serverless.yaml

#
#  Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
#  SPDX-License-Identifier: Apache-2.0
#

service: fhir-service

custom:
  oldResourceTableName: 'resource-${self:custom.stage}'
  resourceTableName: 'resource-db-${self:custom.stage}'
  exportRequestTableName: 'export-request-${self:custom.stage}'
  exportRequestTableJobStatusIndex: 'jobStatus-index'
  stage: ${opt:stage, self:provider.stage}
  region: ${opt:region, self:provider.region}
  oauthRedirect: ${opt:oauthRedirect, 'http://localhost'}
  config: ${file(serverless_config.json)}
  useHapiValidator: ${opt:useHapiValidator, 'false'}
  bundle:
    externals:
      - fhir-works-on-aws-routing
    packager: yarn
    copyFiles: # Copy any additional files to the generated package
      - from: 'bulkExport/glueScripts/export-script.py'
        to: './bulkExport/glueScripts/export-script.py'
      - from: 'compiledImplementationGuides/*'
        to: './'

provider:
  name: aws
  region: us-west-2
  stage: dev
  runtime: nodejs12.x
  memorySize: 512
  logRetentionInDays: 3653 # 10 years
  stackTags:
    FHIR_SERVICE: 'fhir-service-${self:custom.region}-${self:custom.stage}'
  environment:
    API_URL:
      !Join ['', ['https://', !Ref ApiGatewayRestApi, !Sub '.execute-api.${AWS::Region}.amazonaws.com/', !Ref Stage]]
    S3_KMS_KEY: !Ref S3KMSKey
    RESOURCE_TABLE: '${self:custom.resourceTableName}'
    EXPORT_REQUEST_TABLE: '${self:custom.exportRequestTableName}'
    EXPORT_REQUEST_TABLE_JOB_STATUS_INDEX: '${self:custom.exportRequestTableJobStatusIndex}'
    FHIR_BINARY_BUCKET: !Ref FHIRBinaryBucket
    ELASTICSEARCH_DOMAIN_ENDPOINT: !Join ['', ['https://', !GetAtt ElasticSearchDomain.DomainEndpoint]]
    OAUTH2_DOMAIN_ENDPOINT:
      !Join ['', ['https://', !Ref UserPoolDomain, !Sub '.auth.${AWS::Region}.amazoncognito.com/oauth2']]
    EXPORT_RESULTS_BUCKET: !Ref BulkExportResultsBucket
    EXPORT_RESULTS_SIGNER_ROLE_ARN: !GetAtt ExportResultsSignerRole.Arn
    CUSTOM_USER_AGENT: 'AwsLabs/SO0128/2.6.0'
    VALIDATOR_LAMBDA_ALIAS:
      !If
        - isUsingHapiValidator
        - Fn::ImportValue: "fhir-service-validator-lambda-${self:custom.stage}"
        - !Ref AWS::NoValue
  apiKeys:
    - name: 'developer-key-${self:custom.stage}' # Full name must be known at package-time
      description: Key for developer to access the FHIR Api
  usagePlan:
    throttle:
      burstLimit: 100 # maximum API request rate limit over a time ranging from one to a few seconds
      rateLimit: 50 # average requests per second over an extended period of time
  variableSyntax: "\\${((?!AWS)[ ~:a-zA-Z0-9._@'\",\\-\\/\\(\\)]+?)}" # Use this for allowing CloudFormation Pseudo-Parameters in your serverless.yml
  logs:
    restApi:
      format: '{"authorizer.claims.sub":"$context.authorizer.claims.sub","error.message":"$context.error.message","extendedRequestId":"$context.extendedRequestId","httpMethod":"$context.httpMethod","identity.sourceIp":"$context.identity.sourceIp","integration.error":"$context.integration.error","integration.integrationStatus":"$context.integration.integrationStatus","integration.latency":"$context.integration.latency","integration.requestId":"$context.integration.requestId","integration.status":"$context.integration.status","path":"$context.path","requestId":"$context.requestId","responseLatency":"$context.responseLatency","responseLength":"$context.responseLength","stage":"$context.stage","status":"$context.status"}'
      executionLogging: false
  tracing:
    apiGateway: true
    lambda: true

functions:
  fhirServer:
    timeout: 40
    description: 'FHIR API Server'
    role: FhirServerLambdaRole
    events:
      - http:
          authorizer:
            type: COGNITO_USER_POOLS
            authorizerId: !Ref ApiGatewayAuthorizer
            scopes: # must have both scopes
              - 'openid'
              - 'profile'
              - 'aws.cognito.signin.user.admin'
          method: ANY
          path: /
          private: true
      - http:
          authorizer:
            type: COGNITO_USER_POOLS
            authorizerId: !Ref ApiGatewayAuthorizer
            scopes: # must have both scopes
              - 'openid'
              - 'profile'
              - 'aws.cognito.signin.user.admin'
          method: ANY
          path: '{proxy+}'
          private: true
      - http:
          method: GET
          path: /metadata
    handler: src/index.default
    provisionedConcurrency: 5
    environment:
      EXPORT_STATE_MACHINE_ARN: !Ref BulkExportStateMachine

  ddbToEs:
    timeout: 300
    runtime: nodejs12.x
    description: 'Write DDB changes from `resource` table to ElasticSearch service'
    role: DdbToEsLambdaRole
    handler: ddbToEsLambda/index.handler
    events:
      - stream:
          type: dynamodb
          arn: !GetAtt ResourceDynamoDBTableV2.StreamArn
          batchSize: 100
          maximumRetryAttempts: 3
          startingPosition: LATEST

  startExportJob:
    timeout: 30
    memorySize: 192
    runtime: nodejs12.x
    description: 'Start the Glue job for bulk export'
    role: GlueJobRelatedLambdaRole
    handler: bulkExport/index.startExportJobHandler
    environment:
      GLUE_JOB_NAME: !Ref ExportGlueJob

  stopExportJob:
    timeout: 30
    memorySize: 192
    runtime: nodejs12.x
    description: 'Stop the Glue job for bulk export'
    role: GlueJobRelatedLambdaRole
    handler: bulkExport/index.stopExportJobHandler
    environment:
      GLUE_JOB_NAME: !Ref ExportGlueJob

  getJobStatus:
    timeout: 30
    memorySize: 192
    runtime: nodejs12.x
    description: 'Get the status of a Glue job run for bulk export'
    role: GlueJobRelatedLambdaRole
    handler: bulkExport/index.getJobStatusHandler
    environment:
      GLUE_JOB_NAME: !Ref ExportGlueJob

  updateStatus:
    timeout: 30
    memorySize: 192
    runtime: nodejs12.x
    description: 'Update the status of a bulk export job'
    role: UpdateStatusLambdaRole
    handler: bulkExport/index.updateStatusStatusHandler

  uploadGlueScripts:
    timeout: 30
    memorySize: 192
    runtime: nodejs12.x
    description: 'Upload glue scripts to s3'
    role: UploadGlueScriptsLambdaRole
    handler: bulkExport/uploadGlueScriptsToS3.handler
    disableLogs: true # needed to avoid race condition error "Resource of type 'AWS::Logs::LogGroup' already exists" since the custom resource lambda invocation may create the log group before CFN does
    environment:
      GLUE_SCRIPTS_BUCKET: !Ref GlueScriptsBucket

stepFunctions:
  stateMachines:
    BulkExportStateMachine: ${file(bulkExport/state-machine-definition.yaml)}

resources:
  - Description: (SO0128) - Solution - Primary Template - This template creates all the necessary resources to deploy FHIR Works on AWS; a framework to deploy a FHIR server on AWS.
  - Parameters:
      Stage:
        Type: String
        Default: ${self:custom.stage}
        Description: 'The deployment stage (e.g. dev, qa, prod). Default: dev'
      CognitoOAuthDefaultRedirectURL:
        Type: String
        Default: ${self:custom.oauthRedirect}
        Description: "Cognito's default OAuth redirect URL used for User Pool. Default:  ${self:custom.oauthRedirect}"
      ExportGlueWorkerType:
        Type: String
        Default: 'G.2X'
        AllowedValues:
          - 'G.2X'
          - 'G.1X'
        Description: Select the Glue worker type to run Export jobs. Default is 'G.2X'
      ExportGlueNumberWorkers:
        Type: Number
        Default: 5
        Description: Number of Glue workers to use during an Export job.
      UseHapiValidator:
        Type: String
        Default: ${self:custom.useHapiValidator}
        AllowedValues:
          - 'true'
          - 'false'
        Description: whether or not to use an already deployed HAPI Validator
  - Conditions:
      isDev: !Equals [!Ref Stage, 'dev']
      isNotDev: !Not [Condition: isDev]
      isUsingHapiValidator: !Equals [!Ref UseHapiValidator, 'true']
  - Resources:
      ResourceDynamoDBTableV2:
        Type: AWS::DynamoDB::Table
        DeletionPolicy: Retain
        UpdateReplacePolicy: Retain
        Properties:
          TableName: '${self:custom.resourceTableName}'
          AttributeDefinitions:
            - AttributeName: id
              AttributeType: S
            - AttributeName: vid
              AttributeType: N
          KeySchema:
            - AttributeName: id
              KeyType: HASH
            - AttributeName: vid
              KeyType: RANGE
          BillingMode: PAY_PER_REQUEST
          StreamSpecification:
            StreamViewType: NEW_AND_OLD_IMAGES
          SSESpecification:
            KMSMasterKeyId: !Ref DynamodbKMSKey
            SSEEnabled: true
            SSEType: 'KMS'
          Tags: !If
            - isNotDev
            - - Key: 'backup' # You must also cfn deploy backup.yaml to enable back-ups
                Value: 'daily'
              - Key: 'service'
                Value: 'fhir'
            - !Ref AWS::NoValue
      ExportRequestDynamoDBTable:
        Type: AWS::DynamoDB::Table
        Properties:
          TableName: '${self:custom.exportRequestTableName}'
          AttributeDefinitions:
            - AttributeName: jobId
              AttributeType: S
            - AttributeName: jobStatus
              AttributeType: S
            - AttributeName: jobOwnerId
              AttributeType: S
          KeySchema:
            - AttributeName: jobId
              KeyType: HASH
          SSESpecification:
            KMSMasterKeyId: !Ref DynamodbKMSKey
            SSEEnabled: true
            SSEType: 'KMS'
          BillingMode: PAY_PER_REQUEST
          GlobalSecondaryIndexes:
            - IndexName: '${self:custom.exportRequestTableJobStatusIndex}'
              KeySchema:
                - AttributeName: jobStatus
                  KeyType: HASH
                - AttributeName: jobOwnerId
                  KeyType: RANGE
              Projection:
                ProjectionType: KEYS_ONLY
          Tags: !If
            - isNotDev
            - - Key: 'service'
                Value: 'fhir'
            - !Ref AWS::NoValue
      ResourceDynamoDBTable: # Superseded by ResourceDynamoDBTableV2 & is unused;
        Type: AWS::DynamoDB::Table # Remaining in the template to give opportunity to move resources from old DB to New with "sort-key-migration.js" script
        DeletionPolicy: Retain
        UpdateReplacePolicy: Retain
        Properties:
          TableName: '${self:custom.oldResourceTableName}'
          AttributeDefinitions:
            - AttributeName: id
              AttributeType: S
            - AttributeName: vid
              AttributeType: S
          KeySchema:
            - AttributeName: id
              KeyType: HASH
            - AttributeName: vid
              KeyType: RANGE
          BillingMode: PAY_PER_REQUEST
          SSESpecification:
            KMSMasterKeyId: !Ref DynamodbKMSKey
            SSEEnabled: true
            SSEType: 'KMS'
      ApiGatewayAuthorizer:
        Type: AWS::ApiGateway::Authorizer
        Properties:
          AuthorizerResultTtlInSeconds: 300
          IdentitySource: method.request.header.Authorization
          RestApiId: !Ref ApiGatewayRestApi
          Type: COGNITO_USER_POOLS
          Name: Authorizer
          ProviderARNs:
            - !Join [
                '',
                [!Sub 'arn:${AWS::Partition}:cognito-idp:${AWS::Region}:${AWS::AccountId}:userpool/', !Ref UserPool],
              ]
      FHIRBinaryBucket:
        Type: AWS::S3::Bucket
        DeletionPolicy: Retain
        UpdateReplacePolicy: Retain
        Properties:
          LoggingConfiguration:
            DestinationBucketName: !Ref FHIRLogsBucket
            LogFilePrefix: 'binary-acl'
          VersioningConfiguration:
            Status: Enabled
          BucketEncryption:
            ServerSideEncryptionConfiguration:
              - ServerSideEncryptionByDefault:
                  SSEAlgorithm: aws:kms
                  KMSMasterKeyID: !Ref S3KMSKey
      FHIRLogsBucket:
        Type: AWS::S3::Bucket
        DeletionPolicy: Retain
        UpdateReplacePolicy: Retain
        Properties:
          AccessControl: LogDeliveryWrite
          BucketEncryption:
            ServerSideEncryptionConfiguration:
              - ServerSideEncryptionByDefault:
                  SSEAlgorithm: AES256
      FHIRBinaryBucketHttpsOnlyPolicy:
        Type: AWS::S3::BucketPolicy
        Properties:
          Bucket: !Ref FHIRBinaryBucket
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Sid: AllowSSLRequestsOnly
                Effect: Deny
                Principal: '*'
                Action:
                  - s3:*
                Resource:
                  - !GetAtt FHIRBinaryBucket.Arn
                  - !Join ['', [!GetAtt FHIRBinaryBucket.Arn, '/*']]
                Condition:
                  Bool:
                    'aws:SecureTransport': false
      FHIRLogsBucketHttpsOnlyPolicy:
        Type: AWS::S3::BucketPolicy
        Properties:
          Bucket: !Ref FHIRLogsBucket
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Sid: AllowSSLRequestsOnly
                Effect: Deny
                Principal: '*'
                Action:
                  - s3:*
                Resource:
                  - !GetAtt FHIRLogsBucket.Arn
                  - !Join ['', [!GetAtt FHIRLogsBucket.Arn, '/*']]
                Condition:
                  Bool:
                    'aws:SecureTransport': false
      FhirServerLambdaRole:
        Type: AWS::IAM::Role
        Properties:
          AssumeRolePolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Effect: 'Allow'
                Principal:
                  Service: 'lambda.amazonaws.com'
                Action: 'sts:AssumeRole'
          Policies:
            - PolicyName: 'FhirServerLambdaPolicy'
              PolicyDocument:
                Version: '2012-10-17'
                Statement:
                  - Effect: Allow
                    Action:
                      - logs:CreateLogStream
                      - logs:CreateLogGroup
                      - logs:PutLogEvents
                    Resource: !Sub 'arn:${AWS::Partition}:logs:${AWS::Region}:*:*'
                  - Effect: Allow
                    Action:
                      - 'kms:Describe*'
                      - 'kms:Get*'
                      - 'kms:List*'
                      - 'kms:Encrypt'
                      - 'kms:Decrypt'
                      - 'kms:ReEncrypt*'
                      - 'kms:GenerateDataKey'
                      - 'kms:GenerateDataKeyWithoutPlaintext'
                    Resource:
                      - !GetAtt S3KMSKey.Arn
                      - !GetAtt DynamodbKMSKey.Arn
                      - !GetAtt ElasticSearchKMSKey.Arn
                  - Effect: Allow
                    Action:
                      - 'dynamodb:Query'
                      - 'dynamodb:Scan'
                      - 'dynamodb:GetItem'
                      - 'dynamodb:PutItem'
                      - 'dynamodb:UpdateItem'
                      - 'dynamodb:DeleteItem'
                      - 'dynamodb:BatchWriteItem'
                    Resource:
                      - !GetAtt ResourceDynamoDBTableV2.Arn
                      - !GetAtt ExportRequestDynamoDBTable.Arn
                  - Effect: Allow
                    Action:
                      - 'dynamodb:Query'
                    Resource:
                      - !Join ['', [!GetAtt ExportRequestDynamoDBTable.Arn, '/index/*']]
                  - Effect: Allow
                    Action:
                      - 'es:ESHttpGet'
                      - 'es:ESHttpHead'
                      - 'es:ESHttpPost'
                    Resource:
                      - !Join ['', [!GetAtt ElasticSearchDomain.Arn, '/*']]
                  - Effect: Allow
                    Action:
                      - 's3:*Object'
                      - 's3:ListBucket'
                      - 's3:DeleteObjectVersion'
                    Resource:
                      - !GetAtt FHIRBinaryBucket.Arn
                      - !Join ['', [!GetAtt FHIRBinaryBucket.Arn, '/*']]
                  - Effect: Allow
                    Action:
                      - 's3:ListBucket'
                      - 's3:GetObject'
                    Resource:
                      - !GetAtt BulkExportResultsBucket.Arn
                      - !Join ['', [!GetAtt BulkExportResultsBucket.Arn, '/*']]
                  - Effect: Allow
                    Action:
                      - 'xray:PutTraceSegments'
                      - 'xray:PutTelemetryRecords'
                    Resource:
                      - '*'
                  - Effect: Allow
                    Action:
                      - 'sts:AssumeRole'
                    Resource:
                      - !GetAtt ExportResultsSignerRole.Arn
                  - Effect: Allow
                    Action:
                      - 'states:StartExecution'
                    Resource:
                      - !Ref BulkExportStateMachine
                  - !If
                    - isUsingHapiValidator
                    - Effect: Allow
                      Action:
                        - 'lambda:InvokeFunction'
                      Resource:
                        - Fn::ImportValue: "fhir-service-validator-lambda-${self:custom.stage}"
                    - !Ref AWS::NoValue
      DdbToEsLambdaRole:
        Type: AWS::IAM::Role
        Properties:
          AssumeRolePolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Effect: 'Allow'
                Principal:
                  Service: 'lambda.amazonaws.com'
                Action: 'sts:AssumeRole'
          Policies:
            - PolicyName: 'DdbToEsLambdaPolicy'
              PolicyDocument:
                Version: '2012-10-17'
                Statement:
                  - Effect: Allow
                    Action:
                      - logs:CreateLogStream
                      - logs:CreateLogGroup
                      - logs:PutLogEvents
                    Resource: !Sub 'arn:${AWS::Partition}:logs:${AWS::Region}:*:*'
                  - Effect: Allow
                    Action:
                      - dynamodb:GetShardIterator
                      - dynamodb:DescribeStream
                      - dynamodb:ListStreams
                      - dynamodb:GetRecords
                    Resource:
                      - !GetAtt ResourceDynamoDBTableV2.StreamArn
                  - Effect: Allow
                    Action:
                      - xray:PutTraceSegments
                      - xray:PutTelemetryRecords
                    Resource:
                      - '*'
                  - Effect: Allow
                    Action:
                      - 'es:ESHttp*'
                    Resource:
                      - !Join ['', [!GetAtt ElasticSearchDomain.Arn, '/*']]
            - PolicyName: 'KMSPolicy'
              PolicyDocument:
                Version: '2012-10-17'
                Statement:
                  - Effect: Allow
                    Action:
                      - 'kms:Describe*'
                      - 'kms:Get*'
                      - 'kms:List*'
                      - 'kms:Encrypt'
                      - 'kms:Decrypt'
                      - 'kms:ReEncrypt*'
                      - 'kms:GenerateDataKey'
                      - 'kms:GenerateDataKeyWithoutPlaintext'
                    Resource:
                      - !GetAtt DynamodbKMSKey.Arn
                      - !GetAtt ElasticSearchKMSKey.Arn
  - extensions:
      FhirServerLogGroup:
        Properties:
          KmsKeyId: !GetAtt LogKMSKey.Arn
        DependsOn:
          - LogKMSKey
      DdbToEsLogGroup:
        Properties:
          KmsKeyId: !GetAtt LogKMSKey.Arn
        DependsOn:
          - LogKMSKey
      StartExportJobLogGroup:
        Properties:
          KmsKeyId: !GetAtt LogKMSKey.Arn
        DependsOn:
          - LogKMSKey
      StopExportJobLogGroup:
        Properties:
          KmsKeyId: !GetAtt LogKMSKey.Arn
        DependsOn:
          - LogKMSKey
      GetJobStatusLogGroup:
        Properties:
          KmsKeyId: !GetAtt LogKMSKey.Arn
        DependsOn:
          - LogKMSKey
      UpdateStatusLogGroup:
        Properties:
          KmsKeyId: !GetAtt LogKMSKey.Arn
        DependsOn:
          - LogKMSKey
      ApiGatewayLogGroup:
        Properties:
          KmsKeyId: !GetAtt LogKMSKey.Arn
        DependsOn:
          - LogKMSKey
  - ${file(cloudformation/alarms.yaml)}
  - ${file(cloudformation/kms.yaml)}
  - ${file(cloudformation/elasticsearch.yaml)}
  - ${file(cloudformation/cognito.yaml)}
  - ${file(cloudformation/bulkExport.yaml)}
  - Outputs:
      UserPoolId:
        Description: User pool id for the provisioning users.
        Value: !Ref UserPool
      UserPoolAppClientId:
        Description: App client id for the provisioning users.
        Value: !Ref UserPoolClient
      FHIRBinaryBucket:
        Description: S3 Bucket for storing Binary Objects
        Value: !Ref FHIRBinaryBucket
      ResourceDynamoDBTableV2Arn:
        Description: DynamoDB table for storing non-Binary resources
        Value: !GetAtt ResourceDynamoDBTableV2.Arn
      ResourceDynamoDBTableV2StreamArn:
        Description: DynamoDB stream for the DDB table storing non-Binary resources
        Value: !GetAtt ResourceDynamoDBTableV2.StreamArn
      ExportRequestDynamoDBTableArn:
        Description: DynamoDB table for storing bulk export requests
        Value: !GetAtt ExportRequestDynamoDBTable.Arn
      ElasticSearchDomainEndpoint:
        Description: Endpoint of ElasticSearch instance
        Value: !Join ['', ['https://', !GetAtt ElasticSearchDomain.DomainEndpoint]]
      ElasticSearchDomainKibanaEndpoint:
        Condition: isDev
        Description: ElasticSearch Kibana endpoint
        Value: !Join ['', ['https://', !GetAtt ElasticSearchDomain.DomainEndpoint, '/_plugin/kibana']]
      ElasticSearchKibanaUserPoolId:
        Condition: isDev
        Description: User pool id for the provisioning ES Kibana users.
        Value: !Ref KibanaUserPool
      ElasticSearchKibanaUserPoolAppClientId:
        Condition: isDev
        Description: App client id for the provisioning ES Kibana users.
        Value: !Ref KibanaUserPoolClient
      CloudwatchExecutionLogGroup:
        Description: Cloudwatch Execution log group for storing request/responses for auditing purposes
        Value: !Join ['', ['API-Gateway-Execution-Logs_', !Ref ApiGatewayRestApi, '/', !Ref Stage]]
        Export:
          Name: !Join ['-', [CloudwatchExecutionLogGroup, !Ref Stage]]
      CloudwatchExecutionLogGroupArn:
        Description: Arn of Cloudwatch Execution log group for storing request/responses for auditing purposes
        Value:
          !Join [
            '',
            [
              !Sub 'arn:${AWS::Partition}:logs:${AWS::Region}:${AWS::AccountId}:log-group:API-Gateway-Execution-Logs_',
              !Ref ApiGatewayRestApi,
              '/',
              !Ref Stage,
              ':log-stream:*',
            ],
          ]
        Export:
          Name: !Join ['-', [CloudwatchExecutionLogGroup, !Ref Stage, Arn]]

plugins:
  - serverless-step-functions
  - serverless-bundle
  - serverless-offline