template.yaml

AWSTemplateFormatVersion: '2010-09-09'
Transform: AWS::Serverless-2016-10-31
Description: PhotoOpsAI central application platform

Parameters:
  ServiceName:
    Type: String
    Description: "Name of service"

  ServiceEnv:
    Type: String
    Description: "Name of deployment environment"
    Default: "prime"

  LogLevel:
    Type: String
    Description: "Log level for functions; used internally in code."
    Default: 'INFO'
    AllowedValues:
      - 'DEBUG'
      - 'INFO'
      - 'WARNING'
      - 'ERROR'
      - 'CRITICAL'

  XRayTracingMode:
    Type: String
    Description: "AWS XRay tracing mode"
    Default: PassThrough
    AllowedValues:
      - Active
      - PassThrough


Globals:
  Function:
    Environment:
      Variables:
        LOG_LEVEL:
          Ref: LogLevel
        POWERTOOLS_SERVICE_NAME: !Ref AWS::StackName
    Tracing: !Ref XRayTracingMode


Resources:
  # Layer also brings in aws-lambda-powertools and boto3
  CommonLayer:
    Type: AWS::Serverless::LayerVersion
    Properties:
      LayerName: !Sub "${AWS::StackName}-${ServiceEnv}-CommonLayer"
      ContentUri: src/common
      RetentionPolicy: Delete
      CompatibleRuntimes:
        - python3.8
    Metadata:
      BuildMethod: makefile

  CommonLayerArnSsmParam:
    Type: AWS::SSM::Parameter
    Properties:
      Name: !Sub /layers/${AWS::StackName}/CommonLayerArn
      Type: String
      Value: !Ref CommonLayer
      Description: ARN of PhotoOps Common Lambda layer for Python 3.8


  IngestS3Event:
    Type: AWS::Serverless::Function
    Properties:
      Description: "Ingest an S3 event"
      CodeUri: src/handlers/IngestS3Event
      Handler: function.handler
      Runtime: python3.8
      MemorySize: 128
      Timeout: 3
      Layers:
        - !Ref CommonLayer
      Events:
        SnsEvent:
          Type: SNS
          Properties:
            Topic: !Ref PhotoOpsIngestTopic
      EventInvokeConfig:
        DestinationConfig:
          OnSuccess:
            Type: EventBridge
            Destination: !GetAtt EventBus.Arn
          OnFailure:
            Type: 'SQS'
            Destination: !GetAtt IngestS3EventDlqQueue.Arn

  IngestS3EventDlqQueue:
    Type: AWS::SQS::Queue


  # FIXME: Running close to memory limit but don't want to bump memory up for
  # all transactions. Possibly we create small, medium, and large functions
  # where we use the object size in the S3 event as a determining factor for
  # which function gets invoked.
  GetExifData:
    Type: AWS::Serverless::Function
    Properties:
      Description: "Get EXIF data"
      CodeUri: src/handlers/GetExifData
      Handler: function.handler
      Runtime: python3.8
      MemorySize: 128
      Timeout: 30
      Layers:
        - !Ref CommonLayer
      Environment:
        Variables:
          CROSS_ACCOUNT_IAM_ROLE_ARN: !GetAtt PhotoOpsCrossAccountIamRole.Arn
      Policies:
        - Version: "2012-10-17"
          Statement:
            - Sid: StsAssumeRole
              Effect: Allow
              Action:
                - sts:AssumeRole
              Resource: !GetAtt PhotoOpsCrossAccountIamRole.Arn


  GetExifCameraData:
    Type: AWS::Serverless::Function
    Properties:
      Description: "Get EXIF camera data"
      CodeUri: src/handlers/GetExifCameraData
      Handler: function.handler
      Runtime: python3.8
      MemorySize: 128
      Timeout: 3
      Layers:
        - !Ref CommonLayer


  GetExifLensData:
    Type: AWS::Serverless::Function
    Properties:
      Description: "Get EXIF lens data"
      CodeUri: src/handlers/GetExifLensData
      Handler: function.handler
      Runtime: python3.8
      MemorySize: 128
      Timeout: 3
      Layers:
        - !Ref CommonLayer


  GetExifImageData:
    Type: AWS::Serverless::Function
    Properties:
      Description: "Get EXIF image data"
      CodeUri: src/handlers/GetExifImageData
      Handler: function.handler
      Runtime: python3.8
      MemorySize: 128
      Timeout: 3
      Layers:
        - !Ref CommonLayer


  GetExifLocationData:
    Type: AWS::Serverless::Function
    Properties:
      Description: "Get EXIF location data"
      CodeUri: src/handlers/GetExifLocationData
      Handler: function.handler
      Runtime: python3.8
      MemorySize: 128
      Timeout: 3
      Layers:
        - !Ref CommonLayer


  GetFileData:
    Type: AWS::Serverless::Function
    Properties:
      Description: "Get file data"
      CodeUri: src/handlers/GetFileData
      Handler: function.handler
      Runtime: python3.8
      MemorySize: 128
      Timeout: 3
      Layers:
        - !Ref CommonLayer


  PhotoOpsIngestTopic:
    Type: AWS::SNS::Topic
    Properties:
      TopicName: !Sub "${AWS::StackName}-PhotoOpsIngestTopic"

  # FIXME: We should be using something like an external ID to limit who can
  # write to this topic.
  PhotoOpsIngestTopicPolicy:
    Type: AWS::SNS::TopicPolicy
    Properties:
      PolicyDocument:
        Id: "PhotoOpsIngestTopicPolicy"
        Version: "2012-10-17"
        Statement:
        - Sid: "GlobalWrite"
          Effect: Allow
          Principal:
            Service: "s3.amazonaws.com"
          Action:
            - sns:Publish
          Resource: !Ref PhotoOpsIngestTopic
      Topics:
        - !Ref PhotoOpsIngestTopic


  CreateJpegFromRaw:
    Type: AWS::Serverless::Function
    Properties:
      Description: "Create a CreateJpegFromRaw"
      CodeUri: src/handlers/CreateJpegFromRaw
      Handler: function.handler
      Runtime: python3.8
      MemorySize: 512
      Timeout: 30
      Layers:
        - !Ref CommonLayer
      Environment:
        Variables:
          PHOTOOPS_S3_BUCKET: !Ref PhotoOpsBucket
          CROSS_ACCOUNT_IAM_ROLE_ARN: !GetAtt PhotoOpsCrossAccountIamRole.Arn
      Policies:
        - Statement:
          - Sid: StsAssumeRole
            Effect: Allow
            Action:
              - sts:AssumeRole
            Resource: !GetAtt PhotoOpsCrossAccountIamRole.Arn
        - Statement:
          - Sid: S3PutObject
            Effect: "Allow"
            Action:
              - s3:PutObject
            Resource: !Sub "${PhotoOpsBucket.Arn}/*"


  DdbSerializer:
    Type: AWS::Serverless::Function
    Properties:
      Description: "Serialize a DDB Document or API item to vice versa"
      CodeUri: src/handlers/DdbSerializer
      Handler: function.handler
      Runtime: python3.8
      MemorySize: 128
      Timeout: 3
      Layers:
        - !Ref CommonLayer


  PhotoOpsBucket:
    Type: AWS::S3::Bucket


  PhotoOpsCrossAccountIamRole:
    Type: "AWS::IAM::Role"
    Properties:
      RoleName: !Sub "CrossAccountAccess-${ServiceEnv}"
      Path: "/PhotoOpsAI/"
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: "Allow"
            Principal:
              AWS:
                # Anyone in account can assume so long as they have their own
                # permission to assume the role.
                - !Sub "arn:aws:iam::${AWS::AccountId}:root"
            Action:
              - "sts:AssumeRole"
      Policies:
        - PolicyName: "DownloadS3Object"
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Sid: "GetS3Object"
                Effect: "Allow"
                Action:
                  - "s3:GetObject"
                Resource: "arn:aws:s3:::*/*"
              - Sid: "ListS3Bucket"
                Effect: "Allow"
                Action:
                  - "s3:ListBucket"
                Resource: "arn:aws:s3:::*/"


  GetExifDataStateMachine:
    Type: AWS::Serverless::StateMachine
    Properties:
      DefinitionUri: src/state-machines/get-exif-data.yaml
      DefinitionSubstitutions:
        DdbTableName: !Ref DynamoDBTable
        GetExifDataArn: !GetAtt GetExifData.Arn
        GetExifCameraDataArn: !GetAtt GetExifCameraData.Arn
        GetExifImageDataArn: !GetAtt GetExifImageData.Arn
        GetExifLensDataArn: !GetAtt GetExifLensData.Arn
        GetExifLocationDataArn: !GetAtt GetExifLocationData.Arn
        GetFileDataArn: !GetAtt GetFileData.Arn
        DdbSerializerArn: !GetAtt DdbSerializer.Arn
      Tracing:
        Enabled: true
      Logging:
        IncludeExecutionData: true
        Level: ERROR
        Destinations:
          - CloudWatchLogsLogGroup:
              LogGroupArn: !GetAtt GetExifDataLogGroup.Arn
      Events:
        EventBridgeRule:
          Type: EventBridgeRule
          Properties:
            EventBusName: !Ref EventBus
            Pattern:
              source: [ "lambda" ]
              detail-type: [ "Lambda Function Invocation Result - Success" ]
              detail:
                requestPayload:
                  Records:
                    Sns:
                      TopicArn: [ !Ref PhotoOpsIngestTopic ]
                responsePayload:
                  Records:
                    eventSource: [ "aws:s3" ]
                    # FIXME: Is this all the possible event names?
                    eventName:
                      - prefix: "ObjectCreated:"
      Policies:
        - Statement:
          - Effect: Allow
            Action:
              - "dynamodb:PutItem"
            Resource:
              - !GetAtt DynamoDBTable.Arn
          - Effect: Allow
            Action:
              - "lambda:InvokeFunction"
            Resource:
              - !Sub "arn:aws:lambda:${AWS::Region}:${AWS::AccountId}:function:${AWS::StackName}-*"
          - Effect: Allow
            Action:
              - logs:CreateLogDelivery
              - logs:GetLogDelivery
              - logs:UpdateLogDelivery
              - logs:DeleteLogDelivery
              - logs:ListLogDeliveries
              - logs:PutResourcePolicy
              - logs:DescribeResourcePolicies
              - logs:DescribeLogGroups
            Resource: '*'
          - Effect: Allow
            Action:
              - logs:CreateLogStream
              - logs:DescribeLogStream
              - logs:PutLogEvents
            Resource:
              - !GetAtt GetExifDataLogGroup.Arn


  GetExifDataLogGroup:
    Type: AWS::Logs::LogGroup
    Properties:
      LogGroupName: !Sub '/aws/step-functions/GetExifData-${ServiceEnv}'
      RetentionInDays: 7


  CreateJpegStateMachine:
    Type: AWS::Serverless::StateMachine
    Properties:
      DefinitionUri: src/state-machines/create-jpeg.json
      DefinitionSubstitutions:
        EventBusName: !Ref EventBus
        DdbTableName: !Ref DynamoDBTable
        CreateJpegFromRawName: !Ref CreateJpegFromRaw
      Tracing:
        Enabled: true
      Logging:
        IncludeExecutionData: true
        Level: ERROR
        Destinations:
          - CloudWatchLogsLogGroup:
              LogGroupArn: !GetAtt CreateJpegLogGroup.Arn
      Events:
        EventBridgeRule:
          Type: EventBridgeRule
          Properties:
            EventBusName: !Ref EventBus
            InputPath: "$.detail"
            Pattern:
              account:
                - !Ref AWS::AccountId
              detail-type:
                - "PhotoOps::CreateJpeg::Invoke"
              detail:
                s3_bucket:
                  - exists: true
                s3_object_key:
                  - exists: true
      Policies:
        - Statement:
          - Effect: Allow
            Action:
              - "states:SendTaskSuccess"
            Resource:
              - '*'
          - Effect: Allow
            Action:
              - "events:PutEvents"
            Resource:
              - !GetAtt EventBus.Arn
          - Effect: Allow
            Action:
              - "lambda:InvokeFunction"
            Resource:
              - !GetAtt CreateJpegFromRaw.Arn
          - Effect: Allow
            Action:
              - "eventbridge:PutEvents"
            Resource:
              - !GetAtt EventBus.Arn
          - Effect: Allow
            Action:
              - logs:CreateLogDelivery
              - logs:GetLogDelivery
              - logs:UpdateLogDelivery
              - logs:DeleteLogDelivery
              - logs:ListLogDeliveries
              - logs:PutResourcePolicy
              - logs:DescribeResourcePolicies
              - logs:DescribeLogGroups
            Resource: '*'
          - Effect: Allow
            Action:
              - logs:CreateLogStream
              - logs:DescribeLogStream
              - logs:PutLogEvents
            Resource:
              - !GetAtt CreateJpegLogGroup.Arn


  CreateJpegLogGroup:
    Type: AWS::Logs::LogGroup
    Properties:
      LogGroupName: !Sub '/aws/step-functions/CreateJpeg-${ServiceEnv}'
      RetentionInDays: 7


  # FIXME: We should add a "Serialize DDB event function to this."
  DdbOpsStateMachine:
    Type: AWS::Serverless::StateMachine
    Properties:
      DefinitionUri: src/state-machines/ddb-ops.yaml
      DefinitionSubstitutions:
        DdbTableName: !Ref DynamoDBTable
        UpdateExpression: '$.UpdateExpression'
        ExpressionAttributeNames: '$.ExpressionAttributeNames'
        ExpressionAttributeValues: '$.ExpressionAttributeValues'
        DdbSerializerArn: !GetAtt DdbSerializer.Arn
      Tracing:
        Enabled: true
      Logging:
        IncludeExecutionData: true
        Level: ERROR
        Destinations:
          - CloudWatchLogsLogGroup:
              LogGroupArn: !GetAtt DdbOpsLogGroup.Arn
      Events:
        DdbOp:
          Type: EventBridgeRule
          Properties:
            EventBusName: !Ref EventBus
            Pattern:
              detail-type:
                - prefix: "AWS::DynamoDB"
#        DdbBatchOp:
#          Type: EventBridgeRule
#          Properties:
#            EventBusName: !Ref EventBus
#            Pattern:
#              detail-type:
#                - prefix: "AWS::DynamoDB::Batch"
#              detail:
#                RequestItems:
#                  "!Ref DynamoDBTable":
#                    - exists: true
      Policies:
        - Statement:
          - Effect: Allow
            Action:
              - "states:SendTaskSuccess"
            Resource:
              - '*'
          - Effect: Allow
            Action:
              - "dynamodb:PutItem"
              - "dynamodb:GetItem"
              - "dynamodb:UpdateItem"
              - "dynamodb:DeleteItem"
            Resource:
              - !GetAtt DynamoDBTable.Arn
          - Effect: Allow
            Action:
              - logs:CreateLogDelivery
              - logs:GetLogDelivery
              - logs:UpdateLogDelivery
              - logs:DeleteLogDelivery
              - logs:ListLogDeliveries
              - logs:PutResourcePolicy
              - logs:DescribeResourcePolicies
              - logs:DescribeLogGroups
            Resource: '*'
          - Effect: Allow
            Action:
              - logs:CreateLogStream
              - logs:DescribeLogStream
              - logs:PutLogEvents
            Resource:
              - !GetAtt DdbOpsLogGroup.Arn
          - Effect: Allow
            Action:
              - lambda:InvokeFunction
            Resource:
              - !GetAtt DdbSerializer.Arn


  DdbOpsLogGroup:
    Type: AWS::Logs::LogGroup
    Properties:
      LogGroupName: !Sub '/aws/step-functions/DdbOps-${ServiceEnv}'
      RetentionInDays: 7


  # FIXME: Need a DLQ
  EventBus:
    Type: AWS::Events::EventBus
    Properties:
      Name: !Sub "${ServiceName}-${ServiceEnv}"

  EventBusLogGroup:
    Type: AWS::Logs::LogGroup
    Properties:
      LogGroupName: !Sub "/aws/events/${EventBus}/all"
      RetentionInDays: 7

  EventBusLogGroupRule:
    Type: AWS::Events::Rule
    Properties:
      Description: "Log all events to CloudWatch"
      EventBusName: !Ref EventBus
      EventPattern:
        account:
          - !Ref AWS::AccountId
      Targets:
        - Arn: !Sub "arn:aws:logs:${AWS::Region}:${AWS::AccountId}:log-group:${EventBusLogGroup}"
          Id: "EventBusLogGroup"


  # Grant eventBus ability to deliver logs to CW.
  #
  # ref: https://github.com/aws-cloudformation/cloudformation-coverage-roadmap/issues/351#issuecomment-887045751
  LogGroupForEventsPolicy:
    Type: AWS::Logs::ResourcePolicy
    Properties:
      PolicyName: !Sub "${AWS::StackName}-${ServiceEnv}-EventBridgeToCWLogsPolicy"
      PolicyDocument: !Sub
        - >
          {
            "Version": "2012-10-17",
            "Statement": [
              {
                "Sid": "EventBridgetoCWLogsPolicy",
                "Effect": "Allow",
                "Principal": {
                  "Service": [
                    "delivery.logs.amazonaws.com",
                    "events.amazonaws.com"
                  ]
                },
                "Action": [
                  "logs:CreateLogStream",
                  "logs:PutLogEvents"
                ],
                "Resource": [
                  "${logArn}"
                ],
                "Condition": {
                  "ArnEquals": {"aws:SourceArn": "${ruleArn}"}
                }
              }
            ]
          }
        - { logArn: !GetAtt EventBusLogGroup.Arn, ruleArn:  !GetAtt EventBusLogGroupRule.Arn}



  DynamoDBTable:
    Type: AWS::DynamoDB::Table
    # NOTE: Retain data by default
    DeletionPolicy: Retain
    UpdateReplacePolicy: Retain
    Properties:
      AttributeDefinitions:
        - AttributeName: "pk"
          AttributeType: "S"
        - AttributeName: "sk"
          AttributeType: "S"
      KeySchema:
        - AttributeName: "pk"
          KeyType: "HASH"
        - AttributeName: "sk"
          KeyType: "RANGE"
      TimeToLiveSpecification:
        AttributeName: "ttl"
        Enabled: true
      BillingMode: "PAY_PER_REQUEST"


  AppSyncGqlApi:
    Type: "AWS::AppSync::GraphQLApi"
    Properties:
      Name: !Ref AWS::StackName
      # FIXME: Using until we finally have something permanent built.
      AuthenticationType: API_KEY
      LogConfig:
        CloudWatchLogsRoleArn: !GetAtt AppSyncGqlCwLogsIamRole.Arn
        FieldLogLevel: ALL
      # FIXME: Appears to be an issue on AWS side with servce role being created behind
      # the scenes.
      # ref. https://github.com/aws/aws-cdk/issues/16598
      #XrayEnabled: true

  AppSyncGqlIamRole:
    Type: "AWS::IAM::Role"
    Properties:
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: "Allow"
            Principal:
              Service: appsync.amazonaws.com
            Action:
              - "sts:AssumeRole"
      Policies:
        - PolicyName: "DynamoDB"
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Sid: "DdbOps"
                Effect: "Allow"
                Action:
                  - "dynamodb:*GetItem"
                Resource: !GetAtt DynamoDBTable.Arn

  AppSyncGqlCwLogsIamRole:
    Type: "AWS::IAM::Role"
    Properties:
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: "Allow"
            Principal:
              Service: appsync.amazonaws.com
            Action:
              - "sts:AssumeRole"
      Policies:
        - PolicyName: "CwLogs"
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Sid: "CwLogDelivery"
                Effect: "Allow"
                Action:
                  - "logs:CreateLogGroup"
                  - "logs:CreateLogStream"
                  - "logs:PutLogEvents"
                Resource: "*"

  # FIXME: Using until we finally have something permanent built.
  AppSyncGqlApiKey:
    Type: AWS::AppSync::ApiKey
    Properties:
      Description:
        Fn::Sub:
          - "API key for ${GraphQLApiApiId} at ${GraphQLApiGraphQLUrl}"
          - GraphQLApiApiId: !GetAtt AppSyncGqlApi.ApiId
            GraphQLApiGraphQLUrl: !GetAtt AppSyncGqlApi.GraphQLUrl
      ApiId: !GetAtt AppSyncGqlApi.ApiId
      # FIXME: 365 days; will update the key on every deploy. This whole thing is not ideal.
      Expires: 1689884857

  AppSyncGqlSchema:
    Type: AWS::AppSync::GraphQLSchema
    Properties:
      ApiId: !GetAtt AppSyncGqlApi.ApiId
      DefinitionS3Location: schema.graphql

  AppSyncDdbDataSource:
    Type: "AWS::AppSync::DataSource"
    Properties:
      ApiId: !GetAtt AppSyncGqlApi.ApiId
      Name: DdbTable
      Description: !Sub "${DynamoDBTable} data source"
      Type: AMAZON_DYNAMODB
      ServiceRoleArn: !GetAtt AppSyncGqlIamRole.Arn
      DynamoDBConfig:
        AwsRegion: !Ref AWS::Region
        TableName: !Ref DynamoDBTable

  QueryPhotoCameraDataResolver:
    Type: AWS::AppSync::Resolver
    DependsOn: AppSyncGqlSchema
    Properties:
      ApiId: !GetAtt AppSyncGqlApi.ApiId
      TypeName: Query
      FieldName: photoCameraData
      DataSourceName: !GetAtt AppSyncDdbDataSource.Name
      RequestMappingTemplate: |
        {
            "version" : "2017-02-28",
            "operation" : "GetItem",
            "key" : {
                "pk" : $util.dynamodb.toDynamoDBJson($ctx.args.id),
                "sk": $util.dynamodb.toDynamoDBJson("camera#v0")
            }
        }
      ResponseMappingTemplate: |
        $util.qr($ctx.result.put("id", "$ctx.result.pk"))
        $util.qr($ctx.result.remove("pk"))
        $util.qr($ctx.result.remove("sk"))
        $utils.toJson($ctx.result)

  # FIXME: Not sure how we'll model this schema well with graphql
  #QueryPhotoExifDataResolver:
  #  Type: AWS::AppSync::Resolver
  #  DependsOn: AppSyncGqlSchema
  #  Properties:
  #    ApiId: !GetAtt AppSyncGqlApi.ApiId
  #    TypeName: Query
  #    FieldName: photoExifData
  #    DataSourceName: !GetAtt AppSyncDdbDataSource.Name
  #    RequestMappingTemplate: |
  #      {
  #          "version" : "2017-02-28",
  #          "operation" : "GetItem",
  #          "key" : {
  #              "pk" : $util.dynamodb.toDynamoDBJson($ctx.args.id),
  #              "sk": $util.dynamodb.toDynamoDBJson("exif#v0")
  #          }
  #      }
  #    ResponseMappingTemplate: |
  #      $util.qr($ctx.result.put("id", "$ctx.result.pk"))
  #      $util.qr($ctx.result.remove("pk"))
  #      $util.qr($ctx.result.remove("sk"))
  #      $utils.toJson($ctx.result)

  QueryPhotoFileDataResolver:
    Type: AWS::AppSync::Resolver
    DependsOn: AppSyncGqlSchema
    Properties:
      ApiId: !GetAtt AppSyncGqlApi.ApiId
      TypeName: Query
      FieldName: photoFileData
      DataSourceName: !GetAtt AppSyncDdbDataSource.Name
      RequestMappingTemplate: |
        {
            "version" : "2017-02-28",
            "operation" : "GetItem",
            "key" : {
                "pk" : $util.dynamodb.toDynamoDBJson($ctx.args.id),
                "sk": $util.dynamodb.toDynamoDBJson("file#v0")
            }
        }
      ResponseMappingTemplate: |
        $util.qr($ctx.result.put("id", "$ctx.result.pk"))
        $util.qr($ctx.result.remove("pk"))
        $util.qr($ctx.result.remove("sk"))
        $utils.toJson($ctx.result)

  QueryPhotoImageDataResolver:
    Type: AWS::AppSync::Resolver
    DependsOn: AppSyncGqlSchema
    Properties:
      ApiId: !GetAtt AppSyncGqlApi.ApiId
      TypeName: Query
      FieldName: photoImageData
      DataSourceName: !GetAtt AppSyncDdbDataSource.Name
      RequestMappingTemplate: |
        {
            "version" : "2017-02-28",
            "operation" : "GetItem",
            "key" : {
                "pk" : $util.dynamodb.toDynamoDBJson($ctx.args.id),
                "sk": $util.dynamodb.toDynamoDBJson("image#v0")
            }
        }
      ResponseMappingTemplate: |
        $util.qr($ctx.result.put("id", "$ctx.result.pk"))
        $util.qr($ctx.result.remove("pk"))
        $util.qr($ctx.result.remove("sk"))
        $utils.toJson($ctx.result)

  QueryPhotoLensDataResolver:
    Type: AWS::AppSync::Resolver
    DependsOn: AppSyncGqlSchema
    Properties:
      ApiId: !GetAtt AppSyncGqlApi.ApiId
      TypeName: Query
      FieldName: photoLensData
      DataSourceName: !GetAtt AppSyncDdbDataSource.Name
      RequestMappingTemplate: |
        {
            "version" : "2017-02-28",
            "operation" : "GetItem",
            "key" : {
                "pk" : $util.dynamodb.toDynamoDBJson($ctx.args.id),
                "sk": $util.dynamodb.toDynamoDBJson("lens#v0")
            }
        }
      ResponseMappingTemplate: |
        $util.qr($ctx.result.put("id", "$ctx.result.pk"))
        $util.qr($ctx.result.remove("pk"))
        $util.qr($ctx.result.remove("sk"))
        $utils.toJson($ctx.result)

  QueryPhotoLocationDataResolver:
    Type: AWS::AppSync::Resolver
    DependsOn: AppSyncGqlSchema
    Properties:
      ApiId: !GetAtt AppSyncGqlApi.ApiId
      TypeName: Query
      FieldName: photoLocationData
      DataSourceName: !GetAtt AppSyncDdbDataSource.Name
      RequestMappingTemplate: |
        {
            "version" : "2017-02-28",
            "operation" : "GetItem",
            "key" : {
                "pk" : $util.dynamodb.toDynamoDBJson($ctx.args.id),
                "sk": $util.dynamodb.toDynamoDBJson("location#v0")
            }
        }
      ResponseMappingTemplate: |
        $util.qr($ctx.result.put("id", "$ctx.result.pk"))
        $util.qr($ctx.result.remove("pk"))
        $util.qr($ctx.result.remove("sk"))
        $utils.toJson($ctx.result)


  # For CloudWatch Alarms
  CloudWatchTopic:
    Type: AWS::SNS::Topic


  # SSM Parameters
  PhotoOpsIngestTopicArn:
    Type: AWS::SSM::Parameter
    Properties:
      Name: !Sub "/PhotoOpsAI/${ServiceName}/${ServiceEnv}/PhotoOpsIngestTopicArn"
      Type: String
      Description: "Ingest SNS topic ARN"
      Value: !Ref PhotoOpsIngestTopic

  PhotoOpsBucketName:
    Type: AWS::SSM::Parameter
    Properties:
      Name: !Sub "/PhotoOpsAI/${ServiceName}/${ServiceEnv}/PhotoOpsBucketName"
      Type: String
      Description: "Name of PhotoOps image bucket"
      Value: !Ref PhotoOpsBucket

  DynamoDBTableName:
    Type: AWS::SSM::Parameter
    Properties:
      Name: !Sub "/PhotoOpsAI/${ServiceName}/${ServiceEnv}/DynamoDBTableName"
      Type: String
      Description: "DDB table name"
      Value: !Ref DynamoDBTable

  DynamoDBTableArn:
    Type: AWS::SSM::Parameter
    Properties:
      Name: !Sub "/PhotoOpsAI/${ServiceName}/${ServiceEnv}/DynamoDBTableArn"
      Type: String
      Description: "DDB table ARN"
      Value: !GetAtt DynamoDBTable.Arn

  EventBusArn:
    Type: AWS::SSM::Parameter
    Properties:
      Name: !Sub "/PhotoOpsAI/${ServiceName}/${ServiceEnv}/EventBusArn"
      Type: String
      Description: "Event Bus ARN"
      Value: !GetAtt EventBus.Arn

  EventBusName:
    Type: AWS::SSM::Parameter
    Properties:
      Name: !Sub "/PhotoOpsAI/${ServiceName}/${ServiceEnv}/EventBusName"
      Type: String
      Description: "Event Bus Name"
      Value: !Ref EventBus

  CloudWatchTopicArn:
    Type: AWS::SSM::Parameter
    Properties:
      Name: !Sub "/PhotoOpsAI/${ServiceName}/${ServiceEnv}/CloudWatchTopicArn"
      Type: String
      Description: "CloudWatch SNS Topic ARN"
      Value: !Ref CloudWatchTopic

  AppSyncGqlApiUrl:
    Type: AWS::SSM::Parameter
    Properties:
      Name: !Sub "/PhotoOpsAI/${ServiceName}/${ServiceEnv}/AppSyncGqlApiUrl"
      Type: String
      Description: "AppSync API URL"
      Value: !GetAtt AppSyncGqlApi.GraphQLUrl

  AppSyncGqlApiKeyValue:
    Type: AWS::SSM::Parameter
    Properties:
      Name: !Sub "/PhotoOpsAI/${ServiceName}/${ServiceEnv}/AppSyncGqlApiKeyValue"
      Type: String
      Description: "AppSync API key"
      Value: !GetAtt AppSyncGqlApiKey.ApiKey


Outputs:
  PhotoOpsIngestTopicArn:
    Description: "ARN of PhotoOps Ingest topic ARN"
    Value: !Ref PhotoOpsIngestTopic

  DynamoDBTableName:
    Description: "Name of DynamoDB table"
    Value: !Ref DynamoDBTable

  EventBusArn:
    Description: "ARN of event bus"
    Value: !GetAtt EventBus.Arn

  EventBusName:
    Description: "Name of event bus"
    Value: !Ref EventBus

  CloudWatchTopicArn:
    Description: "ARN of CloudWatch topic"
    Value: !Ref CloudWatchTopic

  AppSyncGqlApiUrl:
    Description: "AppSync API URL"
    Value: !GetAtt AppSyncGqlApi.GraphQLUrl

  AppSyncGqlApiKeyValue:
    Description: "AppSync API key"
    Value: !GetAtt AppSyncGqlApiKey.ApiKey