template.yaml

AWSTemplateFormatVersion: 2010-09-09
Transform: AWS::Serverless-2016-10-31
Resources:
  FrontendContent:
    Type: AWS::S3::Bucket
    Properties:
      WebsiteConfiguration:
        IndexDocument: index.html
  UserPool:
    Type: AWS::Cognito::UserPool
    Properties:
      AdminCreateUserConfig:
        AllowAdminCreateUserOnly: false
      AliasAttributes:
        - email
        - preferred_username
      AutoVerifiedAttributes:
        - email
      UserPoolName: !Sub ${AWS::StackName}-UserPool
  UserPoolClient:
    Type: AWS::Cognito::UserPoolClient
    Properties:
      UserPoolId: !Ref UserPool
  HttpApi:
    Type: AWS::Serverless::HttpApi
    Properties:
      DefinitionBody:
        openapi: '3.0'
        info:
          title: !Sub ${AWS::StackName}-HttpApi
          version: '1.0'
        paths:
          /ride:
            post:
              responses: {}
      FailOnWarnings: true
      Auth:
        Authorizers:
          Authorizer:
            IdentitySource: $request.header.Authorization
            JwtConfiguration:
              issuer: !Sub https://cognito-idp.${AWS::Region}.amazonaws.com/${UserPool}
              audience:
                - !Ref UserPoolClient
        DefaultAuthorizer: Authorizer
      CorsConfiguration:
        AllowOrigins:
          - '*'
        AllowHeaders:
          - Authorization
          - Content-Type
        AllowMethods:
          - '*'
  Rides:
    Type: AWS::DynamoDB::Table
    Properties:
      AttributeDefinitions:
        - AttributeName: RideId
          AttributeType: S
      BillingMode: PAY_PER_REQUEST
      KeySchema:
        - AttributeName: RideId
          KeyType: HASH
      StreamSpecification:
        StreamViewType: NEW_AND_OLD_IMAGES
      TableName: !Sub ${AWS::StackName}-Rides
  RequestUnicorn:
    Type: AWS::Serverless::Function
    Properties:
      FunctionName: !Sub ${AWS::StackName}-RequestUnicorn
      Description: !Sub
        - Stack ${StackTagName} Environment ${EnvironmentTagName} Function ${ResourceName}
        - ResourceName: RequestUnicorn
      CodeUri: src/RequestUnicorn
      Handler: index.handler
      Runtime: nodejs12.x
      MemorySize: 3008
      Timeout: 30
      Tracing: Active
      Policies:
        - AWSXrayWriteOnlyAccess
        - DynamoDBCrudPolicy:
            TableName: !Ref Rides
        - AWSSecretsManagerGetSecretValuePolicy:
            SecretArn: !Sub arn:${AWS::Partition}:secretsmanager:${AWS::Region}:${AWS::AccountId}:secret:/${EnvironmentTagName}/*
      Environment:
        Variables:
          TABLE_NAME: !Ref Rides
          TABLE_ARN: !GetAtt Rides.Arn
          SECRETS_NAMESPACE: !Sub /${EnvironmentTagName}/
          UNICORN_STABLE_API: !Ref EnvConfigunicornStableApiAsString
      Events:
        HttpApiPOSTride:
          Type: HttpApi
          Properties:
            Path: /ride
            Method: POST
            ApiId: !Ref HttpApi
            PayloadFormatVersion: '2.0'
            TimeoutInMillis: 29000
  Website:
    Type: AWS::CodeBuild::Project
    Metadata:
      StackeryType: website
    DependsOn: WebsiteRole
    Properties:
      Name: !Sub ${AWS::StackName}-Website
      Artifacts:
        Type: NO_ARTIFACTS
      Environment:
        ComputeType: BUILD_GENERAL1_SMALL
        Image: aws/codebuild/amazonlinux2-x86_64-standard:3.0
        Type: LINUX_CONTAINER
        EnvironmentVariables:
          - Name: USER_POOL_CLIENT_ID
            Value: !Ref UserPoolClient
          - Name: USER_POOL_ID
            Value: !Ref UserPool
          - Name: USER_POOL_ARN
            Value: !GetAtt UserPool.Arn
          - Name: API_URL
            Value: !Sub https://${HttpApi}.execute-api.${AWS::Region}.amazonaws.com
      ServiceRole: !GetAtt WebsiteRole.Arn
      Source:
        Type: NO_SOURCE
        BuildSpec: !Sub
          - |-
            version: 0.2
            phases:
              install:
                runtime-versions:
                  nodejs: latest
                  python: latest
                  ruby: latest
                commands:
                  - |
                    _SOURCE_LOCATION=${SourceLocation}
                    if [ s3 != "${!_SOURCE_LOCATION%%:*}" ]; then
                      git clone ${SourceLocation} repo
                      cd repo
                      git checkout ${SourceVersion}
                    else
                      aws s3 cp ${SourceLocation} repo.tgz
                      tar --strip-components 1 -xvvzf repo.tgz
                    fi
                  - cd ${SourceDirectory}
              pre_build:
                commands:
                  - |
                    if [ ! -f yarn.lock -a -f package.json ]; then
                      npm install --production
                    elif [ -f yarn.lock -a -f package.json ]; then
                      yarn install --production
                    elif [ -f requirements.txt ]; then
                      pip install -r requirements.txt
                    elif [ -f Gemfile ]; then
                      bundle install
                    fi
              build:
                commands:
                  - ${BuildCommand}
              post_build:
                commands:
                  - if [ $CODEBUILD_BUILD_SUCCEEDING == 0 ]; then exit 1; fi
                  - |
                    _SOURCE_LOCATION=${SourceLocation}
                    if [ s3 != "${!_SOURCE_LOCATION%%:*}" ]; then
                      cd "${!CODEBUILD_SRC_DIR}/repo"
                    else
                      cd ${!CODEBUILD_SRC_DIR}
                    fi
                  - aws s3 sync '${PublishDirectory}' 's3://${DestinationBucketName}' --acl public-read --cache-control 'max-age=0, must-revalidate, public' --no-progress --delete
          - PublishDirectory: src/site/public
            BuildCommand: npm run build
            SourceDirectory: src/site
            DestinationBucketName: !Ref FrontendContent
      Tags:
        - Key: Stackery Project Type
          Value: Website Builder
  WebsiteEvents:
    Type: AWS::Events::Rule
    DependsOn: Website
    Properties:
      EventPattern:
        source:
          - aws.codebuild
        detail-type:
          - CodeBuild Build State Change
        detail:
          build-status:
            - SUCCEEDED
            - FAILED
            - FAULT
            - STOPPPED
            - TIMED_OUT
          project-name:
            - !Ref Website
      Targets:
        - Arn: !Sub arn:aws:lambda:${AWS::Region}:${AWS::AccountId}:function:stackery-agent-commander
          Id: StackeryAgentCommander
  WebsiteEventsPermission:
    Type: AWS::Lambda::Permission
    DependsOn: WebsiteEvents
    Properties:
      Action: lambda:InvokeFunction
      FunctionName: !Sub arn:aws:lambda:${AWS::Region}:${AWS::AccountId}:function:stackery-agent-commander
      Principal: events.amazonaws.com
      SourceArn: !GetAtt WebsiteEvents.Arn
  WebsiteRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: !Sub ${AWS::StackName}-Website
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          Effect: Allow
          Principal:
            Service: codebuild.amazonaws.com
          Action: sts:AssumeRole
      Policies:
        - PolicyName: Logs
          PolicyDocument:
            Version: 2012-10-17
            Statement:
              - Effect: Allow
                Action:
                  - logs:CreateLogGroup
                  - logs:CreateLogStream
                  - logs:PutLogEvents
                Resource:
                  - !Sub arn:aws:logs:${AWS::Region}:${AWS::AccountId}:log-group:/aws/codebuild/${AWS::StackName}-Website:log-stream:*
        - PolicyName: DownloadSourceFromStackeryAssetsBucket
          PolicyDocument:
            Version: 2012-10-17
            Statement:
              - Effect: Allow
                Action: s3:GetObject
                Resource: arn:aws:s3:::stackery-assetsbucket-*/*
        - PolicyName: UploadToDestinationObjectStore
          PolicyDocument:
            Version: 2012-10-17
            Statement:
              - Effect: Allow
                Action:
                  - s3:DeleteObject
                  - s3:GetBucketLocation
                  - s3:GetObject
                  - s3:ListBucket
                  - s3:PutObject
                  - s3:PutObjectAcl
                Resource:
                  - !Sub ${FrontendContent.Arn}/*
                  - !Sub ${FrontendContent.Arn}
  WebsiteBuildTrigger:
    Type: Custom::StackeryWebsiteBuildTrigger
    DependsOn: WebsiteEvents
    Properties:
      ServiceToken: !Sub arn:aws:lambda:${AWS::Region}:${AWS::AccountId}:function:stackery-agent-commander
      Type: website
      ProjectName: !Ref Website
      SourceVersion: !Ref SourceVersion
Parameters:
  StackTagName:
    Type: String
    Description: Stack Name (injected by Stackery at deployment time)
  EnvironmentTagName:
    Type: String
    Description: Environment Name (injected by Stackery at deployment time)
  EnvConfigunicornStableApiAsString:
    Type: AWS::SSM::Parameter::Value<String>
    Default: /<EnvironmentName>/unicornStableApi
  SourceLocation:
    Type: String
    Description: Location of source code for deployment (injected by Stackery at deployment time)
  SourceVersion:
    Type: String
    Description: Source version for deployment (injected by Stackery at deployment time)
Metadata:
  EnvConfigParameters:
    EnvConfigunicornStableApiAsString: unicornStableApi