template.yaml

AWSTemplateFormatVersion: 2010-09-09
Description: >-
  lottery-api

Transform:
- AWS::Serverless-2016-10-31

Globals:
  Api:
    OpenApiVersion: 3.0.1
  Function:
    Runtime: nodejs18.x
    Timeout: 30
    MemorySize: 128
    Architectures:
      - x86_64

Resources:
  ## STATE MACHINES
  AdminUpdateUserStateMachine:
    Type: AWS::StepFunctions::StateMachine
    Properties:
      StateMachineName: admin-update-user-state-machine
      Definition:
        Comment: Update User in Cognito User Pool
        StartAt: ParallelUpdate
        States:
          ParallelUpdate:
            Type: Parallel
            Branches:
              - StartAt: UpdateGivenName
                States:
                  UpdateGivenName:
                    Type: Task
                    Resource: !Sub arn:aws:lambda:${AWS::Region}:${AWS::AccountId}:function:${AdminUpdateUserByIdFunction}
                    Parameters:
                      userId.$: $.id
                      updateField: given_name
                      updateValue.$: $.updateParams.givenName
                    End: true
              - StartAt: UpdateFamilyName
                States:
                  UpdateFamilyName:
                    Type: Task
                    Resource: !Sub arn:aws:lambda:${AWS::Region}:${AWS::AccountId}:function:${AdminUpdateUserByIdFunction}
                    Parameters:
                      userId.$: $.id
                      updateField: family_name
                      updateValue.$: $.updateParams.familyName
                    End: true
            Catch: 
              - ErrorEquals: ["States.ALL"]
                Next: HandleError
            Next: ParallelUpdateEnd
          HandleError:
            Type: Fail
            Error: "ErrorUpdatingUserAttributes"
            Cause: "An error occurred while updating user attributes"
          ParallelUpdateEnd:
            Type: Pass
            Result: Parallel Update Complete
            End: true
      RoleArn: !Sub arn:aws:iam::${AWS::AccountId}:role/admin-commands-state-machine-role

  AdminDeleteUserStateMachine:
    Type: AWS::StepFunctions::StateMachine
    Properties:
      StateMachineName: admin-delete-user-state-machine
      Definition:
        Comment: Delete User in Cognito User Pool
        StartAt: DeleteUser
        States:
          DeleteUser:
            Type: Task
            Resource: !Sub arn:aws:lambda:${AWS::Region}:${AWS::AccountId}:function:${AdminDeleteUserByIdFunction}
            Parameters:
              userId.$: $.id
            End: true
      RoleArn: !Sub arn:aws:iam::${AWS::AccountId}:role/admin-commands-state-machine-role

  AdminCreateLotteryStateMachine:
    Type: AWS::StepFunctions::StateMachine
    Properties:
      StateMachineName: admin-create-lottery-state-machine
      Definition:
        Comment: Pick a lottery winner, insert into LotteryWinnersTable, and contact winner
        StartAt: PickLotteryWinner
        States:
          PickLotteryWinner:
            Type: Task
            Resource: !Sub arn:aws:lambda:${AWS::Region}:${AWS::AccountId}:function:${AdminPickLotteryWinnerFunction}
            ResultPath: $.winnerData
            Next: InsertIntoLotteryWinnersTable
          InsertIntoLotteryWinnersTable:
            Type: Task
            Resource: arn:aws:states:::dynamodb:putItem
            Parameters:
              TableName: !Ref LotteryWinnersTable
              Item:
                userEmail:
                  S.$: $.winnerData.userEmail
                userId:
                  S.$: $.winnerData.userId
                userStatus:
                  S.$: $.winnerData.userStatus
            ResultPath: $.dynamoOutput
            Next: NotifyWinner
          NotifyWinner:
            Type: Task
            Resource: !Sub arn:aws:lambda:${AWS::Region}:${AWS::AccountId}:function:${NotifyLotteryWinnerFunction}
            Parameters:
              winnerEmail.$: $.winnerData.userEmail
            End: true
      RoleArn: !Sub arn:aws:iam::${AWS::AccountId}:role/admin-commands-state-machine-role

        
  ## IAM ROLES
  AdminCommandsStateMachineRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: admin-commands-state-machine-role
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              Service: states.amazonaws.com
            Action: sts:AssumeRole
      Policies:
        - PolicyName: AllowLambdaInvoke
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
                - Effect: Allow
                  Action:
                    - lambda:InvokeFunction
                  Resource: !Sub arn:aws:lambda:${AWS::Region}:${AWS::AccountId}:function:*
        - PolicyName: AllowDynamoDbPut
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
                - Effect: Allow
                  Action:
                    - dynamodb:PutItem
                  Resource: 
                    - !GetAtt LotteryWinnersTable.Arn

  ApiGatewayAdminStepFunctionsRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Sid: AllowApiGatewayServiceToAssumeRole
            Effect: Allow
            Action:
              - sts:AssumeRole
            Principal:
              Service:
                - apigateway.amazonaws.com
      Policies:
        - PolicyName: CallStepFunctions
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Effect: Allow
                Action:
                  - states:StartExecution
                Resource: 
                  - !Ref AdminUpdateUserStateMachine
                  - !Ref AdminDeleteUserStateMachine
                  - !Ref AdminCreateLotteryStateMachine
        - PolicyName: InvokeFunctions
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Effect: Allow
                Action:
                  - lambda:InvokeFunction
                Resource:
                  - !GetAtt AdminGetAllUsersFunction.Arn
                  - !GetAtt AdminGetUserByIdFunction.Arn

  ApiGatewayAuthInvokeRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Sid: AllowApiGatewayServiceToAssumeRole
            Effect: Allow
            Action:
              - sts:AssumeRole
            Principal:
              Service:
                - apigateway.amazonaws.com
      Policies:
        - PolicyName: InvokeFunctions
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Effect: Allow
                Action:
                  - lambda:InvokeFunction
                Resource:
                  - !GetAtt UserCheckWinnerFunction.Arn
                  - !GetAtt UserRegistrationFunction.Arn
                  - !GetAtt UserRegistrationConfirmationFunction.Arn

  AdminUserApi:
    Type: AWS::Serverless::Api
    Properties:
      StageName: Test
      DefinitionBody:
        'Fn::Transform':
          Name: 'AWS::Include'
          Parameters:
            Location: dist/open-api-specification.yaml

  ## LAMBDA RESOURCES
  # ADMIN LAMBDAS
  AdminGetAllUsersFunction:
    Type: AWS::Serverless::Function
    Properties:
      CodeUri: dist/admin-get-all-users/
      Handler: handler.handler
      Policies:
        - Statement:
            - Effect: Allow
              Action:
                - cognito-idp:ListUsers
              Resource:
                !Sub arn:aws:cognito-idp:${AWS::Region}:${AWS::AccountId}:userpool/${LotteryPlayersUserPool}
      Environment:
        Variables:
          USER_POOL_ID: !Ref LotteryPlayersUserPool

  AdminGetUserByIdFunction:
    Type: AWS::Serverless::Function
    Properties:
      CodeUri: dist/admin-get-user-by-id/
      Handler: handler.handler
      Policies:
        - Statement:
            - Effect: Allow
              Action:
                - cognito-idp:AdminGetUser
              Resource:
                !Sub arn:aws:cognito-idp:${AWS::Region}:${AWS::AccountId}:userpool/${LotteryPlayersUserPool}
      Environment:
        Variables:
          USER_POOL_ID: !Ref LotteryPlayersUserPool

  AdminUpdateUserByIdFunction:
    Type: AWS::Serverless::Function
    Properties:
      CodeUri: dist/admin-update-user-by-id/
      Handler: handler.handler
      Policies:
        - Statement:
            - Effect: Allow
              Action:
                - cognito-idp:AdminUpdateUserAttributes
              Resource:
                !Sub arn:aws:cognito-idp:${AWS::Region}:${AWS::AccountId}:userpool/${LotteryPlayersUserPool}
      Environment:
        Variables:
          USER_POOL_ID: !Ref LotteryPlayersUserPool

  AdminDeleteUserByIdFunction:
    Type: AWS::Serverless::Function
    Properties:
      CodeUri: dist/admin-delete-user-by-id/
      Handler: handler.handler
      Policies:
        - Statement:
            - Effect: Allow
              Action:
                - cognito-idp:AdminDeleteUser
              Resource:
                !Sub arn:aws:cognito-idp:${AWS::Region}:${AWS::AccountId}:userpool/${LotteryPlayersUserPool}
      Environment:
        Variables:
          USER_POOL_ID: !Ref LotteryPlayersUserPool

  AdminPickLotteryWinnerFunction:
    Type: AWS::Serverless::Function
    Properties:
      CodeUri: dist/pick-lottery-winner/
      Handler: handler.handler
      Policies:
        - Statement:
            - Effect: Allow
              Action:
                - cognito-idp:ListUsers
              Resource:
                !Sub arn:aws:cognito-idp:${AWS::Region}:${AWS::AccountId}:userpool/${LotteryPlayersUserPool}
      Environment:
        Variables:
          USER_POOL_ID: !Ref LotteryPlayersUserPool

  NotifyLotteryWinnerFunction:
    Type: AWS::Serverless::Function
    Properties:
      CodeUri: dist/notify-lottery-winner/
      Handler: handler.handler
      Policies:
        - Statement:
          - Effect: Allow
            Action:
              - ses:SendEmail
            Resource:
              - "*"

  # USER LAMBDAS
  UserRegistrationFunction:
    Type: AWS::Serverless::Function
    Properties:
      CodeUri: dist/user-registration/ 
      Handler: handler.handler
      Policies:
        - Statement:
          - Effect: Allow
            Action:
              - cognito-idp:SignUp
            Resource:
              !Sub arn:aws:cognito-idp:${AWS::Region}:${AWS::AccountId}:userpool/${LotteryPlayersUserPool}
      Environment:
        Variables:
          COGNITO_CLIENT_ID: !Ref LotteryPlayersUserPoolClient

  UserRegistrationConfirmationFunction:
    Type: AWS::Serverless::Function
    Properties:
      CodeUri: dist/user-registration-confirmation/ 
      Handler: handler.handler
      Policies:
        - Statement:
          - Effect: Allow
            Action:
              - cognito-idp:ConfirmSignUpCommand
            Resource:
              !Sub arn:aws:cognito-idp:${AWS::Region}:${AWS::AccountId}:userpool/${LotteryPlayersUserPool}
      Environment:
        Variables:
          COGNITO_CLIENT_ID: !Ref LotteryPlayersUserPoolClient

  UserCheckWinnerFunction:
    Type: AWS::Serverless::Function
    Properties:
      CodeUri: dist/user-check-winner/
      Handler: handler.handler
      Policies: 
        - Statement:
          - Effect: Allow
            Action:
              - dynamodb:GetItem
            Resource:
              !GetAtt LotteryWinnersTable.Arn
      Environment:
        Variables:
          LOTTERY_WINNERS_TABLE_NAME: !Ref LotteryWinnersTable

  ## DYNAMO TABLE
  LotteryWinnersTable:
    Type: AWS::Serverless::SimpleTable
    Properties:
      TableName: lottery-winners-table
      PrimaryKey:
        Name: userEmail
        Type: String
      ProvisionedThroughput:
        ReadCapacityUnits: 2
        WriteCapacityUnits: 2

  ## COGNITO RESOURCES
  LotteryPlayersUserPool:
      Type: AWS::Cognito::UserPool
      Properties:
        UserPoolName: lottery-players-user-pool
        AutoVerifiedAttributes:
          - email
        Schema:
          - Name: given_name
            AttributeDataType: String
            Mutable: true
            Required: true
          - Name: family_name
            AttributeDataType: String
            Mutable: true
            Required: true
        VerificationMessageTemplate:
          DefaultEmailOption: CONFIRM_WITH_CODE

  LotteryPlayersUserPoolClient:
    Type: AWS::Cognito::UserPoolClient
    Properties:
      UserPoolId: !Ref LotteryPlayersUserPool
      GenerateSecret: false

Outputs:
  WebEndpoint:
    Description: "API Gateway endpoint URL for Prod stage"
    Value: !Sub "https://${AdminUserApi}.execute-api.${AWS::Region}.amazonaws.com/Test/"