template.yaml

AWSTemplateFormatVersion: "2010-09-09"
Transform: AWS::Serverless-2016-10-31

Parameters:
  VpcId:
    Type: AWS::EC2::VPC::Id
    Description: VPC ID where the lambdas will be deployed.
  SubnetIds:
    Type: List<AWS::EC2::Subnet::Id>
    Description: List of SUbnet IDs where the lambdas will be deployed.
  DatamasqueBaseUrl:
    Type: String
    Description: DATAMASQUE instance URL.
  DatamasqueSecretArn:
    Type: String
    Description: AWS secret for DATAMASQUE instance credentials.
  DataMasqueSecurityGroup:
    Type: String
    Description: Security Group ID for connectivity between Staged DB and DM instance.

Resources:
  DatamasqueRunSg:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: DATAMASQUE blueprint API run Lambda security group
      VpcId:
        Ref: VpcId

  DatamasqueRun:
    Type: AWS::Serverless::Function
    Properties:
      CodeUri: functions/datamasque_run/
      Handler: app.lambda_handler
      Runtime: python3.9
      Timeout: 10
      Architectures:
        - x86_64
      Policies:
        - VPCAccessPolicy: {}
        - AWSSecretsManagerGetSecretValuePolicy:
            SecretArn: !Ref DatamasqueSecretArn
        - AWSSecretsManagerGetSecretValuePolicy:
            SecretArn: !Sub "arn:aws:secretsmanager:${AWS::Region}:${AWS::AccountId}:secret:datamasque/*connections*"
      VpcConfig:
        SubnetIds:
          Ref: SubnetIds
        SecurityGroupIds:
          - Ref: DatamasqueRunSg
      Environment:
        Variables:
          DATANASQUE_BASE_URL: !Ref DatamasqueBaseUrl
          DATAMASQUE_SECRET_ARN: !Ref DatamasqueSecretArn

  DescribeDBInstances:
    Type: AWS::Serverless::Function # More info about Function Resource: https://docs.aws.amazon.com/serverless-application-model/latest/developerguide/sam-resource-function.html
    Properties:
      CodeUri: functions/describe_db_instances/
      Handler: app.lambda_handler
      Runtime: python3.9
      Timeout: 10
      Architectures:
        - x86_64
      Policies:
        - AmazonRDSReadOnlyAccess

  DescribeDBSnapshot:
    Type: AWS::Serverless::Function # More info about Function Resource: https://docs.aws.amazon.com/serverless-application-model/latest/developerguide/sam-resource-function.html
    Properties:
      CodeUri: functions/describe_db_snapshots/
      Handler: app.lambda_handler
      Runtime: python3.9
      Timeout: 10
      Architectures:
        - x86_64
      Policies:
        - AmazonRDSReadOnlyAccess
        - Statement:
            - Action:
                - rds:CreateDBSnapshot
                - rds:CreateDBClusterSnapshot
                - rds:AddTagsToResource
              Effect: Allow
              Resource: "*"

  RestoreDBInstanceFromSnapshot:
    Type: AWS::Serverless::Function # More info about Function Resource: https://docs.aws.amazon.com/serverless-application-model/latest/developerguide/sam-resource-function.html
    Properties:
      CodeUri: functions/restore_db_instance_from_db_snapshot/
      Handler: app.lambda_handler
      Runtime: python3.9
      Timeout: 10
      Environment:
        Variables:
          DATANASQUE_SG: !Ref DataMasqueSecurityGroup
      Architectures:
        - x86_64
      Policies:
        - AmazonRDSReadOnlyAccess
        - Statement:
            - Action:
                - iam:PassRole
                - rds:AddTagsToResource
                - rds:RestoreDBInstanceFromDBSnapshot
                - rds:RestoreDBClusterFromSnapshot
              Effect: Allow
              Resource: "*"

  CheckDBAvailability:
    Type: AWS::Serverless::Function # More info about Function Resource: https://docs.aws.amazon.com/serverless-application-model/latest/developerguide/sam-resource-function.html
    Properties:
      CodeUri: functions/check_db_availability/
      Handler: app.lambda_handler
      Runtime: python3.9
      Timeout: 10
      Architectures:
        - x86_64
      Policies:
        - AmazonRDSReadOnlyAccess
        - Statement:
            - Action:
                - rds:AddTagsToResource
              Effect: Allow
              Resource: "*"
            - Action:
                - rds:CreateDBInstance
              Effect: Allow
              Resource: "*"

  CreateMaskedSnapshot:
    Type: AWS::Serverless::Function # More info about Function Resource: https://docs.aws.amazon.com/serverless-application-model/latest/developerguide/sam-resource-function.html
    Properties:
      CodeUri: functions/create_masked_snapshot/
      Handler: app.lambda_handler
      Runtime: python3.9
      Timeout: 60
      Architectures:
        - x86_64
      Policies:
        - AmazonRDSReadOnlyAccess
        - Statement:
            - Action:
                - rds:CreateDBSnapshot
                - rds:CreateDBClusterSnapshot
              Effect: Allow
              Resource: "*"

  CheckMaskedSnapshot:
    Type: AWS::Serverless::Function # More info about Function Resource: https://docs.aws.amazon.com/serverless-application-model/latest/developerguide/sam-resource-function.html
    Properties:
      CodeUri: functions/check_masked_snapshot/
      Handler: app.lambda_handler
      Runtime: python3.9
      Timeout: 60
      Architectures:
        - x86_64
      Policies:
        - AmazonRDSReadOnlyAccess

  CheckMaskingRunStatus:
    Type: AWS::Serverless::Function # More info about Function Resource: https://docs.aws.amazon.com/serverless-application-model/latest/developerguide/sam-resource-function.html
    Properties:
      CodeUri: functions/check_masking_run/
      Handler: app.lambda_handler
      Runtime: python3.9
      Timeout: 20
      Architectures:
        - x86_64
      Policies:
        - VPCAccessPolicy: {}
        - AWSSecretsManagerGetSecretValuePolicy:
            SecretArn: !Ref DatamasqueSecretArn
      VpcConfig:
        SubnetIds:
          Ref: SubnetIds
        SecurityGroupIds:
          - Ref: DatamasqueRunSg
      Environment:
        Variables:
          DATANASQUE_BASE_URL: !Ref DatamasqueBaseUrl
          DATAMASQUE_SECRET_ARN: !Ref DatamasqueSecretArn

  DatamasqueBlueprintStateMachine:
    Type: AWS::Serverless::StateMachine # More info about State Machine Resource: https://docs.aws.amazon.com/serverless-application-model/latest/developerguide/sam-resource-statemachine.html
    Properties:
      DefinitionUri: statemachine/datamasque_blueprint.asl.json
      DefinitionSubstitutions:
        DatamasqueRunFunctionArn: !GetAtt DatamasqueRun.Arn
        DescribeDBSnapshotFunctionArn: !GetAtt DescribeDBSnapshot.Arn
        DescribeDBInstancesFunctionArn: !GetAtt DescribeDBInstances.Arn
        RestoreDBInstanceFromSnapshotFunctionArn: !GetAtt RestoreDBInstanceFromSnapshot.Arn
        CheckDBAvailabilityArn: !GetAtt CheckDBAvailability.Arn
        CheckMaskingRunStatus: !GetAtt CheckMaskingRunStatus.Arn
        CreateMaskedSnapshot: !GetAtt CreateMaskedSnapshot.Arn
        CheckMaskedSnapshot: !GetAtt CheckMaskedSnapshot.Arn
      Policies:
        - LambdaInvokePolicy:
            FunctionName: !Ref DescribeDBInstances
        - LambdaInvokePolicy:
            FunctionName: !Ref DescribeDBSnapshot
        - LambdaInvokePolicy:
            FunctionName: !Ref RestoreDBInstanceFromSnapshot
        - LambdaInvokePolicy:
            FunctionName: !Ref DatamasqueRun
        - LambdaInvokePolicy:
            FunctionName: !Ref CheckDBAvailability
        - LambdaInvokePolicy:
            FunctionName: !Ref CheckMaskingRunStatus
        - LambdaInvokePolicy:
            FunctionName: !Ref CreateMaskedSnapshot
        - LambdaInvokePolicy:
            FunctionName: !Ref CheckMaskedSnapshot
        - Statement:
            - Action:
                - rds:DeleteDBInstance
              Effect: Allow
              Resource:
                - !Sub "arn:aws:rds:${AWS::Region}:${AWS::AccountId}:db:*-datamasque"
                - !Sub "arn:aws:rds:${AWS::Region}:${AWS::AccountId}:db:*-datamasque-1"
            - Action:
                - rds:DeleteDBCluster
              Effect: Allow
              Resource: !Sub "arn:aws:rds:${AWS::Region}:${AWS::AccountId}:cluster:*-datamasque"
            - Action:
                - rds:CreateDBSnapshot
                - rds:CreateDBClusterSnapshot
              Effect: Allow
              Resource: "*"
      Events:
        Schedule:
          Type: Schedule # More info about Schedule Event Source: https://docs.aws.amazon.com/serverless-application-model/latest/developerguide/sam-property-statemachine-schedule.html
          Properties:
            Description: Schedule to run the DATAMASQUE state machine weekly
            Enabled: False
            Schedule: "rate(7 days)"
            Input: '{
              "DBInstanceIdentifier": "demo-oracle-datamasque-03-rds",
              "DBSecretIdentifier": "arn:aws:secretsmanager:${AWS::Region}:${AWS::AccountId}:secret:datamasque/demo/oracle_connections-TpvoiO",
              "DataMasqueRulesetId": "4f115c49-43bb-4cbc-a5b8-55a5aa9509e0",
              "PreferredAZ": "ap-southeast-2b"
              }'