AWSTemplateFormatVersion: '2010-09-09'
Transform: AWS::Serverless-2016-10-31
Description: 'Rekognition

  Sample SAM Template for Rekognition

  '
Parameters:
  StackName:
    Type: String
    Default: rekognition
    Description: Base name for the stack resources (must be lowercase)
    AllowedPattern: ^[a-z0-9-]*$
    ConstraintDescription: Stack name can only contain lowercase letters, numbers,
      and hyphens
  Environment:
    Type: String
    Default: dev
    AllowedValues:
    - dev
    - staging
    - prod
    Description: Environment name for the stack (defaults to dev)
  ProjectName:
    Type: String
    Default: datafy-rekognition
    Description: Name of the Rekognition Custom Labels project
  ModelVersion:
    Type: String
    Default: v1
    Description: Version of the Rekognition Custom Labels model
  DatastoreManifestBucket:
    Type: String
    Default: datafy-rekognition-training-data-dev
    Description: The S3 bucket containing manifest files
Globals:
  Function:
    Timeout: 900
    MemorySize: 1024
    Handler: app.lambda_handler
    Runtime: python3.10
    Architectures:
    - x86_64
    Tracing: Active
    LoggingConfig:
      LogFormat: JSON
Resources:
  SourceDataBucket:
    Type: AWS::S3::Bucket
    DeletionPolicy: Retain
    UpdateReplacePolicy: Retain
    Properties:
      BucketName:
        Fn::Sub: datafy-${StackName}-source-data-${Environment}
      VersioningConfiguration:
        Status: Enabled
      BucketEncryption:
        ServerSideEncryptionConfiguration:
        - ServerSideEncryptionByDefault:
            SSEAlgorithm: AES256
      PublicAccessBlockConfiguration:
        BlockPublicAcls: true
        BlockPublicPolicy: true
        IgnorePublicAcls: true
        RestrictPublicBuckets: true
    Metadata:
      SamResourceId: SourceDataBucket
  TrainingDataBucket:
    Type: AWS::S3::Bucket
    DeletionPolicy: Retain
    UpdateReplacePolicy: Retain
    Properties:
      BucketName:
        Fn::Sub: datafy-${StackName}-training-data-${Environment}
      VersioningConfiguration:
        Status: Enabled
      BucketEncryption:
        ServerSideEncryptionConfiguration:
        - ServerSideEncryptionByDefault:
            SSEAlgorithm: AES256
      PublicAccessBlockConfiguration:
        BlockPublicAcls: true
        BlockPublicPolicy: true
        IgnorePublicAcls: true
        RestrictPublicBuckets: true
      LifecycleConfiguration:
        Rules:
        - Id: DeleteOldManifests
          Status: Enabled
          ExpirationInDays: 30
          Prefix: manifests/
    Metadata:
      SamResourceId: TrainingDataBucket
  SourceBucketParameter:
    Type: AWS::SSM::Parameter
    Properties:
      Name:
        Fn::Sub: /datafy-rekognition-stack/source-bucket
      Type: String
      Value:
        Ref: SourceDataBucket
      Description: Source data bucket name for XML and JPG files
    Metadata:
      SamResourceId: SourceBucketParameter
  TrainingBucketParameter:
    Type: AWS::SSM::Parameter
    Properties:
      Name:
        Fn::Sub: /datafy-rekognition-stack/training-bucket
      Type: String
      Value:
        Ref: TrainingDataBucket
      Description: Training data bucket name
    Metadata:
      SamResourceId: TrainingBucketParameter
  TrainingPrefixParameter:
    Type: AWS::SSM::Parameter
    Properties:
      Name:
        Fn::Sub: /datafy-rekognition-stack/training-prefix
      Type: String
      Value: manifests
      Description: Prefix for training data in the bucket
    Metadata:
      SamResourceId: TrainingPrefixParameter
  ProjectNameParameter:
    Type: AWS::SSM::Parameter
    Properties:
      Name:
        Fn::Sub: /datafy-rekognition-stack/project-name
      Type: String
      Value: Datafy
      Description: Rekognition Custom Labels Project Name
    Metadata:
      SamResourceId: ProjectNameParameter
  ApplicationResourceGroup:
    Type: AWS::ResourceGroups::Group
    Properties:
      Name:
        Fn::Sub: ApplicationInsights-SAM-${AWS::StackName}
      ResourceQuery:
        Type: CLOUDFORMATION_STACK_1_0
    Metadata:
      SamResourceId: ApplicationResourceGroup
  ApplicationInsightsMonitoring:
    Type: AWS::ApplicationInsights::Application
    Properties:
      ResourceGroupName:
        Ref: ApplicationResourceGroup
      AutoConfigurationEnabled: 'true'
    Metadata:
      SamResourceId: ApplicationInsightsMonitoring
  RekognitionServiceRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
        - Effect: Allow
          Principal:
            Service: rekognition.amazonaws.com
          Action: sts:AssumeRole
      ManagedPolicyArns:
      - arn:aws:iam::aws:policy/AmazonRekognitionFullAccess
      Policies:
      - PolicyName: RekognitionS3Access
        PolicyDocument:
          Version: '2012-10-17'
          Statement:
          - Effect: Allow
            Action:
            - s3:GetObject
            - s3:ListBucket
            - s3:PutObject
            Resource:
            - Fn::Sub: arn:aws:s3:::${TrainingDataBucket}
            - Fn::Sub: arn:aws:s3:::${TrainingDataBucket}/*
            - Fn::Sub: arn:aws:s3:::${SourceDataBucket}
            - Fn::Sub: arn:aws:s3:::${SourceDataBucket}/*
    Metadata:
      SamResourceId: RekognitionServiceRole

Outputs:
  SourceDataBucketName:
    Description: Name of the created source data bucket
    Value:
      Ref: SourceDataBucket
  SourceDataBucketArn:
    Description: ARN of the created source data bucket
    Value:
      Fn::GetAtt:
      - SourceDataBucket
      - Arn
  TrainingDataBucketName:
    Description: Name of the created training data bucket
    Value:
      Ref: TrainingDataBucket
  TrainingDataBucketArn:
    Description: ARN of the created training data bucket
    Value:
      Fn::GetAtt:
      - TrainingDataBucket
      - Arn
