template.yaml

AWSTemplateFormatVersion: '2010-09-09'
Transform: AWS::Serverless-2016-10-31
Description: OmniCloud Agent - Claude Agent SDK based Telegram Bot

Parameters:
  TelegramBotToken:
    Type: String
    NoEcho: true
  BedrockAccessKeyId:
    Type: String
    NoEcho: true
  BedrockSecretAccessKey:
    Type: String
    NoEcho: true
  AuthToken:
    Type: String
    Default: 'change-me-in-production'
    NoEcho: true
  BedrockHaikuModelArn:
    Type: String
    Default: ''
    Description: "(Optional) ARN for Bedrock Haiku model"
    NoEcho: true
  BedrockSonnetModelArn:
    Type: String
    Default: ''
    Description: "(Optional) ARN for Bedrock Sonnet model"
    NoEcho: true
  BedrockOpusModelArn:
    Type: String
    Default: ''
    Description: "(Optional) ARN for Bedrock Opus 4.5 model"
    NoEcho: true
  TelegramWebhookSecret:
    Type: String
    Default: ''
    Description: "(Optional) Secret token for Telegram webhook verification"
    NoEcho: true

Globals:
  Function:
    Timeout: 900
    MemorySize: 512
    Architectures:
      - arm64

Resources:
  # S3 Bucket for session files
  SessionBucket:
    Type: AWS::S3::Bucket
    Properties:
      BucketName: !Sub 'omnicloud-agent-sessions-${AWS::AccountId}'
      LifecycleConfiguration:
        Rules:
          - Id: ExpireOldSessions
            Status: Enabled
            ExpirationInDays: 30

  # DynamoDB Table for session mapping
  SessionTable:
    Type: AWS::DynamoDB::Table
    Properties:
      TableName: omnicloud-agent-sessions
      BillingMode: PAY_PER_REQUEST
      AttributeDefinitions:
        - AttributeName: session_key
          AttributeType: S
      KeySchema:
        - AttributeName: session_key
          KeyType: HASH
      TimeToLiveSpecification:
        AttributeName: ttl
        Enabled: true

  # SQS Task Queue (FIFO for session message ordering)
  TaskQueue:
    Type: AWS::SQS::Queue
    Properties:
      QueueName: !Sub '${AWS::StackName}-TaskQueue.fifo'
      FifoQueue: true
      ContentBasedDeduplication: false
      DeduplicationScope: messageGroup
      FifoThroughputLimit: perMessageGroupId
      VisibilityTimeout: 900  # 15 minutes = Lambda timeout
      MessageRetentionPeriod: 1209600  # 14 days
      RedrivePolicy:
        deadLetterTargetArn: !GetAtt DLQueue.Arn
        maxReceiveCount: 3  # Retry 3 times then move to DLQ

  # Dead Letter Queue (FIFO to match TaskQueue)
  DLQueue:
    Type: AWS::SQS::Queue
    Properties:
      QueueName: !Sub '${AWS::StackName}-DLQueue.fifo'
      FifoQueue: true
      ContentBasedDeduplication: true
      MessageRetentionPeriod: 1209600  # 14 days

  # SNS Topic for alarm notifications
  AlarmTopic:
    Type: AWS::SNS::Topic
    Properties:
      TopicName: !Sub '${AWS::StackName}-Alarms'
      DisplayName: OmniCloud Agent Alarms

  # Agent Server Lambda (Container)
  AgentServerFunction:
    Type: AWS::Serverless::Function
    Metadata:
      DockerTag: agent-server
      DockerContext: ./agent-sdk-server
      Dockerfile: Dockerfile
    Properties:
      PackageType: Image
      MemorySize: 2048
      EphemeralStorage:
        Size: 2048
      Environment:
        Variables:
          # App config
          SESSION_BUCKET: !Ref SessionBucket
          SESSION_TABLE: !Ref SessionTable
          PROJECT_PATH: '-tmp-workspace'
          SDK_CLIENT_AUTH_TOKEN: !Ref AuthToken
          # Bedrock credentials (runtime injection)
          CLAUDE_CODE_USE_BEDROCK: '1'
          BEDROCK_ACCESS_KEY_ID: !Ref BedrockAccessKeyId
          BEDROCK_SECRET_ACCESS_KEY: !Ref BedrockSecretAccessKey
          # Claude Code config (static)
          CLAUDE_CONFIG_DIR: '/tmp/.claude-code'
          AWS_SHARED_CREDENTIALS_FILE: '/tmp/.aws/credentials'
          DISABLE_AUTOUPDATER: '1'
          DISABLE_TELEMETRY: '1'
          # Bedrock model ARNs
          ANTHROPIC_DEFAULT_HAIKU_MODEL: !Ref BedrockHaikuModelArn
          ANTHROPIC_DEFAULT_SONNET_MODEL: !Ref BedrockSonnetModelArn
          ANTHROPIC_DEFAULT_OPUS_MODEL: !Ref BedrockOpusModelArn
      Policies:
        - S3CrudPolicy:
            BucketName: !Ref SessionBucket
        - DynamoDBCrudPolicy:
            TableName: !Ref SessionTable
      FunctionUrlConfig:
        AuthType: NONE

  # SDK Client Lambda - Producer (writes to SQS, returns 200 immediately)
  SdkClientFunction:
    Type: AWS::Serverless::Function
    Properties:
      CodeUri: ./agent-sdk-client
      Handler: handler.lambda_handler
      Runtime: python3.12
      Timeout: 10  # Producer should complete quickly (<1s for message validation + SQS write)
      Environment:
        Variables:
          TELEGRAM_BOT_TOKEN: !Ref TelegramBotToken
          AGENT_SERVER_URL: !GetAtt AgentServerFunctionUrl.FunctionUrl
          SDK_CLIENT_AUTH_TOKEN: !Ref AuthToken
          QUEUE_URL: !Ref TaskQueue
          TELEGRAM_WEBHOOK_SECRET: !Ref TelegramWebhookSecret
          SESSION_TABLE: !Ref SessionTable
          SESSION_BUCKET: !Ref SessionBucket
      Policies:
        - SQSSendMessagePolicy:
            QueueName: !GetAtt TaskQueue.QueueName
        - Statement:
            - Effect: Allow
              Action:
                - cloudwatch:PutMetricData
              Resource: '*'
        - DynamoDBReadPolicy:
            TableName: !Ref SessionTable
        - S3ReadPolicy:
            BucketName: !Ref SessionBucket
      Events:
        Webhook:
          Type: HttpApi
          Properties:
            Path: /webhook
            Method: POST

  # Consumer Lambda - processes messages from SQS
  ConsumerFunction:
    Type: AWS::Serverless::Function
    Properties:
      CodeUri: ./agent-sdk-client
      Handler: consumer.lambda_handler
      Runtime: python3.12
      Timeout: 900  # 15 minutes for long Agent Server calls
      Environment:
        Variables:
          TELEGRAM_BOT_TOKEN: !Ref TelegramBotToken
          AGENT_SERVER_URL: !GetAtt AgentServerFunctionUrl.FunctionUrl
          SDK_CLIENT_AUTH_TOKEN: !Ref AuthToken
          QUEUE_URL: !Ref TaskQueue
          SESSION_TABLE: !Ref SessionTable
      Policies:
        - SQSPollerPolicy:
            QueueName: !GetAtt TaskQueue.QueueName
        - DynamoDBCrudPolicy:
            TableName: !Ref SessionTable
      Events:
        SQSEvent:
          Type: SQS
          Properties:
            Queue: !GetAtt TaskQueue.Arn
            BatchSize: 1  # Process one message at a time
            MaximumBatchingWindowInSeconds: 0  # Process immediately

  # DLQ Alarm - alert when messages land in DLQ
  DLQAlarm:
    Type: AWS::CloudWatch::Alarm
    Properties:
      AlarmName: !Sub '${AWS::StackName}-DLQ-Messages'
      AlarmDescription: Alert when messages land in Dead Letter Queue
      MetricName: ApproximateNumberOfMessagesVisible
      Namespace: AWS/SQS
      Statistic: Sum
      Period: 300
      EvaluationPeriods: 1
      Threshold: 1
      ComparisonOperator: GreaterThanOrEqualToThreshold
      AlarmActions:
        - !Ref AlarmTopic
      Dimensions:
        - Name: QueueName
          Value: !GetAtt DLQueue.QueueName

  # Producer SQS send error alarm
  ProducerSQSErrorAlarm:
    Type: AWS::CloudWatch::Alarm
    Properties:
      AlarmName: !Sub '${AWS::StackName}-Producer-SQS-Errors'
      AlarmDescription: Alert when Producer fails to send messages to SQS
      MetricName: SQSError.QueueNotFound
      Namespace: OmniCloudAgent/Producer
      Statistic: Sum
      Period: 60
      EvaluationPeriods: 1
      Threshold: 1
      ComparisonOperator: GreaterThanOrEqualToThreshold
      AlarmActions:
        - !Ref AlarmTopic
      TreatMissingData: notBreaching

  # Producer Lambda error alarm
  ProducerLambdaErrorAlarm:
    Type: AWS::CloudWatch::Alarm
    Properties:
      AlarmName: !Sub '${AWS::StackName}-Producer-Lambda-Errors'
      AlarmDescription: Alert on Producer Lambda exceptions
      MetricName: Errors
      Namespace: AWS/Lambda
      Statistic: Sum
      Period: 60
      EvaluationPeriods: 1
      Threshold: 1
      ComparisonOperator: GreaterThanOrEqualToThreshold
      AlarmActions:
        - !Ref AlarmTopic
      Dimensions:
        - Name: FunctionName
          Value: !Ref SdkClientFunction

Outputs:
  WebhookUrl:
    Description: Telegram Webhook URL
    Value: !Sub 'https://${ServerlessHttpApi}.execute-api.${AWS::Region}.amazonaws.com/webhook'
  AgentServerUrl:
    Description: Agent Server Function URL
    Value: !GetAtt AgentServerFunctionUrl.FunctionUrl
  TaskQueueUrl:
    Description: Task Queue URL
    Value: !Ref TaskQueue
  DLQueueUrl:
    Description: Dead Letter Queue URL
    Value: !Ref DLQueue
  AlarmTopicArn:
    Description: SNS Topic for CloudWatch Alarm notifications
    Value: !Ref AlarmTopic
    Export:
      Name: !Sub '${AWS::StackName}-AlarmTopic'