template.yaml

AWSTemplateFormatVersion: '2010-09-09'
Transform: AWS::Serverless-2016-10-31
Description: >
  WombletechRHoK

  SAM Template for WombletechRHoK stack

# More info about Globals: https://github.com/awslabs/serverless-application-model/blob/master/docs/globals.rst
Globals:
  Function:
    Timeout: 3
    Runtime: nodejs14.x

Parameters:
  Env:
    Description: Deployment environment
    Default: test
    Type: String
    AllowedValues:
      - prod
      - test
  CognitoSlug:
    Description: The final part of the Cognito ARN (get from AWS console)
    Type: String
  EmailBucketName:
    Type: String
    Default: wombletech-rhok-email-incoming
  NewDonationTopicName:
    Type: String
    Default: wombletech-rhok-new-donation
  MxDomain:
    Type: String
    Default: mailer.sample.com

Resources:
  IncomingEmailBucketName:
    Type: 'AWS::S3::Bucket'
    DependsOn:
      - NewIncomingEmailInvokeLambdaPermission
    Properties:
      BucketName: !Ref EmailBucketName
      NotificationConfiguration:
        LambdaConfigurations:
          - Function: !GetAtt NewIncomingEmailFunction.Arn
            Event: 's3:ObjectCreated:*'
            Filter:
              S3Key:
                Rules:
                  - Name: prefix
                    Value: incoming/

  IncomingEmailBucketPolicy:
    Type: AWS::S3::BucketPolicy
    Properties:
      Bucket: !Ref EmailBucketName
      PolicyDocument:
        Version: 2012-10-17
        Statement:
          - Action:
              - 's3:PutObject'
            Effect: Allow
            Resource: !Join
              - ''
              - - 'arn:aws:s3:::'
                - !Ref EmailBucketName
                - /*
            Principal:
              Service: ses.amazonaws.com
            Condition:
              StringLike:
                'aws:Referer':
                  - !Sub "${AWS::AccountId}"

  GetDonationFunction:
    Type: AWS::Serverless::Function # More info about Function Resource: https://github.com/awslabs/serverless-application-model/blob/master/versions/2016-10-31.md#awsserverlessfunction
    Properties:
      Handler: app.lambdaHandler
      CodeUri: dist/api/donation/get
      Environment:
        Variables:
          TARGET_REGION: !Sub '${AWS::Region}'
      Events:
        Api:
          Type: Api # More info about API Event Source: https://github.com/awslabs/serverless-application-model/blob/master/versions/2016-10-31.md#api
          Properties:
            Path: /donation/{donationId}
            Method: get
            RestApiId: !Ref RestApi
            Auth:
              Authorizer: CognitoAuthorizer
              AuthorizationScopes:
                - admin-ui/admin
      Role: !GetAtt WombletechRHoKFunctionRole.Arn

  ListDonationsFunction:
    Type: AWS::Serverless::Function # More info about Function Resource: https://github.com/awslabs/serverless-application-model/blob/master/versions/2016-10-31.md#awsserverlessfunction
    Properties:
      Handler: app.lambdaHandler
      CodeUri: dist/api/donation/list
      Environment:
        Variables:
          TARGET_REGION: !Sub '${AWS::Region}'
      Events:
        Api:
          Type: Api # More info about API Event Source: https://github.com/awslabs/serverless-application-model/blob/master/versions/2016-10-31.md#api
          Properties:
            Path: /donation
            Method: get
            RestApiId: !Ref RestApi
            Auth:
              Authorizer: CognitoAuthorizer
              AuthorizationScopes:
                - admin-ui/admin
      Role: !GetAtt WombletechRHoKFunctionRole.Arn

  SubmitDonationFunction:
    Type: AWS::Serverless::Function # More info about Function Resource: https://github.com/awslabs/serverless-application-model/blob/master/versions/2016-10-31.md#awsserverlessfunction
    Properties:
      Handler: app.lambdaHandler
      CodeUri: dist/api/donation/post
      Environment:
        Variables:
          TARGET_REGION: !Sub '${AWS::Region}'
          NEW_DONATION_TOPIC: !Ref NewDonationReceivedNotificationTopic
      Events:
        Api:
          Type: Api # More info about API Event Source: https://github.com/awslabs/serverless-application-model/blob/master/versions/2016-10-31.md#api
          Properties:
            Path: /donation
            Method: post
            RestApiId: !Ref RestApi
            Auth:
              Authorizer: 'NONE'
      Role: !GetAtt WombletechRHoKFunctionRole.Arn

  UpdateDonationFunction:
    Type: AWS::Serverless::Function # More info about Function Resource: https://github.com/awslabs/serverless-application-model/blob/master/versions/2016-10-31.md#awsserverlessfunction
    Properties:
      Handler: app.lambdaHandler
      CodeUri: dist/api/donation/put
      Environment:
        Variables:
          TARGET_REGION: !Sub '${AWS::Region}'
      Events:
        Api:
          Type: Api # More info about API Event Source: https://github.com/awslabs/serverless-application-model/blob/master/versions/2016-10-31.md#api
          Properties:
            Path: /donation
            Method: put
            RestApiId: !Ref RestApi
            Auth:
              Authorizer: CognitoAuthorizer
              AuthorizationScopes:
                - admin-ui/admin
      Role: !GetAtt WombletechRHoKFunctionRole.Arn

  GetDonatedItemFunction:
    Type: AWS::Serverless::Function # More info about Function Resource: https://github.com/awslabs/serverless-application-model/blob/master/versions/2016-10-31.md#awsserverlessfunction
    Properties:
      Handler: app.lambdaHandler
      CodeUri: dist/api/item/get
      Environment:
        Variables:
          TARGET_REGION: !Sub '${AWS::Region}'
      Events:
        Api:
          Type: Api # More info about API Event Source: https://github.com/awslabs/serverless-application-model/blob/master/versions/2016-10-31.md#api
          Properties:
            Path: /donation/{donationId}/item/{itemId}
            Method: get
            RestApiId: !Ref RestApi
            Auth:
              Authorizer: CognitoAuthorizer
              AuthorizationScopes:
                - admin-ui/admin
      Role: !GetAtt WombletechRHoKFunctionRole.Arn

  ListDonatedItemsFunction:
    Type: AWS::Serverless::Function # More info about Function Resource: https://github.com/awslabs/serverless-application-model/blob/master/versions/2016-10-31.md#awsserverlessfunction
    Properties:
      Handler: app.lambdaHandler
      CodeUri: dist/api/item/list
      Environment:
        Variables:
          TARGET_REGION: !Sub '${AWS::Region}'
      Events:
        Api:
          Type: Api # More info about API Event Source: https://github.com/awslabs/serverless-application-model/blob/master/versions/2016-10-31.md#api
          Properties:
            Path: /donation/{donationId}/item
            Method: get
            RestApiId: !Ref RestApi
            Auth:
              Authorizer: CognitoAuthorizer
              AuthorizationScopes:
                - admin-ui/admin
      Role: !GetAtt WombletechRHoKFunctionRole.Arn

  SubmitDonatedItemFunction:
    Type: AWS::Serverless::Function # More info about Function Resource: https://github.com/awslabs/serverless-application-model/blob/master/versions/2016-10-31.md#awsserverlessfunction
    Properties:
      Handler: app.lambdaHandler
      CodeUri: dist/api/item/post
      Environment:
        Variables:
          TARGET_REGION: !Sub '${AWS::Region}'
      Events:
        Api:
          Type: Api # More info about API Event Source: https://github.com/awslabs/serverless-application-model/blob/master/versions/2016-10-31.md#api
          Properties:
            Path: /donation/{donationId}/item
            Method: post
            RestApiId: !Ref RestApi
            Auth:
              Authorizer: CognitoAuthorizer
              AuthorizationScopes:
                - admin-ui/admin
      Role: !GetAtt WombletechRHoKFunctionRole.Arn

  UpdateDonatedItemFunction:
    Type: AWS::Serverless::Function # More info about Function Resource: https://github.com/awslabs/serverless-application-model/blob/master/versions/2016-10-31.md#awsserverlessfunction
    Properties:
      Handler: app.lambdaHandler
      CodeUri: dist/api/item/put
      Environment:
        Variables:
          TARGET_REGION: !Sub '${AWS::Region}'
      Events:
        Api:
          Type: Api # More info about API Event Source: https://github.com/awslabs/serverless-application-model/blob/master/versions/2016-10-31.md#api
          Properties:
            Path: /donation/{donationId}/item
            Method: put
            RestApiId: !Ref RestApi
            Auth:
              Authorizer: CognitoAuthorizer
              AuthorizationScopes:
                - admin-ui/admin
      Role: !GetAtt WombletechRHoKFunctionRole.Arn

  NewIncomingEmailFunction:
    Type: AWS::Serverless::Function # More info about Function Resource: https://github.com/awslabs/serverless-application-model/blob/master/versions/2016-10-31.md#awsserverlessfunction
    Properties:
      Handler: app.lambdaHandler
      CodeUri: dist/backend/s3/newIncomingEmail
      Environment:
        Variables:
          TARGET_REGION: !Sub '${AWS::Region}'
      Role: !GetAtt WombletechRHoKFunctionRole.Arn

  NewIncomingEmailInvokeLambdaPermission:
    Type: AWS::Lambda::Permission
    Properties:
      Action: 'lambda:InvokeFunction'
      FunctionName: !Ref NewIncomingEmailFunction
      Principal: s3.amazonaws.com
      SourceArn: !Sub 'arn:aws:s3:::${EmailBucketName}'
      SourceAccount: !Ref AWS::AccountId

  NewDonationReceivedNotificationTopic:
    Type: AWS::SNS::Topic
    Properties:
      DisplayName: !Sub "${NewDonationTopicName}"
      TopicName: !Sub "${NewDonationTopicName}"
      Subscription:
        - Protocol: Lambda
          Endpoint: !GetAtt SendThankyouResponseFunction.Arn

  NewDonationReceivedNotificationTopicPolicy:
    Type: AWS::SNS::TopicPolicy
    Properties:
      Topics:
        - !Ref NewDonationReceivedNotificationTopic
      PolicyDocument:
        Version: 2012-10-17
        Statement:
          - Action:
              - 'sns:Publish'
            Effect: Allow
            Resource: !Ref NewDonationReceivedNotificationTopic
            Principal:
              AWS: '*'
            Condition:
              ArnLike:
                AWS:SourceArn: !Sub 'arn:aws:*:*:${AWS::AccountId}:*'

  SendThankyouResponseFunction:
    Type: AWS::Serverless::Function # More info about Function Resource: https://github.com/awslabs/serverless-application-model/blob/master/versions/2016-10-31.md#awsserverlessfunction
    Properties:
      Handler: app.lambdaHandler
      CodeUri: dist/backend/sns/newDonationReceived/sendThankyouResponse
      Environment:
        Variables:
          TARGET_REGION: !Sub '${AWS::Region}'
          MX_DOMAIN: !Sub '${MxDomain}'
      Role: !GetAtt WombletechRHoKFunctionRole.Arn

  SendThankyouResponseInvokeLambdaPermission:
    Type: AWS::Lambda::Permission
    Properties:
      Action: 'lambda:InvokeFunction'
      FunctionName: !Ref SendThankyouResponseFunction
      Principal: sns.amazonaws.com

  WombletechRHoKFunctionRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - lambda.amazonaws.com
            Action:
              - sts:AssumeRole
      Policies:
        - PolicyName: allowLogging
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Effect: Allow
                Action:
                  - logs:*
                Resource: arn:aws:logs:*:*:*
        - PolicyName: getS3Objects
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Effect: Allow
                Action:
                  - s3:GetObject
                Resource: !Sub 'arn:aws:s3:::${EmailBucketName}/*'
        - PolicyName: publishSNSNotifications
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Effect: Allow
                Action:
                  - sns:Publish
                Resource: !Sub 'arn:aws:sns:${AWS::Region}:${AWS::AccountId}:*'
        - PolicyName: sendSESEmails
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Effect: Allow
                Action:
                  - ses:Send*
                Resource: '*'
        - PolicyName: accessSimpleDB
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Effect: Allow
                Action:
                  - sdb:*
                Resource: !Sub 'arn:aws:sdb:${AWS::Region}:${AWS::AccountId}:domain/*'

  RestApi:
    Type: AWS::Serverless::Api # https://docs.aws.amazon.com/serverless-application-model/latest/developerguide/sam-resource-api.html
    Properties:
      StageName: !Ref Env
      Cors:
        AllowMethods: "'GET,POST,PUT,DELETE,OPTIONS'"
        AllowHeaders: "'*'"
        AllowOrigin: "'*'"
      Auth:
        DefaultAuthorizer: CognitoAuthorizer
        AddDefaultAuthorizerToCorsPreflight: false # < ignore template schema validation error - this is correct
        Authorizers:
          CognitoAuthorizer:
            AuthType: "COGNITO_USER_POOLS"
            UserPoolArn:
              - !Sub 'arn:aws:cognito-idp:${AWS::Region}:${AWS::AccountId}:userpool/${AWS::Region}_${CognitoSlug}'
            Identity:
              Header: 'Authorization'

Outputs:
  # ServerlessRestApi is an implicit API created out of Events key under Serverless::Function
  # Find out more about other implicit resources you can reference within SAM
  # https://github.com/awslabs/serverless-application-model/blob/master/docs/internals/generated_resources.rst#api
  WombletechRHoKDonationApi:
    Description: "API Gateway endpoint URL for Prod stage managing donations"
    Value: !Sub "https://${RestApi}.execute-api.${AWS::Region}.amazonaws.com/${Env}/donation"
  GetDonationFunction:
    Description: "Lambda function to get a donation entry"
    Value: !GetAtt GetDonationFunction.Arn
  ListDonationsFunction:
    Description: "Lambda Function To list donations"
    Value: !GetAtt ListDonationsFunction.Arn
  SubmitDonationFunction:
    Description: "Lambda Function To submit donations"
    Value: !GetAtt SubmitDonationFunction.Arn
  UpdateDonationFunction:
    Description: "Lambda Function To update donations"
    Value: !GetAtt UpdateDonationFunction.Arn
  GetDonatedItemFunction:
    Description: "Lambda Function go get a donation item"
    Value: !GetAtt GetDonatedItemFunction.Arn
  ListDonatedItemsFunction:
    Description: "Lambda Function To list donation items"
    Value: !GetAtt ListDonatedItemsFunction.Arn
  SubmitDonatedItemFunction:
    Description: "Lambda Function To submit a donated item"
    Value: !GetAtt SubmitDonatedItemFunction.Arn
  UpdateDonatedItemFunction:
    Description: "Lambda Function To update a donated item"
    Value: !GetAtt UpdateDonatedItemFunction.Arn
  WombletechRHoKFunctionRole:
    Description: "IAM Role created for Lambdas"
    Value: !GetAtt WombletechRHoKFunctionRole.Arn
  NewDonationReceivedNotificationTopic:
    Description: "New Donation Received Notification Topic"
    Value: !Ref NewDonationReceivedNotificationTopic