template-with-and-without-data-api-and-rds-proxy.yaml

AWSTemplateFormatVersion: '2010-09-09'
Transform: AWS::Serverless-2016-10-31
Description: >
  AWSLambdaJavaAuroraServerlessV2ViaDataApiProductApi
  Sample SAM Template

Parameters:
  DBClusterName:
    Description: "Aurora Serverless V2 RDS cluster name"
    Type: String
    Default: AuroraServerlessV2DataApiCluster
  DatabaseName:
    Description: "Aurora Serverless V2 RDS database name"
    Type: String
    Default: AuroraServerlessV2DataApiClusterDB
  DatabaseStackName:
    Description: "Name of the Aurora Serverlss V2 CloudFormation stack to import parameters from"
    Type: String
    Default: AuroraServerlessV2
  DBMasterUserName:
    Type: String
    Default: postgres
  UserSecret:
    Type: String
    Default: AuroraServerlessV2UserSecret
  Stage:
    Type: String
    Default: prod
  VpcId:
    Type: String
    Default: vpc-950cd6fd
    Description: VpcId of your existing Virtual Private Cloud (VPC)
  Subnets:
    Type: CommaDelimitedList  
    Default: subnet-0787be4d, subnet-88dc46e0
    Description: The list of SubnetIds, for at least two Availability Zones in the
      region in your Virtual Private Cloud (VPC)
    
Globals:
  Function:
    CodeUri: target/aws-lambda-java-21-aurora-serverless-v2-data-api-1.0.0-SNAPSHOT.jar
    Runtime: java21 
     #SnapStart:
      #ApplyOn: PublishedVersions 
    Timeout: 60 
    MemorySize: 1024  
    Environment:
      Variables:
        JAVA_TOOL_OPTIONS: "-XX:+TieredCompilation -XX:TieredStopAtLevel=1"
        DB_ENDPOINT: !GetAtt AuroraServerlessV2Cluster.Endpoint.Address
        DB_NAME: !Ref DatabaseName
        DB_CLUSTER_ARN: !Sub arn:aws:rds:${AWS::Region}:${AWS::AccountId}:cluster:${DBClusterName}
        DB_CRED_SECRETS_STORE_ARN: !Ref  DBSecret
        
Resources:

  MyApi:
    Type: AWS::Serverless::Api
    Properties:
      StageName: !Ref Stage
      Name: AWSAuroraServerlessV2ProductApiViaDataApi
      Description: Api for Aurora Serverless V2 Data Api access
      AccessLogSetting:
        DestinationArn: !Sub ${MyApiLogGroup.Arn} # This Log Group is already created within our SAM Template
        Format: "{'integrationLatency':'$context.integrationLatency', 'latency':'$context.responseLatency', 'requestId':'$context.requestId', 'ip': '$context.identity.sourceIp', 'caller':'$context.identity.caller', 'user':'$context.identity.user','requestTime':'$context.requestTime', 'xrayTraceId':'$context.xrayTraceId', 'wafResponseCode':'$context.wafResponseCode', 'httpMethod':'$context.httpMethod','resourcePath':'$context.resourcePath', 'status':'$context.status','protocol':'$context.protocol', 'responseLength':'$context.responseLength' }"
      #MethodSettings:
       # - MetricsEnabled: True
       #   ResourcePath: '/*'
       #   HttpMethod: '*'
      Auth:
        ApiKeyRequired: true  # sets for all methods
      
        
  MyApiLogGroup:
    Type: AWS::Logs::LogGroup
    Properties:
       LogGroupName: !Sub "/aws/apigateway/${MyApi}"
       RetentionInDays: 7
      
  MyApiUsagePlan:
     Type: AWS::ApiGateway::UsagePlan
     DependsOn:  
        - MyApiStage
     Properties:
      ApiStages: 
        - ApiId: !Ref MyApi
          Stage: !Ref Stage
      UsagePlanName: AWSAuroraServerlessV2ProductApiViaDataApiUsagePlan
      Description: Usage plan for AWSAuroraServerlessV2ProductApiViaDataApi
      Quota:
          Limit: 2000000
          Period: DAY
      Throttle:
          RateLimit:  10000
          BurstLimit: 5000   

  MyApiKey: 
    Type: AWS::ApiGateway::ApiKey
    DependsOn:  
       - MyApiStage
    Properties: 
      Name: "AWSAuroraServerlessV2ProductApiViaDataApuAKey"
      Description: "AWSAuroraServerlessV2ProductApiViaDataApi Api Key"
      Enabled: true
      GenerateDistinctId: false
      Value: a6ZbcDefQW12BN56WEW7
      StageKeys:
        - RestApiId: !Ref MyApi
          StageName: !Ref Stage

  MyApiUsagePlanKey:
      Type: "AWS::ApiGateway::UsagePlanKey"
      DependsOn: 
      - MyApi
      Properties:
        KeyId: !Ref MyApiKey
        KeyType: API_KEY
        UsagePlanId: !Ref MyApiUsagePlan


  CreateUserDataApiFunction:
    Type: AWS::Serverless::Function
    Properties:
      FunctionName: CreateUserViaAuroraServerlessV2DataApi
      AutoPublishAlias: liveVersion
      Handler: software.amazonaws.example.product.handler.CreateUserViaAuroraServerlessV2DataApiHandler::handleRequest
      Policies:
        - Version: '2012-10-17' # Policy Document
          Statement:
            - Effect: Allow
              Action:
                - rds-data:*
              Resource:
                 !Sub arn:aws:rds:${AWS::Region}:${AWS::AccountId}:cluster:${DBClusterName}
            - Effect: Allow
              Action:
                - secretsmanager:GetSecretValue
              Resource:
                !Ref DBSecret
      Events:
        PutRequest:
          Type: Api
          Properties:
            RestApiId: !Ref MyApi
            Path: /user
            Method: put
            
            
  CreateUserDataApiFunctionLogGroup:
    Type: AWS::Logs::LogGroup
    Properties:
      LogGroupName: !Sub "/aws/lambda/${CreateUserDataApiFunction}"
      RetentionInDays: 7


  GetProductByIdDataApiFunction:
    Type: AWS::Serverless::Function
    Properties:
      FunctionName: GetProductByIdViaAuroraServerlessV2DataApi
      AutoPublishAlias: liveVersion
      Handler: software.amazonaws.example.product.handler.GetProductByIdViaAuroraServerlessV2DataApiHandler::handleRequest
      Policies:
        - Version: '2012-10-17' # Policy Document
          Statement:
            - Effect: Allow
              Action:
                - rds-data:*
              Resource:
                 !Sub arn:aws:rds:${AWS::Region}:${AWS::AccountId}:cluster:${DBClusterName}
            - Effect: Allow
              Action:
                - secretsmanager:GetSecretValue
              Resource:
                !Ref DBSecret               
      Events:
        GetRequestById:
          Type: Api
          Properties:
            RestApiId: !Ref MyApi
            Path: /products/{id}
            Method: get     

            
            
  GetProductByIdDataApiFunctionLogGroup:
    Type: AWS::Logs::LogGroup
    Properties:
      LogGroupName: !Sub "/aws/lambda/${GetProductByIdDataApiFunction}"
      RetentionInDays: 7



  GetProductByIdDataApiWithPrimingFunction:
    Type: AWS::Serverless::Function
    Properties:
      FunctionName: GetProductByIdViaAuroraServerlessV2DataApiWithPriming
      AutoPublishAlias: liveVersion
      Handler: software.amazonaws.example.product.handler.GetProductByIdViaAuroraServerlessV2DataApiWithPrimingHandler::handleRequest
      Policies:
        - Version: '2012-10-17' # Policy Document
          Statement:
            - Effect: Allow
              Action:
                - rds-data:*
              Resource:
                 !Sub arn:aws:rds:${AWS::Region}:${AWS::AccountId}:cluster:${DBClusterName}
            - Effect: Allow
              Action:
                - secretsmanager:GetSecretValue
              Resource:
                !Ref DBSecret
      Events:
        GetRequestById:
          Type: Api
          Properties:
            RestApiId: !Ref MyApi
            Path: /productsWithPriming/{id}
            Method: get     
            
            
  GetProductByIdDataApiWithPrimingFunctionLogGroup:
    Type: AWS::Logs::LogGroup
    Properties:
      LogGroupName: !Sub "/aws/lambda/${GetProductByIdDataApiWithPrimingFunction}"
      RetentionInDays: 7

  CreateProductsDataApiFunction:
    Type: AWS::Serverless::Function
    Properties:
      FunctionName: CreateProductsViaAuroraServerlessV2DataApi
      AutoPublishAlias: liveVersion
      Handler: software.amazonaws.example.product.handler.CreateProductsViaAuroraServerlessV2DataApiHandler::handleRequest
      Policies:
        - Version: '2012-10-17' # Policy Document
          Statement:
            - Effect: Allow
              Action:
                - rds-data:*
              Resource:
                 !Sub arn:aws:rds:${AWS::Region}:${AWS::AccountId}:cluster:${DBClusterName}
            - Effect: Allow
              Action:
                - secretsmanager:GetSecretValue
              Resource:
                !Ref DBSecret
      Events:
        PutProducts:
          Type: Api
          Properties:
            RestApiId: !Ref MyApi
            Path: /products
            Method: put     

            
            
  CreateProductsDataApiFunctionLogGroup:
    Type: AWS::Logs::LogGroup
    Properties:
      LogGroupName: !Sub "/aws/lambda/${CreateProductsDataApiFunction}"
      RetentionInDays: 7


  GetProductByIdWithoutDataApiFunction:
    Type: AWS::Serverless::Function
    Properties:
      FunctionName: GetProductByIdViaAuroraServerlessV2WithoutDataApi
      AutoPublishAlias: liveVersion
      Handler: software.amazonaws.example.product.handler.GetProductByIdViaAuroraServerlessV2WithoutDataApiHandler::handleRequest   
      Environment:
        Variables:
          DB_USER_PASSWORD: !Join ['', ['{{resolve:secretsmanager:', !Ref DBSecret, ':SecretString:password}}' ]]
          DB_USER_NAME: !Join ['', ['{{resolve:secretsmanager:', !Ref DBSecret, ':SecretString:username}}' ]] 
      Policies:
        - VPCAccessPolicy: {}
      VpcConfig:
        SecurityGroupIds:
          - Fn::GetAtt: LambdaSecurityGroup.GroupId
        SubnetIds: !Ref  Subnets
      Events:
        GetRequestById:
          Type: Api
          Properties:
            RestApiId: !Ref MyApi
            Path: /productsWithoutDataAPI/{id}
            Method: get

  GetProductByIdWithoutDataApiFunctionLogGroup:
    Type: AWS::Logs::LogGroup
    Properties:
      LogGroupName: !Sub "/aws/lambda/${GetProductByIdWithoutDataApiFunction}"
      RetentionInDays: 7
      
  GetProductByIdRDSProxyFunction:
    Type: AWS::Serverless::Function
    Properties:
      FunctionName: GetProductByIdViaAuroraServerlessV2WithRDSProxy
      AutoPublishAlias: liveVersion
      Handler: software.amazonaws.example.product.handler.GetProductByIdViaAuroraServerlessV2RDSProxyHandler::handleRequest   
      Environment:
        Variables:
          DB_USER_PASSWORD: !Join ['', ['{{resolve:secretsmanager:', !Ref DBSecret, ':SecretString:password}}' ]]
          DB_USER_NAME: !Join ['', ['{{resolve:secretsmanager:', !Ref DBSecret, ':SecretString:username}}' ]]
          RDS_PROXY_ENDPOINT: !GetAtt RDSProxy.Endpoint 
      Policies:
        - Statement:
            - Sid: AllowDbConnect
              Effect: Allow
              Action:
                - rds-db:connect
              Resource:
                - !Sub arn:aws:rds-db:${AWS::Region}:${AWS::AccountId}:dbuser:!Select [6, !Split [":", !GetAtt RDSProxy.DBProxyArn]]/*

        - VPCAccessPolicy: {}
      VpcConfig:
        SecurityGroupIds:
          - Fn::GetAtt: LambdaSecurityGroup.GroupId
        SubnetIds: !Ref  Subnets
      Events:
        GetRequestById:
          Type: Api
          Properties:
            RestApiId: !Ref MyApi
            Path: /productsWithRDSProxy/{id}
            Method: get

  GetProductByIdRDSProxyFunctionLogGroup:
    Type: AWS::Logs::LogGroup
    Properties:
      LogGroupName: !Sub "/aws/lambda/${GetProductByIdRDSProxyFunction}"
      RetentionInDays: 7


  VPCSecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: Security group for RDS DB Instance.
      VpcId: 
         Ref: VpcId 
      SecurityGroupEgress: 
        - CidrIp: '0.0.0.0/0'
          Description: lambda RDS access over 5432
          FromPort: 5432
          IpProtocol: TCP
          ToPort: 5432
      SecurityGroupIngress:
        - IpProtocol: tcp
          FromPort: '5432'
          ToPort: '5432'
          SourceSecurityGroupId:
               Ref: LambdaSecurityGroup
               
  LambdaSecurityGroup:
      Type: AWS::EC2::SecurityGroup
      Properties:
        GroupDescription: SecurityGroup for Serverless Functions
        VpcId: 
          Ref: VpcId


  DBSubnetGroup:
    Type: AWS::RDS::DBSubnetGroup
    Properties:
      DBSubnetGroupDescription: Subnets available for the RDS DB Instance
      SubnetIds:
       Ref: Subnets
        
        
  DBSecret:
    Type: AWS::SecretsManager::Secret
    Properties:
      Name: !Ref UserSecret
      Description: RDS database auto-generated user password
      GenerateSecretString:
        SecretStringTemplate: !Sub '{"username": "${DBMasterUserName}"}'
        GenerateStringKey: "password"
        PasswordLength: 30
        ExcludeCharacters: '"@/\'
 
         
  AuroraServerlessV2Cluster:
    Type: 'AWS::RDS::DBCluster'
    DeletionPolicy: Delete
    Properties:
      DBClusterIdentifier: !Ref DBClusterName
      Engine: aurora-postgresql
      Port: 5432
      EnableHttpEndpoint: true
      MasterUsername: !Join ['', ['{{resolve:secretsmanager:', !Ref DBSecret, ':SecretString:username}}' ]]
      MasterUserPassword: !Join ['', ['{{resolve:secretsmanager:', !Ref DBSecret, ':SecretString:password}}' ]]
      DatabaseName: !Ref DatabaseName
      ServerlessV2ScalingConfiguration:
        MinCapacity: 0.5
        MaxCapacity: 1
      DBSubnetGroupName:
        Ref: DBSubnetGroup
      VpcSecurityGroupIds:
      - !Ref VPCSecurityGroup
  
  AuroraServerlessV2Instance:
    Type: 'AWS::RDS::DBInstance'
    Properties:
      Engine: aurora-postgresql
      DBInstanceClass: db.serverless
      DBClusterIdentifier: !Ref AuroraServerlessV2Cluster
      MonitoringInterval: 1
      MonitoringRoleArn: !GetAtt EnhancedMonitoringRole.Arn
      PubliclyAccessible: false
      EnablePerformanceInsights: true
      PerformanceInsightsRetentionPeriod: 7

  EnhancedMonitoringRole:
    Type: "AWS::IAM::Role"
    Properties:
      RoleName: !Sub "${AWS::StackName}-monitor-${AWS::Region}"
      Description: "Allows your Aurora DB cluster to deliver Enhanced Monitoring metrics."
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Action:
              - "sts:AssumeRole"
            Principal:
              Service:
                - "monitoring.rds.amazonaws.com"
      ManagedPolicyArns:
        - "arn:aws:iam::aws:policy/service-role/AmazonRDSEnhancedMonitoringRole"
 
  
  # IAM Role to be used by RDS Proxy for fetching secrets
  RDSProxyRole:
    Type: AWS::IAM::Role
    Properties:
      Path: /
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Action: [ 'sts:AssumeRole' ]
            Effect: Allow
            Principal:
              Service: [ rds.amazonaws.com ]
      Policies:
        - PolicyName: DBProxyPolicy
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Action:
                  - secretsmanager:GetSecretValue
                Effect: Allow
                Resource:
                  - !Ref DBSecret

  # Rds Proxy
  RDSProxy:
    Type: AWS::RDS::DBProxy
    Properties:
      Auth:
        - { AuthScheme: SECRETS, SecretArn: !Ref DBSecret}
      DBProxyName: 'rds-proxy'
      RoleArn: !GetAtt RDSProxyRole.Arn
      EngineFamily: 'POSTGRESQL'
      IdleClientTimeout: 120
      RequireTLS: true
      DebugLogging: false
      VpcSecurityGroupIds:
      - !Ref VPCSecurityGroup
      VpcSubnetIds: !Ref  Subnets

      
  # Rds Proxy Target group
  ProxyTargetGroup:
    Type: AWS::RDS::DBProxyTargetGroup
    Properties:
      DBProxyName: !Ref RDSProxy
      DBClusterIdentifiers: [ !Ref AuroraServerlessV2Cluster]
      TargetGroupName: default
      ConnectionPoolConfigurationInfo:
        MaxConnectionsPercent: 20
        MaxIdleConnectionsPercent: 4
        ConnectionBorrowTimeout: 120


Outputs:
  AWSLambdaAuroraServerlessV2DataApiEndpoint:
    Description: "API Gateway endpoint URL for Prod stage for AWS Lambda Java Serverless V2 Data API"
    Value: !Sub "https://${MyApi}.execute-api.${AWS::Region}.amazonaws.com/prod/products"
    
  DatabaseName:
    Description: Aurora Database Name
    Value: !Ref DatabaseName
    Export:
      Name: !Sub ${AWS::StackName}-DatabaseName
    
  DatabaseClusterArn:
    Description: Aurora Cluster ARN
    Value: !Sub :aws:rds:${AWS::Region}:${AWS::AccountId}:cluster:${DBClusterName}
    Export:
      Name: !Sub ${AWS::StackName}-DatabaseClusterArn
    
  DatabaseSecretArn:
    Description: Aurora Secret ARN
    Value: !Ref DBSecret
    Export:
      Name: !Sub ${AWS::StackName}-DatabaseSecretArn
    
  DatabaseClusterID:
    Description: Aurora Cluster ID
    Value: !Ref AuroraServerlessV2Cluster
    Export:
      Name: !Sub ${AWS::StackName}-DatabaseClusterID
    
  AuroraServerlessV2DBURL:
    Description: Aurora Database URL
    Value: !GetAtt AuroraServerlessV2Cluster.Endpoint.Address
    Export:
      Name: !Sub ${AWS::StackName}-DatabaseURL
      
  DatabaseMasterUserName:
    Description: Aurora Database User
    Value: !Ref DBMasterUserName
    Export:
      Name: !Sub ${AWS::StackName}-DatabaseMasterUserName