template.yaml

AWSTemplateFormatVersion: '2010-09-09'
Transform: AWS::Serverless-2016-10-31
Description: >
  subscriber
  Sample SAM Template for subscriber
Parameters:
  pdsJwtAud:
    Type: String
    Default: "https://int.api.service.nhs.uk/oauth2/token"
  pdsJwtKid:
    Type: String
    Default: "int-2"
  pdsBaseUrl:
    Type: String
    Default: "https://int.api.service.nhs.uk"
  managementInterfaceBaseUrl:
    Type: String
    Default: "http://api-django-staging.internal.hans.service.thepsc.co.uk"
  domainName:
    Type: String
    Default: "api-staging.hans.service.thepsc.co.uk"
  hostedZoneId:
    Type: String
    Default: "Z0749399NWCFPUQORL8R"
  secretName:
    Type: String
    Default: "nhs-hans-staging"
  vpcId:
    Type: String
  vpcEndpointId:
    Type: String
  securityGroupId:
    Type: String
  subnetId1:
    Type: AWS::EC2::Subnet::Id
  subnetId2:
    Type: AWS::EC2::Subnet::Id
  subnetId3:
    Type: AWS::EC2::Subnet::Id

# More info about Globals: https://github.com/awslabs/serverless-application-model/blob/master/docs/globals.rst
Globals:
  Function:
    Timeout: 30
    MemorySize: 128
    Environment:
      Variables:
        POWERTOOLS_SERVICE_NAME: hans
        LOG_LEVEL: INFO

# AWS SAM Spec is here: https://github.com/awslabs/serverless-application-model/blob/master/versions/2016-10-31.md#api
Resources:
  DomainCertificate:
    Type: AWS::CertificateManager::Certificate
    Properties:
      DomainName: !Ref domainName
      ValidationMethod: DNS
      DomainValidationOptions:
      - DomainName: !Ref domainName
        HostedZoneId: !Ref hostedZoneId
  APIGatewayPublic:
    Type: AWS::Serverless::Api
    Properties:
      Description: Domain configured API gateway for public-facing APIs
      Domain:
        CertificateArn: !Ref DomainCertificate
        DomainName: !Ref domainName
        Route53:
          HostedZoneId: !Ref hostedZoneId
      StageName: Prod
  APIGatewayInternal:
    Type: AWS::Serverless::Api
    Properties:
      Description: Domain configure API gateway for internal-only APIs
      Auth:
        ResourcePolicy:
          SourceVpcWhitelist:
          - !Ref vpcId
      EndpointConfiguration:
        Type: PRIVATE
        VPCEndpointIds:
          - !Ref vpcEndpointId
      StageName: Prod
  SubscriptionCreateFunction:
    Type: AWS::Serverless::Function
    Properties:
      CodeUri: src/subscription_create
      Handler: subscription_create.app.lambda_handler
      Runtime: python3.9
      Description: Lambda function that creates a subscription for a given CareRecipient
      Architectures:
        - x86_64
      Events:
        SubscriptionCreate:
          Type: Api
          Properties:
            Path: /subscription
            Method: post
            RestApiId: !Ref APIGatewayInternal
      Environment:
        Variables:
          PDS_JWT_RSA_PRIVATE_KEY: !Join
            - ""
            - - "{{resolve:secretsmanager:"
              - !Ref secretName
              - ":SecretString:PDS_JWT_RSA_PRIVATE_KEY}}"
          PDS_JWT_SUB: !Join
            - ""
            - - "{{resolve:secretsmanager:"
              - !Ref secretName
              - ":SecretString:PDS_JWT_SUB}}"
          PDS_JWT_ISS: !Join
            - ""
            - - "{{resolve:secretsmanager:"
              - !Ref secretName
              - ":SecretString:PDS_JWT_ISS}}"
          PDS_API_KEY: !Join
            - ""
            - - "{{resolve:secretsmanager:"
              - !Ref secretName
              - ":SecretString:PDS_API_KEY}}"
          PDS_JWT_AUD: !Ref pdsJwtAud
          PDS_JWKS_KID: !Ref pdsJwtKid
          PDS_BASE_URL: !Ref pdsBaseUrl
  SubscriptionDeleteFunction:
    Type: AWS::Serverless::Function
    Properties:
      CodeUri: src/subscription_delete
      Handler: subscription_delete.app.lambda_handler
      Runtime: python3.9
      Description: Lambda function that deletes a subscription for a given CareRecipient
      Architectures:
        - x86_64
      Events:
        SubscriptionDelete:
          Type: Api
          Properties:
            Path: /subscription/{id}
            Method: delete
            RestApiId: !Ref APIGatewayInternal
  UnprocessedMessageQueue:
    Type: AWS::SQS::Queue
    Properties:
      RedrivePolicy:
        deadLetterTargetArn: !GetAtt DeadLetterQueue.Arn
        maxReceiveCount: 10
  EmailCareProviderFunction:
    Type: AWS::Serverless::Function
    Properties:
      CodeUri: src/email_care_provider
      Handler: email_care_provider.app.lambda_handler
      Runtime: python3.9
      Description: Lambda function that processes messages from the queue and sends emails to care providers
      Architectures:
        - x86_64
      MemorySize: 512
      Events:
        NewUnprocessedMessage:
          Type: SQS
          Properties:
            Queue: !GetAtt UnprocessedMessageQueue.Arn
            BatchSize: 10
            Enabled: True
      Environment:
        Variables:
          MANAGEMENT_INTERFACE_BASE_URL: !Ref managementInterfaceBaseUrl
          NOTIFY_API_KEY: !Join
            - ""
            - - "{{resolve:secretsmanager:"
              - !Ref secretName
              - ":SecretString:NOTIFY_API_KEY}}"
      VpcConfig:
        SecurityGroupIds:
          - !Ref securityGroupId
        SubnetIds:
          - !Ref subnetId1
          - !Ref subnetId2
          - !Ref subnetId3
  DeadLetterQueue:
    Type: AWS::SQS::Queue
  ConvertHL7v2ToFhirFunction:
    Type: AWS::Serverless::Function
    Properties:
      CodeUri: src/convert_hl7v2_fhir
      Handler: convert_hl7v2_fhir.app.lambda_handler
      Runtime: python3.9
      Description: Lambda function that converts HL7v2 (over HTTPs) to FHIR
      Architectures:
        - x86_64
      MemorySize: 512
      Events:
        ConvertHL7v2:
          Type: Api
          Properties:
            Path: /message/hl7v2
            Method: post
            RestApiId: !Ref APIGatewayPublic
      Timeout: 30
      Environment:
        Variables:
          SQS_CONVERTED_QUEUE_URL: !GetAtt UnprocessedMessageQueue.QueueUrl
          MANAGEMENT_INTERFACE_BASE_URL: !Ref managementInterfaceBaseUrl
      VpcConfig:
        SecurityGroupIds:
          - !Ref securityGroupId
        SubnetIds:
          - !Ref subnetId1
          - !Ref subnetId2
          - !Ref subnetId3
      Policies:
      - Statement:
        - Sid: AllowQueueSendMessage
          Effect: Allow
          Action:
          - sqs:SendMessage
          Resource: !GetAtt UnprocessedMessageQueue.Arn
  
      

Outputs:
  # ServerlessRestApi is an implicit API created out of Events key under Serverless::Function
  # Find out more about other implicit resources you can reference within SAM
  # https://github.com/awslabs/serverless-application-model/blob/master/docs/internals/generated_resources.rst#api
  ManageAPI:
    Description: "API Gateway endpoint URL for Prod stage for public functions (/message/hl7v2)"
    Value: !Sub "https://${APIGatewayPublic}.execute-api.${AWS::Region}.amazonaws.com/Prod"
  PrivateAPI:
    Description: "API Gateway endpoint URL for Prod stage for private functions (/subscription/*)"
    Value: !Sub "https://${APIGatewayInternal}-${vpcEndpointId}.execute-api.${AWS::Region}.amazonaws.com/Prod"
  UnprocessedMessageQueueUrl:
    Description: "URL for queue containing messages to be processed"
    Value: !GetAtt UnprocessedMessageQueue.QueueUrl