hmts-support-stack.yml

---
AWSTemplateFormatVersion: '2010-09-09'
Description: This is an AWS Cloudformation template that will create the source and targets and accompanying roles to quickly utilize the Healthshare Transformation Service.
Parameters:
  PipelineName:
    Description: The name of the pipeline, that will be used to create the resources.
    Type: String
  HL7SourceBucketKey:
    Description: The key (folder) in the source bucket to pull from. (Enforced)
    Type: String
    Default: in
  FHIRTargetBucketKey:
    Description: The key (folder) in the source bucket to pull from. (enforced)
    Type: String
    Default: out
  FHIRSourceBucketLoggingKey:
    Description: The key (folder) in the source bucket to log to. (enforced)
    Type: String
    Default: logs
  HMTSTransformType:
    Description: Deploy a highly available IRIS deployment conditional
    Default: "s3tos3"
    Type: String
    AllowedValues:
      - "s3tos3"
      - "s3tohl"
Conditions:
  ShouldCreateS3toS3: !Equals
  - "s3tos3"
  - !Ref HMTSTransformType
  ShouldCreateS3toHL: !Equals
  - "s3tohl"
  - !Ref HMTSTransformType
Resources:
  HL7SourceBucket:
    Type: AWS::S3::Bucket
    Condition: ShouldCreateS3toS3
    Properties:
      BucketName: !Sub ${PipelineName}-hmts-source
      PublicAccessBlockConfiguration:
        BlockPublicAcls: true
        BlockPublicPolicy: true
        IgnorePublicAcls: true
        RestrictPublicBuckets: true
  FHIRTargetBucket:
    Type: AWS::S3::Bucket
    Condition: ShouldCreateS3toS3
    Properties:
      BucketName: !Sub ${PipelineName}-hmts-target
      PublicAccessBlockConfiguration:
        BlockPublicAcls: true
        BlockPublicPolicy: true
        IgnorePublicAcls: true
        RestrictPublicBuckets: true
  HealthLake:
    Type: AWS::HealthLake::FHIRDatastore
    Condition: ShouldCreateS3toHL
    Properties: 
      DatastoreName: !Sub ${PipelineName}
      DatastoreTypeVersion: R4
  IAMRoleS3toS3:
    Type: AWS::IAM::Role
    Condition: ShouldCreateS3toS3
    Properties:
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - s3.amazonaws.com
            Action:
              - sts:AssumeRole
      Path: /
      Policies:
        - PolicyName: HMTSBucketAccess
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Effect: Allow
                Action:
                  - s3:PutObject
                  - s3:GetObject
                  - s3:ListObject
                  - s3:DeleteObject
                  - s3:GetBucketLocation
                Resource: 
                  - !Sub "arn:aws:s3:::${PipelineName}-hmts-source"
                  - !Sub "arn:aws:s3:::${PipelineName}-hmts-source/*"
                  - !Sub "arn:aws:s3:::${PipelineName}-hmts-target"
                  - !Sub "arn:aws:s3:::${PipelineName}-hmts-target/*"
  IAMRoleS3toHealthLake:
    Type: AWS::IAM::Role
    DependsOn: HealthLake
    Condition: ShouldCreateS3toHL
    Properties:
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - s3.amazonaws.com
                - healthlake.amazonaws.com
            Action:
              - sts:AssumeRole
      Path: /
      Policies:
        - PolicyName: HMTSBucketHealthlakeAccess
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Effect: Allow
                Action:
                  - s3:PutObject
                  - s3:GetObject
                  - s3:ListObject
                  - s3:DeleteObject
                  - s3:GetBucketLocation
                  - healthlake:CreateResource
                  - healthlake:ReadResource
                  - healthlake:DeleteResource
                  - healthlake:SearchWithGet
                  - healthlake:SearchWithPost
                  - healthlake:UpdateResource
                  - healthlake:GetCapabilities
                Resource: 
                  - !Sub "arn:aws:s3:::${PipelineName}-hmts-source"
                  - !Sub "arn:aws:s3:::${PipelineName}-hmts-source/*"
                  - !Sub "arn:aws:s3:::${PipelineName}-hmts-target"
                  - !Sub "arn:aws:s3:::${PipelineName}-hmts-target/*"
                  - !Sub "arn:aws:healthlake:${AWS::Region}:${AWS::AccountId}:datastore/fhir/$(Fn::GetAtt:[HealthLake, DatastoreId])"
  BucketKeysRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: !Sub ${PipelineName}-lambda-role
      AssumeRolePolicyDocument:
        Statement:
          - Action:
            - sts:AssumeRole
            Effect: Allow
            Principal:
              Service:
              - lambda.amazonaws.com
        Version: 2012-10-17
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/AWSLambdaExecute
        - arn:aws:iam::aws:policy/AmazonS3FullAccess
      Path: /
  BucketKeysFunction:
    Type: AWS::Lambda::Function
    Condition: ShouldCreateS3toS3
    Properties:
      Handler: "index.lambda_handler"
      Role: !GetAtt BucketKeysRole.Arn #!If [ShouldCreateS3toS3, !Ref IAMRoleS3toS3, !Ref IAMRoleS3toHealthLake]
      Runtime: python3.6
      FunctionName: !Sub ${PipelineName}-hmts-keys
      Description: Simply creates keys in buckets.
      Timeout: "300"
      Code:
        ZipFile: !Sub |
          import boto3
          import cfnresponse

          def lambda_handler(event, context):
              pipeline_name = event['ResourceProperties']['PipelineName']
              hl7_src_key = event['ResourceProperties']['HL7SourceBucketKey']
              fhir_target_key = event['ResourceProperties']['FHIRTargetBucketKey']
              fhir_src_logging_key = event['ResourceProperties']['FHIRSourceBucketLoggingKey']

              if event['RequestType'] == "Create":
                # Redeploy the Api After Changes from stack
                try:
                  s3 = boto3.client('s3')
                  src_bucket = pipeline_name + '-hmts-source'
                  target_bucket = pipeline_name + '-hmts-target'
                  # create keys here
                  s3.put_object(Bucket=src_bucket, Key=hl7_src_key)
                  s3.put_object(Bucket=src_bucket, Key=fhir_src_logging_key)
                  s3.put_object(Bucket=target_bucket, Key=fhir_target_key)
                except Exception as e:
                  print(e)
                send_cfnresponse(event, context, "SUCCESS",
                             {'message': 'donesies'})
              if event['RequestType'] == "Delete":
                #
                send_cfnresponse(event, context, "SUCCESS",
                             {'message': 'delete no op'})
              if event['RequestType'] == "Update":
                #
                send_cfnresponse(event, context, "SUCCESS",
                             {'message': 'update no op'})
          def send_cfnresponse(event, context, status, data):
              if status == "SUCCESS":
                  cfnresponse.send(event, context, cfnresponse.SUCCESS, data)
              else:
                  cfnresponse.send(event, context, cfnresponse.FAILED, data)
  BucketKeysResource:
    Type: "Custom::BucketKeysResource"
    Properties:
      ServiceToken: !GetAtt BucketKeysFunction.Arn
      PipelineName: !Ref PipelineName
      HL7SourceBucketKey: !Ref HL7SourceBucketKey
      FHIRTargetBucketKey: !Ref FHIRTargetBucketKey
      FHIRSourceBucketLoggingKey: !Ref FHIRSourceBucketLoggingKey
Outputs:
  HMTSS3toS3RoleArn:
    Condition: ShouldCreateS3toS3
    Description: IAM Role for S3 to S3
    Value:
      Fn::GetAtt:
      - IAMRoleS3toS3
      - Arn
  HMTSFHIRtoS3RoleArn:
    Condition: ShouldCreateS3toHL
    Description: IAM Role for S3 to Healthlake
    Value:
      Fn::GetAtt:
      - IAMRoleS3toHealthLake
      - Arn
  Source:
    Description: Upload HL7 Here
    Value: !Sub ${PipelineName}-hmts-src/${HL7SourceBucketKey}
  Target:
    Description: FHIR Here
    Value: !Sub ${PipelineName}-hmts-target/${FHIRTargetBucketKey}
  Logging:
    Description: Logs Here
    Value: !Sub ${PipelineName}-hmts-src/${FHIRSourceBucketLoggingKey}