CMR-notifier/cloudformation.yml at develop · ASFHyP3/CMR-notifier · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
AWSTemplateFormatVersion: 2010-09-09

Parameters:
  EcrImageUri:
    Description: ECR image URI
    Type: String

  CmrDomainName:
    Description: CMR search API domain name
    Type: String
    AllowedValues:
      - cmr.earthdata.nasa.gov
      - cmr.uat.earthdata.nasa.gov

  CmrProvider:
    Description: CMR provider to use when searching for new granules
    Type: String

  TopicName:
    Description: 'Name for the SNS Topic name'
    Type: String

Resources:

  Topic:
    Type: AWS::SNS::Topic
    Properties:
      # Note: The only other parameter that requires replacement on update is FifoTopic, so this shan't be troublesome.
      #       See: https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-sns-topic.html
      TopicName: !Sub '${TopicName}'

  TopicPolicy:
    Type: AWS::SNS::TopicPolicy
    Properties:
      Topics:
        - !Ref Topic
      PolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Action: sns:Subscribe
            Resource: !Ref Topic
            Principal:
              AWS: "*"
            Condition:
              StringEquals:
                SNS:Protocol:
                  - sqs
                  - lambda

  LogGroup:
    Type: AWS::Logs::LogGroup
    Properties:
      LogGroupName: !Sub "/aws/lambda/${Lambda}"
      RetentionInDays: 90

  Role:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          Action: sts:AssumeRole
          Principal:
            Service: lambda.amazonaws.com
          Effect: Allow
      Policies:
        - PolicyName: policy
          PolicyDocument:
            Version: 2012-10-17
            Statement:
              - Effect: Allow
                Action:
                  - logs:CreateLogStream
                  - logs:PutLogEvents
                Resource: !Sub "arn:aws:logs:${AWS::Region}:${AWS::AccountId}:log-group:/aws/lambda/*"
              - Effect: Allow
                Action: sns:Publish
                Resource: !Ref Topic
              - Effect: Allow
                Action:
                  - dynamodb:GetItem
                  - dynamodb:PutItem
                Resource: !GetAtt Table.Arn
              - Effect: Allow
                Action:
                  - ecr:BatchGetImage
                  - ecr:BatchCheckLayerAvailability
                  - ecr:GetAuthorizationToken
                  - ecr:GetDownloadUrlForLayer
                Resource: !Sub "arn:aws:ecr:${AWS::Region}:${AWS::AccountId}:repository/*"

  Lambda:
    Type: AWS::Lambda::Function
    Properties:
      PackageType: Image
      ImageConfig:
        Command:
          - cmr_notifier.main.lambda_handler
      Code:
        ImageUri: !Ref EcrImageUri
      Environment:
        Variables:
          TOPIC_ARN: !Ref Topic
          TABLE_NAME: !Ref Table
          CMR_DOMAIN_NAME: !Ref CmrDomainName
          CMR_PROVIDER: !Ref CmrProvider
      MemorySize: 128
      Role: !GetAtt Role.Arn
      Timeout: 900

  EventInvokeConfig:
    Type: AWS::Lambda::EventInvokeConfig
    Properties:
      FunctionName: !Ref Lambda
      Qualifier: $LATEST
      MaximumRetryAttempts: 0

  Schedule:
    Type: AWS::Events::Rule
    Properties:
      ScheduleExpression: "rate(1 minute)"
      Targets:
        - Arn: !GetAtt Lambda.Arn
          Id: schedule
          Input: '{"window_in_seconds": 120}'

  EventPermission:
    Type: AWS::Lambda::Permission
    Properties:
      FunctionName: !GetAtt Lambda.Arn
      Action: lambda:InvokeFunction
      Principal: events.amazonaws.com
      SourceArn: !GetAtt Schedule.Arn


  Table:
    Type: AWS::DynamoDB::Table
    Properties:
      BillingMode: PROVISIONED
      ProvisionedThroughput:
        ReadCapacityUnits: 50
        WriteCapacityUnits: 10
      AttributeDefinitions:
        - AttributeName: granule_ur
          AttributeType: S
      KeySchema:
        - AttributeName: granule_ur
          KeyType: HASH

Outputs:

  TopicArn:
    Description: ARN of the SNS Topic
    Value: !Ref Topic