template.yaml

AWSTemplateFormatVersion: "2010-09-09"
Transform: AWS::Serverless-2016-10-31
Description: "ACD Leave Approval Application"

# Parameters Section
Parameters:
  CognitoUserPoolDomain:
    Type: String
    Description: Auth domain used in cognito to create the sign in / sign up links
  S3BucketName:
    Type: String
    Description: Auth domain used in cognito to create the sign in / sign up links

# Resources Section
Resources:
  # cognito trigger
  CognitoTriggerPostSignup:
    Type: AWS::Serverless::Function
    Properties:
      FunctionName: create-user-trigger
      CodeUri: lambdas/create-user-trigger/
      Handler: app.lambdaHandler
      Runtime: nodejs14.x
      Environment:
        Variables:
          leavesTable: !Ref LeaveTable
          userinfoTable: !Ref UserInfoTable
      Policies:
        - AWSLambdaDynamoDBExecutionRole
        - DynamoDBCrudPolicy:
            TableName: !Ref LeaveTable
        - DynamoDBCrudPolicy:
            TableName: !Ref UserInfoTable

  # get user infor after login
  GetUserInfo:
    Type: AWS::Serverless::Function
    Properties:
      FunctionName: get-user-info
      CodeUri: lambdas/get-user-info/
      Handler: app.lambdaHandler
      Runtime: nodejs14.x
      Environment:
        Variables:
          leavesTable: !Ref LeaveTable
          userinfoTable: !Ref UserInfoTable
      Policies:
        - AWSLambdaDynamoDBExecutionRole
        - DynamoDBCrudPolicy:
            TableName: !Ref LeaveTable
        - DynamoDBCrudPolicy:
            TableName: !Ref UserInfoTable
      Events:
        Root:
          Type: Api
          Properties:
            RestApiId: !Ref LeaveApprovalApi2
            Path: /getUserInfo
            Method: POST

  # async trigger for leave approval
  ManualApproval:
    Type: AWS::Serverless::Function
    Properties:
      FunctionName: manual-approval
      CodeUri: lambdas/manual-approval
      Handler: app.lambdaHandler
      Runtime: nodejs14.x
      Environment:
        Variables:
          leavesTable: !Ref LeaveTable
          userinfoTable: !Ref UserInfoTable
      Policies:
        - AWSLambdaDynamoDBExecutionRole
        - DynamoDBCrudPolicy:
            TableName: !Ref LeaveTable
        - DynamoDBCrudPolicy:
            TableName: !Ref UserInfoTable
        - Statement:
            - Sid: StepFunctionTaskToken
              Effect: Allow
              Action:
                - states:SendTaskSuccess
              Resource: "*"
      Events:
        Root:
          Type: Api
          Properties:
            RestApiId: !Ref LeaveApprovalApi2
            Path: /manualApproval
            Method: POST

  # step function lambda - approve leave
  ApproveLeave:
    Type: AWS::Serverless::Function
    Properties:
      FunctionName: approve-leave
      CodeUri: lambdas/approve-leave
      Handler: app.lambdaHandler
      Runtime: nodejs14.x
      Environment:
        Variables:
          leavesTable: !Ref LeaveTable
          userinfoTable: !Ref UserInfoTable
      Policies:
        - AWSLambdaDynamoDBExecutionRole
        - DynamoDBCrudPolicy:
            TableName: !Ref LeaveTable
        - DynamoDBCrudPolicy:
            TableName: !Ref UserInfoTable

  # step function lambda - wait for task token
  WaitForTaskToken:
    Type: AWS::Serverless::Function
    Properties:
      FunctionName: wait-for-task-token
      CodeUri: lambdas/wait-for-tasktoken
      Handler: app.lambdaHandler
      Runtime: nodejs14.x
      Environment:
        Variables:
          leavesTable: !Ref LeaveTable
          userinfoTable: !Ref UserInfoTable
      Policies:
        - AWSLambdaDynamoDBExecutionRole
        - DynamoDBCrudPolicy:
            TableName: !Ref LeaveTable
        - DynamoDBCrudPolicy:
            TableName: !Ref UserInfoTable

  # step function
  LeaveApplicationStepFunction:
    Type: AWS::Serverless::StateMachine
    Properties:
      Name: approve-leave
      DefinitionUri: stepfunction/approve-leave.asl.json
      DefinitionSubstitutions:
        ApproveLeaveArn: !GetAtt ApproveLeave.Arn
        WaitForTaskTokenArn: !GetAtt WaitForTaskToken.Arn
      Policies:
        - CloudWatchLogsFullAccess
        - LambdaInvokePolicy:
            Effect: Allow
            Action: lambda:InvokeFunction
            FunctionName: "*"
            Resource:
              - !GetAtt WaitForTaskToken.Arn
              - !GetAtt ApproveLeave.Arn
      Logging:
        IncludeExecutionData: true
        Level: ALL
        Destinations:
          - CloudWatchLogsLogGroup:
              LogGroupArn: !GetAtt LeaveApplicationLogGroup.Arn
      Events:
        Root:
          Type: Api
          Properties:
            RestApiId: !Ref LeaveApprovalApi2
            Path: /requestLeave
            Method: POST

  LeaveApplicationLogGroup:
    Type: AWS::Logs::LogGroup
    Properties:
      RetentionInDays: 7
      LogGroupName: !Sub "LeaveApplicationLogGroup"

  #dynamodb - userInfo
  UserInfoTable:
    Type: AWS::DynamoDB::Table
    Properties:
      TableName: UserInfoTable
      BillingMode: PAY_PER_REQUEST
      AttributeDefinitions:
        - AttributeName: "email"
          AttributeType: "S"
      KeySchema:
        - AttributeName: "email"
          KeyType: "HASH"

  #dynamodb
  LeaveTable:
    Type: AWS::DynamoDB::Table
    Properties:
      TableName: LeaveTable
      BillingMode: PAY_PER_REQUEST
      AttributeDefinitions:
        - AttributeName: "id"
          AttributeType: "S"
      KeySchema:
        - AttributeName: "id"
          KeyType: "HASH"

  #api
  LeaveApprovalApi2:
    Type: AWS::Serverless::Api
    Properties:
      Name: !Sub "LeaveApprovalApi2"
      StageName: prod
      DefinitionBody:
        openapi: "3.0.1"
        info:
          title: "acd-api"
          version: "1.0"

        paths:
          /getUserInfo:
            post:
              security:
                - CognitoAuthorizer: []
              x-amazon-apigateway-integration:
                httpMethod: "POST"
                uri: !Sub "arn:aws:apigateway:${AWS::Region}:lambda:path/2015-03-31/functions/${GetUserInfo.Arn}/invocations"
                passthroughBehavior: "when_no_match"
                type: "aws_proxy"
            options:
              responses:
                "200":
                  description: "200 response"
                  headers:
                    Access-Control-Allow-Origin:
                      schema:
                        type: "string"
                    Access-Control-Allow-Methods:
                      schema:
                        type: "string"
                    Access-Control-Allow-Headers:
                      schema:
                        type: "string"
                  content: {}
              x-amazon-apigateway-integration:
                responses:
                  default:
                    statusCode: "200"
                    responseParameters:
                      method.response.header.Access-Control-Allow-Methods: "'OPTIONS,POST'"
                      method.response.header.Access-Control-Allow-Headers: "'Content-Type,X-Amz-Date,Authorization,X-Api-Key,X-Amz-Security-Token'"
                      method.response.header.Access-Control-Allow-Origin: !Sub "'https://${CloudFrontDistribution.DomainName}'"
                    responseTemplates:
                      application/json: "{}\n"
                requestTemplates:
                  application/json: "{\n  \"statusCode\" : 200\n}\n"
                passthroughBehavior: "when_no_match"
                type: "mock"
          /manualApproval:
            post:
              security:
                - CognitoAuthorizer: []
              x-amazon-apigateway-integration:
                httpMethod: "POST"
                uri: !Sub "arn:aws:apigateway:${AWS::Region}:lambda:path/2015-03-31/functions/${ManualApproval.Arn}/invocations"
                passthroughBehavior: "when_no_match"
                type: "aws_proxy"
            options:
              responses:
                "200":
                  description: "200 response"
                  headers:
                    Access-Control-Allow-Origin:
                      schema:
                        type: "string"
                    Access-Control-Allow-Methods:
                      schema:
                        type: "string"
                    Access-Control-Allow-Headers:
                      schema:
                        type: "string"
                  content: {}
              x-amazon-apigateway-integration:
                responses:
                  default:
                    statusCode: "200"
                    responseParameters:
                      method.response.header.Access-Control-Allow-Methods: "'OPTIONS,POST'"
                      method.response.header.Access-Control-Allow-Headers: "'Content-Type,X-Amz-Date,Authorization,X-Api-Key,X-Amz-Security-Token'"
                      method.response.header.Access-Control-Allow-Origin: !Sub "'https://${CloudFrontDistribution.DomainName}'"
                    responseTemplates:
                      application/json: "{}\n"
                requestTemplates:
                  application/json: "{\n  \"statusCode\" : 200\n}\n"
                passthroughBehavior: "when_no_match"
                type: "mock"
          /requestLeave:
            post:
              responses:
                "400":
                  description: "400 response"
                  content: {}
                "200":
                  description: "200 response"
                  headers:
                    Access-Control-Allow-Origin:
                      schema:
                        type: "string"
                  content: {}
              security:
                - CognitoAuthorizer: []
              x-amazon-apigateway-integration:
                credentials: !GetAtt LeaveApprovalApi2Role.Arn
                httpMethod: "POST"
                uri: !Sub "arn:aws:apigateway:${AWS::Region}:states:action/StartExecution"
                responses:
                  "200":
                    statusCode: "200"
                    responseParameters:
                      method.response.header.Access-Control-Allow-Origin: "'*'"
                  "400":
                    statusCode: "400"
                requestTemplates:
                  application/json:
                    !Sub "{\"input\": \"$util.escapeJavaScript($input.json('$'))\"\
                    , \"stateMachineArn\": \"${LeaveApplicationStepFunction}\"\
                    }"
                passthroughBehavior: "when_no_match"
                type: "aws"
            options:
              responses:
                "200":
                  description: "200 response"
                  headers:
                    Access-Control-Allow-Origin:
                      schema:
                        type: "string"
                    Access-Control-Allow-Methods:
                      schema:
                        type: "string"
                    Access-Control-Allow-Headers:
                      schema:
                        type: "string"
                  content: {}
              x-amazon-apigateway-integration:
                responses:
                  default:
                    statusCode: "200"
                    responseParameters:
                      method.response.header.Access-Control-Allow-Methods: "'OPTIONS,POST'"
                      method.response.header.Access-Control-Allow-Headers: "'Content-Type,X-Amz-Date,Authorization,X-Api-Key,X-Amz-Security-Token'"
                      method.response.header.Access-Control-Allow-Origin: !Sub "'https://${CloudFrontDistribution.DomainName}'"
                    responseTemplates:
                      application/json: "{}\n"
                requestTemplates:
                  application/json: "{\n  \"statusCode\" : 200\n}\n"
                passthroughBehavior: "when_no_match"
                type: "mock"
        components:
          securitySchemes:
            CognitoAuthorizer:
              type: "apiKey"
              name: "Authorization"
              in: "header"
              x-amazon-apigateway-authtype: "cognito_user_pools"
              x-amazon-apigateway-authorizer:
                providerARNs:
                  - !Sub "arn:aws:cognito-idp:${AWS::Region}:${AWS::AccountId}:userpool/${CognitoUserPool}"
                type: "cognito_user_pools"

  #api role
  LeaveApprovalApi2Role:
    Type: AWS::IAM::Role
    Properties:
      ManagedPolicyArns:
        - >-
          arn:aws:iam::aws:policy/service-role/AmazonAPIGatewayPushToCloudWatchLogs
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - apigateway.amazonaws.com
            Action:
              - sts:AssumeRole
      Path: /
      Policies:
        - PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Effect: Allow
                Action: states:StartExecution
                Resource:
                  - Ref: LeaveApplicationStepFunction
          PolicyName: StepFunctionSyncExecution
        - PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Effect: Allow
                Action: lambda:InvokeFunction
                Resource: !Sub "arn:aws:lambda:*:${AWS::AccountId}:function:*"
          PolicyName: LambdaFunctionInvocation
  #cognito pool
  CognitoUserPool:
    Type: AWS::Cognito::UserPool
    Properties:
      UserPoolName: ACD-User-Pool
      AutoVerifiedAttributes:
        - email
      AliasAttributes:
        - email
      Policies:
        PasswordPolicy:
          MinimumLength: 8
          RequireUppercase: true
          RequireLowercase: true
          RequireNumbers: true
          RequireSymbols: true
      Schema:
        - AttributeDataType: String
          Name: email
          Required: true
      LambdaConfig:
        PostConfirmation: !GetAtt CognitoTriggerPostSignup.Arn

  # Permission for Cognito User Pool to trigger Lambda
  CognitoTriggerPostSignupPermission:
    Type: AWS::Lambda::Permission
    Properties:
      Action: lambda:InvokeFunction
      FunctionName: !GetAtt CognitoTriggerPostSignup.Arn
      Principal: cognito-idp.amazonaws.com
      SourceArn: !GetAtt CognitoUserPool.Arn

  #cognito pool client
  CognitoUserPoolClient:
    Type: AWS::Cognito::UserPoolClient
    Properties:
      UserPoolId: !Ref CognitoUserPool
      ClientName: ACD-User-Pool-Client
      GenerateSecret: false
      SupportedIdentityProviders:
        - COGNITO
      AllowedOAuthFlows:
        - implicit
      AllowedOAuthScopes:
        - phone
        - email
        - openid
        - profile
        - aws.cognito.signin.user.admin
      CallbackURLs:
        - !Sub
          - https://${CloudfrontDomain}
          - { CloudfrontDomain: !GetAtt CloudFrontDistribution.DomainName }
      LogoutURLs:
        - !Sub
          - https://${CloudfrontDomain}
          - { CloudfrontDomain: !GetAtt CloudFrontDistribution.DomainName }
      ExplicitAuthFlows:
        - ALLOW_USER_PASSWORD_AUTH
        - ALLOW_REFRESH_TOKEN_AUTH
      AllowedOAuthFlowsUserPoolClient: true

  #cognito domain
  CognitoDomain:
    Type: AWS::Cognito::UserPoolDomain
    Properties:
      Domain: !Ref CognitoUserPoolDomain
      UserPoolId: !Ref CognitoUserPool

  #s3 bucket and hosting

  # Create the bucket to contain the website HTML
  S3Bucket:
    Type: "AWS::S3::Bucket"
    Properties:
      BucketName: !Ref S3BucketName
      WebsiteConfiguration:
        ErrorDocument: "error.html"
        IndexDocument: "index.html"

  # Configure the bucket as a CloudFront Origin
  ReadPolicy:
    Type: "AWS::S3::BucketPolicy"
    Properties:
      Bucket: !Ref S3Bucket
      PolicyDocument:
        Statement:
          - Action: "s3:GetObject"
            Effect: Allow
            Resource: !Sub "arn:aws:s3:::${S3Bucket}/*"
            Principal:
              CanonicalUser: !GetAtt CloudFrontOriginAccessIdentity.S3CanonicalUserId

  # Configure Access to CloudFroun
  CloudFrontOriginAccessIdentity:
    Type: "AWS::CloudFront::CloudFrontOriginAccessIdentity"
    Properties:
      CloudFrontOriginAccessIdentityConfig:
        Comment: !Ref S3Bucket

  # Configure CloudFront
  CloudFrontDistribution:
    Type: "AWS::CloudFront::Distribution"
    Properties:
      DistributionConfig:
        CustomErrorResponses:
          - ErrorCode: 403 # not found
            ResponseCode: 404
            ResponsePagePath: "/index.html"
        DefaultCacheBehavior:
          AllowedMethods:
            - GET
            - HEAD
            - OPTIONS
          CachedMethods:
            - GET
            - HEAD
            - OPTIONS
          Compress: true
          DefaultTTL: 3600 # in seconds
          ForwardedValues:
            Cookies:
              Forward: none
            QueryString: false
          MaxTTL: 86400 # in seconds
          MinTTL: 60 # in seconds
          TargetOriginId: s3origin
          ViewerProtocolPolicy: "allow-all"
        # This DefaultRootObject configuration is not enough.
        DefaultRootObject: "/index.html"
        Enabled: true
        HttpVersion: http2
        Origins:
          - DomainName: !GetAtt "S3Bucket.DomainName"
            Id: s3origin
            S3OriginConfig:
              OriginAccessIdentity: !Sub "origin-access-identity/cloudfront/${CloudFrontOriginAccessIdentity}"
        PriceClass: "PriceClass_All"

# Outputs Section
Outputs:
  CloudfrontUrl:
    Value: !GetAtt CloudFrontDistribution.DomainName
  APIDomain:
    Value: !Ref LeaveApprovalApi2
  CognitoClientId:
    Value: !Ref CognitoUserPoolClient