ping-pong-stack.yml

AWSTemplateFormatVersion: '2010-09-09'
Transform: AWS::Serverless-2016-10-31
Description: Ping Function and Pong Endpoint

Parameters:
  DomainName:
    Type: String
  PrimaryUrl:
    Type: String
  StandbyUrl:
    Type: String
  TransitionalUrl:
    Type: String
  Bucket:
    Type: String
  md5:
    Type: String
  OtherInfraStackName:
    Type: String
  OtherPingPongStackName:
    Type: String
  MyInfraStackName:
    Type: String
  OtherStackRegion:
    Type: String

Outputs:
  AlarmSNSArn:
    Value: !Ref AlarmSNS
    Export:
      Name: apigw-multiregion-lambda-backend:AlarmSNSArn
  KickerFunctionArn:
    Value: !GetAtt KickerFunction.Arn
    Export:
      Name: apigw-multiregion-lambda-backend:KickerFunctionArn

Mappings:
  RegionMap:
    us-east-2:
      'cron': 'cron(0/2 * * * ? *)'
    us-west-2:
      'cron': 'cron(1/2 * * * ? *)'

Resources:
  MultiRegionCoolDownTable:
    Type: "AWS::DynamoDB::Table"
    Properties:
      AttributeDefinitions:
        -
          AttributeName: "created"
          AttributeType: "N"
      KeySchema:
        -
          AttributeName: "created"
          KeyType: "HASH"
      ProvisionedThroughput:
        ReadCapacityUnits: "1"
        WriteCapacityUnits: "1"
      TimeToLiveSpecification:
        AttributeName: expiretime
        Enabled: true

  PongerFunction:
    Type: AWS::Serverless::Function
    Properties:
      Handler: ponger.handler
      Runtime: python3.6
      Timeout: 2
      CodeUri:
        Bucket: !Ref Bucket
        Key: !Ref md5
      Events:
        GetApi:
          Type: Api
          Properties:
            Path: /
            Method: GET

  OrchestratorStateMachine:
    Type: AWS::StepFunctions::StateMachine
    Properties:
      DefinitionString:
        !Sub
          - |-
            {
              "Comment": "Orchestrator State Machine, trivial",
              "StartAt": "FirstFunction",
              "States": {
                "FifthFunction": {
                  "Next": "FifthWait",
                  "Resource": "${FifthFunction}",
                  "Type": "Task"
                },
                "FifthWait": {
                  "Next": "SixthFunction",
                  "Resource": "${FifthWait}",
                  "Type": "Task",
                  "Retry" : [
                      {
                        "ErrorEquals": [ "States.TaskFailed" ],
                        "IntervalSeconds": 6,
                        "MaxAttempts": 60,
                        "BackoffRate": 1.1
                      }
                  ]
                },
                "FirstFunction": {
                  "Next": "FirstWait",
                  "Resource": "${FirstFunction}",
                  "Type": "Task"
                },
                "FirstWait": {
                  "Next": "SecondFunction",
                  "Resource": "${FirstWait}",
                  "Type": "Task",
                  "Retry" : [
                      {
                        "ErrorEquals": [ "States.TaskFailed" ],
                        "IntervalSeconds": 6,
                        "MaxAttempts": 60,
                        "BackoffRate": 1.1
                      }
                  ]
                },
                "FourthFunction": {
                  "Next": "FifthFunction",
                  "Resource": "${FourthFunction}",
                  "Type": "Task"
                },
                "SecondFunction": {
                  "Next": "ThirdFunction",
                  "Resource": "${SecondFunction}",
                  "Type": "Task"
                },
                "SixthFunction": {
                  "End": true,
                  "Resource": "${SixthFunction}",
                  "Type": "Task"
                },
                "ThirdFunction": {
                  "Next": "ThirdWait",
                  "Resource": "${ThirdFunction}",
                  "Type": "Task"
                },
                "ThirdWait": {
                  "Next": "FourthFunction",
                  "Resource": "${ThirdWait}",
                  "Type": "Task",
                  "Retry" : [
                      {
                        "ErrorEquals": [ "States.TaskFailed" ],
                        "IntervalSeconds": 6,
                        "MaxAttempts": 60,
                        "BackoffRate": 1.1
                      }
                  ]
                }
              }
            }
          - {
                FirstFunction: !GetAtt [FirstFunction, Arn],
                SecondFunction: !GetAtt [SecondFunction, Arn],
                ThirdFunction: !GetAtt [ThirdFunction, Arn],
                FourthFunction: !GetAtt [FourthFunction, Arn],
                FifthFunction: !GetAtt [FifthFunction, Arn],
                SixthFunction: !GetAtt [SixthFunction, Arn],
                FirstWait: !GetAtt [FirstWait, Arn],
                ThirdWait: !GetAtt [ThirdWait, Arn],
                FifthWait: !GetAtt [FifthWait, Arn]
            }
      RoleArn: !Sub arn:aws:iam::${AWS::AccountId}:role/service-role/StatesExecutionRole-${AWS::Region}

  SwapperFunctionRole:
    Type: AWS::IAM::Role
    Properties:
      ManagedPolicyArns:
      - arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
        - Effect: Allow
          Sid: 'Lambda'
          Principal:
            Service:
            - lambda.amazonaws.com
          Action:
            - sts:AssumeRole
      Path: "/cfn/"
      Policies:
      - PolicyName: UpdateCFNThings
        PolicyDocument:
          Statement:
          - Effect: Allow
            Action:
                - 'cloudformation:DescribeStacks'
                - 'cloudformation:GetTemplate'
                - 'cloudformation:UpdateStack'
                - 'lambda:GetFunctionConfiguration'
                - 'route53:ListHostedZones'
                - 'route53:GetChange'
            Resource: '*'
          - Effect: Allow
            Action:
                - 'apigateway:GET'
                - 'apigateway:DELETE'
            Resource:
                - !Sub 'arn:aws:apigateway:${AWS::Region}::/domainnames/${PrimaryUrl}'
                - !Sub 'arn:aws:apigateway:${OtherStackRegion}::/domainnames/${PrimaryUrl}'
                - !Sub 'arn:aws:apigateway:${AWS::Region}::/domainnames/${StandbyUrl}'
                - !Sub 'arn:aws:apigateway:${OtherStackRegion}::/domainnames/${StandbyUrl}'
                - !Sub 'arn:aws:apigateway:${AWS::Region}::/domainnames/${TransitionalUrl}'
                - !Sub 'arn:aws:apigateway:${OtherStackRegion}::/domainnames/${TransitionalUrl}'
          - Effect: Allow
            Action:
                - 'apigateway:POST'
            Resource:
                - !Sub 'arn:aws:apigateway:${AWS::Region}::/domainnames'
                - !Sub 'arn:aws:apigateway:${OtherStackRegion}::/domainnames'
                - !Sub 'arn:aws:apigateway:${AWS::Region}::/domainnames/${PrimaryUrl}/basepathmappings'
                - !Sub 'arn:aws:apigateway:${OtherStackRegion}::/domainnames/${PrimaryUrl}/basepathmappings'
                - !Sub 'arn:aws:apigateway:${AWS::Region}::/domainnames/${StandbyUrl}/basepathmappings'
                - !Sub 'arn:aws:apigateway:${OtherStackRegion}::/domainnames/${StandbyUrl}/basepathmappings'
                - !Sub 'arn:aws:apigateway:${AWS::Region}::/domainnames/${TransitionalUrl}/basepathmappings'
                - !Sub 'arn:aws:apigateway:${OtherStackRegion}::/domainnames/${TransitionalUrl}/basepathmappings'
          - Effect: Allow
            Action:
                - 'apigateway:DELETE'
            Resource:
                - !Sub 'arn:aws:apigateway:${AWS::Region}::/domainnames/${PrimaryUrl}/basepathmappings/*'
                - !Sub 'arn:aws:apigateway:${OtherStackRegion}::/domainnames/${PrimaryUrl}/basepathmappings/*'
                - !Sub 'arn:aws:apigateway:${AWS::Region}::/domainnames/${StandbyUrl}/basepathmappings/*'
                - !Sub 'arn:aws:apigateway:${OtherStackRegion}::/domainnames/${StandbyUrl}/basepathmappings/*'
                - !Sub 'arn:aws:apigateway:${AWS::Region}::/domainnames/${TransitionalUrl}/basepathmappings/*'
                - !Sub 'arn:aws:apigateway:${OtherStackRegion}::/domainnames/${TransitionalUrl}/basepathmappings/*'
          - Effect: Allow
            Action:
                - 'lambda:InvokeFunction'
            Resource:
                # Too broad, remove wildcard somehow?
                # Just needs permissions to invoke the Custom CFN function in
                # the existing stack
                - !Sub 'arn:aws:lambda:${AWS::Region}:${AWS::AccountId}:function:*'
                - !Sub 'arn:aws:lambda:${OtherStackRegion}:${AWS::AccountId}:function:*'
          - Effect: Allow
            Action:
                - 'route53:ChangeResourceRecordSets'
            Resource:
                # Too broad, remove wildcard somehow?
                - 'arn:aws:route53:::hostedzone/*'
          - Effect: Allow
            Action:
                - 'cloudfront:UpdateDistribution'
            Resource:
                # This is crazy broad but needed to update a
                # AWS::ApiGateway::CustomDomain resource?!?
                - '*'


  KickerFunction:
    Type: AWS::Serverless::Function
    Properties:
      # I don't like hardcoding names but it is required for cross-region references
      FunctionName: apigw-multiregion-lambda-backend-swap
      Handler: swap.kicker
      Runtime: python3.6
      Timeout: 300
      CodeUri:
        Bucket: !Ref Bucket
        Key: !Ref md5
      Environment:
        Variables:
          StateMachineArn: !Ref OrchestratorStateMachine
          CoolDownTableName: !Ref MultiRegionCoolDownTable
          PingerAlarmName: !Ref PingerFunctionAlarm
      Policies:
        - Statement:
            Effect: Allow
            Action:
              - 'states:StartExecution'
            Resource:
              - !Ref OrchestratorStateMachine
        - Statement:
            Effect: Allow
            Action:
                - 'dynamodb:Scan'
                - 'dynamodb:PutItem'
            Resource:
                - !Sub "arn:aws:dynamodb:${AWS::Region}:${AWS::AccountId}:table/${MultiRegionCoolDownTable}"
        - Statement:
            Effect: Allow
            Action:
                - 'cloudwatch:DescribeAlarms'
            Resource:
                - '*'

  FirstFunction:
    Type: AWS::Serverless::Function
    Properties:
      Handler: swap.FirstFunction
      Runtime: python3.6
      Timeout: 300
      CodeUri:
        Bucket: !Ref Bucket
        Key: !Ref md5
      Environment:
        Variables:
          MyInfraStackName: !Ref MyInfraStackName
          TransitionalUrl: !Ref TransitionalUrl
      Role: !GetAtt SwapperFunctionRole.Arn
  SecondFunction:
    Type: AWS::Serverless::Function
    Properties:
      Handler: swap.SecondFunction
      Runtime: python3.6
      Timeout: 300
      CodeUri:
        Bucket: !Ref Bucket
        Key: !Ref md5
      Environment:
        Variables:
          MyPingPongStackName: !Sub ${AWS::StackName}
          TransitionalUrl: !Ref TransitionalUrl
      Role: !GetAtt SwapperFunctionRole.Arn
  ThirdFunction:
    Type: AWS::Serverless::Function
    Properties:
      Handler: swap.ThirdFunction
      Runtime: python3.6
      Timeout: 300
      CodeUri:
        Bucket: !Ref Bucket
        Key: !Ref md5
      Environment:
        Variables:
          OtherInfraStackName: !Ref OtherInfraStackName
          StandbyUrl: !Ref StandbyUrl
          OtherStackRegion: !Ref OtherStackRegion
      Role: !GetAtt SwapperFunctionRole.Arn
  FourthFunction:
    Type: AWS::Serverless::Function
    Properties:
      Handler: swap.FourthFunction
      Runtime: python3.6
      Timeout: 300
      CodeUri:
        Bucket: !Ref Bucket
        Key: !Ref md5
      Environment:
        Variables:
          OtherPingPongStackName: !Ref OtherPingPongStackName
          StandbyUrl: !Ref StandbyUrl
          OtherStackRegion: !Ref OtherStackRegion
      Role: !GetAtt SwapperFunctionRole.Arn
  FifthFunction:
    Type: AWS::Serverless::Function
    Properties:
      Handler: swap.FifthFunction
      Runtime: python3.6
      Timeout: 300
      CodeUri:
        Bucket: !Ref Bucket
        Key: !Ref md5
      Environment:
        Variables:
          MyInfraStackName: !Ref MyInfraStackName
          PrimaryUrl: !Ref PrimaryUrl
      Role: !GetAtt SwapperFunctionRole.Arn
  SixthFunction:
    Type: AWS::Serverless::Function
    Properties:
      Handler: swap.SixthFunction
      Runtime: python3.6
      Timeout: 300
      CodeUri:
        Bucket: !Ref Bucket
        Key: !Ref md5
      Environment:
        Variables:
          MyPingPongStackName: !Sub ${AWS::StackName}
          PrimaryUrl: !Ref PrimaryUrl
      Role: !GetAtt SwapperFunctionRole.Arn
  FirstWait:
    Type: AWS::Serverless::Function
    Properties:
      Handler: swap.FirstWait
      Runtime: python3.6
      Timeout: 300
      CodeUri:
        Bucket: !Ref Bucket
        Key: !Ref md5
      Environment:
        Variables:
          OtherInfraStackName: !Ref OtherInfraStackName
          OtherPingPongStackName: !Ref OtherPingPongStackName
          MyInfraStackName: !Ref MyInfraStackName
          MyPingPongStackName: !Sub ${AWS::StackName}
          PrimaryUrl: !Ref PrimaryUrl
          StandbyUrl: !Ref StandbyUrl
          TransitionalUrl: !Ref TransitionalUrl
          OtherStackRegion: !Ref OtherStackRegion
          CoolDownTableName: !Ref MultiRegionCoolDownTable
      Role: !GetAtt SwapperFunctionRole.Arn
  ThirdWait:
    Type: AWS::Serverless::Function
    Properties:
      Handler: swap.ThirdWait
      Runtime: python3.6
      Timeout: 300
      CodeUri:
        Bucket: !Ref Bucket
        Key: !Ref md5
      Environment:
        Variables:
          OtherInfraStackName: !Ref OtherInfraStackName
          OtherPingPongStackName: !Ref OtherPingPongStackName
          MyInfraStackName: !Ref MyInfraStackName
          MyPingPongStackName: !Sub ${AWS::StackName}
          PrimaryUrl: !Ref PrimaryUrl
          StandbyUrl: !Ref StandbyUrl
          TransitionalUrl: !Ref TransitionalUrl
          OtherStackRegion: !Ref OtherStackRegion
          CoolDownTableName: !Ref MultiRegionCoolDownTable
      Role: !GetAtt SwapperFunctionRole.Arn
  FifthWait:
    Type: AWS::Serverless::Function
    Properties:
      Handler: swap.FifthWait
      Runtime: python3.6
      Timeout: 300
      CodeUri:
        Bucket: !Ref Bucket
        Key: !Ref md5
      Environment:
        Variables:
          OtherInfraStackName: !Ref OtherInfraStackName
          OtherPingPongStackName: !Ref OtherPingPongStackName
          MyInfraStackName: !Ref MyInfraStackName
          MyPingPongStackName: !Sub ${AWS::StackName}
          PrimaryUrl: !Ref PrimaryUrl
          StandbyUrl: !Ref StandbyUrl
          TransitionalUrl: !Ref TransitionalUrl
          OtherStackRegion: !Ref OtherStackRegion
          CoolDownTableName: !Ref MultiRegionCoolDownTable
      Role: !GetAtt SwapperFunctionRole.Arn


  AlarmSNS:
    Type: AWS::SNS::Topic

  PongerFunctionAlarm:
    Type: "AWS::CloudWatch::Alarm"
    Properties:
      ActionsEnabled: true
      AlarmDescription: Checks for number of pong invokes
      AlarmActions: [ !Ref AlarmSNS ]
      ComparisonOperator: LessThanThreshold
      Dimensions:
        - Name: FunctionName
          Value: !Ref PongerFunction
      EvaluationPeriods: 1
      MetricName: Invocations
      Namespace: AWS/Lambda
      Period: 60
      Statistic: Sum
      Threshold: 1
      TreatMissingData: breaching
      Unit: Count

  PingerFunctionAlarm:
    Type: "AWS::CloudWatch::Alarm"
    Properties:
      ActionsEnabled: false
      AlarmDescription: Checks for number of ping invokes
      ComparisonOperator: LessThanThreshold
      Dimensions:
        - Name: FunctionName
          Value: !Ref PingerFunction
      EvaluationPeriods: 1
      MetricName: Invocations
      Namespace: AWS/Lambda
      Period: 60
      Statistic: Sum
      Threshold: 1
      TreatMissingData: breaching
      Unit: Count

  PongerPathMapping:
    Type: "AWS::ApiGateway::BasePathMapping"
    Properties:
      BasePath: ting # careful /ping is a reserved endpoint
      DomainName: !Ref DomainName
      RestApiId: !Ref ServerlessRestApi
      Stage: !Ref ServerlessRestApiProdStage # "Prod"

  PingerFunction:
    Type: AWS::Serverless::Function
    Properties:
      Handler: pinger.handler
      Runtime: python3.6
      Timeout: 2
      CodeUri:
        Bucket: !Ref Bucket
        Key: !Ref md5
      Environment:
        Variables:
          PrimaryUrl: !Ref PrimaryUrl
      Events:
        Cron:
          Type: Schedule
          Properties:
              Schedule: !FindInMap [RegionMap, !Ref 'AWS::Region', cron]