template.sam

AWSTemplateFormatVersion: 2010-09-09
Description: REST services for the Task API. Includes API, SNS Topic, and DynamoDB Table

# Transform section specifies one or more macros that AWS CloudFormation uses to process your template
# https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/transform-section-structure.html
Transform:
- AWS::Serverless-2016-10-31

Parameters:
  TargetEnvironment:
    Description: 'Examples can be dev, test or prod'
    Type: 'String'
    
  ProductName:
    Description: 'Represents the name of the product you want to call the deployment'
    Type: 'String'

Resources:

  # DynamoDB Table for storing the Task records
  TaskTable:
    Type: AWS::DynamoDB::Table
    Properties:
      TableName: !Sub '${ProductName}-${TargetEnvironment}-dynamodb-taskstore'
      AttributeDefinitions:
        - AttributeName: userId
          AttributeType: S
        - AttributeName: taskId
          AttributeType: S
      KeySchema:
        - AttributeName: userId
          KeyType: HASH
        - AttributeName: taskId
          KeyType: RANGE
      ProvisionedThroughput: 
        ReadCapacityUnits: 2
        WriteCapacityUnits: 2

  # API Gateway used by the Task API.
  # Auth setup example from https://github.com/awslabs/serverless-application-model/blob/master/examples/2016-10-31/api_cognito_auth/template.yaml
  TaskApi:
    Type: AWS::Serverless::Api
    Properties:
      StageName: !Ref TargetEnvironment
      Name: !Sub '${ProductName}-${TargetEnvironment}-apigateway-task'
      Auth:
        DefaultAuthorizer: ApiReadTaskAuthorizer
        Authorizers:
          ApiDeleteTaskAuthorizer:
            UserPoolArn: {'Fn::ImportValue': !Sub '${ProductName}-${TargetEnvironment}-customeruserpoolarn'}
            Identity: 
              Header: 'Authorization'
            AuthorizationScopes:
              - !Sub "app.${ProductName}.api.task/task.delete"
          ApiWriteTaskAuthorizer:
            UserPoolArn: {'Fn::ImportValue': !Sub '${ProductName}-${TargetEnvironment}-customeruserpoolarn'}
            Identity: 
              Header: 'Authorization'
            AuthorizationScopes:
              - !Sub "app.${ProductName}.api.task/task.write"
          ApiReadTaskAuthorizer:
            UserPoolArn: {'Fn::ImportValue': !Sub '${ProductName}-${TargetEnvironment}-customeruserpoolarn'}
            Identity: 
              Header: 'Authorization'
            AuthorizationScopes:
              - !Sub "app.${ProductName}.api.task/task.read"
              
  # Task SNS subscriber for Project deletions
  projectTopicDeletionFunction:
    Type: 'AWS::Serverless::Function'
    Properties:
      Handler: src/handlers/project-deleted-event-handler.projectDeletedEventHandler
      Runtime: nodejs12.x
      Role: !GetAtt projectDeletionFunctionRole.Arn
      FunctionName: !Sub "${ProductName}-${TargetEnvironment}-lambda-event_task_project_deleted"
      Description: 'Deletes Tasks that are related to a project being deleted.'
      Environment:
        Variables:
          deployed_environment: !Ref TargetEnvironment
          dynamodb_taskTable: !Ref TaskTable
          dynamodb_endpointUrl: ''
          sns_project_topic: {'Fn::ImportValue': !Sub '${ProductName}-${TargetEnvironment}-sns-ProjectTopic'}
      MemorySize: 256
      Timeout: 300
      Tracing: Active
              
  ProjectTopicLambdaSubscription:
    Type: AWS::SNS::Subscription
    Properties: 
      Protocol: lambda
      Endpoint: !GetAtt projectTopicDeletionFunction.Arn
      TopicArn: {'Fn::ImportValue': !Sub '${ProductName}-${TargetEnvironment}-sns-ProjectTopic'}
      FilterPolicy:
        Event:
          - 'project-deleted'
      
  ProjectTopicSubscriberLambdaPermission:
    Type: AWS::Lambda::Permission
    Properties:
      FunctionName: !Ref projectTopicDeletionFunction
      Action: lambda:InvokeFunction
      Principal: sns.amazonaws.com
      SourceArn: {'Fn::ImportValue': !Sub '${ProductName}-${TargetEnvironment}-sns-ProjectTopic'}
      
  postItemFunction:
    Type: AWS::Serverless::Function
    Properties:
      FunctionName: !Sub '${ProductName}-${TargetEnvironment}-lambda-api_task_post'
      Handler: src/handlers/post-handler.postHandler
      Runtime: nodejs12.x
      MemorySize: 256
      Timeout: 10
      Description: HTT POST handler for the /task API endpoint
      Role: !GetAtt postItemFunctionRole.Arn
      Environment:
        Variables:
          deployed_environment: !Ref TargetEnvironment
          dynamodb_taskTable: !Ref TaskTable
          dynamodb_endpointUrl: ''
      Events:
        Api:
          Type: Api
          Properties:
            Auth:
              Authorizer: ApiWriteTaskAuthorizer
            Path: /
            Method: POST
            RestApiId:
              Ref: TaskApi

  getAllItemsFunction:
    Type: AWS::Serverless::Function
    Properties:
      Handler: src/handlers/get-all-handler.getAllHandler
      FunctionName: !Sub '${ProductName}-${TargetEnvironment}-lambda-api_task_getall'
      Runtime: nodejs12.x
      MemorySize: 256
      Timeout: 100
      Description: HTTP GET handler for the /task API endpoint to retrieve all Tasks for a user.
      Role: !GetAtt getAllItemsFunctionRole.Arn
      Environment:
        Variables:
          deployed_environment: !Ref TargetEnvironment
          dynamodb_taskTable: !Ref TaskTable
          dynamodb_endpointUrl: ''
      Events:
        Api:
          Type: Api
          Properties:
            Auth:
              Authorizer: ApiReadTaskAuthorizer
            Path: /
            Method: GET
            RestApiId:
              Ref: TaskApi
              
  projectDeletionFunctionRole:
    Type: AWS::IAM::Role
    Properties:
      Description: !Sub 'Allows deleting existing records from the ${TaskTable} table'
      RoleName: !Sub '${ProductName}-${TargetEnvironment}-role-api_task_project_topic'
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Principal:
              Service:
              - lambda.amazonaws.com
            Action:
              - 'sts:AssumeRole'
      Policies:
        - PolicyName: !Sub '${ProductName}-${TargetEnvironment}-policy-api_task_project_topic'
          PolicyDocument:
            Version: 2012-10-17
            Statement:
              - Effect: Allow
                Action: 
                  - 'dynamodb:DeleteItem'
                  - 'dynamodb:Query'
                Resource: !GetAtt TaskTable.Arn
              - Effect: Allow
                Action: 
                  - 'xray:CreateGroup'
                  - 'xray:CreateSamplingRule'
                Resource: 
                  - 'arn:aws:xray:*:*:group/*/*'
                  - 'arn:aws:xray:*:*:sampling-rule/*'
              - Effect: Allow
                Action:
                  - 'xray:PutTelemetryRecords'
                  - 'xray:PutTraceSegments'
                Resource: '*'
      ManagedPolicyArns:
        - 'arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole'
              
  # IAM Role used by the Lambda for handling HTTP POST requests that create projects.
  postItemFunctionRole:
    Type: AWS::IAM::Role
    Properties:
      Description: !Sub 'Allows inserting new records into the ${TaskTable} table'
      RoleName: !Sub '${ProductName}-${TargetEnvironment}-role-api_task_post'
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Principal:
              Service:
              - lambda.amazonaws.com
            Action:
              - 'sts:AssumeRole'
      Policies:
        - PolicyName: !Sub '${ProductName}-${TargetEnvironment}-policy-api_task_post'
          PolicyDocument:
            Version: 2012-10-17
            Statement:
              - Effect: Allow
                Action: 
                  - 'dynamodb:PutItem'
                Resource: !GetAtt TaskTable.Arn
              - Effect: Allow
                Action: 
                  - 'xray:CreateGroup'
                  - 'xray:CreateSamplingRule'
                Resource: 
                  - 'arn:aws:xray:*:*:group/*/*'
                  - 'arn:aws:xray:*:*:sampling-rule/*'
              - Effect: Allow
                Action:
                  - 'xray:PutTelemetryRecords'
                  - 'xray:PutTraceSegments'
                Resource: '*'
      ManagedPolicyArns:
        - 'arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole'

  # IAM Role used by the Lambda for handling HTTP GET requests that queries tasks.
  getAllItemsFunctionRole:
    Type: AWS::IAM::Role
    Properties:
      Description: !Sub 'Allows querying records from the ${TaskTable} table that represent a Task'
      RoleName: !Sub '${ProductName}-${TargetEnvironment}-role-api_task_getall'
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Principal:
              Service:
              - lambda.amazonaws.com
            Action:
              - 'sts:AssumeRole'
      Policies:
        - PolicyName: !Sub '${ProductName}-${TargetEnvironment}-policy-api_task_getall'
          PolicyDocument:
            Version: 2012-10-17
            Statement:
              - Effect: Allow
                Action: 
                  - 'dynamodb:Query'
                Resource: !GetAtt TaskTable.Arn
              - Effect: Allow
                Action: 
                  - 'xray:CreateGroup'
                  - 'xray:CreateSamplingRule'
                Resource: 
                  - 'arn:aws:xray:*:*:group/*/*'
                  - 'arn:aws:xray:*:*:sampling-rule/*'
              - Effect: Allow
                Action:
                  - 'xray:PutTelemetryRecords'
                  - 'xray:PutTraceSegments'
                Resource: '*'
      ManagedPolicyArns:
        - 'arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole'

Outputs:
  ApiEndPoint:
    Description: "API Gateway endpoint URL for target environment stage"
    Value: !Sub "https://${TaskApi}.execute-api.${AWS::Region}.amazonaws.com/${TargetEnvironment}/"
  ApiId:
    Description: "ID of the Task API resource"
    Value: !Ref TaskApi
    Export:
      Name: !Sub '${ProductName}-${TargetEnvironment}-apigateway-task'