template.yaml

AWSTemplateFormatVersion: "2010-09-09"
Transform: AWS::Serverless-2016-10-31
Description: >
  serverless-video-transcoder

Metadata:
  AWS::ServerlessRepo::Application:
    Name: serverless-video-transcoder
    Description: Serverless Video Transcoder
    Author: Harold Sun
    SpdxLicenseId: Apache-2.0
    LicenseUrl: LICENSE
    ReadmeUrl: README.md
    Labels: ['S3', 'Lambda', 'Step_Functions', 'EFS', 'Video', 'Transcode']
    HomePageUrl: https://github.com/bnusunny/serverless-video-transcoder
    SemanticVersion: 0.0.2
    SourceCodeUrl: https://github.com/bnusunny/serverless-video-transcoder


Parameters:

  EnvironmentName:
    Description: An environment name that is prefixed to resource names
    Type: String
    Default: Dev

  VpcCIDR:
    Description: Please enter the IP range (CIDR notation) for this VPC
    Type: String
    AllowedPattern: '^(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])(\/([0-9]|[1-2][0-9]|3[0-2]))$'
    Default: 10.192.0.0/16

  PublicSubnet1CIDR:
    Description: Please enter the IP range (CIDR notation) for the public subnet in the first Availability Zone
    Type: String
    AllowedPattern: '^(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])(\/([0-9]|[1-2][0-9]|3[0-2]))$'
    Default: 10.192.0.0/20

  PublicSubnet2CIDR:
    Description: Please enter the IP range (CIDR notation) for the public subnet in the second Availability Zone
    Type: String
    AllowedPattern: '^(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])(\/([0-9]|[1-2][0-9]|3[0-2]))$'
    Default: 10.192.16.0/20

  VideosBucketName:
    Type: String
    Description: "REQUIRED: Unique S3 bucket name to use for the app."

  EFSpath:
    Type: String
    Default: /mnt/efs


Globals:
  Function:
    Timeout: 30
    Runtime: python3.7
    MemorySize: 512
    Tracing: Active
    Layers:
      - !Sub "arn:${AWS::Partition}:lambda:${AWS::Region}:580247275435:layer:LambdaInsightsExtension:12"

Resources:

  VideosBucket:
    Type: AWS::S3::Bucket
    Properties:
      BucketName: !Ref VideosBucketName

  JobTable:
    Type: AWS::Serverless::SimpleTable

  FFmpegLayer:
    Type: AWS::Serverless::LayerVersion
    Properties:
      ContentUri: layers/ffmpeg_layer
      CompatibleRuntimes:
        - python3.8
        - python3.7
        - python3.6

  TriggerFunction:
    Type: AWS::Serverless::Function
    Properties:
      CodeUri: functions/trigger_statemachine_function/
      Handler: app.lambda_handler
      Policies:
        - S3ReadPolicy:
            BucketName: !Ref VideosBucketName
        - DynamoDBWritePolicy:
            TableName: !Ref JobTable
        - StepFunctionsExecutionPolicy:
            StateMachineName: !GetAtt MainStateMachine.Name
        - CloudWatchLambdaInsightsExecutionRolePolicy
      Environment:
        Variables:
          JOB_TABLE: !Ref JobTable
          SFN_ARN: !Ref MainStateMachine
          DEFAULT_SEGMENT_TIME: 60
          ENABLE_HLS: 0
      Layers:
        - !Ref FFmpegLayer
      Events:
        S3NewObjectEvent:
          Type: S3
          Properties:
            Bucket: !Ref VideosBucket
            Events: s3:ObjectCreated:*
            Filter:
              S3Key:
                Rules:
                  - Name: suffix
                    Value: ".mp4"
                  - Name: prefix
                    Value: "input/"

  MainStateMachine:
    Type: AWS::Serverless::StateMachine
    Properties:
      DefinitionUri: statemachines/main.asl.json
      Tracing:
        Enabled: True
      DefinitionSubstitutions:
        ControllerFunctionArn: !GetAtt ControllerFunction.Arn
        TranscodeVideoFunctionArn: !GetAtt TranscodeVideoFunction.Arn
        MergeVideoFunctionArn: !GetAtt MergeVideoFunction.Arn
      Policies:
        - CloudWatchPutMetricPolicy: {}
        - CloudWatchLogsFullAccess
        - LambdaInvokePolicy:
            FunctionName: !Ref ControllerFunction
        - LambdaInvokePolicy:
            FunctionName: !Ref TranscodeVideoFunction
        - LambdaInvokePolicy:
            FunctionName: !Ref MergeVideoFunction
        - CloudWatchLambdaInsightsExecutionRolePolicy
        - AWSXRayDaemonWriteAccess

  ControllerFunction:
    Type: AWS::Serverless::Function
    Properties:
      CodeUri: functions/controller_function/
      Handler: app.lambda_handler
      MemorySize: 10240
      Timeout: 900
      Environment:
        Variables:
          EFS_PATH: !Ref EFSpath
          PARALLEL_GROUPS: 3
          DEFAULT_CONCURENCY: 30
          DEFAULT_SEGMENT_TIME: 30
      Layers:
        - !Ref FFmpegLayer
      Policies:
        - S3ReadPolicy:
            BucketName: !Ref VideosBucketName
        - S3WritePolicy:
            BucketName: !Ref VideosBucketName
        - EFSWriteAccessPolicy:
            FileSystem: !Ref FileSystemResource
            AccessPoint: !Ref AccessPointResource
        - CloudWatchLambdaInsightsExecutionRolePolicy
      VpcConfig:
        SecurityGroupIds: 
        - !GetAtt VPC.DefaultSecurityGroup
        SubnetIds: 
        - !Ref PublicSubnet1
        - !Ref PublicSubnet2
      FileSystemConfigs:
        - Arn: !Sub "arn:${AWS::Partition}:elasticfilesystem:${AWS::Region}:${AWS::AccountId}:access-point/${AccessPointResource}"
          LocalMountPath: !Ref EFSpath
    DependsOn: ["MountTargetResource1", "MountTargetResource2"]

  TranscodeVideoFunction:
    Type: AWS::Serverless::Function
    Properties:
      CodeUri: functions/transcode_video_function/
      Handler: app.lambda_handler
      MemorySize: 10240
      Timeout: 900
      Environment:
        Variables:
          EFS_PATH: !Ref EFSpath
      Layers:
        - !Ref FFmpegLayer
      Policies:
        - S3ReadPolicy:
            BucketName: !Ref VideosBucketName
        - S3WritePolicy:
            BucketName: !Ref VideosBucketName
        - EFSWriteAccessPolicy:
            FileSystem: !Ref FileSystemResource
            AccessPoint: !Ref AccessPointResource
        - CloudWatchLambdaInsightsExecutionRolePolicy
      VpcConfig:
        SecurityGroupIds: 
        - !GetAtt VPC.DefaultSecurityGroup
        SubnetIds: 
        - !Ref PublicSubnet1
        - !Ref PublicSubnet2
      FileSystemConfigs:
        - Arn: !Sub "arn:${AWS::Partition}:elasticfilesystem:${AWS::Region}:${AWS::AccountId}:access-point/${AccessPointResource}"
          LocalMountPath: !Ref EFSpath
    DependsOn: ["MountTargetResource1", "MountTargetResource2"]

  MergeVideoFunction:
    Type: AWS::Serverless::Function
    Properties:
      CodeUri: functions/merge_video_function/
      Handler: app.lambda_handler
      MemorySize: 10240
      Timeout: 900
      Environment:
        Variables:
          EFS_PATH: !Ref EFSpath
          MEDIA_BUCKET: !Ref VideosBucketName
      Layers:
        - !Ref FFmpegLayer
      Policies:
        - S3ReadPolicy:
            BucketName: !Ref VideosBucketName
        - S3WritePolicy:
            BucketName: !Ref VideosBucketName
        - EFSWriteAccessPolicy:
            FileSystem: !Ref FileSystemResource
            AccessPoint: !Ref AccessPointResource
        - CloudWatchLambdaInsightsExecutionRolePolicy
      VpcConfig:
        SecurityGroupIds: 
        - !GetAtt VPC.DefaultSecurityGroup
        SubnetIds: 
        - !Ref PublicSubnet1
        - !Ref PublicSubnet2
      FileSystemConfigs:
        - Arn: !Sub "arn:${AWS::Partition}:elasticfilesystem:${AWS::Region}:${AWS::AccountId}:access-point/${AccessPointResource}"
          LocalMountPath: !Ref EFSpath
    DependsOn: ["MountTargetResource1", "MountTargetResource2"]

  VPC:
    Type: AWS::EC2::VPC
    Properties:
      CidrBlock: !Ref VpcCIDR
      EnableDnsSupport: true
      EnableDnsHostnames: true
      Tags:
        - Key: Name
          Value: !Ref EnvironmentName

  InternetGateway:
    Type: AWS::EC2::InternetGateway
    Properties:
      Tags:
        - Key: Name
          Value: !Ref EnvironmentName

  InternetGatewayAttachment:
    Type: AWS::EC2::VPCGatewayAttachment
    Properties:
      InternetGatewayId: !Ref InternetGateway
      VpcId: !Ref VPC

  PublicSubnet1:
    Type: AWS::EC2::Subnet
    Properties:
      VpcId: !Ref VPC
      AvailabilityZone: !Select [ 0, !GetAZs '' ]
      CidrBlock: !Ref PublicSubnet1CIDR
      MapPublicIpOnLaunch: true
      Tags:
        - Key: Name
          Value: !Sub ${EnvironmentName} Public Subnet (AZ1)

  PublicSubnet2:
    Type: AWS::EC2::Subnet
    Properties:
      VpcId: !Ref VPC
      AvailabilityZone: !Select [ 1, !GetAZs  '' ]
      CidrBlock: !Ref PublicSubnet2CIDR
      MapPublicIpOnLaunch: true
      Tags:
        - Key: Name
          Value: !Sub ${EnvironmentName} Public Subnet (AZ2)

  PublicRouteTable:
    Type: AWS::EC2::RouteTable
    Properties:
      VpcId: !Ref VPC
      Tags:
        - Key: Name
          Value: !Sub ${EnvironmentName} Public Routes

  DefaultPublicRoute:
    Type: AWS::EC2::Route
    DependsOn: InternetGatewayAttachment
    Properties:
      RouteTableId: !Ref PublicRouteTable
      DestinationCidrBlock: 0.0.0.0/0
      GatewayId: !Ref InternetGateway

  PublicSubnet1RouteTableAssociation:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      RouteTableId: !Ref PublicRouteTable
      SubnetId: !Ref PublicSubnet1

  PublicSubnet2RouteTableAssociation:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      RouteTableId: !Ref PublicRouteTable
      SubnetId: !Ref PublicSubnet2

  EndpointS3:
    Type: 'AWS::EC2::VPCEndpoint'
    Properties:
      RouteTableIds: [!Ref PublicRouteTable]
      ServiceName: !Sub 'com.amazonaws.${AWS::Region}.s3'
      VpcId: !Ref VPC

  EndpointDDB:
    Type: 'AWS::EC2::VPCEndpoint'
    Properties:
      RouteTableIds: [!Ref PublicRouteTable]
      ServiceName: !Sub 'com.amazonaws.${AWS::Region}.dynamodb'
      VpcId: !Ref VPC

  FileSystemResource:
    Type: 'AWS::EFS::FileSystem'
    Properties:
      PerformanceMode: generalPurpose
      LifecyclePolicies:
        - TransitionToIA: AFTER_30_DAYS

  MountTargetResource1:
    Type: AWS::EFS::MountTarget
    Properties:
      FileSystemId: !Ref FileSystemResource
      SubnetId: !Ref PublicSubnet1
      SecurityGroups:
      - !GetAtt VPC.DefaultSecurityGroup

  MountTargetResource2:
    Type: AWS::EFS::MountTarget
    Properties:
      FileSystemId: !Ref FileSystemResource
      SubnetId: !Ref PublicSubnet2
      SecurityGroups:
      - !GetAtt VPC.DefaultSecurityGroup

  AccessPointResource:
    Type: 'AWS::EFS::AccessPoint'
    Properties:
      FileSystemId: !Ref FileSystemResource
      PosixUser:
        Uid: "1000"
        Gid: "1000"
      RootDirectory:
        CreationInfo:
          OwnerGid: "1000"
          OwnerUid: "1000"
          Permissions: "0755"
        Path: "/lambda"

Outputs:
  VPC:
    Description: A reference to the created VPC
    Value: !Ref VPC

  PublicSubnets:
    Description: A list of the public subnets
    Value: !Join [ ",", [ !Ref PublicSubnet1, !Ref PublicSubnet2 ]]

  PublicSubnet1:
    Description: A reference to the public subnet in the 1st Availability Zone
    Value: !Ref PublicSubnet1

  PublicSubnet2:
    Description: A reference to the public subnet in the 2nd Availability Zone
    Value: !Ref PublicSubnet2

  DefaultSecurityGroup:
    Description: Default Security group
    Value: !GetAtt VPC.DefaultSecurityGroup

  EfsFileSystem: 
    Description: EFS File System ID
    Value: !Ref FileSystemResource

  EfsAccessPoint: 
    Description: EFS Access Point ID
    Value: !Ref AccessPointResource

  VideosBucketName:
    Description: S3 Video bucket name
    Value: !Ref VideosBucketName