codex-proxy/template.yaml at main · evilvic/codex-proxy · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
AWSTemplateFormatVersion: '2010-09-09'
Transform: AWS::Serverless-2016-10-31
Description: Codex CLI Proxy - Observability and usage control

Parameters:
  LogsBucketName:
    Type: String
    Description: S3 bucket name for proxy logs (e.g. codex-proxy-logs-ACCOUNT_ID)
  OpenAISecretName:
    Type: String
    Default: codex-proxy/openai-api-key
    Description: Secrets Manager secret name containing the OpenAI API key
  TokensTableName:
    Type: String
    Default: codex-proxy-tokens
    Description: DynamoDB table name for proxy tokens

Globals:
  Function:
    Timeout: 120
    MemorySize: 512
    Runtime: provided.al2023
    Architectures:
      - x86_64

Resources:
  CodexProxyFunction:
    Type: AWS::Serverless::Function
    Properties:
      Handler: bootstrap
      CodeUri: lambda/
      ReservedConcurrentExecutions: 25
      Environment:
        Variables:
          TOKENS_TABLE: !Ref TokensTable
          LOGS_BUCKET: !Ref LogsBucket
          OPENAI_SECRET_NAME: !Ref OpenAISecretName
      Policies:
        - Version: '2012-10-17'
          Statement:
            - Effect: Allow
              Action:
                - dynamodb:GetItem
              Resource: !GetAtt TokensTable.Arn
            - Effect: Allow
              Action:
                - s3:PutObject
              Resource: !Sub '${LogsBucket.Arn}/*'
            - Effect: Allow
              Action:
                - secretsmanager:GetSecretValue
              Resource: !Sub 'arn:aws:secretsmanager:${AWS::Region}:${AWS::AccountId}:secret:${OpenAISecretName}*'

  TokensTable:
    Type: AWS::DynamoDB::Table
    Properties:
      TableName: !Ref TokensTableName
      BillingMode: PAY_PER_REQUEST
      AttributeDefinitions:
        - AttributeName: token
          AttributeType: S
      KeySchema:
        - AttributeName: token
          KeyType: HASH

  LogsBucket:
    Type: AWS::S3::Bucket
    Properties:
      BucketName: !Ref LogsBucketName
      LifecycleConfiguration:
        Rules:
          - Id: ExpireOldLogs
            Status: Enabled
            ExpirationInDays: 90
            Filter:
              Prefix: ''

Outputs:
  FunctionName:
    Description: Lambda function name
    Value: !Ref CodexProxyFunction
  TokensTableName:
    Description: DynamoDB table for tokens
    Value: !Ref TokensTable
  LogsBucketName:
    Description: S3 bucket for logs
    Value: !Ref LogsBucket