serverlessunicorn

AWSTemplateFormatVersion: 2010-09-09
Transform:
  - AWS::Serverless-2016-10-31
  - AWS::CodeStar

serverlessunicorn

Parameters:
  ProjectId:
    Type: String
    Description: CodeStar projectId used to associate new resources to team members
  CodeDeployRole:
    Type: String
    Description: IAM role to allow AWS CodeDeploy to manage deployment of AWS Lambda functions
  Stage:
    Type: String
    Description: The name for a project pipeline stage, such as Staging or Prod, for which resources are provisioned and deployed.

serverlessunicorn

Globals:
  Function:
    AutoPublishAlias: live
    # Deploy Lambda function updates via 5 minute canary rollout
    DeploymentPreference:
      Enabled: true
      Type: Canary10Percent5Minutes
      Role: !Ref CodeDeployRole

serverlessunicorn

NATPunchFunction:
    Type: AWS::Serverless::Function
    Properties:
      Handler: natpunch.lambda_handler
      Runtime: python3.7
      CodeUri: natpunch.py # Local name; cloudformation package will rewrite to S3 URI
      # Required Python modules are held in a Lambda layer; see the definition below.
      Layers: [!Ref NATPunchFunctionPythonDependenciesLayer]
      Role: !GetAtt NATPunchFunctionRole.Arn # Definition follows below
      Environment:

serverlessunicorn

  NATPunchFunctionPythonDependenciesLayer:
    Type: AWS::Serverless::LayerVersion
    Properties:
      LayerName: natpuncher-python-dependencies
      Description: Python module dependencies required by the NATPuncher function
      ContentUri: python_dependencies/
      CompatibleRuntimes:
        - python3.7
      RetentionPolicy: Delete

serverlessunicorn

  NATPunchFunctionRole:
    Description: AWS Lambda NATPunch function role
    Type: AWS::IAM::Role
    Properties:
      # Heavily mangled to ensure we always know the origin and purpose of this role
      # just by looking at its name.
      RoleName: !Sub 'CodeStar-${ProjectId}-NATPunchFunctionRole-${Stage}'
      # All Lambda roles need to enable Lambda to assume them...
      AssumeRolePolicyDocument:
        Statement:

serverlessunicorn

  NATPunchDatabase:
    Type: AWS::Serverless::SimpleTable
    Properties:
      TableName: !Sub 'NATPunchDatabase-${Stage}' # Keep consistent with DB envvar above
      PrimaryKey:
        Name: NATSourceIP
        Type: String

serverlessunicorn

  # The top-level websocket itself
  NATPunchWebSocket:
    Type: AWS::ApiGatewayV2::Api
    Properties:
      Name: NATPunchWebSocket
      ProtocolType: WEBSOCKET
      RouteSelectionExpression: "$request.body.action"

  # The builtin $connect path. This involves both a route
  # definition and its integration definition, which follows, as well as a 

serverlessunicorn

  # NATPunch websocket deployment descriptor; see 'stage' below.
  NATPunchWebSocketDeployment:
    Type: AWS::ApiGatewayV2::Deployment
    # See https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-apigateway-deployment.html for
    # an explanation on why the routes below are listed as explicit dependencies for
    # the API's deployment in CloudFormation. This feels like a bug/hack; hopefully AWS
    # fixes it over time.
    DependsOn:
      - NATPunchConnectRoute
      - NATPunchDisconnectRoute

serverlessunicorn

Outputs:
  NATPunchWebSocketOutput:
    Description: NATPunch WebSocket created by CloudFormation
    Value: !Ref NATPunchWebSocket
  NATPunchFunctionOutput:
    Description: NATPunch's Lambda function as created by CloudFormation
    Value: !Ref NATPunchFunction
  NATPunchDatabaseOutput:
    Description: NATPunch's DynamoDB table as created by CloudFormation
    Value: !Ref NATPunchDatabase