basic-cloudformation.yaml

AWSTemplateFormatVersion: '2010-09-09'
Description: 'Basic CloudFormation template with common AWS resources'

Parameters:
  Environment:
    Type: String
    Default: dev
    AllowedValues:
      - dev
      - staging
      - prod
    Description: Environment name

Resources:
  # S3 Bucket for storing application data
  AppDataBucket:
    Type: AWS::S3::Bucket
    Properties:
      # Note: Bucket names must be lowercase. Consider using a parameter or fixed prefix
      # instead of AWS::StackName which may contain uppercase letters
      BucketName: !Sub '${AWS::AccountId}-${AWS::Region}-data-${Environment}'
      VersioningConfiguration:
        Status: Enabled
      PublicAccessBlockConfiguration:
        BlockPublicAcls: true
        BlockPublicPolicy: true
        IgnorePublicAcls: true
        RestrictPublicBuckets: true
      BucketEncryption:
        ServerSideEncryptionConfiguration:
          - ServerSideEncryptionByDefault:
              SSEAlgorithm: AES256

  # DynamoDB Table for user data
  UserTable:
    Type: AWS::DynamoDB::Table
    Properties:
      TableName: !Sub '${AWS::StackName}-users-${Environment}'
      BillingMode: PAY_PER_REQUEST
      AttributeDefinitions:
        - AttributeName: userId
          AttributeType: S
        - AttributeName: email
          AttributeType: S
      KeySchema:
        - AttributeName: userId
          KeyType: HASH
      GlobalSecondaryIndexes:
        - IndexName: EmailIndex
          KeySchema:
            - AttributeName: email
              KeyType: HASH
          Projection:
            ProjectionType: ALL

  # Lambda Execution Role
  LambdaExecutionRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              Service: lambda.amazonaws.com
            Action: sts:AssumeRole
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole
      Policies:
        - PolicyName: DynamoDBAccess
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Effect: Allow
                Action:
                  - dynamodb:GetItem
                  - dynamodb:PutItem
                  - dynamodb:UpdateItem
                  - dynamodb:DeleteItem
                  - dynamodb:Query
                Resource: 
                  - !GetAtt UserTable.Arn
                  - !Sub '${UserTable.Arn}/index/*'
        - PolicyName: S3Access
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Effect: Allow
                Action:
                  - s3:GetObject
                  - s3:PutObject
                Resource: !Sub '${AppDataBucket.Arn}/*'

  # Lambda Function for processing user data
  UserProcessorFunction:
    Type: AWS::Lambda::Function
    Properties:
      FunctionName: !Sub '${AWS::StackName}-user-processor-${Environment}'
      Runtime: python3.11
      Handler: index.handler
      Role: !GetAtt LambdaExecutionRole.Arn
      Timeout: 60
      MemorySize: 256
      Environment:
        Variables:
          USER_TABLE_NAME: !Ref UserTable
          BUCKET_NAME: !Ref AppDataBucket
          ENVIRONMENT: !Ref Environment
      Code:
        ZipFile: |
          import json
          import os
          import boto3

          def handler(event, context):
              # Sample Lambda function
              print(f"Processing event: {json.dumps(event)}")
              
              table_name = os.environ['USER_TABLE_NAME']
              bucket_name = os.environ['BUCKET_NAME']
              
              return {
                  'statusCode': 200,
                  'body': json.dumps({
                      'message': 'User processed successfully',
                      'table': table_name,
                      'bucket': bucket_name
                  })
              }

  # API Gateway for REST API
  RestApi:
    Type: AWS::ApiGateway::RestApi
    Properties:
      Name: !Sub '${AWS::StackName}-api-${Environment}'
      Description: REST API for user management
      EndpointConfiguration:
        Types:
          - REGIONAL

  # API Gateway Resource
  UserResource:
    Type: AWS::ApiGateway::Resource
    Properties:
      RestApiId: !Ref RestApi
      ParentId: !GetAtt RestApi.RootResourceId
      PathPart: users

  # API Gateway Method
  UserGetMethod:
    Type: AWS::ApiGateway::Method
    Properties:
      RestApiId: !Ref RestApi
      ResourceId: !Ref UserResource
      HttpMethod: GET
      AuthorizationType: NONE
      Integration:
        Type: AWS_PROXY
        IntegrationHttpMethod: POST
        Uri: !Sub 'arn:aws:apigateway:${AWS::Region}:lambda:path/2015-03-31/functions/${UserProcessorFunction.Arn}/invocations'

  # Lambda Permission for API Gateway
  ApiGatewayInvokePermission:
    Type: AWS::Lambda::Permission
    Properties:
      FunctionName: !Ref UserProcessorFunction
      Action: lambda:InvokeFunction
      Principal: apigateway.amazonaws.com
      SourceArn: !Sub 'arn:aws:execute-api:${AWS::Region}:${AWS::AccountId}:${RestApi}/*/*'

  # API Gateway Deployment
  ApiDeployment:
    Type: AWS::ApiGateway::Deployment
    DependsOn: UserGetMethod
    Properties:
      RestApiId: !Ref RestApi
      StageName: !Ref Environment

Outputs:
  BucketName:
    Description: Name of the S3 bucket
    Value: !Ref AppDataBucket
    Export:
      Name: !Sub '${AWS::StackName}-BucketName'

  TableName:
    Description: Name of the DynamoDB table
    Value: !Ref UserTable
    Export:
      Name: !Sub '${AWS::StackName}-TableName'

  ApiUrl:
    Description: URL of the REST API
    Value: !Sub 'https://${RestApi}.execute-api.${AWS::Region}.amazonaws.com/${Environment}'
    Export:
      Name: !Sub '${AWS::StackName}-ApiUrl'

  LambdaFunctionArn:
    Description: ARN of the Lambda function
    Value: !GetAtt UserProcessorFunction.Arn
    Export:
      Name: !Sub '${AWS::StackName}-LambdaArn'