assignment3.yaml

AWSTemplateFormatVersion: 2010-09-09
Description: Template for our assignment 3 implementation
Resources:

  PhotosDomain:
    Type: AWS::OpenSearchService::Domain
    Properties:
      DomainName: photos
      EBSOptions:
        EBSEnabled: true
        VolumeSize: 10
        VolumeType: gp2
      ClusterConfig:
        InstanceType: t3.small.search
        InstanceCount: 1
      AccessPolicies:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              AWS: !GetAtt LF1IAMRole.Arn
            Action:
              - es:ESHttpPost
              - es:ESHttpPut
              - es:ESHttpDelete
            Resource: !Sub arn:aws:es:${AWS::Region}:${AWS::AccountId}:domain/photos/*

  B1:
    Type: AWS::S3::Bucket
    Properties:
      BucketName: !Sub front-end-bucket-${AWS::AccountId}-${AWS::Region}
      WebsiteConfiguration:
        IndexDocument: index.html
      # Enable public access
      PublicAccessBlockConfiguration:
        BlockPublicAcls: true
        BlockPublicPolicy: false
        IgnorePublicAcls: true
        RestrictPublicBuckets: false

  # Grants public read access
  B1Policy:
    Type: AWS::S3::BucketPolicy
    Properties:
      Bucket: !Ref B1
      PolicyDocument:
        Statement:
          - Sid: PublicReadGetObject
            Effect: Allow
            Principal: '*'
            Action: s3:GetObject
            Resource: !Join
              - ''
              - - 'arn:aws:s3:::'
                - !Ref B1
                - /*
          #Enables P2 to write front end to the bucket
          - Sid: CodePipelineWriteAccess
            Effect: Allow
            Principal:
              AWS: "arn:aws:iam::346225466066:role/service-role/AWSCodePipelineServiceRole-us-east-1-P2"
            Action:
              - s3:PutObject
              - s3:GetObject
              - s3:ListBucket
            Resource:
              - !Join [ "", [ "arn:aws:s3:::", !Ref B1 ] ]
              - !Join [ "", [ "arn:aws:s3:::", !Ref B1, "/*" ] ]

  B2:
    Type: AWS::S3::Bucket
    DeletionPolicy: Retain
    #B2Permission needs to be created first so that B2 has correct permissions for
    #lambda configurations.
    DependsOn: B2Permission
    Properties:
      BucketName: !Sub photosbucket-${AWS::AccountId}-${AWS::Region}
      NotificationConfiguration:
        #Allows S3 to use put method on LF1
        LambdaConfigurations:
          - Event: s3:ObjectCreated:Put
            Filter:
              S3Key:
                Rules:
                  - Name: suffix
                    Value: .jpg
            Function: !GetAtt LF1.Arn

  B2Permission:
    #Gives B2 permision to invoke LF1
    Type: AWS::Lambda::Permission
    Properties:
      Action: lambda:InvokeFunction
      FunctionName: !Ref LF1
      Principal: s3.amazonaws.com
      SourceArn: !Sub arn:aws:s3:::photosbucket-${AWS::AccountId}-${AWS::Region}

  LF1:
    Type: AWS::Lambda::Function
    DependsOn: LF1IAMRole
    Properties:
      #IAM Role that LF1 must assume.
      Role: !GetAtt LF1IAMRole.Arn
      Runtime: python3.12
      FunctionName: index-photos
      #Source code for lambda function
      Code:
        ZipFile: |
          def main(event, context):
            return "Hello World!"
      Handler: index.main
      Timeout: 15

  LF1IAMRole:
    Type: AWS::IAM::Role
    Properties:
      #Allows a lambda instance to assume this role
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              Service: lambda.amazonaws.com
            Action: sts:AssumeRole
      #Allows a lambda to write logs to cloudwatch
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole
      #Provides the necessary permissions to lambda
      Policies:
        - PolicyName: LF1Permissions
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Effect: Allow
                Action:
                  - s3:GetObject
                  - s3:ListBucket
                  - s3:HeadObject
                #The /* gives the lambda object leve interactions. Without it,
                #it can only perform bucket level actions like deleting the bucket.
                #Hardcoding the arn for B2 is considered bad practice. It is done
                #here to break the dependency loop B2->LF1->LF1IAMRole->B2
                Resource:
                  - !Sub arn:aws:s3:::photosbucket-${AWS::AccountId}-${AWS::Region}
                  - !Sub arn:aws:s3:::photosbucket-${AWS::AccountId}-${AWS::Region}/*
              - Effect: Allow
                Action: rekognition:DetectLabels
                #Wild card is used instead of ARN, because Rekognition
                #is an API based service, so there is no specific ARN
                #that it needs access to.
                Resource: '*'
              - Effect: Allow
                Action:
                  - es:ESHttpPost
                  - es:ESHttpPut
                  - es:ESHttpDelete
                Resource: !Sub arn:aws:es:${AWS::Region}:${AWS::AccountId}:domain/photos/*

  LF2IAMRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              Service: lambda.amazonaws.com
            Action: sts:AssumeRole
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole
      Policies:
        - PolicyName: LF2Permissions
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              # add es:ESHttpGet / ESHttpPost etc here when you wire OpenSearch
              - Effect: Allow
                Action:
                  - es:ESHttpGet
                  - es:ESHttpPost
                Resource: '*'

  ApiGatewayS3Role:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              Service: apigateway.amazonaws.com
            Action: sts:AssumeRole
      Policies:
        - PolicyName: ApiGatewayS3WritePhotos
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Effect: Allow
                Action:
                  - s3:PutObject
                  - s3:PutObjectAcl
                Resource: !Sub arn:aws:s3:::photosbucket-${AWS::AccountId}-${AWS::Region}/*

  BotRuntimeRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - lexv2.amazonaws.com
            Action:
              - sts:AssumeRole
      Path: /
      Policies:
        - PolicyName: LexRuntimeRolePolicy
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Effect: Allow
                Action:
                  - polly:SynthesizeSpeech
                  - comprehend:DetectSentiment
                Resource: '*'
  # 2. Inline bot definition which depends on the IAM role
  # The bot definition consists of combining all the child resources into one CFN resource.
  # This includes Locales, Intents, Slots, and SlotTypes.

  PhotoSearchBot:
    DependsOn: BotRuntimeRole
    Type: AWS::Lex::Bot
    Properties:
      Name: PhotoSearcher
      RoleArn: !GetAtt BotRuntimeRole.Arn
      DataPrivacy:
        ChildDirected: false
      IdleSessionTTLInSeconds: 300
      Description: Takes user input to get keywords to search with
      # Provide a setting that allows you to either auto build the locales provided.
      # Locale builds are also kicked off if you attempt to create a bot version
      # that depends on an unbuilt locale.
      AutoBuildBotLocales: false
      BotLocales:
        - LocaleId: en_US
          Description: Find a photo based on description
          NluConfidenceThreshold: 0.4
          VoiceSettings:
            VoiceId: Ivy
          SlotTypes:
            - Name: PhotoTypeValues
              Description: Slot Type description
              SlotTypeValues:
                - SampleValue:
                    Value: person
                - SampleValue:
                    Value: dog
                - SampleValue:
                    Value: park
                - SampleValue:
                    Value: bird
                - SampleValue:
                    Value: tree
              ValueSelectionSetting:
                ResolutionStrategy: ORIGINAL_VALUE
          Intents:
            - Name: SearchIntent
              Description: Intent to search for a photo
              SampleUtterances:
                - Utterance: Show me photos
                - Utterance: Give me the photos
                - Utterance: I want to search my photos
              SlotPriorities:
                - Priority: 1
                  SlotName: PhotoType
              IntentConfirmationSetting:
                PromptSpecification:
                  MessageGroupsList:
                    - Message:
                        PlainTextMessage:
                          Value: Okay, I am going to search for {PhotoType}, can you confirm?
                  MaxRetries: 3
                  AllowInterrupt: false
                DeclinationResponse:
                  MessageGroupsList:
                    - Message:
                        PlainTextMessage:
                          Value: Okay, I have cancelled your search request.
                  AllowInterrupt: false
              Slots:
                - Name: PhotoType
                  Description: something
                  SlotTypeName: PhotoTypeValues
                  ValueElicitationSetting:
                    SlotConstraint: Required
                    PromptSpecification:
                      MessageGroupsList:
                        - Message:
                            PlainTextMessage:
                              Value: What do you want to look for?
                      MaxRetries: 3
                      AllowInterrupt: false
            # We expect developers to provide the FallbackIntent when generating their bot.
            # The service will throw an exception if it isn't provided.
            - Name: FallbackIntent
              Description: Default intent when no other intent matches
              ParentIntentSignature: AMAZON.FallbackIntent

  PhotoSearchBotVersionWithCFN:
    DependsOn: PhotoSearchBot
    Type: AWS::Lex::BotVersion
    Properties:
      BotId: !Ref PhotoSearchBot
      BotVersionLocaleSpecification:
        - LocaleId: en_US
          BotVersionLocaleDetails:
            SourceBotVersion: DRAFT
      Description: BookTrip Version

  # 4. We define the alias by providing the bot version created by the AWS::Lex::BotVersion resource above
  FirstBotAliasWithCFN:
    DependsOn: PhotoSearchBotVersionWithCFN
    Type: AWS::Lex::BotAlias
    Properties:
      BotId: !Ref PhotoSearchBot
      BotAliasName: PhotoSearchBotVersion1
      # Remove BotAliasLocaleSettings if you aren't concerned with Lambda setup.
      # If you are you can modify the LambdaArn below to get started.
      # BotAliasLocaleSettings:
      #   - LocaleId: en_US
      #     BotAliasLocaleSetting:
      #       Enabled: false
      #       CodeHookSpecification:
      #         LambdaCodeHook:
      #           CodeHookInterfaceVersion: "1.0"
      #           LambdaArn: "arn:aws:lambda:us-east-1:111111111111:function:ReplaceWithYourOwnLambda"
      BotVersion: !GetAtt PhotoSearchBotVersionWithCFN.BotVersion
      SentimentAnalysisSettings:
        DetectSentiment: true

  LF2:
    DependsOn: PhotoSearchBot
    Type: AWS::Lambda::Function
    Properties:
      Role: !GetAtt LF2IAMRole.Arn
      Runtime: python3.12
      FunctionName: search-photos
      # Source code for lambda function
      Environment:
        Variables:
          LEX_BOT_ID: !Ref PhotoSearchBot
          LEX_ALIAS_ID: !Ref FirstBotAliasWithCFN
          LEX_LOCALE_ID: en_US
          OS_ENDPOINT: !GetAtt PhotosDomain.DomainEndpoint
          OS_INDEX: "photos"
      Code:
        ZipFile: |
          def main(event, context):
            return "Hello World!"
      Handler: index.main
      Timeout: 15

  PhotoGateway:
    Type: AWS::ApiGateway::RestApi
    Properties:
      Name: A3APIGateway

  # /photos resource
  PhotosResource:
    Type: AWS::ApiGateway::Resource
    Properties:
      RestApiId: !Ref PhotoGateway
      ParentId: !GetAtt PhotoGateway.RootResourceId
      PathPart: photos

  PhotosObjectResource:
    Type: AWS::ApiGateway::Resource
    Properties:
      RestApiId: !Ref PhotoGateway
      ParentId: !Ref PhotosResource
      PathPart: '{object}'

  # /search resource
  SearchResource:
    Type: AWS::ApiGateway::Resource
    Properties:
      RestApiId: !Ref PhotoGateway
      ParentId: !GetAtt PhotoGateway.RootResourceId
      PathPart: search

  # PUT /photos (S3 proxy)
  PutPhotosMethod:
    Type: AWS::ApiGateway::Method
    DependsOn:
      - B2
    Properties:
      RestApiId: !Ref PhotoGateway
      ResourceId: !Ref PhotosObjectResource
      HttpMethod: PUT
      AuthorizationType: NONE
      ApiKeyRequired: false
      RequestParameters:
        method.request.header.x-amz-meta-customLabels: false
        method.request.path.object: true            # if using /photos/{object}
      Integration:
        Type: AWS
        IntegrationHttpMethod: PUT
        Uri: !Sub arn:aws:apigateway:${AWS::Region}:s3:path/${B2}/{object}
        Credentials: !GetAtt ApiGatewayS3Role.Arn
        RequestParameters:
          integration.request.header.x-amz-meta-customLabels: method.request.header.x-amz-meta-customLabels
          integration.request.path.object: method.request.path.object
        PassthroughBehavior: WHEN_NO_MATCH
        IntegrationResponses:
          - StatusCode: 200
            ResponseParameters:
              method.response.header.Access-Control-Allow-Origin: "'*'"
              method.response.header.Access-Control-Allow-Methods: "'OPTIONS,PUT'"
              method.response.header.Access-Control-Allow-Headers: "'Content-Type,X-Amz-Date,Authorization,X-Api-Key,X-Amz-Security-Token,x-amz-meta-customLabels'"
            ResponseTemplates:
              application/json: ""
      MethodResponses:
        - StatusCode: 200
          ResponseParameters:
            method.response.header.Access-Control-Allow-Origin: true
            method.response.header.Access-Control-Allow-Methods: true
            method.response.header.Access-Control-Allow-Headers: true
  
  PhotosObjectOptionsMethod:
      Type: AWS::ApiGateway::Method
      Properties:
        RestApiId: !Ref PhotoGateway
        ResourceId: !Ref PhotosObjectResource
        HttpMethod: OPTIONS
        AuthorizationType: NONE
        Integration:
          Type: MOCK
          RequestTemplates:
            application/json: '{"statusCode": 200}'
          IntegrationResponses:
            - StatusCode: 200
              ResponseParameters:
                method.response.header.Access-Control-Allow-Origin: "'*'"
                method.response.header.Access-Control-Allow-Methods: "'OPTIONS,PUT'"
                method.response.header.Access-Control-Allow-Headers: "'Content-Type,X-Amz-Date,Authorization,X-Api-Key,X-Amz-Security-Token,x-amz-meta-customLabels'"
              ResponseTemplates:
                application/json: ""
        MethodResponses:
          - StatusCode: 200
            ResponseParameters:
              method.response.header.Access-Control-Allow-Origin: true
              method.response.header.Access-Control-Allow-Methods: true
              method.response.header.Access-Control-Allow-Headers: true

  SearchOptionsMethod:
    Type: AWS::ApiGateway::Method
    Properties:
      RestApiId: !Ref PhotoGateway
      ResourceId: !Ref SearchResource
      HttpMethod: OPTIONS
      AuthorizationType: NONE
      Integration:
        Type: MOCK
        RequestTemplates:
          application/json: '{"statusCode": 200}'
        IntegrationResponses:
          - StatusCode: 200
            ResponseParameters:
              method.response.header.Access-Control-Allow-Origin: "'*'"
              method.response.header.Access-Control-Allow-Methods: "'GET,OPTIONS'"
              method.response.header.Access-Control-Allow-Headers: "'Content-Type,X-Amz-Date,Authorization,X-Api-Key,X-Amz-Security-Token'"
            ResponseTemplates:
              application/json: ""
      MethodResponses:
        - StatusCode: 200
          ResponseParameters:
            method.response.header.Access-Control-Allow-Origin: true
            method.response.header.Access-Control-Allow-Methods: true
            method.response.header.Access-Control-Allow-Headers: true

  # GET /search?q=...
  GetSearchMethod:
    Type: AWS::ApiGateway::Method
    DependsOn:
      - LF2
    Properties:
      RestApiId: !Ref PhotoGateway
      ResourceId: !Ref SearchResource
      HttpMethod: GET
      AuthorizationType: NONE
      ApiKeyRequired: false
      RequestParameters:
        method.request.querystring.q: false
      Integration:
        Type: AWS_PROXY
        IntegrationHttpMethod: POST
        Uri: !Sub arn:aws:apigateway:${AWS::Region}:lambda:path/2015-03-31/functions/${LF2.Arn}/invocations

  # Allow API Gateway to invoke the search lambda
  SearchPhotosLambdaPermissionForApiGateway:
    Type: AWS::Lambda::Permission
    Properties:
      Action: lambda:InvokeFunction
      FunctionName: !Ref LF2
      Principal: apigateway.amazonaws.com
      SourceArn: !Sub arn:aws:execute-api:${AWS::Region}:${AWS::AccountId}:${PhotoGateway}/*/GET/search

  # Deployment (depends on methods, but methods do NOT depend on deployment)
  ApiDeployment:
    Type: AWS::ApiGateway::Deployment
    DependsOn:
      - PutPhotosMethod
      - PhotosObjectOptionsMethod
      - GetSearchMethod
      - SearchOptionsMethod
    Properties:
      RestApiId: !Ref PhotoGateway
      StageName: Stage1


Outputs:
  WebsiteURL:
    Description: The URL of the front end.
    Value: !GetAtt B1.WebsiteURL

  S3BucketName:
    Description: The name of the front end bucket.
    Value: !Ref B1