sam-template.yaml

AWSTemplateFormatVersion: '2010-09-09'
Transform: AWS::Serverless-2016-10-31
Description: >
  aws-lambda

  WCIVF Template for aws-lambda

# More info about Globals: https://github.com/awslabs/serverless-application-model/blob/master/docs/globals.rst
Globals:
  Function:
    Timeout: 240

Parameters:

  AppDjangoSettingsModule:
    Description: "The DJANGO_SETTINGS_MODULE environment variable passed to the app."
    Type: String

  AppRdsHost:
    Description: "The RDS_HOST environment variable passed to the app."
    Type: String

  AppRdsDbName:
    Description: "The RDS_DB_NAME environment variable passed to the app."
    Type: String

  AppRdsDbPassword:
    Description: "The DB_PASSWORD environment variable passed to the app."
    Type: String

  AppSentryDsn:
    Description: "The SENTRY_DSN environment variable passed to the app."
    Type: String

  AppSecretKey:
    Description: "The django SECRET_KEY environment variable passed to the app."
    Type: String

  AppDcEnvironment:
    Description: "The DC_ENVIRONMENT environment variable passed to the app."
    Type: String

  VpcIdParameter:
    Description: "VPC ID"
    Type: String

  SubnetIdsParameter:
    Description: "List of subnet IDs"
    Type: CommaDelimitedList

  SSLCertificateArn:
    Description: "SSL Certificate ARN"
    Type: String

  InstanceType:
    Description: "The instance type to be used"
    Type: String

  Domain:
    Description: "The domain to be used"
    Type: String

  AppSlackFeedbackWebhookUrl:
    Description: "Webhook url used to send feeback entries to Slack"
    Type: String

  AppYnrApiKey:
    Description: "API key used to import data from YNR"
    Type: String

  AppFeedbackDbEnabled:
    Default: FEEDBACK_DB_ENABLED
    Description: "Is the feedback DB enabled?"
    Type: AWS::SSM::Parameter::Value<String>
  AppFeedbackDbPassword:
    Default: FEEDBACK_DB_PASSWORD
    Description: "Webhook url used to send feeback entries to Slack"
    Type: AWS::SSM::Parameter::Value<String>

  AppFeedbackDbHost:
    Default: FEEDBACK_DB_HOST
    Description: "Webhook url used to send feeback entries to Slack"
    Type: AWS::SSM::Parameter::Value<String>

Resources:
  WCIVFControllerFunction:
    Type: AWS::Serverless::Function # More info about Function Resource: https://github.com/awslabs/serverless-application-model/blob/master/versions/2016-10-31.md#awsserverlessfunction
    Properties:
      FunctionName: WCIVFControllerFunction
      Role: !Sub "arn:aws:iam::${AWS::AccountId}:role/WCIVFLambdaExecutionRole"
      CodeUri: .
      Handler: wcivf.lambda_handler.handler
      MemorySize: 256
      Runtime: python3.10
      Timeout: 360
      Environment:
        Variables:
          DJANGO_SETTINGS_MODULE: !Ref AppDjangoSettingsModule
          RDS_HOST: !Ref AppRdsHost
          RDS_DB_NAME: !Ref AppRdsDbName
          RDS_DB_PASSWORD: !Ref AppRdsDbPassword
          SENTRY_DSN: !Ref AppSentryDsn
          SECRET_KEY: !Ref AppSecretKey
          DC_ENVIRONMENT: !Ref AppDcEnvironment
          SLACK_FEEDBACK_WEBHOOK_URL: !Ref AppSlackFeedbackWebhookUrl
          YNR_API_KEY: !Ref AppYnrApiKey
          FEEDBACK_DB_ENABLED: !Ref AppFeedbackDbEnabled
          FEEDBACK_DB_PASSWORD: !Ref AppFeedbackDbPassword
          FEEDBACK_DB_HOST: !Ref AppFeedbackDbHost
      Tags:
        dc-environment: !Ref AppDcEnvironment
        dc-product: wcivf
        CreatedVia: CloudFormation
      Events:
        ImportPeopleRecentlyUpdated:
          Type: Schedule # More info about API Event Source: https://github.com/aws/serverless-application-model/blob/master/versions/2016-10-31.md#schedule
          Properties:
            Schedule: cron(*/5 * ? * * *) # using the ? as you cannot use * wildcard for both day-of-month and day-of-week field. See https://docs.aws.amazon.com/AmazonCloudWatch/latest/events/ScheduledEvents.html#CronExpressions
            Name: import-people-recently-updated
            Description: Update all people updated in YNR recently
            Input: '{"command": "import_people", "args": ["--recently-updated"]}'
            RetryPolicy:
              MaximumRetryAttempts: 0
        DeleteDeletedPeople:
          Type: Schedule # More info about API Event Source: https://github.com/aws/serverless-application-model/blob/master/versions/2016-10-31.md#schedule
          Properties:
            Schedule: rate(1 hour)
            Name: delete-deleted-people
            Description: Deletes people deleted in YNR in the last hour
            Input: '{"command": "delete_deleted_people"}'
            RetryPolicy:
              MaximumRetryAttempts: 0
        ImportBallotsRecentlyUpdated:
          Type: Schedule # More info about API Event Source: https://github.com/aws/serverless-application-model/blob/master/versions/2016-10-31.md#schedule
          Properties:
            Schedule: cron(2-57/5 * ? * * *) # using the ? as you cannot use * wildcard for both day-of-month and day-of-week field. See https://docs.aws.amazon.com/AmazonCloudWatch/latest/events/ScheduledEvents.html#CronExpressions
            Name: import-ballots-recently-updated
            Description: Update all ballots updated in YNR recently
            Input: '{"command": "import_ballots", "args": ["--recently-updated"]}'
            RetryPolicy:
              MaximumRetryAttempts: 0
        ImportParties:
          Type: Schedule
          Properties:
            Schedule: rate(1 day)
            Name: import-parties
            Description: Import parties
            Input: '{"command": "import_parties"}'
            RetryPolicy:
              MaximumRetryAttempts: 0
        BatchFeedbackToSlack:
          Type: Schedule
          Properties:
            Schedule: cron(0 9 ? * * *) # using the ? as you cannot use * wildcard for both day-of-month and day-of-week field. See https://docs.aws.amazon.com/AmazonCloudWatch/latest/events/ScheduledEvents.html#CronExpressions
            Name: batch-feedback-to-slack
            Description: Send feedback entries for the last week to slack
            Input: '{"command": "batch_feedback_to_slack", "args": ["--hours=24"]}'
        ImportHustings:
          Type: Schedule
          Properties:
            Schedule: rate(1 hour)
            Name: import-hustings
            Description: Import hustings from google spreadsheets
            Input: '{"command": "import_hustings"}'
#        ImportLeaflets:
#          Type: Schedule
#          Properties:
#            Schedule: rate(1 hour)
#            Name: import-leaflets
#            Description: Import leaflets
#            Input: '{"command": "import_leaflets", "args": ["--recently-uploaded", "--uploaded-since=2022-4-1"]}'
        ImportWikipediaBios:
          Type: Schedule
          Properties:
            Schedule: cron(0 9 * * ? *)
            Name: import-wikipedia-bios
            Description: Import wikipedia bio extracts
            Input: '{"command": "import_wikipedia_bios", "args": ["--current"]}'
            RetryPolicy:
              MaximumRetryAttempts: 0
        # Import2024PPCs:
        #   Type: Schedule
        #   Properties:
        #     Schedule: rate(1 hour)
        #     Name: import-2024-ppcs
        #     Description: Import 2024 PPCs
        #     Input: '{"command": "import_2024_ppcs"}'
        #     RetryPolicy:
        #       MaximumRetryAttempts: 0
        # ILPGlobal:
        #   Type: Schedule
        #   Properties:
        #     Schedule: rate(1 hour)
        #     Name: import-local-parties-global
        #     Description: Import LocalParty objects from google spreadsheets
        #     Input: '{"command": "import_local_parties", "args": ["--date=2023-5-2"]}'

  WCIVFCodeDeployApp:
    Type: AWS::CodeDeploy::Application
    Properties:
      ApplicationName: WCIVFCodeDeploy
      ComputePlatform: Server
      # cannot apply tags without recreating - applied in console

  ElbHTTPSecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: 'HTTP traffic'
      GroupName: 'Elb Security Group'
      SecurityGroupIngress:
        - CidrIp: 0.0.0.0/0
          FromPort: 80
          IpProtocol: tcp
          ToPort: 80
        - CidrIp: 0.0.0.0/0
          FromPort: 443
          IpProtocol: tcp
          ToPort: 443
      VpcId: !Ref VpcIdParameter
      Tags:
        - Key: dc-environment
          Value: !Ref AppDcEnvironment
        - Key: dc-product
          Value: wcivf
        - Key: CreatedVia
          Value: CloudFormation

  InstanceHTTPSecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: 'Allow HTTP and HTTPS access for an instance from the ALB security group'
      GroupName: 'InstanceHTTPSecurityGroup'
      SecurityGroupIngress:
        - FromPort: 8000
          IpProtocol: tcp
          SourceSecurityGroupId: !Ref ElbHTTPSecurityGroup
          ToPort: 8000
        - FromPort: 80
          IpProtocol: tcp
          SourceSecurityGroupId: !Ref ElbHTTPSecurityGroup
          ToPort: 80
        - FromPort: 443
          IpProtocol: tcp
          SourceSecurityGroupId: !Ref ElbHTTPSecurityGroup
          ToPort: 443
      VpcId: !Ref VpcIdParameter
      Tags:
        - Key: dc-environment
          Value: !Ref AppDcEnvironment
        - Key: dc-product
          Value: wcivf
        - Key: CreatedVia
          Value: CloudFormation

  WCIVFTargetGroup:
    Type: "AWS::ElasticLoadBalancingV2::TargetGroup"
    Properties:
      HealthCheckIntervalSeconds: 30
      HealthCheckPath: "/_status_check/"
      Port: 8000
      Protocol: "HTTP"
      HealthCheckPort: "traffic-port"
      HealthCheckProtocol: "HTTP"
      HealthCheckTimeoutSeconds: 5
      UnhealthyThresholdCount: 5
      TargetGroupAttributes:
      - Key: deregistration_delay.timeout_seconds
        Value: 30
      TargetType: "instance"
      Matcher:
        HttpCode: "200"
      HealthyThresholdCount: 2
      VpcId: !Ref VpcIdParameter
      Name: "wcivf-alb-tg"
      HealthCheckEnabled: true
      Tags:
        - Key: dc-environment
          Value: !Ref AppDcEnvironment
        - Key: dc-product
          Value: wcivf
        - Key: CreatedVia
          Value: CloudFormation

  ApplicationLoadBalancer:
    Type: "AWS::ElasticLoadBalancingV2::LoadBalancer"
    Properties:
      Name: "wcivf-alb"
      Scheme: "internet-facing"
      Type: "application"
      SecurityGroups:
        - !Ref ElbHTTPSecurityGroup
      IpAddressType: "ipv4"
      Subnets: !Ref SubnetIdsParameter
      Tags:
        - Key: dc-environment
          Value: !Ref AppDcEnvironment
        - Key: dc-product
          Value: wcivf
        - Key: CreatedVia
          Value: CloudFormation

  HTTPListener:
    Type: "AWS::ElasticLoadBalancingV2::Listener"
    Properties:
      LoadBalancerArn: !Ref ApplicationLoadBalancer
      Port: 80
      Protocol: "HTTP"
      DefaultActions:
        - Order: 2
          TargetGroupArn: !Ref WCIVFTargetGroup
          Type: "forward"

  WWWRedirectListenerRule:
    Type: "AWS::ElasticLoadBalancingV2::ListenerRule"
    Properties:
      Actions:
        - Type: redirect
          RedirectConfig:
            Host: !Ref Domain
            Path: "/#{path}"
            Port: 443
            Protocol: HTTPS
            Query: "#{query}"
            StatusCode: HTTP_301
      Conditions:
        - Field: host-header
          HostHeaderConfig:
            Values:
              - !Sub 'www.${Domain}'
      ListenerArn: !Ref HTTPListener
      Priority: 1




  WCIVFLaunchTemplate:
    Type: AWS::EC2::LaunchTemplate
    Properties:
      LaunchTemplateName: wcivf
      LaunchTemplateData:
        BlockDeviceMappings:
          - DeviceName: /dev/sda1
            Ebs:
              VolumeSize: 35
              VolumeType: gp2
              DeleteOnTermination: true
        NetworkInterfaces:
          - DeviceIndex: 0
            AssociatePublicIpAddress: true
            Groups:
              - !Ref InstanceHTTPSecurityGroup
        # This is needed as it has permissions needed for the instance
        # TODO create new role without packer permissions
        IamInstanceProfile:
          Name: 'CodeDeploy-EC2-Instance-Profile'
        ImageId: 'ami-014a706cddda2a79a' # AMI number
        InstanceType: !Ref InstanceType
      TagSpecifications:
        - ResourceType: launch-template
          Tags:
            - Key: dc-environment
              Value: !Ref AppDcEnvironment
            - Key: dc-product
              Value: wcivf
            - Key: CreatedVia
              Value: CloudFormation

  CloudFrontDistribution:
    Type: 'AWS::CloudFront::Distribution'
    Properties:
      DistributionConfig:
        Comment: 'Cloudfront Distribution pointing to the ALB origin'
        Origins:
          - Id: Static
            DomainName: !GetAtt ApplicationLoadBalancer.DNSName
            CustomOriginConfig:
              OriginProtocolPolicy: "http-only"
            OriginCustomHeaders:
              - HeaderName: X-Forwarded-Host
                HeaderValue: !Ref Domain
              - HeaderName: X-Forwarded-Proto
                HeaderValue: https
            OriginShield:
              Enabled: true
              OriginShieldRegion: eu-west-2

          - Id: Dynamic
            DomainName: !GetAtt ApplicationLoadBalancer.DNSName
            CustomOriginConfig:
              OriginProtocolPolicy: "http-only"
            OriginCustomHeaders:
              - HeaderName: X-Forwarded-Host
                HeaderValue: !Ref Domain
              - HeaderName: X-Forwarded-Proto
                HeaderValue: https

        Enabled: true
        HttpVersion: 'http2'
        Aliases:
          - !Ref Domain
          - !Sub "www.${Domain}"
        PriceClass: "PriceClass_100"
        ViewerCertificate:
          AcmCertificateArn: !Ref SSLCertificateArn
          MinimumProtocolVersion: TLSv1.1_2016
          SslSupportMethod: sni-only

        DefaultCacheBehavior:
          AllowedMethods: [ GET, HEAD, OPTIONS, PUT, POST, PATCH, DELETE ]
          TargetOriginId: Dynamic
          ForwardedValues:
            QueryString: true
            Cookies:
              Forward: "all"
            Headers:
              - Authorization
              - Origin
              - Referer
          ViewerProtocolPolicy: "redirect-to-https"

        CacheBehaviors:
          - AllowedMethods: [ GET, HEAD, OPTIONS ]
            PathPattern: static/*
            TargetOriginId: Static
            Compress: true
            ForwardedValues:
              QueryString: true
              Cookies:
                Forward: none
              Headers:
                - Authorization
                - Origin
            ViewerProtocolPolicy: "redirect-to-https"
            MinTTL: '50'

  DnsRecord:
    Type: AWS::Route53::RecordSet
    Properties:
      AliasTarget:
        DNSName: !GetAtt CloudFrontDistribution.DomainName
        HostedZoneId: Z2FDTNDATAQYW2 # this is an AWS-owned, global singleton required for Aliases to CloudFront
      HostedZoneName: !Sub "${Domain}."
      Name: !Sub "${Domain}."
      Type: A
  
  WWWDnsRecord:
    Type: AWS::Route53::RecordSet
    Properties:
      AliasTarget:
        DNSName: !GetAtt CloudFrontDistribution.DomainName
        HostedZoneId: Z2FDTNDATAQYW2 # this is an AWS-owned, global singleton required for Aliases to CloudFront
      HostedZoneName: !Sub "${Domain}."
      Name: !Sub "www.${Domain}."
      Type: A


Outputs:
  WCIVFControllerFunctionArn:
    Description: "WCIVF Controller Lambda Function ARN"
    Value: !GetAtt WCIVFControllerFunction.Arn