wps-cloudformation-template.yaml

AWSTemplateFormatVersion: 2010-09-09
Description: >-
  A template for AWS-WPS
Parameters:
  geoserver:
    Type: String
    Description: Geoserver from which to source files to aggregate
  dockerImage:
    Type: String
  templatesURL:
    Type: String
  geonetworkCatalogueURL:
    Type: String
  sumoEndpoint:
    Type: String
    Default: ''
  maxVCPUs:
    Type: Number
    Default: 4
  wpsDomainName:
    Type: String
    Default: ''
    Description: The WPS API Gateway endpoint's domain name prefix (excluding the domain)
  administratorEmail:
    Type: String
    Default: ''
    Description: Email address of an administrator - used to send failed job emails for attention of administrators
  bucketName:
    Type: String
    Default: aws-wps-dev
  awsRegionSes:
    Type: String
    Default: us-east-1
    AllowedValues:
      - us-east-1
      - us-west-2
      - eu-west-1
Mappings:
  Constants:
    ConstantMap:
      ContainerWorkingDir: /mnt/work
      CloudfrontHostedZoneId: Z2FDTNDATAQYW2
      S3JobKeyPrefix: jobs/
      requestHandlerApiPath: wps
      jobStatusApiPath: jobStatus
      wpsApiStage: LATEST
      dataDownloadUrlPrefix: "http://data.aodn.org.au/"
  AccountConstants:
    '615645230945':  # non-production
      AllowEphemeralBuckets: true
      CertificateArn: arn:aws:acm:us-east-1:615645230945:certificate/06e50848-29a7-47c3-8a3f-c3212b608a8d
      DomainSuffix: dev.aodn.org.au
      HostedZoneId: Z3JIUIKOQNPOWH
      HostedZoneName: dev.aodn.org.au.
      CustomAmiId: ami-bd06f3df
      TestCustomAmiId: ami-0c7f195015aedf700
      UseVpcGateway: false
    '104044260116':  # production
      AllowEphemeralBuckets: false
      CertificateArn: arn:aws:acm:us-east-1:104044260116:certificate/58773098-aaa7-42b5-bc58-8ba2a938f951
      DomainSuffix: aodn.org.au
      HostedZoneId: ZYU7JVFK6NXWM
      HostedZoneName: aodn.org.au.
      CustomAmiId: ami-bd06f3df
      TestCustomAmiId: ami-0c7f195015aedf700
      UseVpcGateway: true
  '615645230945': # non-production region constants
    ap-southeast-2:
      vpc: vpc-5e0e3a3a
      subnets:
        - subnet-4d471e14
        - subnet-eab65ea3
        - subnet-19956d7e
  '104044260116': # production region constants
    ap-southeast-2:
      vpc: vpc-7302ee16
      subnets:
        - subnet-7976213f
        - subnet-54b3aa20
        - subnet-d722d0b2
  ConfigurationFileMap:
    Filename:
      status: status.xml
      request: request.xml
Conditions:
  CreateEphemeralBucket: !And
    - !Equals [!Ref bucketName, aws-wps-dev]
    - !Equals [true, !FindInMap [AccountConstants, !Ref 'AWS::AccountId', AllowEphemeralBuckets]]
  ConfigureSumoLogic: !Not [!Equals ['', !Ref sumoEndpoint]]
  CreateWpsApiGatewayDomainName: !Not [!Equals ['', !Ref wpsDomainName]]
  UseCustomAmi: !Not [!Equals ['', !FindInMap [AccountConstants, !Ref 'AWS::AccountId', CustomAmiId]]]
  UseTestCustomAmi: !Not [!Equals ['', !FindInMap [AccountConstants, !Ref 'AWS::AccountId', TestCustomAmiId]]]
  UseVpcGateway: !Equals [true, !FindInMap [AccountConstants, !Ref 'AWS::AccountId', UseVpcGateway]]
Resources:

  #
  # S3 bucket
  #

  EphemeralS3Bucket:
    Type: AWS::S3::Bucket
    Condition: CreateEphemeralBucket
    DeletionPolicy: Delete
    Properties:
      LifecycleConfiguration:
        Rules:
          - Id: JobExpirationInDays
            Prefix: !FindInMap [Constants, ConstantMap, S3JobKeyPrefix]
            Status: Enabled
            ExpirationInDays: 7
      Tags:
        - Key: EphemeralBucket
          Value: true
  S3BucketPolicy:
    Type: AWS::S3::BucketPolicy
    Properties:
      Bucket: !If [CreateEphemeralBucket, !Ref EphemeralS3Bucket, !Ref bucketName]
      PolicyDocument:
        Statement:
          -
            Action:
              - s3:GetObject
            Effect: Allow
            Resource: !Sub
              - 'arn:aws:s3:::${BucketName}/${S3Prefix}*'
              - BucketName: !If [CreateEphemeralBucket, !Ref EphemeralS3Bucket, !Ref bucketName]
                S3Prefix: !FindInMap [Constants, ConstantMap, S3JobKeyPrefix]
            Principal: '*'
  EmptyBucketLambdaFunction:
    Type: AWS::Lambda::Function
    Condition: CreateEphemeralBucket
    Properties:
      Code:
        ZipFile: |
          import os
          import boto3
          import cfnresponse

          def handler(event, context):
              try:
                  if event['RequestType'] == 'Delete':
                      s3 = boto3.resource('s3')
                      bucket = s3.Bucket(os.environ['BUCKET'])

                      is_ephemeral = any(
                          l for l in bucket.Tagging().tag_set if l['Key'] == 'EphemeralBucket' and l['Value'] == 'true')
                      if not is_ephemeral:
                          raise ValueError("bucket '{bucket}' is not ephemeral".format(bucket=bucket))

                      bucket.objects.filter(Prefix=os.environ['JOBS_KEY']).delete()
                  cfnresponse.send(event, context, cfnresponse.SUCCESS, {'Data': 'OK'}, 'EmptyBucketLambdaFunction')
              except Exception as e:
                  print("error deleting ephemeral bucket contents: {e}".format(e=e))
                  cfnresponse.send(event, context, cfnresponse.FAILED, {'Data': 'OK'}, 'EmptyBucketLambdaFunction')
      Description: Used to put objects into S3.
      FunctionName: !Sub 'EmptyBucket-${AWS::StackName}'
      Handler: index.handler
      Role: !GetAtt EmptyBucketLambdaFunctionRole.Arn
      Runtime: python2.7
      Timeout: 60
      Environment:
        Variables:
          BUCKET: !Ref EphemeralS3Bucket
          JOBS_KEY: !FindInMap [Constants, ConstantMap, S3JobKeyPrefix]
  EmptyBucket:
    Type: Custom::EmptyBucket
    Condition: CreateEphemeralBucket
    Properties:
      ServiceToken: !GetAtt EmptyBucketLambdaFunction.Arn
  EmptyBucketLambdaFunctionRole:
      Type: AWS::IAM::Role
      Condition: CreateEphemeralBucket
      Properties:
        AssumeRolePolicyDocument:
          Version: 2012-10-17
          Statement:
            - Effect: Allow
              Principal:
                Service:
                  - lambda.amazonaws.com
              Action:
                - sts:AssumeRole
        Path: /
        ManagedPolicyArns:
          - arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole
        Policies:
          - PolicyName: PublishVersion
            PolicyDocument:
              Version: 2012-10-17
              Statement:
                - Effect: Allow
                  Action:
                    - lambda:PublishVersion
                  Resource: '*'
          - PolicyName: S3Access
            PolicyDocument:
              Version: 2012-10-17
              Statement:
                - Effect: Allow
                  Action:
                    - s3:Delete*
                    - s3:List*
                    - s3:Get*
                  Resource:
                    - !Sub 'arn:aws:s3:::${EphemeralS3Bucket}'
                    - !Sub 'arn:aws:s3:::${EphemeralS3Bucket}/*'

  #
  # Batch service
  #

  BatchServiceRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Principal:
              Service: batch.amazonaws.com
            Action: sts:AssumeRole
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/service-role/AWSBatchServiceRole
  SpotIamFleetRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Principal:
              Service: spot.amazonaws.com
            Action: sts:AssumeRole
          - Effect: Allow
            Principal:
              Service: spotfleet.amazonaws.com
            Action: sts:AssumeRole
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/service-role/AmazonEC2SpotFleetTaggingRole
  IamInstanceProfile:
    Type: AWS::IAM::InstanceProfile
    Properties:
      Roles:
        - !Ref EcsInstanceRole
  EcsInstanceRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: 2008-10-17
        Statement:
          - Sid: ''
            Effect: Allow
            Principal:
              Service: ec2.amazonaws.com
            Action: sts:AssumeRole
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/service-role/AmazonEC2ContainerServiceforEC2Role
  JobInstanceRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: 2008-10-17
        Statement:
          - Sid: ''
            Effect: Allow
            Principal:
              Service: ecs-tasks.amazonaws.com
            Action: sts:AssumeRole
      Policies:
        -
          PolicyName: wps-job-s3-access
          PolicyDocument:
            Version: 2012-10-17
            Statement:
              -
                Effect: Allow
                Action:
                  - s3:*
                Resource:
                  - !Sub
                    - 'arn:aws:s3:::${BucketName}'
                    - { BucketName: !If [CreateEphemeralBucket, !Ref EphemeralS3Bucket, !Ref bucketName] }
                  - !Sub
                    - 'arn:aws:s3:::${BucketName}/*'
                    - { BucketName: !If [CreateEphemeralBucket, !Ref EphemeralS3Bucket, !Ref bucketName] }
              -
                Effect: Allow
                Action:
                  - ses:SendEmail
                Resource: '*'
              -
                Effect: Allow
                Action:
                  - ses:SendRawEmail
                Resource: '*'
  JobDefinition:
    Type: AWS::Batch::JobDefinition
    Properties:
      Type: container
      JobDefinitionName: !Sub 'JavaDuckSmall1-${AWS::StackName}'
      ContainerProperties:
        Image: !Ref dockerImage
        Vcpus: 2
        Memory: 4000
        JobRoleArn: !Ref JobInstanceRole
        Volumes:
          -
            Name: work
        Environment:
          -
            Name: JAVA_TOOL_OPTIONS
            Value: -Xmx2g
          -
            Name: OUTPUT_S3_FILENAME
            Value: output
          -
            Name: OUTPUT_S3_BUCKET
            Value: !If [CreateEphemeralBucket, !Ref EphemeralS3Bucket, !Ref bucketName]
          -
            Name: STATUS_S3_FILENAME
            Value: !FindInMap [ConfigurationFileMap, Filename, status]
          -
            Name: REQUEST_S3_FILENAME
            Value: !FindInMap [ConfigurationFileMap, Filename, request]
          -
            Name: AWS_REGION
            Value: !Ref 'AWS::Region'
          -
            Name: AWS_REGION_SES
            Value: !Ref awsRegionSes
          -
            Name: DATA_DOWNLOAD_URL_PREFIX
            Value: !FindInMap [Constants, ConstantMap, dataDownloadUrlPrefix]
          -
            Name: SUMO_ENDPOINT
            Value: !Ref sumoEndpoint
          -
            Name: AGGREGATOR_TEMPLATE_FILE_URL
            Value: !Ref templatesURL
          -
            Name: GEOSERVER_CATALOGUE_ENDPOINT_URL
            Value: !Ref geoserver
          -
            Name: CHUNK_SIZE
            Value: 100000000
          -
            Name: DOWNLOAD_ATTEMPTS
            Value: 4
          -
            Name: WORKING_DIR
            Value: !FindInMap [Constants, ConstantMap, ContainerWorkingDir]
          -
            Name: LOCAL_STORAGE_LIMIT_BYTES
            Value: 104857600
          -
            Name: POOL_SIZE
            Value: 8
          -
            Name: RETRY_INTERVAL_MS
            Value: 60000
          -
            Name: GEONETWORK_CATALOGUE_URL
            Value: !Ref geonetworkCatalogueURL
          -
            Name: ADMINISTRATOR_EMAIL
            Value: !Ref administratorEmail
          -
            Name: GEONETWORK_LAYER_SEARCH_FIELD
            Value: layer
          -
            Name: JOB_S3_KEY
            Value: !FindInMap [Constants, ConstantMap, S3JobKeyPrefix]
          -
            Name: STATUS_SERVICE_ENDPOINT_URL
            Value: !If
              - CreateWpsApiGatewayDomainName
              - !Sub ['https://${WpsRoute53RecordSet}/${requestHandlerApiPath}/${jobStatusApiPath}',{requestHandlerApiPath: !FindInMap [Constants, ConstantMap, requestHandlerApiPath], jobStatusApiPath: !FindInMap [Constants, ConstantMap, jobStatusApiPath]}]
              - !Sub ['https://${WPSRestApi}.execute-api.${AWS::Region}.amazonaws.com/${wpsApiStage}/${requestHandlerApiPath}/${jobStatusApiPath}',{wpsApiStage: !FindInMap [Constants, ConstantMap, wpsApiStage], requestHandlerApiPath: !FindInMap [Constants, ConstantMap, requestHandlerApiPath], jobStatusApiPath: !FindInMap [Constants, ConstantMap, jobStatusApiPath]}]
          -
            Name: AWS_WPS_ENDPOINT_URL
            Value: !If
              - CreateWpsApiGatewayDomainName
              - !Sub ['https://${WpsRoute53RecordSet}/${requestHandlerApiPath}',{requestHandlerApiPath: !FindInMap [Constants, ConstantMap, requestHandlerApiPath]}]
              - !Sub ['https://${WPSRestApi}.execute-api.${AWS::Region}.amazonaws.com/${wpsApiStage}/${requestHandlerApiPath}',{wpsApiStage: !FindInMap [Constants, ConstantMap, wpsApiStage], requestHandlerApiPath: !FindInMap [Constants, ConstantMap, requestHandlerApiPath]}]
        MountPoints:
          -
            SourceVolume: work
            ContainerPath: !FindInMap [Constants, ConstantMap, ContainerWorkingDir]
            ReadOnly: false
      RetryStrategy:
        Attempts: 2
    DependsOn:  JobInstanceRole
  JobQueue:
    Type: AWS::Batch::JobQueue
    Properties:
      JobQueueName: !Sub 'JavaDuckExecuteQueue-${AWS::StackName}'
      Priority: 2
      ComputeEnvironmentOrder:
        - Order: 1
          ComputeEnvironment: !Ref JobComputeEnvironment
  TestQueue:
      Type: AWS::Batch::JobQueue
      Properties:
        JobQueueName: !Sub 'JavaDuckTestQueue-${AWS::StackName}'
        Priority: 2
        ComputeEnvironmentOrder:
          - Order: 1
            ComputeEnvironment: !Ref TestComputeEnvironment
  JobComputeEnvironment:
    Metadata:
      Comment: Please apply any changes made to this ComputeEnvironment to TestComputeEnvironment also!!!!!
    Type: AWS::Batch::ComputeEnvironment
    DeletionPolicy: Delete
    Properties:
      Type: MANAGED
      ComputeResources:
        Type: SPOT
        MinvCpus: 0
        DesiredvCpus: 0
        MaxvCpus: !Ref maxVCPUs
        InstanceTypes:
          - m3.large
          - m4.large
          - r4.large
          - r3.large
        ImageId: !If [UseCustomAmi, !FindInMap [AccountConstants, !Ref 'AWS::AccountId', CustomAmiId], !Ref 'AWS::NoValue']
        Subnets: !FindInMap [!Ref 'AWS::AccountId', !Ref 'AWS::Region', subnets]
        SecurityGroupIds:
          - !Ref ComputeEnvironmentInstanceSecurityGroup
        InstanceRole: !Ref IamInstanceProfile
        SpotIamFleetRole: !Ref SpotIamFleetRole
        BidPercentage: 100
      ServiceRole: !Ref BatchServiceRole
  TestComputeEnvironment:
      Metadata:
        Comment: Please keep in sync with JobComputeEnvironment!!!!!
      Type: AWS::Batch::ComputeEnvironment
      DeletionPolicy: Delete
      Properties:
        Type: MANAGED
        ComputeResources:
          Type: SPOT
          MinvCpus: 0
          DesiredvCpus: 0
          MaxvCpus: !Ref maxVCPUs
          InstanceTypes:
            - c3.large
            - c4.large
            - m3.large
            - m4.large
            - r4.large
            - r3.large
          ImageId: !If [UseTestCustomAmi, !FindInMap [AccountConstants, !Ref 'AWS::AccountId', TestCustomAmiId], !Ref 'AWS::NoValue']
          Subnets: !FindInMap [!Ref 'AWS::AccountId', !Ref 'AWS::Region', subnets]
          SecurityGroupIds:
            - !Ref ComputeEnvironmentInstanceSecurityGroup
          InstanceRole: !Ref IamInstanceProfile
          SpotIamFleetRole: !Ref SpotIamFleetRole
          BidPercentage: 100
        ServiceRole: !Ref BatchServiceRole
  ComputeEnvironmentInstanceSecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: Allow http to client host
      VpcId: !FindInMap [!Ref 'AWS::AccountId', !Ref 'AWS::Region', vpc]
      SecurityGroupIngress:
      - IpProtocol: '-1'
        FromPort: '-1'
        ToPort: '-1'
        CidrIp: 0.0.0.0/0
      SecurityGroupEgress:
      - IpProtocol: '-1'
        FromPort: '-1'
        ToPort: '-1'
        CidrIp: 0.0.0.0/0

  #
  # Request handler service
  #

  WPSRestApi:
    Type: AWS::ApiGateway::RestApi
    Properties:
      Name: !Sub 'WPS API-${AWS::StackName}'
      Description: API used for WPS requests
      FailOnWarnings: true
  WpsApiGatewayStage:
    DependsOn:
      - WPSRestApi
    Type: AWS::ApiGateway::Stage
    Properties:
      DeploymentId: !Ref WpsApiGatewayDeployment
      MethodSettings:
          -
            DataTraceEnabled: true
            HttpMethod: '*'
            LoggingLevel: INFO
            ResourcePath: /*
      RestApiId: !Ref WPSRestApi
      StageName: !FindInMap [Constants, ConstantMap, wpsApiStage]
  WpsApiGatewayDomainName:
    Type: AWS::ApiGateway::DomainName
    Condition: CreateWpsApiGatewayDomainName
    Properties:
      CertificateArn: !FindInMap [AccountConstants, !Ref 'AWS::AccountId', CertificateArn]
      DomainName: !Join ['.', [!Ref wpsDomainName, !FindInMap [AccountConstants, !Ref 'AWS::AccountId', DomainSuffix]]]
  WpsDomainToAPIMapping:
    Type: AWS::ApiGateway::BasePathMapping
    Condition: CreateWpsApiGatewayDomainName
    DependsOn:
      - WpsApiGatewayStage
      - WpsRoute53RecordSet
    Properties:
      DomainName: !Ref WpsApiGatewayDomainName
      RestApiId: !Ref WPSRestApi
      Stage: !FindInMap [Constants, ConstantMap, wpsApiStage]
  WpsRoute53RecordSet:
    Type: AWS::Route53::RecordSet
    Condition: CreateWpsApiGatewayDomainName
    Properties:
      AliasTarget:
        DNSName: !GetAtt WpsApiGatewayDomainName.DistributionDomainName
        HostedZoneId: !FindInMap [Constants, ConstantMap, CloudfrontHostedZoneId]
      HostedZoneName: !FindInMap [AccountConstants, !Ref 'AWS::AccountId', HostedZoneName]
      Name: !Join ['.', [!Ref wpsDomainName, !FindInMap [AccountConstants, !Ref 'AWS::AccountId', DomainSuffix]]]
      Type: 'A'
  WpsApiGatewayDeployment:
    Type: AWS::ApiGateway::Deployment
    DependsOn:
      - RequestHandlerApiGatewayRequest
      - JobStatusApiGatewayRequest
    Properties:
      RestApiId: !Ref WPSRestApi
  RequestHandlerApiGatewayResource:
    Type: AWS::ApiGateway::Resource
    Properties:
      RestApiId: !Ref WPSRestApi
      ParentId: !GetAtt WPSRestApi.RootResourceId
      PathPart: !FindInMap [Constants, ConstantMap, requestHandlerApiPath]
  RequestHandlerApiGatewayRequest:
    DependsOn: RequestHandlerLambdaPermission
    Type: AWS::ApiGateway::Method
    Properties:
      AuthorizationType: NONE
      HttpMethod: ANY
      Integration:
        Type: AWS_PROXY
        IntegrationHttpMethod: POST
        Uri: !Sub
          - 'arn:aws:apigateway:${AWS::Region}:lambda:path/2015-03-31/functions/${FunctionArn}/invocations'
          - { FunctionArn: !GetAtt RequestHandlerLambdaFunction.Arn }
        IntegrationResponses:
          - StatusCode: 200
      ResourceId: !Ref RequestHandlerApiGatewayResource
      RestApiId: !Ref WPSRestApi
      MethodResponses:
        - StatusCode: 200
  RequestHandlerLambdaPermission:
    Type: AWS::Lambda::Permission
    Properties:
      Action: lambda:invokeFunction
      FunctionName: !GetAtt RequestHandlerLambdaFunction.Arn
      Principal: apigateway.amazonaws.com
      SourceArn: !Sub 'arn:aws:execute-api:${AWS::Region}:${AWS::AccountId}:${WPSRestApi}/*'
  RequestHandlerLambdaFunction:
    Type: AWS::Lambda::Function
    Properties:
      Description: Make a wps request
      FunctionName: !Sub 'wps-request-handler-${AWS::StackName}'
      Handler: au.org.aodn.aws.wps.lambda.WpsLambdaRequestHandler
      MemorySize: 1536
      Role: !GetAtt RequestHandlerLambdaExecutionRole.Arn
      Runtime: java8
      Timeout: 60
      Code: lambda/request-handler-lambda-package.zip
      Environment:
        Variables:
          GEONETWORK_CATALOGUE_URL: !Ref geonetworkCatalogueURL
          GEONETWORK_LAYER_SEARCH_FIELD: layer
          AWS_BATCH_JOB_NAME: javaduck
          AWS_BATCH_JOB_QUEUE_NAME: !Ref JobQueue
          AWS_BATCH_TEST_QUEUE_NAME: !Ref TestQueue
          AWS_BATCH_JOB_DEFINITION_NAME: !Select [1, !Split ['/', !Ref JobDefinition]]
          ADMINISTRATOR_EMAIL: !Ref administratorEmail
          OUTPUT_S3_BUCKET: !If [CreateEphemeralBucket, !Ref EphemeralS3Bucket, !Ref bucketName]
          STATUS_S3_FILENAME: !FindInMap [ConfigurationFileMap, Filename, status]
          REQUEST_S3_FILENAME: !FindInMap [ConfigurationFileMap, Filename, request]
          AWS_WPS_ENDPOINT_URL: !If
            - CreateWpsApiGatewayDomainName
            - !Sub ['https://${WpsRoute53RecordSet}/${requestHandlerApiPath}',{requestHandlerApiPath: !FindInMap [Constants, ConstantMap, requestHandlerApiPath]}]
            - !Sub ['https://${WPSRestApi}.execute-api.${AWS::Region}.amazonaws.com/${wpsApiStage}/${requestHandlerApiPath}',{wpsApiStage: !FindInMap [Constants, ConstantMap, wpsApiStage], requestHandlerApiPath: !FindInMap [Constants, ConstantMap, requestHandlerApiPath]}]
          AWS_REGION_SES: !Ref awsRegionSes
          JOB_S3_KEY: !FindInMap [Constants, ConstantMap, S3JobKeyPrefix]
          STATUS_SERVICE_ENDPOINT_URL: !If
            - CreateWpsApiGatewayDomainName
            - !Sub ['https://${WpsRoute53RecordSet}/${requestHandlerApiPath}/${jobStatusApiPath}',{requestHandlerApiPath: !FindInMap [Constants, ConstantMap, requestHandlerApiPath], jobStatusApiPath: !FindInMap [Constants, ConstantMap, jobStatusApiPath]}]
            - !Sub ['https://${WPSRestApi}.execute-api.${AWS::Region}.amazonaws.com/${wpsApiStage}/${requestHandlerApiPath}/${jobStatusApiPath}',{wpsApiStage: !FindInMap [Constants, ConstantMap, wpsApiStage], requestHandlerApiPath: !FindInMap [Constants, ConstantMap, requestHandlerApiPath], jobStatusApiPath: !FindInMap [Constants, ConstantMap, jobStatusApiPath]}]
      VpcConfig: !If
        - UseVpcGateway
        - SecurityGroupIds:
            - !Ref LambdaSecurityGroup
          SubnetIds:
            - !ImportValue "lambda-subnets-subnetA"
            - !ImportValue "lambda-subnets-subnetB"
            - !ImportValue "lambda-subnets-subnetC"
        - !Ref "AWS::NoValue"
  RequestHandlerLambdaExecutionRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - lambda.amazonaws.com
            Action:
              - sts:AssumeRole
      Path: /
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole
        - arn:aws:iam::aws:policy/service-role/AWSLambdaVPCAccessExecutionRole
        - arn:aws:iam::aws:policy/AWSBatchFullAccess
      Policies:
        - PolicyName: PublishVersion
          PolicyDocument:
            Version: 2012-10-17
            Statement:
              - Effect: Allow
                Action:
                  - lambda:PublishVersion
                Resource: '*'
        - PolicyName: S3Access
          PolicyDocument:
            Version: 2012-10-17
            Statement:
              - Effect: Allow
                Action:
                  - s3:*
                Resource:
                  - !Sub
                    - 'arn:aws:s3:::${BucketName}'
                    - { BucketName: !If [CreateEphemeralBucket, !Ref EphemeralS3Bucket, !Ref bucketName] }
                  - !Sub
                    - 'arn:aws:s3:::${BucketName}/*'
                    - { BucketName: !If [CreateEphemeralBucket, !Ref EphemeralS3Bucket, !Ref bucketName] }
              -
                Effect: Allow
                Action:
                  - ses:SendEmail
                Resource: '*'
              -
                Effect: Allow
                Action:
                  - ses:SendRawEmail
                Resource: '*'

  #
  # Job status service
  #

  JobStatusApiGatewayResource:
    Type: AWS::ApiGateway::Resource
    Properties:
      RestApiId: !Ref WPSRestApi
      ParentId: !Ref RequestHandlerApiGatewayResource
      PathPart: !FindInMap [Constants, ConstantMap, jobStatusApiPath]
  JobStatusApiGatewayRequest:
    DependsOn:
      - JobStatusLambdaPermission
      - RequestHandlerApiGatewayRequest
    Type: AWS::ApiGateway::Method
    Properties:
      AuthorizationType: NONE
      HttpMethod: ANY
      Integration:
        Type: AWS_PROXY
        IntegrationHttpMethod: POST
        Uri: !Sub
          - 'arn:aws:apigateway:${AWS::Region}:lambda:path/2015-03-31/functions/${FunctionArn}/invocations'
          - { FunctionArn: !GetAtt JobStatusLambdaFunction.Arn }
        IntegrationResponses:
          - StatusCode: 200
      ResourceId: !Ref JobStatusApiGatewayResource
      RestApiId: !Ref WPSRestApi
      MethodResponses:
        - StatusCode: 200
  JobStatusLambdaPermission:
    Type: AWS::Lambda::Permission
    Properties:
      Action: lambda:invokeFunction
      FunctionName: !GetAtt JobStatusLambdaFunction.Arn
      Principal: apigateway.amazonaws.com
      SourceArn: !Sub 'arn:aws:execute-api:${AWS::Region}:${AWS::AccountId}:${WPSRestApi}/*'
  JobStatusLambdaFunction:
    Type: AWS::Lambda::Function
    Properties:
      Description: Return wps job status
      FunctionName: !Sub 'wps-job-status-${AWS::StackName}'
      Handler: au.org.aodn.aws.wps.lambda.JobStatusServiceRequestHandler
      MemorySize: 1536
      Role: !GetAtt JobStatusLambdaExecutionRole.Arn
      Runtime: java8
      Timeout: 60
      Code: lambda/job-status-service-lambda-package.zip
      Environment:
        Variables:
          OUTPUT_S3_BUCKET: !If [CreateEphemeralBucket, !Ref EphemeralS3Bucket, !Ref bucketName]
          STATUS_S3_FILENAME: !FindInMap [ConfigurationFileMap, Filename, status]
          REQUEST_S3_FILENAME: !FindInMap [ConfigurationFileMap, Filename, request]
          JOB_S3_KEY: !FindInMap [Constants, ConstantMap, S3JobKeyPrefix]
          AWS_BATCH_JOB_QUEUE_NAME: !Ref JobQueue
          AWS_BATCH_LOG_GROUP_NAME: /aws/batch/job
          STATUS_SERVICE_ENDPOINT_URL: !If
            - CreateWpsApiGatewayDomainName
            - !Sub ['https://${WpsRoute53RecordSet}/${requestHandlerApiPath}/${jobStatusApiPath}',{requestHandlerApiPath: !FindInMap [Constants, ConstantMap, requestHandlerApiPath], jobStatusApiPath: !FindInMap [Constants, ConstantMap, jobStatusApiPath]}]
            - !Sub ['https://${WPSRestApi}.execute-api.${AWS::Region}.amazonaws.com/${wpsApiStage}/${requestHandlerApiPath}/${jobStatusApiPath}',{wpsApiStage: !FindInMap [Constants, ConstantMap, wpsApiStage], requestHandlerApiPath: !FindInMap [Constants, ConstantMap, requestHandlerApiPath], jobStatusApiPath: !FindInMap [Constants, ConstantMap, jobStatusApiPath]}]
      VpcConfig: !If
        - UseVpcGateway
        - SecurityGroupIds:
            - !Ref LambdaSecurityGroup
          SubnetIds:
            - !ImportValue "lambda-subnets-subnetA"
            - !ImportValue "lambda-subnets-subnetB"
            - !ImportValue "lambda-subnets-subnetC"
        - !Ref "AWS::NoValue"
  JobStatusLambdaExecutionRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - lambda.amazonaws.com
            Action:
              - sts:AssumeRole
      Path: /
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole
        - arn:aws:iam::aws:policy/service-role/AWSLambdaVPCAccessExecutionRole
        - arn:aws:iam::aws:policy/AWSBatchFullAccess
      Policies:
        - PolicyName: PublishVersion
          PolicyDocument:
            Version: 2012-10-17
            Statement:
              - Effect: Allow
                Action:
                  - lambda:PublishVersion
                Resource: '*'
        - PolicyName: S3Access
          PolicyDocument:
            Version: 2012-10-17
            Statement:
              - Effect: Allow
                Action:
                  - s3:*
                Resource:
                  - !Sub
                    - 'arn:aws:s3:::${BucketName}'
                    - { BucketName: !If [CreateEphemeralBucket, !Ref EphemeralS3Bucket, !Ref bucketName] }
                  - !Sub
                    - 'arn:aws:s3:::${BucketName}/*'
                    - { BucketName: !If [CreateEphemeralBucket, !Ref EphemeralS3Bucket, !Ref bucketName] }

  LambdaSecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Condition: UseVpcGateway
    Properties:
      GroupDescription: Allow http to client host
      VpcId: !ImportValue "lambda-subnets-vpc"
      SecurityGroupIngress:
      - IpProtocol: '-1'
        FromPort: '-1'
        ToPort: '-1'
        CidrIp: 0.0.0.0/0
      SecurityGroupEgress:
      - IpProtocol: '-1'
        FromPort: '-1'
        ToPort: '-1'
        CidrIp: 0.0.0.0/0

  #
  # SumoLogic integration
  #

  SumoLogicLambdaFunction:
    Type: AWS::Lambda::Function
    Condition: ConfigureSumoLogic
    Properties:
      Code: lambda/sumologic
      Description: Push batch logs to SumoLogic
      FunctionName: !Sub 'SumoLogic-WPS-${AWS::StackName}'
      Handler: index.handler
      Role: !GetAtt SumoLogicLambdaFunctionRole.Arn
      Runtime: nodejs10.x
      Timeout: 3
      Environment:
        Variables:
          SUMO_ENDPOINT: !Ref sumoEndpoint
  SumoLogicLambdaFunctionRole:
      Type: AWS::IAM::Role
      Condition: ConfigureSumoLogic
      Properties:
        AssumeRolePolicyDocument:
          Version: 2012-10-17
          Statement:
            - Effect: Allow
              Principal:
                Service:
                  - lambda.amazonaws.com
              Action:
                - sts:AssumeRole
        Path: /
        ManagedPolicyArns:
          - arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole
  RequestHandlerLogsLambdaPermission:
    Type: AWS::Lambda::Permission
    Condition: ConfigureSumoLogic
    Properties:
      Action: lambda:invokeFunction
      FunctionName: !GetAtt SumoLogicLambdaFunction.Arn
      Principal: !Sub 'logs.${AWS::Region}.amazonaws.com'
      SourceArn: !Sub 'arn:aws:logs:${AWS::Region}:${AWS::AccountId}:log-group:${RequestHandlerLogGroup}:*'
  RequestHandlerLambdaLogsSubscriptionFilter:
    Type: AWS::Logs::SubscriptionFilter
    Condition: ConfigureSumoLogic
    DependsOn: RequestHandlerLogsLambdaPermission
    Properties:
      DestinationArn: !GetAtt SumoLogicLambdaFunction.Arn
      FilterPattern: ''
      LogGroupName: !Ref RequestHandlerLogGroup
  JobStatusLogsLambdaPermission:
    Type: AWS::Lambda::Permission
    Condition: ConfigureSumoLogic
    Properties:
      Action: lambda:invokeFunction
      FunctionName: !GetAtt SumoLogicLambdaFunction.Arn
      Principal: !Sub 'logs.${AWS::Region}.amazonaws.com'
      SourceArn: !Sub 'arn:aws:logs:${AWS::Region}:${AWS::AccountId}:log-group:${JobStatusLogGroup}:*'
  JobStatusLambdaLogsSubscriptionFilter:
    Type: AWS::Logs::SubscriptionFilter
    Condition: ConfigureSumoLogic
    DependsOn: JobStatusLogsLambdaPermission
    Properties:
      DestinationArn: !GetAtt SumoLogicLambdaFunction.Arn
      FilterPattern: ''
      LogGroupName: !Ref JobStatusLogGroup
  JobStatusLogGroup:
    Type: AWS::Logs::LogGroup
    Properties:
      LogGroupName: !Sub '/aws/lambda/${JobStatusLambdaFunction}'
  RequestHandlerLogGroup:
    Type: AWS::Logs::LogGroup
    Properties:
      LogGroupName: !Sub '/aws/lambda/${RequestHandlerLambdaFunction}'
Outputs:
  RequestHandlerApiGatewayUrl:
    Value: !If
      - CreateWpsApiGatewayDomainName
      - !Sub ['https://${WpsRoute53RecordSet}/${requestHandlerApiPath}',{requestHandlerApiPath: !FindInMap [Constants, ConstantMap, requestHandlerApiPath]}]
      - !Sub ['https://${WPSRestApi}.execute-api.${AWS::Region}.amazonaws.com/${wpsApiStage}/${requestHandlerApiPath}',{wpsApiStage: !FindInMap [Constants, ConstantMap, wpsApiStage], requestHandlerApiPath: !FindInMap [Constants, ConstantMap, requestHandlerApiPath]}]
  JobStatusApiGatewayUrl:
    Value: !If
      - CreateWpsApiGatewayDomainName
      - !Sub ['https://${WpsRoute53RecordSet}/${requestHandlerApiPath}/${jobStatusApiPath}',{requestHandlerApiPath: !FindInMap [Constants, ConstantMap, requestHandlerApiPath], jobStatusApiPath: !FindInMap [Constants, ConstantMap, jobStatusApiPath]}]
      - !Sub ['https://${WPSRestApi}.execute-api.${AWS::Region}.amazonaws.com/${wpsApiStage}/${requestHandlerApiPath}/${jobStatusApiPath}',{wpsApiStage: !FindInMap [Constants, ConstantMap, wpsApiStage], requestHandlerApiPath: !FindInMap [Constants, ConstantMap, requestHandlerApiPath], jobStatusApiPath: !FindInMap [Constants, ConstantMap, jobStatusApiPath]}]
  JobComputeEnvironmentArn:
    Value: !Ref JobComputeEnvironment
  TestComputeEnvironmentArn:
    Value: !Ref TestComputeEnvironment
  JobQueueArn:
    Value: !Ref JobQueue
  TestQueueArn:
    Value: !Ref TestQueue
  JobDefinitionArn:
    Value: !Ref JobDefinition