template.yml

AWSTemplateFormatVersion: '2010-09-09'
Transform: AWS::Serverless-2016-10-31
Description: AWS Lambda Power Tuning resources.

Metadata:
  AWS::ServerlessRepo::Application:
    Name: aws-lambda-power-tuning
    Description: AWS Lambda Power Tuning is an open-source tool that can help you visualize and fine-tune the memory/power configuration of Lambda functions. It runs in your AWS account - powered by AWS Step Functions - and it supports multiple optimization strategies.
    Author: Alex Casalboni
    SpdxLicenseId: Apache-2.0
    LicenseUrl: LICENSE.txt
    ReadmeUrl: README-SAR.md
    Labels: ['lambda', 'power', 'state-machine', 'step-functions', 'optimization']
    HomePageUrl: https://github.com/alexcasalboni/aws-lambda-power-tuning
    SemanticVersion: 4.3.6
    SourceCodeUrl: https://github.com/alexcasalboni/aws-lambda-power-tuning

Parameters:
  PowerValues:
    Type: List<Number>
    Default: 128,256,512,1024,1536,3008
    Description: Default RAM values, used only if not provided as execution input (comma-separated).
  visualizationURL:
    Type: String
    Default: https://lambda-power-tuning.show/
    Description: Stats visualization URL
  lambdaResource:
    Type: String
    Default: '*'
    Description: AWS Lambda resource (or prefix) to be used for IAM policies
  totalExecutionTimeout:
    Type: Number
    Default: 300
    MinValue: 10
    MaxValue: 900
    Description: Maximum invocation timeout (in seconds) for the Executor step, after which you get a States.Timeout error
  permissionsBoundary:
    Type: String
    Default: ''
    Description: The ARN of a permissions boundary to use for all functions' execution role.
  payloadS3Bucket:
    Type: String
    Default: ''
    Description: S3 bucket name used for large payloads (optional), included in IAM policy if not an empty string
  payloadS3Key:
    Type: String
    Default: '*'
    Description: S3 object key used for large payloads (optional), included in IAM policy if bucket is not an empty string (all objects are readable by default)
  layerSdkName:
    Type: String
    Default: ''
    Description: Name of the SDK layer, if customization is needed (optional)
  logGroupRetentionInDays:
    Type: Number
    Default: 7
    Description: The number of days to retain the log events in the Lambda log groups.
  securityGroupIds:
    Type: CommaDelimitedList
    Default: ''
    Description: List of Security Groups to use in every Lambda function's VPC Configuration (optional).
  subnetIds:
    Type: CommaDelimitedList
    Default: ''
    Description: List of Subnets to use in every Lambda function's VPC Configuration (optional).
  stateMachineNamePrefix:
    Type: String
    MaxLength: 43
    AllowedPattern: ^[a-zA-Z0-9\-_]*$
    ConstraintDescription: Prefix must conform to StateMachineName requirements.
    Default: 'powerTuningStateMachine'
    Description: Prefix to the name of the StateMachine. The StackId will be appended to this value (optional).

Conditions:
  UsePermissionsBoundary: !Not [!Equals [!Ref permissionsBoundary, '']]
  S3BucketProvided: !Not [!Equals [!Ref payloadS3Bucket, '']]
  UseLayerSdkName: !Not [!Equals [!Ref layerSdkName, '']]
  UseSecurityGroupIds: !Not [!Equals [!Join ['', !Ref securityGroupIds], '']]
  UseSubnetIds: !Not [!Equals [!Join ['', !Ref subnetIds], '']]
  UseVPCConfig: !Or [Condition: UseSecurityGroupIds, Condition: UseSubnetIds]

Globals:
  Function:
    Runtime: nodejs20.x
    MemorySize: 128
    Timeout: !Ref totalExecutionTimeout
    PermissionsBoundary: !If [UsePermissionsBoundary, !Ref permissionsBoundary, !Ref AWS::NoValue]
    VpcConfig: !If [UseVPCConfig, {
      SecurityGroupIds: !If [UseSecurityGroupIds, !Ref securityGroupIds, !Ref AWS::NoValue],
      SubnetIds: !If [UseSubnetIds, !Ref subnetIds, !Ref AWS::NoValue]
    }, !Ref AWS::NoValue]
    Environment:
      Variables:
        defaultPowerValues: !Join [ ",", !Ref PowerValues ]
        minRAM: '128'
        baseCosts: '{"x86_64": {"ap-east-1":2.9e-9,"af-south-1":2.8e-9,"me-south-1":2.6e-9,"eu-south-1":2.4e-9,"ap-northeast-3":2.7e-9,"cn-north-1":0.0000000142,"cn-northwest-1":0.0000000142,"default":2.1e-9}, "arm64": {"default":1.7e-9}}'
        sfCosts: '{"default": 0.000025,"us-gov-west-1": 0.00003,"ap-northeast-2": 0.0000271,"eu-south-1": 0.00002625,"af-south-1": 0.00002975,"us-west-1": 0.0000279,"eu-west-3": 0.0000297,"ap-east-1": 0.0000275,"me-south-1": 0.0000275,"ap-south-1": 0.0000285,"us-gov-east-1": 0.00003,"sa-east-1": 0.0000375,"cn-north-1":0.0001891,"cn-northwest-1":0.0001891}'
        visualizationURL: !Ref visualizationURL

Resources:

  SDKlayer:
    Type: AWS::Serverless::LayerVersion
    Properties:
      LayerName: !If [UseLayerSdkName, !Ref layerSdkName, AWS-SDK-v3]
      Description: AWS SDK 3
      ContentUri: ./layer-sdk
      CompatibleRuntimes:
        - nodejs20.x
      LicenseInfo: 'Available under the MIT-0 license.'
      RetentionPolicy: Retain
    Metadata:
      BuildMethod: nodejs20.x

  initializerLogGroup:
    Type: AWS::Logs::LogGroup
    DependsOn: initializer
    Properties:
      LogGroupName: !Sub '/aws/lambda/${initializer}'
      RetentionInDays: !Ref logGroupRetentionInDays

  initializer:
    Type: AWS::Serverless::Function
    Properties:
      CodeUri: lambda
      Handler: initializer.handler
      Layers:
        - !Ref SDKlayer
      Policies:
        - AWSLambdaBasicExecutionRole # Only logs
        - Version: '2012-10-17' # allow Lambda actions
          Statement:
            - Effect: Allow
              Action:
                - lambda:GetFunctionConfiguration
              Resource: !Ref lambdaResource
  publisher:
    Type: AWS::Serverless::Function
    Properties:
      CodeUri: lambda
      Handler: publisher.handler
      Layers:
        - !Ref SDKlayer
      Policies:
        - AWSLambdaBasicExecutionRole # Only logs
        - Version: '2012-10-17' # allow Lambda actions
          Statement:
            - Effect: Allow
              Action:
                - lambda:GetAlias
                - lambda:GetFunctionConfiguration
                - lambda:PublishVersion
                - lambda:UpdateFunctionConfiguration
                - lambda:CreateAlias
                - lambda:UpdateAlias
              Resource: !Ref lambdaResource

  executorLogGroup:
    Type: AWS::Logs::LogGroup
    DependsOn: executor
    Properties:
      LogGroupName: !Sub '/aws/lambda/${executor}'
      RetentionInDays: !Ref logGroupRetentionInDays

  executor:
    Type: AWS::Serverless::Function
    Properties:
      CodeUri: lambda
      Handler: executor.handler
      Layers:
        - !Ref SDKlayer
      Policies:
        - AWSLambdaBasicExecutionRole # only logs
        - Version: '2012-10-17' # allow Lambda actions
          Statement:
            - Effect: Allow
              Action:
                - lambda:InvokeFunction
                - lambda:GetFunctionConfiguration
              Resource: !Ref lambdaResource
        - !If
          - S3BucketProvided # if S3 bucket is provided
          - !Ref payloadS3Policy # allow read-only access to S3
          - !Ref AWS::NoValue

  payloadS3Policy:
    Condition: S3BucketProvided
    Type: AWS::IAM::ManagedPolicy
    Properties:
      Description: Lambda Power Tunning - S3 Read Only for large payloads
      PolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Action:
              - s3:ListBucket # this is needed only to detect 404 errors correctly
              - s3:GetObject
            Resource:
              - !Sub arn:${AWS::Partition}:s3:::${payloadS3Bucket}
              - !Sub arn:${AWS::Partition}:s3:::${payloadS3Bucket}/${payloadS3Key} # payloadS3Key is * by default

  cleanerLogGroup:
    Type: AWS::Logs::LogGroup
    DependsOn: cleaner
    Properties:
      LogGroupName: !Sub '/aws/lambda/${cleaner}'
      RetentionInDays: !Ref logGroupRetentionInDays

  cleaner:
    Type: AWS::Serverless::Function
    Properties:
      CodeUri: lambda
      Handler: cleaner.handler
      Layers:
        - !Ref SDKlayer
      Policies:
        - AWSLambdaBasicExecutionRole # only logs
        - Version: '2012-10-17' # allow Lambda actions
          Statement:
            - Effect: Allow
              Action:
                - lambda:GetAlias
                - lambda:DeleteAlias
                - lambda:DeleteFunction  # only by version/qualifier
              Resource: !Ref lambdaResource

  analyzerLogGroup:
    Type: AWS::Logs::LogGroup
    DependsOn: analyzer
    Properties:
      LogGroupName: !Sub '/aws/lambda/${analyzer}'
      RetentionInDays: !Ref logGroupRetentionInDays

  analyzer:
    Type: AWS::Serverless::Function
    Properties:
      CodeUri: lambda
      Handler: analyzer.handler
      Timeout: 10
      Policies:
        - AWSLambdaBasicExecutionRole # only logs

  optimizerLogGroup:
    Type: AWS::Logs::LogGroup
    DependsOn: optimizer
    Properties:
      LogGroupName: !Sub '/aws/lambda/${optimizer}'
      RetentionInDays: !Ref logGroupRetentionInDays

  optimizer:
    Type: AWS::Serverless::Function
    Properties:
      CodeUri: lambda
      Handler: optimizer.handler
      Layers:
        - !Ref SDKlayer
      Policies:
        - AWSLambdaBasicExecutionRole # only logs
        - Version: '2012-10-17' # allow Lambda actions
          Statement:
            - Effect: Allow
              Action:
                - lambda:GetAlias
                - lambda:PublishVersion
                - lambda:UpdateFunctionConfiguration
                - lambda:GetFunctionConfiguration
                - lambda:CreateAlias
                - lambda:UpdateAlias
              Resource: !Ref lambdaResource

  statemachineRole:
    Type: AWS::IAM::Role
    Properties:
      PermissionsBoundary: !If [UsePermissionsBoundary, !Ref permissionsBoundary, !Ref AWS::NoValue]
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/service-role/AWSLambdaRole
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              Service: !Sub states.${AWS::Region}.amazonaws.com
            Action: sts:AssumeRole

  powerTuningStateMachine:
    Type: AWS::Serverless::StateMachine
    Properties:
      Name:
        Fn::Join:
          - '-'
          - - !Ref stateMachineNamePrefix
            - !Select [2, !Split ['/', !Ref AWS::StackId]]
      Role: !GetAtt statemachineRole.Arn
      DefinitionUri: statemachine/statemachine.asl.json
      DefinitionSubstitutions:
        initializerArn: !GetAtt initializer.Arn
        publisherArn: !GetAtt publisher.Arn
        executorArn: !GetAtt executor.Arn
        cleanerArn: !GetAtt cleaner.Arn
        analyzerArn: !GetAtt analyzer.Arn
        optimizerArn: !GetAtt optimizer.Arn
        totalExecutionTimeout: !Ref totalExecutionTimeout

Outputs:
  StateMachineARN:
    Value: !Ref powerTuningStateMachine