---
AWSTemplateFormatVersion: 2010-09-09
Description: 'Master manifest for ADP Data Governance usecase'
Metadata:
  AWS::CloudFormation::Interface:
    ParameterGroups:
      - Label:
          default: General configuration
        Parameters:
          - ADPS3BucketName
          - ADPS3BucketRegion
          - BasePlatformVersion
          - UseCaseVersion
          - DnsZoneType
          - EnableExternalAccess
      - Label:
          default: Application configuration
        Parameters:
          - DockerRegistry

Parameters:
  ADPS3BucketName:
    Type: String
    AllowedPattern: ^[0-9a-z]+([0-9a-z\.\-]*[0-9a-z])*$
    ConstraintDescription:
      'Bucket name can include numbers, lowercase letters, and hyphens (-).
       It cannot start or end with a hyphen (-).'
    Description:
      'ADP bucket name with cloudformation scripts can include numbers,
      lowercase letters, and hyphens (-). It cannot start or end with a hyphen (-).'
    Default: 'griddynamics-analytical-data-platform-releases'
  ADPS3BucketRegion:
    Type: String
    Description: 'The AWS Region where the ADP S3 bucket (ADPS3BucketName) is hosted.'
    Default: 'us-east-1'
  BasePlatformVersion:
    Type: String
    Description: 'BasePlatform build version.'
    Default: '2023-02-16-marketplace'
  UseCaseVersion:
    Type: String
    Description: 'UseCase build version.'
    Default: '2023-02-16-marketplace'

  DockerRegistry:
    Type: String
    Description: 'Docker registry.'
    Default: '125667932402.dkr.ecr.us-east-1.amazonaws.com'

  EnableExternalAccess:
    Type: String
    Description:
      'Allow or deny access to UI from outside of VPC (disables ELB for EKS-based applications).
      Disabled by default to minimize unauthorized access.'
    AllowedValues: [ "Enabled", "Disabled" ]
    Default: 'Disabled'
  DnsZoneType:
    Type: String
    Description:
      'Should match with ADP Base Platform settings. Choose public if you already delegated responsibility for the subdomain to Route 53. This subdomain
      should be configured in Route53HostedZoneName. Otherwise choose a private DNS zone.'
    AllowedValues: [ "public", "private" ]
    Default: 'private'

Conditions:
  RunningInAnotherRegion: !Not [!Equals [!Ref ADPS3BucketRegion, !Ref "AWS::Region"]]
  EnableExternalAccessCondition: !And
    - !Equals [!Ref DnsZoneType, 'private']
    - !Equals [!Ref EnableExternalAccess, 'Enabled']

Resources:
  BasePlatformUtils:
    Type: AWS::CloudFormation::Stack
    Properties:
      Tags:
        - Key: 'Name'
          Value: 'BasePlatformUtils'
        - Key: 'Owner'
          Value: !ImportValue ADPPlatformOwner
        - Key: 'Project'
          Value: 'ADP'
      TemplateURL: !Sub 'https://${ADPS3BucketName}.s3.${ADPS3BucketRegion}.${AWS::URLSuffix}/platform/${BasePlatformVersion}/cloudformation/l0/base/utils.yaml'
      Parameters:
        ResourcePrefix: !ImportValue ADPResourcePrefix
        ADPS3BucketName: !Sub
          - '${BucketName}'
          - BucketName: !If [RunningInAnotherRegion, !ImportValue ADPS3BucketAnotherRegion, !Ref ADPS3BucketName]
        BasePlatformVersion: !Ref BasePlatformVersion

  BasePlatformInputs:
    DependsOn: BasePlatformUtils
    Type: AWS::CloudFormation::CustomResource
    Properties:
      ServiceToken: !GetAtt BasePlatformUtils.Outputs.BasePlatformInputsLambdaArn
      BpStateBucket: !Sub
        - "${ResourcePrefix}-platform-state-${AWS::AccountId}"
        - ResourcePrefix: !ImportValue ADPResourcePrefix

  BasePlatformOutputs:
    DependsOn: BasePlatformInputs
    Type: AWS::CloudFormation::CustomResource
    Properties:
      ServiceToken: !GetAtt BasePlatformUtils.Outputs.BasePlatformOutputsLambdaArn
      BpStateBucket: !Sub
        - "${ResourcePrefix}-platform-state-${AWS::AccountId}"
        - ResourcePrefix: !ImportValue ADPResourcePrefix

  BasePlatformVPCOutputs:
    DependsOn: BasePlatformOutputs
    Type: AWS::CloudFormation::CustomResource
    Properties:
      ServiceToken: !GetAtt BasePlatformUtils.Outputs.BasePlatformOutputsLambdaArn
      StackName: "VPCStack"
      BpStateBucket: !Sub
        - "${ResourcePrefix}-platform-state-${AWS::AccountId}"
        - ResourcePrefix: !ImportValue ADPResourcePrefix

  BasePlatformCloudMapOutputs:
    DependsOn: BasePlatformVPCOutputs
    Type: AWS::CloudFormation::CustomResource
    Properties:
      ServiceToken: !GetAtt BasePlatformUtils.Outputs.BasePlatformOutputsLambdaArn
      StackName: "CloudMapStack"
      BpStateBucket: !Sub
        - "${ResourcePrefix}-platform-state-${AWS::AccountId}"
        - ResourcePrefix: !ImportValue ADPResourcePrefix

  BasePlatformLambdaFunctionsOutputs:
    DependsOn: BasePlatformCloudMapOutputs
    Type: AWS::CloudFormation::CustomResource
    Properties:
      ServiceToken: !GetAtt BasePlatformUtils.Outputs.BasePlatformOutputsLambdaArn
      StackName: "BasePlatformLambdaFunctions"
      BpStateBucket: !Sub
        - "${ResourcePrefix}-platform-state-${AWS::AccountId}"
        - ResourcePrefix: !ImportValue ADPResourcePrefix

  InitDeploymentBucketOutputs:
    Condition: RunningInAnotherRegion
    DependsOn: BasePlatformLambdaFunctionsOutputs
    Type: AWS::CloudFormation::CustomResource
    Properties:
      ServiceToken: !GetAtt BasePlatformUtils.Outputs.BasePlatformOutputsLambdaArn
      StackName: "InitDeploymentBucket"
      BpStateBucket: !Sub
        - "${ResourcePrefix}-platform-state-${AWS::AccountId}"
        - ResourcePrefix: !ImportValue ADPResourcePrefix

  CopyDeploymentFiles:
    Condition: RunningInAnotherRegion
    DependsOn: InitDeploymentBucketOutputs
    Type: Custom::CopyFiles
    Properties:
      ServiceToken: !GetAtt InitDeploymentBucketOutputs.CopyFilesFunctionArn
      DestBucket: !GetAtt InitDeploymentBucketOutputs.FilesBucket
      SourceBucket: !Ref ADPS3BucketName
      Prefix: !Sub 'applications/adp/${UseCaseVersion}/'

  BasePlatformKubernetes:
    DependsOn: BasePlatformCloudMapOutputs
    Type: AWS::CloudFormation::CustomResource
    Properties:
      ServiceToken: !GetAtt BasePlatformUtils.Outputs.BasePlatformLambdaOperateArn
      BpStateBucket: !GetAtt BasePlatformUtils.Outputs.BasePlatformStateBucketName
      BpGdComponent: "datagovernance"
      BpAwsComponent: "Kubernetes"
      BpReferenceComponentName: "KubernetesStack"

  BasePlatformKubernetesExtra:
    DependsOn: BasePlatformKubernetes
    Type: AWS::CloudFormation::CustomResource
    Properties:
      ServiceToken: !GetAtt BasePlatformUtils.Outputs.BasePlatformLambdaOperateArn
      BpStateBucket: !GetAtt BasePlatformUtils.Outputs.BasePlatformStateBucketName
      BpGdComponent: "datagovernance"
      BpAwsComponent: "KubernetesExtra"
      BpReferenceComponentName: "KubernetesExtraStack"

  BasePlatformAirflow:
    DependsOn: BasePlatformKubernetesExtra
    Type: AWS::CloudFormation::CustomResource
    Properties:
      ServiceToken: !GetAtt BasePlatformUtils.Outputs.BasePlatformLambdaOperateArn
      BpStateBucket: !GetAtt BasePlatformUtils.Outputs.BasePlatformStateBucketName
      BpGdComponent: "datagovernance"
      BpAwsComponent: "Airflow"
      BpReferenceComponentName: "AirflowStack"

  BasePlatformElastic:
    DependsOn: BasePlatformAirflow
    Type: AWS::CloudFormation::CustomResource
    Properties:
      ServiceToken: !GetAtt BasePlatformUtils.Outputs.BasePlatformLambdaOperateArn
      BpStateBucket: !GetAtt BasePlatformUtils.Outputs.BasePlatformStateBucketName
      BpGdComponent: "datagovernance"
      BpAwsComponent: "Elastic"
      BpReferenceComponentName: "ElasticStack"

  BasePlatformEMR:
    DependsOn: BasePlatformElastic
    Type: AWS::CloudFormation::CustomResource
    Properties:
      ServiceToken: !GetAtt BasePlatformUtils.Outputs.BasePlatformLambdaOperateArn
      BpStateBucket: !GetAtt BasePlatformUtils.Outputs.BasePlatformStateBucketName
      BpGdComponent: "datagovernance"
      BpAwsComponent: "EMR"
      BpReferenceComponentName: "EMRStack"

  EmrSGIngressLivy:
    Type: AWS::EC2::SecurityGroupIngress
    Properties:
      IpProtocol: tcp
      FromPort: 8998
      ToPort: 8998
      SourceSecurityGroupId: !GetAtt BasePlatformKubernetes.ControlPlaneSecurityGroup
      GroupId: !GetAtt BasePlatformEMR.EmrMasterSecurityGroup

  GetAirflowSecretExecution:
    DependsOn:
      - BasePlatformLambdaFunctionsOutputs
      - BasePlatformAirflow
    Type: AWS::CloudFormation::CustomResource
    Properties:
      ServiceToken: !GetAtt BasePlatformLambdaFunctionsOutputs.BPGetSecretLambdaArn
      Name: !GetAtt BasePlatformAirflow.AirflowSecret

  GetAtlasSecretExecution:
    DependsOn:
      - BasePlatformLambdaFunctionsOutputs
      - BasePlatformAtlas
    Type: AWS::CloudFormation::CustomResource
    Properties:
      ServiceToken: !GetAtt BasePlatformLambdaFunctionsOutputs.BPGetSecretLambdaArn
      Name: !GetAtt BasePlatformAtlas.AtlasSecret

  BasePlatformZooKeeper:
    DependsOn: BasePlatformEMR
    Type: AWS::CloudFormation::CustomResource
    Properties:
      ServiceToken: !GetAtt BasePlatformUtils.Outputs.BasePlatformLambdaOperateArn
      BpStateBucket: !GetAtt BasePlatformUtils.Outputs.BasePlatformStateBucketName
      BpGdComponent: "datagovernance"
      BpAwsComponent: "ZooKeeper"
      BpReferenceComponentName: "ZooKeeperStack"

  BasePlatformKafka:
    DependsOn: BasePlatformZooKeeper
    Type: AWS::CloudFormation::CustomResource
    Properties:
      ServiceToken: !GetAtt BasePlatformUtils.Outputs.BasePlatformLambdaOperateArn
      BpStateBucket: !GetAtt BasePlatformUtils.Outputs.BasePlatformStateBucketName
      BpGdComponent: "datagovernance"
      BpAwsComponent: "Kafka"
      BpReferenceComponentName: "KafkaStack"

  BasePlatformCassandra:
    DependsOn: BasePlatformKafka
    Type: AWS::CloudFormation::CustomResource
    Properties:
      ServiceToken: !GetAtt BasePlatformUtils.Outputs.BasePlatformLambdaOperateArn
      BpStateBucket: !GetAtt BasePlatformUtils.Outputs.BasePlatformStateBucketName
      BpGdComponent: "datagovernance"
      BpAwsComponent: "Cassandra"
      BpReferenceComponentName: "CassandraStack"

  BasePlatformAtlas:
    DependsOn:
      - BasePlatformCassandra
      - BasePlatformZooKeeper
      - BasePlatformKafka
    Type: AWS::CloudFormation::CustomResource
    Properties:
      ServiceToken: !GetAtt BasePlatformUtils.Outputs.BasePlatformLambdaOperateArn
      BpStateBucket: !GetAtt BasePlatformUtils.Outputs.BasePlatformStateBucketName
      BpGdComponent: "datagovernance"
      BpAwsComponent: "Atlas"
      BpReferenceComponentName: "AtlasStack"

  AtlasLambdaSecurityGroup:
    DependsOn: BasePlatformAtlas
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: Dummy SG for Atlas lambda functions
      VpcId: !GetAtt BasePlatformVPCOutputs.VPCID

  AtlasInitRole:
    DependsOn: BasePlatformAtlas
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Statement:
          - Action: ['sts:AssumeRole']
            Effect: Allow
            Principal:
              Service: [lambda.amazonaws.com]
        Version: '2012-10-17'
      Path: /
      Policies:
        - PolicyName: !Sub
            - ${ResourcePrefix}-AtlasInitRole-LambdaRole
            - ResourcePrefix: !ImportValue ADPResourcePrefix
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Action:
                  - 'logs:CreateLogGroup'
                  - 'logs:CreateLogStream'
                  - 'logs:PutLogEvents'
                Effect: Allow
                Resource: !Sub "arn:${AWS::Partition}:logs:*:*:*"
              - Action:
                  - "servicediscovery:ListServices"
                  - "servicediscovery:ListOperations"
                  - "servicediscovery:GetOperation"
                  - "servicediscovery:DiscoverInstances"
                  - "servicediscovery:ListNamespaces"
                  - "servicediscovery:GetInstancesHealthStatus"
                  - "servicediscovery:GetNamespace"
                  - "servicediscovery:GetInstance"
                  - "servicediscovery:GetService"
                  - "servicediscovery:ListInstances"
                  - "ec2:CreateNetworkInterface"
                  - "ec2:DescribeNetworkInterfaces"
                  - "ec2:DeleteNetworkInterface"
                Effect: Allow
                Resource: "*"
              - Effect: Allow
                Action: s3:GetObject
                Resource: !Sub
                  - "arn:${AWS::Partition}:s3:::${BucketName}/applications/adp/${UseCaseVersion}/dags/*"
                  - BucketName: !If [RunningInAnotherRegion, !ImportValue ADPS3BucketAnotherRegion, !Ref ADPS3BucketName]
              - Effect: Allow
                Action: 's3:*'
                Resource:
                  - !Sub
                    - 'arn:${AWS::Partition}:s3:::${BucketName}'
                    - BucketName: !If [RunningInAnotherRegion, !ImportValue ADPS3BucketAnotherRegion, !Ref ADPS3BucketName]
                  - !Sub
                    - 'arn:${AWS::Partition}:s3:::${BucketName}/*'
                    - BucketName: !If [RunningInAnotherRegion, !ImportValue ADPS3BucketAnotherRegion, !Ref ADPS3BucketName]
                  - !Sub
                    - 'arn:${AWS::Partition}:s3:::${SyncerDagS3Bucket}'
                    - SyncerDagS3Bucket: !GetAtt BasePlatformAirflow.SyncerDagS3Bucket
                  - !Sub
                    - 'arn:${AWS::Partition}:s3:::${SyncerDagS3Bucket}/*'
                    - SyncerDagS3Bucket: !GetAtt BasePlatformAirflow.SyncerDagS3Bucket

  AtlasInitLambda:
    DependsOn: AtlasInitRole
    Type: "AWS::Lambda::Function"
    Properties:
      Handler: batch_s3_init.lambda_handler
      MemorySize: 128
      Role: !GetAtt AtlasInitRole.Arn
      Runtime: python3.7
      Timeout: 900
      Code:
        S3Bucket: !Sub
          - '${BucketName}'
          - BucketName: !If [RunningInAnotherRegion, !ImportValue ADPS3BucketAnotherRegion, !Ref ADPS3BucketName]
        S3Key: !Sub 'platform/${BasePlatformVersion}/functions/packages/batchInit/lambda.zip'
      VpcConfig:
        SecurityGroupIds: [!Ref AtlasLambdaSecurityGroup]
        SubnetIds:
          - !GetAtt BasePlatformVPCOutputs.PrivateSubnet1AID
          - !GetAtt BasePlatformVPCOutputs.PrivateSubnet2AID
          - !GetAtt BasePlatformVPCOutputs.PrivateSubnet3AID
      Tags:
        - Key: 'Name'
          Value: 'AtlasInitLambda'
        - Key: 'Owner'
          Value: !ImportValue ADPPlatformOwner
        - Key: 'Project'
          Value: 'ADP'

  AtlasInitLambdaExec:
    DependsOn: AtlasInitLambda
    Type: "Custom::AtlasInitLambda"
    Properties:
      ServiceToken: !GetAtt AtlasInitLambda.Arn
      Namespace: !ImportValue ADPResourcePrefix
      AirflowServiceName: airflow
      AirflowUsername: !GetAtt GetAirflowSecretExecution.username
      AirflowPassword: !GetAtt GetAirflowSecretExecution.password
      TargetBucket: !GetAtt BasePlatformAirflow.SyncerDagS3Bucket
      TargetPrefix: "dags"
      SourceBucket: !Sub
        - '${BucketName}'
        - BucketName: !If [RunningInAnotherRegion, !ImportValue ADPS3BucketAnotherRegion, !Ref ADPS3BucketName]
      SourcePrefix: !Sub "applications/adp/${UseCaseVersion}/dags/"
      Objects:
        - dg_dags.zip
      AirflowProperties: {
            "atlas_discovery": {
              "namespace": !ImportValue ADPResourcePrefix,
              "region_name": !Ref "AWS::Region"
              },
            "atlas_aws_secret_name": !Join ['', [!ImportValue ADPResourcePrefix, '-atlas-secret' ]],
            "atlas_lineage_conf": {
              "atlas_enable_lineage": "True",
              "atlas_create_if_not_exists": "True",
              "atlas_fail_if_lineage_error": "False",
              "atlas_timeout": "600"
              }
            }
      AirflowConnections:
        {
        "adp_aws_default": {
            "extra": {
              "region_name": !Ref 'AWS::Region'
            }
            },
        "atlas_default": {
          "conn_type": "http",
          "host": !GetAtt GetAtlasSecretExecution.host,
          "port": !GetAtt GetAtlasSecretExecution.port,
          "login": !GetAtt GetAtlasSecretExecution.username,
          "password": !GetAtt GetAtlasSecretExecution.password
          }
        }

Outputs:
  AirflowELB:
    Value: !GetAtt BasePlatformAirflow.AirflowELB
    Description: Airflow service ELB address (should be enabled in Base Platform first)

  AirflowFQDN:
    Value: !GetAtt BasePlatformAirflow.AirflowFQDN
    Description: Airflow service DNS address (private zone will not be accessible form outside)

  AirflowSecret:
    Value: !GetAtt BasePlatformAirflow.AirflowSecret
    Description: Airflow service secret

  AtlasELB:
    Condition: EnableExternalAccessCondition
    Value: !GetAtt BasePlatformAtlas.AtlasELB
    Description: Atlas service ELB address (will not work if external access is disabled)

  AtlasFQDN:
    Value: !GetAtt BasePlatformAtlas.AtlasFQDN
    Description: Atlas service DNS address (private zone will not be accessible form outside)

  AtlasSecret:
    Value: !GetAtt BasePlatformAtlas.AtlasSecret
    Description: Atlas service secret
