document-management-stack.yml

AWSTemplateFormatVersion: 2010-09-09

Parameters:
  pNamePrefix:
    Type: String
    Default: apr21
  pPrefix:
    Type: String
    Default: DocumentManagment
  pUserPoolName:
    Type: String
    Default: DocumentManagementUserPool
  pBucketParamName:
    Type: String
    Default: BucketParam
  pKeyAlias:
    Type: String
    Default: alias/document-management-app/keys/document-management
  pCognitoAuthRoleName:
    Type: String
    Default: CognitoAuthRole
  pCognitoUserPoolDomainPrefix:
    Type: String
    Default: document-management

Resources:
  rCognitoUserPool:
    Type: 'AWS::Cognito::UserPool'
    Properties:
      AccountRecoverySetting:
        RecoveryMechanisms:
          - Name: verified_phone_number
            Priority: 1
          - Name: verified_email
            Priority: 2
      AdminCreateUserConfig:
        AllowAdminCreateUserOnly: true
        InviteMessageTemplate:
          EmailMessage: >-
            Hello {username}, you have been invited to join the Document
            Management App! Your temporary password is {####}
          EmailSubject: Invitation to join the Document Management App
      AutoVerifiedAttributes:
        - email
      EmailVerificationMessage: 'The verification code to your new account is {####}'
      EmailVerificationSubject: Verify your new account
      Schema:
        - Mutable: true
          Name: name
          Required: true
        - Mutable: true
          Name: phone_number
          Required: false
        - AttributeDataType: DateTime
          Name: joinedOn
      SmsVerificationMessage: 'The verification code to your new account is {####}'
      UsernameAttributes:
        - email
      UserPoolName: !Ref pUserPoolName
      VerificationMessageTemplate:
        DefaultEmailOption: CONFIRM_WITH_CODE
        EmailMessage: 'The verification code to your new account is {####}'
        EmailSubject: Verify your new account
        SmsMessage: 'The verification code to your new account is {####}'

  rUserPoolCognitoDomain:
    Type: 'AWS::Cognito::UserPoolDomain'
    Properties:
      Domain: !Sub "${pNamePrefix}${pCognitoUserPoolDomainPrefix}"
      UserPoolId: !Ref rCognitoUserPool

  rUserPoolIdParam:
    Type: 'AWS::SSM::Parameter'
    Properties:
      Type: String
      Value: !Ref rCognitoUserPool
      Name: /document-management-app/cognito/user-pool-id
      Tags:
        Project: !Ref pPrefix
    
  rUserPoolClient:
    Type: 'AWS::Cognito::UserPoolClient'
    Properties:
      UserPoolId: !Ref rCognitoUserPool
      AllowedOAuthFlows:
        - implicit
        - code
      AllowedOAuthFlowsUserPoolClient: true
      AllowedOAuthScopes:
        - profile
        - phone
        - email
        - openid
        - aws.cognito.signin.user.admin
      CallbackURLs:
        - 'http://localhost:1234'
        - 'http://localhost:3000'
      PreventUserExistenceErrors: ENABLED
      SupportedIdentityProviders:
        - COGNITO

  rUserPoolClientIdParam:
    Type: 'AWS::SSM::Parameter'
    Properties:
      Type: String
      Value: !Ref rCognitoUserPool
      Name: /document-management-app/cognito/user-pool-client-id
      Tags:
        Project: !Ref pPrefix

  rUserPoolDomainParam:
    Type: 'AWS::SSM::Parameter'
    Properties:
      Type: String
      Value: !Ref rUserPoolCognitoDomain
      Name: /document-management-app/cognito/user-pool-domain
      Tags:
        Project: !Ref pPrefix
    
  rIdentityPool:
    Type: 'AWS::Cognito::IdentityPool'
    Properties:
      AllowUnauthenticatedIdentities: false
      CognitoIdentityProviders:
        - ClientId: !Ref rUserPoolClient
          ProviderName: !GetAtt 
            - rCognitoUserPool
            - ProviderName
      IdentityPoolName: document-management-app-idp

  rIdentityPoolIdParam:
    Type: 'AWS::SSM::Parameter'
    Properties:
      Type: String
      Value: !Ref rIdentityPool
      Name: /document-management-app/cognito/identity-pool-id
      Tags:
        Project: !Ref pPrefix

  rAuthenticatedRole:
    Type: 'AWS::IAM::Role'
    Properties:
      RoleName: !Sub "${pNamePrefix}${pCognitoAuthRoleName}"
      AssumeRolePolicyDocument:
        Statement:
          - Action: 'sts:AssumeRoleWithWebIdentity'
            Condition:
              StringEquals:
                'cognito-identity.amazonaws.com:aud': !Ref rIdentityPool
            Effect: Allow
            Principal:
              Federated: cognito-identity.amazonaws.com
        Version: 2012-10-17
      Tags:
        - Key: Project
          Value: !Ref pPrefix

  rAuthenticatedRoleArn:
    Type: 'AWS::SSM::Parameter'
    Properties:
      Type: String
      Value: !GetAtt 
        - rAuthenticatedRole
        - Arn
      Name: /document-management-app/cognito/authenticated-role-arn
      Tags:
        Project: !Ref pPrefix

  rAuthenticatedRoleAttachement:
    Type: 'AWS::Cognito::IdentityPoolRoleAttachment'
    Properties:
      IdentityPoolId: !Ref rIdentityPool
      Roles:
        authenticated: !GetAtt 
          - rAuthenticatedRole
          - Arn        

  rDocumentManagementKmsKey:
    Type: 'AWS::KMS::Key'
    Properties: 
      KeyPolicy:
        Statement:
          - Action:
              - 'kms:Create*'
              - 'kms:Describe*'
              - 'kms:Enable*'
              - 'kms:List*'
              - 'kms:Put*'
              - 'kms:Update*'
              - 'kms:Revoke*'
              - 'kms:Disable*'
              - 'kms:Get*'
              - 'kms:Delete*'
              - 'kms:ScheduleKeyDeletion'
              - 'kms:CancelKeyDeletion'
              - 'kms:GenerateDataKey'
              - 'kms:TagResource'
              - 'kms:UntagResource'
            Effect: Allow
            Principal:
              AWS: !Join 
                - ''
                - - 'arn:'
                  - !Ref 'AWS::Partition'
                  - ':iam::'
                  - !Ref 'AWS::AccountId'
                  - ':root'
            Resource: '*'
          - Action: 'kms:*'
            Effect: Allow
            Principal:
              AWS: !GetAtt
                - rAuthenticatedRole
                - Arn
            Resource:
              - !Join 
                - ''
                - - 'arn:aws:kms:*:'
                  - !Ref 'AWS::AccountId'
                  - ':'
                  - !Ref pKeyAlias
              - !Join 
                - ''
                - - 'arn:aws:kms:*:'
                  - !Ref 'AWS::AccountId'
                  - ':key/*'
        Version: 2012-10-17
      EnableKeyRotation: true
      Tags:
        - Key: Project
          Value: !Ref pPrefix
    UpdateReplacePolicy: Retain
    DeletionPolicy: Retain

  rDocumentManagementKeyAlias:
    Type: 'AWS::KMS::Alias'
    Properties:
      AliasName: !Ref pKeyAlias
      TargetKeyId: !GetAtt 
        - rDocumentManagementKmsKey
        - Arn

  rDocumentManagementBucket: 
    Type: 'AWS::S3::Bucket'
    Properties:
      AccessControl: Private
      BucketEncryption:
        ServerSideEncryptionConfiguration:
          - ServerSideEncryptionByDefault:
              SSEAlgorithm: 'aws:kms'
              KMSMasterKeyID: !GetAtt
                - rDocumentManagementKmsKey
                - Arn
      CorsConfiguration:
        CorsRules:
          - AllowedMethods:
              - POST
              - GET
              - PUT
              - DELETE
            AllowedOrigins:
              - '*'
            ExposedHeaders:
              - ETag
              - x-amz-version-id
              - VersionId
            AllowedHeaders:
              - '*'
      LifecycleConfiguration:
        Rules:
          - Status: Enabled
            Transitions:
              - StorageClass: STANDARD_IA
                TransitionInDays: 60
      VersioningConfiguration:
        Status: Enabled
      Tags:
        - Key: Project
          Value: !Ref pPrefix
    DeletionPolicy: Delete
    UpdateReplacePolicy: Retain

  rDocumentManagementBucketPolicy:
    Type: 'AWS::S3::BucketPolicy'
    Properties:
      Bucket: !Ref rDocumentManagementBucket
      PolicyDocument:
        Statement:
          - Action: 's3:*'
            Condition:
              StringNotEquals:
                'aws:PrincipalAccount': !Ref 'AWS::AccountId'
                'aws:RequestedRegion': !Ref 'AWS::Region'
            Effect: Deny
            Principal: '*'
            Resource:
              - !Join 
                - ''
                - - 'arn:aws:s3:::'
                  - !Ref rDocumentManagementBucket
              - !Join 
                - ''
                - - 'arn:aws:s3:::'
                  - !Ref rDocumentManagementBucket
                  - /*
          - Action:
              - 's3:Put*'
              - 's3:Get*'
              - 's3:List*'
            Effect: Allow
            Principal:
              AWS: !GetAtt
                - rAuthenticatedRole
                - Arn
            Resource:
              - !GetAtt 
                - rDocumentManagementBucket
                - Arn
              - !Join 
                - ''
                - - !GetAtt 
                    - rDocumentManagementBucket
                    - Arn
                  - /*
        Version: 2012-10-17

  rDocumentManagementBucketParam:
    Type: 'AWS::SSM::Parameter'
    Properties:
      Type: String
      Value: !Ref rDocumentManagementBucket
      Name: /document-management-app/s3-bucket
      Tags:
        Project: !Ref pPrefix

  rCognitoAuthRoleImportedPolicy:
    Type: 'AWS::IAM::Policy'
    Properties:
      PolicyDocument:
        Statement:
          - Action:
              - 'kms:List*'
              - 'kms:Create*'
              - 'kms:Encrypt*'
              - 'kms:Decrypt*'
              - 'kms:Generate*'
            Effect: Allow
            Resource:
              - !GetAtt 
                - rDocumentManagementKmsKey
                - Arn
              - !Join 
                - ''
                - - 'arn:aws:kms:*:'
                  - !Ref 'AWS::AccountId'
                  - ':'
                  - !Ref pKeyAlias
          - Action:
              - 's3:Put*'
              - 's3:Delete*'
              - 's3:Get*'
              - 's3:List*'
            Effect: Allow
            Resource:
              - !GetAtt 
                - rDocumentManagementBucket
                - Arn
              - !Join 
                - ''
                - - !GetAtt 
                    - rDocumentManagementBucket
                    - Arn
                  - /*
        Version: 2012-10-17
      PolicyName: DocumentManagmentCognitoAuthRolePolicy
      Roles:
        - !Select 
          - 1
          - !Split 
            - /
            - !Select 
              - 5
              - !Split 
                - ':'
                - !GetAtt
                  - rAuthenticatedRole
                  - Arn

  rDynamoDBAttachmentsTable:
    Type: AWS::DynamoDB::Table
    Properties:
      AttributeDefinitions:
        - AttributeName: id
          AttributeType: S
      KeySchema:
        - AttributeName: id
          KeyType: HASH
      ProvisionedThroughput:
        ReadCapacityUnits: 1
        WriteCapacityUnits: 1

  rDynamoDBVersionsTable:
    Type: AWS::DynamoDB::Table
    Properties:
      AttributeDefinitions:
        - AttributeName: versionId
          AttributeType: S
      KeySchema:
        - AttributeName: versionId
          KeyType: HASH
      ProvisionedThroughput:
        ReadCapacityUnits: 1
        WriteCapacityUnits: 1

  rDynamoDBRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Action:
              - sts:AssumeRole
            Principal:
              Service:
                - appsync.amazonaws.com
      Policies:
        - PolicyName: DDBAccess
          PolicyDocument:
            Version: 2012-10-17
            Statement:
              - Effect: Allow
                Action:
                  - dynamodb:GetItem
                  - dynamodb:PutItem
                  - dynamodb:DeleteItem
                  - dynamodb:UpdateItem
                  - dynamodb:Query
                  - dynamodb:Scan
                Resource: !GetAtt rDynamoDBAttachmentsTable.Arn
        - PolicyName: DDBAccessB
          PolicyDocument:
            Version: 2012-10-17
            Statement:
              - Effect: Allow
                Action:
                  - dynamodb:GetItem
                  - dynamodb:PutItem
                  - dynamodb:DeleteItem
                  - dynamodb:UpdateItem
                  - dynamodb:Query
                  - dynamodb:Scan
                Resource: !GetAtt rDynamoDBVersionsTable.Arn

  rAppSyncApi:
    Type: AWS::AppSync::GraphQLApi
    Properties:
      Name: AttachmentsApi
      AuthenticationType: AMAZON_COGNITO_USER_POOLS
      UserPoolConfig:
        UserPoolId: !Ref rCognitoUserPool
        AwsRegion: !Ref AWS::Region
        DefaultAction: ALLOW

  rAppSyncSchema:
    Type: AWS::AppSync::GraphQLSchema
    Properties:
      ApiId: !GetAtt rAppSyncApi.ApiId
      Definition: |
        type Attachment {
          id: ID!
          name: String
          type: String
          url: String
        }
        type PaginatedAttachments {
          attachments: [Attachment!]!
          nextToken: String
        }
        type Version {
          versionId: String,
          lastModified: String,
          attachmentId: String
          url: String
        }
        type Query {
          allAttachments(limit: Int, nextToken: String): PaginatedAttachments!
          getAttachment(id: ID!): Attachment
        }
        type Mutation {
          createAttachment(id: ID!, name: String, type: String, url: String, lastModified: String): Attachment
          createAttachmentVersion(versionId: ID!, attachmentId: String, url: String, lastModified: String): Version
          deleteAttachment(id: ID!): Attachment
        }
        type Schema {
          query: Query
          mutation: Mutation
        }

  rAppSyncAttachmentsTableDataSource:
    Type: AWS::AppSync::DataSource
    Properties:
      Name: AttachmentsDataSource
      ApiId: !GetAtt rAppSyncApi.ApiId
      Description: "The Attachments Table AppSync Data Source"
      Type: AMAZON_DYNAMODB
      ServiceRoleArn: !GetAtt rDynamoDBRole.Arn
      DynamoDBConfig:
        TableName: !Ref rDynamoDBAttachmentsTable
        AwsRegion: !Sub ${AWS::Region}

  rAppSyncVersionsTableDataSource:
    Type: AWS::AppSync::DataSource
    Properties:
      Name: VersionsDataSource
      ApiId: !GetAtt rAppSyncApi.ApiId
      Description: "The Versions Table AppSync Data Source"
      Type: AMAZON_DYNAMODB
      ServiceRoleArn: !GetAtt rDynamoDBRole.Arn
      DynamoDBConfig:
        TableName: !Ref rDynamoDBVersionsTable
        AwsRegion: !Sub ${AWS::Region}

  rAppSyncAllAttachmentsQueryResolver:
    Type: AWS::AppSync::Resolver
    DependsOn: rAppSyncSchema
    Properties:
      ApiId: !GetAtt rAppSyncApi.ApiId
      TypeName: Query
      FieldName: allAttachments
      DataSourceName: !GetAtt rAppSyncAttachmentsTableDataSource.Name
      RequestMappingTemplate: |
        {
          "version": "2017-02-28",
          "operation": "Scan",
          "limit": $util.defaultIfNull(${ctx.args.limit},20),
          "nextToken": $util.toJson(${ctx.args.nextToken})
        }
      ResponseMappingTemplate: |
        {
          "attachments": $util.toJson($ctx.result.items),
          "nextToken": $util.toJson(${ctx.args.nextToken})
        }

  rAppSyncGetAttachmentQueryResolver:
    Type: AWS::AppSync::Resolver
    DependsOn: rAppSyncSchema
    Properties:
      ApiId: !GetAtt rAppSyncApi.ApiId
      TypeName: Query
      FieldName: getAttachment
      DataSourceName: !GetAtt rAppSyncAttachmentsTableDataSource.Name
      RequestMappingTemplate: |
        {
          "version": "2018-05-29",
          "operation": "GetItem",
          "key": {
            "id": $util.dynamodb.toDynamoDBJson($ctx.args.id)
          }
        }
      ResponseMappingTemplate: "$util.toJson($ctx.result)"

  rAppSyncCreateAttachmentMutationResolver:
    Type: AWS::AppSync::Resolver
    DependsOn: rAppSyncSchema
    Properties:
      ApiId: !GetAtt rAppSyncApi.ApiId
      TypeName: Mutation
      FieldName: createAttachment
      DataSourceName: !GetAtt rAppSyncAttachmentsTableDataSource.Name
      RequestMappingTemplate: |
        {
          "version": "2018-05-29",
          "operation": "PutItem",
          "key": {
            "id": $util.dynamodb.toDynamoDBJson($ctx.args.id)
          },
          "attributeValues": {
            "name": $util.dynamodb.toDynamoDBJson($ctx.args.name),
            "type": $util.dynamodb.toDynamoDBJson($ctx.args.type),
            "url": $util.dynamodb.toDynamoDBJson($ctx.args.url)
          }
        }
      ResponseMappingTemplate: "$util.toJson($ctx.result)"

  rAppSyncCreateAttachmentVersionMutationResolver:
    Type: AWS::AppSync::Resolver
    DependsOn: rAppSyncSchema
    Properties:
      ApiId: !GetAtt rAppSyncApi.ApiId
      TypeName: Mutation
      FieldName: createAttachmentVersion
      DataSourceName: !GetAtt rAppSyncVersionsTableDataSource.Name
      RequestMappingTemplate: |
        {
          "version": "2018-05-29",
          "operation": "PutItem",
          "key": {
            "versionId": $util.dynamodb.toDynamoDBJson($ctx.args.versionId)
          },
          "attributeValues": {
            "attachmentId": $util.dynamodb.toDynamoDBJson($ctx.args.attachmentId),
            "lastModified": $util.dynamodb.toDynamoDBJson($ctx.args.lastModified),
            "url": $util.dynamodb.toDynamoDBJson($ctx.args.url),
          }
        }
      ResponseMappingTemplate: "$util.toJson($ctx.result)"

  rAppSyncDeleteAttachmentMutationResolver:
    Type: AWS::AppSync::Resolver
    DependsOn: rAppSyncSchema
    Properties:
      ApiId: !GetAtt rAppSyncApi.ApiId
      TypeName: Mutation
      FieldName: deleteAttachment
      DataSourceName: !GetAtt rAppSyncAttachmentsTableDataSource.Name
      RequestMappingTemplate: |
        {
          "version": "2018-05-29",
          "operation": "DeleteItem",
          "key": {
            "id": $util.dynamodb.toDynamoDBJson($ctx.args.id)
          }
        }
      ResponseMappingTemplate: "$util.toJson($ctx.result)"

Outputs:
  oGraphQLApiEndpoint:
    Description: The URL to the GraphQL Endpoint
    Value: !GetAtt rAppSyncApi.GraphQLUrl