template.yaml

Description: "Microservice API and Auth settings"
Transform: "AWS::Serverless-2016-10-31"

Parameters:
  YourEmail:
    Type: String
  Version:
    Type: String
    Default: v1

Resources:
  UserPool:
    Type: AWS::Cognito::UserPool
    Properties:
      AdminCreateUserConfig:
        AllowAdminCreateUserOnly: false
      UserPoolName: TestingUsers
      UsernameAttributes:
      - email
      AutoVerifiedAttributes:
      - email
      Policies:
        PasswordPolicy:
          MinimumLength: 6
          RequireLowercase: true
          RequireNumbers: false
          RequireSymbols: false
          RequireUppercase: true
  UserPoolTokenClient:
    Type: AWS::Cognito::UserPoolClient
    Properties:
      UserPoolId: !Ref UserPool
      GenerateSecret: false
      ExplicitAuthFlows:
      - USER_PASSWORD_AUTH
  UserPoolUser:
    Type: AWS::Cognito::UserPoolUser
    Properties:
      DesiredDeliveryMediums:
        - EMAIL
      Username: !Ref YourEmail
      UserPoolId: !Ref UserPool

  # You don't actually need the API, but it does allow you to centralize your auth config, and allows you to add an Open API Spec
  ServiceApi:
    Type: AWS::Serverless::Api
    Properties:
      Name: ServiceApi
      StageName: !Ref Version
      # This is only needed if you are Requesting from a domain that is not shared with this API Domain
      # Know the security implications before doing this on a production site
      Cors:
        AllowMethods: "'*'"
        AllowHeaders: "'*'"
        AllowOrigin: "'*'"
      Auth:
        Authorizers:
          CognitoAuthorizer:
            UserPoolArn: !GetAtt "UserPool.Arn"

  LambdaFunction:
    Type: AWS::Serverless::Function
    Properties:
      Description: Handles the basic request
      Runtime: go1.x
      Handler: ./dist/authenticated
      # Policies:
        # Leaving this here so you can avoid the Gotcha.  Whatever this function does, it must be given permission to do so.
        # Check here: https://github.com/awslabs/serverless-application-model/blob/master/docs/policy_templates.rst
      Events:
        Get:
          Type: Api
          Properties:
            Path: /
            RestApiId: !Ref ServiceApi
            Method: GET
            Auth:
              Authorizer: CognitoAuthorizer
  OpenLambdaFunction:
    Type: AWS::Serverless::Function
    Properties:
      Description: Handles the basic request with no need for authentication
      Runtime: go1.x
      Handler: ./dist/open
      Events:
        Get:
          Type: Api
          Properties:
            Path: /open
            RestApiId: !Ref ServiceApi
            Method: GET
Outputs:
  CognitoID:
    Description: The Cognito UserPool ID
    Value: !Ref UserPool
  CognitoClientID:
    Description: The Cognito UserPool Client ID
    Value: !Ref UserPoolTokenClient
  ApiUrl:
    Description: The API URL
    Value: !Sub "https://${ServiceApi}.execute-api.${AWS::Region}.amazonaws.com/${Version}"