template.yml

# This is the SAM template that represents the architecture of your serverless application
# https://docs.aws.amazon.com/serverless-application-model/latest/developerguide/serverless-sam-template-basics.html

# The AWSTemplateFormatVersion identifies the capabilities of the template
# https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/format-version-structure.html
AWSTemplateFormatVersion: 2010-09-09
Description: >-
  aws-sam-typescript-layers-example

# Transform section specifies one or more macros that AWS CloudFormation uses to process your template
# https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/transform-section-structure.html
Transform:
- AWS::Serverless-2016-10-31

Globals:
  Function:
    Environment:
      Variables:
        REGION: ${AWS::Region}
        RESULTS_BUCKET: !Ref TestResultBucket
    Timeout: 100
    MemorySize: 2048

# Resources declares the AWS resources that you want to include in the stack
# https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/resources-section-structure.html
Resources:
  ApiResource:
    Type: AWS::Serverless::Api
    Properties:
      StageName: Prod
      BinaryMediaTypes:
      Auth:
        DefaultAuthorizer: NONE

  # Each Lambda function is defined by properties:
  # https://github.com/awslabs/serverless-application-model/blob/master/versions/2016-10-31.md#awsserverlessfunction

  # This is a Lambda function config associated with the source code: get-all-items.js
  cypressLambdaFunction:
    Type: AWS::Serverless::Function
    Metadata:
      DockerTag: cypress-lambda
      DockerContext: ./
      Dockerfile: docker-src/lambda.Dockerfile
    Properties:
      PackageType: Image
      Description: A simple example includes a HTTP get method to get all items from a DynamoDB table.
      Policies:
        - Statement:
            - Sid: TestBucketFullAccess
              Effect: Allow
              Action:
                - s3:*
              Resource:
                - !GetAtt TestResultBucket.Arn
                - !Join
                  - ''
                  - - !GetAtt TestResultBucket.Arn
                    - '/*'
      Events:
        Api:
          Type: Api
          Properties:
            RestApiId: !Ref ApiResource
            Path: /lambda
            Method: ANY

  RunTestFunction:
    Type: AWS::Serverless::Function
    Properties:
      CodeUri: src/functions/runtest
      Handler: index.handler
      Runtime: nodejs14.x
      Description: A function that ideally would run a test
      Environment:
        Variables:
          ECS_CLUSTER: !Ref ECSCluster
          ECS_TASKDEF: !Ref ECSBaseTaskDef
      Policies:
        - Statement:
            - Sid: ECSRunAccess
              Effect: Allow
              Action:
                - ecs:RunTask
              Condition:
                ArnEquals:
                  ecs:cluster: !GetAtt ECSCluster.Arn
              Resource:
                - !Ref ECSBaseTaskDef
            - Sid: ECSPassRole
              Effect: Allow
              Action:
                - iam:GetRole
                - iam:PassRole
              Resource:
                - !GetAtt ECSExecutionRole.Arn
                - !GetAtt ECSTaskRole.Arn
            - Sid: EC2Describe
              Effect: Allow
              Action:
                - ec2:DescribeSubnets
                - ec2:DescribeSecurityGroups
                - ec2:DescribeVpcs
              Resource:
                - '*'
      Events:
        Api:
          Type: Api
          Properties:
            RestApiId: !Ref ApiResource
            Path: /
            Method: ANY

  RunCompleteFunction:
    Type: AWS::Serverless::Function
    Properties:
      CodeUri: src/functions/runcomplete
      Handler: index.handler
      Runtime: nodejs14.x
      Description: A function that responds to ECS task ending
      Policies:
        - Statement:
            - Sid: TestBucketFullAccess
              Effect: Allow
              Action:
                - s3:*
              Resource:
                - !GetAtt TestResultBucket.Arn
                - !Join
                  - ''
                  - - !GetAtt TestResultBucket.Arn
                    - '/*'
      Events:
        CloudWatchEvent:
          Type: CloudWatchEvent
          Properties:
            RestApiId: !Ref ApiResource
            Path: /
            Method: ANY

  TestResultBucket:
    Type: AWS::S3::Bucket

  ECSRepository:
    Type: AWS::ECR::Repository

  ECSBaseTaskDef:
    Type: AWS::ECS::TaskDefinition
    Properties:
      RequiresCompatibilities:
        - FARGATE
      NetworkMode: awsvpc
      Cpu: 1024
      Memory: 2048
      ExecutionRoleArn: !Ref ECSExecutionRole
      TaskRoleArn: !Ref ECSTaskRole
      ContainerDefinitions:
        - Name: cypress
          Image: !Join
            - ''
            - - !GetAtt ECSRepository.RepositoryUri
              - ':latest'
          Essential: true
          LogConfiguration:
            LogDriver: awslogs
            Options:
              awslogs-region: !Ref AWS::Region
              awslogs-group: !Ref ECSLogGroup
              awslogs-stream-prefix: ecs

  ECSExecutionRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Statement:
          - Effect: Allow
            Principal:
              Service: ecs-tasks.amazonaws.com
            Action: 'sts:AssumeRole'
      ManagedPolicyArns:
        - 'arn:aws:iam::aws:policy/service-role/AmazonECSTaskExecutionRolePolicy'

  # PolicyDocuments at the IAM role require JSON strings
  ECSExecutionRolePolicies:
    Type: AWS::IAM::Policy
    DependsOn:
      - TestResultBucket
    Properties:
      PolicyName: TestBucketFullAccess
      PolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Action:
              - s3:*
            Resource:
              - !GetAtt TestResultBucket.Arn
              - !Join
                - ''
                - - !GetAtt TestResultBucket.Arn
                  - '/*'
      Roles:
        - !Ref ECSExecutionRole

  ECSTaskRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Statement:
          - Effect: Allow
            Principal:
              Service: ecs-tasks.amazonaws.com
            Action: 'sts:AssumeRole'

  ECSLogGroup:
    Type: AWS::Logs::LogGroup

  ECSCluster:
    Type: AWS::ECS::Cluster
    Properties:
      CapacityProviders:
        - FARGATE
      ClusterSettings:
        - Name: containerInsights
          Value: enabled
Outputs:
  WebEndpoint:
    Description: API Gateway endpoint URL for Prod stage
    Value: !Sub "https://${ApiResource}.execute-api.${AWS::Region}.amazonaws.com/Prod/"
  Repository:
    Description: ECS Repository URL
    Value: !GetAtt ECSRepository.RepositoryUri
  Task:
    Description: ECS Task Definition
    Value: !Ref ECSBaseTaskDef
  Cluster:
    Description: ECS Cluster
    Value: !Ref ECSCluster