cloudformation.yml

---
AWSTemplateFormatVersion: '2010-09-09'
Transform: AWS::Serverless-2016-10-31
Description: 'iot stack, includes RDS for iot data and 1 lambda to import data from enphase'
Parameters:
  enphaseUserId:
    Type: String
  enphaseKey:
    Type: String
  enphaseSystemId:
    Type: String
  timezone:
    Type: String
  sleepBetweenRequests:
    Type: String
  startDate:
    Type: String
  endDate:
    Type: String
  dbUser:
    Type: String
  dbPassword:
    Type: String
  dbPort:
    Type: String
  dbName:
    Type: String

Resources:
  vpc:
    Type: "AWS::EC2::VPC"
    Properties:
      CidrBlock: 172.32.0.0/16
      EnableDnsSupport: true
      EnableDnsHostnames: true
      InstanceTenancy: default
      Tags:
        - Key: Name
          Value: iot-vpc

# Subnetting and routing

  privateSubnet1:
    Type: "AWS::EC2::Subnet"
    Properties:
      CidrBlock: 172.32.96.0/20
      VpcId: !Ref vpc
      AvailabilityZone: ap-southeast-2c
      Tags:
        - Key: Name
          Value: private-subnet-1
  privateSubnet2:
    Type: "AWS::EC2::Subnet"
    Properties:
      CidrBlock: 172.32.128.0/20
      VpcId: !Ref vpc
      AvailabilityZone: ap-southeast-2a
      Tags:
        - Key: Name
          Value: private-subnet-2
  publicSubnet1:
    Type: "AWS::EC2::Subnet"
    Properties:
      CidrBlock: 172.32.144.0/20
      VpcId: !Ref vpc
      MapPublicIpOnLaunch: true
      Tags:
        - Key: Name
          Value: public-subnet-1

  routeTablePublic:
    Type: "AWS::EC2::RouteTable"
    Properties:
      VpcId: !Ref vpc
      Tags:
        - Key: Name
          Value: route-table-public
  routeTablePrivate:
      Type: "AWS::EC2::RouteTable"
      Properties:
        VpcId: !Ref vpc
        Tags:
          - Key: Name
            Value: route-table-private

  allowAllRoutePrivate:
      Type: AWS::EC2::Route
      DependsOn:
        - natGateway
      Properties:
        RouteTableId: !Ref routeTablePrivate
        DestinationCidrBlock: 0.0.0.0/0
        NatGatewayId: !Ref natGateway

  allowAllRoutePublic:
      Type: AWS::EC2::Route
      DependsOn:
        - internetGateway
      Properties:
        RouteTableId: !Ref routeTablePublic
        DestinationCidrBlock: 0.0.0.0/0
        GatewayId: !Ref internetGateway

  routeTablePrivateSubnet1:
    Type: "AWS::EC2::SubnetRouteTableAssociation"
    Properties:
      RouteTableId: !Ref routeTablePrivate
      SubnetId: !Ref privateSubnet1
  routeTablePrivateSubnet2:
      Type: "AWS::EC2::SubnetRouteTableAssociation"
      Properties:
        RouteTableId: !Ref routeTablePrivate
        SubnetId: !Ref privateSubnet2
  routeTablePublicSubnet1:
      Type: "AWS::EC2::SubnetRouteTableAssociation"
      Properties:
        RouteTableId: !Ref routeTablePublic
        SubnetId: !Ref publicSubnet1

# Gateways

  publicEip:
    Type: "AWS::EC2::EIP"
    Properties:
      Domain: vpc

  internetGateway:
    Type: "AWS::EC2::InternetGateway"
    Properties:
      Tags:
        - Key: Name
          Value: internet gateway

  natGateway:
    Type: "AWS::EC2::NatGateway"
    Properties:
      AllocationId: !GetAtt publicEip.AllocationId
      SubnetId: !Ref publicSubnet1

  attachGateway:
    Type: "AWS::EC2::VPCGatewayAttachment"
    Properties:
      VpcId: !Ref vpc
      InternetGatewayId: !Ref internetGateway

  securityGroupRds:
    Type: "AWS::EC2::SecurityGroup"
    Properties:
      GroupName: rds-iotdb
      GroupDescription: RDS security group iotdb
      SecurityGroupIngress:
      - IpProtocol: tcp
        FromPort: '3306'
        ToPort: '3306'
        CidrIp: 172.32.96.0/20
      - IpProtocol: tcp
        FromPort: '3306'
        ToPort: '3306'
        CidrIp: 172.32.128.0/20
      Tags:
        - Key: Name
          Value: sg-rds-iotdb
      VpcId: !Ref vpc

  securityGroupBastion:
    Type: "AWS::EC2::SecurityGroup"
    DependsOn:
    - securityGroupRds
    Properties:
      GroupName: bastion
      GroupDescription: Bastion security group
      SecurityGroupIngress:
      - IpProtocol: tcp
        FromPort: '22'
        ToPort: '22'
        CidrIp: 0.0.0.0/0
      - IpProtocol: tcp
        FromPort: '3306'
        ToPort: '3306'
        CidrIp: 0.0.0.0/0
      SecurityGroupEgress:
      - IpProtocol: tcp
        FromPort: '22'
        ToPort: '22'
        DestinationSecurityGroupId: !Ref securityGroupRds
      - IpProtocol: tcp
        FromPort: '3306'
        ToPort: '3306'
        DestinationSecurityGroupId: !Ref securityGroupRds
      Tags:
        - Key: Name
          Value: sg-bastion
      VpcId: !Ref vpc

  securityGroupIngressRdsFromBastion:
    Type: "AWS::EC2::SecurityGroupIngress"
    DependsOn:
    - securityGroupRds
    - securityGroupBastion
    Properties:
      IpProtocol: tcp
      FromPort: '3306'
      ToPort: '3306'
      Description: RDS inbound from bastion
      GroupId: !Ref securityGroupRds
      SourceSecurityGroupId: !Ref securityGroupBastion

  bastionInstance:
    Type: "AWS::EC2::Instance"
    DependsOn:
    - securityGroupBastion
    - publicSubnet1
    - routeTablePublic
    Properties:
      InstanceType: t2.micro
      ImageId: ami-ff4ea59d
      KeyName: bastion-keypair
      NetworkInterfaces:
        - AssociatePublicIpAddress: true
          DeleteOnTermination: true
          Description: Public IP
          DeviceIndex: 0
          GroupSet:
            - !Ref securityGroupBastion
          SubnetId: !Ref publicSubnet1
      SourceDestCheck: true
      Tags:
        - Key: Name
          Value: bastion-host
      Tenancy: default


  dbSubnetGroup:
    Type: "AWS::RDS::DBSubnetGroup"
    DependsOn:
    - privateSubnet1
    - privateSubnet2
    Properties:
      DBSubnetGroupDescription: private subnets for rds
      SubnetIds:
        - !Ref privateSubnet1
        - !Ref privateSubnet2
      Tags:
        - Key: Name
          Value: private-subnet

  FunctionIAMRole:
      Type: AWS::IAM::Role
      Properties:
        AssumeRolePolicyDocument:
          Statement:
          - Effect: Allow
            Principal:
              Service:
              - lambda.amazonaws.com
            Action:
            - sts:AssumeRole
        ManagedPolicyArns:
        - arn:aws:iam::aws:policy/service-role/AWSLambdaENIManagementAccess
        - arn:aws:iam::aws:policy/AWSXrayWriteOnlyAccess
        - arn:aws:iam::aws:policy/AmazonRDSFullAccess
        - arn:aws:iam::aws:policy/AWSLambdaFullAccess
        Policies:
        - PolicyName: 'custom-policy'
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
            - Effect: Allow
              Action:
              - rds:*
              Resource:
              - arn:aws:rds:::*
            - Effect: Allow
              Action:
              - s3:*
              Resource:
              - arn:aws:s3:::iotdb-bucket

  mysql:
    Type: "AWS::RDS::DBInstance"
    Properties:
      DBName: !Ref dbName
      DBInstanceClass: db.t2.micro
      DBInstanceIdentifier: !Ref dbName
      Engine: "MySQL"
      EngineVersion: "5.7.19"
      AllocatedStorage: 20
      StorageType: gp2
      MasterUsername: !Ref dbUser
      MasterUserPassword: !Ref dbPassword
      DBSubnetGroupName: !Ref dbSubnetGroup
      VPCSecurityGroups:
        - !Ref securityGroupRds
      Tags:
        - Key: "Name"
          Value: !Ref dbName

  Function:
      Type: AWS::Serverless::Function
      DependsOn:
      - FunctionIAMRole
      Properties:
        Handler: stats_to_db.lambda_handler
        Runtime: python3.6
        CodeUri: ./node-importer.zip
        MemorySize: 128
        Timeout: 30
        Role: !GetAtt FunctionIAMRole.Arn
        FunctionName: enphase-stats-to-db
        VpcConfig:
          SecurityGroupIds:
            - !Ref securityGroupRds
          SubnetIds:
            - !Ref privateSubnet1
            - !Ref privateSubnet2
        Environment:
          Variables:
            ENHPASE_USER_ID: !Ref enphaseUserId
            ENPHASE_KEY: !Ref enphaseKey
            ENPHASE_SYSTEM_ID: !Ref enphaseSystemId
            TIME_ZONE: !Ref timezone
            SLEEP_BETWEEN_REQUESTS: !Ref sleepBetweenRequests
            START_DATE: !Ref startDate
            END_DATE: !Ref endDate
            DB_HOST: !GetAtt mysql.Endpoint.Address
            DB_USER: !Ref dbUser
            DB_PASSWORD: !Ref dbPassword
            DB_PORT: !Ref dbPort
            DB_NAME: !Ref dbName
        Events:
          ScheduleEvent:
            Type: Schedule
            Properties:
              Schedule: rate(1 hour)