IAC.yml

AWSTemplateFormatVersion: '2010-09-09'
Description: 'Quarkus Video Transcoder: VPC, ALB, Private ASG, and Service Endpoints'

Parameters:
  BakedAmiId:
    Type: AWS::EC2::Image::Id
    Description: The ID of the AMI you just baked (e.g., ami-0xxxxxxx)
    Default: # Insert your AMI ID
  InstanceType:
    Type: String
    Default: t3.micro
  VpcCidr:
    Type: String
    Default: 10.0.0.0/16

Resources:
  # --- 1. NETWORKING LAYER ---
  VPC:
    Type: AWS::EC2::VPC
    Properties:
      CidrBlock: !Ref VpcCidr
      EnableDnsSupport: true
      EnableDnsHostnames: true
      Tags:
        - Key: Name
          Value: TranscoderVPC

  InternetGateway:
    Type: AWS::EC2::InternetGateway

  VPCGatewayAttachment:
    Type: AWS::EC2::VPCGatewayAttachment
    Properties:
      VpcId: !Ref VPC
      InternetGatewayId: !Ref InternetGateway

  # AZ 1 Subnets
  PublicSubnet1:
    Type: AWS::EC2::Subnet
    Properties:
      VpcId: !Ref VPC
      CidrBlock: 10.0.1.0/24
      AvailabilityZone: !Select
        - 0
        - !GetAZs ''
      MapPublicIpOnLaunch: true

  PrivateSubnet1:
    Type: AWS::EC2::Subnet
    Properties:
      VpcId: !Ref VPC
      CidrBlock: 10.0.2.0/24
      AvailabilityZone: !Select
        - 0
        - !GetAZs ''

  # AZ 2 Subnets (Required for ALB)
  PublicSubnet2:
    Type: AWS::EC2::Subnet
    Properties:
      VpcId: !Ref VPC
      CidrBlock: 10.0.3.0/24
      AvailabilityZone: !Select
        - 1
        - !GetAZs ''
      MapPublicIpOnLaunch: true

  PrivateSubnet2:
    Type: AWS::EC2::Subnet
    Properties:
      VpcId: !Ref VPC
      CidrBlock: 10.0.4.0/24
      AvailabilityZone: !Select
        - 1
        - !GetAZs ''

  PublicRouteTable:
    Type: AWS::EC2::RouteTable
    Properties:
      VpcId: !Ref VPC

  DefaultPublicRoute:
    Type: AWS::EC2::Route
    DependsOn: VPCGatewayAttachment
    Properties:
      RouteTableId: !Ref PublicRouteTable
      DestinationCidrBlock: 0.0.0.0/0
      GatewayId: !Ref InternetGateway

  PrivateRouteTable:
    Type: AWS::EC2::RouteTable
    Properties:
      VpcId: !Ref VPC

  # Associations
  PublicSubnet1Assoc:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      SubnetId: !Ref PublicSubnet1
      RouteTableId: !Ref PublicRouteTable

  PublicSubnet2Assoc:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      SubnetId: !Ref PublicSubnet2
      RouteTableId: !Ref PublicRouteTable

  PrivateSubnet1Association:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      SubnetId: !Ref PrivateSubnet1
      RouteTableId: !Ref PrivateRouteTable

  PrivateSubnet2Association:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      SubnetId: !Ref PrivateSubnet2
      RouteTableId: !Ref PrivateRouteTable

  # --- 2. VPC ENDPOINTS (Private Connectivity) ---
  S3Endpoint:
    Type: AWS::EC2::VPCEndpoint
    Properties:
      ServiceName: !Sub com.amazonaws.${AWS::Region}.s3
      VpcId: !Ref VPC
      VpcEndpointType: Gateway
      RouteTableIds:
        - !Ref PrivateRouteTable

  DynamoDBEndpoint:
    Type: AWS::EC2::VPCEndpoint
    Properties:
      ServiceName: !Sub com.amazonaws.${AWS::Region}.dynamodb
      VpcId: !Ref VPC
      VpcEndpointType: Gateway
      RouteTableIds:
        - !Ref PrivateRouteTable

  SQSEndpoint:
    Type: AWS::EC2::VPCEndpoint
    Properties:
      ServiceName: !Sub com.amazonaws.${AWS::Region}.sqs
      VpcId: !Ref VPC
      VpcEndpointType: Interface
      PrivateDnsEnabled: true
      SubnetIds:
        - !Ref PrivateSubnet1
        - !Ref PrivateSubnet2
      SecurityGroupIds:
        - !Ref SqsEndpointSG

  CloudWatchLogsEndpoint:
    Type: AWS::EC2::VPCEndpoint
    Properties:
      ServiceName: !Sub com.amazonaws.${AWS::Region}.logs
      VpcId: !Ref VPC
      VpcEndpointType: Interface
      PrivateDnsEnabled: true
      SubnetIds:
        - !Ref PrivateSubnet1
        - !Ref PrivateSubnet2
      SecurityGroupIds:
        - !Ref CloudWatchEndpointSG

  # --- 3. SECURITY GROUPS ---
  AlbSG:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: Allow HTTP to Load Balancer
      VpcId: !Ref VPC
      SecurityGroupIngress:
        - IpProtocol: tcp
          FromPort: 80
          ToPort: 80
          CidrIp: 0.0.0.0/0

  Ec2SG:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: Allow ALB to Workers
      VpcId: !Ref VPC
      SecurityGroupIngress:
        - IpProtocol: tcp
          FromPort: 8080
          ToPort: 8080
          SourceSecurityGroupId: !Ref AlbSG

  SqsEndpointSG:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: Allow EC2 to SQS Endpoint
      VpcId: !Ref VPC
      SecurityGroupIngress:
        - IpProtocol: tcp
          FromPort: 443
          ToPort: 443
          SourceSecurityGroupId: !Ref Ec2SG

  CloudWatchEndpointSG:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: Allow EC2 to CloudWatch Logs Endpoint
      VpcId: !Ref VPC
      SecurityGroupIngress:
        - IpProtocol: tcp
          FromPort: 443
          ToPort: 443
          SourceSecurityGroupId: !Ref Ec2SG

  # --- 4. LOAD BALANCER ---
  ALB:
    Type: AWS::ElasticLoadBalancingV2::LoadBalancer
    Properties:
      Subnets:
        - !Ref PublicSubnet1
        - !Ref PublicSubnet2
      SecurityGroups:
        - !Ref AlbSG

  TargetGroup:
    Type: AWS::ElasticLoadBalancingV2::TargetGroup
    Properties:
      VpcId: !Ref VPC
      Port: 8080
      Protocol: HTTP
      TargetType: instance
      HealthCheckPath: /q/health

  Listener:
    Type: AWS::ElasticLoadBalancingV2::Listener
    Properties:
      LoadBalancerArn: !Ref ALB
      Port: 80
      Protocol: HTTP
      DefaultActions:
        - Type: forward
          TargetGroupArn: !Ref TargetGroup

  # --- 5. COMPUTE & AUTO SCALING ---
  LaunchTemplate:
    Type: AWS::EC2::LaunchTemplate
    Properties:
      LaunchTemplateData:
        ImageId: !Ref BakedAmiId
        InstanceType: !Ref InstanceType
        SecurityGroupIds:
          - !Ref Ec2SG
        IamInstanceProfile:
          Arn: !GetAtt Ec2InstanceProfile.Arn

  ASG:
    Type: AWS::AutoScaling::AutoScalingGroup
    DependsOn:
      - TranscoderMediaBucket
      - TranscoderQueue
      - TranscodeTable
    Properties:
      VPCZoneIdentifier:
        - !Ref PrivateSubnet1
        - !Ref PrivateSubnet2
      LaunchTemplate:
        LaunchTemplateId: !Ref LaunchTemplate
        Version: !GetAtt LaunchTemplate.LatestVersionNumber
      MinSize: '1'
      MaxSize: '2'
      TargetGroupARNs:
        - !Ref TargetGroup

  # --- 6. IAM ROLE (The "Key" to services) ---
  Ec2InstanceProfile:
    Type: AWS::IAM::InstanceProfile
    Properties:
      Roles:
        - !Ref Ec2Role # This links your existing/new role to the profile

  Ec2Role:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - ec2.amazonaws.com
            Action:
              - sts:AssumeRole
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/AmazonS3FullAccess
        - arn:aws:iam::aws:policy/AmazonSQSFullAccess
        - arn:aws:iam::aws:policy/AmazonDynamoDBFullAccess
        - arn:aws:iam::aws:policy/CloudWatchAgentServerPolicy

  # ------- 7. Data layer ------------------

  TranscoderDLQ:
    Type: AWS::SQS::Queue
    Properties:
      QueueName: Transcoder-DLQ

  TranscoderQueue:
    Type: AWS::SQS::Queue
    Properties:
      QueueName: TranscoderVideoRequestsQ
      VisibilityTimeout: 300 # 5 minutes for FFmpeg to finish
      RedrivePolicy:
        deadLetterTargetArn: !GetAtt TranscoderDLQ.Arn
        maxReceiveCount: 3

  TranscodeTable:
    Type: AWS::DynamoDB::Table
    Properties:
      TableName: transcoderStats
      AttributeDefinitions:
        - AttributeName: video_id
          AttributeType: S
      KeySchema:
        - AttributeName: video_id
          KeyType: HASH
      BillingMode: PAY_PER_REQUEST

  S3ToSqsPolicy:
    Type: AWS::SQS::QueuePolicy
    Properties:
      Queues:
        - !Ref TranscoderQueue
      PolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              Service: s3.amazonaws.com
            Action: sqs:SendMessage
            Resource: !GetAtt TranscoderQueue.Arn
            Condition:
              ArnLike:
                aws:SourceArn: !Sub arn:aws:s3:::transcoderprocessingbucket

  TranscoderMediaBucket:
    Type: AWS::S3::Bucket
    DependsOn: S3ToSqsPolicy # Crucial: SQS policy must exist before S3 can validate the trigger
    Properties:
      BucketName: !Sub transcoderprocessingbucket
      NotificationConfiguration:
        QueueConfigurations:
          - Event: s3:ObjectCreated:*
            Queue: !GetAtt TranscoderQueue.Arn
            Filter:
              S3Key:
                Rules:
                  - Name: prefix
                    Value: PreProcess/