video-on-demand-on-aws.template

Description: "(SO0021) - Video On Demand workflow with AWS Step Functions, MediaConvert, MediaPackage, S3, CloudFront and DynamoDB. Version v5.2.0"

Parameters:

  AdminEmail:
    Description: Email address for SNS notifications (subscribed users will receive ingest, publishing, and error notifications)
    Type: String
    AllowedPattern: "^[_A-Za-z0-9-\\+]+(\\.[_A-Za-z0-9-]+)*@[A-Za-z0-9-]+(\\.[A-Za-z0-9]+)*(\\.[A-Za-z]{2,})$"

  WorkflowTrigger:
    Description: How the workflow will be triggered (source video upload to S3 or source metadata file upload)
    Type: String
    Default: VideoFile
    AllowedValues:
      - VideoFile
      - MetadataFile

  Glacier:
    Description: If enabled, source assets will be tagged for archiving to Glacier or Glacier Deep Archive once the workflow is complete
    Type: String
    Default: DISABLED
    AllowedValues:
      - DISABLED
      - GLACIER
      - DEEP_ARCHIVE

  FrameCapture:
    Description: If enabled, frame capture is added to the job submitted to MediaConvert
    Type: String
    Default: No
    AllowedValues:
      - Yes
      - No

  EnableMediaPackage:
    Description: If enabled, MediaPackage VOD will be included in the workflow
    Type: String
    Default: No
    AllowedValues:
      - Yes
      - No

  EnableSns:
    Description: Enable Ingest and Publish email notifications, error messages are not afeected by this parameter.
    Type: String
    Default: Yes
    AllowedValues:
      - Yes
      - No    
  
  EnableSqs:
    Description: Publish the workflow results to an SQS queue to injest upstream
    Type: String
    Default: Yes
    AllowedValues:
      - Yes
      - No  

  AcceleratedTranscoding:
    Description: Enable accelerated transcoding in AWS Elemental MediaConvert. PREFERRED will only use acceleration if the input files is supported. ENABLED accleration is applied to all files (this will fail for unsupported file types) see MediaConvert Documentation for more detail https://docs.aws.amazon.com/mediaconvert/latest/ug/accelerated-transcoding.html
    Type: String
    Default: PREFERRED
    AllowedValues:
      - ENABLED
      - DISABLED
      - PREFERRED

Metadata:
  AWS::CloudFormation::Interface:
    ParameterGroups:
      -
        Label:
          default: "Workflow"
        Parameters:
          - AdminEmail
          - WorkflowTrigger
          - Glacier
          - EnableSns
          - EnableSqs
      -
        Label:
          default: "AWS Elemental MediaConvert"
        Parameters:
          - FrameCapture
          - AcceleratedTranscoding
      -
        Label:
          default: "AWS Elemental MediaPackage"
        Parameters:
          - EnableMediaPackage
    ParameterLabels:
      AdminEmail:
        default: Notification email address
      Glacier:
        default: Archive source content
      WorkflowTrigger:
        default: Workflow trigger
      FrameCapture:
        default: Enable Frame Capture
      EnableMediaPackage:
        default: Enable MediaPackage
      AcceleratedTranscoding:
        default: Accelerated Transcoding
      EnableSns:
        default: Enable SNS Notifications
      EnableSqs:
        default: Enable SQS Messaging

Mappings:
  SourceCode:
    General:
      S3Bucket: "solutions"
      KeyPrefix: "video-on-demand-on-aws/v5.2.0"
  AnonymousData:
    SendAnonymousData:
      Data: Yes

Conditions:
  Metrics: !Equals [!FindInMap [AnonymousData, SendAnonymousData, Data], Yes]
  IsMediaPackageEnabled: !Equals [!Ref EnableMediaPackage, Yes]

Resources:
  CustomResourceRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - lambda.amazonaws.com
            Action:
              - sts:AssumeRole
      Path: "/"
      Policies:
        - PolicyName: !Sub "${AWS::StackName}-custom-resource"
          PolicyDocument:
            Statement:
              - Effect: Allow
                Action:
                  - logs:CreateLogGroup
                  - logs:CreateLogStream
                  - logs:PutLogEvents
                Resource:
                  - !Sub "arn:${AWS::Partition}:logs:${AWS::Region}:${AWS::AccountId}:log-group:/aws/lambda/*"
              - Effect: Allow
                Action:
                  - s3:PutBucketNotification
                  - s3:PutObject
                  - s3:PutObjectAcl
                Resource:
                  - !GetAtt Source.Arn
              - Effect: Allow
                Action:
                  - mediaconvert:CreatePreset
                  - mediaconvert:CreateJobTemplate
                  - mediaconvert:DeletePreset
                  - mediaconvert:DeleteJobTemplate
                  - mediaconvert:DescribeEndpoints
                  - mediaconvert:ListJobTemplates
                Resource:
                  - !Sub "arn:${AWS::Partition}:mediaconvert:${AWS::Region}:${AWS::AccountId}:*"
              - Effect: Allow
                Action:
                  - mediapackage-vod:DeleteAsset
                  - mediapackage-vod:DeletePackagingConfiguration
                Resource:
                  - !Sub "arn:${AWS::Partition}:mediapackage-vod:${AWS::Region}:${AWS::AccountId}:assets/*"
                  - !Sub "arn:${AWS::Partition}:mediapackage-vod:${AWS::Region}:${AWS::AccountId}:packaging-configurations/packaging-config-*"
              - Effect: Allow
                Action:
                  - mediapackage-vod:DescribePackagingGroup
                  - mediapackage-vod:DeletePackagingGroup
                Resource:
                  - !Sub "arn:${AWS::Partition}:mediapackage-vod:${AWS::Region}:${AWS::AccountId}:packaging-groups/${AWS::StackName}-packaging-group"
              - Effect: Allow
                Action:
                  - mediapackage-vod:CreatePackagingConfiguration
                  - mediapackage-vod:CreatePackagingGroup
                  - mediapackage-vod:ListAssets
                  - mediapackage-vod:ListPackagingConfigurations
                  - mediapackage-vod:ListPackagingGroups
                Resource: "*"
              - Effect: Allow
                Action:
                  - cloudfront:GetDistributionConfig
                  - cloudfront:UpdateDistribution
                Resource:
                  - !Sub "arn:${AWS::Partition}:cloudfront::${AWS::AccountId}:distribution/${CloudFront}"
    Metadata:
      cfn_nag:
        rules_to_suppress:
          - id: W11
            reason: "* is required to create CloudWatch logs and interact with MediaConvert / MediaPackage actions that do not support resource level permissions"
          - id: W76
            reason: "All policies are required by the custom resource."

  StepFunctionsServiceRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - !Sub "states.${AWS::Region}.amazonaws.com"
            Action:
              - sts:AssumeRole
      Policies:
        - PolicyName: !Sub "${AWS::StackName}-stepfunctions-service-role"
          PolicyDocument:
            Statement:
              - Effect: Allow
                Action:
                  - lambda:InvokeFunction
                Resource:
                  - !Sub "arn:${AWS::Partition}:lambda:${AWS::Region}:${AWS::AccountId}:function:*"
    Metadata:
      cfn_nag:
        rules_to_suppress:
          - id: W11
            reason: "The * resource is required since the functions need to be created before the state machine"

  MediaConvertRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - mediaconvert.amazonaws.com
            Action:
              - sts:AssumeRole
      Policies:
        - PolicyName: !Sub "${AWS::StackName}-mediatranscode-policy"
          PolicyDocument:
            Statement:
              - Effect: Allow
                Action:
                  - s3:GetObject
                  - s3:PutObject
                Resource:
                  - !Sub "${Source.Arn}/*"
                  - !Sub "${Destination.Arn}/*"
              - Effect: Allow
                Action:
                  - execute-api:Invoke
                Resource:
                  - !Sub "arn:${AWS::Partition}:execute-api:${AWS::Region}:${AWS::AccountId}:*"
    Metadata:
      cfn_nag:
        rules_to_suppress:
          - id: W11
            reason: "/* required to get/put objects to S3"

  MediaPackageVodRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - mediapackage.amazonaws.com
            Action:
              - sts:AssumeRole
      Policies:
        - PolicyName: !Sub "${AWS::StackName}-mediapackagevod-policy"
          PolicyDocument:
            Statement:
              - Effect: Allow
                Action:
                  - s3:GetObject
                  - s3:GetBucketLocation
                  - s3:GetBucketRequestPayment
                Resource:
                  - !Sub "${Destination.Arn}"
                  - !Sub "${Destination.Arn}/*"
    Metadata:
      cfn_nag:
        rules_to_suppress:
          - id: W11
            reason: "* is required to get objects from S3"

  S3LambdaInvokeVideo:
    Type: AWS::Lambda::Permission
    Properties:
      FunctionName: !GetAtt StepFunctions.Arn
      Action: lambda:InvokeFunction
      Principal: s3.amazonaws.com
      SourceAccount: !Ref AWS::AccountId

  CloudWatchLambdaInvokeErrors:
    Type: AWS::Lambda::Permission
    Properties:
      FunctionName: !GetAtt ErrorHandler.Arn
      Action: lambda:InvokeFunction
      Principal: events.amazonaws.com
      SourceArn: !GetAtt EncodeErrorRule.Arn

  CloudWatchLambdaInvokeCompletes:
    Type: AWS::Lambda::Permission
    Properties:
      FunctionName: !GetAtt StepFunctions.Arn
      Action: lambda:InvokeFunction
      Principal: events.amazonaws.com
      SourceArn: !GetAtt EncodeCompleteRule.Arn

  DestBucketPolicy:
    Type: AWS::S3::BucketPolicy
    Properties:
      Bucket: !Ref Destination
      PolicyDocument:
        Statement:
          - Effect: Allow
            Action:
              - s3:GetObject
            Resource: !Sub "arn:${AWS::Partition}:s3:::${Destination}/*"
            Principal:
              CanonicalUser: !GetAtt DestinationOriginAccessIdentity.S3CanonicalUserId

  EncodeCompleteRule:
    Type: AWS::Events::Rule
    Properties:
      Name: !Sub "${AWS::StackName}-EncodeComplete"
      Description: MediaConvert Completed event rule
      EventPattern:
        source:
          - aws.mediaconvert
        detail:
          status:
            - COMPLETE
          userMetadata:
            workflow:
              - !Ref AWS::StackName
      Targets:
        - Arn: !GetAtt StepFunctions.Arn
          Id: !Sub "${AWS::StackName}-StepFunctions"

  EncodeErrorRule:
    Type: AWS::Events::Rule
    Properties:
      Name: !Sub "${AWS::StackName}-EncodeError"
      Description: MediaConvert Error event rule
      EventPattern:
        source:
          - aws.mediaconvert
        detail:
          status:
            - ERROR
          userMetadata:
            workflow:
              - !Ref AWS::StackName
      Targets:
        - Arn: !GetAtt ErrorHandler.Arn
          Id: !Sub "${AWS::StackName}-EncodeError"

  DynamoDBTable:
    DeletionPolicy: Retain
    UpdateReplacePolicy: Retain
    Type: AWS::DynamoDB::Table
    Properties:
      BillingMode: PAY_PER_REQUEST
      PointInTimeRecoverySpecification: 
        PointInTimeRecoveryEnabled: true
      AttributeDefinitions:
        - AttributeName: guid
          AttributeType: S
        - AttributeName: srcBucket
          AttributeType: S
        - AttributeName: startTime
          AttributeType: S
      KeySchema:
        - AttributeName: guid
          KeyType: HASH
      GlobalSecondaryIndexes:
        - IndexName: srcBucket-startTime-index
          KeySchema:
          - AttributeName: srcBucket
            KeyType: HASH
          - AttributeName: startTime
            KeyType: RANGE
          Projection:
            ProjectionType: ALL
      TableName: !Ref AWS::StackName
    Metadata:
      cfn_nag:
        rules_to_suppress:
          - id: W28
            reason: "Table name is set to the stack name"
          - id: W74
            reason: " The DynamoDB table is configured to use the default encryption"

  Source:
    DeletionPolicy: Retain
    UpdateReplacePolicy: Retain
    Type: AWS::S3::Bucket
    Properties:
      LoggingConfiguration:
        DestinationBucketName: !Ref Logs
        LogFilePrefix: s3-access/
      LifecycleConfiguration:
        Rules:
          - Id: !Sub "${AWS::StackName}-source-archive"
            TagFilters:
              - Key: !Ref AWS::StackName
                Value: GLACIER
            Status: Enabled
            Transitions:
            - TransitionInDays: 1
              StorageClass: GLACIER
          - Id: !Sub "${AWS::StackName}-source-deep-archive"
            TagFilters:
              - Key: !Ref AWS::StackName
                Value: DEEP_ARCHIVE
            Status: Enabled
            Transitions:
            - TransitionInDays: 1
              StorageClass: DEEP_ARCHIVE
      BucketEncryption:
        ServerSideEncryptionConfiguration:
          - ServerSideEncryptionByDefault:
              SSEAlgorithm: AES256
      PublicAccessBlockConfiguration:
        BlockPublicAcls: true
        BlockPublicPolicy: true
        IgnorePublicAcls: true
        RestrictPublicBuckets: true
    Metadata:
      cfn_nag:
        rules_to_suppress:
          - id: W51
            reason: "Bucket does not need a bucket policy"

  Destination:
    DeletionPolicy: Retain
    UpdateReplacePolicy: Retain
    Type: AWS::S3::Bucket
    Properties:
      LoggingConfiguration:
        DestinationBucketName: !Ref Logs
        LogFilePrefix: s3-access/
      CorsConfiguration:
        CorsRules:
          - AllowedMethods: [GET]
            AllowedOrigins: ['*']
            AllowedHeaders: ['*']
            MaxAge: 3000
      PublicAccessBlockConfiguration:
        BlockPublicAcls: true
        BlockPublicPolicy: true
        IgnorePublicAcls: true
        RestrictPublicBuckets: true
      BucketEncryption:
        ServerSideEncryptionConfiguration:
          - ServerSideEncryptionByDefault:
              SSEAlgorithm: AES256

  Logs:
    DeletionPolicy: Retain
    UpdateReplacePolicy: Retain
    Type: AWS::S3::Bucket
    Properties:
      AccessControl: LogDeliveryWrite
      BucketEncryption:
        ServerSideEncryptionConfiguration:
          - ServerSideEncryptionByDefault:
              SSEAlgorithm: AES256
      PublicAccessBlockConfiguration:
        BlockPublicAcls: true
        BlockPublicPolicy: true
        IgnorePublicAcls: true
        RestrictPublicBuckets: true
    Metadata:
      cfn_nag:
        rules_to_suppress:
          - id: W35
            reason: "Used to store access logs for other buckets"
          - id: W51
            reason: "Bucket does not need a bucket policy"

  SnsTopic:
    Type: AWS::SNS::Topic
    Properties:
      DisplayName: !Sub "${AWS::StackName}-Notifications"
      KmsMasterKeyId: alias/aws/sns
      Subscription:
        - Endpoint: !Ref AdminEmail
          Protocol: email

  SqsQueue:
    Type: AWS::SQS::Queue
    Properties:
      VisibilityTimeout: 120
      QueueName: !Sub ${AWS::StackName}
      RedrivePolicy:
        deadLetterTargetArn: !Sub ${SqsQueueDlq.Arn}
        maxReceiveCount: 1
      KmsDataKeyReusePeriodSeconds: 300
      KmsMasterKeyId: alias/aws/sqs

  SqsQueueDlq:
    Type: AWS::SQS::Queue
    Properties:
      VisibilityTimeout: 120
      QueueName: !Sub ${AWS::StackName}-dlq
      KmsDataKeyReusePeriodSeconds: 300
      KmsMasterKeyId: alias/aws/sqs

  DestinationOriginAccessIdentity:
    Type: AWS::CloudFront::CloudFrontOriginAccessIdentity
    Properties:
      CloudFrontOriginAccessIdentityConfig:
        Comment: !Sub "access-identity-${Destination}"

  CloudFront:
    Type: AWS::CloudFront::Distribution
    Properties:
      DistributionConfig:
        Origins:
          - DomainName: !Sub "${Destination}.s3.${AWS::Region}.amazonaws.com"
            Id: vodS3Origin
            S3OriginConfig:
              OriginAccessIdentity: !Sub "origin-access-identity/cloudfront/${DestinationOriginAccessIdentity}"
        Enabled: true
        Logging:
          IncludeCookies: false
          Bucket: !GetAtt Logs.DomainName
          Prefix: cloudfront-logs/
        DefaultCacheBehavior:
          AllowedMethods:
          - GET
          - HEAD
          Compress: true
          MaxTTL: 0
          MinTTL: 0
          ViewerProtocolPolicy: "redirect-to-https"
          DefaultTTL: 0
          TargetOriginId: vodS3Origin
          ForwardedValues:
            QueryString: false
            Cookies:
              Forward: none
            Headers:
              - Origin
              - Access-Control-Request-Method
              - Access-Control-Request-Headers
        PriceClass: PriceClass_100
        ViewerCertificate:
          CloudFrontDefaultCertificate: true
    Metadata:
      cfn_nag:
        rules_to_suppress:
          - id: W70
            reason: "CloudFront automatically sets the security policy to TLSv1 when the distribution uses the CloudFront domain name (CloudFrontDefaultCertificate=true)"

  S3Config:
    DependsOn: CloudFront
    Type: Custom::S3
    Properties:
      ServiceToken: !GetAtt CustomResource.Arn
      Source: !Ref Source
      IngestArn: !GetAtt StepFunctions.Arn
      Resource: S3Notification
      WorkflowTrigger: !Ref WorkflowTrigger

  MediaConvertEndPoint:
    Type: Custom::LoadLambda
    Properties:
      ServiceToken: !GetAtt CustomResource.Arn
      Resource: EndPoint

  MediaConvertTemplates:
    Type: Custom::LoadLambda
    Properties:
      ServiceToken: !GetAtt CustomResource.Arn
      Resource: MediaConvertTemplates
      StackName: !Ref AWS::StackName
      EndPoint: !GetAtt MediaConvertEndPoint.EndpointUrl
      EnableMediaPackage: !Ref EnableMediaPackage
      EnableNewTemplates: true

  MediaPackageVod:
    Type: Custom::LoadLambda
    Properties:
      ServiceToken: !GetAtt CustomResource.Arn
      Resource: MediaPackageVod
      StackName: !Ref AWS::StackName
      GroupId: !Sub "${AWS::StackName}-packaging-group"
      PackagingConfigurations: "HLS,DASH,MSS,CMAF"
      DistributionId: !Ref CloudFront
      EnableMediaPackage: !Ref EnableMediaPackage

  CustomResource:
    Type: AWS::Lambda::Function
    Properties:
      FunctionName: !Sub "${AWS::StackName}-custom-resource"
      Description: Used to deploy resources not supported by CloudFormation
      Handler: index.handler
      Role: !GetAtt CustomResourceRole.Arn
      Code:
        S3Bucket: !Join ["-", [!FindInMap ["SourceCode", "General", "S3Bucket"], Ref: "AWS::Region"]]
        S3Key: !Join ["/", [!FindInMap ["SourceCode", "General", "KeyPrefix"], "custom-resource.zip"]]
      Runtime: nodejs12.x
      Timeout: 180
      Environment:
        Variables:
          AWS_NODEJS_CONNECTION_REUSE_ENABLED: "1"

  StepFunctionsRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - lambda.amazonaws.com
            Action:
              - sts:AssumeRole
      Policies:
        - PolicyName: !Sub "${AWS::StackName}-step-functions-role"
          PolicyDocument:
            Statement:
              - Effect: Allow
                Action:
                  - states:StartExecution
                Resource:
                  - !Sub "arn:${AWS::Partition}:states:${AWS::Region}:${AWS::AccountId}:stateMachine:${AWS::StackName}-ingest"
                  - !Sub "arn:${AWS::Partition}:states:${AWS::Region}:${AWS::AccountId}:stateMachine:${AWS::StackName}-process"
                  - !Sub "arn:${AWS::Partition}:states:${AWS::Region}:${AWS::AccountId}:stateMachine:${AWS::StackName}-publish"
              - Effect: Allow
                Action:
                  - lambda:InvokeFunction
                Resource:
                  - !Sub "arn:${AWS::Partition}:lambda:${AWS::Region}:${AWS::AccountId}:function:${AWS::StackName}-error-handler"
              - Effect: Allow
                Action:
                  - logs:CreateLogGroup
                  - logs:CreateLogStream
                  - logs:PutLogEvents
                Resource:
                  - !Sub "arn:${AWS::Partition}:logs:${AWS::Region}:${AWS::AccountId}:log-group:/aws/lambda/*"
    Metadata:
      cfn_nag:
        rules_to_suppress:
          - id: W11
            reason: "* is used so that the Lambda function can create log groups"

  StepFunctions:
    Type: AWS::Lambda::Function
    Properties:
      FunctionName: !Sub "${AWS::StackName}-step-functions"
      Description: Creates a unique identifer (GUID) and executes the Ingest StateMachine
      Handler: index.handler
      Role: !GetAtt StepFunctionsRole.Arn
      Code:
        S3Bucket: !Join ["-", [!FindInMap ["SourceCode", "General", "S3Bucket"], Ref: "AWS::Region"]]
        S3Key: !Join ["/", [!FindInMap ["SourceCode", "General", "KeyPrefix"], "step-functions.zip"]]
      Runtime: nodejs12.x
      Timeout: 120
      Environment:
        Variables:
          AWS_NODEJS_CONNECTION_REUSE_ENABLED: "1"
          IngestWorkflow: !Sub "arn:${AWS::Partition}:states:${AWS::Region}:${AWS::AccountId}:stateMachine:${AWS::StackName}-ingest"
          ProcessWorkflow: !Sub "arn:${AWS::Partition}:states:${AWS::Region}:${AWS::AccountId}:stateMachine:${AWS::StackName}-process"
          PublishWorkflow: !Sub "arn:${AWS::Partition}:states:${AWS::Region}:${AWS::AccountId}:stateMachine:${AWS::StackName}-publish"
          ErrorHandler: !GetAtt ErrorHandler.Arn

  InputValidateRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - lambda.amazonaws.com
            Action:
              - sts:AssumeRole
      Policies:
        - PolicyName: !Sub "${AWS::StackName}-input-validate-role"
          PolicyDocument:
            Statement:
              - Effect: Allow
                Action:
                  - s3:GetObject
                Resource:
                  - !Sub "${Source.Arn}/*"
              - Effect: Allow
                Action:
                  - lambda:InvokeFunction
                Resource:
                  - !Sub "arn:${AWS::Partition}:lambda:${AWS::Region}:${AWS::AccountId}:function:${AWS::StackName}-error-handler"
              - Effect: Allow
                Action:
                  - logs:CreateLogGroup
                  - logs:CreateLogStream
                  - logs:PutLogEvents
                Resource:
                  - !Sub "arn:${AWS::Partition}:logs:${AWS::Region}:${AWS::AccountId}:log-group:/aws/lambda/*"
    Metadata:
      cfn_nag:
        rules_to_suppress:
          - id: W11
            reason: "* is used so that the Lambda function can create log groups; S3 action is limited to one bucket"

  InputValidate:
    Type: AWS::Lambda::Function
    Properties:
      FunctionName: !Sub "${AWS::StackName}-input-validate"
      Description: Validates the input given to the workflow
      Handler: index.handler
      Role: !GetAtt InputValidateRole.Arn
      Code:
        S3Bucket: !Join ["-", [!FindInMap ["SourceCode", "General", "S3Bucket"], Ref: "AWS::Region"]]
        S3Key: !Join ["/", [!FindInMap ["SourceCode", "General", "KeyPrefix"], "input-validate.zip"]]
      Runtime: nodejs12.x
      Timeout: 120
      Environment:
        Variables:
          AWS_NODEJS_CONNECTION_REUSE_ENABLED: "1"
          ErrorHandler: !GetAtt ErrorHandler.Arn
          WorkflowName: !Ref AWS::StackName
          Source: !Ref Source
          Destination: !Ref Destination
          FrameCapture: !Ref FrameCapture
          ArchiveSource: !Ref Glacier
          MediaConvert_Template_2160p:
            !If
              - IsMediaPackageEnabled
              - !Sub "${AWS::StackName}_Ott_2160p_Avc_Aac_16x9_mvod_no_preset"
              - !Sub "${AWS::StackName}_Ott_2160p_Avc_Aac_16x9_qvbr_no_preset"
          MediaConvert_Template_1080p:
            !If
              - IsMediaPackageEnabled
              - !Sub "${AWS::StackName}_Ott_1080p_Avc_Aac_16x9_mvod_no_preset"
              - !Sub "${AWS::StackName}_Ott_1080p_Avc_Aac_16x9_qvbr_no_preset"
          MediaConvert_Template_720p:
            !If
              - IsMediaPackageEnabled
              - !Sub "${AWS::StackName}_Ott_720p_Avc_Aac_16x9_mvod_no_preset"
              - !Sub "${AWS::StackName}_Ott_720p_Avc_Aac_16x9_qvbr_no_preset"
          CloudFront: !GetAtt CloudFront.DomainName
          EnableMediaPackage: !Ref EnableMediaPackage
          InputRotate: DEGREE_0
          EnableSns: !Ref EnableSns
          EnableSqs: !Ref EnableSqs
          AcceleratedTranscoding: !Ref AcceleratedTranscoding

  MediainfoRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - lambda.amazonaws.com
            Action:
              - sts:AssumeRole
      Policies:
        - PolicyName: !Sub "${AWS::StackName}-mediainfo-role"
          PolicyDocument:
            Statement:
              - Effect: Allow
                Action:
                  - s3:GetObject
                Resource:
                  - !Sub "${Source.Arn}/*"
              - Effect: Allow
                Action:
                  - lambda:InvokeFunction
                Resource:
                  - !Sub "arn:${AWS::Partition}:lambda:${AWS::Region}:${AWS::AccountId}:function:${AWS::StackName}-error-handler"
              - Effect: Allow
                Action:
                  - logs:CreateLogGroup
                  - logs:CreateLogStream
                  - logs:PutLogEvents
                Resource:
                  - !Sub "arn:${AWS::Partition}:logs:${AWS::Region}:${AWS::AccountId}:log-group:/aws/lambda/*"
    Metadata:
      cfn_nag:
        rules_to_suppress:
          - id: W11
            reason: "* is limited to one S3 bucket"


  Mediainfo:
    Type: AWS::Lambda::Function
    Properties:
      FunctionName: !Sub "${AWS::StackName}-mediainfo"
      Description: Runs mediainfo on a pre-signed S3 URL
      Handler: lambda_function.lambda_handler
      Role: !GetAtt MediainfoRole.Arn
      Code:
        S3Bucket: !Join ["-", [!FindInMap ["SourceCode", "General", "S3Bucket"], Ref: "AWS::Region"]]
        S3Key: !Join ["/", [!FindInMap ["SourceCode", "General", "KeyPrefix"], "mediainfo.zip"]]
      Runtime: python3.7
      Timeout: 120
      Environment:
        Variables:
          ErrorHandler: !GetAtt ErrorHandler.Arn

  DynamoUpdateRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - lambda.amazonaws.com
            Action:
              - sts:AssumeRole
      Policies:
        - PolicyName: !Sub "${AWS::StackName}-dynamo-role"
          PolicyDocument:
            Statement:
              - Effect: Allow
                Action:
                  - lambda:InvokeFunction
                Resource:
                  - !Sub "arn:${AWS::Partition}:lambda:${AWS::Region}:${AWS::AccountId}:function:${AWS::StackName}-error-handler"
              - Effect: Allow
                Action:
                  - dynamodb:UpdateItem
                Resource:
                  - !Sub "arn:${AWS::Partition}:dynamodb:${AWS::Region}:${AWS::AccountId}:table/${DynamoDBTable}"
              - Effect: Allow
                Action:
                  - logs:CreateLogGroup
                  - logs:CreateLogStream
                  - logs:PutLogEvents
                Resource:
                  - !Sub "arn:${AWS::Partition}:logs:${AWS::Region}:${AWS::AccountId}:log-group:/aws/lambda/*"
    Metadata:
      cfn_nag:
        rules_to_suppress:
          - id: W11
            reason: "* is used so that the Lambda function can create log groups"

  DynamodbUpdate:
    Type: AWS::Lambda::Function
    Properties:
      FunctionName: !Sub "${AWS::StackName}-dynamo"
      Description: Updates DynamoDB with event data
      Handler: index.handler
      Role: !GetAtt DynamoUpdateRole.Arn
      Code:
        S3Bucket: !Join ["-", [!FindInMap ["SourceCode", "General", "S3Bucket"], Ref: "AWS::Region"]]
        S3Key: !Join ["/", [!FindInMap ["SourceCode", "General", "KeyPrefix"], "dynamo.zip"]]
      Runtime: nodejs12.x
      Timeout: 120
      Environment:
        Variables:
          AWS_NODEJS_CONNECTION_REUSE_ENABLED: "1"
          DynamoDBTable: !Ref DynamoDBTable
          ErrorHandler: !GetAtt ErrorHandler.Arn

  ProfilerRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - lambda.amazonaws.com
            Action:
              - sts:AssumeRole
      Policies:
        - PolicyName: !Sub "${AWS::StackName}-profiler-role"
          PolicyDocument:
            Statement:
              - Effect: Allow
                Action:
                  - lambda:InvokeFunction
                Resource:
                  - !Sub "arn:${AWS::Partition}:lambda:${AWS::Region}:${AWS::AccountId}:function:${AWS::StackName}-error-handler"
              - Effect: Allow
                Action:
                  - dynamodb:GetItem
                Resource:
                  - !Sub "arn:${AWS::Partition}:dynamodb:${AWS::Region}:${AWS::AccountId}:table/${DynamoDBTable}"
              - Effect: Allow
                Action:
                  - logs:CreateLogGroup
                  - logs:CreateLogStream
                  - logs:PutLogEvents
                Resource:
                  - !Sub "arn:${AWS::Partition}:logs:${AWS::Region}:${AWS::AccountId}:log-group:/aws/lambda/*"
    Metadata:
      cfn_nag:
        rules_to_suppress:
          - id: W11
            reason: "* is used so that the Lambda function can create log groups"

  Profiler:
    Type: AWS::Lambda::Function
    Properties:
      FunctionName: !Sub "${AWS::StackName}-profiler"
      Description: Sets an EncodeProfile based on mediainfo output
      Handler: index.handler
      Role: !GetAtt ProfilerRole.Arn
      Code:
        S3Bucket: !Join ["-", [!FindInMap ["SourceCode", "General", "S3Bucket"], Ref: "AWS::Region"]]
        S3Key: !Join ["/", [!FindInMap ["SourceCode", "General", "KeyPrefix"], "profiler.zip"]]
      Runtime: nodejs12.x
      Timeout: 120
      Environment:
        Variables:
          AWS_NODEJS_CONNECTION_REUSE_ENABLED: "1"
          DynamoDBTable: !Ref DynamoDBTable
          ErrorHandler: !GetAtt ErrorHandler.Arn

  EncodeRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - lambda.amazonaws.com
            Action:
              - sts:AssumeRole
      Policies:
        - PolicyName: !Sub "${AWS::StackName}-encode-role"
          PolicyDocument:
            Statement:
              - Effect: Allow
                Action:
                  - lambda:InvokeFunction
                Resource:
                  - !Sub "arn:${AWS::Partition}:lambda:${AWS::Region}:${AWS::AccountId}:function:${AWS::StackName}-error-handler"
              - Effect: Allow
                Action:
                  - mediaconvert:CreateJob
                  - mediaconvert:GetJobTemplate
                Resource:
                  - !Sub "arn:${AWS::Partition}:mediaconvert:${AWS::Region}:${AWS::AccountId}:*"
              - Effect: Allow
                Action:
                  - iam:PassRole
                Resource:
                  - !GetAtt MediaConvertRole.Arn
              - Effect: Allow
                Action:
                  - logs:CreateLogGroup
                  - logs:CreateLogStream
                  - logs:PutLogEvents
                Resource:
                  - !Sub "arn:${AWS::Partition}:logs:${AWS::Region}:${AWS::AccountId}:log-group:/aws/lambda/*"
    Metadata:
      cfn_nag:
        rules_to_suppress:
          - id: W11
            reason: "* is used so that the Lambda function can create log groups; MediaConvert job ids are randomly generated"

  Encode:
    Type: AWS::Lambda::Function
    Properties:
      FunctionName: !Sub "${AWS::StackName}-encode"
      Description: Creates a MediaConvert encode job
      Handler: index.handler
      Role: !GetAtt EncodeRole.Arn
      Code:
        S3Bucket: !Join ["-", [!FindInMap ["SourceCode", "General", "S3Bucket"], Ref: "AWS::Region"]]
        S3Key: !Join ["/", [!FindInMap ["SourceCode", "General", "KeyPrefix"], "encode.zip"]]
      Runtime: nodejs12.x
      Timeout: 120
      Environment:
        Variables:
          AWS_NODEJS_CONNECTION_REUSE_ENABLED: "1"
          ErrorHandler: !GetAtt ErrorHandler.Arn
          MediaConvertRole: !GetAtt MediaConvertRole.Arn
          EndPoint: !GetAtt MediaConvertEndPoint.EndpointUrl

  OutputValidateRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - lambda.amazonaws.com
            Action:
              - sts:AssumeRole
      Policies:
        - PolicyName: !Sub "${AWS::StackName}-output-validate-role"
          PolicyDocument:
            Statement:
              - Effect: Allow
                Action:
                  - lambda:InvokeFunction
                Resource:
                  - !Sub "arn:${AWS::Partition}:lambda:${AWS::Region}:${AWS::AccountId}:function:${AWS::StackName}-error-handler"
              - Effect: Allow
                Action:
                  - dynamodb:GetItem
                Resource:
                  - !Sub "arn:${AWS::Partition}:dynamodb:${AWS::Region}:${AWS::AccountId}:table/${DynamoDBTable}"
              - Effect: Allow
                Action:
                  - s3:ListBucket
                Resource:
                  - !GetAtt Destination.Arn
              - Effect: Allow
                Action:
                  - logs:CreateLogGroup
                  - logs:CreateLogStream
                  - logs:PutLogEvents
                Resource:
                  - !Sub "arn:${AWS::Partition}:logs:${AWS::Region}:${AWS::AccountId}:log-group:/aws/lambda/*"
    Metadata:
      cfn_nag:
        rules_to_suppress:
          - id: W11
            reason: "* is used so that the Lambda function can create log groups"

  OutputValidate:
    Type: AWS::Lambda::Function
    Properties:
      FunctionName: !Sub "${AWS::StackName}-output-validate"
      Description: Parses MediaConvert job output
      Handler: index.handler
      Role: !GetAtt OutputValidateRole.Arn
      Code:
        S3Bucket: !Join ["-", [!FindInMap ["SourceCode", "General", "S3Bucket"], Ref: "AWS::Region"]]
        S3Key: !Join ["/", [!FindInMap ["SourceCode", "General", "KeyPrefix"], "output-validate.zip"]]
      Runtime: nodejs12.x
      Timeout: 120
      Environment:
        Variables:
          AWS_NODEJS_CONNECTION_REUSE_ENABLED: "1"
          DynamoDBTable: !Ref DynamoDBTable
          ErrorHandler: !GetAtt ErrorHandler.Arn
          EndPoint: !GetAtt MediaConvertEndPoint.EndpointUrl

  ArchiveSourceRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - lambda.amazonaws.com
            Action:
              - sts:AssumeRole
      Policies:
        - PolicyName: !Sub "${AWS::StackName}-archive-source-role"
          PolicyDocument:
            Statement:
              - Effect: Allow
                Action:
                  - s3:PutObjectTagging
                Resource:
                  - !Sub "${Source.Arn}/*"
              - Effect: Allow
                Action:
                  - lambda:InvokeFunction
                Resource:
                  - !Sub "arn:${AWS::Partition}:lambda:${AWS::Region}:${AWS::AccountId}:function:${AWS::StackName}-error-handler"
              - Effect: Allow
                Action:
                  - logs:CreateLogGroup
                  - logs:CreateLogStream
                  - logs:PutLogEvents
                Resource:
                  - !Sub "arn:${AWS::Partition}:logs:${AWS::Region}:${AWS::AccountId}:log-group:/aws/lambda/*"
    Metadata:
      cfn_nag:
        rules_to_suppress:
          - id: W11
            reason: "* is used so that the Lambda function can create log groups; S3 action is limited to one bucket"

  ArchiveSource:
    Type: AWS::Lambda::Function
    Properties:
      FunctionName: !Sub "${AWS::StackName}-archive-source"
      Description: Updates tags on source files to enable Glacier
      Handler: index.handler
      Role: !GetAtt ArchiveSourceRole.Arn
      Code:
        S3Bucket: !Join ["-", [!FindInMap ["SourceCode", "General", "S3Bucket"], Ref: "AWS::Region"]]
        S3Key: !Join ["/", [!FindInMap ["SourceCode", "General", "KeyPrefix"], "archive-source.zip"]]
      Runtime: nodejs12.x
      Timeout: 120
      Environment:
        Variables:
          AWS_NODEJS_CONNECTION_REUSE_ENABLED: "1"
          ErrorHandler: !GetAtt ErrorHandler.Arn

  SqsSendMessageRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          -
            Effect: Allow
            Principal:
              Service:
                - lambda.amazonaws.com
            Action:
              - sts:AssumeRole
      Policies:
        -
          PolicyName: !Sub "${AWS::StackName}-sqs-publish-role"
          PolicyDocument:
            Statement:
              -
                Effect: Allow
                Action:
                  - lambda:InvokeFunction
                Resource:
                  - !Sub "arn:aws:lambda:${AWS::Region}:${AWS::AccountId}:function:${AWS::StackName}-error-handler"
              -
                Effect: Allow
                Action:
                  - sqs:SendMessage
                Resource:
                  - !GetAtt SqsQueue.Arn
                Condition:
                  Bool:
                    'aws:SecureTransport': 'true'
              -
                Effect: Allow
                Action:
                  - logs:CreateLogGroup
                  - logs:CreateLogStream
                  - logs:PutLogEvents
                Resource:
                  - !Sub "arn:aws:logs:${AWS::Region}:${AWS::AccountId}:log-group:/aws/lambda/*"
    Metadata:
      cfn_nag:
        rules_to_suppress:
          - id: W11
            reason: "* is used so that the Lambda function can create log groups"

  SqsSendMessage:
    Type: AWS::Lambda::Function
    Properties:
      FunctionName: !Sub ${AWS::StackName}-sqs-publish
      Description: Publish the workflow results to an SQS queue
      Handler: index.handler
      Role: !GetAtt SqsSendMessageRole.Arn
      Code:
        S3Bucket: !Join ["-", [!FindInMap ["SourceCode", "General", "S3Bucket"], Ref: "AWS::Region"]]
        S3Key: !Join ["/", [!FindInMap ["SourceCode", "General", "KeyPrefix"], "sqs-publish.zip"]]
      Runtime: nodejs12.x
      Timeout: 120
      Environment:
        Variables:
          AWS_NODEJS_CONNECTION_REUSE_ENABLED: "1"
          ErrorHandler: !GetAtt ErrorHandler.Arn
          SqsQueue: !Ref SqsQueue
  SnsNotificationRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          -
            Effect: Allow
            Principal:
              Service:
                - lambda.amazonaws.com
            Action:
              - sts:AssumeRole
      Policies:
        - PolicyName: !Sub "${AWS::StackName}-sns-notification-role"
          PolicyDocument:
            Statement:
              - Effect: Allow
                Action:
                  - lambda:InvokeFunction
                Resource:
                  - !Sub "arn:${AWS::Partition}:lambda:${AWS::Region}:${AWS::AccountId}:function:${AWS::StackName}-error-handler"
              - Effect: Allow
                Action:
                  - sns:Publish
                Resource:
                  - !Ref SnsTopic
                Condition:
                  Bool:
                    'aws:SecureTransport': 'true'                
              - Effect: Allow
                Action:
                  - logs:CreateLogGroup
                  - logs:CreateLogStream
                  - logs:PutLogEvents
                Resource:
                  - !Sub "arn:${AWS::Partition}:logs:${AWS::Region}:${AWS::AccountId}:log-group:/aws/lambda/*"
    Metadata:
      cfn_nag:
        rules_to_suppress:
          - id: W11
            reason: "* is used so that the Lambda function can create log groups"

  SnsNotification:
    Type: AWS::Lambda::Function
    Properties:
      FunctionName: !Sub "${AWS::StackName}-sns-notification"
      Description: Sends a notification when the encode job is completed
      Handler: index.handler
      Role: !GetAtt SnsNotificationRole.Arn
      Code:
        S3Bucket: !Join ["-", [!FindInMap ["SourceCode", "General", "S3Bucket"], Ref: "AWS::Region"]]
        S3Key: !Join ["/", [!FindInMap ["SourceCode", "General", "KeyPrefix"], "sns-notification.zip"]]
      Runtime: nodejs12.x
      Timeout: 120
      Environment:
        Variables:
          AWS_NODEJS_CONNECTION_REUSE_ENABLED: "1"
          ErrorHandler: !GetAtt ErrorHandler.Arn
          SnsTopic: !Ref SnsTopic

  MediaPackageAssetsRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - lambda.amazonaws.com
            Action:
              - sts:AssumeRole
      Policies:
        - PolicyName: !Sub "${AWS::StackName}-media-package-assets-role"
          PolicyDocument:
            Statement:
              - Effect: Allow
                Action:
                  - lambda:InvokeFunction
                Resource:
                  - !Sub "arn:${AWS::Partition}:lambda:${AWS::Region}:${AWS::AccountId}:function:${AWS::StackName}-error-handler"
              - Effect: Allow
                Action:
                  - iam:PassRole
                Resource:
                  - !GetAtt MediaPackageVodRole.Arn
              - Effect: Allow
                Action:
                  - logs:CreateLogGroup
                  - logs:CreateLogStream
                  - logs:PutLogEvents
                Resource:
                  - !Sub "arn:${AWS::Partition}:logs:${AWS::Region}:${AWS::AccountId}:log-group:/aws/lambda/*"
              - Effect: Allow
                Action:
                  - mediapackage-vod:CreateAsset
                Resource: "*"
    Metadata:
      cfn_nag:
        rules_to_suppress:
          - id: W11
            reason: "* is used so that the Lambda function can create log groups; MediaPackage action that does not support resource level permissions"

  MediaPackageAssets:
    Type: AWS::Lambda::Function
    Properties:
      FunctionName: !Sub "${AWS::StackName}-media-package-assets"
      Description: Ingests an asset into MediaPackage-VOD
      Handler: index.handler
      Role: !GetAtt MediaPackageAssetsRole.Arn
      Code:
        S3Bucket: !Join ["-", [!FindInMap ["SourceCode", "General", "S3Bucket"], Ref: "AWS::Region"]]
        S3Key: !Join ["/", [!FindInMap ["SourceCode", "General", "KeyPrefix"], "media-package-assets.zip"]]
      Runtime: nodejs12.x
      Timeout: 300
      Environment:
        Variables:
          AWS_NODEJS_CONNECTION_REUSE_ENABLED: "1"
          ErrorHandler: !GetAtt ErrorHandler.Arn
          GroupId: !GetAtt MediaPackageVod.GroupId
          GroupDomainName: !GetAtt MediaPackageVod.GroupDomainName
          MediaPackageVodRole: !GetAtt MediaPackageVodRole.Arn

  ErrorHandlerRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - lambda.amazonaws.com
            Action:
              - sts:AssumeRole
      Policies:
        - PolicyName: !Sub "${AWS::StackName}-error-handler-role"
          PolicyDocument:
            Statement:
              - Effect: Allow
                Action:
                  - sns:Publish
                Resource:
                  - !Ref SnsTopic
                Condition:
                  Bool:
                    'aws:SecureTransport': 'true'
              - Effect: Allow
                Action:
                  - dynamodb:UpdateItem
                Resource:
                  - !Sub "arn:${AWS::Partition}:dynamodb:${AWS::Region}:${AWS::AccountId}:table/${DynamoDBTable}"
              - Effect: Allow
                Action:
                  - logs:CreateLogGroup
                  - logs:CreateLogStream
                  - logs:PutLogEvents
                Resource:
                  - !Sub "arn:${AWS::Partition}:logs:${AWS::Region}:${AWS::AccountId}:log-group:/aws/lambda/*"
    Metadata:
      cfn_nag:
        rules_to_suppress:
          - id: W11
            reason: "* is used so that the Lambda function can create log groups"

  ErrorHandler:
    Type: AWS::Lambda::Function
    Properties:
      FunctionName: !Sub "${AWS::StackName}-error-handler"
      Description: Captures and processes workflow errors
      Handler: index.handler
      Role: !GetAtt ErrorHandlerRole.Arn
      Code:
        S3Bucket: !Join ["-", [!FindInMap ["SourceCode", "General", "S3Bucket"], Ref: "AWS::Region"]]
        S3Key: !Join ["/", [!FindInMap ["SourceCode", "General", "KeyPrefix"], "error-handler.zip"]]
      Runtime: nodejs12.x
      Timeout: 120
      Environment:
        Variables:
          AWS_NODEJS_CONNECTION_REUSE_ENABLED: "1"
          DynamoDBTable: !Ref DynamoDBTable
          SnsTopic: !Ref SnsTopic

  IngestWorkflow:
    Type: AWS::StepFunctions::StateMachine
    Properties:
      StateMachineName: !Sub "${AWS::StackName}-ingest"
      DefinitionString: !Sub |
        {
          "StartAt": "Input Validate",
          "States": {
            "Input Validate": {
              "Type": "Task",
              "Resource": "${InputValidate.Arn}",
              "Next": "Mediainfo"
            },
            "Mediainfo": {
              "Type": "Task",
              "Resource": "${Mediainfo.Arn}",
              "Next": "DynamoDB Update"
            },
            "DynamoDB Update": {
              "Type": "Task",
              "Resource": "${DynamodbUpdate.Arn}",
              "Next": "SNS Choice"
            },
            "SNS Choice": {
              "Type": "Choice",
              "Choices": [
                {
                  "Variable": "$.enableSns",
                  "BooleanEquals": true,
                  "Next": "SNS Notification"
                }
              ],
              "Default": "Process Execute"
            },
            "SNS Notification": {
              "Type": "Task",
              "Resource": "${SnsNotification.Arn}",
              "Next": "Process Execute"
            },
            "Process Execute": {
              "Type": "Task",
              "Resource": "${StepFunctions.Arn}",
              "End": true
            }
          }
        }
      RoleArn: !GetAtt StepFunctionsServiceRole.Arn

  ProcessWorkflow:
    Type: AWS::StepFunctions::StateMachine
    Properties:
      StateMachineName: !Sub "${AWS::StackName}-process"
      DefinitionString: !Sub |
        {
          "Comment": "Process StateMachine to create MediaConvert Encoding Jobs",
          "StartAt": "Profiler",
          "States": {
            "Profiler": {
              "Type": "Task",
              "Resource": "${Profiler.Arn}",
              "Next": "Encoding Profile Check"
            },
            "Encoding Profile Check": {
              "Type": "Choice",
              "Choices": [
                {
                  "Variable": "$.isCustomTemplate",
                  "BooleanEquals": true,
                  "Next": "Custom jobTemplate"
                },
                        {
                  "Variable": "$.encodingProfile ",
                  "NumericEquals": 2160,
                  "Next": "jobTemplate 2160p"
                },
                {
                  "Variable": "$.encodingProfile ",
                  "NumericEquals": 1080,
                  "Next": "jobTemplate 1080p"
                },
                {
                  "Variable": "$.encodingProfile ",
                  "NumericEquals": 720,
                  "Next": "jobTemplate 720p"
                }
              ]
            },
            "jobTemplate 2160p": {
              "Type": "Pass",
              "Next": "Accelerated Transcoding Check"
            },
            "jobTemplate 1080p": {
              "Type": "Pass",
              "Next": "Accelerated Transcoding Check"
            },
            "jobTemplate 720p": {
              "Type": "Pass",
              "Next": "Accelerated Transcoding Check"
            },
            "Custom jobTemplate": {
              "Type": "Pass",
              "Next": "Accelerated Transcoding Check"
            },
            "Accelerated Transcoding Check": {
              "Type": "Choice",
              "Choices": [
                {
                  "Variable": "$.acceleratedTranscoding",
                  "StringEquals": "ENABLED",
                  "Next": "Enabled"
                },
                {
                  "Variable": "$.acceleratedTranscoding",
                  "StringEquals": "PREFERRED",
                  "Next": "Preferred"
                },
                {
                  "Variable": "$.acceleratedTranscoding",
                  "StringEquals": "DISABLED",
                  "Next": "Disabled"
                }
              ]
            },
            "Enabled": {
              "Type": "Pass",
              "Next": "Frame Capture Check"
            },
            "Preferred": {
              "Type": "Pass",
              "Next": "Frame Capture Check"
            },
            "Disabled": {
              "Type": "Pass",
              "Next": "Frame Capture Check"
            },
            "Frame Capture Check": {
              "Type": "Choice",
              "Choices": [
                {
                  "Variable": "$.frameCapture",
                  "BooleanEquals": true,
                  "Next": "Frame Capture"
                },
                {
                  "Variable": "$.frameCapture",
                  "BooleanEquals": false,
                  "Next": "No Frame Capture"
                }
              ]
            },
            "Frame Capture": {
              "Type": "Pass",
              "Next": "Encode Job Submit"
            },
            "No Frame Capture": {
              "Type": "Pass",
              "Next": "Encode Job Submit"
            },
            "Encode Job Submit": {
              "Type": "Task",
              "Resource": "${Encode.Arn}",
              "Next": "DynamoDB Update"
            },
            "DynamoDB Update": {
              "Type": "Task",
              "Resource": "${DynamodbUpdate.Arn}",
              "End": true
            }
          }
        }
      RoleArn: !GetAtt StepFunctionsServiceRole.Arn

  PublishWorkflow:
    Type: AWS::StepFunctions::StateMachine
    Properties:
      StateMachineName: !Sub "${AWS::StackName}-publish"
      DefinitionString: !Sub |
        {
          "StartAt": "Validate Encoding Outputs",
          "States": {
            "Validate Encoding Outputs": {
              "Type": "Task",
              "Resource": "${OutputValidate.Arn}",
              "Next": "Archive Source Choice"
            },
            "Archive Source Choice": {
              "Type": "Choice",
              "Choices": [
                {
                  "Variable": "$.archiveSource",
                  "StringEquals": "GLACIER",
                  "Next": "Archive"
                },
                {
                  "Variable": "$.archiveSource",
                  "StringEquals": "DEEP_ARCHIVE",
                  "Next": "Deep Archive"
                }
              ],
              "Default": "MediaPackage Choice"
            },
            "Archive": {
              "Type": "Task",
              "Resource": "${ArchiveSource.Arn}",
              "Next": "MediaPackage Choice"
            },
            "Deep Archive": {
              "Type": "Task",
              "Resource": "${ArchiveSource.Arn}",
              "Next": "MediaPackage Choice"
            },
            "MediaPackage Choice": {
              "Type": "Choice",
              "Choices": [
                {
                  "Variable": "$.enableMediaPackage",
                  "BooleanEquals": true,
                  "Next": "MediaPackage Assets"
                }
              ],
              "Default": "DynamoDB Update"
            },
            "MediaPackage Assets": {
              "Type": "Task",
              "Resource": "${MediaPackageAssets.Arn}",
              "Next": "DynamoDB Update"
            },
            "DynamoDB Update": {
              "Type": "Task",
              "Resource": "${DynamodbUpdate.Arn}",
              "Next": "SQS Choice"
            },
            "SQS Choice": {
              "Type": "Choice",
              "Choices": [
                {
                  "Variable": "$.enableSqs",
                  "BooleanEquals": true,
                  "Next": "SQS Send Message"
                }
              ],
              "Default": "SNS Choice"
            },
            "SQS Send Message": {
              "Type": "Task",
              "Resource": "${SqsSendMessage.Arn}",
              "Next": "SNS Choice"
            },
            "SNS Choice": {
              "Type": "Choice",
              "Choices": [
                {
                  "Variable": "$.enableSns",
                  "BooleanEquals": true,
                  "Next": "SNS Notification"
                }
              ],
              "Default": "Complete"
            },
            "SNS Notification": {
              "Type": "Task",
              "Resource": "${SnsNotification.Arn}",
              "Next": "Complete"
            },
            "Complete": {
              "Type": "Pass",
              "End": true
            }
          }
        }
      RoleArn: !GetAtt StepFunctionsServiceRole.Arn

  Uuid:
    Condition: Metrics
    Type: Custom::UUID
    Properties:
      ServiceToken: !GetAtt CustomResource.Arn
      Resource: UUID

  AnonymousMetric:
    Condition: Metrics
    Type: Custom::LoadLambda
    Properties:
      ServiceToken: !GetAtt CustomResource.Arn
      SolutionId: SO0021
      UUID: !GetAtt Uuid.UUID
      Version: "v5.2.0"
      Transcoder: MediaConvert
      WorkflowTrigger: !Ref WorkflowTrigger
      Glacier: !Ref Glacier
      FrameCapture: !Ref FrameCapture
      Resource: AnonymousMetric
      EnableMediaPackage: !Ref EnableMediaPackage

Outputs:

  DynamoDBTable:
    Description: DynamoDB Table
    Value: !Ref DynamoDBTable
    Export:
      Name: !Join [":", [!Ref "AWS::StackName", DynamoDBTable]]

  Source:
    Description: Source Bucket
    Value: !Ref Source
    Export:
      Name: !Join [":", [!Ref "AWS::StackName", Source]]

  Destination:
    Description: Destination Bucket
    Value: !Ref Destination
    Export:
      Name: !Join [":", [!Ref "AWS::StackName", Destination]]

  CloudFront:
    Description: CloudFront Domain Name
    Value: !GetAtt CloudFront.DomainName
    Export:
      Name: !Join [":", [!Ref "AWS::StackName", CloudFront]]

  UUID:
    Condition: Metrics
    Description: AnonymousMetric UUID
    Value: !GetAtt Uuid.UUID
    Export:
      Name: !Join [":", [!Ref "AWS::StackName", UUID]]

  SnsTopic:
    Description: SNS Notification Topic
    Value: !Ref SnsTopic
    Export:
      Name: !Join [":", [!Ref "AWS::StackName", SnsTopic]]

  SqsURL:
    Description: AmazonSQS Queue URL
    Value: !Ref SqsQueue
    Export:
      Name: !Join [":", [!Ref "AWS::StackName", SqsQueue]]

  SqsARN: 
    Description: AmazonSQS Queue ARN
    Value: 
      !Sub ${SqsQueue.Arn}