template.yaml

AWSTemplateFormatVersion: "2010-09-09"
Transform: AWS::Serverless-2016-10-31
Description: Breakdown
Parameters:
  Api:
    Type: AWS::SSM::Parameter::Value<String>
    Default: Api

  EpsagonToken:
    Type: AWS::SSM::Parameter::Value<String>
    Default: EpsagonToken

  GitHubBranch:
    Type: String
    Default: master

  GitHubRepo:
    Type: String
    Default: breakdown

  GitHubToken:
    Type: AWS::SSM::Parameter::Value<String>
    Default: GitHubToken

  GitHubUser:
    Type: String
    Default: cazzer

  DatabaseName:
    Type: String
    Default: breakdown

  DatabaseUser:
    Type: String
    Default: postgres

  DatabasePassword:
    Type: AWS::SSM::Parameter::Value<String>
    Default: DatabasePassword

  SentryDsn:
    Type: AWS::SSM::Parameter::Value<String>
    Default: SentryDsn

  WebSocketUrl:
    Type: AWS::SSM::Parameter::Value<String>
    Default: WebSocketUrl

Globals:
  Function:
    Runtime: nodejs10.x
    MemorySize: 192
    Timeout: 10
    Environment:
      Variables:
        EPSAGON_TOKEN: !Ref EpsagonToken

Resources:
  PipelineBucket:
    Type: AWS::S3::Bucket

  LambdaSourceBucket:
    Type: AWS::S3::Bucket

  PipelineRole:
    Type: AWS::IAM::Role
    Properties:
      Path: /
      AssumeRolePolicyDocument:
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - codepipeline.amazonaws.com
            Action:
              - sts:AssumeRole

  CodebuildRole:
    Type: AWS::IAM::Role
    Properties:
      Path: /
      AssumeRolePolicyDocument:
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - codebuild.amazonaws.com
            Action:
              - sts:AssumeRole

  CloudFormationRole:
    Type: AWS::IAM::Role
    Properties:
      Path: /
      AssumeRolePolicyDocument:
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - cloudformation.amazonaws.com
            Action:
              - sts:AssumeRole

  AutomationPolicy:
    Type: AWS::IAM::Policy
    Properties:
      PolicyName: !Sub ${AWS::StackName}-policy
      PolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Resource: "*"
            Effect: Allow
            Action:
              - s3:*
              - cloudformation:*
              - iam:PassRole
              - codebuild:*
              - cloudwatch:*
              - logs:*
              - ec2:*
              - iam:*
              - lambda:*
              - sns:*
              - ssm:*
              - rds:*
              - ecr:*
              - xray:*
              - cloudfront:*
              - route53:*
              - apigateway:*
              - cognito-idp:*
              - codepipeline:*
              - acm:*
              - cognito-identity:*
              - events:*
              - dynamodb:*
      Roles:
        - !Ref PipelineRole
        - !Ref CodebuildRole
        - !Ref CloudFormationRole

  CodebuildProject:
    Type: AWS::CodeBuild::Project
    Properties:
      Artifacts:
        Type: "CODEPIPELINE"
      Source:
        Type: "CODEPIPELINE"
        BuildSpec: buildspec.yaml
      Environment:
        ComputeType: "BUILD_GENERAL1_SMALL"
        Image: "aws/codebuild/nodejs:10.1.0"
        Type: "LINUX_CONTAINER"
        EnvironmentVariables:
          - Name: OUTPUT_TEMPLATE_FILE
            Value: 'packaged-template.yaml'
          - Name: TEMPLATE_FILE
            Value: 'template.yaml'
          - Name: S3_BUCKET
            Value: !Ref LambdaSourceBucket
      ServiceRole: !Ref CodebuildRole

  Pipeline:
    Type: AWS::CodePipeline::Pipeline
    Properties:
      RoleArn: !GetAtt PipelineRole.Arn
      ArtifactStore:
        Type: S3
        Location: !Ref PipelineBucket
      Stages:
        - Name: Source
          Actions:
            - Name: Source
              ActionTypeId:
                Category: Source
                Owner: ThirdParty
                Version: 1
                Provider: GitHub
              Configuration:
                Owner: !Ref GitHubUser
                Repo: !Ref GitHubRepo
                Branch: !Ref GitHubBranch
                OAuthToken: !Ref GitHubToken
              OutputArtifacts:
                - Name: Source
              RunOrder: 1
        - Name: Build
          Actions:
            - Name: Build
              ActionTypeId:
                Category: Build
                Owner: AWS
                Version: 1
                Provider: CodeBuild
              Configuration:
                ProjectName: !Ref CodebuildProject
              InputArtifacts:
                - Name: Source
              OutputArtifacts:
                - Name: LambdaBuild
              RunOrder: 1
        - Name: Deploy
          Actions:
            - Name: CreateChangeSet
              ActionTypeId:
                Category: Deploy
                Owner: AWS
                Provider: CloudFormation
                Version: 1
              Configuration:
                ActionMode: CHANGE_SET_REPLACE
                Capabilities: CAPABILITY_NAMED_IAM
                ChangeSetName: ChangeSet
                RoleArn: !GetAtt CloudFormationRole.Arn
                StackName: !Ref AWS::StackName
                TemplatePath: Build::packaged-template.yaml
              InputArtifacts:
                - Name: LambdaBuild
              RunOrder: 1
            - Name: ExecuteChangeSet
              ActionTypeId:
                Category: Deploy
                Owner: AWS
                Provider: CloudFormation
                Version: 1
              Configuration:
                ActionMode: CHANGE_SET_EXECUTE
                ChangeSetName: ChangeSet
                RoleArn: !GetAtt CloudFormationRole.Arn
                StackName: !Ref AWS::StackName
              RunOrder: 2

  IdentityPool:
    Type: AWS::Cognito::IdentityPool
    Properties:
      AllowUnauthenticatedIdentities: false
      CognitoIdentityProviders:
        - ClientId: !Ref UserPoolClient
          ProviderName: !GetAtt UserPool.ProviderName
          ServerSideTokenCheck: true

  CognitoIdentityPoolRoles:
    Type: AWS::Cognito::IdentityPoolRoleAttachment
    Properties:
      IdentityPoolId: !Ref IdentityPool
      Roles:
        authenticated: !GetAtt CognitoAuthRole.Arn

  CognitoAuthRole:
    Type: AWS::IAM::Role
    Properties:
      Path: /
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: 'Allow'
            Principal:
              Federated: 'cognito-identity.amazonaws.com'
            Action:
              - 'sts:AssumeRoleWithWebIdentity'
            Condition:
              StringEquals:
                'cognito-identity.amazonaws.com:aud':
                  Ref: IdentityPool
              'ForAnyValue:StringLike':
                'cognito-identity.amazonaws.com:amr': authenticated
      Policies:
        - PolicyName: 'CognitoAuthorizedPolicy'
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Effect: 'Allow'
                Action:
                  - 'mobileanalytics:PutEvents'
                  - 'cognito-sync:*'
                  - 'cognito-identity:*'
                Resource: '*'
              - Effect: 'Allow'
                Action:
                  - 'execute-api:Invoke'
                Resource:
                  Fn::Join:
                    - ''
                    -
                      - 'arn:aws:execute-api:'
                      - Ref: AWS::Region
                      - ':'
                      - Ref: AWS::AccountId
                      - ':'
                      - Ref: Api
                      - '/*'

  UserPool:
    Type: AWS::Cognito::UserPool
    Properties:
      AliasAttributes:
        - phone_number
        - email
      LambdaConfig:
        PostConfirmation: !GetAtt PostConfirmationFunction.Arn
      UserPoolName: BreakdownUserPoolV1

  UserPoolClient:
    Type: AWS::Cognito::UserPoolClient
    Properties:
      ClientName: BreakdownWebApplication
      RefreshTokenValidity: 90
      UserPoolId: !Ref UserPool

  PostConfirmationFunctionPolicy:
    Type: AWS::IAM::Policy
    Properties:
      PolicyName: !Sub ${AWS::StackName}-post-confirmation-policy
      PolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Resource: "*"
            Effect: Allow
            Action:
              - "logs:*"
              - "events:*"
              - "rds:*"
              - "xray:*"
      Roles:
        - !Ref PostConfirmationFunctionRole

  PostConfirmationFunctionRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: "Allow"
            Principal:
              Service:
                "lambda.amazonaws.com"
            Action:
              - "sts:AssumeRole"

  PostConfirmationFunction:
    Type: AWS::Serverless::Function
    Properties:
      Handler: services/cognito/lib/post-confirmation.default
      Role: !GetAtt PostConfirmationFunctionRole.Arn
      Environment:
        Variables:
          DB_HOST: !GetAtt Database.Endpoint.Address
          DB_NAME: !Ref DatabaseName
          DB_PASSWORD: !Ref DatabasePassword
          DB_SCHEMA: !Ref DatabaseName
          DB_USER: !Ref DatabaseUser
          DEBUG: post-confirmation*

  PreSignUpFunctionPolicy:
    Type: AWS::IAM::Policy
    Properties:
      PolicyName: !Sub ${AWS::StackName}-pre-sign-up-policy
      PolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Resource: "*"
            Effect: Allow
            Action:
              - "logs:*"
              - "events:*"
              - "xray:*"
      Roles:
        - !Ref PreSignUpFunctionRole

  PreSignUpFunctionRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: "Allow"
            Principal:
              Service:
                "lambda.amazonaws.com"
            Action:
              - "sts:AssumeRole"

  PreSignUpFunction:
    Type: AWS::Serverless::Function
    Properties:
      Handler: services/cognito/lib/pre-sign-up.default
      Role: !GetAtt PreSignUpFunctionRole.Arn

  PreTokenGenerationFunctionPolicy:
    Type: AWS::IAM::Policy
    Properties:
      PolicyName: !Sub ${AWS::StackName}-pre-token-generation-policy
      PolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Resource: "*"
            Effect: Allow
            Action:
              - "logs:*"
              - "events:*"
              - "rds:*"
              - "xray:*"
      Roles:
        - !Ref PreTokenGenerationFunctionRole

  PreTokenGenerationFunctionRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: "Allow"
            Principal:
              Service:
                "lambda.amazonaws.com"
            Action:
              - "sts:AssumeRole"

  PreTokenGenerationFunction:
    Type: AWS::Serverless::Function
    Properties:
      Handler: services/cognito/lib/pre-token-generation.default
      Role: !GetAtt PreTokenGenerationFunctionRole.Arn
      Environment:
        Variables:
          DB_HOST: !GetAtt Database.Endpoint.Address
          DB_NAME: !Ref DatabaseName
          DB_PASSWORD: !Ref DatabasePassword
          DB_SCHEMA: !Ref DatabaseName
          DB_USER: !Ref DatabaseUser
          DEBUG: pre-token*

  RdsMonitoringRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: "Allow"
            Principal:
              Service:
                "monitoring.rds.amazonaws.com"
            Action:
              - "sts:AssumeRole"
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/service-role/AmazonRDSEnhancedMonitoringRole

  Database:
    Type: AWS::RDS::DBInstance
    Properties:
      AllocatedStorage: 20
      BackupRetentionPeriod: 7
      DBInstanceClass: db.t2.micro
      DBInstanceIdentifier: breakdown-rds
      DBName: !Ref DatabaseName
      Engine: postgres
      EngineVersion: 10.6
      MasterUsername: !Ref DatabaseUser
      MasterUserPassword: !Ref DatabasePassword
      MonitoringRoleArn: !GetAtt RdsMonitoringRole.Arn
      MonitoringInterval: 60
      StorageType: gp2
      PubliclyAccessible: true
      PreferredMaintenanceWindow: "Sun:08:30-Sun:09:30"

  WebBucket:
    Type: AWS::S3::Bucket
    Properties:
      AccessControl: PublicRead
      BucketName: app.thinstack.io
      WebsiteConfiguration:
        IndexDocument: index.html
        ErrorDocument: index.html
    DeletionPolicy: Retain

  BucketPolicy:
    Type: AWS::S3::BucketPolicy
    Properties:
      PolicyDocument:
        Id: MyPolicy
        Version: "2012-10-17"
        Statement:
          - Sid: PublicReadForGetBucketObjects
            Effect: Allow
            Principal: '*'
            Action: 's3:GetObject'
            Resource: !Join
              - ''
              - - 'arn:aws:s3:::'
                - !Ref WebBucket
                - /*
      Bucket: !Ref WebBucket

  WebDistribution:
    Type: AWS::CloudFront::Distribution
    Properties:
      DistributionConfig:
        Aliases:
          - thinstack.io
          - www.thinstack.io
          - app.thinstack.io
        CustomErrorResponses:
          - ErrorCachingMinTTL: 0
            ErrorCode: 404
            ResponseCode: 200
            ResponsePagePath: /index.html
        DefaultCacheBehavior:
          ForwardedValues:
            QueryString: true
          TargetOriginId: !Sub S3-thinstack.io
          ViewerProtocolPolicy: redirect-to-https
        DefaultRootObject: index.html
        Enabled: true
        Origins:
          - DomainName: !GetAtt WebBucket.DomainName
            Id: !Sub S3-thinstack.io
            S3OriginConfig:
              OriginAccessIdentity: ""
        ViewerCertificate:
          AcmCertificateArn: "arn:aws:acm:us-east-1:181782121001:certificate/25e46328-7571-4adb-841c-254cd60468ff"
          SslSupportMethod: sni-only

  DNS:
    Type: AWS::Route53::HostedZone
    Properties:
      HostedZoneConfig:
        Comment: Thin Stack zone
      Name: thinstack.io

  RootDomain:
    Type: AWS::Route53::RecordSet
    Properties:
      HostedZoneId: !Ref DNS
      Name: thinstack.io.
      Type: A
      AliasTarget:
        DNSName: !GetAtt WebDistribution.DomainName
        HostedZoneId: Z2FDTNDATAQYW2

  WwwDomain:
    Type: AWS::Route53::RecordSet
    Properties:
      HostedZoneId: !Ref DNS
      Name: www.thinstack.io.
      Type: A
      AliasTarget:
        DNSName: !GetAtt WebDistribution.DomainName
        HostedZoneId: Z2FDTNDATAQYW2

  AppDomain:
    Type: AWS::Route53::RecordSet
    Properties:
      HostedZoneId: !Ref DNS
      Name: app.thinstack.io.
      Type: A
      AliasTarget:
        DNSName: !GetAtt WebDistribution.DomainName
        HostedZoneId: Z2FDTNDATAQYW2

  ApiDomain:
    Type: AWS::Route53::RecordSet
    Properties:
      HostedZoneId: !Ref DNS
      Name: api.thinstack.io.
      Type: A
      AliasTarget:
        DNSName: !GetAtt ApiGatewayDomain.DistributionDomainName
        HostedZoneId: Z2FDTNDATAQYW2

  ApiGatewayDomain:
    Type: AWS::ApiGateway::DomainName
    Properties:
      CertificateArn: "arn:aws:acm:us-east-1:181782121001:certificate/25e46328-7571-4adb-841c-254cd60468ff"
      DomainName: api.thinstack.io

  RootCertificate:
    Type: AWS::CertificateManager::Certificate
    Properties:
      DomainName: "*.thinstack.io"
      DomainValidationOptions:
        - DomainName: thinstack.io
          ValidationDomain: thinstack.io
      SubjectAlternativeNames:
        - thinstack.io
        - "*.thinstack.io"
      ValidationMethod: DNS