streaming-support.yaml

AWSTemplateFormatVersion: '2010-09-09'
Transform: AWS::Serverless-2016-10-31

Description: >
  This template deploys the api with api gateway to initiate a web socket connection for streaming use cases

Parameters:
    ParentStackName:
      Type: String
      Description: Parent Stack Name
      Default: lex-web-ui-stack

    SourceBucket:
      Description: S3 bucket where the source is located
      Type: String
      Default: aws-bigdata-blog

    StreamingLambdaCodeObject:
      Type: String
      Description: >
          S3 object zip file containing Lambda initiate chat functions
      Default: artifacts/aws-lex-web-ui/artifacts/streaming-lambda.zip
    
    TableName:
      Description: DynamoDB Table Name
      Type: String
      Default: streaming-chat-table
    
    ParentOrigin:
      Type: String
      Description: >
          Parent Origin for CORS allow-origin

    VpcSubnetId:
        Type: String
        Default: ''
        Description: ID of a VPC subnet where all Lambda functions will run, only used if you need Lambda to run in a VPC

    VpcSecurityGroupId:
        Type: String
        Default: ''
        Description: ID of a security group where all Lambda functions will run, only used if you need Lambda to run in a VPC

Conditions:
    NeedsVpc:  !And [ !Not [ !Equals [!Ref VpcSubnetId, ''] ], !Not [ !Equals [!Ref VpcSecurityGroupId, ''] ] ] 

Resources:

  #### Lambda #####
  
  StreamingLambda:
    Type: "AWS::Lambda::Function"   
    Properties:
      VpcConfig:
        !If
        - NeedsVpc
        - 
            SecurityGroupIds:
              - !Ref VpcSecurityGroupId
            SubnetIds:
              - !Ref VpcSubnetId
        - !Ref "AWS::NoValue"
      Description:  AWS Lambda Function to initiate web socket connection for streaming
      Handler: "index.handler"
      Role: !GetAtt StreamingLambdaExecutionRole.Arn
      Runtime: "nodejs18.x"
      MemorySize: 128
      Timeout: 30
      Environment:
        Variables:
          TABLE_NAME: !Ref TableName
      Code:
        S3Bucket: !Ref SourceBucket
        S3Key: !Ref StreamingLambdaCodeObject

  StreamingLambdaExecutionRole:
    Type: "AWS::IAM::Role"
    Properties:
      ManagedPolicyArns:
        !If 
          - NeedsVpc
          -
            - "arn:aws:iam::aws:policy/service-role/AWSLambdaVPCAccessExecutionRole"
          - !Ref "AWS::NoValue"
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: "Allow"
            Principal:
              Service:
                - "lambda.amazonaws.com"
            Action:
              - "sts:AssumeRole"
      Path: "/"
      Policies:
        - PolicyName: streaming-execution-policy
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Effect: "Allow"
                Action:
                  - 'logs:CreateLogGroup'
                  - 'logs:CreateLogStream'
                  - 'logs:PutLogEvents'
                Resource:
                  - !Sub "arn:${AWS::Partition}:logs:${AWS::Region}:${AWS::AccountId}:log-group:/aws/lambda/*"
              - Effect: "Allow"
                Action:
                  - "dynamodb:PutItem"
                Resource:
                  - !Sub "arn:${AWS::Partition}:dynamodb:${AWS::Region}:${AWS::AccountId}:table/${TableName}"

  StreamingLambdaInvokePermission:
    Type: AWS::Lambda::Permission
    Properties:
      FunctionName: !Ref StreamingLambda
      Action: "lambda:InvokeFunction"
      Principal: apigateway.amazonaws.com
      SourceArn: 
        Fn::Sub:
            arn:${AWS::Partition}:execute-api:${AWS::Region}:${AWS::AccountId}:${StreamingWebSocket}/*

  #### DynamoDB #####

  ConnectionsTable:
    Type: AWS::DynamoDB::Table
    Properties:
      AttributeDefinitions:
      - AttributeName: "sessionId"
        AttributeType: "S"
      KeySchema:
      - AttributeName: "sessionId"
        KeyType: "HASH"
      BillingMode: PAY_PER_REQUEST
      SSESpecification:
        SSEEnabled: True
      TableName: !Ref TableName
      TimeToLiveSpecification:
        AttributeName: ttl
        Enabled: true

  #### API Gateway #####

  StreamingWebSocket:
    Type: AWS::ApiGatewayV2::Api
    Properties:
      Name: !Join ["-", [!Ref ParentStackName, "Streaming-API"]]
      ProtocolType: WEBSOCKET
      RouteSelectionExpression: "$request.body.action"

  ConnectRoute:
    Type: AWS::ApiGatewayV2::Route
    Properties:
      ApiId: !Ref StreamingWebSocket
      RouteKey: $connect
      AuthorizationType: "AWS_IAM"
      OperationName: ConnectRoute
      Target: !Join
        - '/'
        - - 'integrations'
          - !Ref ConnectInteg

  ConnectInteg:
    Type: AWS::ApiGatewayV2::Integration
    Properties:
      ApiId: !Ref StreamingWebSocket
      Description: Connect Integration
      IntegrationType: AWS_PROXY
      IntegrationUri: 
        Fn::Sub:
            arn:aws:apigateway:${AWS::Region}:lambda:path/2015-03-31/functions/${StreamingLambda.Arn}/invocations    
  
  PingRoute:
    Type: AWS::ApiGatewayV2::Route
    Properties:
      ApiId: !Ref StreamingWebSocket
      RouteKey: ping
      OperationName: PingRoute
      Target: !Join
        - '/'
        - - 'integrations'
          - !Ref PingIntegration

  PingIntegration:
    Type: AWS::ApiGatewayV2::Integration
    Properties:
      ApiId: !Ref StreamingWebSocket
      Description: Ping Integration
      IntegrationType: MOCK
      PassthroughBehavior: WHEN_NO_MATCH
      RequestTemplates:
        application/json: '{"statusCode":200}'


  Deployment:
    Type: AWS::ApiGatewayV2::Deployment
    DependsOn:
    - ConnectRoute
    - PingRoute
    Properties:
      ApiId: !Ref StreamingWebSocket

  Stage:
    Type: AWS::ApiGatewayV2::Stage
    Properties:
      StageName: Prod
      Description: Prod Stage
      DeploymentId: !Ref Deployment
      ApiId: !Ref StreamingWebSocket

  UsagePlan:
    Type: AWS::ApiGateway::UsagePlan
    Properties:
      ApiStages: 
      - ApiId: !Ref StreamingWebSocket
        Stage: !Ref Stage
      Quota: 
        Limit: 1000
        Period: DAY
      Throttle: 
        BurstLimit: 10
        RateLimit: 5
      UsagePlanName: !Join ["-", [!Ref ParentStackName, "API-Usage-Plan"]]
      
  ApiKey:
    Type: 'AWS::ApiGateway::ApiKey'
    Properties:
      Name: !Join ["-", [!Ref ParentStackName, "StreamingApiKey"]]
      Enabled: 'true'
  
  UsagePlanKey:
    Type: 'AWS::ApiGateway::UsagePlanKey'
    Properties:
      KeyId: !Ref ApiKey
      KeyType: API_KEY
      UsagePlanId: !Ref UsagePlan

Outputs:
  WebSocketId:
    Description: "The WSS ID to connect to"
    Value: !Ref StreamingWebSocket

  DynamoTableName:
    Value: !Ref TableName
    Description: "DynamoDB table name"