template-Aurora-Serverless-with-and-without-Data-API-RDS-Proxy.yaml

AWSTemplateFormatVersion: '2010-09-09'
Transform: AWS::Serverless-2016-10-31
Description: >
  DevOpsGuruDemoProductsAPi
  Sample SAM Template for DevOpsGuruDemoProductsAPi

Parameters:
  DBClusterName:
    Description: "Aurora Serverless V2 RDS cluster name"
    Type: String
    Default: AuroraServerlessV2DataApiCluster
  DatabaseName:
    Description: "Aurora Serverless V2 RDS database name"
    Type: String
    Default: AuroraServerlessV2DataApiClusterDB
  DatabaseStackName:
    Description: "Name of the Aurora Serverlss V2 CloudFormation stack to import parameters from"
    Type: String
    Default: AuroraServerlessV2
  DBMasterUserName:
    Type: String
    Default: postgres
  UserSecret:
    Type: String
    Default: AuroraServerlessV2UserSecret
  Stage:
    Type: String
    Default: prod
  KinesisStreamName:
    Type: String
    Default: orderedProductDataStream
    Description: name for the Kinesis Data Stream.
  VpcId:
    Type: String
    Default: vpc-950cd6fd
    Description: VpcId of your existing Virtual Private Cloud (VPC)
  Subnets:
    Type: CommaDelimitedList  
    Default: subnet-0787be4d, subnet-88dc46e0
    Description: The list of SubnetIds, for at least two Availability Zones in the
      region in your Virtual Private Cloud (VPC)
          
Globals:
  Function:
    CodeUri: target/amazon-devops-guru-workshop-source-code-1.0.0-SNAPSHOT.jar
    Runtime: java21
    Timeout: 30 
    MemorySize: 512
    Environment:
      Variables:
        JAVA_TOOL_OPTIONS: "-XX:+TieredCompilation -XX:TieredStopAtLevel=1"
        PRODUCT_TABLE_NAME: !Ref ProductsTable
        INVOCATION_QUEUE_URL: !Ref SimpleQueue
        INVOCATION_TOPIC_URL: !Ref TargetTopic
        #STATE_MACHINE_ARN: !Ref CreatedProductEmailNotificationSM
        #DB_ENDPOINT: !GetAtt MyDB.Endpoint.Address
        DB_ENDPOINT: !GetAtt AuroraServerlessV2Cluster.Endpoint.Address
        RDS_PROXY_ENDPOINT: !GetAtt RDSProxy.Endpoint
        DB_NAME: !Ref DatabaseName
        DB_CLUSTER_ARN: !Sub arn:aws:rds:${AWS::Region}:${AWS::AccountId}:cluster:${DBClusterName}
        DB_CRED_SECRETS_STORE_ARN: !Ref  DBSecret
        DB_USER_PASSWORD: !Join ['', ['{{resolve:secretsmanager:', !Ref DBSecret, ':SecretString:password}}' ]]
        DB_USER_NAME: !Join ['', ['{{resolve:secretsmanager:', !Ref DBSecret, ':SecretString:username}}' ]] 

Resources:

  MyApi:
    Type: AWS::Serverless::Api
    Properties:
      StageName: !Ref Stage
      Name: DevOpsGuruDemoProductsAPI
      Description: Api for DevOpsGuruDemoProductsAPI
      Auth:
        ApiKeyRequired: true  # sets for all methods

  MyApiUsagePlan:
     Type: AWS::ApiGateway::UsagePlan
     DependsOn:  
        - MyApiStage
     Properties:
      ApiStages: 
        - ApiId: !Ref MyApi
          Stage: !Ref Stage
      UsagePlanName: DevOpsGuruDemoProductsAPIUsagePlan
      Description: Usage plan for DevOpsGuruDemoProductsAPI
      Quota:
          Limit: 2000000
          Period: DAY
      Throttle:
          RateLimit:  50000
          BurstLimit: 50000   

  MyApiKey: 
    Type: AWS::ApiGateway::ApiKey
    DependsOn:  
       - MyApiStage
    Properties: 
      Name: "DevOpsGuruDemoProductsApiKey"
      Description: "DevOpsGuruDemoProducts API Key"
      Enabled: true
      GenerateDistinctId: false
      Value: a6ZbcDefQW12BN56WEN7
      StageKeys:
        - RestApiId: !Ref MyApi
          StageName: !Ref Stage

  MyApiUsagePlanKey:
      Type: "AWS::ApiGateway::UsagePlanKey"
      DependsOn: 
      - MyApi
      Properties:
        KeyId: !Ref MyApiKey
        KeyType: API_KEY
        UsagePlanId: !Ref MyApiUsagePlan


  GetProductByIdFunction:
    Type: AWS::Serverless::Function
    Properties:
      FunctionName: GetProductById
      Handler: software.amazonaws.example.product.handler.GetProductByIdHandler::handleRequest
      Policies:
        - DynamoDBReadPolicy:
            TableName: !Ref ProductsTable
      Events:
        GetRequestById:
          Type: Api
          Properties:
            RestApiId: !Ref MyApi
            Path: /products/{id}
            Method: get

  GetProductByIdFunctionLogGroup:
    Type: AWS::Logs::LogGroup
    Properties:
      LogGroupName: !Sub "/aws/lambda/${GetProductByIdFunction}"
      RetentionInDays: 7


  GetProductByIdRDSFunction:
    Type: AWS::Serverless::Function
    Properties:
      FunctionName: GetProductByIdRDS
      Handler: software.amazonaws.example.product.handler.GetProductByIdRDSHandler::handleRequest
      Environment:
        Variables:
          JAVA_TOOL_OPTIONS: "-XX:+TieredCompilation -XX:TieredStopAtLevel=1"
          #DB_ENDPOINT: !GetAtt MyDB.Endpoint.Address
      
      #Policies:
       # - VPCAccessPolicy: {}
      #VpcConfig:
       # SecurityGroupIds:
        #  - Fn::GetAtt: LambdaSecurityGroup.GroupId
        #SubnetIds: !Ref  Subnets
      Events:
        GetRequestById:
          Type: Api
          Properties:
            RestApiId: !Ref MyApi
            Path: /productsFromRDS/{id}
            Method: get

  GetProductByIdRDSFunctionLogGroup:
    Type: AWS::Logs::LogGroup
    Properties:
      LogGroupName: !Sub "/aws/lambda/${GetProductByIdRDSFunction}"
      RetentionInDays: 7


  GetProductsFunction:
    Type: AWS::Serverless::Function
    Properties:
      FunctionName: GetProducts
      Handler: software.amazonaws.example.product.handler.GetAllProductsHandler::handleRequest
      Policies:
        - DynamoDBReadPolicy:
            TableName: !Ref ProductsTable
      Events:
        GetRequest:
          Type: Api
          Properties:
            RestApiId: !Ref MyApi
            Path: /products
            Method: get

  GetProductsFunctionLogGroup:
    Type: AWS::Logs::LogGroup
    Properties:
      LogGroupName: !Sub "/aws/lambda/${GetProductsFunction}"
      RetentionInDays: 7


  CreateProductsDataApiFunction:
    Type: AWS::Serverless::Function
    Properties:
      FunctionName: CreateProductsViaAuroraServerlessV2DataApi
      AutoPublishAlias: liveVersion
      Handler: software.amazonaws.example.product.handler.CreateProductsViaAuroraServerlessV2DataApiHandler::handleRequest
      Policies:
        - Version: '2012-10-17' # Policy Document
          Statement:
            - Effect: Allow
              Action:
                - rds-data:*
              Resource:
                 !Sub arn:aws:rds:${AWS::Region}:${AWS::AccountId}:cluster:${DBClusterName}
            - Effect: Allow
              Action:
                - secretsmanager:GetSecretValue
              Resource:
                !Ref DBSecret
                
      Events:
        PutProducts:
          Type: Api
          Properties:
            RestApiId: !Ref MyApi
            Path: /productsWithDataApi
            Method: put     

            
            
  CreateProductsDataApiFunctionLogGroup:
    Type: AWS::Logs::LogGroup
    Properties:
      LogGroupName: !Sub "/aws/lambda/${CreateProductsDataApiFunction}"
      RetentionInDays: 7

  GetProductByIdDataApiFunction:
    Type: AWS::Serverless::Function
    Properties:
      FunctionName: GetProductByIdViaAuroraServerlessV2DataApi
      AutoPublishAlias: liveVersion
      Timeout: 15
      Handler: software.amazonaws.example.product.handler.GetProductByIdViaAuroraServerlessV2DataApiHandler::handleRequest
      Policies:
        - Version: '2012-10-17' # Policy Document
          Statement:
            - Effect: Allow
              Action:
                - rds-data:*
              Resource:
                 !Sub arn:aws:rds:${AWS::Region}:${AWS::AccountId}:cluster:${DBClusterName}
            - Effect: Allow
              Action:
                - secretsmanager:GetSecretValue
              Resource:
                !Ref DBSecret
                
      Events:
        GetRequestById:
          Type: Api
          Properties:
            RestApiId: !Ref MyApi
            Path: /productsWithDataApi/{id}
            Method: get     

            
            
  GetProductByIdDataApiFunctionLogGroup:
    Type: AWS::Logs::LogGroup
    Properties:
      LogGroupName: !Sub "/aws/lambda/${GetProductByIdDataApiFunction}"
      RetentionInDays: 7



  PutProductFunction:
    Type: AWS::Serverless::Function
    Properties:
      FunctionName: PutProduct
      Handler: software.amazonaws.example.product.handler.CreateProductHandler::handleRequest
      Environment:
         Variables:
           JAVA_TOOL_OPTIONS: "-XX:+TieredCompilation -XX:TieredStopAtLevel=1"
           PRODUCT_TABLE_NAME: !Ref ProductsTable
           INVOCATION_QUEUE_URL: !Ref SimpleQueue
           INVOCATION_TOPIC_URL: !Ref TargetTopic
           STATE_MACHINE_ARN: !Ref CreatedProductEmailNotificationSM   
      Policies:
        - DynamoDBCrudPolicy:
            TableName: !Ref ProductsTable
        - SQSSendMessagePolicy:
            QueueName: !GetAtt SimpleQueue.QueueName   
        - StepFunctionsExecutionPolicy:
            StateMachineName: !GetAtt CreatedProductEmailNotificationSM.Name 
        #- KinesisCrudPolicy:
         #   StreamName: !Ref KinesisStreamName
        - SNSPublishMessagePolicy:
            TopicName: !GetAtt TargetTopic.TopicName 
             
      Events:
        PutRequest:
          Type: Api
          Properties:
            RestApiId: !Ref MyApi
            Path: /products
            Method: put

  PutProductFunctionLogGroup:
    Type: AWS::Logs::LogGroup
    Properties:
      LogGroupName: !Sub "/aws/lambda/${PutProductFunction}"
      RetentionInDays: 7

  DeleteProductFunction:
    Type: AWS::Serverless::Function
    Properties:
      FunctionName: DeleteProduct
      Handler: software.amazonaws.example.product.handler.DeleteProductByIdHandler::handleRequest
      MemorySize: 512
      Policies:
        - DynamoDBCrudPolicy:
            TableName: !Ref ProductsTable
      Events:
        PutRequest:
          Type: Api
          Properties:
            RestApiId: !Ref MyApi  
            Path: /products/{id}
            Method: delete

  DeleteProductFunctionLogGroup:
    Type: AWS::Logs::LogGroup
    Properties:
      LogGroupName: !Sub "/aws/lambda/${DeleteProductFunction}"
      RetentionInDays: 7


  SimpleQueue:
      Type: AWS::SQS::Queue
      Properties:
         QueueName: "new-product-created"
        
         
  TargetTopic:
      Type: AWS::SNS::Topic
      Properties:
         TopicName: devops-guru-workshop-target-topic
         Subscription:
           - Endpoint: !GetAtt SimpleQueue.Arn
             Protocol: sqs
             
  # Policy allows SNS to publish to this SQS queue
  SnsToSqsPolicy:
    Type: AWS::SQS::QueuePolicy
    Properties:
      PolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Sid: "Allow SNS publish to SQS"
            Effect: Allow
            Principal: 
              Service: "sns.amazonaws.com"
            Resource: !GetAtt SimpleQueue.Arn
            Action: SQS:SendMessage
            Condition:
              ArnEquals:
                aws:SourceArn: !Ref TargetTopic
      Queues:
        - Ref: SimpleQueue


         
  ProductCreatedEventFunction:
    Type: AWS::Serverless::Function
    Properties:
      FunctionName: CreatedProduct
      Handler:  software.amazonaws.example.sqs.CreatedProductFunction::handleRequest 
      Timeout: 20  
      Events:
         SQSQueueEvent:
          Type: SQS
          Properties:
            Queue: !GetAtt SimpleQueue.Arn

  
  CreatedProductFunctionLogGroup:
    Type: AWS::Logs::LogGroup
    Properties:
      LogGroupName: !Sub "/aws/lambda/${ProductCreatedEventFunction}"
      RetentionInDays: 7

  CreatedProductSNSNotificationFunction:
    Type: AWS::Serverless::Function
    Properties:
      FunctionName: CreatedProductNotification
      Handler:  software.amazonaws.example.sns.CreatedProductNotificationFunction::handleRequest  
      Events:
         SNSEvent:
           Type: SNS 
           Properties:
             Topic: !Ref TargetTopic            
  
  CreatedProductSNSNotificationFunctionLogGroup:
    Type: AWS::Logs::LogGroup
    Properties:
      LogGroupName: !Sub "/aws/lambda/${CreatedProductSNSNotificationFunction}"
      RetentionInDays: 7
      

  CreatedProductSFnEmailNotificationFunction:
    Type: AWS::Serverless::Function
    Properties:
      FunctionName: CreatedProductSFnEmailNotification
      Handler:  software.amazonaws.example.stepfunction.CreatedProductSFnEmailNotificationFunction::handleRequest  
             
  
  CreatedProductSFnEmailNotificationFunctionLogGroup:
    Type: AWS::Logs::LogGroup
    Properties:
      LogGroupName: !Sub "/aws/lambda/${CreatedProductSFnEmailNotificationFunction}"
      RetentionInDays: 7

  CreatedProductEmailNotificationSM:
    Type: AWS::Serverless::StateMachine
    Properties:
      Definition:
        StartAt: CreatedProductTask
        States:
          CreatedProductTask:
            Type: Task
            Resource: !GetAtt CreatedProductSFnEmailNotificationFunction.Arn
            "Retry": [
              { 
                "ErrorEquals": [States.ALL],
                "IntervalSeconds": 10,
                "MaxAttempts": 30,
                "BackoffRate": 1
              }
            ]
            End: true
      Policies: 
        - LambdaInvokePolicy:
            FunctionName:
              !Ref CreatedProductSFnEmailNotificationFunction


          
  # Define an AWS Kinesis Data Stream
  #KinesisStream:
   # Type: AWS::Kinesis::Stream
    #Properties:
     # Name: !Ref KinesisStreamName
      #ShardCount: 1
      #StreamModeDetails: 
       #   StreamMode: ON_DEMAND

  # Define a Lambda function as an application consumer  
  #OrderedProductFunction:
   # Type: AWS::Serverless::Function  
    #Properties:
     # FunctionName: OrderedProduct
      #Handler:  software.amazonaws.example.kinesis.OrderedProductFunction::handleRequest 
      #Timeout: 20  
      #Policies: 
      #- KinesisStreamReadPolicy:
       #   StreamName: !Ref KinesisStreamName      
      #Events:
       # Stream:
        #  Type: Kinesis 
         # Properties:
          #  Stream: !GetAtt KinesisStream.Arn
           # StartingPosition: LATEST
           # BatchSize: 50
           # MaximumRetryAttempts: 100
            
  #OrderedProductFunctionLogGroup:
   # Type: AWS::Logs::LogGroup
    #Properties:
     # LogGroupName: !Sub "/aws/lambda/${OrderedProductFunction}"
      #RetentionInDays: 7
      
      
  # Define a Lambda function as an application consumer
  UpdatedProductFunction:
    Type: AWS::Serverless::Function
    Properties:
      FunctionName: UpdatedProduct
      Handler:  software.amazonaws.example.dynamodb.streams.UpdatedProductFunction::handleRequest 
      Timeout: 20  
      Events:
        DynamoStream:
          Type: DynamoDB 
          Properties:
            Stream: !GetAtt ProductsTable.StreamArn
            StartingPosition: LATEST
            BatchSize: 50
            MaximumRetryAttempts: 100
            MaximumRecordAgeInSeconds: 3600
            
  UpdatedProductFunctionLogGroup:
    Type: AWS::Logs::LogGroup
    Properties:
      LogGroupName: !Sub "/aws/lambda/${UpdatedProductFunction}"
      RetentionInDays: 7

  GetProductByIdWithoutDataApiFunction:
    Type: AWS::Serverless::Function
    Properties:
      FunctionName: GetProductByIdViaAuroraServerlessV2WithoutDataApi
      Timeout: 15 
      Handler: software.amazonaws.example.product.handler.GetProductByIdViaAuroraServerlessV2WithoutDataApiHandler::handleRequest   
      Environment:
        Variables:
          JAVA_TOOL_OPTIONS: "-XX:+TieredCompilation -XX:TieredStopAtLevel=1"
          #DB_ENDPOINT: !GetAtt MyDB.Endpoint.Address
      
      Policies:
        - VPCAccessPolicy: {}
      VpcConfig:
        SecurityGroupIds:
          - Fn::GetAtt: LambdaSecurityGroup.GroupId
        SubnetIds: !Ref  Subnets
      Events:
        GetRequestById:
          Type: Api
          Properties:
            RestApiId: !Ref MyApi
            Path: /productsWithoutDataApi/{id}
            Method: get

  GetProductByIdWithoutDataApiFunctionLogGroup:
    Type: AWS::Logs::LogGroup
    Properties:
      LogGroupName: !Sub "/aws/lambda/${GetProductByIdWithoutDataApiFunction}"
      RetentionInDays: 7

  GetProductByIdWithRDSProxyFunction:
    Type: AWS::Serverless::Function
    Properties:
      FunctionName: GetProductByIdViaAuroraServerlessV2WithRDSProxy
      Timeout: 15 
      Handler: software.amazonaws.example.product.handler.GetProductByIdViaAuroraServerlessV2RDSProxyHandler::handleRequest   
      Environment:
        Variables:
          JAVA_TOOL_OPTIONS: "-XX:+TieredCompilation -XX:TieredStopAtLevel=1"
          #DB_ENDPOINT: !GetAtt MyDB.Endpoint.Address
      
      Policies:
        - Statement:
            - Sid: AllowDbConnect
              Effect: Allow
              Action:
                - rds-db:connect
              Resource:
                - !Sub arn:aws:rds-db:${AWS::Region}:${AWS::AccountId}:dbuser:!Select [6, !Split [":", !GetAtt RDSProxy.DBProxyArn]]/*
        - VPCAccessPolicy: {}
      VpcConfig:
        SecurityGroupIds:
          - Fn::GetAtt: LambdaSecurityGroup.GroupId
        SubnetIds: !Ref  Subnets
      Events:
        GetRequestById:
          Type: Api
          Properties:
            RestApiId: !Ref MyApi
            Path: /productsWithRDSProxy/{id}
            Method: get

  GetProductByIdWithRDSProxyFunctionLogGroup:
    Type: AWS::Logs::LogGroup
    Properties:
      LogGroupName: !Sub "/aws/lambda/${GetProductByIdWithRDSProxyFunction}"
      RetentionInDays: 7


  VPCSecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: Security group for RDS DB Instance.
      VpcId: 
         Ref: VpcId 
      SecurityGroupEgress: 
        - CidrIp: '0.0.0.0/0'
          Description: lambda RDS access over 5432
          FromPort: 5432
          IpProtocol: TCP
          ToPort: 5432
      SecurityGroupIngress:
        - IpProtocol: tcp
          FromPort: '5432'
          ToPort: '5432'
          SourceSecurityGroupId:
               Ref: LambdaSecurityGroup
               
  LambdaSecurityGroup:
      Type: AWS::EC2::SecurityGroup
      Properties:
        GroupDescription: SecurityGroup for Serverless Functions
        VpcId: 
          Ref: VpcId

  ProductsTable:
    Type: AWS::DynamoDB::Table
    Properties:
      TableName: "ProductsTable"
      PointInTimeRecoverySpecification:
         PointInTimeRecoveryEnabled: true
      AttributeDefinitions:
        - AttributeName: 'PK'
          AttributeType: 'S'
      KeySchema:
        - AttributeName: 'PK'
          KeyType: 'HASH'
      #BillingMode: PAY_PER_REQUEST
      ProvisionedThroughput: 
        ReadCapacityUnits: "3"
        WriteCapacityUnits: "1"
      StreamSpecification:
        StreamViewType: NEW_IMAGE 
        
  #MyDBSubnetGroup:
   # Type: AWS::RDS::DBSubnetGroup
    #Properties:
     # DBSubnetGroupDescription: Subnets available for the RDS DB Instance
      #SubnetIds:
       # Ref: Subnets
        
        
  #VPCSecurityGroup:
   # Type: AWS::EC2::SecurityGroup
    #Properties:
     # GroupDescription: Security group for RDS DB Instance.
      #VpcId: 
       #  Ref: VpcId 
      #SecurityGroupIngress:
       # - IpProtocol: tcp
        #  FromPort: '5432'
         # ToPort: '5432'
          #SourceSecurityGroupId:
               #Ref: LambdaSecurityGroup
               
  #LambdaSecurityGroup:
   #   Type: AWS::EC2::SecurityGroup
    #  Properties:
     #   GroupDescription: SecurityGroup for Serverless Functions
      #  VpcId: 
       #   Ref: VpcId
               
  #MyDB:
   # Type: AWS::RDS::DBInstance
    #Properties:
     # DBName: DevOpsGuruWorkshop
      #AllocatedStorage: 5
      #DBInstanceClass: db.t3.micro
      #Engine: postgres
      #EngineVersion: '14.6'
      #MasterUsername: postgres
      #MasterUserPassword: postgres
      #DBSubnetGroupName:
       # Ref: MyDBSubnetGroup
      #VPCSecurityGroups:
      #- Ref: VPCSecurityGroup
      
      
  DevOpsGuruResource:
    Type: AWS::DevOpsGuru::ResourceCollection
    Properties:
      ResourceCollectionFilter:
        CloudFormation:
          StackNames:
          - !Sub ${AWS::StackName}
          

  DBSubnetGroup:
    Type: AWS::RDS::DBSubnetGroup
    Properties:
      DBSubnetGroupDescription: Subnets available for the RDS DB Instance
      SubnetIds:
       Ref: Subnets
        
        
  DBSecret:
    Type: AWS::SecretsManager::Secret
    Properties:
      Name: !Ref UserSecret
      Description: RDS database auto-generated user password
      GenerateSecretString:
        SecretStringTemplate: !Sub '{"username": "${DBMasterUserName}"}'
        GenerateStringKey: "password"
        PasswordLength: 30
        ExcludeCharacters: '"@/\'
 
         
  AuroraServerlessV2Cluster:
    Type: 'AWS::RDS::DBCluster'
    DeletionPolicy: Delete
    Properties:
      DBClusterIdentifier: !Ref DBClusterName
      DatabaseName: DevOpsGuruWorkshop
      Engine: aurora-postgresql
      Port: 5432
      EnableHttpEndpoint: true
      MasterUsername: !Join ['', ['{{resolve:secretsmanager:', !Ref DBSecret, ':SecretString:username}}' ]]
      MasterUserPassword: !Join ['', ['{{resolve:secretsmanager:', !Ref DBSecret, ':SecretString:password}}' ]]
      DatabaseName: !Ref DatabaseName
      ServerlessV2ScalingConfiguration:
        MinCapacity: 0.5
        MaxCapacity: 1
      DBSubnetGroupName:
        Ref: DBSubnetGroup
      VpcSecurityGroupIds:
      - !Ref VPCSecurityGroup
  
  AuroraServerlessV2Instance:
    Type: 'AWS::RDS::DBInstance'
    Properties:
      Engine: aurora-postgresql
      DBInstanceClass: db.serverless
      DBClusterIdentifier: !Ref AuroraServerlessV2Cluster
      MonitoringInterval: 1
      MonitoringRoleArn: !GetAtt EnhancedMonitoringRole.Arn
      PubliclyAccessible: false
      EnablePerformanceInsights: true
      PerformanceInsightsRetentionPeriod: 7
      
  EnhancedMonitoringRole:
    Type: "AWS::IAM::Role"
    Properties:
      RoleName: !Sub "${AWS::StackName}-monitor-${AWS::Region}"
      Description: "Allows your Aurora DB cluster to deliver Enhanced Monitoring metrics."
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Action:
              - "sts:AssumeRole"
            Principal:
              Service:
                - "monitoring.rds.amazonaws.com"
      ManagedPolicyArns:
        - "arn:aws:iam::aws:policy/service-role/AmazonRDSEnhancedMonitoringRole"
 
  
  # IAM Role to be used by RDS Proxy for fetching secrets
  RDSProxyRole:
    Type: AWS::IAM::Role
    Properties:
      Path: /
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Action: [ 'sts:AssumeRole' ]
            Effect: Allow
            Principal:
              Service: [ rds.amazonaws.com ]
      Policies:
        - PolicyName: DBProxyPolicy
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Action:
                  - secretsmanager:GetSecretValue
                Effect: Allow
                Resource:
                  - !Ref DBSecret

  # Rds Proxy
  RDSProxy:
    Type: AWS::RDS::DBProxy
    Properties:
      Auth:
        - { AuthScheme: SECRETS, SecretArn: !Ref DBSecret}
      DBProxyName: 'rds-proxy'
      RoleArn: !GetAtt RDSProxyRole.Arn
      EngineFamily: 'POSTGRESQL'
      IdleClientTimeout: 120
      RequireTLS: true
      DebugLogging: false
      VpcSecurityGroupIds:
      - !Ref VPCSecurityGroup
      VpcSubnetIds: !Ref  Subnets

      
  # Rds Proxy Target group
  ProxyTargetGroup:
    Type: AWS::RDS::DBProxyTargetGroup
    Properties:
      DBProxyName: !Ref RDSProxy
      DBClusterIdentifiers: [ !Ref AuroraServerlessV2Cluster]
      TargetGroupName: default
      ConnectionPoolConfigurationInfo:
        MaxConnectionsPercent: 5
        MaxIdleConnectionsPercent: 4
        ConnectionBorrowTimeout: 120
        
Outputs:
  DevOpsGuruWorkshopApiEndpoint:
    Description: "API Gateway endpoint URL for Prod stage for DevOpsGuru Workshop"
    Value: !Sub "https://${MyApi}.execute-api.${AWS::Region}.amazonaws.com/prod/products"
  StackName:
    Description: "Created AWS CloudFormation Stack Name"
    Value: !Sub ${AWS::StackName}