test_sam_template.yaml

# This is the ECR version of the SAM template:
AWSTemplateFormatVersion: '2010-09-09'
Transform: AWS::Serverless-2016-10-31
Description: >
  starfleet

  This is a Sample SAM Template for starfleet -- please replace this with your own and add your own values in.
  See the Starfleet documentation here for more details: https://gemini-oss.github.io/starfleet/installation/Overview/

# Replace these with your own:
Parameters:
  EnvironmentName:
    Type: String
    Default: TEST
    AllowedValues:
      - TEST
      - PROD
    Description: Informs the Lambda functions which configuration to use, either TEST or PROD

# Environment specific configuration can go in here:
Mappings:
  EnvMap:
    TEST:
      # Add more values that can be referenced easily here:
      BaseRoleName: starfleet-worker-basic-test-role

    PROD:
      # Add more values that can be referenced easily here:
      BaseRoleName: starfleet-worker-basic-prod-role

# More info about Globals: https://github.com/awslabs/serverless-application-model/blob/master/docs/globals.rst
Globals:
  Function:
    Timeout: 300
    Environment:
      Variables:
        GIT_PYTHON_REFRESH: quiet  # Required for IAMbic in the IAM Role Worker

Resources:
  # The Starbase Components
  StarbaseFanoutDLQ:
    Type: AWS::SQS::Queue
    Properties:
      QueueName: starbase-fanout-dlq
      RedriveAllowPolicy:
        redrivePermission: allowAll

  StarbaseFanoutQueue:
    Type: AWS::SQS::Queue
    Properties:
      QueueName: starbase-fanout-queue
      VisibilityTimeout: 300  # This needs to be the same as the Lambda function timeout.
      RedrivePolicy:
        deadLetterTargetArn: !GetAtt StarbaseFanoutDLQ.Arn
        maxReceiveCount: 4

  StarbaseFanoutQueuePolicy:  # SQS policy to allow S3 bucket notifications
    Type: AWS::SQS::QueuePolicy
    Properties:
      Queues:
        - !GetAtt StarbaseFanoutQueue.QueueUrl
      PolicyDocument:
        Statement:
          - Effect: Allow
            Action: SQS:SendMessage
            Resource:
              - !GetAtt StarbaseFanoutQueue.Arn
            Principal:
              Service: s3.amazonaws.com
            Condition:
              ArnLike:
                "aws:SourceArn": !Sub
                  - 'arn:aws:s3:::starfleet-templates-${AccountId}'
                  - AccountId: !Ref "AWS::AccountId"
              StringEquals:
                "aws:SourceAccount": !Ref "AWS::AccountId"

  StarfleetTemplateBucket:
    DependsOn:
      - StarbaseFanoutQueuePolicy
    Type: AWS::S3::Bucket
    Properties:
      BucketName: !Sub
        - 'starfleet-templates-${AccountId}'
        - AccountId: !Ref "AWS::AccountId"
      PublicAccessBlockConfiguration:
        BlockPublicAcls: True
        BlockPublicPolicy: True
        IgnorePublicAcls: True
        RestrictPublicBuckets: True
      BucketEncryption:
        ServerSideEncryptionConfiguration:
          - ServerSideEncryptionByDefault:
              SSEAlgorithm: AES256
      NotificationConfiguration:
        QueueConfigurations:
          - Event: "s3:ObjectCreated:*"
            Queue: !GetAtt StarbaseFanoutQueue.Arn

  # The S3 bucket that holds the account index:
  AccountIndexBucket:
    Type: AWS::S3::Bucket
    Properties:
      BucketName: !Sub
        - 'starfleet-account-index-${AccountId}'
        - AccountId: !Ref "AWS::AccountId"
      PublicAccessBlockConfiguration:
        BlockPublicAcls: True
        BlockPublicPolicy: True
        IgnorePublicAcls: True
        RestrictPublicBuckets: True
      BucketEncryption:
        ServerSideEncryptionConfiguration:
          - ServerSideEncryptionByDefault:
              SSEAlgorithm: AES256

  # Secrets Manager for Starfleet secrets -- this is optional and disabled by default -- recommend you click ops this actually
  #StarfleetSecrets:
  #  Type: AWS::SecretsManager::Secret
  #  Properties:
  #    Description: Secret storage for Starfleet secrets
  #    KmsKeyId: alias/aws/secretsmanager
  #    Name: StarfleetSecrets
  #    Tags:
  #     - Add here

  # The Starbase EventBridge listener:
  StarbaseEventBridgeFunction:
    Type: AWS::Serverless::Function
    Metadata:
      DockerTag: starfleet
      DockerContext: ./
      Dockerfile: Dockerfile
    Properties:
      PackageType: Image
      ImageConfig:
        Command:
          - starfleet.starbase.entrypoints.eventbridge_timed_lambda_handler
      Architectures:
        - arm64
      Events:
        # Make one for each timed event:  -- Don't forget to set these to Enabled when you are ready to use them!
        EventBridgeFiveMin:
          Type: Schedule
          Properties:
            Name: StarfleetFiveMin
            Description: Invokes Starfleet 5-minute worker ship tasks
            Enabled: False  # Disabled by default for cost unless you need this for some workers
            Schedule: rate(5 minutes)
            Input: '{"name": "FIVE_MIN"}'
        EventBridgeFifteenMin:
          Type: Schedule
          Properties:
            Name: StarfleetFifteenMin
            Description: Invokes Starfleet 15-minute worker ship tasks
            Enabled: False  # Disabled by default for cost unless you need this for some workers
            Schedule: rate(15 minutes)
            Input: '{"name": "FIFTEEN_MIN"}'
        EventBridgeThirtyMin:
          Type: Schedule
          Properties:
            Name: StarfleetThirtyMin
            Description: Invokes Starfleet 30-minute worker ship tasks
            Enabled: False  # Disabled by default for cost unless you need this for some workers
            Schedule: rate(30 minutes)
            Input: '{"name": "THIRTY_MIN"}'
        EventBridgeHourly:
          Type: Schedule
          Properties:
            Name: StarfleetHourly
            Description: Invokes Starfleet hourly worker ship tasks
            Enabled: True
            Schedule: rate(1 hour)
            Input: '{"name": "HOURLY"}'
        EventBridgeSixHourly:
          Type: Schedule
          Properties:
            Name: StarfleetSixHourly
            Description: Invokes Starfleet six-hourly worker ship tasks
            Enabled: True
            Schedule: rate(6 hours)
            Input: '{"name": "SIX_HOURLY"}'
        EventBridgeTwelveHourly:
          Type: Schedule
          Properties:
            Name: StarfleetTwelveHourly
            Description: Invokes Starfleet twelve-hourly worker ship tasks
            Enabled: True
            Schedule: rate(12 hours)
            Input: '{"name": "TWELVE_HOURLY"}'
        EventBridgeDaily:
          Type: Schedule
          Properties:
            Name: StarfleetDaily
            Description: Invokes Starfleet daily worker ship tasks
            Enabled: True
            Schedule: rate(1 day)
            Input: '{"name": "DAILY"}'
      Policies:
        # Grant permissions to read from the Template S3 bucket and also the account index bucket:
        - S3ReadPolicy:
            BucketName: !Ref StarfleetTemplateBucket
        - S3ReadPolicy:
            BucketName: !Ref AccountIndexBucket
        # Write out to the fan out queue:
        - SQSSendMessagePolicy:
            QueueName: !GetAtt StarbaseFanoutQueue.QueueName

  # #####
  # Define the worker ships here:
  # ####

  # Account Index Generator Worker Ship Resources:
  AccountIndexGeneratorDLQ:
    Type: AWS::SQS::Queue
    Properties:
      QueueName: starfleet-account-index-generator-dlq
      RedriveAllowPolicy:
        redrivePermission: allowAll

  AccountIndexGeneratorQueue:
    Type: AWS::SQS::Queue
    Properties:
      QueueName: starfleet-account-index-generator
      VisibilityTimeout: 300  # This needs to be the same as the Lambda function timeout.
      RedrivePolicy:
        deadLetterTargetArn: !GetAtt AccountIndexGeneratorDLQ.Arn
        maxReceiveCount: 4

  AccountIndexGenerator:
    Type: AWS::Serverless::Function
    Metadata:
      DockerTag: starfleet
      DockerContext: ./
      Dockerfile: Dockerfile
    Properties:
      PackageType: Image
      ImageConfig:
        Command:
          - starfleet.worker_ships.plugins.account_index_generator.ship.lambda_handler
      Architectures:
        - arm64
      MemorySize: 256
      Events:
        SQSEvent:
          Type: SQS
          Properties:
            Queue: !GetAtt AccountIndexGeneratorQueue.Arn
            BatchSize: 2
      Environment:
        Variables:
          STARFLEET_COMMIT: True
      Policies:
        # Grant permissions to read and write to the inventory S3 bucket:
        - S3ReadPolicy:
            BucketName: !Ref AccountIndexBucket
        - S3WritePolicy:
            BucketName: !Ref AccountIndexBucket

# Uncomment for the AWS Config worker to have that set up and deployed:
#  AWSConfigWorkerDLQ:
#    Type: AWS::SQS::Queue
#    Properties:
#      QueueName: starfleet-aws-config-worker-dlq
#      RedriveAllowPolicy:
#        redrivePermission: allowAll
#
#  AWSConfigWorkerQueue:
#    Type: AWS::SQS::Queue
#    Properties:
#      QueueName: starfleet-aws-config-worker
#      VisibilityTimeout: 300  # This needs to be the same as the Lambda function timeout.
#      RedrivePolicy:
#        deadLetterTargetArn: !GetAtt AWSConfigWorkerDLQ.Arn
#        maxReceiveCount: 4
#
#  AWSConfigWorker:
#    Type: AWS::Serverless::Function
#    Metadata:
#      DockerTag: starfleet
#      DockerContext: ./
#      Dockerfile: Dockerfile
#    Properties:
#      PackageType: Image
#      ImageConfig:
#        Command:
#          - starfleet.worker_ships.plugins.aws_config.ship.lambda_handler
#      Architectures:
#        - arm64
#      MemorySize: 128
#      Events:
#        SQSEvent:
#          Type: SQS
#          Properties:
#            Queue: !GetAtt AWSConfigWorkerQueue.Arn
#            BatchSize: 2
#      Environment:
#        Variables:
#          STARFLEET_COMMIT: False
#      Policies:
#        # Grant permissions to read from the inventory S3 bucket:
#        - S3ReadPolicy:
#             BucketName: !Ref AccountIndexBucket

# Uncomment for the GitHub Repo Sync Worker:
#  GitHubSyncWorkerDLQ:
#    Type: AWS::SQS::Queue
#    Properties:
#      QueueName: starfleet-github-sync-worker-dlq
#      RedriveAllowPolicy:
#        redrivePermission: allowAll
#
#  GitHubSyncWorkerQueue:
#    Type: AWS::SQS::Queue
#    Properties:
#      QueueName: starfleet-github-sync-worker
#      VisibilityTimeout: 300  # This needs to be the same as the Lambda function timeout.
#      RedrivePolicy:
#        deadLetterTargetArn: !GetAtt GitHubSyncWorkerDLQ.Arn
#        maxReceiveCount: 4
#
#  GitHubSyncWorker:
#    Type: AWS::Serverless::Function
#    Metadata:
#      DockerTag: starfleet
#      DockerContext: ./
#      Dockerfile: Dockerfile
#    Properties:
#      PackageType: Image
#      ImageConfig:
#        Command:
#          - starfleet.worker_ships.plugins.github_sync.ship.lambda_handler
#      Architectures:
#        - arm64
#      MemorySize: 128
#      Events:
#        SQSEvent:
#          Type: SQS
#          Properties:
#            Queue: !GetAtt GitHubSyncWorkerQueue.Arn
#            BatchSize: 2
#      Environment:
#        Variables:
#          STARFLEET_COMMIT: False
#      Policies:
#        # Grant permissions to read and write to the templates bucket, so you can do CI/CD!
#        - S3CrudPolicy:
#            BucketName: !Ref StarfleetTemplateBucket
#        # Add any additional S3 policies here!

# Uncomment for the IAM Role Worker:
#  IamRoleWorkerDLQ:
#    Type: AWS::SQS::Queue
#    Properties:
#      QueueName: starfleet-iam-role-worker-dlq
#      RedriveAllowPolicy:
#        redrivePermission: allowAll
#
#  IamRoleWorkerQueue:
#    Type: AWS::SQS::Queue
#    Properties:
#      QueueName: starfleet-iam-role-worker
#      VisibilityTimeout: 300  # This needs to be the same as the Lambda function timeout.
#      RedrivePolicy:
#        deadLetterTargetArn: !GetAtt IamRoleWorkerDLQ.Arn
#        maxReceiveCount: 4
#
#  IamRoleWorker:
#    Type: AWS::Serverless::Function
#    Metadata:
#      DockerTag: starfleet
#      DockerContext: ./
#      Dockerfile: Dockerfile
#    Properties:
#      PackageType: Image
#      ImageConfig:
#        Command:
#          - starfleet.worker_ships.plugins.iam.role_ship.lambda_handler
#      Architectures:
#        - arm64
#      MemorySize: 128
#      Events:
#        SQSEvent:
#          Type: SQS
#          Properties:
#            Queue: !GetAtt IamRoleWorkerQueue.Arn
#            BatchSize: 4
#      Environment:
#        Variables:
#          STARFLEET_COMMIT: False
#          GIT_PYTHON_REFRESH: quiet  # Iambic
#      Policies:
#        # Grant permissions to read from the Account Inventory S3 bucket:
#        - S3ReadPolicy:
#              BucketName: !Ref AccountIndexBucket

  # Finally, the Starbase Fanout Function:
  StarbaseFanoutFunction:
    Type: AWS::Serverless::Function
    DependsOn:
      - AccountIndexGeneratorQueue
    Metadata:
      DockerTag: starfleet
      DockerContext: ./
      Dockerfile: Dockerfile
    Properties:
      PackageType: Image
      ImageConfig:
        Command:
          - starfleet.starbase.entrypoints.fanout_payload_lambda_handler
      Architectures:
        - arm64
      Events:
        # Make one for each timed event:
        SQSEvent:
          Type: SQS
          Properties:
            Queue: !GetAtt StarbaseFanoutQueue.Arn
            BatchSize: 1  # Important! We only want 1 to ensure we don't hit timeouts.
      Policies:
        # Grant permissions to read from the Template S3 bucket:
        - S3ReadPolicy:
            BucketName: !Ref StarfleetTemplateBucket
        - SQSSendMessagePolicy:
            QueueName: starfleet-*

  # Common worker ship components here:
  AssumeRoleManagedPolicy:
    Type: AWS::IAM::ManagedPolicy
    DependsOn:
      - AccountIndexGenerator
    Properties:
      Description: Grants Starfleet workers assume role permissions to common Starfleet worker IAM roles
      ManagedPolicyName: StarfleetWorkerAssumeRoles
      PolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Action: 'sts:AssumeRole'
            Resource:
              - !Sub
                - 'arn:aws:iam::*:role/${RoleName}'
                - RoleName: !FindInMap
                    - EnvMap
                    - !Ref 'EnvironmentName'
                    - BaseRoleName
          # Uncomment for secrets manager permissions as well for Slack alerts and GitHub Repo Sync worker
          # - Effect: Allow
          #  Action: secretsmanager:GetSecretValue
          #  Resource: arn:aws:secretsmanager:REGION:ACCOUNTNUMBER:secret:STARFLEET-SECRET-ID-HERE

      Roles:
        - !Ref AccountIndexGeneratorRole  # AccountIndexGeneratorRole is created automatically by SAM and can be referenced
        # - !Ref AWSConfigWorkerRole  # Uncomment for the AWS Config worker
        # - !Ref GitHubSyncWorkerRole # Uncomment for the GitHub Repo Sync Worker
        # - !Ref IamRoleWorkerRole  # Uncomment for the IAM Role Worker
        # - !Ref YourWorkerRoleHere # Add your worker roles here to get the policy attached

Outputs:
  StarbaseFanoutQueue:
    Description: The Queue URL for the Starbase fan out queue
    Value: !GetAtt StarbaseFanoutQueue.QueueUrl
  StarbaseFanoutDLQ:
    Description: The Queue URL for the Starbase fan out DLQ
    Value: !GetAtt StarbaseFanoutDLQ.QueueUrl
  StarfleetTemplateBucket:
    Description: The Starfleet S3 bucket that holds all the worker ship templates
    Value: !Ref StarfleetTemplateBucket
  StarbaseEventBridgeFunction:
    Description: The primary entrypoint for the Starbase timed EventBridge invocations
    Value: !GetAtt StarbaseEventBridgeFunction.Arn
  StarbaseFanoutFunction:
    Description: The Starbase function that fans out the tasks to the worker ships
    Value: !GetAtt StarbaseFanoutFunction.Arn
  AssumeRoleManagedPolicy:
    Description: The Assume Role managed policy that can be attached to worker roles that need it
    Value: !Ref AssumeRoleManagedPolicy
  AccountIndexBucket:
    Description: The Starfleet S3 bucket that holds the account index JSON file
    Value: !Ref AccountIndexBucket
  AccountIndexGeneratorQueue:
    Description: The Queue URL for the Account Index Generator invocation queue
    Value: !GetAtt AccountIndexGeneratorQueue.QueueUrl
  AccountIndexGeneratorDLQ:
    Description: The Queue URL for the Account Index Generator invocation DLQ
    Value: !GetAtt AccountIndexGeneratorDLQ.QueueUrl
  AccountIndexGeneratorFunction:
    Description: The Account Index Generator worker ship function that generates an account index
    Value: !GetAtt AccountIndexGenerator.Arn
# Uncomment for the AWS Config worker:
#  AWSConfigWorkerQueue:
#    Description: The Queue URL for the AWS Config Worker invocation queue
#    Value: !GetAtt AWSConfigWorkerQueue.QueueUrl
#  AWSConfigWorkerDLQ:
#    Description: The Queue URL for the AWS Config Worker invocation DLQ
#    Value: !GetAtt AWSConfigWorkerDLQ.QueueUrl
#  AWSConfigWorker:
#    Description: The AWS Config Worker ship function that enables AWS Config everywhere
#    Value: !GetAtt AWSConfigWorker.Arn
# Uncomment for the GitHub Sync worker:
#  GitHubSyncWorkerQueue:
#    Description: The Queue URL for the GitHub Sync Worker invocation queue
#    Value: !GetAtt GitHubSyncWorkerQueue.QueueUrl
#  GitHubSyncWorkerDLQ:
#    Description: The Queue URL for the GitHub Sync Worker invocation DLQ
#    Value: !GetAtt GitHubSyncWorkerDLQ.QueueUrl
#  GitHubSyncWorker:
#    Description: The GitHub Sync Worker ship function that syncs a GitHub repo with S3
#    Value: !GetAtt GitHubSyncWorker.Arn
# Uncomment for the IAM Role worker:
#  IamRoleWorkerQueue:
#    Description: The Queue URL for the IAM Role Worker invocation queue
#    Value: !GetAtt IamRoleWorkerQueue.QueueUrl
#  IamRoleWorkerDLQ:
#    Description: The Queue URL for the IAM Role Worker invocation DLQ
#    Value: !GetAtt IamRoleWorkerDLQ.QueueUrl
#  IamRoleWorker:
#    Description: The IAM Role Worker ship function that uses iambic to sync IAM roles in our infrastructure
#    Value: !GetAtt IamRoleWorker.Arn