template.yaml

AWSTemplateFormatVersion: '2010-09-09'
Transform: AWS::Serverless-2016-10-31
Description: >
  Serverless Code Review Agents — Two-tier event-driven architecture.
  EventBridge coordinates two Durable Function pipelines:
    DF1 (Analysis): clone → security + style agents in parallel → severity scorer
    DF2 (Remediation): Kiro headless auto-fix → test generation → executive summary
  S3 Files provides a shared POSIX workspace across all functions.

# ════════════════════════════════════════════════════════════════
# Globals
# ════════════════════════════════════════════════════════════════
Globals:
  Function:
    Runtime: python3.14
    MemorySize: 1024
    Timeout: 900
    Architectures:
      - arm64
    Tracing: Active
    Environment:
      Variables:
        WORKSPACE_MOUNT: /mnt/workspace

# ════════════════════════════════════════════════════════════════
# Parameters
# ════════════════════════════════════════════════════════════════
Parameters:
  BedrockModelId:
    Type: String
    Default: eu.anthropic.claude-sonnet-4-20250514-v1:0
    Description: Bedrock inference profile ID for the review agents

Resources:
  # ════════════════════════════════════════════════════════════════
  # Networking (nested stack)
  # ════════════════════════════════════════════════════════════════
  NetworkingStack:
    Type: AWS::Serverless::Application
    Properties:
      Location: stacks/network.yaml

  # ════════════════════════════════════════════════════════════════
  # S3 Files — shared workspace
  # ════════════════════════════════════════════════════════════════
  WorkspaceBucket:
    Type: AWS::S3::Bucket
    Properties:
      BucketEncryption:
        ServerSideEncryptionConfiguration:
          - ServerSideEncryptionByDefault:
              SSEAlgorithm: AES256
      PublicAccessBlockConfiguration:
        BlockPublicAcls: true
        BlockPublicPolicy: true
        IgnorePublicAcls: true
        RestrictPublicBuckets: true
      VersioningConfiguration:
        Status: Enabled

  S3FilesRole:
    Type: AWS::IAM::Role
    Properties:
      Path: /service-role/
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Sid: AllowS3FilesAssumeRole
            Effect: Allow
            Principal:
              Service: elasticfilesystem.amazonaws.com
            Action: sts:AssumeRole
            Condition:
              StringEquals:
                aws:SourceAccount: !Ref AWS::AccountId
              ArnLike:
                aws:SourceArn: !Sub 'arn:aws:s3files:${AWS::Region}:${AWS::AccountId}:file-system/*'
      Policies:
        - PolicyName: S3FilesBucketAccess
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Sid: S3BucketPermissions
                Effect: Allow
                Action:
                  - s3:ListBucket*
                Resource: !GetAtt WorkspaceBucket.Arn
                Condition:
                  StringEquals:
                    aws:ResourceAccount: !Ref AWS::AccountId
              - Sid: S3ObjectPermissions
                Effect: Allow
                Action:
                  - s3:AbortMultipartUpload
                  - s3:DeleteObject*
                  - s3:GetObject*
                  - s3:List*
                  - s3:PutObject*
                Resource: !Sub '${WorkspaceBucket.Arn}/*'
                Condition:
                  StringEquals:
                    aws:ResourceAccount: !Ref AWS::AccountId

  S3FileSystem:
    Type: AWS::S3Files::FileSystem
    Properties:
      Bucket: !GetAtt WorkspaceBucket.Arn
      RoleArn: !GetAtt S3FilesRole.Arn
      AcceptBucketWarning: true

  MountTargetA:
    Type: AWS::S3Files::MountTarget
    Properties:
      FileSystemId: !GetAtt S3FileSystem.FileSystemId
      SubnetId: !GetAtt NetworkingStack.Outputs.PrivateSubnetAId
      SecurityGroups:
        - !GetAtt NetworkingStack.Outputs.MountTargetSGId

  MountTargetB:
    Type: AWS::S3Files::MountTarget
    Properties:
      FileSystemId: !GetAtt S3FileSystem.FileSystemId
      SubnetId: !GetAtt NetworkingStack.Outputs.PrivateSubnetBId
      SecurityGroups:
        - !GetAtt NetworkingStack.Outputs.MountTargetSGId

  S3FilesAccessPoint:
    Type: AWS::S3Files::AccessPoint
    Properties:
      FileSystemId: !GetAtt S3FileSystem.FileSystemId
      PosixUser:
        Uid: '1000'
        Gid: '1000'
      RootDirectory:
        Path: /lambda
        CreationPermissions:
          OwnerUid: '1000'
          OwnerGid: '1000'
          Permissions: '755'

  # ════════════════════════════════════════════════════════════════
  # API Gateway
  # Publishes review.requested event to the default EventBridge bus.
  # Returns 202 immediately.
  # ════════════════════════════════════════════════════════════════
  CodeReviewApi:
    Type: AWS::Serverless::Api
    Properties:
      Name: CodeReviewApi
      StageName: Prod
      DefinitionBody:
        openapi: 3.0.1
        info:
          title: Code Review API
          version: '2.0'
        paths:
          /review:
            post:
              summary: Start a code review
              x-amazon-apigateway-integration:
                type: aws
                httpMethod: POST
                uri: !Sub 'arn:aws:apigateway:${AWS::Region}:events:action/PutEvents'
                credentials: !GetAtt ApiGatewayRole.Arn
                passthroughBehavior: never
                requestTemplates:
                  application/json: |
                    #set($body = $input.json('$'))
                    {
                      "Entries": [
                        {
                          "Source": "code-review.api",
                          "DetailType": "review.requested",
                          "Detail": "{\"repo_url\": $input.json('$.repo_url')}"
                        }
                      ]
                    }
                responses:
                  default:
                    statusCode: 202
                    responseTemplates:
                      application/json: |
                        {
                          "status": "ACCEPTED",
                          "message": "Code review requested. Events will coordinate the pipeline."
                        }
              responses:
                '202':
                  description: Review accepted

  ApiGatewayRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              Service: apigateway.amazonaws.com
            Action: sts:AssumeRole
      Policies:
        - PolicyName: PutEvents
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Effect: Allow
                Action: events:PutEvents
                Resource: !Sub 'arn:aws:events:${AWS::Region}:${AWS::AccountId}:event-bus/default'

  # ════════════════════════════════════════════════════════════════
  # DF1 — Analysis Pipeline
  # Clone → Security + Style agents (parallel) → Severity Scorer
  # Emits analysis.complete when done.
  # Triggered by review.requested on the default bus (implicit event).
  # ════════════════════════════════════════════════════════════════
  AnalysisPipelineFunction:
    Type: AWS::Serverless::Function
    DependsOn:
      - MountTargetA
      - MountTargetB
    Properties:
      FunctionName: code-review-analysis-pipeline
      Handler: app.handler
      CodeUri: src/analysis_pipeline/
      MemorySize: 512
      Timeout: 900
      DurableConfig:
        ExecutionTimeout: 3600
        RetentionPeriodInDays: 7
      AutoPublishAlias: live
      Events:
        ReviewRequested:
          Type: EventBridgeRule
          Properties:
            Pattern:
              source:
                - code-review.api
              detail-type:
                - review.requested
      VpcConfig:
        SecurityGroupIds:
          - !GetAtt NetworkingStack.Outputs.LambdaSGId
        SubnetIds:
          - !GetAtt NetworkingStack.Outputs.PrivateSubnetAId
          - !GetAtt NetworkingStack.Outputs.PrivateSubnetBId
      FileSystemConfigs:
        - Arn: !GetAtt S3FilesAccessPoint.AccessPointArn
          LocalMountPath: /mnt/workspace
      Environment:
        Variables:
          SECURITY_AGENT_ARN: !GetAtt SecurityAgentFunction.Arn
          STYLE_AGENT_ARN: !GetAtt StyleAgentFunction.Arn
          SEVERITY_SCORER_ARN: !GetAtt SeverityScorerFunction.Arn
      Policies:
        - Version: '2012-10-17'
          Statement:
            - Sid: InvokeAgents
              Effect: Allow
              Action: lambda:InvokeFunction
              Resource:
                - !GetAtt SecurityAgentFunction.Arn
                - !Sub '${SecurityAgentFunction.Arn}:*'
                - !GetAtt StyleAgentFunction.Arn
                - !Sub '${StyleAgentFunction.Arn}:*'
                - !GetAtt SeverityScorerFunction.Arn
                - !Sub '${SeverityScorerFunction.Arn}:*'
            - Sid: MountS3Files
              Effect: Allow
              Action:
                - s3files:ClientMount
                - s3files:ClientWrite
                - s3files:ClientRootAccess
              Resource: !GetAtt S3FileSystem.FileSystemArn
            - Sid: EmitEvents
              Effect: Allow
              Action: events:PutEvents
              Resource: !Sub 'arn:aws:events:${AWS::Region}:${AWS::AccountId}:event-bus/default'

  # Security agent — Strands agent for vulnerability scanning
  SecurityAgentFunction:
    Type: AWS::Serverless::Function
    DependsOn:
      - MountTargetA
      - MountTargetB
    Properties:
      FunctionName: code-review-security-agent
      Handler: app.lambda_handler
      CodeUri: src/security_agent/
      Timeout: 600
      MemorySize: 1024
      VpcConfig:
        SecurityGroupIds:
          - !GetAtt NetworkingStack.Outputs.LambdaSGId
        SubnetIds:
          - !GetAtt NetworkingStack.Outputs.PrivateSubnetAId
          - !GetAtt NetworkingStack.Outputs.PrivateSubnetBId
      FileSystemConfigs:
        - Arn: !GetAtt S3FilesAccessPoint.AccessPointArn
          LocalMountPath: /mnt/workspace
      Environment:
        Variables:
          BEDROCK_MODEL_ID: !Ref BedrockModelId
      Policies:
        - Version: '2012-10-17'
          Statement:
            - Sid: MountS3Files
              Effect: Allow
              Action:
                - s3files:ClientMount
                - s3files:ClientWrite
                - s3files:ClientRootAccess
              Resource: !GetAtt S3FileSystem.FileSystemArn
            - Sid: InvokeBedrock
              Effect: Allow
              Action:
                - bedrock:InvokeModel
                - bedrock:InvokeModelWithResponseStream
                - bedrock:Converse
                - bedrock:ConverseStream
              Resource: '*'

  # Style agent — Strands agent for code quality review
  StyleAgentFunction:
    Type: AWS::Serverless::Function
    DependsOn:
      - MountTargetA
      - MountTargetB
    Properties:
      FunctionName: code-review-style-agent
      Handler: app.lambda_handler
      CodeUri: src/style_agent/
      Timeout: 600
      MemorySize: 1024
      VpcConfig:
        SecurityGroupIds:
          - !GetAtt NetworkingStack.Outputs.LambdaSGId
        SubnetIds:
          - !GetAtt NetworkingStack.Outputs.PrivateSubnetAId
          - !GetAtt NetworkingStack.Outputs.PrivateSubnetBId
      FileSystemConfigs:
        - Arn: !GetAtt S3FilesAccessPoint.AccessPointArn
          LocalMountPath: /mnt/workspace
      Environment:
        Variables:
          BEDROCK_MODEL_ID: !Ref BedrockModelId
      Policies:
        - Version: '2012-10-17'
          Statement:
            - Sid: MountS3Files
              Effect: Allow
              Action:
                - s3files:ClientMount
                - s3files:ClientWrite
                - s3files:ClientRootAccess
              Resource: !GetAtt S3FileSystem.FileSystemArn
            - Sid: InvokeBedrock
              Effect: Allow
              Action:
                - bedrock:InvokeModel
                - bedrock:InvokeModelWithResponseStream
                - bedrock:Converse
                - bedrock:ConverseStream
              Resource: '*'

  # Severity scorer — scores and prioritizes security findings
  SeverityScorerFunction:
    Type: AWS::Serverless::Function
    DependsOn:
      - MountTargetA
      - MountTargetB
    Properties:
      FunctionName: code-review-severity-scorer
      Handler: app.lambda_handler
      CodeUri: src/severity_scorer_agent/
      Timeout: 300
      MemorySize: 1024
      VpcConfig:
        SecurityGroupIds:
          - !GetAtt NetworkingStack.Outputs.LambdaSGId
        SubnetIds:
          - !GetAtt NetworkingStack.Outputs.PrivateSubnetAId
          - !GetAtt NetworkingStack.Outputs.PrivateSubnetBId
      FileSystemConfigs:
        - Arn: !GetAtt S3FilesAccessPoint.AccessPointArn
          LocalMountPath: /mnt/workspace
      Environment:
        Variables:
          BEDROCK_MODEL_ID: !Ref BedrockModelId
      Policies:
        - Version: '2012-10-17'
          Statement:
            - Sid: MountS3Files
              Effect: Allow
              Action:
                - s3files:ClientMount
                - s3files:ClientWrite
                - s3files:ClientRootAccess
              Resource: !GetAtt S3FileSystem.FileSystemArn
            - Sid: InvokeBedrock
              Effect: Allow
              Action:
                - bedrock:InvokeModel
                - bedrock:InvokeModelWithResponseStream
                - bedrock:Converse
                - bedrock:ConverseStream
              Resource: '*'

  # ════════════════════════════════════════════════════════════════
  # DF2 — Remediation Pipeline
  # Kiro headless auto-fix → Test generation → Executive summary
  # Emits remediation.complete when done.
  # Triggered by analysis.complete on the default bus (implicit event).
  # ════════════════════════════════════════════════════════════════
  RemediationPipelineFunction:
    Type: AWS::Serverless::Function
    DependsOn:
      - MountTargetA
      - MountTargetB
    Properties:
      FunctionName: code-review-remediation-pipeline
      Handler: app.handler
      CodeUri: src/remediation_pipeline/
      MemorySize: 512
      Timeout: 900
      DurableConfig:
        ExecutionTimeout: 3600
        RetentionPeriodInDays: 7
      AutoPublishAlias: live
      Events:
        AnalysisComplete:
          Type: EventBridgeRule
          Properties:
            Pattern:
              source:
                - code-review.analysis
              detail-type:
                - analysis.complete
      VpcConfig:
        SecurityGroupIds:
          - !GetAtt NetworkingStack.Outputs.LambdaSGId
        SubnetIds:
          - !GetAtt NetworkingStack.Outputs.PrivateSubnetAId
          - !GetAtt NetworkingStack.Outputs.PrivateSubnetBId
      FileSystemConfigs:
        - Arn: !GetAtt S3FilesAccessPoint.AccessPointArn
          LocalMountPath: /mnt/workspace
      Environment:
        Variables:
          KIRO_AGENT_ARN: !GetAtt KiroAutoFixFunction.Arn
          TEST_GEN_AGENT_ARN: !GetAtt TestGenAgentFunction.Arn
          SUMMARY_AGENT_ARN: !GetAtt ExecutiveSummaryFunction.Arn
      Policies:
        - Version: '2012-10-17'
          Statement:
            - Sid: InvokeAgents
              Effect: Allow
              Action: lambda:InvokeFunction
              Resource:
                - !GetAtt KiroAutoFixFunction.Arn
                - !Sub '${KiroAutoFixFunction.Arn}:*'
                - !GetAtt TestGenAgentFunction.Arn
                - !Sub '${TestGenAgentFunction.Arn}:*'
                - !GetAtt ExecutiveSummaryFunction.Arn
                - !Sub '${ExecutiveSummaryFunction.Arn}:*'
            - Sid: MountS3Files
              Effect: Allow
              Action:
                - s3files:ClientMount
                - s3files:ClientWrite
                - s3files:ClientRootAccess
              Resource: !GetAtt S3FileSystem.FileSystemArn
            - Sid: EmitEvents
              Effect: Allow
              Action: events:PutEvents
              Resource: !Sub 'arn:aws:events:${AWS::Region}:${AWS::AccountId}:event-bus/default'

  # Kiro headless — auto-fix agent that reasons over the full codebase
  KiroAutoFixFunction:
    Type: AWS::Serverless::Function
    DependsOn:
      - MountTargetA
      - MountTargetB
    Properties:
      FunctionName: code-review-kiro-autofix
      Handler: app.lambda_handler
      CodeUri: src/kiro_autofix_agent/
      Timeout: 900
      MemorySize: 1024
      VpcConfig:
        SecurityGroupIds:
          - !GetAtt NetworkingStack.Outputs.LambdaSGId
        SubnetIds:
          - !GetAtt NetworkingStack.Outputs.PrivateSubnetAId
          - !GetAtt NetworkingStack.Outputs.PrivateSubnetBId
      FileSystemConfigs:
        - Arn: !GetAtt S3FilesAccessPoint.AccessPointArn
          LocalMountPath: /mnt/workspace
      Environment:
        Variables:
          BEDROCK_MODEL_ID: !Ref BedrockModelId
      Policies:
        - Version: '2012-10-17'
          Statement:
            - Sid: MountS3Files
              Effect: Allow
              Action:
                - s3files:ClientMount
                - s3files:ClientWrite
                - s3files:ClientRootAccess
              Resource: !GetAtt S3FileSystem.FileSystemArn
            - Sid: InvokeBedrock
              Effect: Allow
              Action:
                - bedrock:InvokeModel
                - bedrock:InvokeModelWithResponseStream
                - bedrock:Converse
                - bedrock:ConverseStream
              Resource: '*'

  # Test generation agent — validates fixes with generated tests
  TestGenAgentFunction:
    Type: AWS::Serverless::Function
    DependsOn:
      - MountTargetA
      - MountTargetB
    Properties:
      FunctionName: code-review-test-gen-agent
      Handler: app.lambda_handler
      CodeUri: src/test_gen_agent/
      Timeout: 600
      MemorySize: 1024
      VpcConfig:
        SecurityGroupIds:
          - !GetAtt NetworkingStack.Outputs.LambdaSGId
        SubnetIds:
          - !GetAtt NetworkingStack.Outputs.PrivateSubnetAId
          - !GetAtt NetworkingStack.Outputs.PrivateSubnetBId
      FileSystemConfigs:
        - Arn: !GetAtt S3FilesAccessPoint.AccessPointArn
          LocalMountPath: /mnt/workspace
      Environment:
        Variables:
          BEDROCK_MODEL_ID: !Ref BedrockModelId
      Policies:
        - Version: '2012-10-17'
          Statement:
            - Sid: MountS3Files
              Effect: Allow
              Action:
                - s3files:ClientMount
                - s3files:ClientWrite
                - s3files:ClientRootAccess
              Resource: !GetAtt S3FileSystem.FileSystemArn
            - Sid: InvokeBedrock
              Effect: Allow
              Action:
                - bedrock:InvokeModel
                - bedrock:InvokeModelWithResponseStream
                - bedrock:Converse
                - bedrock:ConverseStream
              Resource: '*'

  # Executive summary agent — fans-in all results into final report
  ExecutiveSummaryFunction:
    Type: AWS::Serverless::Function
    DependsOn:
      - MountTargetA
      - MountTargetB
    Properties:
      FunctionName: code-review-executive-summary
      Handler: app.lambda_handler
      CodeUri: src/executive_summary_agent/
      Timeout: 300
      MemorySize: 1024
      VpcConfig:
        SecurityGroupIds:
          - !GetAtt NetworkingStack.Outputs.LambdaSGId
        SubnetIds:
          - !GetAtt NetworkingStack.Outputs.PrivateSubnetAId
          - !GetAtt NetworkingStack.Outputs.PrivateSubnetBId
      FileSystemConfigs:
        - Arn: !GetAtt S3FilesAccessPoint.AccessPointArn
          LocalMountPath: /mnt/workspace
      Environment:
        Variables:
          BEDROCK_MODEL_ID: !Ref BedrockModelId
      Policies:
        - Version: '2012-10-17'
          Statement:
            - Sid: MountS3Files
              Effect: Allow
              Action:
                - s3files:ClientMount
                - s3files:ClientWrite
                - s3files:ClientRootAccess
              Resource: !GetAtt S3FileSystem.FileSystemArn
            - Sid: InvokeBedrock
              Effect: Allow
              Action:
                - bedrock:InvokeModel
                - bedrock:InvokeModelWithResponseStream
                - bedrock:Converse
                - bedrock:ConverseStream
              Resource: '*'

# ════════════════════════════════════════════════════════════════
# Outputs
# ════════════════════════════════════════════════════════════════
Outputs:
  ApiEndpoint:
    Description: POST a repo_url here to start a review
    Value: !Sub 'https://${CodeReviewApi}.execute-api.${AWS::Region}.amazonaws.com/Prod/review'
  WorkspaceBucketName:
    Description: S3 bucket — check {repo}/reviews/ for results
    Value: !Ref WorkspaceBucket
  S3FileSystemId:
    Description: S3 file system ID
    Value: !GetAtt S3FileSystem.FileSystemId