petunia.template.yaml

AWSTemplateFormatVersion: "2010-09-09"
Transform: AWS::Serverless-2016-10-31
Description: >
  devNull

  /dev/null as a Service
Parameters:
  KMSAliasName: 
    Type: String
    Default: alias/devnull/share
  SaltAndPWLength: 
    Type: Number
    Default: 150
Resources:
  DevNullFunction:
    Type: AWS::Serverless::Function
    Properties:
      CodeUri: devNull/
      Handler: app.lambdaHandler
      Runtime: nodejs8.10
      Events:
        DevNull:
          Type: Api
          Properties:
            Path: /null
            Method: post

  KMSShareFunction:
    Type: AWS::Serverless::Function
    Properties:
      CodeUri: kmsShare/
      Handler: app.lambdaHandler
      Runtime: nodejs8.10
      Role: !GetAtt KMSShareEncryptionRole.Arn
      Environment:
        Variables:
          KMS_ALIAS:
            Ref: KMSAliasName
      Events:
        KMSShare:
          Type: Api
          Properties:
            Path: /kms-share
            Method: post
  AESShareFunction:
    Type: AWS::Serverless::Function
    Properties:
      CodeUri: aesShare/
      Handler: app.lambdaHandler
      Runtime: nodejs8.10
      Environment:
        Variables:
          SALT_AND_PW_LENGTH:
            Ref: SaltAndPWLength
      Events:
        AESShare:
          Type: Api
          Properties:
            Path: /aes-share
            Method: post

  KMSShareKmsKey:
    Type: AWS::KMS::Key
    Properties:
      EnableKeyRotation: "True"
      KeyPolicy:
        Id: dev-null-key
        Version: "2012-10-17"
        Statement:
          - Sid: Enable IAM User Permissions
            Effect: Allow
            Principal:
              AWS:
                Fn::Join:
                  - ""
                  - - "arn:aws:iam::"
                    - Ref: AWS::AccountId
                    - ":root"
            Action: kms:*
            Resource: "*"
          - Sid: "Allow Encryption Service to use this key"
            Effect: "Allow"
            Action:
              - "kms:Encrypt"
            Principal:
              AWS: !GetAtt KMSShareEncryptionRole.Arn
            Resource: "*"

  KMSShareKmsKeyAlias:
    Type: AWS::KMS::Alias
    Properties:
      AliasName: 
        Ref: KMSAliasName
      TargetKeyId:
        Ref: KMSShareKmsKey
  KMSShareEncryptionRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Principal:
              Service: lambda.amazonaws.com
            Action: sts:AssumeRole
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/AWSLambdaExecute
      RoleName: kms-share-encryption-role

Outputs:
  DevNullApi:
    Description: "API Gateway endpoint URL for Prod stage for /dev/null as a service"
    Value: !Sub "https://${ServerlessRestApi}.execute-api.${AWS::Region}.amazonaws.com/Prod/null/"

  DevNullFunction:
    Description: "/dev/null Lambda Function ARN"
    Value: !GetAtt DevNullFunction.Arn

  DevNullFunctionIamRole:
    Description: "Implicit IAM Role created for /dev/null function"
    Value: !GetAtt DevNullFunction.Arn
  
  KMSShareApi:
    Description: "API Gateway endpoint URL for Prod stage for SHA Share"
    Value: !Sub "https://${ServerlessRestApi}.execute-api.${AWS::Region}.amazonaws.com/Prod/encrypt/"

  KMSShareFunction:
    Description: "SHA Share Lambda Function ARN"
    Value: !GetAtt KMSShareFunction.Arn

  KMSShareFunctionIamRole:
    Description: "Implicit IAM Role created for SHA Share function"
    Value: !GetAtt KMSShareFunction.Arn