template.yml

---
AWSTemplateFormatVersion: '2010-09-09'

Conditions:
  ApiDomainNameSpecified: !Not [!Equals [!Ref ApiDomainName, ""]]
  AuthDomainNameSpecified: !Not [!Equals [!Ref AuthDomainName, ""]]
  AuthHashKeySpecified: !Not [!Equals [!Ref AuthHashKey, ""]]
  NotificationEmailSpecified: !Not [!Equals [!Ref NotificationEmail, ""]]
  NotificationNumberSpecified: !Not [!Equals [!Ref NotificationNumber, ""]]
  OAuthClientIdSpecified: !Not [!Equals [!Ref OAuthClientId, ""]]
  OAuthClientSecretSpecified: !Not [!Equals [!Ref OAuthClientSecret, ""]]
  WebDomainNameSpecified: !Not [!Equals [!Ref WebDomainName, ""]]
  WebDomainNameUnspecified: !Equals [!Ref WebDomainName, ""]

Globals:
  Api:
    Cors:
      AllowHeaders: "'Accept, Authorization, Content-Type'"
      AllowOrigin:
        !If
        - WebDomainNameSpecified
        - !Sub "'https://${WebDomainName}'"
        - Fn::Sub: ["'http://${WebBucket}.${Endpoint}'", {Endpoint: !FindInMap [RegionMap, !Ref "AWS::Region", S3WebsiteEndpoint]}]

    MethodSettings:
      - DataTraceEnabled: true
        HttpMethod: "*"
        LoggingLevel: INFO
        MetricsEnabled: true
        ResourcePath: /*

  Function:
    Environment:
      Variables:
        NOTIFICATION_TOPIC: !Ref NotificationTopic
    Handler: main
    Runtime: go1.x
    Timeout: 5
    Tracing: Active

Mappings:
  RegionMap:
    ap-northeast-1:
      S3HostedZoneId: Z2M4EHUR26P7ZW
      S3WebsiteEndpoint: s3-website-ap-northeast-1.amazonaws.com
    ap-southeast-1:
      S3HostedZoneId: Z3O0J2DXBE1FTB
      S3WebsiteEndpoint: s3-website-ap-southeast-1.amazonaws.com
    ap-southeast-2:
      S3HostedZoneId: Z1WCIGYICN2BYD
      S3WebsiteEndpoint: s3-website-ap-southeast-2.amazonaws.com
    eu-west-1:
      S3HostedZoneId: Z1BKCTXD74EZPE
      S3WebsiteEndpoint: s3-website-eu-west-1.amazonaws.com
    sa-east-1:
      S3HostedZoneId: Z31GFT0UA1I2HV
      S3WebsiteEndpoint: s3-website-sa-east-1.amazonaws.com
    us-east-1:
      S3HostedZoneId: Z3AQBSTGFYJSTF
      S3WebsiteEndpoint: s3-website-us-east-1.amazonaws.com
    us-west-1:
      S3HostedZoneId: Z2F56UZL2M1ACD
      S3WebsiteEndpoint: s3-website-us-west-1.amazonaws.com
    us-west-2:
      S3HostedZoneId: Z3BJ6K6RIION7M
      S3WebsiteEndpoint: s3-website-us-west-2.amazonaws.com

Metadata:
  AWS::CloudFormation::Interface:
    ParameterGroups:
      - Label:
          default: Custom domains
        Parameters:
          - ApiDomainName
          - WebDomainName
      - Label:
          default: OAuth
        Parameters:
          - AuthDomainName
          - AuthHashKey
          - OAuthClientId
          - OAuthClientSecret
      - Label:
          default: Notifications
        Parameters:
          - NotificationEmail
          - NotificationNumber

Outputs:
  ApiDistributionDomainName:
    Condition: ApiDomainNameSpecified
    Value: !GetAtt ApiGatewayDomainName.DistributionDomainName

  ApiUrl:
    Value:
      !If
      - ApiDomainNameSpecified
      - !Sub https://${ApiDomainName}
      - !Sub "https://${ServerlessRestApi}.execute-api.${AWS::Region}.amazonaws.com/${ServerlessRestApiProdStage}"

  WebDistributionDomainName:
    Condition: WebDomainNameSpecified
    Value: !GetAtt WebDistribution.DomainName

  WebUrl:
    Value:
      !If
      - WebDomainNameSpecified
      - !Sub https://${WebDomainName}
      - Fn::Sub: ["http://${WebBucket}.${Endpoint}", {Endpoint: !FindInMap [RegionMap, !Ref "AWS::Region", S3WebsiteEndpoint]}]

Parameters:
  ApiDomainName:
    Default: ""
    Description: "Domain or subdomain for the API Gateway distribution, e.g. api.gofaas.net"
    Type: String

  AuthDomainName:
    Default: ""
    Description: "The domain to restrict OAuth profiles to, e.g. gofaas.net"
    Type: String

  AuthHashKey:
    Default: ""
    Description: "A secret key for signing and verifying JWTs"
    NoEcho: true
    Type: String

  NotificationEmail:
    Default: ""
    Type: String

  NotificationNumber:
    Default: ""
    Type: String

  OAuthClientId:
    Default: ""
    Description: "The Google OAuth 2.0 web app client id"
    Type: String

  OAuthClientSecret:
    Default: ""
    Description: "The Google OAuth 2.0 web app client secret"
    NoEcho: true
    Type: String

  WebDomainName:
    Default: ""
    Description: "Domain or subdomain for the static website distribution, e.g. www.gofaas.net"
    Type: String

Resources:
  ApiGatewayAccount:
    Properties:
      CloudWatchRoleArn: !GetAtt ApiGatewayRole.Arn
    Type: AWS::ApiGateway::Account

  ApiGatewayCertificate:
    Condition: ApiDomainNameSpecified
    Properties:
      DomainName: !Ref ApiDomainName
    Type: AWS::CertificateManager::Certificate

  ApiGatewayDomainName:
    Condition: ApiDomainNameSpecified
    Properties:
      CertificateArn: !Ref ApiGatewayCertificate
      DomainName: !Ref ApiDomainName
    Type: AWS::ApiGateway::DomainName

  ApiGatewayMapping:
    Condition: ApiDomainNameSpecified
    Properties:
      DomainName: !Ref ApiGatewayDomainName
      RestApiId: !Ref ServerlessRestApi
      Stage: !Ref ServerlessRestApiProdStage
    Type: AWS::ApiGateway::BasePathMapping

  ApiGatewayRole:
    Properties:
      AssumeRolePolicyDocument:
        Statement:
          - Action:
              - sts:AssumeRole
            Effect: Allow
            Principal:
              Service:
                - apigateway.amazonaws.com
            Sid: AllowServiceToAssumeRole
        Version: 2012-10-17
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/service-role/AmazonAPIGatewayPushToCloudWatchLogs
      Path: /
    Type: AWS::IAM::Role

  ApiGatewayStage:
    Properties:
      RestApiId: !Ref ServerlessRestApi
      ServiceToken: !GetAtt CustomResourceFunction.Arn
      Stage: !Ref ServerlessRestApiProdStage
      TracingEnabled: true
    Type: Custom::ApiGatewayStage

  Bucket:
    Type: AWS::S3::Bucket

  CustomResourceFunction:
    Properties:
      CodeUri: ./handlers/custom-resource
      FunctionName: !Sub ${AWS::StackName}-CustomResourceFunction
      Handler: main
      Policies:
        - arn:aws:iam::aws:policy/AmazonAPIGatewayAdministrator
      Runtime: go1.x
    Type: AWS::Serverless::Function

  DashboardFunction:
    Properties:
      CodeUri: ./handlers/dashboard
      Environment:
        Variables:
          CLIENT_ID: "id"
          CLIENT_SECRET: "secret"
      Events:
        Request:
          Properties:
            Method: GET
            Path: /
          Type: Api
      FunctionName: !Sub ${AWS::StackName}-DashboardFunction
      Handler: main
      Policies:
        - SNSPublishMessagePolicy:
            TopicName: !GetAtt NotificationTopic.TopicName
      Runtime: go1.x
    Type: AWS::Serverless::Function

  Key:
    Properties:
      KeyPolicy:
        Id: default
        Statement:
          - Action: kms:*
            Effect: Allow
            Principal:
              AWS: !Sub arn:aws:iam::${AWS::AccountId}:root
            Resource: '*'
            Sid: Enable IAM User Permissions
        Version: 2012-10-17
    Type: AWS::KMS::Key

  NotificationTopic:
    Properties:
      DisplayName: !Sub Notifications for ${AWS::StackName}
      Subscription:
        - !If
          - NotificationEmailSpecified
          - Endpoint: !Ref NotificationEmail
            Protocol: email
          - !Ref AWS::NoValue
        - !If
          - NotificationNumberSpecified
          - Endpoint: !Ref NotificationNumber
            Protocol: sms
          - !Ref AWS::NoValue
    Type: AWS::SNS::Topic

  UserCreateFunction:
    Properties:
      CodeUri: ./handlers/user-create
      Environment:
        Variables:
          AUTH_HASH_KEY: !Ref AuthHashKey
          KEY_ID: !Ref Key
          TABLE_NAME: !Ref UsersTable
      Events:
        Request:
          Properties:
            Method: POST
            Path: /users
          Type: Api
      FunctionName: !Sub ${AWS::StackName}-UserCreateFunction
      Handler: main
      Policies:
        - DynamoDBCrudPolicy:
            TableName: !Ref UsersTable
        - SNSPublishMessagePolicy:
            TopicName: !GetAtt NotificationTopic.TopicName
        - Statement:
            - Action:
                - kms:Encrypt
              Effect: Allow
              Resource: !GetAtt Key.Arn
          Version: 2012-10-17
      Runtime: go1.x
    Type: AWS::Serverless::Function

  UserDeleteFunction:
    Properties:
      CodeUri: ./handlers/user-delete
      Environment:
        Variables:
          AUTH_HASH_KEY: !Ref AuthHashKey
          KEY_ID: !Ref Key
          TABLE_NAME: !Ref UsersTable
      Events:
        Request:
          Properties:
            Method: DELETE
            Path: /users/{id}
          Type: Api
      FunctionName: !Sub ${AWS::StackName}-UserDeleteFunction
      Handler: main
      Policies:
        - DynamoDBCrudPolicy:
            TableName: !Ref UsersTable
        - SNSPublishMessagePolicy:
            TopicName: !GetAtt NotificationTopic.TopicName
      Runtime: go1.x
    Type: AWS::Serverless::Function

  UserReadFunction:
    Properties:
      CodeUri: ./handlers/user-read
      Environment:
        Variables:
          AUTH_HASH_KEY: !Ref AuthHashKey
          KEY_ID: !Ref Key
          TABLE_NAME: !Ref UsersTable
      Events:
        Request:
          Properties:
            Method: GET
            Path: /users/{id}
          Type: Api
      FunctionName: !Sub ${AWS::StackName}-UserReadFunction
      Handler: main
      Policies:
        - DynamoDBReadPolicy:
            TableName: !Ref UsersTable
        - KMSDecryptPolicy:
            KeyId: !Ref Key
        - SNSPublishMessagePolicy:
            TopicName: !GetAtt NotificationTopic.TopicName
      Runtime: go1.x
    Type: AWS::Serverless::Function

  UserUpdateFunction:
    Properties:
      CodeUri: ./handlers/user-update
      Environment:
        Variables:
          AUTH_HASH_KEY: !Ref AuthHashKey
          KEY_ID: !Ref Key
          TABLE_NAME: !Ref UsersTable
      Events:
        Request:
          Properties:
            Method: PUT
            Path: /users/{id}
          Type: Api
      FunctionName: !Sub ${AWS::StackName}-UserUpdateFunction
      Handler: main
      Policies:
        - DynamoDBCrudPolicy:
            TableName: !Ref UsersTable
        - SNSPublishMessagePolicy:
            TopicName: !GetAtt NotificationTopic.TopicName
        - Statement:
            - Action:
                - kms:Encrypt
              Effect: Allow
              Resource: !GetAtt Key.Arn
          Version: 2012-10-17
      Runtime: go1.x
    Type: AWS::Serverless::Function

  UsersTable:
    Properties:
      ProvisionedThroughput:
        ReadCapacityUnits: 1
        WriteCapacityUnits: 1
    Type: AWS::Serverless::SimpleTable

  WebAuthFunction:
    Properties:
      AutoPublishAlias: Live
      CodeUri: ./web/handlers/auth
      Environment: !Ref AWS::NoValue
      FunctionName: !Sub ${AWS::StackName}-WebAuthFunction
      Handler: index.handler
      Role: !GetAtt WebAuthFunctionRole.Arn
      Runtime: nodejs6.10
    Type: AWS::Serverless::Function

  WebAuthFunctionRole:
    Properties:
      AssumeRolePolicyDocument:
        Statement:
          - Action:
              - sts:AssumeRole
            Effect: Allow
            Principal:
              Service:
                - edgelambda.amazonaws.com
                - lambda.amazonaws.com
            Sid: AllowLambdaServiceToAssumeRole
        Version: 2012-10-17
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole
        - arn:aws:iam::aws:policy/AWSXrayWriteOnlyAccess
      Path: /
      Policies:
        - PolicyDocument:
            Statement:
              - Action: ssm:GetParametersByPath
                Effect: Allow
                Resource:
                  - !Sub arn:aws:ssm:${AWS::Region}:${AWS::AccountId}:parameter/${AWS::StackName}/*
            Version: 2012-10-17
          PolicyName: SSM
    Type: AWS::IAM::Role

  WebAuthParameterAuthDomainName:
    Condition: AuthDomainNameSpecified
    Properties:
      Name: !Sub /${AWS::StackName}/AuthDomainName
      Type: String
      Value: !Ref AuthDomainName
    Type: AWS::SSM::Parameter

  WebAuthParameterAuthHashKey:
    Condition: AuthHashKeySpecified
    Properties:
      Name: !Sub /${AWS::StackName}/AuthHashKey
      Type: String
      Value: !Ref AuthHashKey
    Type: AWS::SSM::Parameter

  WebAuthParameterOAuthClientId:
    Condition: OAuthClientIdSpecified
    Properties:
      Name: !Sub /${AWS::StackName}/OAuthClientId
      Type: String
      Value: !Ref OAuthClientId
    Type: AWS::SSM::Parameter

  WebAuthParameterOAuthClientSecret:
    Condition: OAuthClientSecretSpecified
    Properties:
      Name: !Sub /${AWS::StackName}/OAuthClientSecret
      Type: String
      Value: !Ref OAuthClientSecret
    Type: AWS::SSM::Parameter

  WebBucket:
    Properties:
      BucketName: !If [WebDomainNameSpecified, !Ref WebDomainName, !Sub "${AWS::StackName}-webbucket-${AWS::AccountId}"]
      WebsiteConfiguration:
        ErrorDocument: 404.html
        IndexDocument: index.html
    Type: AWS::S3::Bucket

  WebBucketPolicyPrivate:
    Condition: WebDomainNameSpecified
    Properties:
      Bucket: !Ref WebBucket
      PolicyDocument:
        Statement:
          - Action: s3:GetObject
            Effect: Allow
            Principal:
              CanonicalUser: !GetAtt WebOriginAccessIdentity.S3CanonicalUserId
            Resource: !Sub arn:aws:s3:::${WebBucket}/*
            Sid: GetObjectsCloudFront
    Type: AWS::S3::BucketPolicy

  WebBucketPolicyPublic:
    Condition: WebDomainNameUnspecified
    Properties:
      Bucket: !Ref WebBucket
      PolicyDocument:
        Statement:
          - Action: s3:GetObject
            Effect: Allow
            Principal: "*"
            Resource: !Sub arn:aws:s3:::${WebBucket}/*
            Sid: GetObjectsPublic
    Type: AWS::S3::BucketPolicy

  WebCertificate:
    Condition: WebDomainNameSpecified
    Properties:
      DomainName: !Ref WebDomainName
    Type: AWS::CertificateManager::Certificate

  WebDistribution:
    Condition: WebDomainNameSpecified
    Properties:
      DistributionConfig:
        Aliases:
          - !Ref WebDomainName
        Comment: !Sub Distribution for ${WebBucket}
        DefaultCacheBehavior:
          AllowedMethods:
            - GET
            - HEAD
          Compress: true
          ForwardedValues:
            Cookies:
              Forward: none
            QueryString: true
          LambdaFunctionAssociations:
            - !If
              - OAuthClientIdSpecified
              - EventType: viewer-request
                LambdaFunctionARN: !Ref WebAuthFunction.Version
              - !Ref AWS::NoValue
          TargetOriginId: !Ref WebBucket
          ViewerProtocolPolicy: redirect-to-https
        DefaultRootObject: index.html
        Enabled: true
        HttpVersion: http2
        Origins:
          - DomainName: !Sub ${WebBucket}.s3.amazonaws.com
            Id: !Ref WebBucket
            S3OriginConfig:
              OriginAccessIdentity: !Sub origin-access-identity/cloudfront/${WebOriginAccessIdentity}
        PriceClass: PriceClass_All
        ViewerCertificate:
          AcmCertificateArn: !Ref WebCertificate
          SslSupportMethod: sni-only
    Type: AWS::CloudFront::Distribution

  WebOriginAccessIdentity:
    Condition: WebDomainNameSpecified
    Properties:
      CloudFrontOriginAccessIdentityConfig:
        Comment: !Ref WebBucket
    Type: AWS::CloudFront::CloudFrontOriginAccessIdentity

  WorkCreateFunction:
    Properties:
      CodeUri: ./handlers/work-create
      Environment:
        Variables:
          AUTH_HASH_KEY: !Ref AuthHashKey
          WORKER_FUNCTION_NAME: !Ref WorkerFunction
      Events:
        Request:
          Properties:
            Method: POST
            Path: /work
          Type: Api
      FunctionName: !Sub ${AWS::StackName}-WorkCreateFunction
      Handler: main
      Policies:
        - SNSPublishMessagePolicy:
            TopicName: !GetAtt NotificationTopic.TopicName
        - Statement:
            - Action:
                - lambda:InvokeFunction
              Effect: Allow
              Resource: !GetAtt WorkerFunction.Arn
          Version: 2012-10-17
      Runtime: go1.x
    Type: AWS::Serverless::Function

  WorkerFunction:
    Properties:
      CodeUri: ./handlers/worker
      Environment:
        Variables:
          BUCKET: !Ref Bucket
      FunctionName: !Sub ${AWS::StackName}-WorkerFunction
      Handler: main
      Policies:
        - S3CrudPolicy:
            BucketName: !Ref Bucket
        - SNSPublishMessagePolicy:
            TopicName: !GetAtt NotificationTopic.TopicName
      Runtime: go1.x
    Type: AWS::Serverless::Function

  WorkerPeriodicFunction:
    Properties:
      CodeUri: ./handlers/worker-periodic
      Environment:
        Variables:
          BUCKET: !Ref Bucket
      Events:
        Request:
          Properties:
            Schedule: rate(1 day)
          Type: Schedule
      FunctionName: !Sub ${AWS::StackName}-WorkerPeriodicFunction
      Handler: main
      Policies:
        - Statement:
            - Action:
                - s3:DeleteObject
              Effect: Allow
              Resource: !Sub "arn:aws:s3:::${Bucket}/*"
            - Action:
                - s3:ListBucket
              Effect: Allow
              Resource: !Sub "arn:aws:s3:::${Bucket}"
        - SNSPublishMessagePolicy:
            TopicName: !GetAtt NotificationTopic.TopicName
      Runtime: go1.x
    Type: AWS::Serverless::Function

Transform: AWS::Serverless-2016-10-31