template.yml

AWSTemplateFormatVersion : '2010-09-09'
Description: "DCE Transcript Indexer"

Parameters:
  CidrBlock:
    Type: String
  LambdaCodeBucket:
    Type: String
  NotificationEmail:
    Type: String
  ElasticsearchInstanceType:
    Type: String
    Default: t2.small.elasticsearch
  LambdaTimeout:
    Type: String
    Default: 180
  LambdaMemory:
    Type: String
    Default: 256

Resources:

  VPC:
    Type: AWS::EC2::VPC
    Properties:
      CidrBlock: !Ref CidrBlock
      EnableDnsSupport: true
      EnableDnsHostnames: true
      Tags:
        - Key: Name
          Value: !Sub "${AWS::StackName}-vpc"

  FlowLogGroup:
    Type: AWS::Logs::LogGroup
    Properties:
      LogGroupName: !Sub "${AWS::StackName}-vpc-flowlog"
      RetentionInDays: 30

  VPCFlowLog:
    Type: AWS::EC2::FlowLog
    Properties:
      DeliverLogsPermissionArn: !GetAtt TranscriptIndexerRole.Arn
      LogGroupName: !Ref FlowLogGroup
      ResourceId: !Ref VPC
      ResourceType: VPC
      TrafficType: ALL

  PrivateSubnet:
    Type: AWS::EC2::Subnet
    Properties:
      VpcId: !Ref VPC
      CidrBlock: !Ref CidrBlock
      Tags:
        - Key: Name
          Value: !Sub "${AWS::StackName} private subnet"

  PrivateRouteTable:
    Type: AWS::EC2::RouteTable
    Properties:
      VpcId: !Ref VPC
      Tags:
        - Key: Name
          Value: !Sub "${AWS::StackName} route table"

  PrivateSubnetRouteTableAssociation:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      SubnetId: !Ref PrivateSubnet
      RouteTableId: !Ref PrivateRouteTable

  SecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      VpcId: !Ref VPC
      GroupDescription: "Elasticsearch Security Group"
      SecurityGroupIngress:
        - IpProtocol: tcp
          FromPort: 0
          ToPort: 65535
          CidrIp: 10.0.0.0/8
      Tags:
        - Key: Name
          Value: !Sub "${AWS::StackName} elasticsearch security group"

  VPCS3Endpoint:
    Type: AWS::EC2::VPCEndpoint
    Properties:
      VpcEndpointType: Gateway
      VpcId: !Ref VPC
      ServiceName: !Sub "com.amazonaws.${AWS::Region}.s3"
      RouteTableIds:
        - !Ref PrivateRouteTable

  TranscriptIndexerFunction:
    Type: AWS::Lambda::Function
    DependsOn: TranscriptIndexerES
    Properties:
      Runtime: python3.12
      Handler: function.handler
      FunctionName: !Sub "${AWS::StackName}-function"
      Role: !GetAtt [TranscriptIndexerRole, Arn]
      Timeout: !Ref LambdaTimeout
      MemorySize: !Ref LambdaMemory
      Code:
        S3Bucket: !Ref LambdaCodeBucket
        S3Key: !Sub "dce-transcript-indexer/${AWS::StackName}-function.zip"
      Environment:
        Variables:
          ES_HOST: !Sub "https://${TranscriptIndexerES.DomainEndpoint}"
      VpcConfig:
        SubnetIds:
          - !Ref PrivateSubnet
        SecurityGroupIds:
          - !GetAtt [SecurityGroup, GroupId]

  TranscriptIndexerRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: !Sub "${AWS::StackName}-role"
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
        - Action: sts:AssumeRole
          Effect: Allow
          Principal:
            Service: lambda.amazonaws.com
      ManagedPolicyArns:
        - "arn:aws:iam::aws:policy/service-role/AWSLambdaVPCAccessExecutionRole"
        - "arn:aws:iam::aws:policy/CloudWatchFullAccess"
        - "arn:aws:iam::aws:policy/CloudWatchLogsFullAccess"
        - "arn:aws:iam::aws:policy/AmazonS3ReadOnlyAccess"
      Policies:
        - PolicyName: !Sub "${AWS::StackName}-policy"
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Effect: "Allow"
                Action:
                  - "sns:*"
                Resource: !Ref TranscriptIndexerNotificationTopic

  TranscriptIndexerNotificationTopic:
    Type: AWS::SNS::Topic
    Properties:
      TopicName: !Sub "${AWS::StackName}-notification-topic"
      Subscription:
        - Protocol: email
          Endpoint: !Ref NotificationEmail

  TranscriptIndexerES:
    Type: AWS::Elasticsearch::Domain
    Properties:
      DomainName: !Sub "${AWS::StackName}-es"
      ElasticsearchVersion: "6.7"
      EBSOptions:
        VolumeSize: 100
        VolumeType: gp2
        EBSEnabled: true
      ElasticsearchClusterConfig:
        InstanceCount: 1
        InstanceType: !Ref ElasticsearchInstanceType
        DedicatedMasterEnabled: false
      SnapshotOptions:
        AutomatedSnapshotStartHour: 6
      AdvancedOptions:
        rest.action.multi.allow_explicit_index: "true"
        indices.fielddata.cache.size: "40"
      Tags:
        - Key: Project
          Value: "MH"
        - Key: OU
          Value: "DE"
        - Key: dce-transcript-indexer
          Value: "1"
      AccessPolicies:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Principal:
              AWS: '*'
            Action: 'es:*'
            Resource: !Sub "arn:aws:es:${AWS::Region}:${AWS::AccountId}:domain/${AWS::StackName}-es/*"
      VPCOptions:
        SubnetIds:
          - !Ref PrivateSubnet
        SecurityGroupIds:
          - !GetAtt [SecurityGroup, GroupId]

  TranscriptIndexerErrorsMetricAlarm:
    Type: AWS::CloudWatch::Alarm
    Properties:
      AlarmDescription: "Fire alarm on any function errors"
      AlarmActions:
        - !Ref TranscriptIndexerNotificationTopic
      MetricName: Errors
      Dimensions:
        - Name: FunctionName
          Value: !Ref TranscriptIndexerFunction
      Namespace: AWS/Lambda
      ComparisonOperator: GreaterThanOrEqualToThreshold
      Period: 60
      EvaluationPeriods: 1
      Threshold: 1
      Statistic: Sum
      TreatMissingData: ignore

Outputs:
  DomainArn:
    Value: !GetAtt TranscriptIndexerES.DomainArn
  DomainEndpoint:
    Value: !GetAtt TranscriptIndexerES.DomainEndpoint
  VpcCidrBlock:
    Value: !GetAtt VPC.CidrBlock
  PrivateSubnetId:
    Value: !Ref PrivateSubnet
  SecurityGroupId:
    Value: !GetAtt SecurityGroup.GroupId
  VpcId:
    Value: !Ref VPC
  LambdaIndexerFunction:
    Value: !Ref TranscriptIndexerFunction