template.yaml

AWSTemplateFormatVersion: '2010-09-09'
Transform: AWS::Serverless-2016-10-31
Description: >
  dynamodb-reader
  Sample SAM Template for dynamodb-reader
Globals:
  Function:
    Layers:
      - !Sub arn:aws:lambda:${AWS::Region}:017000801446:layer:AWSLambdaPowertoolsPython:13
    Tracing: Active
    Environment:
      Variables:
        POWERTOOLS_METRICS_NAMESPACE: "community-builder-serverless"
        POWERTOOLS_SERVICE_NAME: "python-lambda-observability-example"
  Api:
     TracingEnabled: true

Resources:
  PythonObservabilityExampleFunction:
    Type: AWS::Serverless::Function
    Properties:
      CodeUri: app/
      Handler: app.lambda_handler
      Runtime: python3.9
      MemorySize: 512
      Timeout: 10
      Environment:
        Variables:
          TABLE_NAME: !Ref GameTable
          LOG_LEVEL: "INFO"
      Architectures:
        - x86_64
      Events:
        HelloWorld:
          Type: Api
          Properties:
            RestApiId: !Ref GamesApi
            Path: /games/{game_id}
            Method: get

  GameTable:
    Type: AWS::Serverless::SimpleTable
    Properties:
      TableName: "games"
      PrimaryKey:
        Name: game_id
        Type: String
      ProvisionedThroughput:
        ReadCapacityUnits: 5
        WriteCapacityUnits: 5

  APIGWCloudWatchRole:
    Type: 'AWS::IAM::Role'
    Properties:
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - apigateway.amazonaws.com
            Action: 'sts:AssumeRole'
      Path: /
      ManagedPolicyArns:
        - >-
          arn:aws:iam::aws:policy/service-role/AmazonAPIGatewayPushToCloudWatchLogs

  ApiGWAccount:
    Type: 'AWS::ApiGateway::Account'
    Properties:
      CloudWatchRoleArn: !GetAtt APIGWCloudWatchRole.Arn

  GamesApi:
    Type: AWS::Serverless::Api
    DependsOn:
      - ApiGWAccount
    Properties:
      StageName: Prod
      MethodSettings:
        - DataTraceEnabled: True
          MetricsEnabled: True
          ResourcePath: "/*"
          HttpMethod: "*"
          LoggingLevel: INFO

  GetGamesRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Action:
              - "sts:AssumeRole"
            Effect: "Allow"
            Principal:
              Service:
                - "lambda.amazonaws.com"

  LambdaBasicPolicyAndXray:
    Type: "AWS::IAM::Policy"
    Properties:
      PolicyName: LambdaXRayPolicy
      PolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: "Allow"
            Action: [
              "xray:PutTraceSegments",
              "xray:PutTelemetryRecords",
              "logs:CreateLogGroup",
              "logs:CreateLogStream",
              "logs:PutLogEvents"
            ]
            Resource: "*"
      Roles:
        - !Ref GetGamesRole

  DynamoDBReadPolicy:
    Type: "AWS::IAM::Policy"
    Properties:
      PolicyName: DynamoDBReadPolicy
      PolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: "Allow"
            Action: [
              "dynamodb:GetItem",
              "dynamodb:Scan",
              "dynamodb:Query",
              "dynamodb:BatchGetItem",
              "dynamodb:DescribeTable"
            ]
            Resource:
              - !Sub "arn:aws:dynamodb:sa-east-1:${AWS::AccountId}:table/games"
      Roles:
        - !Ref GetGamesRole