sam.yaml

Transform: AWS::Serverless-2016-10-31
Description: Concierge

Parameters:
  BucketName:
    Type: String

  RekognitionCollectionID:
    Type: String

  TeamsWebhook:
    Type: String

  DeviceName:
    Type: String

  IoTEndpoint:
    Type: String

  IoTTopic:
    Type: String
    
  IsDeeplensUpsideDown:
    Type: String

  OpenDelaySeconds:
    Type: String

  RelayUsbDevice: 
    Type: String

  AlexaApplicationID:
    Type: String

Resources:
  bucket:
    Type: AWS::S3::Bucket
    Properties:
      BucketName: !Ref BucketName

  conciergeApi:
    Type: AWS::Serverless::Api
    Properties:
      Name: concierge-api
      StageName: api
      DefinitionBody:
        swagger: 2.0
        info:
          title: !Ref AWS::StackName
        paths:
          /faces/train:
            post:
              x-amazon-apigateway-integration:
                httpMethod: POST
                type: aws_proxy
                uri:
                  !Sub arn:aws:apigateway:${AWS::Region}:lambda:path/2015-03-31/functions/${train.Arn}/invocations
              responses: {}
            options:
              consumes:
                - application/json
              produces:
                - application/json
              responses:
                '200':
                  description: 200 response
                  schema:
                    $ref: '#/definitions/Empty'
                  headers:
                    Access-Control-Allow-Origin:
                      type: string
                    Access-Control-Allow-Methods:
                      type: string
                    Access-Control-Allow-Headers:
                      type: string
              x-amazon-apigateway-integration:
                responses:
                  default:
                    statusCode: 200
                    responseParameters:
                      method.response.header.Access-Control-Allow-Methods: "'GET,PUT,DELETE,HEAD,OPTIONS'"
                      method.response.header.Access-Control-Allow-Headers: "'Content-Type,Authorization,X-Amz-Date,X-Api-Key,X-Amz-Security-Token'"
                      method.response.header.Access-Control-Allow-Origin: "'*'"
                passthroughBehavior: when_no_match
                requestTemplates:
                  application/json: "{\"statusCode\": 200}"
                type: mock

# IAM roles
  trainRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          -
            Effect: Allow
            Principal:
              Service:
                - "lambda.amazonaws.com"
            Action:
              - "sts:AssumeRole"
      Path: "/"
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole
      Policies:
        - PolicyName: "s3_rekognition"
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              -
                Effect: "Allow"
                Action:
                  - "s3:PutObject"
                  - "s3:PutObjectAcl"
                  - "s3:GetObject"
                  - "s3:DeleteObject"
                Resource: !Sub arn:aws:s3:::${BucketName}/*
              -
                Effect: "Allow"
                Action:
                  - "rekognition:DetectFaces"
                  - "rekognition:SearchFacesByImage"
                  - "rekognition:IndexFaces"
                Resource: !Sub arn:aws:rekognition:${AWS::Region}:${AWS::AccountId}:collection/${RekognitionCollectionID}

  guessRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          -
            Effect: Allow
            Principal:
              Service:
                - "lambda.amazonaws.com"
            Action:
              - "sts:AssumeRole"
      Path: "/"
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole
        - arn:aws:iam::aws:policy/AWSIoTDataAccess
      Policies:
        - PolicyName: "s3_rekognition_iot"
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              -
                Effect: "Allow"
                Action:
                  - "s3:PutObject"
                  - "s3:PutObjectAcl"
                  - "s3:GetObject"
                  - "s3:DeleteObject"
                Resource: !Sub arn:aws:s3:::${BucketName}/*
              -
                Effect: "Allow"
                Action:
                  - "rekognition:DetectFaces"
                  - "rekognition:SearchFacesByImage"
                  - "rekognition:IndexFaces"
                Resource: !Sub arn:aws:rekognition:${AWS::Region}:${AWS::AccountId}:collection/${RekognitionCollectionID}
              -
                Effect: "Allow"
                Action:
                  - "iot:DescribeEndpoint"
                Resource: "*"

  unknownRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          -
            Effect: Allow
            Principal:
              Service:
                - "lambda.amazonaws.com"
            Action:
              - "sts:AssumeRole"
      Path: "/"
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole
      Policies:
        - PolicyName: "s3"
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              -
                Effect: "Allow"
                Action:
                  - "s3:PutObject"
                  - "s3:PutObjectAcl"
                  - "s3:GetObject"
                  - "s3:DeleteObject"
                Resource: !Sub arn:aws:s3:::${BucketName}/*

  greengrassRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          -
            Effect: Allow
            Principal:
              Service:
                - "lambda.amazonaws.com"
            Action:
              - "sts:AssumeRole"

      Path: "/"
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole
        - arn:aws:iam::aws:policy/AWSIoTDataAccess
      Policies:
        - PolicyName: "s3"
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              -
                Effect: "Allow"
                Action:
                  - "s3:PutObject"
                  - "s3:PutObjectAcl"
                Resource:
                  - !Sub arn:aws:s3:::${BucketName}
                  - !Sub arn:aws:s3:::${BucketName}/*
              -
                Effect: "Allow"
                Action:
                  - "iot:DescribeEndpoint"
                Resource: "*"

# lambda functions

  alexaOpenDoor:
    Type: AWS::Serverless::Function
    Properties:
      FunctionName: concierge-alexa-open-door
      Description: "concierge - alexa skill to open door"
      Handler: main
      Role: !GetAtt greengrassRole.Arn
      Runtime: go1.x
      MemorySize: 512
      Timeout: 10
      CodeUri: ./source/alexa-skill-concierge-open-door/deployment.zip
      Events:
        Alexa:
         Type: AlexaSkill
      Environment:
        Variables:
          ALEXA_APPLICATION_ID: !Ref AlexaApplicationID
          IOT_TOPIC: !Ref IoTTopic

  train:
    Type: AWS::Serverless::Function
    Properties:
      FunctionName: concierge-train
      Description: "concierge - train function"
      Handler: main
      Role: !GetAtt trainRole.Arn
      Runtime: go1.x
      MemorySize: 1024
      Timeout: 10
      CodeUri: ./source/train/deployment.zip
      Environment:
        Variables:
          BUCKET_NAME: !Ref BucketName
          REKOGNITION_COLLECTION_ID: !Ref RekognitionCollectionID
      Events:
        Api:
          Type: Api
          Properties:
            RestApiId: !Ref conciergeApi
            Path: /faces/train
            Method: post

  guess:
    Type: AWS::Serverless::Function
    Properties:
      FunctionName: concierge-guess
      Description: "concierge - guess function"
      Handler: main
      Role: !GetAtt guessRole.Arn
      Runtime: go1.x
      MemorySize: 1024
      Timeout: 16
      CodeUri: ./source/guess/deployment.zip
      Environment:
        Variables:
          BUCKET_NAME: !Ref BucketName
          REKOGNITION_COLLECTION_ID: !Ref RekognitionCollectionID
          IOT_TOPIC: !Ref IoTTopic
          TEAMS_WEBHOOK: !Ref TeamsWebhook
      Events:
        imageEvent:
          Type: S3
          Properties:
            Bucket: !Ref bucket
            Events: s3:ObjectCreated:*
            Filter:
              S3Key:
                Rules:
                  - Name: prefix
                    Value: incoming/

  unknown:
    Type: AWS::Serverless::Function
    Properties:
      FunctionName: concierge-unknown
      Description: "concierge - unknown function"
      Handler: main
      Role: !GetAtt unknownRole.Arn
      Runtime: go1.x
      MemorySize: 1024
      Timeout: 10
      CodeUri: ./source/unknown/deployment.zip
      Environment:
        Variables:
          BUCKET_NAME: !Ref BucketName
          TEAMS_WEBHOOK: !Ref TeamsWebhook
          TRAIN_URL: !Sub https://${conciergeApi}.execute-api.${AWS::Region}.amazonaws.com/api/faces/train
      Events:
        imageEvent:
          Type: S3
          Properties:
            Bucket: !Ref bucket
            Events: s3:ObjectCreated:*
            Filter:
              S3Key:
                Rules:
                  - Name: prefix
                    Value: unknown/
                  - Name: suffix
                    Value: jpg

# greengrass
  findPerson:
    Type: AWS::Serverless::Function
    Properties:
      FunctionName: concierge-find-person
      Description: "concierge - find person function (greengrass)"
      Handler: find_person.function_handler
      Role: !GetAtt greengrassRole.Arn
      Runtime: python2.7
      MemorySize: 2048
      Timeout: 10
      CodeUri: ./source/find-person/dist/deployment.zip
      AutoPublishAlias: prod
      Environment:
        Variables:
          BUCKET_NAME: !Ref BucketName
          IS_DEEPLENS_UPSIDE_DOWN: !Ref IsDeeplensUpsideDown

  triggerOpen:
    Type: AWS::Serverless::Function
    Properties:
      FunctionName: concierge-trigger-open
      Description: "concierge - trigger open function (greengrass)"
      Handler: trigger_open.function_handler
      Role: !GetAtt greengrassRole.Arn
      Runtime: python2.7
      MemorySize: 1024
      Timeout: 10
      CodeUri: ./source/trigger-open/dist/deployment.zip
      AutoPublishAlias: prod
      Environment:
        Variables:
          DEVICE_NAME: !Ref DeviceName
          IOT_ENDPOINT: !Ref IoTEndpoint
          IOT_TOPIC: !Ref IoTTopic
          DeepLensDeviceReadAndWrite: !Ref RelayUsbDevice 
          USB_RELAY: !Ref RelayUsbDevice 
          OPEN_DELAY_SECONDS: !Ref OpenDelaySeconds

Outputs:
  apiurl:
    Description: API url
    Value: !Sub https://${conciergeApi}.execute-api.${AWS::Region}.amazonaws.com/api