dovetail-cdn-arranger.yml

# stacks/apps/dovetail-cdn-arranger.yml
# 100A
AWSTemplateFormatVersion: "2010-09-09"
Transform: AWS::Serverless-2016-10-31

Description: >-
  Creates a Lambda function that can generate complete, stitched, transcoded
  audio files based on arrangement data used to determine ads and other dynamic
  content. The function also transcodes component audio files (ads, etc) used
  for stitching. Also creates an S3 bucket to hold the files, which acts as a
  CDN origin for the complete files.

Parameters:
  kMetricFilterNamespace:
    Type: String
    Default: PRX/Dovetail/CdnArranger
  #######
  NestedChangeSetScrubbingResourcesState: { Type: String }
  EnvironmentType: { Type: String }
  EnvironmentTypeAbbreviation: { Type: String }
  AwsOrganizationId: { Type: String }
  RootStackName: { Type: String }
  RootStackId: { Type: String }
  CloudWatchAlarmTaggerServiceToken: { Type: String }
  CodeS3Bucket: { Type: String }
  CodeS3ObjectKey: { Type: AWS::SSM::Parameter::Value<String> }
  FfmpegLambdaLayerS3ObjectKey: { Type: AWS::SSM::Parameter::Value<String> }
  CloudFrontOai: { Type: AWS::SSM::Parameter::Value<String> }
  CloudFrontOai2: { Type: AWS::SSM::Parameter::Value<String> }
  DovetailRouterHostname: { Type: AWS::SSM::Parameter::Value<String> }
  DovetailRouterToken: { Type: AWS::SSM::Parameter::Value<String> }
  ArrangementsDynamodbRegion: { Type: AWS::SSM::Parameter::Value<String> }
  ArrangementsDynamodbTableName: { Type: AWS::SSM::Parameter::Value<String> }
  ArrangementsDynamodbTtl: { Type: AWS::SSM::Parameter::Value<String> }
  ArrangementsDynamodbAccessRoleArn: { Type: AWS::SSM::Parameter::Value<String> }

Conditions:
  EnableNestedChangeSetScrubbingResources: !Equals [!Ref NestedChangeSetScrubbingResourcesState, Enabled]

Resources:
  NestedChangeSetScrubber: { Type: AWS::SNS::Topic, Condition: EnableNestedChangeSetScrubbingResources }

  DtCdnArrangerWorkspaceBucket:
    Type: AWS::S3::Bucket
    DeletionPolicy: Retain
    UpdateReplacePolicy: Retain
    Properties:
      LifecycleConfiguration:
        Rules:
          - ExpirationInDays: 1
            Status: Enabled
            TagFilters:
              - Key: Type
                Value: IncompleteConcat
          - ExpirationInDays: 10
            Status: Enabled
            TagFilters:
              - Key: Type
                Value: Concat
          - ExpirationInDays: 30
            Status: Enabled
      PublicAccessBlockConfiguration:
        BlockPublicAcls: true
        BlockPublicPolicy: true
        IgnorePublicAcls: true
        RestrictPublicBuckets: true
      Tags:
        - { Key: prx:meta:tagging-version, Value: "2021-04-07" }
        - { Key: prx:cloudformation:stack-name, Value: !Ref AWS::StackName }
        - { Key: prx:cloudformation:stack-id, Value: !Ref AWS::StackId }
        - { Key: prx:cloudformation:root-stack-name, Value: !Ref RootStackName }
        - { Key: prx:cloudformation:root-stack-id, Value: !Ref RootStackId }
        - { Key: prx:ops:environment, Value: !Ref EnvironmentType }
        - { Key: prx:dev:family, Value: Dovetail }
        - { Key: prx:dev:application, Value: CDN Arranger }
  BucketPolicy:
    Type: AWS::S3::BucketPolicy
    DeletionPolicy: Retain
    UpdateReplacePolicy: Retain
    Properties:
      Bucket: !Ref DtCdnArrangerWorkspaceBucket
      PolicyDocument:
        Statement:
          - Action: s3:GetObject
            Effect: Allow
            Principal:
              AWS: !Ref CloudFrontOai
            Resource: !Sub ${DtCdnArrangerWorkspaceBucket.Arn}/*
            Sid: Grant read access to a CloudFront Origin Identity
          - Action: s3:GetObject
            Effect: Allow
            Principal:
              AWS: !Ref CloudFrontOai2
            Resource: !Sub ${DtCdnArrangerWorkspaceBucket.Arn}/*
            Sid: AllowCdnObjectRead
          - Action: s3:GetObject
            Condition:
              StringEquals:
                aws:PrincipalOrgID: !Ref AwsOrganizationId
            Effect: Allow
            Principal:
              AWS: "*"
            Resource: !Sub ${DtCdnArrangerWorkspaceBucket.Arn}/*
            Sid: AllowOrganizationObjectRead
        Version: "2012-10-17"

  FfmpegBinaryLayer:
    Type: AWS::Lambda::LayerVersion
    DeletionPolicy: Delete
    UpdateReplacePolicy: Delete
    Properties:
      CompatibleRuntimes:
        - nodejs14.x
        - nodejs16.x
        - nodejs18.x
      Content:
        S3Bucket: !Ref CodeS3Bucket
        S3Key: !Ref FfmpegLambdaLayerS3ObjectKey
      Description: FFmpeg binaries for Dovetail CDN Arranger
      LicenseInfo: MIT

  ArrangerFunction:
    Type: AWS::Serverless::Function
    Properties:
      CodeUri:
        Bucket: !Ref CodeS3Bucket
        Key: !Ref CodeS3ObjectKey
      Description: !Sub >-
        ${EnvironmentType} Dovetail CDN Arranger for transcoding and stitching
        audio files
      Environment:
        Variables:
          ARRANGEMENTS_DDB_ACCESS_ROLE: !Ref ArrangementsDynamodbAccessRoleArn
          ARRANGEMENTS_DDB_REGION: !Ref ArrangementsDynamodbRegion
          ARRANGEMENTS_DDB_TABLE: !Ref ArrangementsDynamodbTableName
          ARRANGEMENTS_DDB_TTL: !Ref ArrangementsDynamodbTtl
          DOVETAIL_HOST: !Ref DovetailRouterHostname
          DOVETAIL_TOKEN: !Ref DovetailRouterToken
          TMP_DISK_LIMIT: 500000000
          WORKSPACE_S3_BUCKET: !Ref DtCdnArrangerWorkspaceBucket
      Handler: index.handler
      Layers:
        - !Ref FfmpegBinaryLayer
      MemorySize: 8000
      Runtime: nodejs16.x
      Policies:
        - Statement:
            - Action:
                - dynamodb:DescribeTable
                - dynamodb:GetItem
                - dynamodb:PutItem
              Effect: Allow
              # TODO: can this be done with an AWS::Partition Sub?
              Resource: !Split
                - ","
                - Fn::Sub:
                    - arn:aws:dynamodb:*:*:table/${inner}
                    - inner:
                        Fn::Join:
                          - ",arn:aws:dynamodb:*:*:table/"
                          - !Split [",", !Ref ArrangementsDynamodbTableName]
          Version: "2012-10-17"
        - Statement:
            - Action: sts:AssumeRole
              Effect: Allow
              Resource: !Split [",", !Ref ArrangementsDynamodbAccessRoleArn]
          Version: "2012-10-17"
        - Statement:
            - Action: s3:ListBucket
              Effect: Allow
              Resource: !GetAtt DtCdnArrangerWorkspaceBucket.Arn
            - Action:
                - s3:GetObject
                - s3:GetObjectAcl
                - s3:GetObjectTagging
                - s3:PutObject
                - s3:PutObjectAcl
                - s3:PutObjectTagging
              Effect: Allow
              Resource: !Sub ${DtCdnArrangerWorkspaceBucket.Arn}/*
          Version: "2012-10-17"
      Tags:
        prx:meta:tagging-version: "2021-04-07"
        prx:cloudformation:stack-name: !Ref AWS::StackName
        prx:cloudformation:stack-id: !Ref AWS::StackId
        prx:cloudformation:root-stack-name: !Ref RootStackName
        prx:cloudformation:root-stack-id: !Ref RootStackId
        prx:ops:environment: !Ref EnvironmentType
        prx:dev:family: Dovetail
        prx:dev:application: CDN Arranger
      Timeout: 900
  ArrangerFunctionLogGroup:
    Type: AWS::Logs::LogGroup
    DeletionPolicy: Delete
    UpdateReplacePolicy: Delete
    Properties:
      LogGroupName: !Sub /aws/lambda/${ArrangerFunction}
      RetentionInDays: 14
      Tags:
        - { Key: prx:meta:tagging-version, Value: "2021-04-07" }
        - { Key: prx:cloudformation:stack-name, Value: !Ref AWS::StackName }
        - { Key: prx:cloudformation:stack-id, Value: !Ref AWS::StackId }
        - { Key: prx:cloudformation:root-stack-name, Value: !Ref RootStackName }
        - { Key: prx:cloudformation:root-stack-id, Value: !Ref RootStackId }
        - { Key: prx:ops:environment, Value: !Ref EnvironmentType }
        - { Key: prx:dev:family, Value: Dovetail }
        - { Key: prx:dev:application, Value: CDN Arranger }
  ArrangerFunctionResourcePolicy:
    Type: AWS::Lambda::Permission
    Properties:
      Action: lambda:InvokeFunction
      FunctionName: !GetAtt ArrangerFunction.Arn
      Principal: "*"
      PrincipalOrgID: !Ref AwsOrganizationId
  ArrangerFunctionElevatedErrorAlarm:
    Type: AWS::CloudWatch::Alarm
    Properties:
      AlarmName: !Sub ERROR [Dovetail-CDN Arranger] Lambda function <${EnvironmentTypeAbbreviation}> INVOCATIONS ERRORS (${RootStackName})
      AlarmDescription: !Sub >-
        ${EnvironmentType} Dovetail CDN Arranger Lambda function is failing, so
        some stitch requests or downloads may be impacted.
      ComparisonOperator: GreaterThanThreshold
      Dimensions:
        - Name: FunctionName
          Value: !Ref ArrangerFunction
      EvaluationPeriods: 1
      MetricName: Errors
      Namespace: AWS/Lambda
      Period: 60
      Statistic: Sum
      Threshold: 1
      TreatMissingData: notBreaching
  ArrangerFunctionElevatedErrorAlarmTags:
    Type: Custom::CloudWatchAlarmTags
    Properties:
      ServiceToken: !Ref CloudWatchAlarmTaggerServiceToken
      AlarmArn: !GetAtt ArrangerFunctionElevatedErrorAlarm.Arn
      Tags:
        - { Key: prx:meta:tagging-version, Value: "2021-04-07" }
        - { Key: prx:cloudformation:stack-name, Value: !Ref AWS::StackName }
        - { Key: prx:cloudformation:stack-id, Value: !Ref AWS::StackId }
        - { Key: prx:cloudformation:root-stack-name, Value: !Ref RootStackName }
        - { Key: prx:cloudformation:root-stack-id, Value: !Ref RootStackId }
        - { Key: prx:ops:environment, Value: !Ref EnvironmentType }
        - { Key: prx:dev:family, Value: Dovetail }
        - { Key: prx:dev:application, Value: CDN Arranger }

  ArrangerFunctionWarnLevelLogMetricFilter:
    Type: AWS::Logs::MetricFilter
    Properties:
      FilterPattern: '{ $._logLevel = "warn" }'
      LogGroupName: !Ref ArrangerFunctionLogGroup
      MetricTransformations:
        # TODO Add dimensions
        - MetricName: !Sub warns_${ArrangerFunction}
          MetricNamespace: !Ref kMetricFilterNamespace
          MetricValue: "1"
  ArrangerFunctionLoggedWarnAlarm:
    Type: AWS::CloudWatch::Alarm
    Properties:
      AlarmName: !Sub WARN [Dovetail-CDN Arranger] Lambda function <${EnvironmentTypeAbbreviation}> LOGGING WARNINGS (${RootStackName})
      AlarmDescription: !Sub >-
        ${EnvironmentType} Dovetail Cdn Arranger Lambda function has logged some warnings.
      ComparisonOperator: GreaterThanThreshold
      EvaluationPeriods: 1
      MetricName: !Sub warns_${ArrangerFunction}
      Namespace: !Ref kMetricFilterNamespace
      Period: 60
      Statistic: Sum
      Threshold: 0
      TreatMissingData: notBreaching
  ArrangerFunctionLoggedWarnAlarmTags:
    Type: Custom::CloudWatchAlarmTags
    Properties:
      ServiceToken: !Ref CloudWatchAlarmTaggerServiceToken
      AlarmArn: !GetAtt ArrangerFunctionLoggedWarnAlarm.Arn
      Tags:
        - { Key: prx:meta:tagging-version, Value: "2021-04-07" }
        - { Key: prx:cloudformation:stack-name, Value: !Ref AWS::StackName }
        - { Key: prx:cloudformation:stack-id, Value: !Ref AWS::StackId }
        - { Key: prx:cloudformation:root-stack-name, Value: !Ref RootStackName }
        - { Key: prx:cloudformation:root-stack-id, Value: !Ref RootStackId }
        - { Key: prx:ops:environment, Value: !Ref EnvironmentType }
        - { Key: prx:ops:cloudwatch-log-group-name, Value: !Ref ArrangerFunctionLogGroup }
        - { Key: prx:dev:family, Value: Dovetail }
        - { Key: prx:dev:application, Value: CDN Arranger }

  ArrangerFunctionErrorLevelLogMetricFilter:
    Type: AWS::Logs::MetricFilter
    Properties:
      FilterPattern: '{ $._logLevel = "error" }'
      LogGroupName: !Ref ArrangerFunctionLogGroup
      MetricTransformations:
        # TODO Add dimensions
        - MetricName: !Sub errors_${ArrangerFunction}
          MetricNamespace: !Ref kMetricFilterNamespace
          MetricValue: "1"
  ArrangerFunctionLoggedErrorAlarm:
    Type: AWS::CloudWatch::Alarm
    Properties:
      AlarmName: !Sub ERROR [Dovetail-CDN Arranger] Lambda function <${EnvironmentTypeAbbreviation}> LOGGED ERRORS (${RootStackName})
      AlarmDescription: !Sub >-
        ${EnvironmentType} Dovetail Cdn Arranger Lambda function has logged some errors.
      ComparisonOperator: GreaterThanThreshold
      EvaluationPeriods: 1
      MetricName: !Sub errors_${ArrangerFunction}
      Namespace: !Ref kMetricFilterNamespace
      Period: 60
      Statistic: Sum
      Threshold: 0
      TreatMissingData: notBreaching
  ArrangerFunctionLoggedErrorAlarmTags:
    Type: Custom::CloudWatchAlarmTags
    Properties:
      ServiceToken: !Ref CloudWatchAlarmTaggerServiceToken
      AlarmArn: !GetAtt ArrangerFunctionLoggedErrorAlarm.Arn
      Tags:
        - { Key: prx:meta:tagging-version, Value: "2021-04-07" }
        - { Key: prx:cloudformation:stack-name, Value: !Ref AWS::StackName }
        - { Key: prx:cloudformation:stack-id, Value: !Ref AWS::StackId }
        - { Key: prx:cloudformation:root-stack-name, Value: !Ref RootStackName }
        - { Key: prx:cloudformation:root-stack-id, Value: !Ref RootStackId }
        - { Key: prx:ops:environment, Value: !Ref EnvironmentType }
        - { Key: prx:ops:cloudwatch-log-group-name, Value: !Ref ArrangerFunctionLogGroup }
        - { Key: prx:dev:family, Value: Dovetail }
        - { Key: prx:dev:application, Value: CDN Arranger }

Outputs:
  ArrangerFunctionArn:
    Value: !GetAtt ArrangerFunction.Arn
  ArrangerWorkspaceBucketArn:
    Value: !GetAtt DtCdnArrangerWorkspaceBucket.Arn
  ArrangerWorkspaceBucketRegionalDomainName:
    Value: !GetAtt DtCdnArrangerWorkspaceBucket.RegionalDomainName