/
dovetail-cdn-arranger.yml
334 lines (324 loc) · 13.5 KB
/
dovetail-cdn-arranger.yml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
# stacks/apps/dovetail-cdn-arranger.yml
# 100A
AWSTemplateFormatVersion: "2010-09-09"
Transform: AWS::Serverless-2016-10-31
Description: >-
Creates a Lambda function that can generate complete, stitched, transcoded
audio files based on arrangement data used to determine ads and other dynamic
content. The function also transcodes component audio files (ads, etc) used
for stitching. Also creates an S3 bucket to hold the files, which acts as a
CDN origin for the complete files.
Parameters:
kMetricFilterNamespace:
Type: String
Default: PRX/Dovetail/CdnArranger
#######
NestedChangeSetScrubbingResourcesState: { Type: String }
EnvironmentType: { Type: String }
EnvironmentTypeAbbreviation: { Type: String }
AwsOrganizationId: { Type: String }
RootStackName: { Type: String }
RootStackId: { Type: String }
CloudWatchAlarmTaggerServiceToken: { Type: String }
CodeS3Bucket: { Type: String }
CodeS3ObjectKey: { Type: AWS::SSM::Parameter::Value<String> }
FfmpegLambdaLayerS3ObjectKey: { Type: AWS::SSM::Parameter::Value<String> }
CloudFrontOai: { Type: AWS::SSM::Parameter::Value<String> }
CloudFrontOai2: { Type: AWS::SSM::Parameter::Value<String> }
DovetailRouterHostname: { Type: AWS::SSM::Parameter::Value<String> }
DovetailRouterToken: { Type: AWS::SSM::Parameter::Value<String> }
ArrangementsDynamodbRegion: { Type: AWS::SSM::Parameter::Value<String> }
ArrangementsDynamodbTableName: { Type: AWS::SSM::Parameter::Value<String> }
ArrangementsDynamodbTtl: { Type: AWS::SSM::Parameter::Value<String> }
ArrangementsDynamodbAccessRoleArn: { Type: AWS::SSM::Parameter::Value<String> }
Conditions:
EnableNestedChangeSetScrubbingResources: !Equals [!Ref NestedChangeSetScrubbingResourcesState, Enabled]
Resources:
NestedChangeSetScrubber: { Type: AWS::SNS::Topic, Condition: EnableNestedChangeSetScrubbingResources }
DtCdnArrangerWorkspaceBucket:
Type: AWS::S3::Bucket
DeletionPolicy: Retain
UpdateReplacePolicy: Retain
Properties:
LifecycleConfiguration:
Rules:
- ExpirationInDays: 1
Status: Enabled
TagFilters:
- Key: Type
Value: IncompleteConcat
- ExpirationInDays: 10
Status: Enabled
TagFilters:
- Key: Type
Value: Concat
- ExpirationInDays: 30
Status: Enabled
PublicAccessBlockConfiguration:
BlockPublicAcls: true
BlockPublicPolicy: true
IgnorePublicAcls: true
RestrictPublicBuckets: true
Tags:
- { Key: prx:meta:tagging-version, Value: "2021-04-07" }
- { Key: prx:cloudformation:stack-name, Value: !Ref AWS::StackName }
- { Key: prx:cloudformation:stack-id, Value: !Ref AWS::StackId }
- { Key: prx:cloudformation:root-stack-name, Value: !Ref RootStackName }
- { Key: prx:cloudformation:root-stack-id, Value: !Ref RootStackId }
- { Key: prx:ops:environment, Value: !Ref EnvironmentType }
- { Key: prx:dev:family, Value: Dovetail }
- { Key: prx:dev:application, Value: CDN Arranger }
BucketPolicy:
Type: AWS::S3::BucketPolicy
DeletionPolicy: Retain
UpdateReplacePolicy: Retain
Properties:
Bucket: !Ref DtCdnArrangerWorkspaceBucket
PolicyDocument:
Statement:
- Action: s3:GetObject
Effect: Allow
Principal:
AWS: !Ref CloudFrontOai
Resource: !Sub ${DtCdnArrangerWorkspaceBucket.Arn}/*
Sid: Grant read access to a CloudFront Origin Identity
- Action: s3:GetObject
Effect: Allow
Principal:
AWS: !Ref CloudFrontOai2
Resource: !Sub ${DtCdnArrangerWorkspaceBucket.Arn}/*
Sid: AllowCdnObjectRead
- Action: s3:GetObject
Condition:
StringEquals:
aws:PrincipalOrgID: !Ref AwsOrganizationId
Effect: Allow
Principal:
AWS: "*"
Resource: !Sub ${DtCdnArrangerWorkspaceBucket.Arn}/*
Sid: AllowOrganizationObjectRead
Version: "2012-10-17"
FfmpegBinaryLayer:
Type: AWS::Lambda::LayerVersion
DeletionPolicy: Delete
UpdateReplacePolicy: Delete
Properties:
CompatibleRuntimes:
- nodejs14.x
- nodejs16.x
- nodejs18.x
Content:
S3Bucket: !Ref CodeS3Bucket
S3Key: !Ref FfmpegLambdaLayerS3ObjectKey
Description: FFmpeg binaries for Dovetail CDN Arranger
LicenseInfo: MIT
ArrangerFunction:
Type: AWS::Serverless::Function
Properties:
CodeUri:
Bucket: !Ref CodeS3Bucket
Key: !Ref CodeS3ObjectKey
Description: !Sub >-
${EnvironmentType} Dovetail CDN Arranger for transcoding and stitching
audio files
Environment:
Variables:
ARRANGEMENTS_DDB_ACCESS_ROLE: !Ref ArrangementsDynamodbAccessRoleArn
ARRANGEMENTS_DDB_REGION: !Ref ArrangementsDynamodbRegion
ARRANGEMENTS_DDB_TABLE: !Ref ArrangementsDynamodbTableName
ARRANGEMENTS_DDB_TTL: !Ref ArrangementsDynamodbTtl
DOVETAIL_HOST: !Ref DovetailRouterHostname
DOVETAIL_TOKEN: !Ref DovetailRouterToken
TMP_DISK_LIMIT: 500000000
WORKSPACE_S3_BUCKET: !Ref DtCdnArrangerWorkspaceBucket
Handler: index.handler
Layers:
- !Ref FfmpegBinaryLayer
MemorySize: 8000
Runtime: nodejs16.x
Policies:
- Statement:
- Action:
- dynamodb:DescribeTable
- dynamodb:GetItem
- dynamodb:PutItem
Effect: Allow
# TODO: can this be done with an AWS::Partition Sub?
Resource: !Split
- ","
- Fn::Sub:
- arn:aws:dynamodb:*:*:table/${inner}
- inner:
Fn::Join:
- ",arn:aws:dynamodb:*:*:table/"
- !Split [",", !Ref ArrangementsDynamodbTableName]
Version: "2012-10-17"
- Statement:
- Action: sts:AssumeRole
Effect: Allow
Resource: !Split [",", !Ref ArrangementsDynamodbAccessRoleArn]
Version: "2012-10-17"
- Statement:
- Action: s3:ListBucket
Effect: Allow
Resource: !GetAtt DtCdnArrangerWorkspaceBucket.Arn
- Action:
- s3:GetObject
- s3:GetObjectAcl
- s3:GetObjectTagging
- s3:PutObject
- s3:PutObjectAcl
- s3:PutObjectTagging
Effect: Allow
Resource: !Sub ${DtCdnArrangerWorkspaceBucket.Arn}/*
Version: "2012-10-17"
Tags:
prx:meta:tagging-version: "2021-04-07"
prx:cloudformation:stack-name: !Ref AWS::StackName
prx:cloudformation:stack-id: !Ref AWS::StackId
prx:cloudformation:root-stack-name: !Ref RootStackName
prx:cloudformation:root-stack-id: !Ref RootStackId
prx:ops:environment: !Ref EnvironmentType
prx:dev:family: Dovetail
prx:dev:application: CDN Arranger
Timeout: 900
ArrangerFunctionLogGroup:
Type: AWS::Logs::LogGroup
DeletionPolicy: Delete
UpdateReplacePolicy: Delete
Properties:
LogGroupName: !Sub /aws/lambda/${ArrangerFunction}
RetentionInDays: 14
Tags:
- { Key: prx:meta:tagging-version, Value: "2021-04-07" }
- { Key: prx:cloudformation:stack-name, Value: !Ref AWS::StackName }
- { Key: prx:cloudformation:stack-id, Value: !Ref AWS::StackId }
- { Key: prx:cloudformation:root-stack-name, Value: !Ref RootStackName }
- { Key: prx:cloudformation:root-stack-id, Value: !Ref RootStackId }
- { Key: prx:ops:environment, Value: !Ref EnvironmentType }
- { Key: prx:dev:family, Value: Dovetail }
- { Key: prx:dev:application, Value: CDN Arranger }
ArrangerFunctionResourcePolicy:
Type: AWS::Lambda::Permission
Properties:
Action: lambda:InvokeFunction
FunctionName: !GetAtt ArrangerFunction.Arn
Principal: "*"
PrincipalOrgID: !Ref AwsOrganizationId
ArrangerFunctionElevatedErrorAlarm:
Type: AWS::CloudWatch::Alarm
Properties:
AlarmName: !Sub ERROR [Dovetail-CDN Arranger] Lambda function <${EnvironmentTypeAbbreviation}> INVOCATIONS ERRORS (${RootStackName})
AlarmDescription: !Sub >-
${EnvironmentType} Dovetail CDN Arranger Lambda function is failing, so
some stitch requests or downloads may be impacted.
ComparisonOperator: GreaterThanThreshold
Dimensions:
- Name: FunctionName
Value: !Ref ArrangerFunction
EvaluationPeriods: 1
MetricName: Errors
Namespace: AWS/Lambda
Period: 60
Statistic: Sum
Threshold: 1
TreatMissingData: notBreaching
ArrangerFunctionElevatedErrorAlarmTags:
Type: Custom::CloudWatchAlarmTags
Properties:
ServiceToken: !Ref CloudWatchAlarmTaggerServiceToken
AlarmArn: !GetAtt ArrangerFunctionElevatedErrorAlarm.Arn
Tags:
- { Key: prx:meta:tagging-version, Value: "2021-04-07" }
- { Key: prx:cloudformation:stack-name, Value: !Ref AWS::StackName }
- { Key: prx:cloudformation:stack-id, Value: !Ref AWS::StackId }
- { Key: prx:cloudformation:root-stack-name, Value: !Ref RootStackName }
- { Key: prx:cloudformation:root-stack-id, Value: !Ref RootStackId }
- { Key: prx:ops:environment, Value: !Ref EnvironmentType }
- { Key: prx:dev:family, Value: Dovetail }
- { Key: prx:dev:application, Value: CDN Arranger }
ArrangerFunctionWarnLevelLogMetricFilter:
Type: AWS::Logs::MetricFilter
Properties:
FilterPattern: '{ $._logLevel = "warn" }'
LogGroupName: !Ref ArrangerFunctionLogGroup
MetricTransformations:
# TODO Add dimensions
- MetricName: !Sub warns_${ArrangerFunction}
MetricNamespace: !Ref kMetricFilterNamespace
MetricValue: "1"
ArrangerFunctionLoggedWarnAlarm:
Type: AWS::CloudWatch::Alarm
Properties:
AlarmName: !Sub WARN [Dovetail-CDN Arranger] Lambda function <${EnvironmentTypeAbbreviation}> LOGGING WARNINGS (${RootStackName})
AlarmDescription: !Sub >-
${EnvironmentType} Dovetail Cdn Arranger Lambda function has logged some warnings.
ComparisonOperator: GreaterThanThreshold
EvaluationPeriods: 1
MetricName: !Sub warns_${ArrangerFunction}
Namespace: !Ref kMetricFilterNamespace
Period: 60
Statistic: Sum
Threshold: 0
TreatMissingData: notBreaching
ArrangerFunctionLoggedWarnAlarmTags:
Type: Custom::CloudWatchAlarmTags
Properties:
ServiceToken: !Ref CloudWatchAlarmTaggerServiceToken
AlarmArn: !GetAtt ArrangerFunctionLoggedWarnAlarm.Arn
Tags:
- { Key: prx:meta:tagging-version, Value: "2021-04-07" }
- { Key: prx:cloudformation:stack-name, Value: !Ref AWS::StackName }
- { Key: prx:cloudformation:stack-id, Value: !Ref AWS::StackId }
- { Key: prx:cloudformation:root-stack-name, Value: !Ref RootStackName }
- { Key: prx:cloudformation:root-stack-id, Value: !Ref RootStackId }
- { Key: prx:ops:environment, Value: !Ref EnvironmentType }
- { Key: prx:ops:cloudwatch-log-group-name, Value: !Ref ArrangerFunctionLogGroup }
- { Key: prx:dev:family, Value: Dovetail }
- { Key: prx:dev:application, Value: CDN Arranger }
ArrangerFunctionErrorLevelLogMetricFilter:
Type: AWS::Logs::MetricFilter
Properties:
FilterPattern: '{ $._logLevel = "error" }'
LogGroupName: !Ref ArrangerFunctionLogGroup
MetricTransformations:
# TODO Add dimensions
- MetricName: !Sub errors_${ArrangerFunction}
MetricNamespace: !Ref kMetricFilterNamespace
MetricValue: "1"
ArrangerFunctionLoggedErrorAlarm:
Type: AWS::CloudWatch::Alarm
Properties:
AlarmName: !Sub ERROR [Dovetail-CDN Arranger] Lambda function <${EnvironmentTypeAbbreviation}> LOGGED ERRORS (${RootStackName})
AlarmDescription: !Sub >-
${EnvironmentType} Dovetail Cdn Arranger Lambda function has logged some errors.
ComparisonOperator: GreaterThanThreshold
EvaluationPeriods: 1
MetricName: !Sub errors_${ArrangerFunction}
Namespace: !Ref kMetricFilterNamespace
Period: 60
Statistic: Sum
Threshold: 0
TreatMissingData: notBreaching
ArrangerFunctionLoggedErrorAlarmTags:
Type: Custom::CloudWatchAlarmTags
Properties:
ServiceToken: !Ref CloudWatchAlarmTaggerServiceToken
AlarmArn: !GetAtt ArrangerFunctionLoggedErrorAlarm.Arn
Tags:
- { Key: prx:meta:tagging-version, Value: "2021-04-07" }
- { Key: prx:cloudformation:stack-name, Value: !Ref AWS::StackName }
- { Key: prx:cloudformation:stack-id, Value: !Ref AWS::StackId }
- { Key: prx:cloudformation:root-stack-name, Value: !Ref RootStackName }
- { Key: prx:cloudformation:root-stack-id, Value: !Ref RootStackId }
- { Key: prx:ops:environment, Value: !Ref EnvironmentType }
- { Key: prx:ops:cloudwatch-log-group-name, Value: !Ref ArrangerFunctionLogGroup }
- { Key: prx:dev:family, Value: Dovetail }
- { Key: prx:dev:application, Value: CDN Arranger }
Outputs:
ArrangerFunctionArn:
Value: !GetAtt ArrangerFunction.Arn
ArrangerWorkspaceBucketArn:
Value: !GetAtt DtCdnArrangerWorkspaceBucket.Arn
ArrangerWorkspaceBucketRegionalDomainName:
Value: !GetAtt DtCdnArrangerWorkspaceBucket.RegionalDomainName