deployment.yaml

AWSTemplateFormatVersion: '2010-09-09'
Description: Arduino S3 data exporter. For deployment and architectural details, see https://github.com/arduino/aws-s3-integration

Parameters:
  LambdaCodeS3Bucket:
    Type: String
    Description: S3 bucket where the Lambda function ZIP file is stored.

  LambdaCodeS3Key:
    Type: String
    Default: 'arduino-s3-integration-lambda.zip'
    Description: S3 key for the Lambda function ZIP file.

  IotApiKey:
    Type: String
    Description: Arduino API Key.

  IotApiSecret:
    Type: String
    Description: Arduino API Secret.
    NoEcho: true

  IotOrgId:
    Type: String
    Default: '<empty>'
    Description: Arduino Organization ID (optional).

  ExecutionScheduling:
      Type: String
      Description: "Choose the execution scheduling for the data export"
      AllowedValues:
        - 5 minutes
        - 15 minutes
        - 1 hour
        - 1 day
      Default: 1 hour

  Resolution:
      Type: String
      Description: "Samples resolution data extraction resolution. 'raw' and '1 minute' are not supported for '1 day' scheduling"
      AllowedValues:
        - raw
        - 1 minute
        - 5 minutes
        - 15 minutes
        - 1 hour
      Default: 5 minutes

  ResolutionAggregationStatistic:
      Type: String
      Description: "Aggregation statistic for data extraction. It is not applicable for 'raw' resolution."
      AllowedValues:
        - AVG
        - MIN
        - MAX
        - PCT_90
        - PCT_90
      Default: AVG

  TagFilter:
    Type: String
    Default: '<empty>'
    Description: Filter things to import by tag (optional). Format> tag1=value1,tag2=value2

  DestinationS3Bucket:
    Type: String
    Description: S3 bucket where CSV files will be stored.

Resources:

  # IAM Role for Lambda
  ArduinoS3LambdaExecutionRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              Service: lambda.amazonaws.com
            Action: sts:AssumeRole
      Policies:
        - PolicyName: ArduinoS3LambdaExecutionPolicy
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Effect: Allow
                Action:
                  - logs:CreateLogGroup
                  - logs:CreateLogStream
                  - logs:PutLogEvents
                Resource: arn:aws:logs:*:*:*
              - Effect: Allow
                Action:
                  - ssm:GetParameter
                  - ssm:GetParameters
                  - ssm:GetParametersByPath
                Resource: arn:aws:ssm:*:*:parameter/arduino/s3-*
              - Effect: Allow
                Action:
                  - s3:PutObject
                  - s3:PutObjectAcl
                  - s3:ListBucket
                Resource:
                  - !Sub arn:aws:s3:::${DestinationS3Bucket}
                  - !Sub arn:aws:s3:::${DestinationS3Bucket}/*

  # Lambda Function
  LambdaFunction:
    Type: AWS::Lambda::Function
    Properties:
      FunctionName: !Sub arduino-s3-csv-data-exporter-${AWS::StackName}
      Handler: bootstrap
      Role: !GetAtt ArduinoS3LambdaExecutionRole.Arn
      Code:
        S3Bucket:
          Ref: LambdaCodeS3Bucket
        S3Key:
          Ref: LambdaCodeS3Key
      Runtime: provided.al2
      Timeout: 900
      MemorySize: 256
      Environment:
        Variables:
          STACK_NAME: !Sub ${AWS::StackName}

  # Parameters in Parameter Store
  ApiKeyParameter:
    Type: AWS::SSM::Parameter
    Properties:
      Name: !Sub /arduino/s3-exporter/${AWS::StackName}/iot/api-key
      Type: String
      Value:
        Ref: IotApiKey
      Tier: Standard

  ApiSecretParameter:
    Type: AWS::SSM::Parameter
    Properties:
      Name: !Sub /arduino/s3-exporter/${AWS::StackName}/iot/api-secret
      Type: String
      Value:
        Ref: IotApiSecret
      Tier: Standard

  OrgIdParameter:
    Type: AWS::SSM::Parameter
    Properties:
      Name: !Sub /arduino/s3-exporter/${AWS::StackName}/iot/org-id
      Type: String
      Value:
        Ref: IotOrgId
      Tier: Standard

  FilterTagsParameter:
    Type: AWS::SSM::Parameter
    Properties:
      Name: !Sub /arduino/s3-exporter/${AWS::StackName}/iot/filter/tags
      Type: String
      Value:
        Ref: TagFilter
      Tier: Standard

  ResolutionParameter:
    Type: AWS::SSM::Parameter
    Properties:
      Name: !Sub /arduino/s3-exporter/${AWS::StackName}/iot/samples-resolution
      Type: String
      Value:
        Ref: Resolution
      Tier: Standard

  DestinationS3BucketParameter:
    Type: AWS::SSM::Parameter
    Properties:
      Name: !Sub /arduino/s3-exporter/${AWS::StackName}/destination-bucket
      Type: String
      Value:
        Ref: DestinationS3Bucket
      Tier: Standard

  ExecutionSchedulingParameter:
    Type: AWS::SSM::Parameter
    Properties:
      Name: !Sub /arduino/s3-exporter/${AWS::StackName}/iot/scheduling
      Type: String
      Value:
        Ref: ExecutionScheduling
      Tier: Standard

  AggregationStatisticParameter:
    Type: AWS::SSM::Parameter
    Properties:
      Name: !Sub /arduino/s3-exporter/${AWS::StackName}/iot/aggregation-statistic
      Type: String
      Value:
        Ref: ResolutionAggregationStatistic
      Tier: Standard

  CompressionParameter:
    Type: AWS::SSM::Parameter
    Properties:
      Name: !Sub /arduino/s3-exporter/${AWS::StackName}/enable_compression
      Type: String
      Value: "false"
      Tier: Standard

  AlignExtractionParameter:
    Type: AWS::SSM::Parameter
    Properties:
      Name: !Sub /arduino/s3-exporter/${AWS::StackName}/iot/align_with_time_window
      Type: String
      Value: "false"
      Tier: Standard

  # EventBridge Rule to trigger Lambda every hour
  EventBridgeRule:
    Type: AWS::Events::Rule
    Properties:
      ScheduleExpression:
        Fn::Sub: "rate(${ExecutionScheduling})"
      Targets:
        - Arn: !GetAtt LambdaFunction.Arn
          Id: LambdaTarget
          Input: '{}'
      State: ENABLED

  # Permission for EventBridge to invoke Lambda
  LambdaPermissionForEventBridge:
    Type: AWS::Lambda::Permission
    Properties:
      FunctionName: !Sub arduino-s3-csv-data-exporter-${AWS::StackName}
      Action: lambda:InvokeFunction
      Principal: events.amazonaws.com
      SourceArn: !GetAtt EventBridgeRule.Arn

Outputs:
  LambdaFunctionArn:
    Description: ARN of the deployed Lambda function.
    Value: !GetAtt LambdaFunction.Arn

  ArduinoS3LambdaExecutionRoleArn:
    Description: ARN of the IAM role associated with the Lambda function.
    Value: !GetAtt ArduinoS3LambdaExecutionRole.Arn