template.yaml

AWSTemplateFormatVersion: '2010-09-09'
Transform: AWS::Serverless-2016-10-31
Description: >
  serverless-rds-proxy-demo

  Sample SAM Template for serverless-rds-proxy-demo

Parameters:
  Vpc:
    Type: AWS::EC2::VPC::Id
    Description: "Vpc where function will be deployed"
  Subnets:
    Type: List<AWS::EC2::Subnet::Id>
    Description: "Subnets where function will be deployed. Provide at least two"
  RdsProxyEndpoint:
    Type: String
    Description: "RDS Proxy endpoint configured. This should be Read/Write endpoint."
  RdsEndpoint:
    Type: String
    Description: "RDS Aurora Cluster Endpoint."
  Port:
    Type: Number
    Description: "Database port. For Mysql 3306 is default."
    Default: 4510
  SecretArn:
    Type: String
    Description: "Secret ARN where database credentials are stored."
  ProxyResourceId:
    Type: String
    Description: "RDS Proxy resource id. This is last part of RDS proxy ARN, ex: prx-<hash>. Its required to configure needed permission by the lambda functions."
  CreateFunctionSecurityGroup:
    Type: String
    AllowedValues: ['True', 'False']
    Default: 'True'
    Description: "Should a security group for function be created? Set value as True only if you do not already have specified LambdaSecurityGroupId. Make sure traffic from this SG is allowed in database and proxy security group."
  LambdaSecurityGroupId:
    Type: String
    Default: ""
    Description: "Security group id for lambda function. Make sure traffic from this SG is allowed in database and proxy security group."

Conditions:
  CreateLambdaSg: !Equals ["True", !Ref CreateFunctionSecurityGroup]

Globals:
  Function:
    Timeout: 30

Resources:
  LambdaSg:
    Type: AWS::EC2::SecurityGroup
    Condition: CreateLambdaSg
    Properties:
      GroupDescription: Security Groups for the AWS Lambda for accessing RDS/Proxy
      GroupName: 'lambda-sg-1'
      SecurityGroupEgress:
        - CidrIp: "0.0.0.0/0"
          FromPort: 0
          ToPort: 65535
          IpProtocol: tcp
      SecurityGroupIngress:
        - CidrIp: "0.0.0.0/0"
          FromPort: 0
          ToPort: 65535
          IpProtocol: tcp
      VpcId: !Ref Vpc

  SampleHttpApi:
    Type: AWS::Serverless::HttpApi

  RdsFunction:
    Type: AWS::Serverless::Function
    Properties:
      CodeUri: rds/
      Handler: app.lambda_handler
      Runtime: python3.9
      VpcConfig:
        SecurityGroupIds:
          - !If [CreateLambdaSg, !Ref LambdaSg, !Ref LambdaSecurityGroupId]
        SubnetIds: !Ref Subnets
      Policies:
        - AWSSecretsManagerGetSecretValuePolicy:
            SecretArn:
              !Ref SecretArn
      Environment:
        Variables:
          region: !Ref AWS::Region
          rds_endpoint: !Ref RdsEndpoint
          port: !Ref Port
          secret_arn: !Ref SecretArn
      Events:
        NoProxy:
          Type: HttpApi
          Properties:
            Path: /no-proxy
            Method: get
            ApiId: !Ref SampleHttpApi

  RdsProxyFunction:
    Type: AWS::Serverless::Function
    Properties:
      CodeUri: rdsproxy/
      Handler: app.lambda_handler
      Runtime: python3.9
      VpcConfig:
        SecurityGroupIds:
          - !If [CreateLambdaSg, !Ref LambdaSg, !Ref LambdaSecurityGroupId]
        SubnetIds: !Ref Subnets
      Policies:
        - Statement:
            - Sid: AllowDbConnect
              Effect: Allow
              Action:
                - rds-db:connect
              Resource:
                - !Sub arn:aws:rds-db:${AWS::Region}:${AWS::AccountId}:dbuser:${ProxyResourceId}/*
      Environment:
        Variables:
          region: !Ref AWS::Region
          rds_endpoint: !Ref RdsProxyEndpoint
          port: !Ref Port
          username: !Sub "{{resolve:secretsmanager:${SecretArn}:SecretString:username}}"
      Events:
        Proxy:
          Type: HttpApi
          Properties:
            Path: /proxy
            Method: get
            ApiId: !Ref SampleHttpApi

Outputs:
  ApiBasePath:
    Description: "API Gateway endpoint URL"
    Value: !Sub "https://${SampleHttpApi}.execute-api.${AWS::Region}.amazonaws.com"

  RdsProxyApiPath:
    Description: "API Gateway endpoint URL for rds proxy function"
    Value: !Sub "https://${SampleHttpApi}.execute-api.${AWS::Region}.amazonaws.com/proxy"

  RdsApiPath:
    Description: "API Gateway endpoint URL for rds function"
    Value: !Sub "https://${SampleHttpApi}.execute-api.${AWS::Region}.amazonaws.com/no-proxy"

  LambdaSecurityGroupId:
    Description: "Security group id attached to lambda functions. Make sure traffic from this SG is allowed in database and proxy security group on db port"
    Value: !GetAtt LambdaSg.GroupId