BackendServices.yml

AWSTemplateFormatVersion: '2010-09-09'
Description: ServerlessPass services used by the backend.
Parameters:
  ArtifactsBucketName:
    Description: Bucket to store artifacts for the backend
    Type: String
  DomainName:
    Description: Domain name used to communicate to the backend
    Type: String
  DomainHostedZoneId:
    Description: Hosted zone id of domain used to communicate to the backend
    Type: String
  Stage:
    Description: Stage is used to deploy multiple instances of ServerlessPass
    Type: String
    Default: Default
  CrossOriginDomains:
    Description: "Comma-separated domains allowed to make requests to the backend (example: https://example.com,http://localhost:5000)"
    Type: String
    Default: "chrome-extension://lcmbpoclaodbgkbjafnkbbinogcbnjih"
Resources:
  Alias:
    Type: AWS::SSM::Parameter
    Properties:
      Name: !Sub "ServerlessPassBackendServicesAlias${Stage}"
      Type: String
      Value: !Sub "ServerlessPass${Stage}"
  Certificate:
    Type: AWS::CertificateManager::Certificate
    Properties:
      DomainName: !Ref DomainName
      DomainValidationOptions:
      - DomainName: !Ref DomainName
        HostedZoneId: !Ref DomainHostedZoneId
      ValidationMethod: DNS
  UserPool:
    Type: AWS::Cognito::UserPool
    Properties:
      AccountRecoverySetting:
        RecoveryMechanisms:
        - Name: verified_email
          Priority: 1
      AutoVerifiedAttributes:
      - email
      Policies:
        PasswordPolicy:
          MinimumLength: 8
          RequireLowercase: true
          RequireNumbers: true
          RequireSymbols: true
          RequireUppercase: true
          TemporaryPasswordValidityDays: 1
      UsernameAttributes:
      - email
      UsernameConfiguration:
        CaseSensitive: false
      UserPoolName: !Sub "${Alias.Value}Users"
      VerificationMessageTemplate:
        DefaultEmailOption: CONFIRM_WITH_LINK
        EmailMessageByLink: Please click the link below to verify your email address.
          {##Verify email##}
        EmailSubjectByLink: Email verification is required
  UserPoolClient:
    Type: AWS::Cognito::UserPoolClient
    Properties:
      ClientName: BackendUserPoolClient
      ExplicitAuthFlows:
      - ALLOW_REFRESH_TOKEN_AUTH
      - ALLOW_USER_PASSWORD_AUTH
      SupportedIdentityProviders:
      - COGNITO
      UserPoolId: !Ref UserPool
      TokenValidityUnits:
        AccessToken: days
        IdToken: days
        RefreshToken: days
      RefreshTokenValidity: 3650
      AccessTokenValidity: 1
      IdTokenValidity: 1
  Table:
    Type: AWS::DynamoDB::Table
    Properties:
      AttributeDefinitions:
      - AttributeName: PartitionKey
        AttributeType: S
      - AttributeName: SortKey
        AttributeType: S
      BillingMode: PAY_PER_REQUEST
      KeySchema:
      - AttributeName: PartitionKey
        KeyType: HASH
      - AttributeName: SortKey
        KeyType: RANGE
      TableName: !Sub "${Alias.Value}PartitionedStorage"
  LambdaFunctionRolePolicy:
    Type: AWS::IAM::ManagedPolicy
    Properties:
      ManagedPolicyName: !Sub "${Alias.Value}LambdaPolicy"
      PolicyDocument:
        Version: '2012-10-17'
        Statement:
        - Effect: Allow
          Action:
          - "logs:CreateLogGroup"
          - "logs:CreateLogStream"
          - "logs:PutLogEvents"
          Resource: "arn:aws:logs:*:*:*"
        - Effect: Allow
          Action:
          - dynamodb:DescribeTable
          - dynamodb:PutItem
          - dynamodb:GetItem
          - dynamodb:Query
          - dynamodb:Scan
          - dynamodb:UpdateItem
          - dynamodb:DeleteItem
          Resource: !GetAtt Table.Arn
        - Effect: "Allow"
          Action:
          - cognito-idp:AdminInitiateAuth
          - cognito-idp:ListUsers
          Resource: !GetAtt UserPool.Arn
  LambdaFunctionRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
        - Action:
          - sts:AssumeRole
          Effect: Allow
          Principal:
            Service:
            - lambda.amazonaws.com
      ManagedPolicyArns:
      - !Ref LambdaFunctionRolePolicy
  ArtifactsBucket:
    Type: AWS::S3::Bucket
    DeletionPolicy: Delete
    Properties:
      BucketName: !Ref ArtifactsBucketName
      PublicAccessBlockConfiguration:
        BlockPublicAcls: true
        BlockPublicPolicy: true
        IgnorePublicAcls: true
        RestrictPublicBuckets: true
      LifecycleConfiguration:
        Rules:
        - ExpirationInDays: 1
          Status: Enabled
  CodeBuildProject:
    Type: AWS::CodeBuild::Project
    Properties:
      Artifacts:
        Type: NO_ARTIFACTS
      Environment:
        ComputeType: BUILD_GENERAL1_SMALL
        Image: aws/codebuild/standard:6.0
        Type: LINUX_CONTAINER
      LogsConfig:
        CloudWatchLogs:
          GroupName: !Ref CodeBuildLogs
          Status: ENABLED
          StreamName: CodeBuildProject
      Name: !Sub "${Alias.Value}BackendDeploy"
      ServiceRole: !Ref CodeBuildRole
      Source:
        Type: NO_SOURCE
        BuildSpec:
          !Sub |
            version: 0.2
            env:
              shell: bash
            phases:
              build:
                commands:
                - wget https://github.com/Staticsoft/ServerlessPass/releases/latest/download/Backend.zip
                - unzip Backend.zip
                - aws cloudformation package --template-file $CODEBUILD_SRC_DIR/deploy/templates/BackendLambda.yml --s3-bucket ${ArtifactsBucket} --output-template-file BackendLambda.yml;
                - |
                  if ! aws cloudformation describe-stacks --region ${AWS::Region} --stack-name ${Alias.Value}BackendLambda; then
                    aws cloudformation create-stack --region ${AWS::Region} --stack-name ${Alias.Value}BackendLambda --template-body file://BackendLambda.yml --parameters ParameterKey=Stage,ParameterValue=${Stage};
                    aws cloudformation wait stack-create-complete --stack-name ${Alias.Value}BackendLambda;
                  else
                    aws cloudformation update-stack --region ${AWS::Region} --stack-name ${Alias.Value}BackendLambda --template-body file://BackendLambda.yml --parameters ParameterKey=Stage,ParameterValue=${Stage} || exit 1;
                    aws cloudformation wait stack-update-complete --stack-name ${Alias.Value}BackendLambda;
                  fi
                - aws apigateway create-deployment --rest-api-id ${ApiGateway} --stage-name ${Stage};
      TimeoutInMinutes: 10
  CodeBuildLogs:
    Type: AWS::Logs::LogGroup
    Properties:
      LogGroupName: !Sub "${Alias.Value}BackendCodeBuildLogs"
      RetentionInDays: 90
  CodeBuildPolicy:
    Type: AWS::IAM::ManagedPolicy
    Properties:
      ManagedPolicyName: !Sub "${Alias.Value}BackendCodeBuildPolicy"
      PolicyDocument:
        Version: '2012-10-17'
        Statement:
        - Effect: Allow
          Action:
          - iam:PassRole
          Resource:
          - "*"
        - Effect: Allow
          Action:
          - logs:CreateLogStream
          - logs:DeleteLogStream
          - logs:PutLogEvents
          Resource: !GetAtt CodeBuildLogs.Arn
        - Effect: Allow
          Action:
          - s3:GetObject
          - s3:PutObject
          - s3:DeleteObject
          - s3:DeleteObjectVersion
          Resource: !Sub "${ArtifactsBucket.Arn}/*"
        - Effect: Allow
          Action:
          - lambda:GetFunction
          - lambda:UpdateFunctionCode
          - lambda:UpdateFunctionConfiguration
          - lambda:CreateFunction
          - lambda:DeleteFunction
          - lambda:AddPermission
          - lambda:RemovePermission
          Resource: !Sub "arn:aws:lambda:${AWS::Region}:${AWS::AccountId}:function:${Alias.Value}BackendLambda*"
        - Effect: Allow
          Action:
          - cloudformation:CreateStack
          - cloudformation:DeleteStack
          - cloudformation:UpdateStack
          - cloudformation:DescribeStacks
          Resource:
          - !Sub "arn:aws:cloudformation:${AWS::Region}:${AWS::AccountId}:stack/${Alias.Value}BackendLambda"
          - !Sub "arn:aws:cloudformation:${AWS::Region}:${AWS::AccountId}:stack/${Alias.Value}BackendLambda/*"
        - Effect: Allow
          Action:
          - apigateway:GET
          - apigateway:POST
          - apigateway:PATCH
          - apigateway:PUT
          - apigateway:DELETE
          - apigateway:TagResource
          Resource:
          - !Sub "arn:aws:apigateway:${AWS::Region}::/tags/*"
          - !Sub "arn:aws:apigateway:${AWS::Region}::/restapis/${ApiGateway}/*"
          - !Sub "arn:aws:apigateway:${AWS::Region}::/domainnames/${ApiGatewayDomain}/basepathmappings"
          - !Sub "arn:aws:apigateway:${AWS::Region}::/domainnames/${ApiGatewayDomain}/basepathmappings/*"
        - Effect: Allow
          Action:
          - events:DescribeRule
          - events:PutRule
          - events:DeleteRule
          - events:EnableRule
          - events:DisableRule
          - events:PutTargets
          - events:RemoveTargets
          Resource:
            Fn::Sub: "arn:aws:events:${AWS::Region}:${AWS::AccountId}:rule/${Alias.Value}StatusRule"
  CodeBuildRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
        - Action:
          - sts:AssumeRole
          Effect: Allow
          Principal:
            Service:
            - codebuild.amazonaws.com
      ManagedPolicyArns:
      - !Ref CodeBuildPolicy
  ApiGateway:
    Type: AWS::ApiGateway::RestApi
    Properties:
      Name: !Sub "${Alias.Value}Api"
  Authorizer:
    Type: AWS::ApiGateway::Authorizer
    Properties:
      Name: !Sub "${Alias.Value}Authorizer"
      RestApiId: !Ref ApiGateway
      Type: COGNITO_USER_POOLS
      ProviderARNs:
      - !Sub "arn:aws:cognito-idp:${AWS::Region}:${AWS::AccountId}:userpool/${UserPool}"
      IdentitySource: method.request.header.Authorization
      AuthorizerResultTtlInSeconds: 3600
  ApiGatewayDomain:
    Type: AWS::ApiGateway::DomainName
    Properties:
      CertificateArn: !Ref Certificate
      DomainName: !Ref DomainName
      EndpointConfiguration:
        Types:
        - EDGE
      SecurityPolicy: TLS_1_2
  ApiDNSRecord:
    Type: AWS::Route53::RecordSet
    Properties:
      HostedZoneId: !Ref DomainHostedZoneId
      Name: !Ref DomainName
      AliasTarget:
        DNSName: !GetAtt ApiGatewayDomain.DistributionDomainName
        EvaluateTargetHealth: false
        HostedZoneId: Z2FDTNDATAQYW2
      Type: A
Outputs:
  LambdaFunctionRoleArn:
    Value: !GetAtt LambdaFunctionRole.Arn
    Export:
      Name: !Sub "ServerlessPass${Stage}LambdaFunctionRoleArn"
  UserPoolId:
    Value: !Ref UserPool
    Export:
      Name: !Sub "ServerlessPass${Stage}UserPoolId"
  UserPoolClientId:
    Value: !Ref UserPoolClient
    Export:
      Name: !Sub "ServerlessPass${Stage}UserPoolClientId"
  ApiGatewayId:
    Value: !Ref ApiGateway
    Export:
      Name: !Sub "ServerlessPass${Stage}ApiGatewayId"
  ApiGatewayRootResourceId:
    Value: !GetAtt ApiGateway.RootResourceId
    Export:
      Name: !Sub "ServerlessPass${Stage}ApiGatewayRootResourceId"
  AuthorizerId:
    Value: !Ref Authorizer
    Export:
      Name: !Sub "ServerlessPass${Stage}AuthorizerId"
  DomainName:
    Value: !Ref ApiGatewayDomain
    Export:
      Name: !Sub "ServerlessPass${Stage}ApiGatewayDomainName"
  ArtifactsBucketName:
    Value: !Ref ArtifactsBucket
    Export:
      Name: !Sub "ServerlessPass${Stage}BackendArtifactsBucketName"
  CrossOriginDomains:
    Value: !Ref CrossOriginDomains
    Export:
      Name: !Sub "ServerlessPass${Stage}CrossOriginDomains"