template.yml

Transform: AWS::Serverless-2016-10-31
Parameters:
  environment:
    Type: AWS::SSM::Parameter::Value<String>
    Default: environment
  prefix:
    Type: AWS::SSM::Parameter::Value<String>
    Default: prefix
  subnetA:
    Type: AWS::SSM::Parameter::Value<String>
    Default: /subnet/private/a
  subnetB:
    Type: AWS::SSM::Parameter::Value<String>
    Default: /subnet/private/b
  vpc:
    Type: AWS::SSM::Parameter::Value<String>
    Default: vpc

  AppName:
    Description: Name of Application
    Type: String
    Default: ede-apis
Globals:
  Function:
    MemorySize: 128
    Handler: lambda_handler.index
    Runtime: python3.9
    Timeout: 20
    Environment:
      Variables:
        REGION:  !Ref "AWS::Region"



Resources:
##########################################################################
#  API Gateway HTTP API                                                  #
##########################################################################
#  StatusHttpApi:
#    Type: 'AWS::ApiGatewayV2::Api'
#    Properties:
#      Name: !Ref AppName
#      Description: An Amazon API Gateway HTTP API and an AWS Lambda function.
#      ProtocolType: HTTP
#      CorsConfiguration:
#        AllowOrigins:
#          - '*'
#        AllowMethods:
#          - GET
#      Target: !GetAtt StatusAPIFunction.Arn
#
#  StatusRoute:
#    Type: AWS::ApiGatewayV2::Route
#    Properties:
#      ApiId: !Ref StatusHttpApi
#      RouteKey: 'GET  /status'

#  BasicAWSApiGateway:
#    Type: AWS::Serverless::Api
#    Properties:
#      Name: Basic AWS Api Gateway
#      StageName: Staging
#
###########################################################################
##   Lambda Function                                                      #
###########################################################################
#  StatusAPIFunction:
#    Type: 'AWS::Serverless::Function'
#    Properties:
#      Handler: index.lambda_entrypoint
#      CodeUri: ./src/apis/status-api/
#      Role: !GetAtt LambdaRole.Arn
#      VpcConfig:
#        SecurityGroupIds:
#          - !Ref LambdaSG
#        SubnetIds:
#          - !Ref subnetB
#          - !Ref subnetA
#      Events:
#        HelloWorldApi:
#          Type: Api
#          Properties:
#            RestApiId: !Ref BasicAWSApiGateway
#            Path:  /v1/ede/status
#            Method: GET
#  # Function permissions grant an AWS service or another account permission to use a function
#  FunctionResourcePermission:
#    Type: 'AWS::Lambda::Permission'
#    Properties:
#      Action: 'lambda:InvokeFunction'
#      Principal: apigateway.amazonaws.com
#      FunctionName: !Ref StatusAPIFunction
#      SourceArn: !Sub 'arn:aws:execute-api:${AWS::Region}:${AWS::AccountId}:${BasicAWSApiGateway}/*'

##########################################################################
#  CloudFront::CachePolicy                                               #
##########################################################################
#  3hCachePolicy:
#    Type: AWS::CloudFront::CachePolicy
#    Properties:
#      CachePolicyConfig:
#        Comment: Cache for 3h
#        Name: !Ref AWS::StackName
#        DefaultTTL: 600
#        MaxTTL: 10800
#        MinTTL: 600
#        ParametersInCacheKeyAndForwardedToOrigin:
#          CookiesConfig:
#            CookieBehavior: none
#          EnableAcceptEncodingBrotli: false
#          EnableAcceptEncodingGzip: false
#          HeadersConfig:
#            HeaderBehavior: whitelist
#            Headers:
#              - x-forwarded-for
#          QueryStringsConfig:
#            QueryStringBehavior: whitelist
#            QueryStrings:
#              - allowed_query_string_param
#
###########################################################################
##  CloudFront::Distribution                                              #
###########################################################################
#  CloudfrontDistribution:
#    Type: AWS::CloudFront::Distribution
#    Properties:
#      DistributionConfig:
#        PriceClass: PriceClass_100
#        IPV6Enabled: true
#        HttpVersion: http2
#        Origins:
#          - Id: MyOrigin
#            DomainName: !Sub "${AppName }.execute-api.${AWS::Region}.amazonaws.com"
#            OriginPath: /ede
#            CustomOriginConfig:
#              HTTPSPort: 443
#              OriginProtocolPolicy: https-only
#              OriginSSLProtocols:
#                - TLSv1.2
#        Enabled: true
#        DefaultCacheBehavior:
#          AllowedMethods:
#            - GET
#            - HEAD
#          CachedMethods:
#            - GET
#            - HEAD
#          Compress: true
#          TargetOriginId: MyOrigin
#          ViewerProtocolPolicy: redirect-to-https
#          CachePolicyId: !Ref 3hCachePolicy

#### What gets deployed:
# Lambda on a 15m schedule that checks for new smart contract events
# Other required SSM parameters:
# (RPC endpoint)
#   /ede/config/mainnet
#   /ede/config/gnosis
# (Contract watching)
#       /ede/tasks/mainnet/<ContractName>/<Event>/<ContractAddress>
#   Example:
#       /ede/tasks/mainnet/ProofOfHumanity/AddSubmission/0xC5E9dDebb09Cd64DfaCab4011A0D5cEDaf7c9BDb
#   This watches a ProofOfHumanity contract at 0xC5..
#   todo: implement smart contract version management
# See README for further configuration

  Bucket:
    Type: AWS::S3::Bucket
    Properties:
      BucketName: !Sub ${prefix}-${environment}-events

  ABITable:
    Type: AWS::Serverless::SimpleTable
    Properties:
      TableName: !Sub ${prefix}-${environment}-abi

  SNSTopic:
    Type: AWS::SNS::Topic
    Properties:
      TopicName: !Sub ${prefix}-${environment}-beat

  txListenerMainnet:
    Type: AWS::Serverless::Function
    Properties:
      Environment:
        Variables:
          TABLE: !Ref ABITable
          BUCKET: !Ref Bucket
          REGION: !Ref AWS::Region
          SNS: !Ref SNSTopic
          network: "mainnet"
          provider: "infura"
      FunctionName: !Sub ${prefix}-${environment}-mainnet-listener
      Handler: index.lambda_entrypoint
      Runtime: python3.9
      MemorySize: 1028
      CodeUri: ./src/event-driven-ethereum
      Timeout: 360
      Events:
        InvocationLevel:
          Type: Schedule
          Properties:
            Schedule: 'rate(15 minutes)'
      Role: !GetAtt LambdaRole.Arn
      VpcConfig:
        SecurityGroupIds:
          - !Ref LambdaSG
        SubnetIds:
          - !Ref subnetB
          - !Ref subnetA

  txListenerGnosis:
    Type: AWS::Serverless::Function
    Properties:
      Environment:
        Variables:
          TABLE: !Ref ABITable
          BUCKET: !Ref Bucket
          REGION: !Ref AWS::Region
          SNS: !Ref SNSTopic
          network: "gnosis"
      FunctionName: !Sub ${prefix}-${environment}-gnosis-listener
      Handler: index.lambda_entrypoint
      Runtime: python3.9
      MemorySize: 1028
      CodeUri: ./src/event-driven-ethereum
      Timeout: 360
      Events:
        InvocationLevel:
          Type: Schedule
          Properties:
            Schedule: 'rate(15 minutes)'
      Role: !GetAtt LambdaRole.Arn
      VpcConfig:
        SecurityGroupIds:
          - !Ref LambdaSG
        SubnetIds:
          - !Ref subnetB
          - !Ref subnetA

  txListenerArbitrumRinkeby:
    Type: AWS::Serverless::Function
    Properties:
      Environment:
        Variables:
          TABLE: !Ref ABITable
          BUCKET: !Ref Bucket
          REGION: !Ref AWS::Region
          SNS: !Ref SNSTopic
          network: "arbitrum-rinkeby"
      FunctionName: !Sub ${prefix}-${environment}-arb-rinkeby-listener
      Handler: index.lambda_entrypoint
      Runtime: python3.9
      MemorySize: 1028
      CodeUri: ./src/event-driven-ethereum
      Timeout: 360
      Events:
        InvocationLevel:
          Type: Schedule
          Properties:
            Schedule: 'rate(15 minutes)'
      Role: !GetAtt LambdaRole.Arn
      VpcConfig:
        SecurityGroupIds:
          - !Ref LambdaSG
        SubnetIds:
          - !Ref subnetB
          - !Ref subnetA

  LambdaSG:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: txListener
      VpcId: !Ref vpc
      SecurityGroupEgress:
        - IpProtocol: tcp
          FromPort: 80
          ToPort: 8545
          CidrIp: 0.0.0.0/0

  LambdaRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - lambda.amazonaws.com
            Action:
              - 'sts:AssumeRole'
      Path: /
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole
      Policies:
        - PolicyName: root
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Effect: Allow
                Action:
                - ec2:CreateNetworkInterface
                - ssm:GetParameter*
                - ec2:DescribeNetworkInterfaces
                - ec2:DeleteNetworkInterface
                - ssm:ListTagsForResource
                - events:ListRules
                - events:Put*
                - sns:Publish
                - sqs:SendMessage
                Resource: '*'
              - Effect: Allow
                Action:
                - ssm:*
                Resource: 'arn:aws:ssm:*:*:parameter/ede/*'
              - Effect: Allow
                Action:
                - dynamodb:*  # FIX ME // NARROW SCOPE
                #Resource: !Sub "arn:aws:dynamodb:*:*:table/${ABITable}"
                Resource: !Sub "arn:aws:dynamodb:*:*:table/*"
              - Effect: Allow
                Action:
                - s3:PutObject
                - s3:PutObjectAcl
                - s3:GetObjectAcl
                - s3:ListBucket
                - s3:GetBucketLocation
                Resource: !Sub "arn:aws:s3:::${Bucket}/*"
              - Effect: Allow
                Action:
                - s3:ListBucket
                Resource: !Sub "arn:aws:s3:::${Bucket}"


#Outputs:
#  StatusHttpApiEndpoint:
#    Description: The default endpoint for the HTTP API.
#    Value: !GetAtt StatusHttpApi.ApiEndpoint
#  DistributionDomainName:
#    Description: "Distribution domain name"
#    Value: !GetAtt CloudfrontDistribution.DomainName
#    Export:
#      Name: DistributionDomainName