template.yaml

AWSTemplateFormatVersion: '2010-09-09'
Transform: AWS::Serverless-2016-10-31
Description: HackOverflow Backend API

Parameters:
  DatabaseURL:
    Type: String
    Description: Database connection URL
    NoEcho: true
  SecretKey:
    Type: String
    Description: JWT secret key
    NoEcho: true
  FrontendURL:
    Type: String
    Description: Frontend URL for CORS
    Default: "https://hackoverflow.srkrcodingclub.in"
  CloudinaryCloudName:
    Type: String
    Description: Cloudinary Cloud Name
  CloudinaryAPIKey:
    Type: String
    Description: Cloudinary API Key
    NoEcho: true
  CloudinaryAPISecret:
    Type: String
    Description: Cloudinary API Secret
    NoEcho: true
  EmailUser:
    Type: String
    Description: Email username for sending emails
    NoEcho: true
  EmailPass:
    Type: String
    Description: Email password for sending emails
    NoEcho: true
  FromEmail:
    Type: String
    Description: From email address for sending emails
  ReSendApiKey:
    Type: String
    Description: Resend API Key for sending emails
    NoEcho: true

Resources:
  # REST API Gateway with explicit stage configuration
  HackOverflowRestApi:
    Type: AWS::Serverless::Api
    Properties:
      StageName: prod
      Cors:
        AllowOrigin: !Sub "'${FrontendURL}'"
        AllowHeaders: "'Content-Type,Authorization,X-Amz-Date,X-Api-Key,X-Amz-Security-Token,Accept,Accept-Encoding,Accept-Language,Cache-Control,Connection,Host,Origin,Pragma,Referer,User-Agent,X-Requested-With'"
        AllowMethods: "'GET,POST,PUT,DELETE,PATCH,OPTIONS'"
        AllowCredentials: true
      BinaryMediaTypes:
        - "multipart/form-data"
        - "image/*"
        - "application/octet-stream"

  HackOverflowAPI:
    Type: AWS::Serverless::Function
    Properties:
      PackageType: Image
      Architectures: [x86_64]
      MemorySize: 1024
      Timeout: 30
      Environment:
        Variables:
          NODE_ENV: production
          DATABASE_URL: !Ref DatabaseURL
          SECRET_KEY: !Ref SecretKey
          FRONTEND_URL: !Ref FrontendURL
          CLOUDINARY_CLOUD_NAME: !Ref CloudinaryCloudName
          CLOUDINARY_API_KEY: !Ref CloudinaryAPIKey
          CLOUDINARY_API_SECRET: !Ref CloudinaryAPISecret
          EMAIL_USER: !Ref EmailUser
          EMAIL_PASS: !Ref EmailPass
          FROM_EMAIL: !Ref FromEmail
          RESEND_API_KEY: !Ref ReSendApiKey
          EMAIL_QUEUE_URL: !Ref HackOverflowEmailQueue
          AWS_LAMBDA_NODEJS_DISABLE_CALLBACK_WARNING: true
          
      Policies:
          Statement:
            - Effect: Allow
              Action:
                - firehose:PutRecord
                - firehose:PutRecordBatch
                - sqs:SendMessage
              Resource:
                - arn:aws:firehose:ap-south-1:161266029104:deliverystream/hackoverflow-audit-log-stream
                - !GetAtt HackOverflowEmailQueue.Arn

      Events:
        ApiEvent:
          Type: Api
          Properties:
            RestApiId: !Ref HackOverflowRestApi
            Path: /{proxy+}
            Method: ANY
        RootEvent:
          Type: Api
          Properties:
            RestApiId: !Ref HackOverflowRestApi
            Path: /
            Method: ANY
    Metadata:
      Dockerfile: Dockerfile
      DockerContext: ./
      DockerTag: nodejs20.x-v1
  
  FirehoseRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: hackoverflow-audit-firehose-role
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Principal:
              Service: firehose.amazonaws.com
            Action: sts:AssumeRole
      Path: "/"
      Policies:
        - PolicyName: FirehoseS3AndKMS
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Effect: Allow
                Action:
                  - s3:PutObject
                  - s3:PutObjectAcl
                  - s3:AbortMultipartUpload
                  - s3:GetBucketLocation
                  - s3:ListBucket
                Resource:
                  - arn:aws:s3:::hackoverflow-audit-logs-prod-ap-south-1
                  - arn:aws:s3:::hackoverflow-audit-logs-prod-ap-south-1/*

              - Effect: Allow
                Action:
                  - kms:GenerateDataKey
                  - kms:Encrypt
                Resource:
                  - arn:aws:kms:ap-south-1:161266029104:key/aa69749c-3817-4b52-b3ef-a1ece512d06d

  AuditFirehose:
    Type: AWS::KinesisFirehose::DeliveryStream
    Properties:
      DeliveryStreamName: hackoverflow-audit-log-stream
      DeliveryStreamType: DirectPut
      S3DestinationConfiguration:
        BucketARN: arn:aws:s3:::hackoverflow-audit-logs-prod-ap-south-1
        RoleARN: !GetAtt FirehoseRole.Arn
        Prefix: "audit_logs/date=!{timestamp:yyyy-MM-dd}/"
        ErrorOutputPrefix: "audit_logs/dlq/!{firehose:error-output-type}/"
        BufferingHints:
          SizeInMBs: 64
          IntervalInSeconds: 300
        CompressionFormat: GZIP
        EncryptionConfiguration:
          KMSEncryptionConfig:
            AWSKMSKeyARN: arn:aws:kms:ap-south-1:161266029104:key/aa69749c-3817-4b52-b3ef-a1ece512d06d
  
  HackOverflowEmailQueue:
    Type: AWS::SQS::Queue
    Properties:
      QueueName: hackoverflow-email-queue
      VisibilityTimeout: 60
  

Outputs:
  ApiUrl:
    Description: "REST API Gateway endpoint URL for prod stage"
    Value: !Sub "https://${HackOverflowRestApi}.execute-api.${AWS::Region}.amazonaws.com/prod"
  ApiId:
    Description: "API Gateway ID"
    Value: !Ref HackOverflowRestApi