template.yaml

AWSTemplateFormatVersion: '2010-09-09'
Transform: AWS::Serverless-2016-10-31
Description: This is an AWS SAM fork of the popular Serverless Notes API

Parameters:
  NotesTableName:
    Type: String
    Default: "notes"
    Description: Notes Table Name
  StripeSecretKey:
    Type: String

Globals:
  Api:
    Cors:
      AllowMethods: "'HEAD,OPTIONS,DELETE,GET,PUT,POST'"
      AllowHeaders: "'Content-Type,X-Amz-Date,Authorization,X-Api-Key,X-Amz-Security-Token'"
      AllowOrigin: "'*'"
    Auth:
      DefaultAuthorizer: AWS_IAM
      InvokeRole: NONE
      AddDefaultAuthorizerToCorsPreflight: false
  Function:
    CodeUri: .
    Runtime: nodejs12.x
    Timeout: 10
    Environment:
      Variables:
        tableName: !Ref NotesTableName
        stripeSecretKey: !Ref StripeSecretKey

Resources:

  #############################################################################
  # Functions
  #############################################################################
  Create:
    Type: AWS::Serverless::Function
    Properties:
      Handler: create.main
      Policies:
        - Version: '2012-10-17'
          Statement:
            - Effect: Allow
              Action:
                - 'dynamodb:PutItem'
              Resource: 'arn:aws:dynamodb:us-east-1:*:*'
      Events:
        HTTP:
          Type: Api
          Properties:
            Path: /notes
            Method: post
  Get:
    Type: AWS::Serverless::Function
    Properties:
      Handler: get.main
      Policies:
        - Version: '2012-10-17'
          Statement:
            - Effect: Allow
              Action:
                - 'dynamodb:GetItem'
              Resource: 'arn:aws:dynamodb:us-east-1:*:*'
      Events:
        HTTP:
          Type: Api
          Properties:
            Path: /notes/{id}
            Method: get
  List:
    Type: AWS::Serverless::Function
    Properties:
      Handler: list.main
      Policies:
        - Version: '2012-10-17'
          Statement:
            - Effect: Allow
              Action:
                - 'dynamodb:Query'
              Resource: 'arn:aws:dynamodb:us-east-1:*:*'
      Events:
        HTTP:
          Type: Api
          Properties:
            Path: /notes
            Method: get
  Update:
    Type: AWS::Serverless::Function
    Properties:
      Handler: update.main
      Policies:
        - Version: '2012-10-17'
          Statement:
            - Effect: Allow
              Action:
                - 'dynamodb:UpdateItem'
              Resource: 'arn:aws:dynamodb:us-east-1:*:*'
      Events:
        HTTP:
          Type: Api
          Properties:
            Path: /notes/{id}
            Method: put
  Billing:
    Type: AWS::Serverless::Function
    Properties:
      Handler: billing.main
      Events:
        HTTP:
          Type: Api
          Properties:
            Path: /billing
            Method: post
  Delete:
    Type: AWS::Serverless::Function
    Properties:
      Handler: delete.main
      Policies:
        - Version: '2012-10-17'
          Statement:
            - Effect: Allow
              Action:
                - 'dynamodb:DeleteItem'
              Resource: 'arn:aws:dynamodb:us-east-1:*:*'
      Events:
        HTTP:
          Type: Api
          Properties:
            Path: /notes/{id}
            Method: delete
  
  #############################################################################
  # Infrastructure
  #############################################################################
  # These Cloudformation definitions are unchanged from those at
  # https://github.com/AnomalyInnovations/serverless-stack-demo-api/tree/master/resources
  #############################################################################

  #############################################################################
  # Unchanged from 
  # https://github.com/AnomalyInnovations/serverless-stack-demo-api/blob/master/resources/dynamodb-table.yml
  #############################################################################
  NotesTable:
    Type: AWS::DynamoDB::Table
    Properties:
      TableName: !Ref NotesTableName
      AttributeDefinitions:
        - AttributeName: userId
          AttributeType: S
        - AttributeName: noteId
          AttributeType: S
      KeySchema:
        - AttributeName: userId
          KeyType: HASH
        - AttributeName: noteId
          KeyType: RANGE
      BillingMode: PAY_PER_REQUEST

  #############################################################################
  # Unchanged from 
  # https://github.com/AnomalyInnovations/serverless-stack-demo-api/blob/master/resources/s3-bucket.yml
  #############################################################################
  AttachmentsBucket:
    Type: AWS::S3::Bucket
    Properties:
      CorsConfiguration:
        CorsRules:
          -
            AllowedOrigins:
              - '*'
            AllowedHeaders:
              - '*'
            AllowedMethods:
              - GET
              - PUT
              - POST
              - DELETE
              - HEAD
            MaxAge: 3000
  
  #############################################################################
  # Unchanged from 
  # https://github.com/AnomalyInnovations/serverless-stack-demo-api/blob/master/resources/cognito-user-pool.yml
  #############################################################################
  CognitoUserPool:
    Type: AWS::Cognito::UserPool
    Properties:
      # Generate a name based on the stage
      UserPoolName: numble-user-pool
      # Set email as an alias
      UsernameAttributes:
        - email
      AutoVerifiedAttributes:
        - email
  CognitoUserPoolClient:
    Type: AWS::Cognito::UserPoolClient
    Properties:
      # Generate an app client name based on the stage
      ClientName: numble-user-pool-client
      UserPoolId:
        Ref: CognitoUserPool
      ExplicitAuthFlows:
        - ADMIN_NO_SRP_AUTH
      GenerateSecret: false 
  
  #############################################################################    
  # Unchanged from 
  # https://github.com/AnomalyInnovations/serverless-stack-demo-api/blob/master/resources/cognito-identity-pool.yml
  #############################################################################
  # The federated identity for our user pool to auth with
  CognitoIdentityPool:
    Type: AWS::Cognito::IdentityPool
    Properties:
      # Generate a name based on the stage
      IdentityPoolName: NumbleIdentityPool
      # Don't allow unathenticated users
      AllowUnauthenticatedIdentities: false
      # Link to our User Pool
      CognitoIdentityProviders:
        - ClientId:
            Ref: CognitoUserPoolClient
          ProviderName:
            Fn::GetAtt: [ "CognitoUserPool", "ProviderName" ]
  # IAM roles
  CognitoIdentityPoolRoles:
    Type: AWS::Cognito::IdentityPoolRoleAttachment
    Properties:
      IdentityPoolId:
        Ref: CognitoIdentityPool
      Roles:
        authenticated:
          Fn::GetAtt: [CognitoAuthRole, Arn]
  # IAM role used for authenticated users
  CognitoAuthRole:
    Type: AWS::IAM::Role
    Properties:
      Path: /
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: 'Allow'
            Principal:
              Federated: 'cognito-identity.amazonaws.com'
            Action:
              - 'sts:AssumeRoleWithWebIdentity'
            Condition:
              StringEquals:
                'cognito-identity.amazonaws.com:aud':
                  Ref: CognitoIdentityPool
              'ForAnyValue:StringLike':
                'cognito-identity.amazonaws.com:amr': authenticated
      Policies:
        - PolicyName: 'CognitoAuthorizedPolicy'
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Effect: 'Allow'
                Action:
                  - 'mobileanalytics:PutEvents'
                  - 'cognito-sync:*'
                  - 'cognito-identity:*'
                Resource: '*'
              # Allow users to invoke our API
              - Effect: 'Allow'
                Action:
                  - 'execute-api:Invoke'
                Resource:
                  Fn::Join:
                    - ''
                    -
                      - 'arn:aws:execute-api:'
                      - Ref: AWS::Region
                      - ':'
                      - Ref: AWS::AccountId
                      - ':'
                      - Ref: ServerlessRestApi
                      - '/*'
              # Allow users to upload attachments to their
              # folder inside our S3 bucket
              - Effect: 'Allow'
                Action:
                  - 's3:*'
                Resource:
                  - Fn::Join:
                    - ''
                    -
                      - Fn::GetAtt: [AttachmentsBucket, Arn]
                      - '/private/'
                      - '$'
                      - '{cognito-identity.amazonaws.com:sub}/*'
Outputs:
  AttachmentsBucketName:
    Value:
      Ref: AttachmentsBucket
  UserPoolId:
    Value:
      Ref: CognitoUserPool
  UserPoolClientId:
    Value:
      Ref: CognitoUserPoolClient
  IdentityPoolId:
    Value:
      Ref: CognitoIdentityPool
  NotesApi:
    Description: "API Gateway endpoint URL for Prod stage for Notes function"
    Value: !Sub "https://${ServerlessRestApi}.execute-api.${AWS::Region}.amazonaws.com/Prod/notes/"
  BillingApi:
    Description: "API Gateway endpoint URL for Prod stage for Billing function"
    Value: !Sub "https://${ServerlessRestApi}.execute-api.${AWS::Region}.amazonaws.com/Prod/billing/"