resources.yml

Resources:
  ArithmeticCalculatorCognitoUserPool:
    # Reference: https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-cognito-userpool.html
    Type: AWS::Cognito::UserPool
    Properties:
      UserPoolName: ArithmeticCalculator
      AliasAttributes:
        - email
      AutoVerifiedAttributes:
        - email
      # Users managed by admin only
      AccountRecoverySetting:
        RecoveryMechanisms:
          - Name: "admin_only"
            Priority: 2
      AdminCreateUserConfig:
        # Remove self-service sign up
        AllowAdminCreateUserOnly: true
      Policies:
        PasswordPolicy:
          MinimumLength: 6
          RequireLowercase: true
          RequireNumbers: true
          RequireSymbols: true
          RequireUppercase: true
          TemporaryPasswordValidityDays: 14

  ArithmeticCalculatorCognitoUserPoolClient:
    # Reference: https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-cognito-userpoolclient.html
    Type: AWS::Cognito::UserPoolClient
    Properties:
      ClientName: ArithmeticCalculatorWebApp
      GenerateSecret: false
      AllowedOAuthFlows:
        - code
        - implicit
      AllowedOAuthFlowsUserPoolClient: true
      SupportedIdentityProviders:
        - COGNITO
      AllowedOAuthScopes:
        - openid
      UserPoolId:
        Ref: "ArithmeticCalculatorCognitoUserPool"
      CallbackURLs: ${self:custom.callBackUrls.${opt:stage, self:provider.stage}}
      LogoutURLs: ${self:custom.signOutURLs.${opt:stage, self:provider.stage}}

  ArithmeticCalculatorCognitoUserPoolDomain:
    # Reference: https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-cognito-userpooldomain.html
    Type: AWS::Cognito::UserPoolDomain
    Properties:
      Domain: ${opt:stage, self:provider.stage}-${self:service}
      UserPoolId:
        Ref: "ArithmeticCalculatorCognitoUserPool"

  ArithmeticCalculatorAuthorizer:
    # Reference: https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-apigateway-authorizer.html
    Type: AWS::ApiGateway::Authorizer
    Properties:
      Name: ArithmeticCalculator
      RestApiId:
        Ref: ApiGatewayRestApi
      Type: COGNITO_USER_POOLS
      ProviderARNs:
        - Fn::GetAtt: [ ArithmeticCalculatorCognitoUserPool, Arn ]
      IdentitySource: method.request.header.Authorization

  ArithmeticOperationTopic:
    Type: AWS::SNS::Topic
    Properties:
      TopicName: arithmetic-operation-${opt:stage, self:provider.stage}

  ArithmeticOperationQueue:
    Type: AWS::SQS::Queue
    Properties:
      QueueName: arithmetic-operation-${opt:stage, self:provider.stage}
      VisibilityTimeout: 180

  ArithemticOperationQueueSubscription:
    Type: AWS::SNS::Subscription
    Properties:
      Endpoint:
        Fn::GetAtt: [ ArithmeticOperationQueue, Arn ]
      Protocol: sqs
      RawMessageDelivery: true
      TopicArn:
        Ref: ArithmeticOperationTopic

  ArithmeticOperationQueuePolicy:
    Type: AWS::SQS::QueuePolicy
    Properties:
      PolicyDocument: {
        "Statement": [{
          "Effect": "Allow",
          "Principal": {
            "Service": "sns.amazonaws.com"
          },
          "Action": ["sqs:SendMessage"],
          "Resource": "*",
          "Condition": {
            "ArnEquals": {
              "aws:SourceArn": {
                "Ref": "ArithmeticOperationTopic"
              }
            }
          }
        }]
      }
      Queues:
        - Ref: ArithmeticOperationQueue

  GenerateRandomStringTopic:
    Type: AWS::SNS::Topic
    Properties:
      TopicName: generate-random-string-${opt:stage, self:provider.stage}

  GenerateRandomStringQueue:
    Type: AWS::SQS::Queue
    Properties:
      QueueName: generate-random-string-${opt:stage, self:provider.stage}
      VisibilityTimeout: 180

  GenerateRandomStringQueueSubscription:
    Type: AWS::SNS::Subscription
    Properties:
      Endpoint:
        Fn::GetAtt: [ GenerateRandomStringQueue, Arn ]
      Protocol: sqs
      RawMessageDelivery: true
      TopicArn:
        Ref: GenerateRandomStringTopic

  GenerateRandomStringQueuePolicy:
    Type: AWS::SQS::QueuePolicy
    Properties:
      PolicyDocument: {
        "Statement": [ {
          "Effect": "Allow",
          "Principal": {
            "Service": "sns.amazonaws.com"
          },
          "Action": [ "sqs:SendMessage" ],
          "Resource": "*",
          "Condition": {
            "ArnEquals": {
              "aws:SourceArn": {
                "Ref": "GenerateRandomStringTopic"
              }
            }
          }
        } ]
      }
      Queues:
        - Ref: GenerateRandomStringQueue

  NewOperationLambdaRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              Service: lambda.amazonaws.com
            Action: sts:AssumeRole
      Description: "New Operation Lambda Role"
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole
        - arn:aws:iam::aws:policy/service-role/AWSLambdaRole
      Policies:
        - PolicyDocument: {
            "Statement": [{
              "Effect": "Allow",
              "Action": [
                "sns:Publish",
                "sns:CreateTopic"
              ],
              "Resource": [
                { "Ref": "ArithmeticOperationTopic" },
                { "Ref": "GenerateRandomStringTopic" }
              ]
            },
            {
              "Effect": "Allow",
              "Action": [
                "dynamodb:Query",
                "dynamodb:PutItem"
              ],
              "Resource": [
                { "Fn::GetAtt": ["ArithmeticCalculatorTable", "Arn"] },
                { "Fn::Join" : [ "/", [ "Fn::GetAtt": [ "ArithmeticCalculatorTable", "Arn" ], "index", "GSI1" ] ]},
                { "Fn::Join" : [ "/", [ "Fn::GetAtt": [ "ArithmeticCalculatorTable", "Arn" ], "index", "GSI2" ] ]}
              ]
            },
            ]
          }
          PolicyName: ${self:service}-newOperation-lambda-policy-${opt:stage, self:provider.stage}
      RoleName: ${self:service}-newOperation-lambda-role-${opt:stage, self:provider.stage}

  GetBalanceLambdaRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              Service: lambda.amazonaws.com
            Action: sts:AssumeRole
      Description: "Get Balance Lambda Role"
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole
        - arn:aws:iam::aws:policy/service-role/AWSLambdaRole
      Policies:
        - PolicyDocument: {
            "Statement": [{
              "Effect": "Allow",
              "Action": [
                "dynamodb:Query"
              ],
              "Resource": [
                { "Fn::GetAtt": ["ArithmeticCalculatorTable", "Arn"] },
                { "Fn::Join" : [ "/", [ "Fn::GetAtt": [ "ArithmeticCalculatorTable", "Arn" ], "index", "GSI1" ] ]},
                { "Fn::Join" : [ "/", [ "Fn::GetAtt": [ "ArithmeticCalculatorTable", "Arn" ], "index", "GSI2" ] ]}
              ]
            },
            ]
          }
          PolicyName: ${self:service}-getBalance-lambda-policy-${opt:stage, self:provider.stage}
      RoleName: ${self:service}-getBalance-lambda-role-${opt:stage, self:provider.stage}

  DeleteRecordLambdaRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              Service: lambda.amazonaws.com
            Action: sts:AssumeRole
      Description: "Delete Record Lambda Role"
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole
        - arn:aws:iam::aws:policy/service-role/AWSLambdaRole
      Policies:
        - PolicyDocument: {
            "Statement": [{
              "Effect": "Allow",
              "Action": [
                "dynamodb:UpdateItem"
              ],
              "Resource": [
                { "Fn::GetAtt": ["ArithmeticCalculatorTable", "Arn"] },
                { "Fn::Join" : [ "/", [ "Fn::GetAtt": [ "ArithmeticCalculatorTable", "Arn" ], "index", "GSI1" ] ]},
                { "Fn::Join" : [ "/", [ "Fn::GetAtt": [ "ArithmeticCalculatorTable", "Arn" ], "index", "GSI2" ] ]}
              ]
            },
            ]
          }
          PolicyName: ${self:service}-deleteRecord-lambda-policy-${opt:stage, self:provider.stage}
      RoleName: ${self:service}-deleteRecord-lambda-role-${opt:stage, self:provider.stage}

  PollResultsLambdaRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              Service: lambda.amazonaws.com
            Action: sts:AssumeRole
      Description: "Poll Results Lambda Role"
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole
        - arn:aws:iam::aws:policy/service-role/AWSLambdaRole
      Policies:
        - PolicyDocument: {
            "Statement": [{
              "Effect": "Allow",
              "Action": [
                "dynamodb:GetItem"
              ],
              "Resource": [
                { "Fn::GetAtt": ["ArithmeticCalculatorTable", "Arn"] },
                { "Fn::Join" : [ "/", [ "Fn::GetAtt": [ "ArithmeticCalculatorTable", "Arn" ], "index", "GSI1" ] ]},
                { "Fn::Join" : [ "/", [ "Fn::GetAtt": [ "ArithmeticCalculatorTable", "Arn" ], "index", "GSI2" ] ]}
              ]
            },
            ]
          }
          PolicyName: ${self:service}-pollResults-lambda-policy-${opt:stage, self:provider.stage}
      RoleName: ${self:service}-pollResults-lambda-role-${opt:stage, self:provider.stage}

  ListRecordsLambdaRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              Service: lambda.amazonaws.com
            Action: sts:AssumeRole
      Description: "List Records Lambda Role"
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole
        - arn:aws:iam::aws:policy/service-role/AWSLambdaRole
      Policies:
        - PolicyDocument: {
            "Statement": [{
              "Effect": "Allow",
              "Action": [
                "dynamodb:Query"
              ],
              "Resource": [
                { "Fn::GetAtt": ["ArithmeticCalculatorTable", "Arn"] },
                { "Fn::Join" : [ "/", [ "Fn::GetAtt": [ "ArithmeticCalculatorTable", "Arn" ], "index", "GSI1" ] ]},
                { "Fn::Join" : [ "/", [ "Fn::GetAtt": [ "ArithmeticCalculatorTable", "Arn" ], "index", "GSI2" ] ]}
              ]
            },
            ]
          }
          PolicyName: ${self:service}-listRecords-lambda-policy-${opt:stage, self:provider.stage}
      RoleName: ${self:service}-listRecords-lambda-role-${opt:stage, self:provider.stage}

  ListOperationsLambdaRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              Service: lambda.amazonaws.com
            Action: sts:AssumeRole
      Description: "List Operations Lambda Role"
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole
        - arn:aws:iam::aws:policy/service-role/AWSLambdaRole
      Policies:
        - PolicyDocument: {
            "Statement": [{
              "Effect": "Allow",
              "Action": [
                "dynamodb:Query",
                "dynamodb:PutItem"
              ],
              "Resource": [
                { "Fn::GetAtt": ["ArithmeticCalculatorTable", "Arn"] },
                { "Fn::Join" : [ "/", [ "Fn::GetAtt": [ "ArithmeticCalculatorTable", "Arn" ], "index", "GSI1" ] ]},
                { "Fn::Join" : [ "/", [ "Fn::GetAtt": [ "ArithmeticCalculatorTable", "Arn" ], "index", "GSI2" ] ]}
              ]
            },
            ]
          }
          PolicyName: ${self:service}-listOperations-lambda-policy-${opt:stage, self:provider.stage}
      RoleName: ${self:service}-listOperations-lambda-role-${opt:stage, self:provider.stage}

  OperationWorkerLambdaRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              Service: lambda.amazonaws.com
            Action: sts:AssumeRole
      Description: "Role shared by Operation worker Lambdas"
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole
        - arn:aws:iam::aws:policy/service-role/AWSLambdaRole
        - arn:aws:iam::aws:policy/service-role/AWSLambdaSQSQueueExecutionRole
      Policies:
        - PolicyDocument: {
            "Statement": [{
              "Effect": "Allow",
              "Action": [
                "sqs:ReceiveMessage",
                "sqs:DeleteMessage",
                "sqs:GetQueueAttributes",
                "sqs:ChangeMessageVisibility",
                "sqs:GetQueueAttributes",
                "sqs:GetQueueUrl"
              ],
              "Resource": [
                { "Fn::GetAtt" : ["ArithmeticOperationQueue", "Arn"]}
              ]
            },
            {
              "Effect": "Allow",
              "Action": [
                "dynamodb:Query",
                "dynamodb:PutItem"
              ],
              "Resource": [
                { "Fn::GetAtt": ["ArithmeticCalculatorTable", "Arn"] },
                { "Fn::Join" : [ "/", [ "Fn::GetAtt": [ "ArithmeticCalculatorTable", "Arn" ], "index", "GSI1" ] ]},
                { "Fn::Join" : [ "/", [ "Fn::GetAtt": [ "ArithmeticCalculatorTable", "Arn" ], "index", "GSI2" ] ]}
              ]
            },
            ]
          }
          PolicyName: ${self:service}-operationWorker-lambda-policy-${opt:stage, self:provider.stage}
      RoleName: ${self:service}-operationWorker-lambda-role-${opt:stage, self:provider.stage}


  ArithmeticCalculatorTable:
    # Reference: https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-dynamodb-globaltable.html
    Type: AWS::DynamoDB::Table
    Properties:
      AttributeDefinitions:
        - AttributeName: PK
          AttributeType: S
        - AttributeName: SK
          AttributeType: S
        - AttributeName: GSI1PK
          AttributeType: S
        - AttributeName: GSI1SK
          AttributeType: S
        - AttributeName: GSI2PK
          AttributeType: S
        - AttributeName: GSI2SK
          AttributeType: S
      KeySchema:
        - AttributeName: PK
          KeyType: HASH
        - AttributeName: SK
          KeyType: RANGE
      ProvisionedThroughput:
        ReadCapacityUnits: 3
        WriteCapacityUnits: 2
      TableName: ${self:custom.tableName}
      GlobalSecondaryIndexes:
        - IndexName: GSI1
          KeySchema:
            - AttributeName: GSI1PK
              KeyType: HASH
            - AttributeName: GSI1SK
              KeyType: RANGE
          Projection:
            ProjectionType: ALL
          ProvisionedThroughput:
            ReadCapacityUnits: 3
            WriteCapacityUnits: 2
        - IndexName: GSI2
          KeySchema:
            - AttributeName: GSI2PK
              KeyType: HASH
            - AttributeName: GSI2SK
              KeyType: RANGE
          Projection:
            ProjectionType: ALL
          ProvisionedThroughput:
            ReadCapacityUnits: 3
            WriteCapacityUnits: 2

Outputs:
  CognitoUserPoolId:
    Description: "Arithmetic Calculator Cognito User Pool ID"
    Value:
      Ref: "ArithmeticCalculatorCognitoUserPool"

  CognitoUserPoolClientId:
    Description: "Arithmetic Calculator Cognito User Pool Client ID"
    Value:
      Ref: "ArithmeticCalculatorCognitoUserPoolClient"

  CognitoUserPoolDomain:
    Description: "Arithmetic Calculator Cognito User Pool Default Domain"
    Value:
      Ref: "ArithmeticCalculatorCognitoUserPoolDomain"

  CallbackURL:
    Description: "A callback URL is where the user is redirected to after a successful sign-in."
    Value: ${self:custom.defaultCallBackURL.${opt:stage, self:provider.stage}}

  SignOutURL:
    Description: "A sign-out URL is where your user is redirected to after signing out."
    Value: ${self:custom.defaultSignOutURL.${opt:stage, self:provider.stage}}