AWSTemplateFormatVersion: '2010-09-09'
Transform: AWS::Serverless-2016-10-31
Description: Operata Conductor for Amazon Connect
Parameters:
  CFRLogGroupName:
    Description: The Cloudwatch log group for the Contact Flow Records
    Type: String
  KinesisStreamARNCFR:
    Description: Kinesis Stream ARN used for Contact Flow Logs (If it already exists)
    Type: String
  KinesisStreamARNCTR:
    Description: Kinesis Stream ARN used by Contact Trace Records
    Type: String
  OperataGroupID:
    Type: String
    Description: Operata Group ID
  OperataGroupSecret:
    Type: String
    Description: Operata Group Secret
  OperataAPIUrl:
    Type: String
    Default: https://api.operata.io
    Description: Operata API Url
  ContentControlConfig:
    Type: String
    Description: Content Control Configuration file (S3 Url)
  LogLevel:
    Type: String
    Default: 0
    AllowedValues:
    - 0
    - 1
    - 2
    - 3
    Description: Log levels. 0=Debug, 1=Info, 2=Warn, 3=Error
Conditions:
  HasCFRLogGroup:
    Fn::Not:
    - Fn::Equals:
      - ''
      - Ref: CFRLogGroupName
  HasExistingCFRKinesis:
    Fn::Not:
    - Fn::Equals:
      - ''
      - Ref: KinesisStreamARNCFR
  ShouldCreateCFRKinesis:
    Fn::And:
    - Fn::Not:
      - Condition: HasExistingCFRKinesis
    - Condition: HasCFRLogGroup
Resources:
  OperataGroupSecretSM:
    Type: AWS::SecretsManager::Secret
    Properties:
      Name:
        Fn::Join:
        - /
        - - operata
          - Ref: OperataGroupID
          - secret
      Description: Operata group secret
      SecretString:
        Ref: OperataGroupSecret
  CTRProcessor:
    Type: AWS::Serverless::Function
    Properties:
      Description: Lambda function that listens to CTR Kinesis stream.
      Handler: bin/processor
      CodeUri: s3://prod-eu-west-2-operata-conductor-processor/33be724dd68711668a2cf21dddf767bb
      Runtime: go1.x
      Timeout: 20
      Role:
        Fn::GetAtt:
        - LambdaExecutionRole
        - Arn
      Events:
        CFRStream:
          Type: Kinesis
          Properties:
            Stream:
              Fn::If:
              - HasExistingCFRKinesis
              - Ref: KinesisStreamARNCFR
              - Fn::GetAtt:
                - CFRKinesisSubscriptionStream
                - Arn
            BatchSize: 50
            StartingPosition: TRIM_HORIZON
            BisectBatchOnFunctionError: true
            MaximumRetryAttempts: 10
        StreamCTR:
          Type: Kinesis
          Properties:
            Stream:
              Ref: KinesisStreamARNCTR
            BatchSize: 50
            StartingPosition: TRIM_HORIZON
            BisectBatchOnFunctionError: true
            MaximumRetryAttempts: 10
      Environment:
        Variables:
          LOG_LEVEL:
            Ref: LogLevel
          OPERATA_GROUP_ID:
            Ref: OperataGroupID
          OPERATA_GROUP_SECRET:
            Ref: OperataGroupSecretSM
          OPERATA_API_URL:
            Ref: OperataAPIUrl
          CONTENT_CONTROL_CONFIG:
            Ref: ContentControlConfig
  LambdaExecutionRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
        - Effect: Allow
          Principal:
            Service:
            - lambda.amazonaws.com
          Action:
          - sts:AssumeRole
      Path: /
      Policies:
      - PolicyName: root
        PolicyDocument:
          Version: '2012-10-17'
          Statement:
          - Effect: Allow
            Action:
            - logs:CreateLogStream
            - logs:CreateLogGroup
            - logs:PutLogEvents
            Resource:
              Fn::Join:
              - ''
              - - arn:aws:logs:*:*:log-group:/aws/lambda/
                - Ref: AWS::StackName
                - '*:log-stream:*'
          - Effect: Allow
            Action:
            - kinesis:DescribeStream
            - kinesis:DescribeStreamSummary
            - kinesis:GetRecords
            - kinesis:GetShardIterator
            - kinesis:ListShards
            - kinesis:ListStreams
            - kinesis:SubscribeToShard
            Resource:
            - Ref: KinesisStreamARNCTR
            - Fn::If:
              - HasExistingCFRKinesis
              - Ref: KinesisStreamARNCFR
              - Fn::GetAtt:
                - CFRKinesisSubscriptionStream
                - Arn
          - Effect: Allow
            Action:
            - secretsmanager:GetSecretValue
            Resource:
            - Ref: OperataGroupSecretSM
  CFRKinesisSubscriptionStream:
    Type: AWS::Kinesis::Stream
    Condition: ShouldCreateCFRKinesis
    Properties:
      ShardCount: 1
  ConnectCFRToKinesisRole:
    Type: AWS::IAM::Role
    Condition: ShouldCreateCFRKinesis
    Properties:
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
        - Effect: Allow
          Action: sts:AssumeRole
          Principal:
            Service:
              Fn::Join:
              - ''
              - - logs.
                - Ref: AWS::Region
                - .amazonaws.com
  ConnectCFRKinesisPolicy:
    Type: AWS::IAM::Policy
    Condition: ShouldCreateCFRKinesis
    Properties:
      PolicyName: ConnectCFRKinesisPolicy
      Roles:
      - Ref: ConnectCFRToKinesisRole
      PolicyDocument:
        Version: '2012-10-17'
        Statement:
        - Effect: Allow
          Action: kinesis:PutRecord
          Resource:
            Fn::GetAtt:
            - CFRKinesisSubscriptionStream
            - Arn
        - Effect: Allow
          Action: iam:PassRole
          Resource:
            Fn::GetAtt:
            - ConnectCFRToKinesisRole
            - Arn
  ConnectCFRKinesisSubscriptionFilter:
    Type: AWS::Logs::SubscriptionFilter
    Condition: ShouldCreateCFRKinesis
    Properties:
      DestinationArn:
        Fn::GetAtt:
        - CFRKinesisSubscriptionStream
        - Arn
      FilterPattern: ''
      LogGroupName:
        Ref: CFRLogGroupName
      RoleArn:
        Fn::GetAtt:
        - ConnectCFRToKinesisRole
        - Arn
Outputs:
  FunctionName:
    Description: Function name
    Value:
      Ref: CTRProcessor
  CFRKinesisStreamArn:
    Description: Kinesis stream ARN for the Contact Flow Records
    Value:
      Fn::If:
      - HasExistingCFRKinesis
      - Ref: KinesisStreamARNCFR
      - Fn::GetAtt:
        - CFRKinesisSubscriptionStream
        - Arn
