backend.yml

AWSTemplateFormatVersion: "2010-09-09"
Description: CloudFormation template for Hotel App with DynamoDB and App Runner, without networking.

Parameters:
  HotelName:
    Type: String
    Default: AWS App Runner Hotel
    Description: Enter a name for the Hotel. Default is AWS App Runner Hotel.
  Environment:
    Type: String
    Default: dev
    Description: Enter a name for the Environment. Default is dev, this is used later in the workshop to tag the environments


Resources:
  # DynamoDB Table for Rooms
  RoomsTable:
    Type: "AWS::DynamoDB::Table"
    Properties:
      TableName: !Sub "Rooms-${AWS::StackName}-${AWS::Region}"
      AttributeDefinitions:
        - AttributeName: "id"
          AttributeType: "N"
      KeySchema:
        - AttributeName: "id"
          KeyType: "HASH"
      ProvisionedThroughput:
        ReadCapacityUnits: 5
        WriteCapacityUnits: 5
      SSESpecification:
        SSEEnabled: true # Enable server-side encryption for the table

  # IAM Role for App Runner to access DynamoDB
  AppRunnerInstanceRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: !Sub "AppRunnerHotelAppRole-${AWS::StackName}-${AWS::Region}"
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: "Allow"
            Principal:
              Service:
                - tasks.apprunner.amazonaws.com
            Action:
              - "sts:AssumeRole"
      Policies:
        - PolicyName: AppRunnerDynamoDBPermissions
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Effect: Allow
                Action:
                  - "dynamodb:PutItem"
                  - "dynamodb:GetItem"
                  - "dynamodb:Scan"
                  - "dynamodb:UpdateItem"
                Resource: !GetAtt RoomsTable.Arn
        - PolicyName: AppRunnerServiceRolePolicy
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Effect: Allow
                Action:
                  - "logs:CreateLogGroup"
                  - "logs:PutRetentionPolicy"
                Resource: "arn:aws:logs:*:*:log-group:/aws/apprunner/*"
              - Effect: Allow
                Action:
                  - "logs:CreateLogStream"
                  - "logs:PutLogEvents"
                  - "logs:DescribeLogStreams"
                Resource: "arn:aws:logs:*:*:log-group:/aws/apprunner/*:log-stream:*"

  # IAM Role for ECR Access
  AppRunnerECRAccessRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: !Sub "AppRunnerHotelAppECRAccessRole-${AWS::StackName}-${AWS::Region}"
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: "Allow"
            Principal:
              Service:
                - build.apprunner.amazonaws.com
            Action:
              - "sts:AssumeRole"
      ManagedPolicyArns:
        - "arn:aws:iam::aws:policy/service-role/AWSAppRunnerServicePolicyForECRAccess"
  
  #Sample Alarm - we will use this later to prove AWS CodePipeline Condition Gates
  DynamoDBReadCapacityAlarm:
    Type: "AWS::CloudWatch::Alarm"
    Properties:
      AlarmName: !Sub "HighReadCapacityAlarm-${AWS::StackName}-${AWS::Region}"
      AlarmDescription: "Alarm if DynamoDB read capacity exceeds 80% of provisioned units"
      Namespace: "AWS/DynamoDB"
      MetricName: "ConsumedReadCapacityUnits"
      Dimensions:
        - Name: "TableName"
          Value: !Ref RoomsTable
      Statistic: "Average"
      Period: 60
      EvaluationPeriods: 1
      Threshold: 4 # 80% of 5 ReadCapacityUnits
      ComparisonOperator: "GreaterThanThreshold"

Outputs:
  DynamoDBTableName:
    Description: "Name of the DynamoDB Table"
    Value: !Ref RoomsTable