template.yml

AWSTemplateFormatVersion: "2010-09-09"
Transform: AWS::Serverless-2016-10-31
Description: "SAM Cloud Formation Template"

Parameters:
  AppId:
    Type: Number
    Default: 9988
  VpcId:
    Type: "AWS::EC2::VPC::Id"
    # Type: String
    Description: VPC to provision the application
  StageName:
    Type: String
    Description: Stage Name
    Default: dev
  DataClassification:
    Type: String
    Default: CompanyConfidential
    Description: Data classification
  EnvironmentType:
    Type: String
    Description: Environment type
    Default: PROD
  LineOfBusiness:
    Type: String
    Description: Line of business for the respective scoring app
    Default: "MLOpsCore"
    AllowedValues:
      - "MLOpsCore"  #MLops Core
      - "Claims"  #Claims
      - "SC"  #Small Commercial
      - "MLC"  #MLC
      - "GS"  #Global Specialty
      - "GB"  #Group Benefits
      - "DSE"  #Data Science Enablement


Mappings:
  APIGatewayVPCEndpoint:
    discover:
      value: "vpce-dummy-discovery123"
    preprod:
      value: "vpce-dummy-preprod123"
    prod:
      value: "vpce-dummy-prod123"


Globals:
  # More info about Globals: https://github.com/awslabs/serverless-application-model/blob/master/docs/globals.rst
  Function:
    Runtime: python3.8
    VpcConfig:
      SecurityGroupIds:
        - !Sub "{{resolve:ssm:/HIG/${VpcId}/SG-Default:1}}"
      SubnetIds:
        "Fn::Transform":
          Name: GetStringList
          Parameters:
            ParameterName: app/SubnetIds
    Tags:
      "hig-planit-appid": !Sub "APP-${AppId}"
      "hig-billing": !Sub "APP-${AppId}"
      "stack-id": !Select [2, !Split ["/", !Ref "AWS::StackId"]]
      "MAINTAINER": "MLOpsSupport@thehartford.com"
    Timeout: 30
    MemorySize: 512
    Environment:
      # More info about Env Vars: https://github.com/awslabs/serverless-application-model/blob/master/versions/2016-10-31.md#environment-object
      Variables:
        STAGE_NAME: !Sub ${StageName}
        API_GATEWAY_DIRECT: !FindInMap [APIGatewayVPCEndpoint, !Ref StageName, value]

Resources:
  ################################################################
  ####           Serverless Function Definition                ###
  ################################################################
  interfaceLambdaFunctionv1:
    Type: AWS::Serverless::Function
    # More info about Function Resource: https://github.com/awslabs/serverless-application-model/blob/master/versions/2016-10-31.md#awsserverlessfunction
    Properties:
      FunctionName: !Join
        - "-"
        - - "APP"
          - !Ref AppId
          - "MLOps"
          - !Ref LineOfBusiness
          - "interfaceLambdaFunctionv1"
          - !Select [
              0,
              !Split ["-", !Select [2, !Split ["/", !Ref "AWS::StackId"]]],
            ]
      Description: "Lambda function to interact with backend resources"
      CodeUri: ./api_v1/
      Handler: server.lambda_handler
      Policies:
        - Statement:
            Effect: Allow
            Action:
              - "apigateway:GET"
            Resource:
              - "*"
      Events:
        ApiEvent1:
          Type: Api
          Properties:
            Path: /{proxy+}
            Method: any
            RestApiId: !Ref interfaceProxyApi
      Tags:
        "hig-planit-appid": !Sub "APP-${AppId}"
        "hig-billing": !Sub "APP-${AppId}"
        "hig-data-classification": "CompanyConfidential"
        "hig-environment-type": "PROD"
        "hig-lob": !Ref LineOfBusiness
        "mlops-ds-environment-type": !Ref StageName
        "MAINTAINER": "MLOpsSupport@thehartford.com"
  # DO NOT DELETE: For Future Reference
  # interfaceLambdaFunctionv2:
  #   Type: AWS::Serverless::Function
  #   # More info about Function Resource: https://github.com/awslabs/serverless-application-model/blob/master/versions/2016-10-31.md#awsserverlessfunction
  #   Properties:
  #     FunctionName: !Join
  #       - "-"
  #       - - "APP"
  #         - !Ref AppId
  #         - "interfaceLambdaFunctionv2"
  #         - !Select [0, !Split ["-", !Select [2, !Split ["/", !Ref "AWS::StackId"]]]]
  #     Description: "Lambda function to perform invocations"
  #     CodeUri: ./api_v2/
  #     Handler: server.lambda_handler
  #     Policies:
  #       - Statement:
  #           Effect: Allow
  #           Action:
  #             - 'apigateway:GET'
  #           Resource:
  #             - "*"
  #       - Statement:
  #           Effect: Allow
  #           Action:
  #             - 'sagemaker:InvokeEndpoint'
  #           Resource: '*'
  #     Events:
  #       ApiEvent:
  #         Type: Api
  #         Properties:
  #           Path: /v2/{proxy+}
  #           Method: any
  #           RestApiId: !Ref interfaceProxyApi
  #     Tags:
  #       'hig-planit-appid': !Sub 'APP-${AppId}'
  #       'hig-billing': !Sub 'APP-${AppId}'
  #       'hig-data-classification': !Sub ${DataClassification}
  #       'hig-environment-type': !Sub ${ EnvironmentType}
  #
  ################################################################
  ####                 API Definition                          ###
  ################################################################
  interfaceProxyApi:
    Type: "AWS::Serverless::Api"
    Properties:
      DefinitionBody:
        openapi: "3.0.1"
        info:
          title: !Join
            - "-"
            - - "APP"
              - !Sub "${AppId}"
              - "MLOps"
              - !Ref LineOfBusiness
              - "interfaceProxyApi"
              - !Select [
                  0,
                  !Split ["-", !Select [2, !Split ["/", !Ref "AWS::StackId"]]],
                ]
        servers:
          - url: "/{basePath}"
            variables:
              basePath:
                default: !Sub "/${StageName}"
            "x-amazon-apigateway-endpoint-configuration":
              vpcEndpointIds:
                - !FindInMap
                    - APIGatewayVPCEndpoint
                    - !Ref StageName
                    - value
        paths:
          "/{proxy+}":
            "x-amazon-apigateway-any-method":
              parameters:
                - name: proxy
                  in: path
                  required: true
                  schema:
                    type: string
              "x-amazon-apigateway-integration":
                uri: !Sub "arn:${AWS::Partition}:apigateway:${AWS::Region}:lambda:path/2015-03-31/functions/${interfaceLambdaFunctionv1.Arn}/invocations"
                responses:
                  default:
                    statusCode: "200"
                passthroughBehavior: when_no_match
                timeoutInMillis: 5000
                httpMethod: POST
                type: aws_proxy
          "/v1/people/{proxy+}":
            "x-amazon-apigateway-any-method":
              parameters:
                - name: proxy
                  in: path
                  required: true
                  schema:
                    type: string
              security:
                - ApiKey: []
              "x-amazon-apigateway-integration":
                uri: !Sub "arn:${AWS::Partition}:apigateway:${AWS::Region}:lambda:path/2015-03-31/functions/${interfaceLambdaFunctionv1.Arn}/invocations"
                responses:
                  default:
                    statusCode: "200"
                passthroughBehavior: when_no_match
                timeoutInMillis: 5000
                httpMethod: POST
                type: aws_proxy
          # DO NOT DELETE: For Future Reference
          # "/v2/{proxy+}":
          #   "x-amazon-apigateway-any-method":
          #     parameters:
          #       - name: proxy
          #         in: path
          #         required: true
          #         schema:
          #           type: string
          #     "x-amazon-apigateway-integration":
          #       uri: !Sub "arn:${AWS::Partition}:apigateway:${AWS::Region}:lambda:path/2015-03-31/functions/${interfaceLambdaFunctionv2.Arn}/invocations"
          #       responses:
          #         default:
          #           statusCode: "200"
          #       passthroughBehavior: when_no_match
          #       timeoutInMillis: 5000
          #       httpMethod: POST
          #       type: aws_proxy
        "x-amazon-apigateway-policy":
          Version: "2012-10-17"
          Statement:
            - Effect: Allow
              Principal: "*"
              Action: "execute-api:Invoke"
              Resource: "execute-api:/*"
        #             - Effect: Deny
        #               Principal: "*"
        #               Action: "execute-api:Invoke"
        #               Resource: "execute-api:/*"
        #               Condition:
        #                 StringNotEquals:
        #                   "aws:sourceVpce": !Ref APIGatewayVPCEndpoint
        "x-amazon-apigateway-minimum-compression-size": 860
        "x-amazon-apigateway-binary-media-types":
          - "*/*"
        securityDefinitions:
          ApiKey:
            type: apiKey
            name: x-api-key
            in: header
      EndpointConfiguration: PRIVATE
      MethodSettings:
        - HttpMethod: "*"
          ResourcePath: "/*"
          LoggingLevel: ERROR
          MetricsEnabled: true
      AccessLogSetting:
        DestinationArn: !GetAtt interfaceProxyApiAccessLogGroup.Arn
        Format: '{"requestId":"$context.requestId", "ip": "$context.identity.sourceIp", "caller":"$context.identity.caller", "user":"$context.identity.user","requestTime":"$context.requestTime", "httpMethod":"$context.httpMethod","resourcePath":"$context.resourcePath", "status":"$context.status","protocol":"$context.protocol", "responseLength":"$context.responseLength"}'
      MinimumCompressionSize: 860
      Auth:
        ApiKeyRequired: false
      TracingEnabled: true
      StageName: !Ref StageName
      Tags:
        "hig-planit-appid": !Sub "APP-${AppId}"
        "hig-billing": !Sub "APP-${AppId}"
        "hig-data-classification": "CompanyConfidential"
        "hig-environment-type": "PROD"
        "hig-lob": !Ref LineOfBusiness
        "mlops-ds-environment-type": !Ref StageName
        "MAINTAINER": "MLOpsSupport@thehartford.com"
  interfaceProxyApiAccessLogGroup:
    Type: AWS::Logs::LogGroup
    Properties:
      LogGroupName: !Join
        - "/"
        - - "/aws/apigateway/accesslogs"
          - !Ref interfaceProxyApi
#       RetentionInDays: 3 # Retain Access Logs Indefinetly
  ################################################################
  ####                 API KEYS                                ###
  ################################################################
  interfaceProxyApiKey1:
    Type: AWS::ApiGateway::ApiKey
    DependsOn:
      - interfaceProxyApiStage
    Properties:
      Name:
        !Sub  APP-${AppId}-MLOps-${StageName}-${LineOfBusiness}-MaaS-interface-Api-Key
      Description: CloudFormation API Key V1
      Enabled: true
      StageKeys:
      - RestApiId: !Ref interfaceProxyApi
        StageName: !Ref StageName
      Tags:
        - Key: hig-billing
          Value: !Sub 'APP-${AppId}'
        - Key: hig-planit-appid
          Value: !Sub 'APP-${AppId}'
        - Key: "hig-environment-type"
          Value: "PROD"
        - Key: "hig-data-classification"
          Value: "CompanyConfidential"
        - Key: "mlops-ds-environment-type"
          Value: !Ref StageName
        - Key: "stage-name"
          Value: !Ref StageName
        - Key: "hig-lob"
          Value: !Ref LineOfBusiness
        - Key: stack-id
          Value: !Select [2, !Split ["/", !Ref "AWS::StackId"]]
  interfaceProxyApiUsagePlan1:
    Type: AWS::ApiGateway::UsagePlan
    DependsOn:
      - interfaceProxyApiKey1
    Properties:
      ApiStages:
      - ApiId: !Ref interfaceProxyApi
        Stage: !Ref StageName
      Description: interfaceProxyApi usage plan
      UsagePlanName:
        !Sub  APP-${AppId}-MLOps-${StageName}-${LineOfBusiness}-MaaS-interface-Api-Key-UsagePlan
      Quota:
        Limit: 50000
        Period: DAY
      Throttle:
        BurstLimit: 200
        RateLimit: 100
      Tags:
        - Key: hig-billing
          Value: !Sub 'APP-${AppId}'
        - Key: hig-planit-appid
          Value: !Sub 'APP-${AppId}'
        - Key: "hig-environment-type"
          Value: "PROD"
        - Key: "hig-data-classification"
          Value: "CompanyConfidential"
        - Key: "mlops-ds-environment-type"
          Value: !Ref StageName
        - Key: "stage-name"
          Value: !Ref StageName
        - Key: "hig-lob"
          Value: !Ref LineOfBusiness
        - Key: stack-id
          Value: !Select [2, !Split ["/", !Ref "AWS::StackId"]]
  interfaceProxyApiUsagePlanKey1:
    Type: AWS::ApiGateway::UsagePlanKey
    Properties:
      KeyId: !Ref interfaceProxyApiKey1
      KeyType: API_KEY
      UsagePlanId: !Ref interfaceProxyApiUsagePlan1


Outputs:
  # ServerlessRestApi is an implicit API created out of Events key under Serverless::Function
  # Find out more about other implicit resources you can reference within SAM
  # https://github.com/awslabs/serverless-application-model/blob/master/docs/internals/generated_resources.rst#api
  interfaceProxyApi:
    Description: "API Gateway endpoint URL"
    Value: !Sub
      - "https://${interfaceProxyApi}-${APIGatewayVPCEndpoint}.execute-api.${AWS::Region}.amazonaws.com/${StageName}/home"
      - APIGatewayVPCEndpoint:
          Fn::FindInMap: [ "APIGatewayVPCEndpoint", !Ref StageName, "value"]
  interfaceLambdaFunctionv1LambdaIntegration:
    Description: "Lambda integration URL"
    Value: !Sub "arn:${AWS::Partition}:apigateway:${AWS::Region}:lambda:path/2015-03-31/functions/${interfaceLambdaFunctionv1.Arn}/invocations"
  interfaceLambdaFunctiov1:
    Description: "Lambda Function ARN"
    Value: !GetAtt interfaceLambdaFunctionv1.Arn
  interfaceProxyApiKey1:
    Description: "API Gateway endpoint URL"
    Value: !Sub "https://us-east-1.console.aws.amazon.com/apigateway/home?region=${AWS::Region}#/api-keys/${interfaceProxyApiKey1}"