template.yaml

AWSTemplateFormatVersion: "2010-09-09"
Transform: AWS::Serverless-2016-10-31

Description: Easy serverless Amazon Trascribe

Metadata:
  AWS::ServerlessRepo::Application:
    Name: serverless-transcribe
    Description: Easy serverless Amazon Trascribe via the web
    Author: Christopher Kalafarski
    SpdxLicenseId: MIT
    LicenseUrl: LICENSE
    ReadmeUrl: README.md
    Labels: ['transcribe', 'transcription', 'serverless']
    HomePageUrl: https://github.com/farski/serverless-transcribe
    SemanticVersion: 2.2.0
    SourceCodeUrl: https://github.com/farski/serverless-transcribe
  AWS::CloudFormation::Interface:
    ParameterGroups:
      - Label:
          default: Authentication
        Parameters:
          - BasicAuthUsername
          - BasicAuthPassword
      - Label:
          default: Configuration
        Parameters:
          - NotificationSourceEmailAddress
          - TranscriptionsExpirationInDays
          - JobTagKey
          - JobTagValue
    ParameterLabels:
      BasicAuthUsername:
        default: Username
      BasicAuthPassword:
        default: Password
      NotificationSourceEmailAddress:
        default: Email FROM
      JobTagKey:
        default: Transcribe job tag
      JobTagValue:
        default: Transcribe job value
      TranscriptionsExpirationInDays:
        default: Days to keep transcriptions

Parameters:
  BasicAuthUsername:
    Type: String
    Description: The HTTP Basic authentication username for the website
  BasicAuthPassword:
    Type: String
    Description: The HTTP Basic authentication password for the website
  NotificationSourceEmailAddress:
    Type: String
    Description: Emails sent by the applications will come from this address
  JobTagKey:
    Type: String
    Default: ""
    Description: >-
      (optional) Transcription jobs will be tagged with this key
  JobTagValue:
    Type: String
    Default: ""
    Description: >-
      (optional) Transcription jobs will be tagged with this value
  TranscriptionsExpirationInDays:
    Type: Number
    Default: 30
    Description: >-
      The number of days transcription files should remain in S3 after they are
      generated

Resources:
  # Final transcriptions will be added to this bucket
  TranscriptionsBucket:
    Type: AWS::S3::Bucket
    DeletionPolicy: Retain
    UpdateReplacePolicy: Retain
    Properties:
      LifecycleConfiguration:
        Rules:
          - ExpirationInDays: !Ref TranscriptionsExpirationInDays
            Status: Enabled
      PublicAccessBlockConfiguration:
        BlockPublicAcls: true
        BlockPublicPolicy: true
        IgnorePublicAcls: true
        RestrictPublicBuckets: true
      Tags:
        - Key: Project
          Value: serverless-transcribe

  # Files uploaded through the website will be added to this bucket
  MediaBucket:
    Type: AWS::S3::Bucket
    DeletionPolicy: Retain
    UpdateReplacePolicy: Retain
    Properties:
      CorsConfiguration:
        CorsRules:
          - AllowedHeaders: ["*"]
            AllowedMethods: [POST]
            AllowedOrigins: ["*"]
      LifecycleConfiguration:
        Rules:
          - ExpirationInDays: 1
            Status: Enabled
      PublicAccessBlockConfiguration:
        BlockPublicAcls: true
        BlockPublicPolicy: true
        IgnorePublicAcls: true
        RestrictPublicBuckets: true
      Tags:
        - Key: Project
          Value: serverless-transcribe

  Api:
    Type: AWS::ApiGateway::RestApi
    Properties:
      Name: !Ref AWS::StackName
      Description: Transcription website API
  ApiStage:
    Type: AWS::ApiGateway::Stage
    Properties:
      StageName: transcribe
      RestApiId: !Ref Api
      DeploymentId: !Ref ApiDeployment
  ApiDeployment:
    DependsOn:
      - WebFrontEndMethod
    Type: AWS::ApiGateway::Deployment
    Properties:
      RestApiId: !Ref Api

  # The authorizer's identity source indicates that an Authorization header
  # is required. When the header is missing, the API Gateway will return an
  # UNAUTHORIZED response. Once a users has completed the HTTP Basic
  # authentication, the header will be present on requests, and the authorizer
  # function will be invoked as expected.
  # The authorizer response is cached, using the Authorization header as a
  # cache key. All authenticated users share a single set of credentials, and
  # will have the same Authorization header (when using the correct
  # credentials), so the authorizers response is generic to all users. The
  # authorizer's response is a policy that grants access to the entire API, not
  # specific paths.
  ApiAuthorizer:
    Type: AWS::ApiGateway::Authorizer
    Properties:
      AuthorizerCredentials: !GetAtt ApiAuthorizerInvokeRole.Arn
      AuthorizerResultTtlInSeconds: 3600
      AuthorizerUri: !Sub arn:aws:apigateway:${AWS::Region}:lambda:path/2015-03-31/functions/${ApiAuthorizerFunction.Arn}/invocations
      IdentitySource: method.request.header.Authorization
      Name: !Sub ${AWS::StackName}_static_website_authorizer
      RestApiId: !Ref Api
      Type: REQUEST
  ApiAuthorizerFunction:
    Type: AWS::Serverless::Function
    Properties:
      CodeUri: src/api-authorizer/
      Description: Authorizer for S3 file upload front end
      Environment:
        Variables:
          BASIC_AUTH_USERNAME: !Ref BasicAuthUsername
          BASIC_AUTH_PASSWORD: !Ref BasicAuthPassword
      Handler: lambda_function.lambda_handler
      MemorySize: 128
      Runtime: python3.9
      Tags:
        Project: serverless-transcribe
      Timeout: 3
  ApiAuthorizerFunctionLogGroup:
    Type: AWS::Logs::LogGroup
    Properties:
      LogGroupName: !Sub /aws/lambda/${ApiAuthorizerFunction}
      RetentionInDays: 14
      Tags:
        - Key: Project
          Value: serverless-transcribe
  ApiAuthorizerInvokeRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Statement:
          - Action: sts:AssumeRole
            Effect: Allow
            Principal:
              Service: apigateway.amazonaws.com
        Version: "2012-10-17"
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole
      Policies:
        - PolicyName: AuthorizerLambdaInvoke
          PolicyDocument:
            Statement:
              - Action: lambda:invokeFunction
                Effect: Allow
                Resource: !GetAtt ApiAuthorizerFunction.Arn
            Version: "2012-10-17"

  # When the API Gateway returns an UNAUTHORIZED response (due to lack of an
  # Authorization header in the request, as required by the authorizer's
  # identity source), the gateway response will transform the response to
  # include a WWW-Authenticate header, which prompts browsers to display an
  # HTTP Basic Auth form.
  ApiUnauthorizedGatewayReponse:
    Type: AWS::ApiGateway::GatewayResponse
    Properties:
      ResponseParameters:
        gatewayresponse.header.WWW-Authenticate: "'Basic'"
      ResponseType: UNAUTHORIZED
      RestApiId: !Ref Api
      StatusCode: "401"

  # Web front-end
  WebFrontEndFunction:
    Type: AWS::Serverless::Function
    Properties:
      CodeUri: src/web-front-end/
      Description: >-
        Generates a basic front end for uploading files to S3
      Environment:
        Variables:
          API_ID: !Ref Api
          MEDIA_BUCKET: !Ref MediaBucket
          MEDIA_BUCKET_DOMAIN_NAME: !GetAtt MediaBucket.RegionalDomainName
      Handler: lambda_function.lambda_handler
      MemorySize: 128
      Policies:
        # HTTP POST requests from the form on the upload webpage will be signed
        # using the temporary key, secret, and token belonging to the Lambda's
        # execution role, so it needs PutObject access to the S3 bucket where
        # files are being uploaded.
        - S3WritePolicy: { BucketName: !Ref MediaBucket }
      Runtime: python3.9
      Tags:
        Project: serverless-transcribe
      Timeout: 3
  WebFrontEndFunctionLogGroup:
    Type: AWS::Logs::LogGroup
    Properties:
      LogGroupName: !Sub /aws/lambda/${WebFrontEndFunction}
      RetentionInDays: 14
      Tags:
        - Key: Project
          Value: serverless-transcribe
  WebFrontEndMethod:
    Type: AWS::ApiGateway::Method
    Properties:
      AuthorizationType: CUSTOM
      AuthorizerId: !Ref ApiAuthorizer
      HttpMethod: GET
      Integration:
        Type: AWS_PROXY
        IntegrationHttpMethod: POST
        Uri: !Sub arn:aws:apigateway:${AWS::Region}:lambda:path/2015-03-31/functions/${WebFrontEndFunction.Arn}/invocations
      ResourceId: !GetAtt Api.RootResourceId
      RestApiId: !Ref Api
  WebFrontEndFunctionPermission:
    Type: AWS::Lambda::Permission
    Properties:
      Action: lambda:InvokeFunction
      FunctionName: !GetAtt WebFrontEndFunction.Arn
      Principal: apigateway.amazonaws.com
      SourceArn: !Sub arn:aws:execute-api:${AWS::Region}:${AWS::AccountId}:${Api}/${ApiStage}/GET/

  # Transcription Job Start
  TranscriptionJobStartFunction:
    Type: AWS::Serverless::Function
    Properties:
      CodeUri: src/transcription-job-start/
      Description: >-
        Starts transcription jobs when triggered by S3 events
      Environment:
        Variables:
          API_ID: !Ref Api
          JOB_TAG_KEY: !Ref JobTagKey
          JOB_TAG_VALUE: !Ref JobTagValue
          NOTIFICATION_SOURCE_EMAIL_ADDRESS: !Ref NotificationSourceEmailAddress
          TRANSCRIPTIONS_OUTPUT_BUCKET: !Ref TranscriptionsBucket
      Events:
        WavCreated:
          Properties:
            Bucket: !Ref MediaBucket
            Events: s3:ObjectCreated:*
            Filter:
              S3Key:
                Rules:
                  - Name: suffix
                    Value: .wav
          Type: S3
        FlacCreated:
          Properties:
            Bucket: !Ref MediaBucket
            Events: s3:ObjectCreated:*
            Filter:
              S3Key:
                Rules:
                  - Name: suffix
                    Value: .flac
          Type: S3
        AmrCreated:
          Properties:
            Bucket: !Ref MediaBucket
            Events: s3:ObjectCreated:*
            Filter:
              S3Key:
                Rules:
                  - Name: suffix
                    Value: .amr
          Type: S3
        3gaCreated:
          Properties:
            Bucket: !Ref MediaBucket
            Events: s3:ObjectCreated:*
            Filter:
              S3Key:
                Rules:
                  - Name: suffix
                    Value: .3ga
          Type: S3
        Mp3Created:
          Properties:
            Bucket: !Ref MediaBucket
            Events: s3:ObjectCreated:*
            Filter:
              S3Key:
                Rules:
                  - Name: suffix
                    Value: .mp3
          Type: S3
        Mp4Created:
          Properties:
            Bucket: !Ref MediaBucket
            Events: s3:ObjectCreated:*
            Filter:
              S3Key:
                Rules:
                  - Name: suffix
                    Value: .mp4
          Type: S3
        M4aCreated:
          Properties:
            Bucket: !Ref MediaBucket
            Events: s3:ObjectCreated:*
            Filter:
              S3Key:
                Rules:
                  - Name: suffix
                    Value: .m4a
          Type: S3
        OgaCreated:
          Properties:
            Bucket: !Ref MediaBucket
            Events: s3:ObjectCreated:*
            Filter:
              S3Key:
                Rules:
                  - Name: suffix
                    Value: .oga
          Type: S3
        OggCreated:
          Properties:
            Bucket: !Ref MediaBucket
            Events: s3:ObjectCreated:*
            Filter:
              S3Key:
                Rules:
                  - Name: suffix
                    Value: .ogg
          Type: S3
        OpusCreated:
          Properties:
            Bucket: !Ref MediaBucket
            Events: s3:ObjectCreated:*
            Filter:
              S3Key:
                Rules:
                  - Name: suffix
                    Value: .opus
          Type: S3
        WebmCreated:
          Properties:
            Bucket: !Ref MediaBucket
            Events: s3:ObjectCreated:*
            Filter:
              S3Key:
                Rules:
                  - Name: suffix
                    Value: .webm
          Type: S3
      Handler: lambda_function.lambda_handler
      MemorySize: 128
      Role: !GetAtt TranscriptionJobStartFunctionIamRole.Arn
      Runtime: python3.9
      Tags:
        Project: serverless-transcribe
      Timeout: 8
  TranscriptionJobStartFunctionLogGroup:
    Type: AWS::Logs::LogGroup
    Properties:
      LogGroupName: !Sub /aws/lambda/${TranscriptionJobStartFunction}
      RetentionInDays: 14
      Tags:
        - Key: Project
          Value: serverless-transcribe
  TranscriptionJobStartFunctionIamRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Statement:
          - Action: sts:AssumeRole
            Effect: Allow
            Principal:
              Service: lambda.amazonaws.com
        Version: "2012-10-17"
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole
      Policies:
        - PolicyDocument:
            Statement:
              - Action:
                  - s3:Get*
                  - s3:List*
                  - s3:Put*
                Effect: Allow
                Resource: !GetAtt TranscriptionsBucket.Arn
                Sid: AllowBucketActions
              - Action:
                  - s3:Get*
                  - s3:List*
                  - s3:Put*
                Effect: Allow
                Resource: !Sub ${TranscriptionsBucket.Arn}/*
                Sid: AllowObjectActions
            Version: "2012-10-17"
          PolicyName: TranscriptionsBucket
        - PolicyDocument:
            Statement:
              - Action:
                  - transcribe:GetTranscriptionJob
                  - transcribe:StartTranscriptionJob
                  - transcribe:TagResource
                Effect: Allow
                Resource: "*"
                Sid: AllowTranscribeJobStart
            Version: "2012-10-17"
          PolicyName: Transcribe
        - PolicyDocument:
            Statement:
              - Action: ses:SendEmail
                Effect: Allow
                Resource: "*"
                Sid: AllowSendEmail
            Version: "2012-10-17"
          PolicyName: SES
  TranscriptionJobStartFunctionIamRoleMediaBucketPolicy:
    Type: AWS::IAM::Policy
    Properties:
      PolicyDocument:
        Statement:
          - Action: s3:GetObject
            Effect: Allow
            Resource: !Sub ${MediaBucket.Arn}/*
            Sid: AllowMediaObjectRead
          - Action: s3:ListBucket
            Effect: Allow
            Resource: !GetAtt MediaBucket.Arn
            Sid: AllowMediaBucketList
        Version: "2012-10-17"
      PolicyName: MediaBucket
      Roles:
        - !Ref TranscriptionJobStartFunctionIamRole

  # Transcription Job Events
  TranscriptionJobStateChangeFunction:
    Type: AWS::Serverless::Function
    Properties:
      CodeUri: src/transcription-job-state-change/
      Description: Handles transcription job state change events
      Environment:
        Variables:
          MEDIA_BUCKET_NAME: !Ref MediaBucket
          NOTIFICATION_SOURCE_EMAIL_ADDRESS: !Ref NotificationSourceEmailAddress
      Events:
        TranscribeJobs:
          Properties:
            Pattern:
              source:
                - aws.transcribe
              detail-type:
                - Transcribe Job State Change
              detail:
                TranscriptionJobStatus:
                  - COMPLETED
                  - FAILED
                TranscriptionJobName:
                  - prefix: !Sub ${Api}-
            Target:
              Id: !Sub ${AWS::StackName}.Transcribe.JobState
          Type: EventBridgeRule
      Handler: lambda_function.lambda_handler
      MemorySize: 256
      Policies:
        - Statement:
            - Action: ses:SendEmail
              Effect: Allow
              Resource: "*"
              Sid: AllowSendEmail
          Version: "2012-10-17"
        - Statement:
            - Action: transcribe:GetTranscriptionJob
              Effect: Allow
              Resource: "*"
              Sid: AllowTranscriptionJobRead
          Version: "2012-10-17"
        - Statement:
            - Action: s3:GetObject
              Effect: Allow
              Resource: !Sub ${TranscriptionsBucket.Arn}/*
              Sid: AllowTranscriptionObjectRead
          Version: "2012-10-17"
        - Statement:
            - Action: s3:GetObject
              Effect: Allow
              Resource: !Sub ${MediaBucket.Arn}/*
              Sid: AllowMediaObjectRead
          Version: "2012-10-17"
      Runtime: python3.9
      Tags:
        Project: serverless-transcribe
      Timeout: 16
  TranscriptionJobStateChangeFunctionLogGroup:
    Type: AWS::Logs::LogGroup
    Properties:
      LogGroupName: !Sub /aws/lambda/${TranscriptionJobStateChangeFunction}
      RetentionInDays: 14
      Tags:
        - Key: Project
          Value: serverless-transcribe

Outputs:
  UploadWebpageUrl:
    Description: The URL for the webpage used to upload media
    Value: !Sub https://${Api}.execute-api.${AWS::Region}.amazonaws.com/${ApiStage}