error-triage-agent/template.yaml at main · toaditi/error-triage-agent · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
AWSTemplateFormatVersion: '2010-09-09'
Transform: AWS::Serverless-2016-10-31
Description: Error Triage Agent (Lambda + Config API + optional UI)

Parameters:
  ConfigSecretName:
    Type: String
    Description: Secrets Manager secret name containing the JSON config
  DdbTableName:
    Type: String
    Default: agent_seen_files
  EnablePublicUi:
    Type: String
    Default: 'false'
    AllowedValues: ['true','false']

Globals:
  Function:
    Runtime: java17
    MemorySize: 1024
    Timeout: 60
    Tracing: Active

Resources:
  ServerlessApi:
    Type: AWS::Serverless::Api
    Properties:
      StageName: Prod
      Cors:
        AllowMethods: "'GET,PUT,OPTIONS'"
        AllowHeaders: "'Content-Type,Authorization'"
        AllowOrigin: "'*'"

  TriageFunction:
    Type: AWS::Serverless::Function
    Properties:
      Handler: com.acme.triage.App::handleRequest
      CodeUri: .
      Environment:
        Variables:
          CONFIG_SECRET_NAME: !Ref ConfigSecretName
          DDB_TABLE: !Ref DdbTableName
      Policies:
        - AWSLambdaBasicExecutionRole
        - Version: '2012-10-17'
          Statement:
            - Effect: Allow
              Action:
                - secretsmanager:GetSecretValue
              Resource: '*'
            - Effect: Allow
              Action:
                - dynamodb:GetItem
                - dynamodb:PutItem
              Resource: '*'

  ConfigApiFunction:
    Type: AWS::Serverless::Function
    Properties:
      Handler: com.acme.triage.api.ConfigApiHandler::handleRequest
      CodeUri: .
      Events:
        GetConfig:
          Type: Api
          Properties:
            RestApiId: !Ref ServerlessApi
            Path: /config
            Method: get
        PutConfig:
          Type: Api
          Properties:
            RestApiId: !Ref ServerlessApi
            Path: /config
            Method: put
        OptConfig:
          Type: Api
          Properties:
            RestApiId: !Ref ServerlessApi
            Path: /config
            Method: options
      Environment:
        Variables:
          CONFIG_SECRET_NAME: !Ref ConfigSecretName
          # Optionally set CONFIG_UI_TOKEN after deploy for shared-secret auth
      Policies:
        - AWSLambdaBasicExecutionRole
        - Version: '2012-10-17'
          Statement:
            - Effect: Allow
              Action:
                - secretsmanager:GetSecretValue
                - secretsmanager:UpdateSecret
              Resource: '*'

  SeenFilesTable:
    Type: AWS::DynamoDB::Table
    Properties:
      TableName: !Ref DdbTableName
      BillingMode: PAY_PER_REQUEST
      AttributeDefinitions:
        - AttributeName: fingerprint
          AttributeType: S
      KeySchema:
        - AttributeName: fingerprint
          KeyType: HASH

  UiBucket:
    Type: AWS::S3::Bucket
    Properties:
      WebsiteConfiguration:
        IndexDocument: index.html
    DeletionPolicy: Retain

  UiBucketPolicy:
    Type: AWS::S3::BucketPolicy
    Condition: PublicUi
    Properties:
      Bucket: !Ref UiBucket
      PolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal: '*'
            Action: 's3:GetObject'
            Resource: !Sub '${UiBucket.Arn}/*'

Conditions:
  PublicUi: !Equals [ !Ref EnablePublicUi, 'true' ]

Outputs:
  ApiUrl:
    Value: !Sub 'https://${ServerlessApi}.execute-api.${AWS::Region}.amazonaws.com/Prod'
  UiBucketName:
    Value: !Ref UiBucket
  TriageFunctionName:
    Value: !Ref TriageFunction
  ConfigApiFunctionName:
    Value: !Ref ConfigApiFunction