template.yaml

AWSTemplateFormatVersion: '2010-09-09'
Transform: AWS::Serverless-2016-10-31
Description: >
  AWS  SAM Template for common resources between NVA stacks

Metadata:
  AWS::CloudFormation::Interface:
    ParameterGroups:
      - Label:
          default: Backup configuration
        Parameters:
          - DaysToRetainHourlyBackup
          - DaysToRetainDailyBackup
          - DaysToRetainWeeklyBackup
          - DaysToRetainQuarterlyBackup
          - SharedBackupVaultArn
          - SharedBackupAccountId
          - UseBackup


Parameters:
  BackendDomainCertificateArn:
    Type: String
    Description: ARN for the certificate covering the API host/domain/API Gateway Custom Domain. The value is stored in Region us-east-1.
  FrontendDomainCertificateArn:
    Type: String
    Description: ARN for the certificate covering the API host/domain/API Gateway Custom Domain. The value is stored in Region us-east-1.
  CustomDomain:
    Type: String
    Description: The domain of the NVA related services. This part of the domain is common to both backend and frontend services. Eg. dev.nva.aws.unit.no or nva.unit.no.
  AlmaApiUri:
    Type: String
    Description: URI to Alma API.
    Default: 'https://bibsys.alma.exlibrisgroup.com/view/sru/47BIBSYS_NETWORK'
  DataCiteMdsEndpoint:
    Type: String
    Description: URI to Datacite MDS endpoint.
  DataCiteRestEndpoint:
    Type: String
    Description: URI to Datacite Rest endpoint.
  OrcidBaseUrl:
    Type: String
    Description: URL for communicating with ORCID
  ApiGatewayEndpointType:
    Type: String
    Default: EDGE
    Description: The ApiGateway Endpoint Type
  SlackChannelId:
    Type: String
    Description: ID of slack channel. Used for monitoring/alerts. Example CXXXXXXXXXX
  SlackWorkspaceId:
    Type: String
    Description: ID of slack workspace. Used for monitoring/alerts. Example TXXXXXXXX
  Suffix:
    Type: String
    Default: ''
    Description: Suffix used for naming resources for feature branches to avoid conflicts.
  EnvironmentName:
    Type: String
    Description: Environment name. Must be unique accross all NVA environments as it will be part of the cognito uri and potentially other resources like S3.
  VpcCIDR:
    Description: IP range (CIDR notation) for this VPC
    Type: String
    Default: 10.192.0.0/16
  PublicSubnetCIDR:
    Description: IP range (CIDR notation) for the public subnet
    Type: String
    Default: 10.192.10.0/24
  PrivateSubnetCIDR:
    Description: IP range (CIDR notation) for the private subnet
    Type: String
    Default: 10.192.20.0/24
  AppConfigName:
    Type: String
    Description: Name of the AppConfig application
    Default: ApplicationConfig
  ApplicationConfigurationProfileName:
    Type: String
    Description: Name of the AppConfig application configuration profile
    Default: ApplicationConfigurationProfile
  ApplicationEnvironmentName:
    Type: String
    Description: Name of the AppConfig application environment
    Default: Live

  # Backup configuration
  DaysToRetainHourlyBackup:
    Type: Number
    Default: 2
    Description: Number of days to retain hourly backups
  DaysToRetainDailyBackup:
    Type: Number
    Default: 7
    Description: Number of days to retain daily backups
  DaysToRetainWeeklyBackup:
    Type: Number
    Default: 28
    Description: Number of days to retain weekly backups
  DaysToRetainQuarterlyBackup:
    Type: Number
    Default: 365
    Description: Number of days to retain quarterly backups
  SharedBackupVaultArn:
    Type: String
    Description: ARN of the shared backup vault for this environment. Backups are copied to this vault.
  SharedBackupAccountId:
    Type: String
    Description: Account ID of the shared backup account
  UseBackup:
    Type: String
    Default: 'false'
    AllowedValues:
      - 'true'
      - 'false'
    Description: Enable or disable backups for this environment

Conditions:
  WithSuffix: !Not [ !Equals [ !Ref Suffix, '' ] ]
  CreateBackups:
    Fn::Equals:
      - !Ref UseBackup
      - 'true'

Resources:

  NvaEventsBus:
    Type: AWS::Events::EventBus
    Properties:
      Name: !If
        - WithSuffix
        - !Sub 'nva-events-default-bus-${AWS::AccountId}-${Suffix}'
        - !Sub 'nva-events-default-bus-${AWS::AccountId}'

  EventBusArn:
    Type: AWS::SSM::Parameter
    Properties:
      DataType: text
      Description: Parameter containing the default EventBridge bus used in NVA so that other services can be aware of the name of the bus.
      Name: /NVA/Events/EventsBusArn
      Type: String
      Value: !GetAtt NvaEventsBus.Arn

  EventBusName:
    Type: AWS::SSM::Parameter
    Properties:
      DataType: text
      Description: Parameter containing the default EventBridge bus used in NVA so that other services can be aware of the name of the bus.
      Name: /NVA/Events/EventsBusName
      Type: String
      Value: !GetAtt NvaEventsBus.Name

  EventsBucket:
    Type: AWS::S3::Bucket
    Properties:
      BucketName: !If
        - WithSuffix
        - !Sub 'eventbridge-event-bodies-${AWS::AccountId}-${Suffix}'
        - !Sub 'eventbridge-event-bodies-${AWS::AccountId}'
      AccessControl: Private
      LifecycleConfiguration:
        Rules:
          - Id: "ExpiryPolicy"
            ExpirationInDays: 14
            Status: Enabled
      VersioningConfiguration:
        Status: Suspended

  ChatbotRole:
    Type: "AWS::IAM::Role"
    Properties:
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: "Allow"
            Principal:
              Service:
                - "chatbot.amazonaws.com"
            Action:
              - "sts:AssumeRole"
      Path: "/"
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/AmazonSNSReadOnlyAccess
        - arn:aws:iam::aws:policy/AWSSupportAccess
        - arn:aws:iam::aws:policy/CloudWatchReadOnlyAccess

  SlackSNSTopic:
    Type: AWS::SNS::Topic

  NvaSlackChannel:
    Type: AWS::Chatbot::SlackChannelConfiguration
    Properties:
      ConfigurationName: nva-monitoring
      IamRoleArn: !GetAtt ChatbotRole.Arn
      LoggingLevel: INFO
      SlackChannelId: !Ref SlackChannelId
      SlackWorkspaceId: !Ref SlackWorkspaceId
      SnsTopicArns:
        - !Ref SlackSNSTopic


  # This bucket could belong to the NVA Resources service but being there would
  # prevent us from being able to create and destroy the stack. Also, this bucket is read
  # by the search service, so it is a common resource by definition. The deletion of
  # the NVA Resources service stack should not necessarily break the NVA search service
  ExpandedResourcesBucket:
    Type: AWS::S3::Bucket
    Properties:
      BucketName: !If
        - WithSuffix
        - !Sub 'persisted-resources-${AWS::AccountId}-${Suffix}'
        - !Sub 'persisted-resources-${AWS::AccountId}'
      "NotificationConfiguration": {
        "EventBridgeConfiguration": {
          "EventBridgeEnabled": true
        }
      }
      AccessControl: Private
      VersioningConfiguration:
        Status: Suspended

  # Bucket for storing API responses that are too large to pass through Lambda
  LargeApiResponsesBucket:
    Type: AWS::S3::Bucket
    Properties:
      BucketName: !If
        - WithSuffix
        - !Sub 'large-api-responses-${AWS::AccountId}-${Suffix}'
        - !Sub 'large-api-responses-${AWS::AccountId}'
      AccessControl: Private
      LifecycleConfiguration:
        Rules:
          - Status: Enabled
            ExpirationInDays: 1
    DeletionPolicy: Retain

  ResourceStorageBucket:
    Type: AWS::S3::Bucket
    DeletionPolicy: Retain
    Properties:

      BucketName: !If
        - WithSuffix
        - !Sub 'nva-resource-storage-${AWS::AccountId}-${Suffix}'
        - !Sub 'nva-resource-storage-${AWS::AccountId}'
      CorsConfiguration:
        CorsRules:
          - AllowedHeaders: [ '*' ]
            AllowedMethods: [ GET, PUT, POST, HEAD ]
            AllowedOrigins: [ '*' ]
            ExposedHeaders: [ ETag ]
      LifecycleConfiguration:
        Rules:
          - Id: RemoveFailedUploads
            Status: Enabled
            AbortIncompleteMultipartUpload:
              DaysAfterInitiation: 7
      VersioningConfiguration:
        Status: Enabled

  NVAStorageBucketPolicy:
    Type: AWS::S3::BucketPolicy
    Properties:
      Bucket: !Ref ResourceStorageBucket
      PolicyDocument:
        Statement:
          - Action:
              - "s3:GetObject"
              - "s3:PutObject"
              - "s3:AbortMultipartUpload"
              - "s3:ListMultipartUploadParts"
              - "s3:ListBucketMultipartUploads"
            Effect: "Allow"
            Resource:
              - !Sub 'arn:aws:s3:::${ResourceStorageBucket}'
              - !Sub 'arn:aws:s3:::${ResourceStorageBucket}/*'
            Principal:
              Service:
                - lambda.amazonaws.com

  NvaAthenaQueriesBucket:
    Type: AWS::S3::Bucket
    DeletionPolicy: Retain
    Properties:
      BucketName: !Sub 'nva-athena-queries-${AWS::AccountId}'
      AccessControl: Private
      VersioningConfiguration:
        Status: Suspended

  BackendDomainName:
    Type: AWS::ApiGateway::DomainName
    Properties:
      CertificateArn: !Ref BackendDomainCertificateArn
      DomainName: !Sub 'api.${CustomDomain}'
      EndpointConfiguration:
        Types:
          - !Ref ApiGatewayEndpointType

  CristinImportNviQueue:
    Type: AWS::SQS::Queue

  VPC:
    Type: AWS::EC2::VPC
    Properties:
      CidrBlock: !Ref VpcCIDR
      EnableDnsSupport: true
      EnableDnsHostnames: true
      Tags:
        - Key: Name
          Value: !Sub nva-${EnvironmentName}-static-ip-vpc
  InternetGateway:
    Type: AWS::EC2::InternetGateway
    Properties:
      Tags:
        - Key: Name
          Value: !Sub nva-${EnvironmentName}-static-ip-igw
  InternetGatewayAttachment:
    Type: AWS::EC2::VPCGatewayAttachment
    Properties:
      InternetGatewayId: !Ref InternetGateway
      VpcId: !Ref VPC
  PublicSubnet:
    Type: AWS::EC2::Subnet
    Properties:
      VpcId: !Ref VPC
      CidrBlock: !Ref PublicSubnetCIDR
      MapPublicIpOnLaunch: true
      Tags:
        - Key: Name
          Value: !Sub nva-${EnvironmentName}-static-ip-public-subnet
  PrivateSubnet:
    Type: AWS::EC2::Subnet
    Properties:
      VpcId: !Ref VPC
      CidrBlock: !Ref PrivateSubnetCIDR
      MapPublicIpOnLaunch: false
      Tags:
        - Key: Name
          Value: !Sub nva-${EnvironmentName}-static-ip-private-subnet

  NatGatewayEIP:
    Type: AWS::EC2::EIP
    DependsOn: InternetGatewayAttachment
    Properties:
      Domain: vpc
  NatGateway:
    Type: AWS::EC2::NatGateway
    Properties:
      AllocationId: !GetAtt NatGatewayEIP.AllocationId
      SubnetId: !Ref PublicSubnet
  PublicRouteTable:
    Type: AWS::EC2::RouteTable
    Properties:
      VpcId: !Ref VPC
      Tags:
        - Key: Name
          Value: !Sub nva-${EnvironmentName}-static-ip-public-routes
  DefaultPublicRoute:
    Type: AWS::EC2::Route
    DependsOn: InternetGatewayAttachment
    Properties:
      RouteTableId: !Ref PublicRouteTable
      DestinationCidrBlock: 0.0.0.0/0
      GatewayId: !Ref InternetGateway
  PublicSubnetRouteTableAssociation:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      RouteTableId: !Ref PublicRouteTable
      SubnetId: !Ref PublicSubnet
  PrivateRouteTable:
    Type: AWS::EC2::RouteTable
    Properties:
      VpcId: !Ref VPC
      Tags:
        - Key: Name
          Value: !Sub nva-${EnvironmentName}-static-ip-private-routes
  DefaultPrivateRoute:
    Type: AWS::EC2::Route
    Properties:
      RouteTableId: !Ref PrivateRouteTable
      DestinationCidrBlock: 0.0.0.0/0
      NatGatewayId: !Ref NatGateway
  PrivateSubnetRouteTableAssociation:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      RouteTableId: !Ref PrivateRouteTable
      SubnetId: !Ref PrivateSubnet
  StaticIpSecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupName: !Sub nva-${EnvironmentName}-static-ip-sg
      GroupDescription: "Security group with no ingress rule for static IP"
      VpcId: !Ref VPC

  #================================= Parameters ============================================================

  EventsBucketName:
    Type: AWS::SSM::Parameter
    Properties:
      DataType: text
      Description: Parameter containing the bucket name of EventsBucket so that other services can be aware of the name of the bucket.
      Name: /NVA/Events/EventsBucketName
      Type: String
      Value: !Ref EventsBucket

  EventsBucketArn:
    Type: AWS::SSM::Parameter
    Properties:
      DataType: text
      Description: Parameter containing the bucket ARN of EventsBucket so that other services can be aware of the name of the bucket.
      Name: /NVA/Events/EventsBucketArn
      Type: String
      Value: !GetAtt EventsBucket.Arn

  ResourcesStorageBucketName:
    Type: AWS::SSM::Parameter
    Properties:
      DataType: text
      Name: /NVA/PublicationData
      Description: The actual published data. E.g. Journal papers, Datasets etc.
      Type: String
      Value: !Ref ResourceStorageBucket

  ExpandedResourcesBucketName:
    Type: AWS::SSM::Parameter
    Properties:
      DataType: text
      Description: Parameter containing the bucket name of EventsBucket so that other services can be aware of the name of the bucket.
      Name: /NVA/Events/PersistedEntriesBucketName
      Type: String
      Value: !Ref ExpandedResourcesBucket

  ExpandedResourcesBucketArn:
    Type: AWS::SSM::Parameter
    Properties:
      DataType: text
      Description: Parameter containing the bucket ARN of EventsBucket so that other services can be aware of the name of the bucket.
      Name: /NVA/Events/PersistedEntriesBucketArn
      Type: String
      Value: !GetAtt ExpandedResourcesBucket.Arn

  LargeApiResponsesBucketName:
    Type: AWS::SSM::Parameter
    Properties:
      DataType: text
      Description: Parameter containing the bucket name of LargeApiResponses so that other services can be aware of the name of the bucket.
      Name: /NVA/LargeApiResponsesBucketName
      Type: String
      Value: !Ref LargeApiResponsesBucket

  LargeApiResponsesBucketArn:
    Type: AWS::SSM::Parameter
    Properties:
      DataType: text
      Description: Parameter containing the bucket ARN of LargeApiResponses so that other services can be aware of the name of the bucket.
      Name: /NVA/LargeApiResponsesBucketArn
      Type: String
      Value: !GetAtt LargeApiResponsesBucket.Arn

  AlmaApiUriParameter:
    Type: AWS::SSM::Parameter
    Properties:
      DataType: text
      Description: Parameter containing the ALMA API URI
      Name: AlmaApiUri
      Type: String
      Value: !Ref AlmaApiUri

  BackendDomainCertificateArnParameter:
    Type: AWS::SSM::Parameter
    Properties:
      DataType: text
      Description: ARN for the certificate covering the API host/domain/API Gateway Custom Domain
      Name: /NVA/BackendDomainCertificate
      Type: String
      Value: !Ref BackendDomainCertificateArn

  FrontendDomainCertificateArnParameter:
    Type: AWS::SSM::Parameter
    Properties:
      DataType: text
      Description: ARN for the certificate covering the API host/domain/API Gateway Custom Domain
      Name: /NVA/FrontendDomainCertificate
      Type: String
      Value: !Ref FrontendDomainCertificateArn

  LegacyCustomDomainParameter:
    Type: AWS::SSM::Parameter
    Properties:
      Description: Legacy Parameter Value for Custom Domain.
      Name: CustomDomain
      Type: String
      Value: !Ref CustomDomain

  DataCiteMdsEndpointParameter:
    Type: AWS::SSM::Parameter
    Properties:
      Description: URI to Datacite MDS endpoint
      Name: dataCiteMdsHost
      Type: String
      Value: !Ref DataCiteMdsEndpoint

  DataCiteRestEndpointParameter:
    Type: AWS::SSM::Parameter
    Properties:
      Description: URI to Datacite MDS endpoint
      Name: dataCiteRestHost
      Type: String
      Value: !Ref DataCiteRestEndpoint

  OrcidBaseUrlParameter:
    Type: AWS::SSM::Parameter
    Properties:
      Description: URL to OrcId service
      Name: OrcidBaseUrl
      Type: String
      Value: !Ref OrcidBaseUrl

  NvaAthenaQueriesBucketName:
    Type: AWS::SSM::Parameter
    Properties:
      DataType: text
      Description: Parameter containing the bucket name of NvaAthenaQueriesBucket so that other services can be aware of the name of the bucket.
      Name: /NVA/Athena/QueriesBucketName
      Type: String
      Value: !Ref NvaAthenaQueriesBucket

  SlackSnsArnParameter:
    Type: AWS::SSM::Parameter
    Properties:
      Description: |-
        Common Amazon Simple Notification Service topic ARN for posting service notifications from all the different NVA stacks. Referenced with \{\{resolve:ssm:/NVA/Monitoring/SlackSnsArn\}\} in other templates
      Name: /NVA/Monitoring/SlackSnsArn
      Type: String
      Value: !Ref SlackSNSTopic

  SlackSnsNameParameter:
    Type: AWS::SSM::Parameter
    Properties:
      Description: |-
        Common Amazon Simple Notification Service topic name for posting service notifications from all the different NVA stacks. Referenced with \{\{resolve:ssm:/NVA/Monitoring/SlackSnsName\}\} in other templates
      Name: /NVA/Monitoring/SlackSnsName
      Type: String
      Value: !GetAtt SlackSNSTopic.TopicName

  CristinImportNviQueueParameterArn:
    Type: AWS::SSM::Parameter
    Properties:
      Description: Amazon SQS Queue for cristin-import nvi entries
      Name: /NVA/Queues/CristinImportNviQueueArn
      Type: String
      Value: !GetAtt CristinImportNviQueue.Arn

  CristinImportNviQueueParameterUrl:
    Type: AWS::SSM::Parameter
    Properties:
      Description: Amazon SQS Queue for cristin-import nvi entries
      Name: /NVA/Queues/CristinImportNviQueueUrl
      Type: String
      Value: !GetAtt CristinImportNviQueue.QueueUrl

  VPCParam:
    Type: AWS::SSM::Parameter
    Properties:
      Description: VPC ID for workloads where we need a static IP
      Name: "/NVA/EIP/VPC/id"
      Type: String
      Value: !Ref VPC

  PrivateSubnetParam:
    Type: AWS::SSM::Parameter
    Properties:
      Description: Private Subnet ID for workloads where we need a static IP
      Name: "/NVA/EIP/PrivateSubnet/id"
      Type: String
      Value: !Ref PrivateSubnet

  NatGatewayEIPParam:
    Type: AWS::SSM::Parameter
    Properties:
      Description: Elastic IP for NAT Gateway for workloads where we need a static IP
      Name: "/NVA/EIP/PublicIp"
      Type: String
      Value: !GetAtt NatGatewayEIP.PublicIp

  StaticIpSecurityGroupParam:
    Type: AWS::SSM::Parameter
    Properties:
      Description: Security Group ID for workloads where we need a static IP
      Name: "/NVA/EIP/SecurityGroup/GroupId"
      Type: String
      Value: !GetAtt StaticIpSecurityGroup.GroupId


  #============================== ApplicationConfig ========================

  ApplicationConfig:
    Type: 'AWS::AppConfig::Application'
    Properties:
      Description: Application Configuration for whole NVA application
      Name: !Ref AppConfigName

  ApplicationConfigurationProfile:
    Type: 'AWS::AppConfig::ConfigurationProfile'
    Properties:
      ApplicationId: !Ref ApplicationConfig
      Description: Application Configuration Profile for ApplicationConfig
      Name: !Ref ApplicationConfigurationProfileName
      LocationUri: !Sub 'arn:${AWS::Partition}:ssm:${AWS::Region}:${AWS::AccountId}:parameter/ApplicationConfigurationParameter'
      RetrievalRoleArn: !GetAtt ApplicationConfigRole.Arn

  ApplicationEnvironment:
    Type: 'AWS::AppConfig::Environment'
    Properties:
      ApplicationId: !Ref ApplicationConfig
      Description: Environment for application configuration
      Name: !Ref ApplicationEnvironmentName

  ApplicationConfigurationVersion:
    Type: AWS::AppConfig::HostedConfigurationVersion
    Properties:
      ApplicationId: !Ref ApplicationConfig
      ConfigurationProfileId: !Ref ApplicationConfigurationProfile
      ContentType: application/json
      Content: '{}'

  ApplicationConfigRole:
    Type: 'AWS::IAM::Role'
    Properties:
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              Service: appconfig.amazonaws.com
            Action: sts:AssumeRole
      Policies:
        - PolicyName: ConfigurationProfileSSMPolicy
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Effect: Allow
                Action:
                  - ssm:GetParameter
                Resource: !Sub 'arn:${AWS::Partition}:ssm:${AWS::Region}:${AWS::AccountId}:parameter/ApplicationConfigurationParameter'

  ApplicationConfigId:
    Type: AWS::SSM::Parameter
    Properties:
      Name: /NVA/AppConfig/ApplicationConfigId
      Type: String
      Value: !Ref ApplicationConfig

  ApplicationConfigName:
    Type: AWS::SSM::Parameter
    Properties:
      Name: /NVA/AppConfig/ApplicationConfigName
      Type: String
      Value: !Ref AppConfigName

  ConfigurationProfileNameParameter:
    Type: AWS::SSM::Parameter
    Properties:
      Name: /NVA/AppConfig/ApplicationConfigProfileName
      Type: String
      Value: !Ref ApplicationConfigurationProfileName

  EnvironmentNameParameter:
    Type: AWS::SSM::Parameter
    Properties:
      Name: /NVA/AppConfig/ApplicationEnvironmentName
      Type: String
      Value: !Ref ApplicationEnvironmentName


  #============================== Backup plan ==============================

  NvaBackupPlan:
    Type: AWS::Backup::BackupPlan
    Properties:
      BackupPlan:
        BackupPlanName: NvaBackupPlan
        BackupPlanRule:
          - RuleName: HourlyBackupRule
            TargetBackupVault: !Ref NvaBackupVault
            ScheduleExpression: 'cron(0 */2 * * ? *)' # Every other hour
            StartWindowMinutes: 60
            CompletionWindowMinutes: 120
            EnableContinuousBackup: true
            Lifecycle:
              DeleteAfterDays: !Ref DaysToRetainHourlyBackup
            RecoveryPointTags:
              BackupType: Hourly
            CopyActions:
              - DestinationBackupVaultArn: !Ref SharedBackupVaultArn
                Lifecycle:
                  DeleteAfterDays: !Ref DaysToRetainHourlyBackup

          - RuleName: DailyBackupRule
            TargetBackupVault: !Ref NvaBackupVault
            ScheduleExpression: 'cron(0 22 * * ? *)' # Every day at 22:00
            StartWindowMinutes: 60
            CompletionWindowMinutes: 120
            EnableContinuousBackup: true
            Lifecycle:
              DeleteAfterDays: !Ref DaysToRetainDailyBackup
            RecoveryPointTags:
              BackupType: Daily
            CopyActions:
              - DestinationBackupVaultArn: !Ref SharedBackupVaultArn
                Lifecycle:
                  DeleteAfterDays: !Ref DaysToRetainDailyBackup

          - RuleName: WeeklyBackupRule
            TargetBackupVault: !Ref NvaBackupVault
            ScheduleExpression: 'cron(0 12 ? * 1 *)' # Every Sunday at 12:00
            StartWindowMinutes: 60
            CompletionWindowMinutes: 120
            EnableContinuousBackup: false # PITR limits retention to 35 days
            Lifecycle:
              DeleteAfterDays: !Ref DaysToRetainWeeklyBackup
            RecoveryPointTags:
              BackupType: Weekly
            CopyActions:
              - DestinationBackupVaultArn: !Ref SharedBackupVaultArn
                Lifecycle:
                  DeleteAfterDays: !Ref DaysToRetainWeeklyBackup

          - RuleName: QuarterlyBackupRule
            TargetBackupVault: !Ref NvaBackupVault
            ScheduleExpression: 'cron(0 0 1 1,4,7,10 ? *)' # At start of every quarter
            StartWindowMinutes: 60
            CompletionWindowMinutes: 120
            EnableContinuousBackup: false # PITR limits retention to 35 days
            Lifecycle:
              DeleteAfterDays: !Ref DaysToRetainQuarterlyBackup
            RecoveryPointTags:
              BackupType: Quarterly
            CopyActions:
              - DestinationBackupVaultArn: !Ref SharedBackupVaultArn
                Lifecycle:
                  DeleteAfterDays: !Ref DaysToRetainQuarterlyBackup

  NvaBackupVault:
    Type: AWS::Backup::BackupVault
    Properties:
      BackupVaultName: NvaBackupVault
      AccessPolicy:
        Version: "2012-10-17"
        Statement:
          # Allow the cross-account vault to copy snapshots into this vault,
          # necessary for cross-region restores.
          - Sid: AllowCopyFromSharedVault
            Effect: Allow
            Principal:
              AWS: !Ref SharedBackupAccountId
            Action:
              - backup:CopyIntoBackupVault
            Resource: '*'

  NvaBackupSelection:
    Type: AWS::Backup::BackupSelection
    Condition: CreateBackups
    Properties:
      BackupPlanId: !Ref NvaBackupPlan
      BackupSelection:
        SelectionName: NvaBackupSelection
        IamRoleArn: !GetAtt BackupRole.Arn
        Conditions:
          StringEquals:
            - ConditionKey: 'aws:ResourceTag/IncludedInBackup'
              ConditionValue: 'true'
        Resources:
          - arn:aws:dynamodb:*:*:table/*
          - arn:aws:s3:::*

  BackupRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: BackupServiceRole
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              Service: backup.amazonaws.com
            Action: sts:AssumeRole
      ManagedPolicyArns:
        - !Sub "arn:${AWS::Partition}:iam::aws:policy/service-role/AWSBackupServiceRolePolicyForBackup"
        - !Sub "arn:${AWS::Partition}:iam::aws:policy/AWSBackupServiceRolePolicyForS3Backup"

  LambdaVersionCleanupFunctionAccessLogGroup:
    Type: AWS::Logs::LogGroup
    Properties:
      LogGroupName: !Sub '/aws/lambda/${LambdaVersionCleanupFunction}'
      RetentionInDays: 90

  LambdaVersionCleanupFunction:
    Type: AWS::Serverless::Function
    Properties:
      Description: 'Lambda function to delete old version of all lambda functions'
      Handler: delete_old_lambda_versions.lambda_handler
      Runtime: python3.11
      Timeout: 900
      MemorySize: 128
      Role: !GetAtt LambdaVersionCleanupRole.Arn
      CodeUri: .
      Events:
          ScheduledEvent:
            Type: Schedule
            Properties:
              Description: 'Schedule to trigger deletion of old versions of lambda functions'
              Schedule: rate(7 days)
              Name: CleanupLambdaVersionSchedule

  LambdaVersionCleanupRole:
    Type: AWS::IAM::Role
    Properties:
      Description: 'IAM role for the lamda that deletes old versions of all lambda functions'
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Principal:
              Service: lambda.amazonaws.com
            Action: sts:AssumeRole
      Policies:
        - PolicyName: LambdaVersionCleanupPolicy
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Effect: Allow
                Action:
                  - logs:CreateLogGroup
                  - logs:CreateLogStream
                  - logs:PutLogEvents
                  - lambda:ListAliases
                  - lambda:ListFunctions
                  - lambda:ListVersionsByFunction
                  - lambda:DeleteFunction
                Resource: "*"

Outputs:
  LambdaVersionCleanupFunction:
    Description: "ARN of the version cleanup Lambda function"
    Value: !GetAtt LambdaVersionCleanupFunction.Arn