template.yml

AWSTemplateFormatVersion: "2010-09-09"
Description: "lambda in vpc with vpc endpoints"
Parameters:
  GlobalTableArn:
    Description: Provide Arn if global dynamodb table is deployed in different region
    Type: String
    Default: ''
  DomainNamePrefix:
    Description: Domain name prefix (optional), used to setup route53 dns
    Type: String
    Default: api
  DomainName:
    Description: Domain name (optional), used to setup route53 dns
    Type: String
    Default: hack23.com
  VpcCidrPrefix:
    Description: The first part of the CIDR block for the VPC and subnets
    Type: String
    Default: "10.1"    
Conditions:
  deployGlobalTable: !Equals
    - ''
    - !Ref 'GlobalTableArn'
Resources:
  VPC:
    Type: "AWS::EC2::VPC"
    Properties:
      CidrBlock: !Sub "${VpcCidrPrefix}.0.0/16"
      EnableDnsHostnames: true
      EnableDnsSupport: true
      Tags:
        - Key: Name
          Value: "Lamba vpc"
  DefaultVPCSgIngress:
    Type: AWS::EC2::SecurityGroupIngress
    Properties:
      GroupId: !GetAtt "VPC.DefaultSecurityGroup"
      Description: "Force removal of default vpc sg rules"
      IpProtocol: "icmp"
      CidrIp: 127.0.0.1/32
      FromPort: 7 
      ToPort: 7
  DefaultVPCSgEgress:
    Type: AWS::EC2::SecurityGroupEgress
    Properties:
      GroupId: !GetAtt "VPC.DefaultSecurityGroup"
      Description: "Force removal of default vpc sg rules"
      IpProtocol: "icmp"
      CidrIp: 127.0.0.1/32
      FromPort: 7 
      ToPort: 7
  PrivateSubnet1:
    Type: "AWS::EC2::Subnet"
    Properties:
      CidrBlock: !Sub "${VpcCidrPrefix}.0.0/24"
      MapPublicIpOnLaunch: false
      VpcId:
        Ref: "VPC"
      Tags:
        - Key: "Name"
          Value: "Private Subnet AZ A"
      AvailabilityZone:
        Fn::Select:
          - "0"
          - Fn::GetAZs:
              Ref: "AWS::Region"
  PrivateSubnet2:
    Type: "AWS::EC2::Subnet"
    Properties:
      CidrBlock: !Sub "${VpcCidrPrefix}.1.0/24"
      MapPublicIpOnLaunch: false
      VpcId:
        Ref: "VPC"
      Tags:
        - Key: "Name"
          Value: "Private Subnet AZ B"
      AvailabilityZone:
        Fn::Select:
          - "1"
          - Fn::GetAZs:
              Ref: "AWS::Region"
  PrivateSubnet3:
    Type: "AWS::EC2::Subnet"
    Properties:
      CidrBlock: !Sub "${VpcCidrPrefix}.2.0/24"
      MapPublicIpOnLaunch: false
      VpcId:
        Ref: "VPC"
      Tags:
        - Key: "Name"
          Value: "Private Subnet AZ C"
      AvailabilityZone:
        Fn::Select:
          - "2"
          - Fn::GetAZs:
              Ref: "AWS::Region"
  PrivateNetworkAcl:
    Type: AWS::EC2::NetworkAcl
    Properties:
      VpcId: !Ref 'VPC'
      Tags:
        - Key: Application
          Value: !Ref 'AWS::StackId'
        - Key: Network
          Value: Private
  InboundPrivateNetworkAclEntry:
    Type: AWS::EC2::NetworkAclEntry
    Properties:
      NetworkAclId: !Ref 'PrivateNetworkAcl'
      RuleNumber: '700'
      Protocol: '6'
      RuleAction: allow
      Egress: 'false'
      CidrBlock: '0.0.0.0/0'
      PortRange:
        From: '1024'
        To: '65535'
  InboundDenyRdpPrivateNetworkAclEntry:
    Type: AWS::EC2::NetworkAclEntry
    Properties:
      NetworkAclId: !Ref 'PrivateNetworkAcl'
      RuleNumber: '70'
      Protocol: '6'
      RuleAction: deny
      Egress: 'false'
      CidrBlock: '0.0.0.0/0'
      PortRange:
        From: '3389'
        To: '3389'
  OutboundPrivateNetworkAclEntry:
    Type: AWS::EC2::NetworkAclEntry
    Properties:
      NetworkAclId: !Ref 'PrivateNetworkAcl'
      RuleNumber: '800'
      Protocol: '6'
      RuleAction: allow
      Egress: 'true'
      CidrBlock: '0.0.0.0/0'
      PortRange:
        From: '443'
        To: '443'
  PrivateSubnetNetworkAclAssociation1:
    Type: AWS::EC2::SubnetNetworkAclAssociation
    Properties:
      SubnetId: !Ref 'PrivateSubnet1'
      NetworkAclId: !Ref 'PrivateNetworkAcl'
  PrivateSubnetNetworkAclAssociation2:
    Type: AWS::EC2::SubnetNetworkAclAssociation
    Properties:
      SubnetId: !Ref 'PrivateSubnet2'
      NetworkAclId: !Ref 'PrivateNetworkAcl'
  PrivateSubnetNetworkAclAssociation3:
    Type: AWS::EC2::SubnetNetworkAclAssociation
    Properties:
      SubnetId: !Ref 'PrivateSubnet3'
      NetworkAclId: !Ref 'PrivateNetworkAcl'
  RouteTablePrivate1:
    Type: "AWS::EC2::RouteTable"
    Properties:
      VpcId:
        Ref: "VPC"
      Tags:
        - Key: "Name"
          Value: "Private Route Table A"
  RouteTablePrivate1Association1:
    Type: "AWS::EC2::SubnetRouteTableAssociation"
    Properties:
      RouteTableId:
        Ref: "RouteTablePrivate1"
      SubnetId:
        Ref: "PrivateSubnet1"
  RouteTablePrivate2:
    Type: "AWS::EC2::RouteTable"
    Properties:
      VpcId:
        Ref: "VPC"
      Tags:
        - Key: "Name"
          Value: "Private Route Table B"
  RouteTablePrivate2Association1:
    Type: "AWS::EC2::SubnetRouteTableAssociation"
    Properties:
      RouteTableId:
        Ref: "RouteTablePrivate2"
      SubnetId:
        Ref: "PrivateSubnet2"
  RouteTablePrivate3:
    Type: "AWS::EC2::RouteTable"
    Properties:
      VpcId:
        Ref: "VPC"
      Tags:
        - Key: "Name"
          Value: "Private Route Table C"
  RouteTablePrivate3Association1:
    Type: "AWS::EC2::SubnetRouteTableAssociation"
    Properties:
      RouteTableId:
        Ref: "RouteTablePrivate3"
      SubnetId:
        Ref: "PrivateSubnet3"
  EncryptionKey:
    Type: AWS::KMS::Key
    Properties:
      Description: Key used for for stack
      Enabled: true
      EnableKeyRotation: true
      KeyPolicy:
        Statement:
          - Sid: manage-key-stack
            Action:
              - kms:*
            Effect: Allow
            Principal:
              AWS: !Sub 'arn:aws:iam::${AWS::AccountId}:role/GithubWorkFlowRole'
            Resource: '*'
          - Sid: manage-key-root
            Action:
              - kms:*
            Effect: Allow
            Principal:
              AWS: !Sub 'arn:aws:iam::${AWS::AccountId}:root'
            Resource: '*'
          - Sid: logs-access-policy-statement
            Action:
              - kms:*
            Effect: Allow
            Principal:
              Service: logs.amazonaws.com
            Resource: '*'
          - Sid: api-access-policy-statement
            Action:
              - kms:*
            Effect: Allow
            Principal:
              Service: apigateway.amazonaws.com
            Resource: '*'
  DNSFIrewallDomainsList:
    Type: AWS::Route53Resolver::FirewallDomainList
    Properties: 
      Domains: 
        - '*.amazonaws.com'
      Name: AwsDomains
  DNSFIrewallAllDomainsList:
    Type: AWS::Route53Resolver::FirewallDomainList
    Properties: 
      Domains: 
        - '*'
      Name: AllDomains
  DNSFIrewallRuleGroup:
    Type: AWS::Route53Resolver::FirewallRuleGroup
    Properties:
      FirewallRules:
        -
          Action: ALLOW
          FirewallDomainListId: !Ref DNSFIrewallDomainsList
          Priority: 1
        -
          Action: BLOCK
          BlockResponse: NODATA
          FirewallDomainListId: !Ref DNSFIrewallAllDomainsList
          Priority: 2
  DNSFIrewalluleGroupAssociation:
    Type: AWS::Route53Resolver::FirewallRuleGroupAssociation
    Properties: 
      FirewallRuleGroupId: !Ref DNSFIrewallRuleGroup
      Name: 'DNSFIrewallRuleGroupAssociation'
      Priority: 101
      VpcId: !Ref VPC
  FlowLogs:
    Type: "AWS::EC2::FlowLog"
    Properties:
      ResourceType: "VPC"
      ResourceId:
        Ref: "VPC"
      TrafficType: "ALL"
      LogDestinationType: "cloud-watch-logs"
      LogGroupName: "vpcprivate"
      DeliverLogsPermissionArn:
        Fn::GetAtt:
          - "IamRoleForFlowLogs"
          - "Arn"
  IamRoleForFlowLogs:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - vpc-flow-logs.amazonaws.com
            Action:
              - sts:AssumeRole
      ManagedPolicyArns:
      - "arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"
  VPCEndpoint:
    Type: "AWS::EC2::VPCEndpoint"
    Properties:
      VpcEndpointType: "Interface"
      ServiceName:
        Fn::Join:
          - ""
          -
            - "com.amazonaws."
            - Ref: "AWS::Region"
            - ".ec2"
      VpcId:
        Ref: "VPC"
      PrivateDnsEnabled: true
      SecurityGroupIds:
        - Ref: "SgForVPCEndpoint"
      SubnetIds:
        - !Ref "PrivateSubnet1"
        - !Ref "PrivateSubnet2"
        - !Ref "PrivateSubnet3"       
  SgForVPCEndpoint:
    Type: "AWS::EC2::SecurityGroup"
    Properties:
      GroupDescription: "Security group to allow access to ec2 VPC Endpoint"
      SecurityGroupIngress:
        - SourceSecurityGroupId: !Ref "LambdaSecurityGroup"
          IpProtocol: "tcp"
          FromPort: "443"
          ToPort: "443"
          Description: "Allow inbound https from inside vpc"
      SecurityGroupEgress:
        - CidrIp: "10.1.0.0/16"
          IpProtocol: "tcp"
          FromPort: "443"
          ToPort: "443"
          Description: "Allow outbound https inside vpc"
      VpcId:
        Ref: "VPC"
  VPCEndpointS3:
    Type: "AWS::EC2::VPCEndpoint"
    Properties:
      ServiceName:
        Fn::Join:
          - ""
          -
            - "com.amazonaws."
            - Ref: "AWS::Region"
            - ".s3"
      VpcId:
        Ref: "VPC"
      PolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: "Allow"
            Principal: "*"
            Action:
              - "*"
            Resource:
              - "*"
      RouteTableIds:
        - Ref: "RouteTablePrivate1"
        - Ref: "RouteTablePrivate2"
        - Ref: "RouteTablePrivate3"     
  VPCEndpointDynamoDb:
    Type: "AWS::EC2::VPCEndpoint"
    Properties:
      ServiceName:
        Fn::Join:
          - ""
          -
            - "com.amazonaws."
            - Ref: "AWS::Region"
            - ".dynamodb"
      VpcId:
        Ref: "VPC"
      PolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: "Allow"
            Principal:
              AWS: !Sub "arn:${AWS::Partition}:iam::${AWS::AccountId}:root"
            Action:
              - "dynamodb:ListTables"
            Resource:
              - !Sub 'arn:aws:dynamodb:${AWS::Region}:${AWS::AccountId}:table/global-table'
      RouteTableIds:
        - Ref: "RouteTablePrivate1"
        - Ref: "RouteTablePrivate2"
        - Ref: "RouteTablePrivate3"
  LambdaSecurityGroup:
    Type: "AWS::EC2::SecurityGroup"
    Properties:
      GroupDescription: "Lambda Traffic"
      VpcId: !Ref "VPC"
      SecurityGroupEgress:
      - IpProtocol: "tcp"
        FromPort: "443"
        ToPort: "443"
        CidrIp: "10.1.0.0/16"
        Description: "Allow outbound https inside vpc"
  InstanceSecurityGroupIngress:
    Type: "AWS::EC2::SecurityGroupIngress"
    Properties:
      GroupId: !Ref "LambdaSecurityGroup"
      IpProtocol: "tcp"
      FromPort: "443"
      ToPort: "443"
      Description: "Allow inbound https"
      SourceSecurityGroupId: !Ref "LambdaSecurityGroup"
  LambdaFunctionRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
        - Effect: Allow
          Principal:
            Service:
            - lambda.amazonaws.com
          Action:
          - sts:AssumeRole
      ManagedPolicyArns:
      - "arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"
      - "arn:aws:iam::aws:policy/service-role/AWSLambdaSQSQueueExecutionRole"
      - "arn:aws:iam::aws:policy/CloudWatchLambdaInsightsExecutionRolePolicy"
      - "arn:aws:iam::aws:policy/AWSXRayDaemonWriteAccess"
      - "arn:aws:iam::aws:policy/AmazonSNSFullAccess"
      - "arn:aws:iam::aws:policy/service-role/AWSLambdaVPCAccessExecutionRole"
  DeadLetterTopic:
    Type: AWS::SNS::Topic
    Properties:
      Subscription:
        - Endpoint: 'admin@hack23.com'
          Protocol: email
      KmsMasterKeyId: alias/aws/sns
  Lambda:
    Type: "AWS::Lambda::Function"
    Properties:
      Code:
        ZipFile: |
          exports.handler =  async function(event, context) {
            const audit = { "RequestId": context.awsRequestId , "Action": "Healthcheck", "Actor": "Api", statusCode: 200}
            console.info("EVENT : " + JSON.stringify(audit, null, 2));
            return "OK";
          }
      Description: "lambda"
      FunctionName: audittest
      Handler: index.handler
      Architectures:
        - arm64
      MemorySize: 256
      ReservedConcurrentExecutions: 4
      DeadLetterConfig:
        TargetArn: !Ref "DeadLetterTopic"
      PackageType: "Zip"
      Role: !GetAtt LambdaFunctionRole.Arn
      Runtime: "nodejs20.x"
      Timeout: 30
      VpcConfig:
        SecurityGroupIds:
          - !Ref "LambdaSecurityGroup"
        SubnetIds:
          - !Ref "PrivateSubnet1"
          - !Ref "PrivateSubnet2"
          - !Ref "PrivateSubnet3"
  LambdaDynamo:
    Type: "AWS::Lambda::Function"
    Properties:
      Code:
        ZipFile: |
          const { DynamoDB } = require("@aws-sdk/client-dynamodb");
          let region = process.env.AWS_REGION;
          const client = new DynamoDB({ region: region });
          exports.handler =  async function(event, context) {
            const audit = { "RequestId": context.awsRequestId , "Action": "Write", "Actor": "Api", statusCode: 200}
            console.info("EVENT : " + JSON.stringify(audit, null, 2));
            return "OK";
          }
      Description: "crud"
      FunctionName: database
      Handler: index.handler
      Architectures:
        - arm64
      MemorySize: 256
      ReservedConcurrentExecutions: 4
      DeadLetterConfig:
        TargetArn: !Ref "DeadLetterTopic"
      PackageType: "Zip"
      Role: !GetAtt LambdaFunctionRole.Arn
      Runtime: "nodejs20.x"
      Timeout: 30
      VpcConfig:
        SecurityGroupIds:
          - !Ref "LambdaSecurityGroup"
        SubnetIds:
          - !Ref "PrivateSubnet1"
          - !Ref "PrivateSubnet2"
          - !Ref "PrivateSubnet3"
  GlobalTable:
    Type: AWS::DynamoDB::GlobalTable
    Condition: deployGlobalTable
    Properties:
      TableName: global-table
      BillingMode: PAY_PER_REQUEST
      StreamSpecification:
        StreamViewType: NEW_AND_OLD_IMAGES
      Replicas:
        - PointInTimeRecoverySpecification:
            PointInTimeRecoveryEnabled: true
          Region: eu-west-1
        - PointInTimeRecoverySpecification:
            PointInTimeRecoveryEnabled: true
          Region: eu-central-1
      AttributeDefinitions:
        - AttributeName: primary_key
          AttributeType: S
      KeySchema:
        - AttributeName: primary_key
          KeyType: HASH
  RestApi:
    Type: AWS::ApiGateway::RestApi
    Properties:
      ApiKeySourceType: HEADER
      DisableExecuteApiEndpoint: False #
      EndpointConfiguration:
        Types:
          - REGIONAL
      Name: ApiName
  AlarmTopic:
    Type: AWS::SNS::Topic
    Properties:
      Subscription:
        - Endpoint: 'admin@hack23.com'
          Protocol: email
      KmsMasterKeyId: alias/aws/sns
  RestApiGw4xxErrorsAlarm:
    Type: AWS::CloudWatch::Alarm
    Properties:
      AlarmActions:
        - !Ref 'AlarmTopic'
      AlarmDescription: Alarm that tracks the percentage of 4xx responses received from REST API Gateway
        responses
      AlarmName: RestApiGw4xxErrorsAlarm
      ComparisonOperator: GreaterThanThreshold
      EvaluationPeriods: 5
      DatapointsToAlarm: 3
      Metrics:
        - Id: m1
          MetricStat:
            Metric:
              MetricName: 4XXError
              Namespace: AWS/ApiGateway
              Dimensions:
                - Name: ApiName
                  Value: ApiName
            Period: 60
            Stat: Average
          ReturnData: false
        - Expression: 100 * m1
          Id: percent4xx
          Label: Percent 4xx
      Threshold: 20
      TreatMissingData: missing
  ApiResource:
    Type: AWS::ApiGateway::Resource
    Properties:
      ParentId: !GetAtt RestApi.RootResourceId
      PathPart: "healthcheck"
      RestApiId: !Ref RestApi
  HealthCheckMethod:
    Type: AWS::ApiGateway::Method
    Properties:
      ApiKeyRequired: false
      AuthorizationType: NONE
      HttpMethod: GET
      Integration:
        ConnectionType: INTERNET
        Credentials: !GetAtt ApiRole.Arn
        IntegrationHttpMethod: POST
        IntegrationResponses:
          - StatusCode: 200
            ResponseTemplates:
              application/json: ""
            ResponseParameters:
              method.response.header.Strict-Transport-Security: "'max-age=31536000; includeSubDomains'"
              method.response.header.X-Content-Type-Options: "'nosniff'"
              method.response.header.Cache-Control: "'no-store, no-cache, must-revalidate, private'"
        Type: AWS
        Uri: !Sub 'arn:aws:apigateway:${AWS::Region}:lambda:path/2015-03-31/functions/${Lambda.Arn}/invocations'
#      RequestValidatorId: !Ref ApiRequestValidator
      RequestModels:
        application/json:
          !Ref RequestModel
      MethodResponses:
        - StatusCode: 200
          ResponseModels:
            application/json: Empty
          ResponseParameters:
            method.response.header.Strict-Transport-Security: true
            method.response.header.X-Content-Type-Options: true
            method.response.header.Cache-Control: true
      OperationName: 'lambda'
      ResourceId: !Ref ApiResource
      RestApiId: !Ref RestApi
  RequestModel:
    Type: AWS::ApiGateway::Model
    Properties:
      ContentType: 'application/json'
      RestApiId: !Ref RestApi
      Schema: {"$schema": "http://json-schema.org/draft-04/schema#",
      "title": "Stats",
      "type": "object" }
  ApiLoggingGroup:
    Type: "AWS::Logs::LogGroup"
    Properties:
      KmsKeyId: !GetAtt "EncryptionKey.Arn"
      RetentionInDays: 30
  CloudWatchRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          Action: 'sts:AssumeRole'
          Effect: Allow
          Principal:
            Service: apigateway.amazonaws.com
      Path: /
      ManagedPolicyArns:
        - 'arn:aws:iam::aws:policy/service-role/AmazonAPIGatewayPushToCloudWatchLogs'
  ApiCloudwatchRoleArn:
    Type: AWS::ApiGateway::Account
    Properties: 
      CloudWatchRoleArn: !GetAtt CloudWatchRole.Arn
  ApiStage:
    Type: AWS::ApiGateway::Stage
    Properties:
      DeploymentId: !Ref ApiDeployment
      Description: "API Stage v1"
      RestApiId: !Ref RestApi
      StageName: "v1"
      CacheClusterEnabled: False
      CacheClusterSize: "0.5"
      TracingEnabled: True
      MethodSettings:
        - HttpMethod: "*"
          ResourcePath: "/*"
          CachingEnabled: False
          CacheTtlInSeconds: 60
          DataTraceEnabled: True
          MetricsEnabled: True
          CacheDataEncrypted: True
          LoggingLevel: "INFO"
      AccessLogSetting:
        DestinationArn:
          !GetAtt "ApiLoggingGroup.Arn"
        Format: "$context.identity.sourceIp $context.identity.caller $context.identity.user [$context.requestTime] $context.httpMethod $context.resourcePath $context.protocol $context.status $context.responseLength $context.requestId $context.extendedRequestId"
  ApiRequestValidator:
    Type: AWS::ApiGateway::RequestValidator
    Properties:
      Name: "RequestValidator"
      RestApiId: !Ref RestApi
      ValidateRequestBody: True
      ValidateRequestParameters: False
  ApiDeployment:
    Type: AWS::ApiGateway::Deployment
    DependsOn: HealthCheckMethod
    Properties:
      RestApiId: !Ref RestApi
  ApiRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Sid: ''
            Effect: 'Allow'
            Principal:
              Service:
                - 'apigateway.amazonaws.com'
            Action:
              - 'sts:AssumeRole'
      Path: '/'
      Policies:
        - PolicyName: "ApiRolePolicy"
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Effect: 'Allow'
                Action: 'lambda:*'
                Resource: !GetAtt Lambda.Arn
  ApiUserPolicy:
    Type: AWS::IAM::ManagedPolicy
    Properties:
      Description: Allows user to trigger the test API
      ManagedPolicyName: !Sub "ApiUserPolicy${AWS::Region}"
      PolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Action:
              - execute-api:Invoke
              - execute-api:ManageConnections
            Resource:
              - !Join ['',[!Sub 'arn:aws:execute-api:${AWS::Region}:${AWS::AccountId}:',!Ref RestApi, '*']]
  RestApiDomainCertificate:
    Type: AWS::CertificateManager::Certificate
    Properties:
      CertificateTransparencyLoggingPreference: ENABLED
      DomainName: !Join
        - ''
        - - '*'
          - .
          - !Ref 'DomainName'
          - ''
      ValidationMethod: DNS
  RestApiDomainName:
    Type: 'AWS::ApiGateway::DomainName'
    Properties:
      RegionalCertificateArn: !Ref RestApiDomainCertificate
      SecurityPolicy: "TLS_1_2"
      EndpointConfiguration:
        Types: 
          - "REGIONAL"
      DomainName: !Join
        - ''
        - - !Ref 'DomainNamePrefix'
          - .
          - !Ref 'DomainName'
          - ''
  RestApiMapping:
    Type: 'AWS::ApiGateway::BasePathMapping'
    Properties:
      DomainName: !Ref RestApiDomainName
      RestApiId: !Ref RestApi
  HealthCheckRestApi: 
    Type: 'AWS::Route53::HealthCheck'
    Properties: 
      HealthCheckConfig: 
        Port: 443
        Type: HTTPS
        EnableSNI: True
        ResourcePath: !Sub "${ApiStage}/healthcheck"
        FullyQualifiedDomainName: !Sub "${RestApi}.execute-api.${AWS::Region}.amazonaws.com"
        RequestInterval: 10
        FailureThreshold: 1
Metadata: {}
Outputs:
  HealthCheckId:
    Value: !GetAtt HealthCheckRestApi.HealthCheckId
  AliasTargetHostedZoneId:
    Value: !GetAtt RestApiDomainName.RegionalHostedZoneId
  AliasTargetDNSName:
    Value: !GetAtt RestApiDomainName.RegionalDomainName
  ApiRoleName:
    Value: !Ref ApiRole
  StackId:
    Value: !Ref AWS::StackId
  RestApi:
    Value: RestApi
  HealthcheckFunction:
    Value: Lambda
  DynamoFunction:
    Value: LambdaDynamo
  DeadLetterTopic:
    Value: DeadLetterTopic
  AlarmTopic:
    Value: AlarmTopic
  GlobalTable:
    Value: !Sub 'arn:aws:dynamodb:${AWS::Region}:${AWS::AccountId}:table/global-table'
  GlobalTableIndex:
    Value: !Sub 'arn:aws:dynamodb:${AWS::Region}:${AWS::AccountId}:table/global-table'
  GlobalTableStream:
    Value: !Sub 'arn:aws:dynamodb:${AWS::Region}:${AWS::AccountId}:table/global-table'
  GlobalTableZoneIrland:
    Value: !Sub 'arn:aws:dynamodb:eu-west-1:${AWS::AccountId}:table/global-table'
  GlobalTableIndexIrland:
    Value: !Sub 'arn:aws:dynamodb:eu-west-1:${AWS::AccountId}:table/global-table'
  GlobalTableStreamIrland:
    Value: !Sub 'arn:aws:dynamodb:eu-west-1:${AWS::AccountId}:table/global-table'
  GlobalTableZoneFrankfurt:
    Value: !Sub 'arn:aws:dynamodb:eu-central-1:${AWS::AccountId}:table/global-table'
  GlobalTableIndexFrankfurt:
    Value: !Sub 'arn:aws:dynamodb:eu-central-1:${AWS::AccountId}:table/global-table'
  GlobalTableStreamFrankfurt:
    Value: !Sub 'arn:aws:dynamodb:eu-central-1:${AWS::AccountId}:table/global-table'
  ApiStageArn2:
    Value: !Sub 'arn:aws:apigateway:${AWS::Region}::/restapis/${RestApi}/stages/${ApiStage}'
  HealthCheckUrl:
    Value: !Sub "https://${DomainNamePrefix}.${DomainName}/${ApiStage}/healthcheck"
  ApiEndpointDomain:
    Value: !Join
      - ''
      - - !Ref 'DomainNamePrefix'
        - .
        - !Ref 'DomainName'
        - ''