backend.yml

AWSTemplateFormatVersion: "2010-09-09"
Description: CloudFormation template for Hotel app with DynamoDB and App Runner, without networking.

Parameters:
  HotelName:
    Type: String
    Default: AWS App Runner Hotel
    Description: Enter a name for the Hotel. Default is AWS AppRunner Hotel.
  Environment:
    Type: String
    Default: dev
    Description: Enter a name for the Environment. Default is dev, this is used later in the workshop to tag the environments

Resources:
  # DynamoDB Table for Rooms
  RoomsTable:
    Type: "AWS::DynamoDB::Table"
    Properties:
      TableName: !Sub "Rooms-${AWS::StackName}-${AWS::Region}"
      AttributeDefinitions:
        - AttributeName: "id"
          AttributeType: "N"
      KeySchema:
        - AttributeName: "id"
          KeyType: "HASH"
      ProvisionedThroughput:
        ReadCapacityUnits: 5
        WriteCapacityUnits: 5
      SSESpecification:
        SSEEnabled: true # Enable server-side encryption for the table
      Tags:
        - Key: "Project"
          Value: !Sub "HotelApp-${Environment}"

  # IAM Role for AppRunner to access DynamoDB
  AppRunnerInstanceRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: !Sub "AppRunnerHotelAppRole-${AWS::StackName}-${AWS::Region}"
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: "Allow"
            Principal:
              Service:
                - tasks.apprunner.amazonaws.com
            Action:
              - "sts:AssumeRole"
      Policies:
        - PolicyName: AppRunnerDynamoDBPermissions
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Effect: Allow
                Action:
                  - "dynamodb:PutItem"
                  - "dynamodb:GetItem"
                  - "dynamodb:Scan"
                  - "dynamodb:UpdateItem"
                Resource: !GetAtt RoomsTable.Arn
        - PolicyName: AppRunnerServiceRolePolicy
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Effect: Allow
                Action:
                  - "logs:CreateLogGroup"
                  - "logs:PutRetentionPolicy"
                Resource: "arn:aws:logs:*:*:log-group:/aws/apprunner/*"
              - Effect: Allow
                Action:
                  - "logs:CreateLogStream"
                  - "logs:PutLogEvents"
                  - "logs:DescribeLogStreams"
                Resource: "arn:aws:logs:*:*:log-group:/aws/apprunner/*:log-stream:*"

  # IAM Role for ECR Access
  AppRunnerECRAccessRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: !Sub "AppRunnerHotelAppECRAccessRole-${AWS::StackName}-${AWS::Region}"
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: "Allow"
            Principal:
              Service:
                - build.apprunner.amazonaws.com
            Action:
              - "sts:AssumeRole"
      ManagedPolicyArns:
        - "arn:aws:iam::aws:policy/service-role/AWSAppRunnerServicePolicyForECRAccess"

  AppRunnerService:
    Type: AWS::AppRunner::Service
    Properties:
      ServiceName: !Sub "Hotel-${AWS::StackName}-${AWS::Region}"
      SourceConfiguration:
        AutoDeploymentsEnabled: false
        ImageRepository:
          ImageIdentifier: !Sub ${AWS::AccountId}.dkr.ecr.${AWS::Region}.amazonaws.com/hotel-app:latest
          ImageRepositoryType: ECR
          ImageConfiguration:
            Port: "8080"
            RuntimeEnvironmentVariables:
              - Name: DYNAMODB_TABLE_NAME
                Value: !Ref RoomsTable
              - Name: HOTEL_NAME
                Value: !Sub ${HotelName}-${Environment}-2
        AuthenticationConfiguration:
          AccessRoleArn: !GetAtt AppRunnerECRAccessRole.Arn
      InstanceConfiguration:
        InstanceRoleArn: !GetAtt AppRunnerInstanceRole.Arn

  AppRunnerURLSSMParameter:
    Type: "AWS::SSM::Parameter"
    Properties:
      Name: !Sub "/hotelapp/${Environment}/url"
      Description: "Hotel app URI"
      Type: "String"
      Value: !Sub "https://${AppRunnerService.ServiceUrl}"
Outputs:
  DynamoDBTableName:
    Description: "Name of the DynamoDB Table"
    Value: !Ref RoomsTable
  AppRunnerServiceUrl:
    Description: "URL of the AppRunner Service"
    Value: !GetAtt AppRunnerService.ServiceUrl