longtrail.yml

Parameters:
  DeploymentBucket:
    Type: String
  APILambdaKey:
    Type: String
  APILambdaVersion:
    Type: String
  SenderEmailArn:
    Type: String
  WebhookURL:
    Type: String
    NoEcho: true

Conditions:
  HasWebhook:
    Fn::Not:
      - Fn::Equals:
        - ""
        - !Ref WebhookURL
  HasSenderEmail:
    Fn::Not:
      - Fn::Equals:
        - ""
        - !Ref SenderEmailArn

Resources:
  LambdaRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Principal:
              Service: lambda.amazonaws.com
            Action: sts:AssumeRole
      Path: /
      Policies:
        - PolicyName: CognitoPolicy
          PolicyDocument:
            Statement:
              - Effect: Allow
                Action: cognito-idp:*
                Resource: !GetAtt LongtrailUserPool.Arn
        - PolicyName: AllowLogging
          PolicyDocument:
            Statement:
              - Effect: Allow
                Action:
                  - logs:CreateLogStream
                  - logs:PutLogEvents
                Resource: !GetAtt APIHandlerLogGroup.Arn
        - PolicyName: AllowDynamoAccess
          PolicyDocument:
            Statement:
              - Effect: Allow
                Action: dynamodb:*
                Resource:
                  - !GetAtt EventsTable.Arn
                  - !Sub ${EventsTable.Arn}/index/*

  APIHandlerLogGroup:
    Type: AWS::Logs::LogGroup
    Properties:
      LogGroupName: !Sub /aws/lambda/${AWS::StackName}-api
      RetentionInDays: 30

  APIHandlerLambda:
    Type: AWS::Lambda::Function
    Properties:
      FunctionName: !Sub ${AWS::StackName}-api
      Timeout: 30
      Environment:
        Variables:
          COGNITO_USER_POOL_ID: !Ref LongtrailUserPool
          EVENTS_TABLE_NAME: !Ref EventsTable
      Handler: longtrail-api
      Runtime: go1.x
      Role: !GetAtt LambdaRole.Arn
      Code:
        S3Bucket: !Ref DeploymentBucket
        S3Key: !Ref APILambdaKey
        S3ObjectVersion: !Ref APILambdaVersion

  APIHandlerLambdaPermission:
    Type: AWS::Lambda::Permission
    Properties:
      Action: lambda:InvokeFunction
      FunctionName: !Ref APIHandlerLambda
      Principal: apigateway.amazonaws.com
      SourceArn: !Sub arn:aws:execute-api:${AWS::Region}:${AWS::AccountId}:${BackendAPI}/*/*/*

  EventsTable:
    Type: AWS::DynamoDB::Table
    Properties:
      AttributeDefinitions:
        - AttributeName: id
          AttributeType: S
        - AttributeName: userId
          AttributeType: S
        - AttributeName: start
          AttributeType: S
      BillingMode: PAY_PER_REQUEST
      KeySchema:
        - AttributeName: id
          KeyType: HASH
        - AttributeName: userId
          KeyType: RANGE
      GlobalSecondaryIndexes:
        - IndexName: userId-start-index
          Projection:
            ProjectionType: ALL
          KeySchema:
            - AttributeName: userId
              KeyType: HASH
            - AttributeName: start
              KeyType: RANGE
      PointInTimeRecoverySpecification:
        PointInTimeRecoveryEnabled: true

  BackendAPI:
    Type: AWS::ApiGateway::RestApi
    Properties:
      Name: !Sub ${AWS::StackName}-backend-api
      EndpointConfiguration:
        Types:
          - EDGE

  BackendAPIMainResource:
    Type: AWS::ApiGateway::Resource
    Properties:
      ParentId: !GetAtt BackendAPI.RootResourceId
      PathPart: "{proxy+}"
      RestApiId: !Ref BackendAPI

  BackendAPIProxy:
    Type: AWS::ApiGateway::Method
    Properties:
      AuthorizationType: COGNITO_USER_POOLS
      AuthorizerId: !Ref LongtrailAPICognitoAuthorizer
      HttpMethod: ANY
      ResourceId: !Ref BackendAPIMainResource
      RestApiId: !Ref BackendAPI
      RequestParameters:
        method.request.path.proxy: true
        method.request.header.Authorization: true
      Integration:
        IntegrationHttpMethod: POST
        Type: AWS_PROXY
        Uri: !Sub arn:${AWS::Partition}:apigateway:${AWS::Region}:lambda:path/2015-03-31/functions/${APIHandlerLambda.Arn}/invocations

  # Define a specific OPTIONS endpoint without authorization. This is required for
  # CORS preflight requests, which do not include authorization information.
  BackendAPIOptions:
    Type: AWS::ApiGateway::Method
    Properties:
      AuthorizationType: NONE
      HttpMethod: OPTIONS
      ResourceId: !Ref BackendAPIMainResource
      RestApiId: !Ref BackendAPI
      RequestParameters:
        method.request.path.proxy: true
      Integration:
        IntegrationHttpMethod: POST
        Type: AWS_PROXY
        Uri: !Sub arn:${AWS::Partition}:apigateway:${AWS::Region}:lambda:path/2015-03-31/functions/${APIHandlerLambda.Arn}/invocations

  # BackendAPIDeployment will not update by default
  BackendAPIDeployment:
    Type: AWS::ApiGateway::Deployment
    Properties:
      RestApiId: !Ref BackendAPI
    DependsOn:
      - BackendAPIProxy
      - BackendAPIOptions

  BackendAPIStage:
    Type: AWS::ApiGateway::Stage
    Properties:
      RestApiId: !Ref BackendAPI
      DeploymentId: !Ref BackendAPIDeployment
      StageName: api
      MethodSettings:
        - ResourcePath: "/*"
          HttpMethod: "*"
          ThrottlingRateLimit: 10
          ThrottlingBurstLimit: 10

  LongtrailUserPool:
    Type: AWS::Cognito::UserPool
    Properties:
      Schema:
        - Name: teacherId
          AttributeDataType: String
          DeveloperOnlyAttribute: true
          Mutable: true
      UserPoolName: !Sub ${AWS::StackName}-userpool
      AutoVerifiedAttributes:
        - email
      LambdaConfig:
        Fn::If:
          - HasWebhook
          - PostConfirmation: !GetAtt AlertsLambda.Arn
          - !Ref AWS::NoValue
      EmailConfiguration:
        Fn::If:
          - HasSenderEmail
          - EmailSendingAccount: DEVELOPER
            SourceArn: !Ref SenderEmailArn
          - EmailSendingAccount: COGNITO_DEFAULT
      EmailVerificationMessage: |
        <p>Thank you for signing up for Long Trail! Your verification code is here:</p>
        <p><b>{####}</b></p>
        <p>The link to Long Trail is: https://longtrail.gmtools.org</p>
        <p>Enjoy!</p>
      EmailVerificationSubject: Long Trail Email Verification
      Policies:
        PasswordPolicy:
          MinimumLength: 8
          RequireLowercase: false
          RequireNumbers: false
          RequireSymbols: false
          RequireUppercase: false

  LongtrailUserPoolAdminGroup:
    Type: AWS::Cognito::UserPoolGroup
    Properties:
      GroupName: Admin
      UserPoolId: !Ref LongtrailUserPool

  LongtrailAPICognitoAuthorizer:
    Type: AWS::ApiGateway::Authorizer
    Properties:
      Name: !Sub ${AWS::StackName}-api-authorizer
      IdentitySource: method.request.header.Authorization
      ProviderARNs:
        - !GetAtt LongtrailUserPool.Arn
      RestApiId: !Ref BackendAPI
      Type: COGNITO_USER_POOLS

  LongtrailCognitoWebClient:
    Type: AWS::Cognito::UserPoolClient
    Properties:
      UserPoolId: !Ref LongtrailUserPool

  AlertsLambdaRole:
    Type: AWS::IAM::Role
    Condition: HasWebhook
    Properties:
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Principal:
              Service: lambda.amazonaws.com
            Action: sts:AssumeRole
      Path: /
      Policies:
        - PolicyName: AllowLogging
          PolicyDocument:
            Statement:
              - Effect: Allow
                Action:
                  - logs:CreateLogStream
                  - logs:PutLogEvents
                Resource: !GetAtt AlertsHandlerLogGroup.Arn

  AlertsLambda:
    Type: AWS::Lambda::Function
    Condition: HasWebhook
    Properties:
      FunctionName: !Sub ${AWS::StackName}-alerts
      Timeout: 5
      Handler: index.lambda_handler
      Runtime: python3.7
      Role: !GetAtt AlertsLambdaRole.Arn
      Environment:
        Variables:
          WEBHOOK_URL: !Ref WebhookURL
      Code:
        ZipFile: |
          import urllib3
          import json
          import os
          http = urllib3.PoolManager()
          def lambda_handler(event, context):
            try:
              url = os.getenv('WEBHOOK_URL')
              msg = {
                  'username': 'Longtrail Signups',
                  'content': f'{event["userName"]} just signed up!',
              }
              encoded_msg = json.dumps(msg).encode('utf-8')
              resp = http.request('POST', url, body=encoded_msg, headers={'Content-Type': 'application/json'})
              print(resp.status, resp.data)
            except Exception as e:
              print(e)
            return event

  AlertsHandlerLogGroup:
    Type: AWS::Logs::LogGroup
    Condition: HasWebhook
    Properties:
      LogGroupName: !Sub /aws/lambda/${AWS::StackName}-alerts
      RetentionInDays: 7

  AlertsLambdaPermission:
    Type: AWS::Lambda::Permission
    Condition: HasWebhook
    Properties:
      Action: lambda:InvokeFunction
      FunctionName: !GetAtt AlertsLambda.Arn
      Principal: cognito-idp.amazonaws.com
      SourceArn: !GetAtt LongtrailUserPool.Arn

Outputs:
  UserPoolId:
    Description: Cognito user pool ID
    Value: !Ref LongtrailUserPool
  WebClientId:
    Value: !Ref LongtrailCognitoWebClient
  BackendAPIId:
    Value: !Ref BackendAPI