template.yaml

AWSTemplateFormatVersion: '2010-09-09'
Transform: 'AWS::Serverless-2016-10-31'
Parameters:
  ProjectName:
    Description: Used as a prefix for project resources.  Can be up to 12 characters, lowercase letters (a-z) only.
    Type: String
    Default: allstore
    AllowedPattern: "^[a-z]{1,12}"
    ConstraintDescription: The ProjectName can be up to 12 characters, lowercase letters (a-z) only.
  ProductSource:
    Description: S3 source for product data (.csv or .json, optionally compressed with .gz suffix)
    Type: String
    Default: s3://public-personalize-demo-assets-us-east-1/data/meta_Grocery_and_Gourmet_Food_5.01.json.gz
  UserSource:
    Description: S3 source for user data (.csv or .json, optionally compressed with .gz suffix)
    Type: String
    Default: s3://public-personalize-demo-assets-us-east-1/data/users_Grocery_and_Gourmet_Food.json
  WebSource:
    Description: S3 source for web UI assets
    Type: String
    Default: s3://public-personalize-demo-assets-us-east-1/webui.zip
  InteractionSource:
    Description: (Optional) S3 source for user-product interaction data (.csv or .json, optionally compressed with .gz suffix)
    Type: String
    Default: ''
  ExistingBaseCampaignName:
    Description: (Optional) Name of an existing Personalize recommendation campaign in your account to link to
    Type: String
    Default: ''
  ExistingSearchCampaignName:
    Description: (Optional) Name of an existing Personalize re-ranking campaign in your account to link to
    Type: String
    Default: ''
  ExistingSimsCampaignName:
    Description: (Optional) Name of an existing Personalize similar items campaign in your account to link to
    Type: String
    Default: ''
  ExistingTrackingId:
    Description: (Optional) Tracking ID for an existing Personalize event tracker in your account to link to
    Type: String
    Default: ''
Conditions:
  IADRegion: !Equals [!Ref "AWS::Region", us-east-1]
  UseInteractionSource: !Not [!Equals [!Ref InteractionSource, '']]
  UseProductSource: !Not [!Equals [!Ref ProductSource, '']]
  UseUserSource: !Not [!Equals [!Ref UserSource, '']]
  UseExistingBaseCampaign: !Not [!Equals [!Ref ExistingBaseCampaignName, '']]
  UseExistingSearchCampaign: !Not [!Equals [!Ref ExistingSearchCampaignName, '']]
  UseExistingSimsCampaign: !Not [!Equals [!Ref ExistingSimsCampaignName, '']]
Globals:
  Function:
    Timeout: 180
  Api:
    EndpointConfiguration: REGIONAL
    # https://docs.aws.amazon.com/serverless-application-model/latest/developerguide/sam-property-api-corsconfiguration.html
    Cors:
      AllowMethods: "'*'"
      AllowHeaders: "'*'"
      AllowOrigin: "'*'"
    # Domain:
    #   DomainName: www.my-domain.com
    #   CertificateArn: my-valid-cert-arn
    #   EndpointConfiguration: EDGE

# ---------- VPC - SUBNET - SECURITY GROUPS  ---------
Resources:
  ItemStoreVPC:
    Type: AWS::EC2::VPC
    Properties:
      CidrBlock: '172.31.0.0/16'
      Tags:
        - Key: Name
          Value: !Sub '${ProjectName}-VPC'
  ItemStoreInternetGateway:
    Type: AWS::EC2::InternetGateway
  ItemStoreAttachGateway:
    Type: AWS::EC2::VPCGatewayAttachment
    Properties:
      InternetGatewayId: !Ref ItemStoreInternetGateway
      VpcId: !Ref ItemStoreVPC
  ItemStoreSubnet1:
    Type: AWS::EC2::Subnet
    Properties:
      CidrBlock: !Select [0, !Cidr [!GetAtt ItemStoreVPC.CidrBlock, 3, 8]]
      VpcId: !Ref ItemStoreVPC
      # The following examples show valid patterns for using nested intrinsic functions using short form YAML
      # ...You can't nest short form functions consecutively, so a pattern like !GetAZs !Ref is invalid.
      AvailabilityZone: !Select [0, Fn::GetAZs: !Ref 'AWS::Region']
      Tags:
        - Key: Name
          Value: !Sub '${ProjectName}-Subnet1'
  ItemStoreSubnet2:
    Type: AWS::EC2::Subnet
    Properties:
      CidrBlock: !Select [1, !Cidr [!GetAtt ItemStoreVPC.CidrBlock, 3, 8]]
      VpcId: !Ref ItemStoreVPC
      AvailabilityZone: !Select [1, Fn::GetAZs: !Ref 'AWS::Region']
      Tags:
        - Key: Name
          Value: !Sub '${ProjectName}-Subnet2'
  ItemStoreVPCRouteTable:
    Type: AWS::EC2::RouteTable
    Properties:
      VpcId: !Ref ItemStoreVPC
  ItemStoreVPCPublicRouteTable:
    Type: AWS::EC2::RouteTable
    Properties:
      VpcId: !Ref ItemStoreVPC
  RouteToInternet:
    Type: AWS::EC2::Route
    Properties:
      RouteTableId: !Ref ItemStoreVPCPublicRouteTable
      DestinationCidrBlock: 0.0.0.0/0
      GatewayId: !Ref ItemStoreInternetGateway
  ItemStoreVPCRouteTableAssociation:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      RouteTableId: !Ref ItemStoreVPCRouteTable
      SubnetId: !Ref ItemStoreSubnet1
  ItemStoreVPCRouteTableAssociationTwo:
    DependsOn: RouteToInternet
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      RouteTableId: !Ref ItemStoreVPCPublicRouteTable
      SubnetId: !Ref ItemStoreSubnet2

# ---------- ROLES FOR DYNAMODB ---------
  DynamoDbRole:
    Type: 'AWS::IAM::Role'
    Properties:
      RoleName: !Sub '${ProjectName}-DynamoDbLambda'
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - lambda.amazonaws.com
            Action:
              - 'sts:AssumeRole'
      ManagedPolicyArns:
        - 'arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole'
        - 'arn:aws:iam::aws:policy/AmazonS3ReadOnlyAccess'
      Policies:
        - PolicyName: DDBAccess
          PolicyDocument:
            Version: 2012-10-17
            Statement:
              - Effect: Allow
                Action:
                  - 'dynamodb:PutItem'
                  - 'dynamodb:Query'
                  - 'dynamodb:UpdateTable'
                  - 'dynamodb:UpdateItem'
                  - 'dynamodb:BatchWriteItem'
                  - 'dynamodb:GetItem'
                  - 'dynamodb:Scan'
                  - 'dynamodb:DeleteItem'
                Resource:
                  - !GetAtt TableItems.Arn
                  - !Join ['', [!GetAtt TableItems.Arn, '/*']]
                  - !GetAtt TableUsers.Arn
                  - !Join ['', [!GetAtt TableUsers.Arn, '/*']]
        - PolicyName: RekognitionAccess
          PolicyDocument:
            Version: 2012-10-17
            Statement:
              - Effect: Allow
                Action:
                  - 'rekognition:DetectLabels'
                Resource: '*'
  APIGateWayRole:
    Type: 'AWS::IAM::Role'
    Properties:
      RoleName: !Sub '${ProjectName}-APIGateWayRole'
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - apigateway.amazonaws.com
            Action:
              - 'sts:AssumeRole'
      ManagedPolicyArns:
        - 'arn:aws:iam::aws:policy/service-role/AmazonAPIGatewayPushToCloudWatchLogs'
        - 'arn:aws:iam::aws:policy/AmazonKinesisFullAccess'

# ---------- DYNAMODB TABLES DEFINITIONS ---------
  TableItems:
    Type: 'AWS::DynamoDB::Table'
    Properties:
      TableName: !Sub '${ProjectName}-Items'
      AttributeDefinitions:
        - AttributeName: asin
          AttributeType: S
      KeySchema:
        - AttributeName: asin
          KeyType: HASH
      BillingMode: PAY_PER_REQUEST
      StreamSpecification:
        StreamViewType: NEW_AND_OLD_IMAGES
  TableUsers:
    Type: 'AWS::DynamoDB::Table'
    Properties:
      TableName: !Sub '${ProjectName}-Users'
      AttributeDefinitions:
        - AttributeName: id
          AttributeType: S
      KeySchema:
        - AttributeName: id
          KeyType: HASH
      BillingMode: PAY_PER_REQUEST

# ---------- ELASTICSEARCH ROLE - Domain -----------
  LambdaAdminRole:
    Type: 'AWS::IAM::Role'
    Properties:
      RoleName: !Sub '${ProjectName}-LambdaAdminRole'
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - lambda.amazonaws.com
            Action:
              - 'sts:AssumeRole'
      Path: /
      ManagedPolicyArns:
        - 'arn:aws:iam::aws:policy/AdministratorAccess'
  ESSearchRole:
    Type: 'AWS::IAM::Role'
    Properties:
      RoleName: !Sub '${ProjectName}-ESSearchRole'
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - lambda.amazonaws.com
            Action:
              - 'sts:AssumeRole'
      Path: /
      ManagedPolicyArns:
        - 'arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole'
        - 'arn:aws:iam::aws:policy/service-role/AWSLambdaVPCAccessExecutionRole'
      Policies:
        - PolicyName: !Sub '${ProjectName}-lambda-policy'
          PolicyDocument:
            Version: 2012-10-17
            Statement:
              - Effect: Allow
                Action:
                  - 'es:ESHttpPost'
                  - 'es:ESHttpGet'
                # arn:aws:es:<REGION>:<ACCOUNTID>:domain/<ESDOMAIN>/*
                Resource: !Join ['',['arn:aws:es:',!Ref 'AWS::Region',':',!Ref 'AWS::AccountId',':domain/',!Ref ElasticsearchDomain,'/*']]
              - Effect: Allow
                Action:
                  - 's3:ListBucket'
                  - 's3:GetObject'
                Resource: '*'
              - Effect: Allow
                Action:
                  - 'dynamodb:DescribeStream'
                  - 'dynamodb:GetRecords'
                  - 'dynamodb:GetShardIterator'
                  - 'dynamodb:ListStreams'
                Resource:
                  - !GetAtt TableItems.Arn
                  - !Join ['',[!GetAtt TableItems.Arn,'/stream/*']]
  ElasticsearchDomain:
    Type: 'AWS::Elasticsearch::Domain'
    DependsOn:
      - ItemStoreSubnet1
    Properties:
      DomainName: !Sub '${ProjectName}-domain'
      ElasticsearchVersion: '7.1'
      ElasticsearchClusterConfig:
        DedicatedMasterEnabled: false
        InstanceCount: 1
        ZoneAwarenessEnabled: false
        InstanceType: t2.small.elasticsearch
      VPCOptions:
        SubnetIds:
          - !Ref ItemStoreSubnet1
      EBSOptions:
        EBSEnabled: true
        Iops: 0
        VolumeSize: 10
        VolumeType: gp2
      AccessPolicies:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Principal:
              AWS: '*'
            Action:
              - 'es:*'
            # arn:aws:es:<REGION>:<ACCOUNTID>:domain/<ESDOMAIN>/*
            Resource:   !Join ['',['arn:aws:es:',!Ref 'AWS::Region',':',!Ref 'AWS::AccountId',':domain/',!Sub '${ProjectName}-domain','/*']]
      AdvancedOptions:
        rest.action.multi.allow_explicit_index: 'true'

# ---------- LAMBDA STREAMING FUNCTIONS ---------
  UpdateSearchCluster:
    Type: AWS::Serverless::Function
    DependsOn:
      - TableItems
    Properties:
      FunctionName: !Sub '${ProjectName}-UpdateSearchCluster'
      Description: 'Update Elasticsearch cluster as items are added'
      Handler: index.handler
      Role: !GetAtt ESSearchRole.Arn
      Runtime: python3.8
      Timeout: 60
      VpcConfig:
        SecurityGroupIds:
          - !GetAtt ItemStoreVPC.DefaultSecurityGroup
        SubnetIds:
          - !Ref ItemStoreSubnet1
      CodeUri: ./functions/streaming/UpdateSearchCluster/
      Environment:
        Variables:
          ESENDPOINT: !GetAtt ElasticsearchDomain.DomainEndpoint
          REGION: !Ref 'AWS::Region'
      Events:
        DynamoDB:
          Type: DynamoDB
          Properties:
            Stream: !GetAtt TableItems.StreamArn
            StartingPosition: TRIM_HORIZON
            BatchSize: 1
            Enabled: True

# ---------- API Function ------------
# when implecitly define api the logical name of AWS::ApiGateway::RestApi is ServerlessRestApi
  FunctionGetItem:
    Type: 'AWS::Serverless::Function'
    Properties:
      FunctionName: !Sub '${ProjectName}-GetItem'
      Description: Get item by id
      Handler: main.handler
      MemorySize: 256
      Runtime: nodejs12.x
      Role: !GetAtt DynamoDbRole.Arn
      Timeout: 120
      Environment:
        Variables:
          TABLE_NAME: !Ref TableItems
      CodeUri: ./functions/APIs/GetItem/
      Events:
        APIgateway:
          Type: Api
          Properties:
            Path: /items/{id}
            Method: get
  FunctionGetItemDescription:
    Type: 'AWS::Serverless::Function'
    Properties:
      FunctionName: !Sub '${ProjectName}-GetItemDescription'
      Description: Get item description by id from Amazon
      Handler: main.handler
      MemorySize: 1344
      Runtime: nodejs12.x
      Role: !GetAtt LambdaAdminRole.Arn
      Timeout: 60
      Environment:
        Variables:
          # TODO: Still necessary?
          CUSTOM_CHROME: 'true'
      CodeUri: ./functions/APIs/GetItemDescription/
      Events:
        APIgateway:
          Type: Api
          Properties:
            Path: /description
            Method: get
  FunctionListItems:
    Type: 'AWS::Serverless::Function'
    Properties:
      FunctionName: !Sub '${ProjectName}-ListItems'
      Description: Get list of items by category
      Handler: main.handler
      MemorySize: 256
      Runtime: nodejs12.x
      Role: !GetAtt DynamoDbRole.Arn
      Timeout: 120
      Environment:
        Variables:
          TABLE_NAME: !Ref TableItems
      CodeUri: ./functions/APIs/ListItems/
      Events:
        APIgateway:
          Type: Api
          Properties:
            Path: /items
            Method: get
  FunctionUploadItems:
    Type: 'AWS::Serverless::Function'
    DependsOn:
      - WebBucket
    Properties:
      FunctionName: !Sub '${ProjectName}-UploadItems'
      Description: Upload sample data for items
      Handler: main.handler
      Runtime: nodejs12.x
      Role: !GetAtt LambdaAdminRole.Arn
      Timeout: 900
      MemorySize: 256
      CodeUri: ./functions/setup/
  FunctionGetRecommendations:
    Type: 'AWS::Serverless::Function'
    Properties:
      FunctionName: !Sub '${ProjectName}-GetRecommendations'
      CodeUri: ./functions/APIs/GetRecommendations/
      Description: Get the product recommendations by user
      Role: !GetAtt LambdaAdminRole.Arn
      Environment:
        Variables:
          DDB_TABLE_NAME: !Ref TableItems
          CAMPAIGN_ARN:
            Fn::If:
              - UseExistingBaseCampaign
              - !Sub 'arn:aws:personalize:${AWS::Region}:${AWS::AccountId}:campaign/${ExistingBaseCampaignName}'
              - ''
      Handler: main.handler
      MemorySize: 256
      Runtime: python3.8
      Timeout: 30
      Events:
        APIgateway:
          Type: Api
          Properties:
            Path: /recommendations
            Method: get
        APIgatewayPath:
          Type: Api
          Properties:
            Path: /recommendations/{userid}
            Method: get
  FunctionGetRecommendationsByItem:
    Type: 'AWS::Serverless::Function'
    Properties:
      FunctionName: !Sub '${ProjectName}-GetRecommendationsByItem'
      CodeUri: ./functions/APIs/GetRecommendationsByItem
      Description: Get the product recommendations by item
      Role: !GetAtt LambdaAdminRole.Arn
      Environment:
        Variables:
          DDB_TABLE_NAME: !Ref TableItems
          CAMPAIGN_ARN:
            Fn::If:
              - UseExistingSimsCampaign
              - !Sub 'arn:aws:personalize:${AWS::Region}:${AWS::AccountId}:campaign/${ExistingSimsCampaignName}'
              - ''
      Handler: main.handler
      MemorySize: 256
      Runtime: python3.8
      Timeout: 30
      Events:
        APIgateway:
          Type: Api
          Properties:
            Path: /recommendationsitem/{itemid}
            Method: get
  FunctionSession:
    Type: 'AWS::Serverless::Function'
    Properties:
      FunctionName: !Sub '${ProjectName}-Session'
      Description: Get session config
      Handler: main.handler
      MemorySize: 128
      Runtime: nodejs12.x
      Role: !GetAtt LambdaAdminRole.Arn
      Timeout: 60
      Environment:
        Variables:
          IDENTITY_POOL_ID: !Ref UserEventIdentityPool
          KINESIS_STREAM_NAME: !Ref PostClickEventStream
          USERS_TABLE_NAME: !Ref TableUsers
      CodeUri: ./functions/APIs/Session/
      Events:
        APIgateway:
          Type: Api
          Properties:
            Path: /session
            Method: get

# ---------- LAMBDA FUNCTIONS for ELASTICSEARCH ---------
  FunctionSearch:
    Type: 'AWS::Serverless::Function'
    DependsOn:
      - TableItems
    Properties:
      FunctionName: !Sub '${ProjectName}-Search'
      Description: Search for items across item names, authors, and categories
      Handler: main.handler
      MemorySize: 256
      Role: !GetAtt ESSearchRole.Arn
      Runtime: python3.8
      Timeout: 60
      VpcConfig:
        SecurityGroupIds:
          - !GetAtt ItemStoreVPC.DefaultSecurityGroup
        SubnetIds:
          - !Ref ItemStoreSubnet1
      CodeUri: ./functions/APIs/Search/
      Environment:
        Variables:
          ESENDPOINT: !GetAtt ElasticsearchDomain.DomainEndpoint
          DDB_TABLE: !Ref TableItems
          REGION: !Ref 'AWS::Region'
  FunctionSearchRerank:
    Type: 'AWS::Serverless::Function'
    Properties:
      FunctionName: !Sub '${ProjectName}-Rerank'
      Description: Search then rerank
      Handler: main.handler
      MemorySize: 256
      Role: !GetAtt LambdaAdminRole.Arn
      Runtime: python3.8
      Timeout: 60
      CodeUri: ./functions/APIs/SearchRerank/
      Environment:
        Variables:
          DDB_TABLE_NAME: !Ref TableItems
          MAX_PROMOTED_RESULTS: 45
          SEARCH_LAMBDA_ARN: !GetAtt FunctionSearch.Arn
          CAMPAIGN_ARN:
            Fn::If:
              - UseExistingSearchCampaign
              - !Sub 'arn:aws:personalize:${AWS::Region}:${AWS::AccountId}:campaign/${ExistingSearchCampaignName}'
              - ''
      Events:
        APIgateway:
          Type: Api
          Properties:
            Path: /search
            Method: get


# ------- CLOUDFRONT DISTRIBUTION -------
  WebsiteOriginAccessIdentity:
    Type: AWS::CloudFront::CloudFrontOriginAccessIdentity
    Properties:
      CloudFrontOriginAccessIdentityConfig:
        Comment: !Sub "web-access-${WebBucket}"

  WebBucket:
    Type: AWS::S3::Bucket
    Properties:
      CorsConfiguration:
        CorsRules:
          - Id: AllowAll
            AllowedMethods:
              - GET
              - HEAD
            AllowedOrigins:
              - "*"
      PublicAccessBlockConfiguration:
        BlockPublicAcls: true
        BlockPublicPolicy: true
        IgnorePublicAcls: true
        RestrictPublicBuckets: true
      WebsiteConfiguration:
        IndexDocument: "index.html"
        ErrorDocument: "index.html"

  WebBucketPolicy:
    Type: AWS::S3::BucketPolicy
    Properties:
      Bucket: !Ref WebBucket
      PolicyDocument:
        Statement:
          - Action:
              - "s3:GetObject"
            Effect: Allow
            Resource: !Join ['',['arn:aws:s3:::',!Ref WebBucket,'/*']]
            Principal:
              CanonicalUser: !GetAtt WebsiteOriginAccessIdentity.S3CanonicalUserId
  WebCDN:
    Type: AWS::CloudFront::Distribution
    Properties:
      DistributionConfig:
        CustomErrorResponses:
          -
            ErrorCachingMinTTL: 300
            ErrorCode: 403
            ResponseCode: 200
            ResponsePagePath: /index.html
        DefaultCacheBehavior: # S3 origin is default
          AllowedMethods:
            - GET
            - HEAD
            - OPTIONS
          CachedMethods: # Cache get requests only
            - GET
            - HEAD
            - OPTIONS
          DefaultTTL: 60
          MaxTTL: 60
          ForwardedValues:
            QueryString: true
          TargetOriginId: webstatic
          ViewerProtocolPolicy: redirect-to-https
        CacheBehaviors: # Alternative behavior for the API gateway
          - AllowedMethods:
              - DELETE
              - GET
              - HEAD
              - OPTIONS
              - PATCH
              - POST
              - PUT
            CachedMethods: # Cache get requests only
              - GET
              - HEAD
              - OPTIONS
            Compress: true
            DefaultTTL: 60
            MaxTTL: 60
            ForwardedValues:
              Cookies:
                Forward: all
              Headers: # Need to whitelist all headers that API gateway requires:
                - Accept
                - Referer
                - Athorization
                - Content-Type
              QueryString: true
            PathPattern: "/Prod/*"
            TargetOriginId: api
            ViewerProtocolPolicy: https-only
        DefaultRootObject: index.html
        Enabled: true
        HttpVersion: http2
        Origins:
          -
            # Note: DO NOT use !GetAtt WebBucket.DomainName for DomainName
            # https://stackoverflow.com/q/38735306
            #DomainName: !GetAtt WebBucket.DomainName
            DomainName: !Sub ${WebBucket}.s3.amazonaws.com
            Id: webstatic
            S3OriginConfig:
              OriginAccessIdentity: !Sub origin-access-identity/cloudfront/${WebsiteOriginAccessIdentity}
            OriginPath: /web
          -
            DomainName: !Join ['',[!Ref ServerlessRestApi,'.execute-api.',!Ref 'AWS::Region','.amazonaws.com']]
            Id: api
            CustomOriginConfig:
              OriginProtocolPolicy: https-only
            # Note we don't map to a particular OriginPath - all API deployments eligible IF PathPattern matched
        # Consider bumping up to PriceClass_All if South America or Australia are important to you:
        PriceClass: PriceClass_200

# ========== AL/ML TEAM =================
  StagingS3Bucket:
    Type: AWS::S3::Bucket
    Properties:
      BucketName: !Sub '${ProjectName}-staging'

# SageMaker Execution Role
  SageMakerIamRole:
    Type: "AWS::IAM::Role"
    Properties:
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          -
            Effect: Allow
            Principal:
              Service: sagemaker.amazonaws.com
            Action: sts:AssumeRole
      Path: "/"
      ManagedPolicyArns:
        - "arn:aws:iam::aws:policy/AmazonSageMakerFullAccess"
        - "arn:aws:iam::aws:policy/AmazonS3FullAccess"
        - "arn:aws:iam::aws:policy/service-role/AmazonPersonalizeFullAccess"
        - "arn:aws:iam::aws:policy/IAMFullAccess"
        - "arn:aws:iam::aws:policy/AWSLambdaFullAccess"
      Policies:
        - PolicyName: DDBAccess
          PolicyDocument:
            Version: 2012-10-17
            Statement:
              - Effect: Allow
                Action:
                  - 'dynamodb:PutItem'
                  - 'dynamodb:Query'
                  - 'dynamodb:UpdateTable'
                  - 'dynamodb:UpdateItem'
                  - 'dynamodb:BatchWriteItem'
                  - 'dynamodb:GetItem'
                  - 'dynamodb:Scan'
                  - 'dynamodb:DeleteItem'
                Resource:
                  - !GetAtt TableItems.Arn
                  - !Join ['', [!GetAtt TableItems.Arn, '/*']]
                  - !GetAtt TableUsers.Arn
                  - !Join ['', [!GetAtt TableUsers.Arn, '/*']]

  # SageMaker notebook
  NotebookConfig:
    Type: AWS::SageMaker::NotebookInstanceLifecycleConfig
    Properties:
      OnStart:
        - Content:
            Fn::Base64: !Sub |
              #!/bin/bash
              set -e

              # Install extension for ipywidgets interactivity:
              sudo -u ec2-user -i <<'EOF'
              source /home/ec2-user/anaconda3/bin/activate JupyterSystemEnv
              jupyter labextension install @jupyter-widgets/jupyterlab-manager
              source /home/ec2-user/anaconda3/bin/deactivate
              EOF

              # Set env vars
              touch /etc/profile.d/jupyter-env.sh
              cat << 'EOF' >> /etc/profile.d/jupyter-env.sh
              export CF_STACK_NAME='${AWS::StackName}'
              export LAMBDA_GETITEMRECS_ARN='${FunctionGetRecommendationsByItem.Arn}'
              export LAMBDA_GETRECS_ARN='${FunctionGetRecommendations.Arn}'
              export LAMBDA_RERANK_ARN='${FunctionSearchRerank.Arn}'
              export LAMBDA_POSTCLICK_ARN='${PostClickEventFunction.Arn}'
              export STAGING_BUCKET='${StagingS3Bucket}'
              EOF
              initctl restart jupyter-server --no-wait

  NotebookInstance:
    Type: AWS::SageMaker::NotebookInstance
    Properties:
      InstanceType: 'ml.t2.medium'
      LifecycleConfigName: !GetAtt NotebookConfig.NotebookInstanceLifecycleConfigName
      # Otherwise it gets some garbage name by default:
      NotebookInstanceName: !Sub '${ProjectName}-Personalize-Notebook'
      RoleArn: !GetAtt SageMakerIamRole.Arn
      VolumeSizeInGB: 20
      DefaultCodeRepository: https://github.com/apac-ml-tfc/personalize-demo

  PostClickEventStream:
    Type: AWS::Kinesis::Stream
    Properties:
        Name: !Sub '${ProjectName}-Clickstream'
        RetentionPeriodHours: 24
        ShardCount: 1
  PostClickEventFunction:
    Type: 'AWS::Serverless::Function'
    Properties:
      FunctionName: !Sub '${ProjectName}-PostClickEvent'
      Description: PostClickEvent function
      Handler: main.handler
      MemorySize: 256
      Runtime: python3.8
      Role: !GetAtt LambdaAdminRole.Arn
      Timeout: 69
      Environment:
        Variables:
          TRACKING_ID: !Ref ExistingTrackingId
      CodeUri: ./functions/APIs/PostClickEvent/
      Events:
        Clickstream:
          Type: Kinesis
          Properties:
            Stream: !GetAtt PostClickEventStream.Arn
            StartingPosition: TRIM_HORIZON
  UserEventIdentityPool:
    Type: AWS::Cognito::IdentityPool
    Properties:
      AllowUnauthenticatedIdentities: True
      # number letter underscore space only
      IdentityPoolName: !Sub '${ProjectName}_UserEventIdentityPool'
  UserEventIdentityPoolAttachment:
    Type: AWS::Cognito::IdentityPoolRoleAttachment
    Properties:
      IdentityPoolId: !Ref UserEventIdentityPool
      Roles:
        authenticated: !GetAtt UserEventAuthRole.Arn
        unauthenticated: !GetAtt UserEventAuthRole.Arn
  UserEventAuthRole:
    Type: 'AWS::IAM::Role'
    Properties:
      RoleName: !Sub '${ProjectName}-UserEventRole'
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Principal:
              Federated:
                - 'cognito-identity.amazonaws.com'
            Action:
              - 'sts:AssumeRoleWithWebIdentity'
            Condition:
              StringEquals:
                cognito-identity.amazonaws.com:aud: !Ref UserEventIdentityPool
              ForAnyValue:StringLike:
                cognito-identity.amazonaws.com:amr: "unauthenticated"
      Policies:
        - PolicyName: KinesisStreamPut
          PolicyDocument:
            Version: 2012-10-17
            Statement:
              - Effect: Allow
                Action:
                  - 'kinesis:PutRecord'
                Resource:
                  - !GetAtt PostClickEventStream.Arn
                  - !Join ['', [!GetAtt PostClickEventStream.Arn, '/*']]

  InitItemTable:
    Condition: UseProductSource
    DependsOn:
      - TableItems
      - UpdateSearchCluster
      - ElasticsearchDomain
    Type: Custom::ProductData
    Version: "1.0"
    Properties:
      ServiceToken: !GetAtt FunctionUploadItems.Arn
      Shards: 3
      Source: !Ref ProductSource
      TableName: !Ref TableItems

  InitStagingBucket:
    DependsOn:
      - StagingS3Bucket
    Type: Custom::S3Copy
    Version: "1.0"
    Properties:
      ServiceToken: !GetAtt FunctionUploadItems.Arn
      Items:
        # Any items with empty To will be skipped:
        - Name: Interactions
          From: !Ref InteractionSource
          To: !If [UseInteractionSource, !Sub 's3://${StagingS3Bucket}/raw/interactions', '']
        - Name: Products
          From: !Ref ProductSource
          To: !If [UseProductSource, !Sub 's3://${StagingS3Bucket}/raw/items', '']
        - Name: Users
          From: !Ref UserSource
          To: !If [UseUserSource, !Sub 's3://${StagingS3Bucket}/raw/users', '']

  InitUserTable:
    Condition: UseUserSource
    DependsOn:
      - TableUsers
    Type: Custom::UserData
    Version: "1.0"
    Properties:
      ServiceToken: !GetAtt FunctionUploadItems.Arn
      Source: !Ref UserSource
      TableName: !Ref TableUsers
  
  InitWebAssets:
    DependsOn:
      - WebBucket
    Type: Custom::WebAssets
    Version: "1.0"
    Properties:
      ServiceToken: !GetAtt FunctionUploadItems.Arn
      Source: !Ref WebSource
      Target: !Sub 's3://${WebBucket}/web'

Outputs:
  APIEndpoint:
    Description: "API production endpoint"
    Value: !Sub "https://${ServerlessRestApi}.execute-api.${AWS::Region}.amazonaws.com/Prod/"
  AllStoreWebUI:
    Description: "AllStore Website"
    Value: !Sub 'https://${WebCDN.DomainName}/'
  WebBucketName:
    Value: !Ref WebBucket
    Description: S3 Bucket for web asset storage
  StagingS3Bucket:
    Value: !Ref StagingS3Bucket
    Description: S3 Bucket for Data Staging
  RerankArn:
    Description: "Rerank_arn"
    Value: !GetAtt FunctionSearchRerank.Arn
  GetRecommendationsByItemArn:
    Description: "GetRecommendationsByItem_arn"
    Value: !GetAtt FunctionGetRecommendationsByItem.Arn
  GetRecommendationsArn:
    Description: "GetRecommendations_arn"
    Value: !GetAtt FunctionGetRecommendations.Arn
  PostClickEventArn:
    Description: "PostClickEvent_arn"
    Value: !GetAtt PostClickEventFunction.Arn
  WebUIStreamName:
    Description: "WebUI Config kinesis.StreamName"
    Value: !Ref PostClickEventStream
  WebUIAnonymousPoolId:
    Description: "WebUI Config cognito.AnonymousPoolId"
    Value: !Ref UserEventIdentityPool