template.yml

# This is the SAM template that represents the architecture of your serverless application
# https://docs.aws.amazon.com/serverless-application-model/latest/developerguide/serverless-sam-template-basics.html

# The AWSTemplateFormatVersion identifies the capabilities of the template
# https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/format-version-structure.html
AWSTemplateFormatVersion: 2010-09-09
Description: >-
  Public Editor algorithms for responding to messages:
  1. Task created
  2. Taskrun submitted
  3. Determine task consensus
  4. Generate visualizations (if all tasks done) and update newsfeed.

# Transform section specifies one or more macros that AWS CloudFormation uses to process your template
# https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/transform-section-structure.html
Transform: AWS::Serverless-2016-10-31

# Shared configuration for all resources, more in
# https://github.com/awslabs/serverless-application-model/blob/master/docs/globals.rst
Globals:
  Function:
    # The PermissionsBoundary allows users to safely develop with their function's permissions constrained
    # to their current application. All the functions and roles in this application have to include it and
    # it has to be manually updated when you add resources to your application.
    # More information in https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_boundaries.html
    PermissionsBoundary: !Sub 'arn:${AWS::Partition}:iam::${AWS::AccountId}:policy/${AppId}-${AWS::Region}-PermissionsBoundary'
    Timeout: 300


Parameters:
  AppId:
    Description: Application ID.
    Type: String
    Default: public-editor-alg
    AllowedPattern: ^([a-zA-Z0-9-])+$
    ConstraintDescription: Application IDs must be between 2 and 20 characters, begin with a letter, and only contain lowercase letters, numbers, and hyphens (-).
    MinLength: 2
    MaxLength: 20
  LayerARN:
    Description: A layer ARN with the dependencies numpy and pandas.
    Type: AWS::SSM::Parameter::Value<String>
    Default: pe-consensus-scoring-layer-arn:1
  QueueStackName:
    Description: Name of an active CloudFormation stack that contains the input and output queues.
    Type: String
    MinLength: 1
    MaxLength: 255
    AllowedPattern: "^[a-zA-Z][-a-zA-Z0-9]*$"
    Default: "pe-task-queues"
  KMSKey:
    Description: The key to encrypt queues with.
    Type: AWS::SSM::Parameter::Value<String>
    Default: public-editor-queues-key:1

# Resources declares the AWS resources that you want to include in the stack
# https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/resources-section-structure.html
Resources:
  # Each Lambda function is defined by properties:
  # https://github.com/awslabs/serverless-application-model/blob/master/versions/2016-10-31.md#awsserverlessfunction

  PublicEditorDispatcher:
    Type: AWS::Serverless::Function
    Properties:
      CodeUri: consensus_and_scoring/
      Handler: app.lambda_handler
      Runtime: python3.8
      Layers:
        - !Ref LayerARN
      MemorySize: 1024
      Timeout: 300
      Description: Listens to an SQS queue and dispatches events to algorithms.
      Policies:
        - AWSLambdaBasicExecutionRole
        - SQSPollerPolicy:
            QueueName:
              Fn::ImportValue:
                !Sub '${QueueStackName}-InputQueueName'
        - SQSSendMessagePolicy:
            QueueName:
              Fn::ImportValue:
                !Sub '${QueueStackName}-OutputQueueName'
        - Statement:
          - Sid: AllowKMSForQueue
            Effect: Allow
            Action:
            - kms:Decrypt
            - kms:GenerateDataKey
            Resource: !Ref KMSKey
    Events:
      InputSQSEvents:
        Type: SQS
        Properties:
          Queue:
            Fn::ImportValue:
              !Sub '${QueueStackName}-InputQueueARN'
          BatchSize: 1
          Enabled: true
  LambdaInvokePermission:
    Type: 'AWS::Lambda::Permission'
    Properties:
      FunctionName: !GetAtt PublicEditorDispatcher.Arn
      Action: 'lambda:InvokeFunction'
      Principal: 'sqs.amazonaws.com'
      SourceAccount: !Sub ${AWS::AccountId}
      SourceArn:
        Fn::ImportValue:
          !Sub '${QueueStackName}-InputQueueARN'

Outputs:
  PublicEditorDispatcherARN:
    Description: "Public Editor Task Processor ARN"
    Value: !GetAtt PublicEditorDispatcher.Arn
  PublicEditorDispatcherNAME:
    Description: "Public Editor Task Processor Name"
    Value: !Ref PublicEditorDispatcher