AWSTemplateFormatVersion: "2010-09-09"
Description: The AWS CloudFormation template for LightFile Next Lambda Function
Parameters:
  MyResourcePrefix:
    Type: String
    Default: sample
    Description: "Enter your project prefix. e.g: my-company"
  MyToken:
    Type: String
    Default: YourLicenseTokenHere
    Description: "Enter your or trial license token. e.g: the-customer!ABCD1234abcd=="
  AclValue:
    Type: String
    Default: public-read
    Description: "Enter the ACL value for the updated object. e.g: public-read, private, _keep"
  BackupAclValue:
    Type: String
    Default: private
    Description: "Enter the ACL value for the backup object before LightFile. e.g: private, _keep"
Resources:
  LightFileLogGroup:
    Type: AWS::Logs::LogGroup
    Properties:
      LogGroupName: !Sub "/aws/lambda/${MyResourcePrefix}-lightfile"
  IamRoleForLambda:
    Type: AWS::IAM::Role
    Properties:
      RoleName: !Sub "${MyResourcePrefix}-lightfile-role"
      Path: /
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - lambda.amazonaws.com
            Action:
              - sts:AssumeRole
      Policies:
        - PolicyName: !Sub "${MyResourcePrefix}-lightfile-log-policy"
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Effect: Allow
                Action:
                  - logs:CreateLogStream
                Resource:
                  - Fn::Sub: arn:${AWS::Partition}:logs:${AWS::Region}:${AWS::AccountId}:log-group:/aws/lambda/${MyResourcePrefix}-lightfile:*
              - Effect: Allow
                Action:
                  - logs:PutLogEvents
                Resource:
                  - Fn::Sub: arn:${AWS::Partition}:logs:${AWS::Region}:${AWS::AccountId}:log-group:/aws/lambda/${MyResourcePrefix}-lightfile:*:*
        - PolicyName: !Sub "${MyResourcePrefix}-lightfile-s3-policy"
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Effect: Allow
                Action:
                  - s3:GetObject
                  - s3:GetObjectAcl
                  - s3:GetObjectTagging
                  - s3:PutObject
                  - s3:PutObjectAcl
                  - s3:PutObjectTagging
                Resource:
                  - !Sub "arn:aws:s3:::${MyResourcePrefix}-lightfile-test/*"
                  - !Sub "arn:aws:s3:::${MyResourcePrefix}-lightfile-backup/*"
  LambdaFunction:
    Type: AWS::Lambda::Function
    Properties:
      Architectures:
        - arm64
      Code:
        S3Bucket: !Sub "lightfile6-deployment-${AWS::Region}"
        S3Key: lambda/6.1.1/arm64/lightfile-lambda.zip
      FunctionName: !Sub "${MyResourcePrefix}-lightfile"
      Handler: handler
      MemorySize: 256
      Role:
        Fn::GetAtt:
          - IamRoleForLambda
          - Arn
      Runtime: provided.al2023
      Timeout: 45
      Environment:
        Variables:
          LICENSE_TOKEN: !Ref "MyToken"
          QUALITY: medium
          ACL: !Ref "AclValue"
          BACKUP_BUCKET: !Sub "${MyResourcePrefix}-lightfile-backup"
          BACKUP_PREFIX: "${bucket}"
          BACKUP_ACL: !Ref "BackupAclValue"
          LANGUAGE: ja
          LOG_LEVEL: info
    DependsOn:
      - LightFileLogGroup
      - IamRoleForLambda
  LambdaPermissionForTestBucket:
    Type: AWS::Lambda::Permission
    Properties:
      FunctionName:
        Fn::GetAtt:
          - LambdaFunction
          - Arn
      Action: lambda:InvokeFunction
      Principal: !Sub "s3.${AWS::URLSuffix}"
      SourceArn: !Sub "arn:${AWS::Partition}:s3:::${MyResourcePrefix}-lightfile-test"
    DependsOn:
      - LambdaFunction
  TestBucket:
    Type: AWS::S3::Bucket
    Properties:
      BucketName: !Sub "${MyResourcePrefix}-lightfile-test"
      OwnershipControls:
        Rules:
          - ObjectOwnership: ObjectWriter
      PublicAccessBlockConfiguration:
        BlockPublicAcls: False
        BlockPublicPolicy: False
        IgnorePublicAcls: False
        RestrictPublicBuckets: False
      NotificationConfiguration:
        LambdaConfigurations:
          - Event: "s3:ObjectCreated:*"
            Function:
              Fn::GetAtt:
                - LambdaFunction
                - Arn
    DependsOn:
      - LambdaPermissionForTestBucket
  BackupBucket:
    Type: AWS::S3::Bucket
    Properties:
      BucketName: !Sub "${MyResourcePrefix}-lightfile-backup"
      OwnershipControls:
        Rules:
          - ObjectOwnership: ObjectWriter
    DependsOn:
      - LambdaFunction
