NutriTrack SaaS — Plan de Arquitectura AWS

AWSTemplateFormatVersion: '2010-09-09'
Transform: AWS::Serverless-2016-10-31
Description: NutriTrack SaaS — Serverless Backend Stack (eu-west-1, GDPR)

Parameters:
  AppName:
    Type: String
    Default: nutritrack
  Environment:
    Type: String
    AllowedValues: [dev, staging, prod]
    Default: prod

Resources:

  # ── COGNITO USER POOL (autenticación GDPR) ───────────────────────
  UserPool:
    Type: AWS::Cognito::UserPool
    Properties:
      UserPoolName: !Sub ${AppName}-users-${Environment}
      AutoVerifiedAttributes: [email]
      MfaConfiguration: OPTIONAL
      PasswordPolicy:
        MinimumLength: 12
        RequireUppercase: true
        RequireSymbols: true

  # ── API LAMBDA (backend NutriTrack) ──────────────────────────────
  ApiFunction:
    Type: AWS::Serverless::Function
    Properties:
      FunctionName: !Sub ${AppName}-api-${Environment}
      Handler: index.handler
      Runtime: nodejs20.x
      MemorySize: 512
      Timeout: 10
      Tracing: Active   # X-Ray habilitado
      Environment:
        Variables:
          TABLE_NAME: !Ref DataTable
          USER_POOL_ID: !Ref UserPool
          ENVIRONMENT: !Ref Environment
      Policies:
        - DynamoDBCrudPolicy:
            TableName: !Ref DataTable
      Events:
        ApiEvent:
          Type: Api
          Properties:
            Path: /{proxy+}
            Method: ANY
            Auth:
              Authorizer: NutriCognito

  # ── DYNAMODB (perfiles + registros nutricionales) ─────────────────
  DataTable:
    Type: AWS::DynamoDB::Table
    Properties:
      TableName: !Sub ${AppName}-data-${Environment}
      BillingMode: PAY_PER_REQUEST
      PointInTimeRecoverySpecification:
        PointInTimeRecoveryEnabled: true
      SSESpecification:
        SSEEnabled: true
        SSEType: KMS  # GDPR: cifrado con clave gestionada
      AttributeDefinitions:
        - AttributeName: pk     # userId o clinicId
          AttributeType: S
        - AttributeName: sk     # entidad#fecha
          AttributeType: S
      KeySchema:
        - AttributeName: pk
          KeyType: HASH
        - AttributeName: sk
          KeyType: RANGE

  # ── S3 ASSETS (SPA React + uploads dietistas) ────────────────────
  WebBucket:
    Type: AWS::S3::Bucket
    Properties:
      BucketName: !Sub ${AppName}-web-${Environment}
      VersioningConfiguration:
        Status: Enabled
      LifecycleConfiguration:
        Rules:
          - Status: Enabled
            Transitions:
              - TransitionInDays: 30
                StorageClass: STANDARD_IA
              - TransitionInDays: 90
                StorageClass: GLACIER_IR

Outputs:
  ApiEndpoint:
    Description: URL del API REST NutriTrack
    Value: !Sub https://${ServerlessRestApi}.execute-api.${AWS::Region}.amazonaws.com/${Environment}
  UserPoolId:
    Value: !Ref UserPool
    Export:
      Name: !Sub ${AppName}-UserPoolId