template.yaml

AWSTemplateFormatVersion: '2010-09-09'
Transform: AWS::Serverless-2016-10-31
Description: >
  flyless let's you evolve database schema in serverless stack

Parameters:
  DBName:
    Type: String
  DBStage:
    Type: String
  DeployTimestamp:
    Type: Number
    Default: 0

Globals:
  Function:
    Timeout: 30

Resources:
  VPC:
    Type: AWS::EC2::VPC
    Properties:
      CidrBlock: 10.0.0.0/16
      EnableDnsSupport: 'true'
      EnableDnsHostnames: 'true'

  IG:
    Type: AWS::EC2::InternetGateway

  IGAttachment:
    Type: AWS::EC2::VPCGatewayAttachment
    Properties:
      VpcId: !Ref VPC
      InternetGatewayId: !Ref IG

  PrivateDBSubnetA:
    Type: AWS::EC2::Subnet
    Properties:
      VpcId: !Ref VPC
      CidrBlock: 10.0.1.0/24
      AvailabilityZone: !Select
        - 0
        - !GetAZs
          Ref: 'AWS::Region'

  PrivateDBSubnetB:
    Type: AWS::EC2::Subnet
    Properties:
      VpcId: !Ref VPC
      CidrBlock: 10.0.2.0/24
      AvailabilityZone: !Select
        - 1
        - !GetAZs
          Ref: 'AWS::Region'

  PrivateFnSubnetA:
    Type: AWS::EC2::Subnet
    Properties:
      VpcId: !Ref VPC
      CidrBlock: 10.0.10.0/24
      AvailabilityZone: !Select
        - 0
        - !GetAZs
          Ref: 'AWS::Region'

  PrivateFnSubnetB:
    Type: AWS::EC2::Subnet
    Properties:
      VpcId: !Ref VPC
      CidrBlock: 10.0.11.0/24
      AvailabilityZone: !Select
        - 1
        - !GetAZs
          Ref: 'AWS::Region'

  PrivateRT:
    Type: AWS::EC2::RouteTable
    Properties:
      VpcId: !Ref VPC

  PrivateRTAssociation1:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      SubnetId: !Ref PrivateDBSubnetA
      RouteTableId: !Ref PrivateRT

  PrivateRTAssociation2:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      SubnetId: !Ref PrivateDBSubnetB
      RouteTableId: !Ref PrivateRT

  PrivateRTAssociation3:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      SubnetId: !Ref PrivateFnSubnetA
      RouteTableId: !Ref PrivateRT

  PrivateRTAssociation4:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      SubnetId: !Ref PrivateFnSubnetB
      RouteTableId: !Ref PrivateRT

  NG:
    Type: AWS::EC2::NatGateway
    Properties:
      AllocationId: !GetAtt EIP.AllocationId
      SubnetId: !Ref PublicSubnetA
    DependsOn: VPC

  EIP:
    Type: AWS::EC2::EIP
    Properties:
      Domain: vpc
    DependsOn: IGAttachment

  PrivateRTRouteToNG:
    Type: AWS::EC2::Route
    Properties:
      RouteTableId: !Ref PrivateRT
      DestinationCidrBlock: 0.0.0.0/0
      NatGatewayId: !Ref NG

  PublicSubnetA:
    Type: AWS::EC2::Subnet
    Properties:
      VpcId: !Ref VPC
      CidrBlock: 10.0.20.0/24
      AvailabilityZone: !Select
        - 0
        - !GetAZs
          Ref: 'AWS::Region'

  PublicSubnetB:
    Type: AWS::EC2::Subnet
    Properties:
      VpcId: !Ref VPC
      CidrBlock: 10.0.21.0/24
      AvailabilityZone: !Select
        - 1
        - !GetAZs
          Ref: 'AWS::Region'

  PublicRT:
    Type: AWS::EC2::RouteTable
    Properties:
      VpcId: !Ref VPC

  PublicRTAssociation1:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      SubnetId: !Ref PublicSubnetA
      RouteTableId: !Ref PublicRT

  PublicRTAssociation2:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      SubnetId: !Ref PublicSubnetB
      RouteTableId: !Ref PublicRT

  PublicRTRouteToInternet:
    Type: AWS::EC2::Route
    Properties:
      RouteTableId: !Ref PublicRT
      DestinationCidrBlock: 0.0.0.0/0
      GatewayId: !Ref IG

  DB:
    Type: AWS::RDS::DBInstance
    Properties:
      AllocatedStorage: 5
      DBInstanceClass: db.t3.small
      DBName: !Ref DBName
      Engine: mysql
      EngineVersion: 5.7.31
      MasterUsername: !Join ['', ['{{resolve:secretsmanager:', !Ref DBSecret, ':SecretString:username}}' ]]
      MasterUserPassword: !Join ['', ['{{resolve:secretsmanager:', !Ref DBSecret, ':SecretString:password}}' ]]
      MultiAZ: False
      PubliclyAccessible: False
      StorageType: gp2
      DBSubnetGroupName: !Ref DBPrivateSubnetGroup
      VPCSecurityGroups:
        - !GetAtt DBSecurityGroup.GroupId
    DeletionPolicy: Delete

  DBPrivateSubnetGroup:
    Type: AWS::RDS::DBSubnetGroup
    Properties:
      DBSubnetGroupDescription: DB subnet group
      SubnetIds:
        - !Ref PrivateDBSubnetA
        - !Ref PrivateDBSubnetB

  DBSecret:
    Type: AWS::SecretsManager::Secret
    Properties:
      Description: !Sub 'This is the secret for database from ${AWS::StackName} stack'
      GenerateSecretString:
        SecretStringTemplate: '{"username": "admin"}'
        GenerateStringKey: 'password'
        PasswordLength: 16
        ExcludeCharacters: '"@/\'

  SecretRDSInstanceAttachment:
    Type: AWS::SecretsManager::SecretTargetAttachment
    Properties:
      SecretId: !Ref DBSecret
      TargetId: !Ref DB
      TargetType: AWS::RDS::DBInstance

  DBSecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: Allow access to MySQL from Lambda SG
      VpcId: !Ref VPC
      SecurityGroupIngress:
        - IpProtocol: tcp
          FromPort: 3306
          ToPort: 3306
          SourceSecurityGroupId : !Ref FnSecurityGroup

  FnSecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: Security group for Lambda function
      VpcId: !Ref VPC

  MigrationFunction:
    Type: AWS::Serverless::Function
    Properties:
      CodeUri: MigrationFunction
      Handler: io.github.ajurasz.flyless.MigrationHandler::handleRequest
      Runtime: java11
      MemorySize: 512
      Policies:
        - AWSLambdaVPCAccessExecutionRole
        - Version: '2012-10-17'
          Statement:
            - Effect: Allow
              Action:
                - secretsmanager:*
              Resource: !Ref DBSecret
      VpcConfig:
        SecurityGroupIds:
          - !Ref FnSecurityGroup
        SubnetIds:
          - !Ref PrivateFnSubnetA
          - !Ref PrivateFnSubnetB
      Environment:
        Variables:
          RDS_SECRET: !Ref DBSecret
          RDS_DB_NAME: !Ref DBName
          DB_STAGE: !Ref DBStage
    DependsOn:
      - DB
      - PublicRTAssociation1
      - PublicRTAssociation2
      - PublicRTRouteToInternet
      - PrivateRTAssociation3
      - PrivateRTAssociation4
      - PrivateRTRouteToNG
      - IGAttachment

  LambdaMigrationFunctionTrigger:
    Type: Custom::LambdaMigrationFunctionTrigger
    Properties:
      ServiceToken: !GetAtt MigrationFunction.Arn
      DeployTimestamp: !Ref DeployTimestamp