template.yaml

AWSTemplateFormatVersion: '2010-09-09'
Transform: AWS::Serverless-2016-10-31
Description: AWS Serverless Spring Boot 2 API - org.umaxcode::task-management-system

Parameters:
  TasksTableName:
    Description: Dynamodb table for tasks
    Type: String
    Default: tasks
  CognitoCallbackURL:
    Description: Cognito callback url
    Type: String
  UserPoolAdminGroupName:
    Description: User pool group name for API administrators
    Type: String
    Default: apiAdmins
  FrontendLoginUrl:
    Description: Frontend url for login
    Type: String
  AdminEmail:
    Description: Email address of admin
    Type: String
  AdminUsername:
    Description: Username of admin
    Type: String

Globals:
  Api:
    EndpointConfiguration: REGIONAL
  Function:
    Runtime: java21
    MemorySize: 512
    Timeout: 30

Resources:
  TaskManagementSystemFunction:
    Type: AWS::Serverless::Function
    Properties:
      FunctionName: !Sub ${AWS::StackName}-APILambda
      Handler: org.umaxcode.StreamLambdaHandler::handleRequest
      CodeUri: .
      Policies:
        - AWSLambdaBasicExecutionRole
        - DynamoDBCrudPolicy:
            TableName: !Ref TasksTable
        - SQSSendMessagePolicy:
            QueueName: !Sub ${AWS::StackName}-tasks-queue
        - Statement:
            Effect: Allow
            Action:
              - cognito-idp:AdminCreateUser
              - cognito-idp:ListUsers
              - cognito-idp:AdminUpdateUserAttributes
            Resource: !GetAtt UserPool.Arn
        - Statement:
            Effect: Allow
            Action:
              - states:StartExecution
            Resource:
              - !GetAtt StepFunctionsStateMachineSNSSubAndTaskDeadlineNot.Arn
      Environment:
        Variables:
          TASKS_TABLE_NAME: !Ref TasksTableName
          AWS_COGNITO_USER_POOL_ID: !Ref UserPool
          STEP_FUNCTION_ARN: !GetAtt StepFunctionsStateMachineSNSSubAndTaskDeadlineNot.Arn
          QUEUE_URL: !Ref TasksQueue
          TASKS_COMPLETE_NOTIFICATION_TOPIC_ARN: !Ref TaskCompleteNotificationTopic
          TASKS_REOPEN_NOTIFICATION_TOPIC_ARN: !Ref ReopenedTasksNotificationTopic
          TASKS_ASSIGNMENT_NOTIFICATION_TOPIC_ARN: !Ref TasksAssignmentNotificationTopic
      Events:
        ProxyResource:
          Type: Api
          Properties:
            Path: /{proxy+}
            Method: any

  UserPool: # Cognito User Pool
    Type: AWS::Cognito::UserPool
    Properties:
      UserPoolName: !Sub ${AWS::StackName}-user-pool
      AdminCreateUserConfig:
        AllowAdminCreateUserOnly: true
      AutoVerifiedAttributes:
        - email
      UsernameAttributes:
        - email
      Schema:
        - Name: name
          AttributeDataType: String
          Mutable: true
          Required: true
        - Name: email
          AttributeDataType: String
          Mutable: false
          Required: true
        - Name: role
          AttributeDataType: String
          Mutable: true
          Required: false
      Policies:
        PasswordPolicy:
          MinimumLength: 8
          RequireUppercase: true
          RequireLowercase: true
          RequireNumbers: true
          RequireSymbols: true
          TemporaryPasswordValidityDays: 7

  UserPoolClient: # Cognito User Pool Client
    Type: AWS::Cognito::UserPoolClient
    Properties:
      ClientName: !Sub ${AWS::StackName}-user-pool-client
      GenerateSecret: true
      AllowedOAuthFlowsUserPoolClient: true
      AllowedOAuthFlows:
        - code
        - implicit
      AllowedOAuthScopes:
        - email
        - openid
        - profile
      SupportedIdentityProviders:
        - COGNITO
      ExplicitAuthFlows:
        - ALLOW_USER_PASSWORD_AUTH
        - ALLOW_USER_SRP_AUTH
        - ALLOW_REFRESH_TOKEN_AUTH
      CallbackURLs:
        - !Ref CognitoCallbackURL
      UserPoolId: !Ref UserPool
      RefreshTokenValidity: 10
      AccessTokenValidity: 3
      IdTokenValidity: 3
      TokenValidityUnits:
        AccessToken: hours
        IdToken: hours
        RefreshToken: days

  UserPoolDomain: # Cognito User Pool Domain
    Type: AWS::Cognito::UserPoolDomain
    Properties:
      Domain: !Sub ${AWS::StackName}-user-pool-domain
      UserPoolId: !Ref UserPool

  ApiAdministratorsUserPoolGroup: # Cognito User Group for administrators
    Type: AWS::Cognito::UserPoolGroup
    Properties:
      Description: User group for API Administrators
      GroupName: !Sub ${AWS::StackName}-${UserPoolAdminGroupName}
      Precedence: 0
      UserPoolId: !Ref UserPool

  # Define SNS Topics
  TasksAssignmentNotificationTopic:
    Type: AWS::SNS::Topic
    Properties:
      TopicName: !Sub ${AWS::StackName}-tasks-assignment-notifications
      DisplayName: "Task Assignment Notifications"

  TasksDeadlineNotificationTopic:
    Type: AWS::SNS::Topic
    Properties:
      TopicName: !Sub ${AWS::StackName}-tasks-deadline-notifications
      DisplayName: "Task Deadline Notifications"

  ClosedTasksNotificationTopic:
    Type: AWS::SNS::Topic
    Properties:
      TopicName: !Sub ${AWS::StackName}-closed-tasks-notifications
      DisplayName: "Closed Tasks Notifications"

  ReopenedTasksNotificationTopic:
    Type: AWS::SNS::Topic
    Properties:
      TopicName: !Sub ${AWS::StackName}-reopened-tasks-notifications
      DisplayName: "Reopened Tasks Notifications"

  TaskCompleteNotificationTopic:
    Type: AWS::SNS::Topic
    Properties:
      TopicName: !Sub ${AWS::StackName}-task-complete-notifications
      DisplayName: "task completion Notifications"

  SNSTopicSubscriptionFunction:
    Type: AWS::Serverless::Function
    Properties:
      CodeUri: .
      FunctionName: !Sub ${AWS::StackName}-SNSLambda
      Handler: org.umaxcode.SNSTopicSubscriptionHandler::handleRequest
      Policies:
        - AWSLambdaBasicExecutionRole
        - Statement:
            Effect: Allow
            Action:
              - sns:Subscribe
              - sns:SetSubscriptionAttributes
            Resource:
              - !Ref TasksAssignmentNotificationTopic
              - !Ref TasksDeadlineNotificationTopic
              - !Ref ClosedTasksNotificationTopic
              - !Ref ReopenedTasksNotificationTopic

  SNSSubStateMachineRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - states.amazonaws.com
            Action:
              - sts:AssumeRole
      Policies:
        - PolicyName: StepFunctionsExecutionPolicy
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Effect: Allow
                Action:
                  - lambda:InvokeFunction
                Resource:
                  - !GetAtt SNSTopicSubscriptionFunction.Arn
                  - !GetAtt TaskStatusUpdateFunction.Arn
                  - !GetAtt SendTaskDeadlineNotificationFunction.Arn

  StepFunctionsStateMachineSNSSubAndTaskDeadlineNot:
    Type: AWS::StepFunctions::StateMachine
    Properties:
      StateMachineName: !Sub ${AWS::StackName}-StepFunctionStateMachine
      RoleArn: !GetAtt SNSSubStateMachineRole.Arn
      DefinitionString:
        !Sub |
        {
          "Comment": "SNS subscription and task deadline update state machine",
          "StartAt": "StateMachineDecision",
          "States": {
            "StateMachineDecision": {
              "Type": "Choice",
              "Choices": [
                {
                  "Variable": "$.workflowType",
                  "StringEquals": "post-confirmation-sns",
                  "Next": "ProcessSNSSubscription"
                },
                {
                  "Variable": "$.workflowType",
                  "StringEquals": "task-deadline-hit",
                  "Next": "ProcessTaskDeadlineUpdate"
                }
              ],
              "Default": "InvalidState"
            },
            "InvalidState": {
              "Type": "Succeed",
              "Comment": "Invalid State, no further action taken"
            },
            "ProcessSNSSubscription": {
              "Type": "Parallel",
              "Branches": [
                {
                  "StartAt": "TasksAssignmentNotificationSubscription",
                  "States": {
                    "TasksAssignmentNotificationSubscription": {
                      "Type": "Task",
                      "Resource": "${SNSTopicSubscriptionFunction.Arn}",
                      "Parameters": {
                        "topicArn": "${TasksAssignmentNotificationTopic}",
                        "email.$": "$.email"
                      },
                      "End": true
                    }
                  }
                },
                {
                  "StartAt": "TasksDeadlineNotificationSubscription",
                  "States": {
                    "TasksDeadlineNotificationSubscription": {
                      "Type": "Task",
                      "Resource": "${SNSTopicSubscriptionFunction.Arn}",
                      "Parameters": {
                        "topicArn": "${TasksDeadlineNotificationTopic}",
                        "email.$": "$.email"
                      },
                      "End": true
                    }
                  }
                },
                {
                  "StartAt": "ClosedTasksNotificationSubscription",
                  "States": {
                    "ClosedTasksNotificationSubscription": {
                      "Type": "Task",
                      "Resource": "${SNSTopicSubscriptionFunction.Arn}",
                      "Parameters": {
                        "topicArn": "${ClosedTasksNotificationTopic}",
                        "email.$": "$.email"
                      },
                      "End": true
                    }
                  }
                },
                {
                  "StartAt": "ReopenedTasksNotificationSubscription",
                  "States": {
                    "ReopenedTasksNotificationSubscription": {
                      "Type": "Task",
                      "Resource": "${SNSTopicSubscriptionFunction.Arn}",
                      "Parameters": {
                        "topicArn": "${ReopenedTasksNotificationTopic}",
                        "email.$": "$.email"
                      },
                      "End": true
                    }
                  }
                }
              ],
              "Next": "Complete"
            },
            "ProcessTaskDeadlineUpdate": {
              "Type": "Parallel",
              "Branches": [
                {
                  "StartAt": "UpdateTaskStatusToExpired",
                  "States": {
                    "UpdateTaskStatusToExpired": {
                      "Type": "Task",
                      "Resource": "${TaskStatusUpdateFunction.Arn}",
                      "Parameters": {
                        "taskId.$": "$.taskId"
                      },
                      "End": true
                    }
                  }
                },
                {
                  "StartAt": "PublishMessageToClosedTasksNotificationTopic",
                  "States": {
                    "PublishMessageToClosedTasksNotificationTopic": {
                      "Type": "Task",
                      "Resource": "${SendTaskDeadlineNotificationFunction.Arn}",
                      "Parameters": {
                        "taskId.$": "$.taskId",
                        "taskName.$": "$.taskName",
                        "taskDescription.$": "$.taskDescription",
                        "receiver.$": "$.receiver",
                        "assignedBy.$": "$.assignedBy",
                        "taskDeadline.$": "$.taskDeadline",
                        "topicArn.$": "$.topicArn",
                        "snsSubject.$": "$.snsSubject"
                      },
                      "End": true
                    }
                  }
                }
              ],
              "Next": "Complete"
            },
            "Complete": {
              "Type": "Succeed"
            }
          }
        }

  TasksTable: # Creates the DynamoDB table for user tasks
    Type: AWS::DynamoDB::Table
    Properties:
      TableName: !Ref TasksTableName
      AttributeDefinitions:
        - AttributeName: "taskId"
          AttributeType: "S"
        - AttributeName: "responsibility"
          AttributeType: "S"
        - AttributeName: "deadline"
          AttributeType: "S"
        - AttributeName: "status"
          AttributeType: "S"
        - AttributeName: "isNotifiedForApproachDeadline"
          AttributeType: "N"
      KeySchema:
        - AttributeName: "taskId"
          KeyType: "HASH"
      GlobalSecondaryIndexes:
        - IndexName: "responsibilityIndex"  # Name of the GSI
          KeySchema:
            - AttributeName: "responsibility"  # Partition key for the GSI
              KeyType: "HASH"
          Projection:
            ProjectionType: ALL
        - IndexName: "deadlineIndex"  # Name of the GSI
          KeySchema:
            - AttributeName: "deadline"  # Partition key for the GSI
              KeyType: "HASH"
          Projection:
            ProjectionType: ALL
        - IndexName: "statusIndex"  # Name of the GSI
          KeySchema:
            - AttributeName: "status"  # Partition key for the GSI
              KeyType: "HASH"
          Projection:
            ProjectionType: ALL
        - IndexName: "isNotifiedForApproachDeadlineIndex"  # Name of the GSI
          KeySchema:
            - AttributeName: "isNotifiedForApproachDeadline"  # Partition key for the GSI
              KeyType: "HASH"
          Projection:
            ProjectionType: ALL
      BillingMode: PAY_PER_REQUEST
      StreamSpecification:
        StreamViewType: NEW_IMAGE  # Capture the new item after each write

  SQSDynamodbStreamLambdaSendMessageHandler:
    Type: AWS::Serverless::Function
    Properties:
      FunctionName: !Sub ${AWS::StackName}-DynamoStreamLambda
      Handler: org.umaxcode.SQSDynamodbStreamLambdaSendMessageHandler::handleRequest
      CodeUri: .
      Policies:
        - SQSSendMessagePolicy: # Predefined policy to send messages
            QueueName: !Sub ${AWS::StackName}-tasks-queue
        - DynamoDBStreamReadPolicy: # Predefined policy to read from DynamoDB streams
            TableName: !Ref TasksTable
            StreamName: !GetAtt TasksTable.StreamArn
      Environment:
        Variables:
          QUEUE_URL: !Ref TasksQueue
          TASKS_ASSIGNMENT_NOTIFICATION_TOPIC_ARN: !Ref TasksAssignmentNotificationTopic
      Events:
        DynamoDBStreamEvent:
          Type: DynamoDB
          Properties:
            Stream: !GetAtt TasksTable.StreamArn
            BatchSize: 10  # Number of records to process in one invocation
            StartingPosition: TRIM_HORIZON

  SQSLambdaReadMessageFunction:
    Type: AWS::Serverless::Function
    Properties:
      FunctionName: !Sub ${AWS::StackName}-SQSLambda
      Handler: org.umaxcode.SQSLambdaReadMessageHandler::handleRequest
      CodeUri: .
      Policies:
        - Statement:
            Effect: Allow
            Action:
              - sqs:ReceiveMessage
              - sqs:DeleteMessage
              - sqs:GetQueueAttributes
            Resource:
              - !GetAtt TasksQueue.Arn
        - Statement:
            Effect: Allow
            Action:
              - sns:Publish
            Resource:
              - !Ref TasksAssignmentNotificationTopic
              - !Ref TasksDeadlineNotificationTopic
              - !Ref ReopenedTasksNotificationTopic
              - !Ref TaskCompleteNotificationTopic
        - Statement:
            Effect: Allow
            Action:
              - states:StartExecution
            Resource:
              - !GetAtt StepFunctionsStateMachineSNSSubAndTaskDeadlineNot.Arn
      Environment:
        Variables:
          STEP_FUNCTION_ARN: !GetAtt StepFunctionsStateMachineSNSSubAndTaskDeadlineNot.Arn
      Events:
        SQSTrigger:
          Type: SQS
          Properties:
            Queue: !GetAtt TasksQueue.Arn
            BatchSize: 5

  TasksQueue:
    Type: AWS::SQS::Queue
    Properties:
      QueueName: !Sub ${AWS::StackName}-tasks-queue

  TaskQueuePolicy:
    Type: AWS::SQS::QueuePolicy
    Properties:
      Queues:
        - !Ref TasksQueue
      PolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Sid: AllowLambdaToManipulateMessages
            Effect: Allow
            Principal:
              Service: lambda.amazonaws.com
            Action:
              - sqs:SendMessage
              - sqs:ReceiveMessage
              - sqs:DeleteMessage
              - sqs:GetQueueAttributes
            Resource: !GetAtt TasksQueue.Arn

  CheckTasksDeadlinesFunction:
    Type: AWS::Serverless::Function
    Properties:
      FunctionName: !Sub ${AWS::StackName}-EventBridgeLambda
      Handler: org.umaxcode.EventBridgeCheckDeadlinesHandler::handleRequest
      CodeUri: .
      Policies:
        - SQSSendMessagePolicy: # Predefined policy to send messages
            QueueName: !Sub ${AWS::StackName}-tasks-queue
        - DynamoDBCrudPolicy:
            TableName: !Ref TasksTable
      Environment:
        Variables:
          QUEUE_URL: !Ref TasksQueue
          TASKS_TABLE_NAME: !Ref TasksTable
          TASKS_DEADLINE_NOTIFICATION_TOPIC_ARN: !Ref TasksDeadlineNotificationTopic
          TASKS_CLOSED_NOTIFICATION_TOPIC_ARN: !Ref ClosedTasksNotificationTopic
      Events:
        CWSchedule:
          Type: ScheduleV2
          Properties:
            ScheduleExpression: 'rate(3 minute)'
            Name: !Sub ${AWS::StackName}-TaskDeadlineChecker
            Description: "Help checks the dynamoDB table(tasks) if a task is approaching deadline"

  TaskStatusUpdateFunction:
    Type: AWS::Serverless::Function
    Properties:
      FunctionName: !Sub ${AWS::StackName}-TaskStatusUpdateLambda
      Handler: org.umaxcode.TaskStatusUpdateLambdaHandler::handleRequest
      CodeUri: .
      Policies:
        - AWSLambdaBasicExecutionRole
        - Statement:
            Effect: Allow
            Action:
              - dynamodb:UpdateItem
            Resource: !GetAtt TasksTable.Arn
      Environment:
        Variables:
          TASKS_TABLE_NAME: !Ref TasksTable
          QUEUE_URL: !Ref TasksQueue

  SendTaskDeadlineNotificationFunction:
    Type: AWS::Serverless::Function
    Properties:
      FunctionName: !Sub ${AWS::StackName}-TaskDeadlineLambda
      Handler: org.umaxcode.SendTaskDeadlineNotificationLambdaHandler::handleRequest
      CodeUri: .
      Policies:
        - AWSLambdaBasicExecutionRole
        - Statement:
            Effect: Allow
            Action:
              - sns:Publish
            Resource: !Ref ClosedTasksNotificationTopic
    Environment:
      Variables:
        TASKS_CLOSED_NOTIFICATION_TOPIC_ARN: !Ref ClosedTasksNotificationTopic

  UpdateInviteMessageAdminCreationLambdaHandler:
    Type: AWS::Serverless::Function
    Properties:
      FunctionName: !Sub ${AWS::StackName}-InviteAdminLambda
      Handler: org.umaxcode.UpdateInviteMessageAdminCreationLambdaHandler::handleRequest
      CodeUri: .
      Policies:
        - AWSLambdaBasicExecutionRole
        - Statement:
            Effect: Allow
            Action:
              - cognito-idp:UpdateUserPool
              - cognito-idp:AdminCreateUser
              - cognito-idp:AdminGetUser
            Resource: !GetAtt UserPool.Arn
        - Statement:
            Effect: Allow
            Action:
              - sns:Subscribe
              - sns:SetSubscriptionAttributes
            Resource:
              - !Ref ClosedTasksNotificationTopic
              - !Ref TaskCompleteNotificationTopic

  UpdateInviteMessageTemplateAndCreateAdminUserCustomResource:
    Type: Custom::UpdateInviteMessageTemplate
    Properties:
      ServiceToken: !GetAtt UpdateInviteMessageAdminCreationLambdaHandler.Arn
      ServiceTimeout: 30
      UserPoolId: !Ref UserPool
      FrontendLoginUrl: !Ref FrontendLoginUrl
      AdminEmail: !Ref AdminEmail
      AdminUsername: !Ref AdminUsername
      TaskCompleteTopicArn: !Ref TaskCompleteNotificationTopic
      ClosedTaskTopicArn: !Ref ClosedTasksNotificationTopic

Outputs:
  TaskManagementSystemApi:
    Description: URL for application
    Value: !Sub 'https://${ServerlessRestApi}.execute-api.${AWS::Region}.amazonaws.com/Prod'
    Export:
      Name: !Sub ${AWS::StackName}-Api

  TaskTableName:
    Description: 'The name of the DynamoDB Task table'
    Value: !Ref TasksTable

  UserPool:
    Description: Cognito User Pool ID
    Value: !Ref UserPool

  UserPoolClient:
    Description: Cognito User Pool Application Client ID
    Value: !Ref UserPoolClient

  UserPoolAdminGroupName:
    Description: User Pool group name for API administrators
    Value: !Ref UserPoolAdminGroupName

  CognitoLoginURL:
    Description: Cognito User Pool Application Client Hosted Login UI URL
    Value: !Sub "https://${UserPoolDomain}.auth.${AWS::Region}.amazoncognito.com/login?client_id=${UserPoolClient}&response_type=code&redirect_uri=${CognitoCallbackURL}"

  CognitoAuthCommand:
    Description: AWS CLI command for Amazon Cognito User Pool authentication
    Value: !Sub "aws cognito-idp initiate-auth --auth-flow USER_PASSWORD_AUTH --client-id ${UserPoolClient} --auth-parameters USERNAME=<username>,PASSWORD=<password> --query 'AuthenticationResult.IdToken' --output text"

  TasksAssignmentNotificationTopicArn:
    Description: "ARN of the Task Assignment Notification SNS Topic"
    Value: !Ref TasksAssignmentNotificationTopic

  TasksDeadlineNotificationTopicArn:
    Description: "ARN of the Task Deadline Notification SNS Topic"
    Value: !Ref TasksDeadlineNotificationTopic

  ClosedTasksNotificationTopicArn:
    Description: "ARN of the Closed Tasks Notification SNS Topic"
    Value: !Ref ClosedTasksNotificationTopic

  ReopenedTasksNotificationTopicArn:
    Description: "ARN of the Reopened Tasks Notification SNS Topic"
    Value: !Ref ReopenedTasksNotificationTopic