main.yaml

AWSTemplateFormatVersion: "2010-09-09"
Transform: AWS::Serverless-2016-10-31
Description: |
  PSU DynamoDB tables and related resources

Parameters:
  StackName:
    Type: String
    Default: none

  EnableDynamoDBAutoScaling:
    Type: String

  MinWritePrescriptionStatusUpdatesCapacity:
    Type: Number
    Default: 50

  MaxWritePrescriptionStatusUpdatesCapacity:
    Type: Number
    Default: 600

  MinWritePrescriptionNotificationStateCapacity:
    Type: Number
    Default: 50

  MaxWritePrescriptionNotificationStateCapacity:
    Type: Number
    Default: 600

Conditions:
  EnableDynamoDBAutoScalingCondition: !Equals
    - true
    - !Ref EnableDynamoDBAutoScaling

Resources:

#---------------------#
#    Common things    #
#---------------------#

  DynamoDbScalingRolePolicy:
    Type: AWS::IAM::ManagedPolicy
    Properties:
      PolicyDocument: !Sub |
        {
            "Version": "2012-10-17",
            "Statement": [
                {
                    "Effect": "Allow",
                    "Action": [
                        "dynamodb:DescribeTable",
                        "dynamodb:UpdateTable"
                    ],
                    "Resource": "${PrescriptionStatusUpdatesTable.Arn}"
                },
                {
                    "Effect": "Allow",
                    "Action": [
                        "cloudwatch:PutMetricAlarm",
                        "cloudwatch:DescribeAlarms",
                        "cloudwatch:DeleteAlarms"
                    ],
                    "Resource": "*"
                }
            ]
        }

  DynamoDbScalingRole:
    Condition: EnableDynamoDBAutoScalingCondition
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Principal:
              { "Service": ["dynamodb.application-autoscaling.amazonaws.com"] }
            Action: ["sts:AssumeRole"]
      Path: "/"
      ManagedPolicyArns:
        - !Ref DynamoDbScalingRolePolicy


#-----------------------------------------#
#    Prescription Status Updates Table    #
#-----------------------------------------#

  PrescriptionStatusUpdatesKMSKey:
    Type: AWS::KMS::Key
    Properties:
      EnableKeyRotation: true
      KeyPolicy:
        Version: 2012-10-17
        Id: key-s3
        Statement:
          - Sid: Enable IAM User Permissions
            Effect: Allow
            Principal:
              AWS: !Sub "arn:aws:iam::${AWS::AccountId}:root"
            Action:
              - kms:*
            Resource: "*"
          - Sid: Enable read only decrypt
            Effect: Allow
            Principal:
              AWS: "*"
            Action:
              - kms:DescribeKey
              - kms:Decrypt
            Resource: "*"
            Condition:
              ArnLike:
                aws:PrincipalArn: !Sub "arn:aws:iam::${AWS::AccountId}:role/aws-reserved/sso.amazonaws.com/${AWS::Region}/AWSReservedSSO_ReadOnly*"

  PrescriptionStatusUpdatesKMSKeyAlias:
    Type: AWS::KMS::Alias
    Properties:
      AliasName: !Sub alias/${StackName}-PrescriptionStatusUpdatesKMSKeyAlias
      TargetKeyId: !Ref PrescriptionStatusUpdatesKMSKey

  UsePrescriptionStatusUpdatesKMSKeyPolicy:
    Type: AWS::IAM::ManagedPolicy
    Properties:
      PolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Action:
              - kms:DescribeKey
              - kms:GenerateDataKey*
              - kms:Encrypt
              - kms:ReEncrypt*
              - kms:Decrypt
            Resource: !GetAtt PrescriptionStatusUpdatesKMSKey.Arn

  PrescriptionStatusUpdatesTable:
    Type: AWS::DynamoDB::Table
    Properties:
      TableName: !Sub ${StackName}-PrescriptionStatusUpdates
      PointInTimeRecoverySpecification:
        PointInTimeRecoveryEnabled: true
      AttributeDefinitions:
        - AttributeName: TaskID
          AttributeType: S
        - AttributeName: PrescriptionID
          AttributeType: S
        - AttributeName: PatientNHSNumber
          AttributeType: S
        - AttributeName: PharmacyODSCode
          AttributeType: S
      KeySchema:
        - AttributeName: PrescriptionID
          KeyType: HASH
        - AttributeName: TaskID
          KeyType: RANGE
      BillingMode: !If
        - EnableDynamoDBAutoScalingCondition
        - PROVISIONED
        - PAY_PER_REQUEST
      ProvisionedThroughput: !If
        - EnableDynamoDBAutoScalingCondition
        - ReadCapacityUnits: 1
          WriteCapacityUnits: !Ref MinWritePrescriptionStatusUpdatesCapacity
        - !Ref "AWS::NoValue"
      SSESpecification:
        KMSMasterKeyId: !Ref PrescriptionStatusUpdatesKMSKey
        SSEEnabled: true
        SSEType: KMS
      TimeToLiveSpecification:
        AttributeName: ExpiryTime
        Enabled: true
      GlobalSecondaryIndexes:
        - IndexName: PharmacyODSCodePrescriptionIDIndex
          KeySchema:
            - AttributeName: PharmacyODSCode
              KeyType: HASH
            - AttributeName: PrescriptionID
              KeyType: RANGE
          Projection:
            NonKeyAttributes:
              - PatientNHSNumber
              - LineItemID
              - TerminalStatus
              - LastModified
              - Status
            ProjectionType: INCLUDE
          ProvisionedThroughput: !If
            - EnableDynamoDBAutoScalingCondition
            - ReadCapacityUnits: 1
              WriteCapacityUnits: !Ref MinWritePrescriptionStatusUpdatesCapacity
            - !Ref "AWS::NoValue"
        - IndexName: PatientNHSNumberIndex
          KeySchema:
            - AttributeName: PatientNHSNumber
              KeyType: HASH
          Projection:
            ProjectionType: KEYS_ONLY
          ProvisionedThroughput: !If
            - EnableDynamoDBAutoScalingCondition
            - ReadCapacityUnits: 1
              WriteCapacityUnits: !Ref MinWritePrescriptionStatusUpdatesCapacity
            - !Ref "AWS::NoValue"

  PrescriptionStatusUpdatesResources:
    Type: AWS::Serverless::Application
    Properties:
      Location: dynamodb_resources.yaml
      Parameters:
        StackName: !Ref StackName
        TableName: !Ref PrescriptionStatusUpdatesTable
        TableArn: !GetAtt PrescriptionStatusUpdatesTable.Arn

  PrescriptionStatusUpdatesTableWriteScalingTarget:
    Type: AWS::ApplicationAutoScaling::ScalableTarget
    DependsOn: PrescriptionStatusUpdatesTable
    Condition: EnableDynamoDBAutoScalingCondition
    Properties:
      MinCapacity: !Ref MinWritePrescriptionStatusUpdatesCapacity
      MaxCapacity: !Ref MaxWritePrescriptionStatusUpdatesCapacity
      ResourceId: !Sub table/${PrescriptionStatusUpdatesTable}
      RoleARN: !GetAtt DynamoDbScalingRole.Arn
      ScalableDimension: "dynamodb:table:WriteCapacityUnits"
      ServiceNamespace: dynamodb

  PrescriptionStatusUpdatesTableWriteScalingPolicy:
    Type: AWS::ApplicationAutoScaling::ScalingPolicy
    Condition: EnableDynamoDBAutoScalingCondition
    Properties:
      PolicyName: PrescriptionStatusUpdatesTableWriteScalingPolicy
      PolicyType: TargetTrackingScaling
      ScalingTargetId: !Ref PrescriptionStatusUpdatesTableWriteScalingTarget
      TargetTrackingScalingPolicyConfiguration:
        TargetValue: 50
        ScaleInCooldown: 600
        ScaleOutCooldown: 0
        PredefinedMetricSpecification:
          PredefinedMetricType: DynamoDBWriteCapacityUtilization

  PrescriptionStatusUpdatesTableReadScalingTarget:
    Type: AWS::ApplicationAutoScaling::ScalableTarget
    DependsOn: PrescriptionStatusUpdatesTable
    Condition: EnableDynamoDBAutoScalingCondition
    Properties:
      MaxCapacity: 100
      MinCapacity: 1
      ResourceId: !Sub table/${PrescriptionStatusUpdatesTable}
      RoleARN: !GetAtt DynamoDbScalingRole.Arn
      ScalableDimension: "dynamodb:table:ReadCapacityUnits"
      ServiceNamespace: dynamodb

  PrescriptionStatusUpdatesTableReadScalingPolicy:
    Type: AWS::ApplicationAutoScaling::ScalingPolicy
    Condition: EnableDynamoDBAutoScalingCondition
    Properties:
      PolicyName: PrescriptionStatusUpdatesTableReadScalingPolicy
      PolicyType: TargetTrackingScaling
      ScalingTargetId: !Ref PrescriptionStatusUpdatesTableReadScalingTarget
      TargetTrackingScalingPolicyConfiguration:
        TargetValue: 70
        ScaleInCooldown: 60
        ScaleOutCooldown: 60
        PredefinedMetricSpecification:
          PredefinedMetricType: DynamoDBReadCapacityUtilization

  PharmacyIndexScalingWriteTarget:
    Type: AWS::ApplicationAutoScaling::ScalableTarget
    DependsOn: PrescriptionStatusUpdatesTable
    Condition: EnableDynamoDBAutoScalingCondition
    Properties:
      MinCapacity: !Ref MinWritePrescriptionStatusUpdatesCapacity
      MaxCapacity: !Ref MaxWritePrescriptionStatusUpdatesCapacity
      ResourceId: !Sub table/${PrescriptionStatusUpdatesTable}/index/PharmacyODSCodePrescriptionIDIndex
      RoleARN: !GetAtt DynamoDbScalingRole.Arn
      ScalableDimension: "dynamodb:index:WriteCapacityUnits"
      ServiceNamespace: dynamodb

  PharmacyIndexScalingWritePolicy:
    Type: AWS::ApplicationAutoScaling::ScalingPolicy
    Condition: EnableDynamoDBAutoScalingCondition
    Properties:
      PolicyName: PharmacyIndexWriteScalingPolicy
      PolicyType: TargetTrackingScaling
      ScalingTargetId: !Ref PharmacyIndexScalingWriteTarget
      TargetTrackingScalingPolicyConfiguration:
        TargetValue: 50
        ScaleInCooldown: 600
        ScaleOutCooldown: 0
        PredefinedMetricSpecification:
          PredefinedMetricType: DynamoDBWriteCapacityUtilization

  PharmacyIndexScalingReadTarget:
    Type: AWS::ApplicationAutoScaling::ScalableTarget
    DependsOn: PrescriptionStatusUpdatesTable
    Condition: EnableDynamoDBAutoScalingCondition
    Properties:
      MaxCapacity: 100
      MinCapacity: 1
      ResourceId: !Sub table/${PrescriptionStatusUpdatesTable}/index/PharmacyODSCodePrescriptionIDIndex
      RoleARN: !GetAtt DynamoDbScalingRole.Arn
      ScalableDimension: "dynamodb:index:ReadCapacityUnits"
      ServiceNamespace: dynamodb

  PharmacyIndexScalingReadPolicy:
    Type: AWS::ApplicationAutoScaling::ScalingPolicy
    Condition: EnableDynamoDBAutoScalingCondition
    Properties:
      PolicyName: NHSNumberIndexReadScalingPolicy
      PolicyType: TargetTrackingScaling
      ScalingTargetId: !Ref PharmacyIndexScalingReadTarget
      TargetTrackingScalingPolicyConfiguration:
        TargetValue: 70
        ScaleInCooldown: 600
        ScaleOutCooldown: 10
        PredefinedMetricSpecification:
          PredefinedMetricType: DynamoDBReadCapacityUtilization

  NHSNumberIndexScalingWriteTarget:
    Type: AWS::ApplicationAutoScaling::ScalableTarget
    DependsOn: PrescriptionStatusUpdatesTable
    Condition: EnableDynamoDBAutoScalingCondition
    Properties:
      MinCapacity: !Ref MinWritePrescriptionStatusUpdatesCapacity
      MaxCapacity: !Ref MaxWritePrescriptionStatusUpdatesCapacity
      ResourceId: !Sub table/${PrescriptionStatusUpdatesTable}/index/PatientNHSNumberIndex
      RoleARN: !GetAtt DynamoDbScalingRole.Arn
      ScalableDimension: "dynamodb:index:WriteCapacityUnits"
      ServiceNamespace: dynamodb

  NHSNumberIndexScalingWritePolicy:
    Type: AWS::ApplicationAutoScaling::ScalingPolicy
    Condition: EnableDynamoDBAutoScalingCondition
    Properties:
      PolicyName: NHSNumberIndexWriteScalingPolicy
      PolicyType: TargetTrackingScaling
      ScalingTargetId: !Ref NHSNumberIndexScalingWriteTarget
      TargetTrackingScalingPolicyConfiguration:
        TargetValue: 50
        ScaleInCooldown: 600
        ScaleOutCooldown: 0
        PredefinedMetricSpecification:
          PredefinedMetricType: DynamoDBWriteCapacityUtilization

  NHSNumberIndexScalingReadTarget:
    Type: AWS::ApplicationAutoScaling::ScalableTarget
    DependsOn: PrescriptionStatusUpdatesTable
    Condition: EnableDynamoDBAutoScalingCondition
    Properties:
      MaxCapacity: 100
      MinCapacity: 1
      ResourceId: !Sub table/${PrescriptionStatusUpdatesTable}/index/PatientNHSNumberIndex
      RoleARN: !GetAtt DynamoDbScalingRole.Arn
      ScalableDimension: "dynamodb:index:ReadCapacityUnits"
      ServiceNamespace: dynamodb

  NHSNumberIndexScalingReadPolicy:
    Type: AWS::ApplicationAutoScaling::ScalingPolicy
    Condition: EnableDynamoDBAutoScalingCondition
    Properties:
      PolicyName: NHSNumberIndexWriteScalingPolicy
      PolicyType: TargetTrackingScaling
      ScalingTargetId: !Ref NHSNumberIndexScalingReadTarget
      TargetTrackingScalingPolicyConfiguration:
        TargetValue: 70
        ScaleInCooldown: 60
        ScaleOutCooldown: 60
        PredefinedMetricSpecification:
          PredefinedMetricType: DynamoDBReadCapacityUtilization


#--------------------------------#
#    Notification State Table    #
#--------------------------------#

  PrescriptionNotificationStateKMSKey:
    Type: AWS::KMS::Key
    Properties:
      EnableKeyRotation: true
      KeyPolicy:
        Version: 2012-10-17
        Id: key-s3
        Statement:
          - Sid: Enable IAM User Permissions
            Effect: Allow
            Principal:
              AWS: !Sub "arn:aws:iam::${AWS::AccountId}:root"
            Action:
              - kms:*
            Resource: "*"
          - Sid: Enable read only decrypt
            Effect: Allow
            Principal:
              AWS: "*"
            Action:
              - kms:DescribeKey
              - kms:Decrypt
            Resource: "*"
            Condition:
              ArnLike:
                aws:PrincipalArn: !Sub "arn:aws:iam::${AWS::AccountId}:role/aws-reserved/sso.amazonaws.com/${AWS::Region}/AWSReservedSSO_ReadOnly*"

  PrescriptionNotificationStateKMSKeyAlias:
    Type: AWS::KMS::Alias
    Properties:
      AliasName: !Sub alias/${StackName}-PrescriptionNotificationStateKMSKeyAlias
      TargetKeyId: !Ref PrescriptionNotificationStateKMSKey

  UsePrescriptionNotificationStateKMSKeyPolicy:
    Type: AWS::IAM::ManagedPolicy
    Properties:
      PolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Action:
              - kms:DescribeKey
              - kms:GenerateDataKey*
              - kms:Encrypt
              - kms:ReEncrypt*
              - kms:Decrypt
            Resource: !GetAtt PrescriptionNotificationStateKMSKey.Arn

  PrescriptionNotificationStateTable:
    Type: AWS::DynamoDB::Table
    Properties:
      TableName: !Sub ${StackName}-PrescriptionNotificationState
      PointInTimeRecoverySpecification:
        PointInTimeRecoveryEnabled: true
      AttributeDefinitions:
        - AttributeName: NHSNumber
          AttributeType: S
        - AttributeName: ODSCode
          AttributeType: S
      KeySchema:
        - AttributeName: NHSNumber
          KeyType: HASH       # Partition key
        - AttributeName: ODSCode
          KeyType: RANGE      # Sort key
      BillingMode: !If
        - EnableDynamoDBAutoScalingCondition
        - PROVISIONED
        - PAY_PER_REQUEST
      ProvisionedThroughput: !If
        - EnableDynamoDBAutoScalingCondition
        - ReadCapacityUnits: 1
          WriteCapacityUnits: !Ref MinWritePrescriptionNotificationStateCapacity
        - !Ref "AWS::NoValue"
      SSESpecification:
        KMSMasterKeyId: !Ref PrescriptionNotificationStateKMSKey
        SSEEnabled: true
        SSEType: KMS
      TimeToLiveSpecification:
        AttributeName: ExpiryTime
        Enabled: true

  PrescriptionNotificationStateResources:
    Type: AWS::Serverless::Application
    Properties:
      Location: dynamodb_resources.yaml
      Parameters:
        StackName: !Ref StackName
        TableName: !Ref PrescriptionNotificationStateTable
        TableArn: !GetAtt PrescriptionNotificationStateTable.Arn

  # Auto scaling for the table
  PrescriptionNotificationStateTableWriteScalingTarget:
    Type: AWS::ApplicationAutoScaling::ScalableTarget
    DependsOn: PrescriptionNotificationStateTable
    Condition: EnableDynamoDBAutoScalingCondition
    Properties:
      MinCapacity: !Ref MinWritePrescriptionNotificationStateCapacity
      MaxCapacity: !Ref MaxWritePrescriptionNotificationStateCapacity
      ResourceId: !Sub table/${PrescriptionNotificationStateTable}
      RoleARN: !GetAtt DynamoDbScalingRole.Arn
      ScalableDimension: "dynamodb:table:WriteCapacityUnits"
      ServiceNamespace: dynamodb

  PrescriptionNotificationStateTableWriteScalingPolicy:
    Type: AWS::ApplicationAutoScaling::ScalingPolicy
    Condition: EnableDynamoDBAutoScalingCondition
    Properties:
      PolicyName: PrescriptionNotificationStateTableWriteScalingPolicy
      PolicyType: TargetTrackingScaling
      ScalingTargetId: !Ref PrescriptionNotificationStateTableWriteScalingTarget
      TargetTrackingScalingPolicyConfiguration:
        TargetValue: 50
        ScaleInCooldown: 600
        ScaleOutCooldown: 0
        PredefinedMetricSpecification:
          PredefinedMetricType: DynamoDBWriteCapacityUtilization

  PrescriptionNotificationStateTableReadScalingTarget:
    Type: AWS::ApplicationAutoScaling::ScalableTarget
    DependsOn: PrescriptionNotificationStateTable
    Condition: EnableDynamoDBAutoScalingCondition
    Properties:
      MinCapacity: 1
      MaxCapacity: 100
      ResourceId: !Sub table/${PrescriptionNotificationStateTable}
      RoleARN: !GetAtt DynamoDbScalingRole.Arn
      ScalableDimension: "dynamodb:table:ReadCapacityUnits"
      ServiceNamespace: dynamodb

  PrescriptionNotificationStateTableReadScalingPolicy:
    Type: AWS::ApplicationAutoScaling::ScalingPolicy
    Condition: EnableDynamoDBAutoScalingCondition
    Properties:
      PolicyName: PrescriptionNotificationStateTableReadScalingPolicy
      PolicyType: TargetTrackingScaling
      ScalingTargetId: !Ref PrescriptionNotificationStateTableReadScalingTarget
      TargetTrackingScalingPolicyConfiguration:
        TargetValue: 70
        ScaleInCooldown: 60
        ScaleOutCooldown: 60
        PredefinedMetricSpecification:
          PredefinedMetricType: DynamoDBReadCapacityUtilization

Outputs:
  PrescriptionStatusUpdatesTableName:
    Description: PrescriptionStatusUpdates table name
    Value: !Ref PrescriptionStatusUpdatesTable

  PrescriptionStatusUpdatesTableArn:
    Description: PrescriptionStatusUpdates table arn
    Value: !GetAtt PrescriptionStatusUpdatesTable.Arn
    
  UsePrescriptionStatusUpdatesKMSKeyPolicyArn:
    Description: Use kms key policy arn
    Value: !GetAtt UsePrescriptionStatusUpdatesKMSKeyPolicy.PolicyArn
    Export:
      Name: !Sub ${StackName}:tables:UsePrescriptionStatusUpdatesKMSKeyPolicyArn

  PrescriptionNotificationStateTableName:
    Description: PrescriptionNotificationState table name
    Value: !Ref PrescriptionNotificationStateTable

  PrescriptionNotificationStateTableArn:
    Description: PrescriptionNotificationState table ARN
    Value: !GetAtt PrescriptionNotificationStateTable.Arn

  UsePrescriptionNotificationStateKMSKeyPolicyArn:
    Description: Use kms key policy arn
    Value: !GetAtt UsePrescriptionNotificationStateKMSKeyPolicy.PolicyArn
    Export:
      Name: !Sub ${StackName}:tables:UsePrescriptionNotificationStateKMSKeyPolicyArn