Transform:
  - AWS::LanguageExtensions
Parameters:
  ctrKinesisStreamARN:
    Type: String
    Description: The full ARN of the Kinesis Streams used by Amazon Connect for CTR records.
  connectInstanceFriendlyName:
    Type: String
    Description: The friendly name of your Amazon Connect instance for ease of reference (i.e. Dev, Prod, UAT). Alphanumeric, no spaces.
  operataGroupId:
    Type: String
    Description: Operata Group ID provided by Operata
  operataAPIKey:
    Type: String
    Description: API key generated in the Operata console
    NoEcho: true
  apiEndpointUrl:
    Type: String
    Default: https://api.operata.io
    Description: Operata API endpoint URL
  agentDataS3BucketName:
    Type: List<String>
    Description: "Optional `Agent Data` S3 Bucket Name (JSON Line/JSON array files). format: <bucket-name>,<prefix>"
  agentLookupKey:
    Type: String
    Description: Optional, The name of the agent field to use for agent data lookup (i.e. USERNAME, userId, etc)
Resources:
  operataAPIKeySM:
    Type: AWS::SecretsManager::Secret
    Properties:
      Description: Operata API token
      Name:
        Fn::Join:
          - ""
          - - cloud-collector-v3/ctr/
            - Ref: operataGroupId
            - /apiToken
      SecretString:
        Ref: operataAPIKey
    Metadata:
      aws:cdk:path: CloudCollectorV3Stack/operataAPIKeySM
  operataEventBridgePipeRole3EA09E25:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Statement:
          - Action: sts:AssumeRole
            Effect: Allow
            Principal:
              Service: pipes.amazonaws.com
            Condition:
              StringEquals:
                aws:SourceArn:
                  Fn::Join:
                    - ""
                    - - "arn:aws:pipes:"
                      - Ref: AWS::Region
                      - ":"
                      - Ref: AWS::AccountId
                      - :pipe/operataEventsPipe-
                      - Ref: connectInstanceFriendlyName
                      - -amazonConnect
                aws:SourceAccount:
                  Ref: AWS::AccountId
        Version: "2012-10-17"
      Description: Operata Event Bridge Pipes Role
    Metadata:
      aws:cdk:path: CloudCollectorV3Stack/operataEventBridgePipeRole/Resource
  operataConnection322BC7D8:
    Type: AWS::Events::Connection
    Properties:
      AuthorizationType: API_KEY
      AuthParameters:
        ApiKeyAuthParameters:
          ApiKeyName: Operata-API-Key
          ApiKeyValue:
            Ref: operataAPIKey
        InvocationHttpParameters:
          HeaderParameters:
            - IsValueSecret: false
              Key: Operata-Group-Id
              Value:
                Ref: operataGroupId
      Description:
        Fn::Join:
          - ""
          - - "EventBridge connection for transmitting CTR events to Operata for the "
            - Ref: connectInstanceFriendlyName
            - " Amazon Connect instance"
      Name:
        Fn::Join:
          - ""
          - - operataAPIgroup-
            - Ref: operataGroupId
    Metadata:
      aws:cdk:path: CloudCollectorV3Stack/operataConnection/Connection
  operataApiDestinationFE63AEAB:
    Type: AWS::Events::ApiDestination
    Properties:
      ConnectionArn:
        Fn::GetAtt:
          - operataConnection322BC7D8
          - Arn
      HttpMethod: POST
      InvocationEndpoint:
        Fn::Join:
          - ""
          - - Ref: apiEndpointUrl
            - /v2/aws/events/contact-record
      Description:
        Fn::Join:
          - ""
          - - API destination for sending CTR data to Operata for the
            - Ref: connectInstanceFriendlyName
            - Amazon Connect instance
      Name:
        Fn::Join:
          - ""
          - - operataEndpointGroup-
            - Ref: operataGroupId
    DependsOn:
      - operataConnection322BC7D8
    Metadata:
      aws:cdk:path: CloudCollectorV3Stack/operataApiDestination/ApiDestination
  operataEventBridgePipeAPIDestinationPolicy6F5D8899:
    Type: AWS::IAM::Policy
    Properties:
      PolicyDocument:
        Statement:
          - Action: events:InvokeApiDestination
            Effect: Allow
            Resource:
              Fn::GetAtt:
                - operataApiDestinationFE63AEAB
                - Arn
        Version: "2012-10-17"
      PolicyName:
        Fn::Join:
          - ""
          - - APIDestinationPolicy-Operata-GroupId-
            - Ref: operataGroupId
      Roles:
        - Ref: operataEventBridgePipeRole3EA09E25
    Metadata:
      aws:cdk:path: CloudCollectorV3Stack/operataEventBridgePipeAPIDestinationPolicy/Resource
  operataEventBridgeKinesisPipeSourcePolicy754E6190:
    Type: AWS::IAM::Policy
    Properties:
      PolicyDocument:
        Statement:
          - Action:
              - kinesis:DescribeStream
              - kinesis:DescribeStreamSummary
              - kinesis:GetRecords
              - kinesis:GetShardIterator
              - kinesis:ListShards
              - kinesis:ListStreams
            Effect: Allow
            Resource:
              Ref: ctrKinesisStreamARN
        Version: "2012-10-17"
      PolicyName:
        Fn::Join:
          - ""
          - - KinesisPipeSourcePolicy-Operata-GroupId-
            - Ref: operataGroupId
      Roles:
        - Ref: operataEventBridgePipeRole3EA09E25
    Metadata:
      aws:cdk:path: CloudCollectorV3Stack/operataEventBridgeKinesisPipeSourcePolicy/Resource
  cloudcollectorv3redactorServiceRole9543ADB8:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Statement:
          - Action: sts:AssumeRole
            Effect: Allow
            Principal:
              Service: lambda.amazonaws.com
        Version: "2012-10-17"
      ManagedPolicyArns:
        - Fn::Join:
            - ""
            - - "arn:"
              - Ref: AWS::Partition
              - :iam::aws:policy/service-role/AWSLambdaBasicExecutionRole
    Metadata:
      aws:cdk:path: CloudCollectorV3Stack/cloud-collector-v3-redactor/ServiceRole/Resource
  cloudcollectorv3redactorServiceRoleDefaultPolicy3AE409B5:
    Type: AWS::IAM::Policy
    Properties:
      PolicyDocument:
        Statement:
          - Action: secretsmanager:GetSecretValue
            Effect: Allow
            Resource:
              Ref: operataAPIKeySM
          - Action:
              - ec2:AttachNetworkInterface
              - ec2:CreateNetworkInterface
              - ec2:DeleteNetworkInterface
              - ec2:DescribeInstances
              - ec2:DescribeNetworkInterfaces
            Effect: Allow
            Resource: "*"
        Version: "2012-10-17"
      PolicyName: cloudcollectorv3redactorServiceRoleDefaultPolicy3AE409B5
      Roles:
        - Ref: cloudcollectorv3redactorServiceRole9543ADB8
    Metadata:
      aws:cdk:path: CloudCollectorV3Stack/cloud-collector-v3-redactor/ServiceRole/DefaultPolicy/Resource
  cloudcollectorv3redactorBACFAA12:
    Type: AWS::Lambda::Function
    Properties:
      Code:
        S3Bucket:
          Fn::Join:
            - ""
            - - Ref: AWS::Region
              - -operata-shared-assets-prod
        S3Key: redactor-v1.2.3.zip
      Role:
        Fn::GetAtt:
          - cloudcollectorv3redactorServiceRole9543ADB8
          - Arn
      Environment:
        Variables:
          OPERATA_API_KEY:
            Ref: operataAPIKeySM
          OPERATA_API_URL:
            Ref: apiEndpointUrl
          OPERATA_GROUP_ID:
            Ref: operataGroupId
          LOG_LEVEL: "0"
          BUILD_VERSION: v1.2.3
          AGENT_DATA_S3_BUCKET:
            Fn::If:
              - HasBucketName
              - Fn::Select:
                  - 0
                  - Ref: agentDataS3BucketName
              - ""
          AGENT_DATA_S3_BUCKET_PREFIX:
            Fn::If:
              - HasPrefix
              - Fn::Select:
                  - 1
                  - Ref: agentDataS3BucketName
              - ""
          AGENT_LOOKUP_KEY:
            Ref: agentLookupKey
      Handler: bootstrap
      Runtime: provided.al2023
      Timeout: 60
    DependsOn:
      - cloudcollectorv3redactorServiceRoleDefaultPolicy3AE409B5
      - cloudcollectorv3redactorServiceRole9543ADB8
    Metadata:
      aws:cdk:path: CloudCollectorV3Stack/cloud-collector-v3-redactor/Resource
  LambdaS3Policy907BA583:
    Type: AWS::IAM::Policy
    Properties:
      PolicyDocument:
        Statement:
          - Action: s3:GetObject
            Effect: Allow
            Resource:
              Fn::Join:
                - ""
                - - "arn:aws:s3:::"
                  - Fn::If:
                      - HasBucketName
                      - Fn::Select:
                          - 0
                          - Ref: agentDataS3BucketName
                      - ""
                  - /*
          - Action: s3:ListBucket
            Effect: Allow
            Resource:
              Fn::Join:
                - ""
                - - "arn:aws:s3:::"
                  - Fn::If:
                      - HasBucketName
                      - Fn::Select:
                          - 0
                          - Ref: agentDataS3BucketName
                      - ""
        Version: "2012-10-17"
      PolicyName: AgentDataS3Access
      Roles:
        - Ref: cloudcollectorv3redactorServiceRole9543ADB8
    Metadata:
      aws:cdk:path: CloudCollectorV3Stack/LambdaS3Policy/Resource
    Condition: HasBucketName
  operataEventBridgePipeLambdaPolicy21093044:
    Type: AWS::IAM::Policy
    Properties:
      PolicyDocument:
        Statement:
          - Action:
              - lambda:InvokeFunction
              - lambda:InvokeFunctionUrl
            Effect: Allow
            Resource:
              Fn::GetAtt:
                - cloudcollectorv3redactorBACFAA12
                - Arn
        Version: "2012-10-17"
      PolicyName:
        Fn::Join:
          - ""
          - - LambdaPolicy-Operata-GroupId-
            - Ref: operataGroupId
      Roles:
        - Ref: operataEventBridgePipeRole3EA09E25
    Metadata:
      aws:cdk:path: CloudCollectorV3Stack/operataEventBridgePipeLambdaPolicy/Resource
  operataPipe:
    Type: AWS::Pipes::Pipe
    Properties:
      RoleArn:
        Fn::GetAtt:
          - operataEventBridgePipeRole3EA09E25
          - Arn
      Source:
        Ref: ctrKinesisStreamARN
      Target:
        Fn::GetAtt:
          - operataApiDestinationFE63AEAB
          - Arn
      Description:
        Fn::Join:
          - ""
          - - "Pipe for sending CTR records to Operata (group ID: "
            - Ref: operataGroupId
            - ") from the "
            - Ref: connectInstanceFriendlyName
            - " Amazon Connect instance in "
            - Ref: AWS::Region
      DesiredState: RUNNING
      Enrichment:
        Fn::GetAtt:
          - cloudcollectorv3redactorBACFAA12
          - Arn
      Name:
        Fn::Join:
          - ""
          - - operataEventsPipe-
            - Ref: connectInstanceFriendlyName
            - -amazonConnect
      SourceParameters:
        FilterCriteria:
          Filters:
            - Pattern: '{ "data": {"Channel": ["VOICE"] } }'
        KinesisStreamParameters:
          BatchSize: 1
          MaximumRecordAgeInSeconds: -1
          MaximumRetryAttempts: -1
          StartingPosition: LATEST
    DependsOn:
      - cloudcollectorv3redactorBACFAA12
      - cloudcollectorv3redactorServiceRoleDefaultPolicy3AE409B5
      - cloudcollectorv3redactorServiceRole9543ADB8
      - operataApiDestinationFE63AEAB
      - operataEventBridgePipeRole3EA09E25
    Metadata:
      aws:cdk:path: CloudCollectorV3Stack/operataPipe
  CDKMetadata:
    Type: AWS::CDK::Metadata
    Properties:
      Analytics: v2:deflate64:H4sIAAAAAAAA/1VO0U7DMAz8lr2nBsoD4pEN8UrVfQDyUoO8NkkVO0Moyr/ThhWBZOnOPt/ZLTw8wt0OP6Wxw9hMfIJ8VLSjObz7DiM6Uopm0d+ykI2k4tDjB0VYFo51Yhgd5D5MtJoqdmFi+1UzKiuGLuRVIB+C92SVg1/VP93TzM8kyh438f+kGLmHfbIj6R6FzITuNCDkl+R/4zZezMwzyfpit5BiepKQoqXrzYE3x2vSOWn9+7pSjA8DwVluLm0LS93uzsLcxOSVHUH/g9+MFlTvOQEAAA==
    Metadata:
      aws:cdk:path: CloudCollectorV3Stack/CDKMetadata/Default
    Condition: CDKMetadataAvailable
Conditions:
  HasBucketName:
    Fn::Not:
      - Fn::Or:
          - Fn::Equals:
              - Fn::Length:
                  Ref: agentDataS3BucketName
              - 0
          - Fn::Equals:
              - Fn::Select:
                  - 0
                  - Ref: agentDataS3BucketName
              - ""
  HasPrefix:
    Fn::Equals:
      - Fn::Length:
          Ref: agentDataS3BucketName
      - 2
  CDKMetadataAvailable:
    Fn::Or:
      - Fn::Or:
          - Fn::Equals:
              - Ref: AWS::Region
              - af-south-1
          - Fn::Equals:
              - Ref: AWS::Region
              - ap-east-1
          - Fn::Equals:
              - Ref: AWS::Region
              - ap-northeast-1
          - Fn::Equals:
              - Ref: AWS::Region
              - ap-northeast-2
          - Fn::Equals:
              - Ref: AWS::Region
              - ap-south-1
          - Fn::Equals:
              - Ref: AWS::Region
              - ap-southeast-1
          - Fn::Equals:
              - Ref: AWS::Region
              - ap-southeast-2
          - Fn::Equals:
              - Ref: AWS::Region
              - ca-central-1
          - Fn::Equals:
              - Ref: AWS::Region
              - cn-north-1
          - Fn::Equals:
              - Ref: AWS::Region
              - cn-northwest-1
      - Fn::Or:
          - Fn::Equals:
              - Ref: AWS::Region
              - eu-central-1
          - Fn::Equals:
              - Ref: AWS::Region
              - eu-north-1
          - Fn::Equals:
              - Ref: AWS::Region
              - eu-south-1
          - Fn::Equals:
              - Ref: AWS::Region
              - eu-west-1
          - Fn::Equals:
              - Ref: AWS::Region
              - eu-west-2
          - Fn::Equals:
              - Ref: AWS::Region
              - eu-west-3
          - Fn::Equals:
              - Ref: AWS::Region
              - me-south-1
          - Fn::Equals:
              - Ref: AWS::Region
              - sa-east-1
          - Fn::Equals:
              - Ref: AWS::Region
              - us-east-1
          - Fn::Equals:
              - Ref: AWS::Region
              - us-east-2
      - Fn::Or:
          - Fn::Equals:
              - Ref: AWS::Region
              - us-west-1
          - Fn::Equals:
              - Ref: AWS::Region
              - us-west-2
Outputs:
  pipeStateOutput:
    Description: The current state of the EventBridge pipe
    Value:
      Fn::GetAtt:
        - operataPipe
        - CurrentState
  secretsManagerSecretARNOutput:
    Description: The Operata API key is stored in AWS Secrets Manager with the following ARN. To change the key create a change set in CloudFormation and update the API Key parameter using the existing template.
    Value:
      Fn::GetAtt:
        - operataConnection322BC7D8
        - SecretArn
  operataGroupIdOutput:
    Description: Events are being sent to the following Operata Group ID
    Value:
      Ref: operataGroupId
  connectInstanceFriendlyNameNameOutput:
    Description: The source of Contact Trace Records is from the following Amazon Connect instance (friendly name)
    Value:
      Ref: connectInstanceFriendlyName

