunctionLogGroup:
    Type: AWS::Logs::LogGroup
    DependsOn: [ ApiFrontendFunction ]
    Properties:
      LogGroupName: !Sub /aws/lambda/${ApiFrontendFunction}
      RetentionInDays: !Ref AppLogRetentionDays

Outputs:
  AggregatorApiFrontendFqdn:
    Description: "API Gateway endpoint FQDN for Aggregator API function"
    Value: !Sub "${FrontendAPIGateway}.execute-api.${AWS::Region}.amazonaws.com"
    Export:
      Name: !Join [ ":", [ !Ref "AWS::StackName", "AggregatorApiFrontendFqdn" ] ]

  AggregatorApiFrontendFqdnTempValue:
    Description: "API Gateway endpoint FQDN for Aggregator API function"
    Value: !Sub "${FrontendAPIGateway}.execute-api.${AWS::Region}.amazonaws.com"
    Export:
      Name: !Join [ ":", [ !Ref "AWS::StackName", "AggregatorApiFrontendFqdnTempValue" ] ]

  AggregatorApiFqdn:
    Description: "API Gateway endpoint FQDN for Aggregator API function"
    Value: !Sub "${DCAPI}.execute-api.${AWS::Region}.amazonaws.com"
    Export:
      Name: !Join [ ":", [ !Ref "AWS::StackName", "AggregatorApiFqdn" ] ]