template.yaml

AWSTemplateFormatVersion: '2010-09-09'
Transform: AWS::Serverless-2016-10-31
Description: SAM Template for LambdaJudge


Parameters:
  APIAccessKeyValue:
    Type: String
    Description: The API Key value to access the API Gateway
  EFSProblemsEncryptionKey:
    Type: String
    Description: The encryption key for the problems store on EFS


Globals:
  Function:
    Timeout: 300        # 5 min
    MemorySize: 1769    # 1769 MB RAM
    EphemeralStorage:   # Temporary storage - for fast processing and to avoid memory errors
      Size: 1769        # 1769 MB SSD


Resources:
  # VPC, Subnet, EFS config - source: https://github.com/aws-samples/aws-lambda-efs-samples/blob/master/1-setup/create-efs-cfn.yml
  JudgeVPC:
    Type: AWS::EC2::VPC
    Properties:
      CidrBlock: 172.31.0.0/16
      EnableDnsHostnames: true
      EnableDnsSupport: true
      Tags:
        - Key: Name
          Value: JudgeVPC

  CodeRunnerPrivateSubnet:
    Type: AWS::EC2::Subnet
    Properties:
      CidrBlock: 172.31.1.0/24
      VpcId: !Ref JudgeVPC
      AvailabilityZone: 'us-east-1a'
      Tags:
        - Key: Name
          Value: CodeRunnerPrivateSubnet

  # source: https://github.com/awsdocs/aws-lambda-developer-guide/blob/main/templates/vpc-private.yaml
  PrivateSubnet:
    Type: AWS::EC2::Subnet
    Properties:
      CidrBlock: 172.31.2.0/24
      VpcId: !Ref JudgeVPC
      AvailabilityZone: 'us-east-1a'
      MapPublicIpOnLaunch: false
      Tags:
        - Key: Name
          Value: PrivateSubnet
  PrivateRouteTable:
    Type: AWS::EC2::RouteTable
    Properties:
      VpcId: !Ref JudgeVPC
      Tags:
        - Key: Name
          Value: Public Routes
  PrivateSubnetRouteTableAssociation:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      SubnetId: !Ref PrivateSubnet
      RouteTableId: !Ref PrivateRouteTable

  # EFS
  FileSystemResource:
    Type: AWS::EFS::FileSystem
    Properties:
      PerformanceMode: generalPurpose  # generalPurpose | maxIO
      Encrypted: true
      BackupPolicy:
        Status: ENABLED
      FileSystemTags:
        - Key: Name
          Value: JudgeFS

  AccessPointResource:
    Type: AWS::EFS::AccessPoint
    Properties:
      FileSystemId: !Ref FileSystemResource
      PosixUser:
        Uid: '1000'
        Gid: '1000'
      RootDirectory:
        CreationInfo:
          OwnerGid: '1000'
          OwnerUid: '1000'
          Permissions: '0777'
        Path: '/mnt/efs'
  CodeRunnerMountTarget:
    Type: AWS::EFS::MountTarget
    Properties:
      FileSystemId: !Ref FileSystemResource
      SubnetId: !Ref CodeRunnerPrivateSubnet
      SecurityGroups:
        - !GetAtt JudgeVPC.DefaultSecurityGroup

  # Execution roles
  TriggerSyncRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - lambda.amazonaws.com
            Action:
              - 'sts:AssumeRole'
  SyncS3WithEFSRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - lambda.amazonaws.com
            Action:
              - 'sts:AssumeRole'
  BouncerRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - lambda.amazonaws.com
            Action:
              - 'sts:AssumeRole'
  ContestantRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - lambda.amazonaws.com
            Action:
              - 'sts:AssumeRole'

  # Policies
  AllowLoggingPolicy:
    Type: AWS::IAM::Policy
    Properties:
      PolicyName: AllowLoggingPolicy
      PolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Action:
              - 'logs:CreateLogGroup'
              - 'logs:CreateLogStream'
              - 'logs:PutLogEvents'
            Resource: '*'
      Roles:
        - Ref: BouncerRole
        - Ref: ContestantRole
        - Ref: TriggerSyncRole
        - Ref: SyncS3WithEFSRole

  DynamoDBAccessPolicy:
    Type: AWS::IAM::Policy
    Properties:
      PolicyName: DynamoDBAccessPolicy
      PolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Action:
              - 'dynamodb:PutItem'
            Resource: '*'
      Roles:
        - Ref: TriggerSyncRole
  AllowS3ReadPolicy:
    Type: AWS::IAM::Policy
    Properties:
      PolicyName: AllowS3ReadPolicy
      PolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Action:
              - 's3:GetObject'
              - 's3:ListBucket'
              - 's3:GetBucketLocation'
              - 's3:GetObjectVersion'
              - 's3:GetLifecycleConfiguration'
            Resource: '*'
      Roles:
        - Ref: TriggerSyncRole
        - Ref: SyncS3WithEFSRole

  AllowEC2NetworkInterfacesPolicy:
    Type: AWS::IAM::Policy
    Properties:
      PolicyName: AllowEC2NetworkInterfacesPolicy
      PolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Action:
              - 'ec2:CreateNetworkInterface'
              - 'ec2:DeleteNetworkInterface'
              - 'ec2:DescribeNetworkInterfaces'
              - 'ec2:DetachNetworkInterface'
            Resource: '*'
      Roles:
        - Ref: SyncS3WithEFSRole
        - Ref: ContestantRole

  AllowLambdaInvokationPolicy:
    Type: AWS::IAM::Policy
    Properties:
      PolicyName: AllowLambdaInvokationPolicy
      PolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Action:
              - 'lambda:InvokeFunction'
            Resource: '*'
      Roles:
        - Ref: TriggerSyncRole
        - Ref: BouncerRole

  SyncS3WithEFSPolicy:
    Type: AWS::IAM::Policy
    Properties:
      PolicyName: SyncS3WithEFSPolicy
      PolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Action:
              - 'elasticfilesystem:ClientMount'
              - 'elasticfilesystem:ClientRootAccess'
              - 'elasticfilesystem:ClientWrite'
              - 'elasticfilesystem:DescribeMountTargets'
            Resource: !Sub arn:aws:elasticfilesystem:${AWS::Region}:${AWS::AccountId}:file-system/${FileSystemResource}
      Roles:
        - Ref: SyncS3WithEFSRole

  ContestantEFSAccessPolicy:
    Type: AWS::IAM::Policy
    Properties:
      PolicyName: ContestantPolicy
      PolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Action:
              - 'elasticfilesystem:ClientMount'
              - 'elasticfilesystem:DescribeMountTargets'
            Resource: !Sub arn:aws:elasticfilesystem:${AWS::Region}:${AWS::AccountId}:file-system/${FileSystemResource}
      Roles:
        - Ref: ContestantRole

  # S3 bucket for test cases (zip files)
  LambdaJudgeTestsBucket:
    Type: AWS::S3::Bucket
    Properties:
      BucketName: 'lambda-judge-tests-bucket'
      CorsConfiguration:
        CorsRules:
          - AllowedHeaders:
              - "*"
            AllowedMethods:
              - GET
              - PUT
              - HEAD
            AllowedOrigins:
              - "*"

  # S3 VPC Endpoint
  S3VPCEndpoint:
    Type: AWS::EC2::VPCEndpoint
    Properties:
      ServiceName: !Sub com.amazonaws.${AWS::Region}.s3
      RouteTableIds:
        - !Ref PrivateRouteTable
      VpcEndpointType: Gateway
      VpcId: !Ref JudgeVPC

  # Lambda Functions
  # More info about Function Resource: https://github.com/awslabs/serverless-application-model/blob/master/versions/2016-10-31.md#awsserverlessfunction
  SyncS3Trigger:
    Type: AWS::Serverless::Function
    Properties:
      FunctionName: TriggerSyncS3
      MemorySize: 256
      PackageType: Image
      Role: !GetAtt TriggerSyncRole.Arn
      Environment:
        Variables:
          DYNAMODB_TABLE_NAME: !Ref PrivateTestsTable
          EFS_PROBLEMS_ENCRYPTION_KEY: !Ref EFSProblemsEncryptionKey
      Events:
        SyncS3TestsWithEFSEvent:
          Type: S3
          Properties:
            Bucket: !Ref LambdaJudgeTestsBucket
            Events: s3:ObjectCreated:*
            Filter:
              S3Key:
                Rules:
                  - Name: suffix      # or prefix
                    Value: zip        # The value to search for in the S3 object key names
    Metadata:
      DockerTag: sync-trigger-v1
      DockerContext: ./
      Dockerfile: sync/trigger.Dockerfile

  PrivateTestsTable:
    Type: "AWS::Serverless::SimpleTable"
  SyncS3WithEFS:
    Type: AWS::Serverless::Function
    DependsOn: CodeRunnerMountTarget
    Properties:
      FunctionName: SyncS3WithEFS
      MemorySize: 10240   # maximum RAM - for fast processing and to avoid memory errors
      EphemeralStorage:   # maximum SSD - for fast processing and to avoid memory errors
        Size: 10240
      PackageType: Image
      Role: !GetAtt SyncS3WithEFSRole.Arn
      VpcConfig:
        SecurityGroupIds:
          - !GetAtt JudgeVPC.DefaultSecurityGroup
        SubnetIds:
          - !Ref PrivateSubnet
      FileSystemConfigs:
        - Arn: !GetAtt AccessPointResource.Arn
          LocalMountPath: '/mnt/efs'
    Metadata:
      DockerTag: sync-efs-v1
      DockerContext: ./
      Dockerfile: sync/sync.Dockerfile

  BouncerApiAccessKey:
    Type: AWS::ApiGateway::ApiKey
    Properties:
      Enabled: true
      Name: 'BouncerApiAccessKey'
      Value: !Ref APIAccessKeyValue

  BouncerUsagePlan:
    Type: AWS::ApiGateway::UsagePlan
    Properties:
      Description: 'Usage plan for Bouncer API'
      ApiStages:
        - ApiId: !Ref ServerlessRestApi  # Replace with your RestApi Resource ID if different
          Stage: Prod
      Throttle:
        BurstLimit: 10000
        RateLimit: 10000
      Quota:
        Limit: 100000000
        Period: MONTH

  BouncerUsagePlanKey:
    Type: AWS::ApiGateway::UsagePlanKey
    Properties:
      KeyId: !Ref BouncerApiAccessKey
      KeyType: 'API_KEY'
      UsagePlanId: !Ref BouncerUsagePlan

  Bouncer:
    Type: AWS::Serverless::Function
    Properties:
      FunctionName: Bouncer
      MemorySize: 256
      PackageType: Image
      Role: !GetAtt BouncerRole.Arn
      Environment:
        Variables:
          EFS_PROBLEMS_ENCRYPTION_KEY: !Ref EFSProblemsEncryptionKey
      Events:
        Check:
          Type: Api # More info about API Event Source: https://github.com/awslabs/serverless-application-model/blob/master/versions/2016-10-31.md#api
          Properties:
            Path: /check
            Method: post
            RestApiId: !Ref ServerlessRestApi
            Auth:
              ApiKeyRequired: true
    Metadata:
      DockerTag: bouncer-v1
      DockerContext: ./
      Dockerfile: bouncer/Dockerfile

  CodeRunnerTxt:
    Type: AWS::Serverless::Function
    DependsOn: CodeRunnerMountTarget
    Properties:
      FunctionName: CodeRunnerTxt
      PackageType: Image
      Role: !GetAtt ContestantRole.Arn
      VpcConfig:
        SecurityGroupIds:
          - !GetAtt JudgeVPC.DefaultSecurityGroup
        SubnetIds:
          - !Ref CodeRunnerPrivateSubnet
      FileSystemConfigs:
        - Arn: !GetAtt AccessPointResource.Arn
          LocalMountPath: '/mnt/efs'
    Metadata:
      DockerTag: txt-v1
      DockerContext: ./
      Dockerfile: coderunners/lang/txt.Dockerfile

  CodeRunnerPython:
    Type: AWS::Serverless::Function
    DependsOn: CodeRunnerMountTarget
    Properties:
      FunctionName: CodeRunnerPython
      PackageType: Image
      Role: !GetAtt ContestantRole.Arn
      VpcConfig:
        SecurityGroupIds:
          - !GetAtt JudgeVPC.DefaultSecurityGroup
        SubnetIds:
          - !Ref CodeRunnerPrivateSubnet
      FileSystemConfigs:
        - Arn: !GetAtt AccessPointResource.Arn
          LocalMountPath: '/mnt/efs'
    Metadata:
      DockerTag: python-v1
      DockerContext: ./
      Dockerfile: coderunners/lang/python.Dockerfile

  CodeRunnerPythonML:
    Type: AWS::Serverless::Function
    DependsOn: CodeRunnerMountTarget
    Properties:
      FunctionName: CodeRunnerPythonML
      PackageType: Image
      Role: !GetAtt ContestantRole.Arn
      VpcConfig:
        SecurityGroupIds:
          - !GetAtt JudgeVPC.DefaultSecurityGroup
        SubnetIds:
          - !Ref CodeRunnerPrivateSubnet
      FileSystemConfigs:
        - Arn: !GetAtt AccessPointResource.Arn
          LocalMountPath: '/mnt/efs'
    Metadata:
      DockerTag: python-ml-v1
      DockerContext: ./
      Dockerfile: coderunners/lang/pythonML.Dockerfile

  CodeRunnerC:
    Type: AWS::Serverless::Function
    DependsOn: CodeRunnerMountTarget
    Properties:
      FunctionName: CodeRunnerC
      PackageType: Image
      Role: !GetAtt ContestantRole.Arn
      VpcConfig:
        SecurityGroupIds:
          - !GetAtt JudgeVPC.DefaultSecurityGroup
        SubnetIds:
          - !Ref CodeRunnerPrivateSubnet
      FileSystemConfigs:
        - Arn: !GetAtt AccessPointResource.Arn
          LocalMountPath: '/mnt/efs'
    Metadata:
      DockerTag: c-v1
      DockerContext: ./
      Dockerfile: coderunners/lang/c.Dockerfile

  CodeRunnerCpp:
    Type: AWS::Serverless::Function
    DependsOn: CodeRunnerMountTarget
    Properties:
      FunctionName: CodeRunnerCpp
      PackageType: Image
      Role: !GetAtt ContestantRole.Arn
      VpcConfig:
        SecurityGroupIds:
          - !GetAtt JudgeVPC.DefaultSecurityGroup
        SubnetIds:
          - !Ref CodeRunnerPrivateSubnet
      FileSystemConfigs:
        - Arn: !GetAtt AccessPointResource.Arn
          LocalMountPath: '/mnt/efs'
    Metadata:
      DockerTag: cpp-v1
      DockerContext: ./
      Dockerfile: coderunners/lang/cpp.Dockerfile

  CodeRunnerCSharp:
    Type: AWS::Serverless::Function
    DependsOn: CodeRunnerMountTarget
    Properties:
      FunctionName: CodeRunnerCSharp
      PackageType: Image
      Role: !GetAtt ContestantRole.Arn
      VpcConfig:
        SecurityGroupIds:
          - !GetAtt JudgeVPC.DefaultSecurityGroup
        SubnetIds:
          - !Ref CodeRunnerPrivateSubnet
      FileSystemConfigs:
        - Arn: !GetAtt AccessPointResource.Arn
          LocalMountPath: '/mnt/efs'
    Metadata:
      DockerTag: csharp-v1
      DockerContext: ./
      Dockerfile: coderunners/lang/csharp.Dockerfile

  CodeRunnerJs:
    Type: AWS::Serverless::Function
    DependsOn: CodeRunnerMountTarget
    Properties:
      FunctionName: CodeRunnerJs
      PackageType: Image
      Role: !GetAtt ContestantRole.Arn
      VpcConfig:
        SecurityGroupIds:
          - !GetAtt JudgeVPC.DefaultSecurityGroup
        SubnetIds:
          - !Ref CodeRunnerPrivateSubnet
      FileSystemConfigs:
        - Arn: !GetAtt AccessPointResource.Arn
          LocalMountPath: '/mnt/efs'
    Metadata:
      DockerTag: js-v1
      DockerContext: ./
      Dockerfile: coderunners/lang/js.Dockerfile

  CodeRunnerJava:
    Type: AWS::Serverless::Function
    DependsOn: CodeRunnerMountTarget
    Properties:
      FunctionName: CodeRunnerJava
      PackageType: Image
      Role: !GetAtt ContestantRole.Arn
      VpcConfig:
        SecurityGroupIds:
          - !GetAtt JudgeVPC.DefaultSecurityGroup
        SubnetIds:
          - !Ref CodeRunnerPrivateSubnet
      FileSystemConfigs:
        - Arn: !GetAtt AccessPointResource.Arn
          LocalMountPath: '/mnt/efs'
    Metadata:
      DockerTag: java-v1
      DockerContext: ./
      Dockerfile: coderunners/lang/java.Dockerfile

  CodeRunnerSQLite:
    Type: AWS::Serverless::Function
    DependsOn: CodeRunnerMountTarget
    Properties:
      FunctionName: CodeRunnerSQLite
      PackageType: Image
      Role: !GetAtt ContestantRole.Arn
      VpcConfig:
        SecurityGroupIds:
          - !GetAtt JudgeVPC.DefaultSecurityGroup
        SubnetIds:
          - !Ref CodeRunnerPrivateSubnet
      FileSystemConfigs:
        - Arn: !GetAtt AccessPointResource.Arn
          LocalMountPath: '/mnt/efs'
    Metadata:
      DockerTag: sqlite-v1
      DockerContext: ./
      Dockerfile: coderunners/lang/sqlite.Dockerfile

Outputs:
  # ServerlessRestApi is an implicit API created out of Events key under Serverless::Function
  # Find out more about other implicit resources you can reference within SAM
  # https://github.com/awslabs/serverless-application-model/blob/master/docs/internals/generated_resources.rst#api
  Check:
    Description: 'API Gateway endpoint URL for Prod stage for Bouncer function'
    Value: !Sub 'https://${ServerlessRestApi}.execute-api.${AWS::Region}.amazonaws.com/Prod/check/'
  Bouncer:
    Description: 'AWS Lambda checker for determining if the output of a code is exactly the same as the target'
    Value: !GetAtt Bouncer.Arn
  BouncerApiAccessKey:
    Description: "API Access Key for the Bouncer lambda function"
    Value: !Ref BouncerApiAccessKey

  CodeRunnerTxt:
    Description: 'AWS Lambda for checking textual outputs'
    Value: !GetAtt CodeRunnerTxt.Arn
  CodeRunnerPython:
    Description: 'AWS Lambda for executing a python code and getting the outputs'
    Value: !GetAtt CodeRunnerPython.Arn
  CodeRunnerPythonML:
    Description: 'AWS Lambda for executing a python code for ML applications and getting the outputs'
    Value: !GetAtt CodeRunnerPythonML.Arn
  CodeRunnerC:
    Description: 'AWS Lambda for executing a C code and getting the outputs'
    Value: !GetAtt CodeRunnerC.Arn
  CodeRunnerCpp:
    Description: 'AWS Lambda for executing a C++ code and getting the outputs'
    Value: !GetAtt CodeRunnerCpp.Arn
  CodeRunnerCSharp:
    Description: 'AWS Lambda for executing a C# code and getting the outputs'
    Value: !GetAtt CodeRunnerCSharp.Arn
  CodeRunnerJs:
    Description: 'AWS Lambda for executing a JS code and getting the outputs'
    Value: !GetAtt CodeRunnerJs.Arn
  CodeRunnerJava:
    Description: 'AWS Lambda for executing a Java code and getting the outputs'
    Value: !GetAtt CodeRunnerJava.Arn
  CodeRunnerSQLite:
    Description: 'AWS Lambda for executing a SQL/SQLite code and getting the results with tables'
    Value: !GetAtt CodeRunnerSQLite.Arn

  SyncS3WithEFSName:
    Description: 'AWS Lambda for syncing S3 bucket for test cases with EFS'
    Value: !GetAtt SyncS3WithEFS.Arn