Skip to content

Instantly share code, notes, and snippets.

@kabootit
Created March 2, 2022 20:00
Show Gist options
  • Save kabootit/c18b1257c8996c84cf3c0dc124815c82 to your computer and use it in GitHub Desktop.
Save kabootit/c18b1257c8996c84cf3c0dc124815c82 to your computer and use it in GitHub Desktop.
AWSTemplateFormatVersion: '2010-09-09'
Transform: AWS::Serverless-2016-10-31
Description: >
ts-sam-test
Sample SAM Template for ts-sam-test
# More info about Globals: https://github.com/awslabs/serverless-application-model/blob/master/docs/globals.rst
Globals:
Function:
Timeout: 10
Runtime: ruby2.7
Environment:
Variables:
NewReceiptEmailsBucketName: 'forpros-receipt-emails'
ReceiptPdfBucketName: 'forpros-receipt-pdfs'
TextractDataBucketName: 'forpros-textract-data'
RubyGemLayerBucket: 'forpros-ruby-gem-layer'
SecretsBucketName: 'forpros-secrets'
DARP_TABLE_NAME: 'darp.v2'
ORG_TABLE_NAME: 'org.v1'
RECEIPT_TABLE_NAME: 'receipt.v1'
USER_TABLE_NAME: 'user.v1'
INT_TABLE_NAME: 'int.v1'
Resources:
TextractRole:
Type: AWS::IAM::Role
Properties:
AssumeRolePolicyDocument:
Version: "2012-10-17"
Statement:
- Effect: "Allow"
Principal:
Service:
- "textract.amazonaws.com"
- "lambda.amazonaws.com"
Action:
- "sts:AssumeRole"
ManagedPolicyArns:
- "arn:aws:iam::aws:policy/AWSLambdaExecute"
- "arn:aws:iam::aws:policy/AmazonDynamoDBFullAccess"
- "arn:aws:iam::aws:policy/AmazonS3FullAccess"
- "arn:aws:iam::aws:policy/AmazonSQSFullAccess"
- "arn:aws:iam::aws:policy/AWSXrayFullAccess"
Policies:
- PolicyName: "TextractRoleAccess"
PolicyDocument:
Version: "2012-10-17"
Statement:
- Effect: Allow
Action:
- "sns:*"
Resource: "*"
- Effect: Allow
Action:
- "textract:*"
Resource: "*"
TextractSNSTopic:
Type: AWS::SNS::Topic
Properties:
DisplayName: "textract-sns-topic"
TopicName: "textract-sns-topic"
Subscription:
- Protocol: lambda
Endpoint: !GetAtt FetchTextractData.Arn
TextractSNSTopicPolicy:
Type: AWS::Lambda::Permission
Properties:
FunctionName: !Ref FetchTextractData
Principal: sns.amazonaws.com
Action: lambda:InvokeFunction
SourceArn: !Ref TextractSNSTopic
ValidReceiptSNSTopic:
Type: AWS::SNS::Topic
Properties:
DisplayName: "valid-receipt-sns-topic"
TopicName: "valid-receipt-sns-topic"
Subscription:
- Protocol: lambda
Endpoint: !GetAtt ApmExport.Arn
ValidReceiptSNSTopicPolicy:
Type: AWS::Lambda::Permission
Properties:
FunctionName: !Ref ApmExport
Principal: sns.amazonaws.com
Action: lambda:InvokeFunction
SourceArn: !Ref ValidReceiptSNSTopic
UserResponseSNSTopic:
Type: AWS::SNS::Topic
Properties:
DisplayName: "user-response-sns-topic"
TopicName: "user-response-sns-topic"
Subscription:
- Protocol: lambda
Endpoint: !GetAtt SendResponse.Arn
UserResponseSNSTopicPolicy:
Type: AWS::Lambda::Permission
Properties:
FunctionName: !Ref SendResponse
Principal: sns.amazonaws.com
Action: lambda:InvokeFunction
SourceArn: !Ref UserResponseSNSTopic
UpdateUserSettings:
Type: AWS::Serverless::Function
Properties:
CodeUri: functions/updateUserSettings
Handler: update_user_settings.lambda_handler
Events:
SomeResource:
Type: Api
Properties:
Path: /userSettings
Method: POST
RestApiId: !Ref ForProsCognitoAuthorizerAPI
Policies:
- DynamoDBWritePolicy:
TableName: !Ref UserTable
- DynamoDBReadPolicy:
TableName: !Ref UserTable
FetchUserSettings:
Type: AWS::Serverless::Function
Properties:
CodeUri: functions/fetchUserSettings
Handler: fetch_user_settings.lambda_handler
Events:
SomeResource:
Type: Api
Properties:
Path: /userSettings
Method: GET
RestApiId: !Ref ForProsCognitoAuthorizerAPI
Policies:
- DynamoDBWritePolicy:
TableName: !Ref UserTable
- DynamoDBReadPolicy:
TableName: !Ref UserTable
UpdateOrgSettings:
Type: AWS::Serverless::Function
Properties:
CodeUri: functions/updateOrgSettings
Handler: update_org_settings.lambda_handler
Layers:
- !Ref GemLayer
Events:
SomeResource:
Type: Api
Properties:
Path: /orgSettings
Method: POST
RestApiId: !Ref ForProsCognitoAuthorizerAPI
Policies:
- DynamoDBWritePolicy:
TableName: !Ref UserTable
- DynamoDBReadPolicy:
TableName: !Ref UserTable
- DynamoDBWritePolicy:
TableName: !Ref OrganizationTable
- DynamoDBReadPolicy:
TableName: !Ref OrganizationTable
FetchOrgSettings:
Type: AWS::Serverless::Function
Properties:
CodeUri: functions/fetchOrgSettings
Handler: fetch_org_settings.lambda_handler
Events:
SomeResource:
Type: Api
Properties:
Path: /orgSettings
Method: GET
RestApiId: !Ref ForProsCognitoAuthorizerAPI
Policies:
- DynamoDBWritePolicy:
TableName: !Ref OrganizationTable
- DynamoDBReadPolicy:
TableName: !Ref OrganizationTable
FetchIntegrationFields:
Type: AWS::Serverless::Function
Properties:
CodeUri: functions/fetchIntegrationFields
Handler: fetch_integration_fields.lambda_handler
Events:
SomeResource:
Type: Api
Properties:
Path: /integrationFields
Method: GET
RestApiId: !Ref ApmCognitoAuthorizerAPI
UpdateIntegrationSettings:
Type: AWS::Serverless::Function
Properties:
CodeUri: functions/updateIntegrationSettings
Handler: update_integration_settings.lambda_handler
Events:
SomeResource:
Type: Api
Properties:
Path: /integrationSettings
Method: POST
RestApiId: !Ref ForProsCognitoAuthorizerAPI
Policies:
- DynamoDBWritePolicy:
TableName: !Ref IntegrationTable
- DynamoDBReadPolicy:
TableName: !Ref IntegrationTable
TokenAuthorizer:
Type: AWS::Serverless::Function
Properties:
CodeUri: functions/authorizer
Handler: token_auth.auth_handler
FetchIntegrationSettings:
Type: AWS::Serverless::Function
Properties:
CodeUri: functions/fetchIntegrationSettings
Handler: fetch_integration_settings.lambda_handler
Events:
SomeResource:
Type: Api
Properties:
Path: /integrationSettings
Method: GET
RestApiId: !Ref ForProsCognitoAuthorizerAPI
Policies:
- DynamoDBWritePolicy:
TableName: !Ref IntegrationTable
- DynamoDBReadPolicy:
TableName: !Ref IntegrationTable
UserReceipts:
Type: AWS::Serverless::Function
Properties:
CodeUri: functions/userReceipts
Handler: user_receipts.lambda_handler
Layers:
- !Ref GemLayer
Events:
SomeResource:
Type: Api
Properties:
Path: /userReceipts
Method: GET
RestApiId: !Ref ForProsCognitoAuthorizerAPI
Policies:
- DynamoDBWritePolicy:
TableName: !Ref DARPTable
- DynamoDBReadPolicy:
TableName: !Ref DARPTable
- DynamoDBWritePolicy:
TableName: !Ref OrganizationTable
- DynamoDBReadPolicy:
TableName: !Ref OrganizationTable
- DynamoDBWritePolicy:
TableName: !Ref UserTable
- DynamoDBReadPolicy:
TableName: !Ref UserTable
FetchEmail:
Type: AWS::Serverless::Function
Properties:
CodeUri: functions/fetchEmail/
Handler: fetch_email_data.email_handler
Runtime: ruby2.7
Layers:
- !Ref GemLayer
Events:
S3Event:
Type: S3
Properties:
Bucket: !Ref NewReceiptEmails
Events: s3:ObjectCreated:Put
Policies:
- S3FullAccessPolicy:
BucketName: forpros-receipt-emails
- S3FullAccessPolicy:
BucketName: forpros-receipt-pdfs
- S3FullAccessPolicy:
BucketName: forpros-ruby-gem-layer
- DynamoDBWritePolicy:
TableName: !Ref DARPTable
- DynamoDBReadPolicy:
TableName: !Ref DARPTable
- DynamoDBWritePolicy:
TableName: !Ref OrganizationTable
- DynamoDBReadPolicy:
TableName: !Ref OrganizationTable
- DynamoDBWritePolicy:
TableName: !Ref UserTable
- DynamoDBReadPolicy:
TableName: !Ref UserTable
FetchTextractData:
Type: AWS::Serverless::Function
Properties:
Layers:
- !Ref GemLayer
CodeUri: functions/fetchTextractData/
Handler: fetch_textract_data.textract_data_handler
Runtime: ruby2.7
Role: !GetAtt TextractRole.Arn
Policies:
- AWSLambdaExecute
- AmazonTextractFullAccess
- S3FullAccessPolicy:
BucketName: forpros-textract-data
- S3FullAccessPolicy:
BucketName: forpros-ruby-gem-layer
- DynamoDBWritePolicy:
TableName: !Ref DARPTable
- DynamoDBReadPolicy:
TableName: !Ref DARPTable
- DynamoDBWritePolicy:
TableName: !Ref ReceiptTable
- DynamoDBReadPolicy:
TableName: !Ref ReceiptTable
ApmExport:
Type: AWS::Serverless::Function
Properties:
Environment:
Variables:
TRFLSALT: $2a$10$zrAgWG72OK36T/IQUe0kP.
CodeUri: functions/apmExport/
Handler: apm_handler.export
Runtime: ruby2.7
Role: !GetAtt TextractRole.Arn
Layers:
- !Ref GemLayer
Policies:
- DynamoDBWritePolicy:
TableName: !Ref DARPTable
- DynamoDBReadPolicy:
TableName: !Ref DARPTable
FetchReceipt:
Type: AWS::Serverless::Function
Properties:
Environment:
Variables:
TEXT_EXTRACT_ROLE: !GetAtt TextractRole.Arn
SNS_TOPIC: !Ref TextractSNSTopic
CLOUDFRONT_DOMAIN: d2nkoo806s3zp0.cloudfront.net
KEYPAIR_ID: APKAJOYSJ6WJIZLFS2MA
SECRETS_BUCKET_NAME: forpros-secrets
CodeUri: functions/fetchReceipt/
Handler: fetch_receipt.receipt_handler
Runtime: ruby2.7
Role: !GetAtt TextractRole.Arn
Events:
S3Event:
Type: S3
Properties:
Bucket: !Ref PdfReceipts
Events: s3:ObjectCreated:Put
Filter:
S3Key:
Rules:
- Name: suffix
Value: .pdf
Policies:
- AmazonTextractFullAccess
- S3FullAccessPolicy:
BucketName: forpros-textract-data
- S3FullAccessPolicy:
BucketName: forpros-receipt-pdfs
- DynamoDBWritePolicy:
TableName: !Ref DARPTable
- DynamoDBReadPolicy:
TableName: !Ref DARPTable
DARPTable:
Type: AWS::DynamoDB::Table
DeletionPolicy: Retain
UpdateReplacePolicy: Retain
Properties:
TableName: 'darp.v2'
AttributeDefinitions:
- AttributeName: message_id
AttributeType: S
- AttributeName: email
AttributeType: S
- AttributeName: current_state
AttributeType: N
- AttributeName: org_id
AttributeType: S
KeySchema:
- AttributeName: message_id
KeyType: HASH
GlobalSecondaryIndexes:
- IndexName: email_secondary_index
KeySchema:
- AttributeName: email
KeyType: HASH
- AttributeName: current_state
KeyType: RANGE
Projection:
ProjectionType: ALL
ProvisionedThroughput:
ReadCapacityUnits: 1
WriteCapacityUnits: 1
- IndexName: current_state_secondary_index
KeySchema:
- AttributeName: current_state
KeyType: HASH
Projection:
ProjectionType: ALL
ProvisionedThroughput:
ReadCapacityUnits: 1
WriteCapacityUnits: 1
- IndexName: organization_secondary_index
KeySchema:
- AttributeName: org_id
KeyType: HASH
Projection:
ProjectionType: ALL
ProvisionedThroughput:
ReadCapacityUnits: 1
WriteCapacityUnits: 1
ProvisionedThroughput:
ReadCapacityUnits: 1
WriteCapacityUnits: 3
StreamSpecification:
StreamViewType: NEW_IMAGE
ReceiptTable:
Type: AWS::DynamoDB::Table
DeletionPolicy: Retain
UpdateReplacePolicy: Retain
Properties:
TableName: 'receipt.v1'
AttributeDefinitions:
- AttributeName: receipt_hash
AttributeType: S
KeySchema:
- AttributeName: receipt_hash
KeyType: HASH
ProvisionedThroughput:
ReadCapacityUnits: 1
WriteCapacityUnits: 1
OrganizationTable:
Type: AWS::DynamoDB::Table
DeletionPolicy: Retain
UpdateReplacePolicy: Retain
Properties:
TableName: 'org.v1'
AttributeDefinitions:
- AttributeName: uuid
AttributeType: S
- AttributeName: email
AttributeType: S
KeySchema:
- AttributeName: uuid
KeyType: HASH
ProvisionedThroughput:
ReadCapacityUnits: 1
WriteCapacityUnits: 1
GlobalSecondaryIndexes:
- IndexName: email_secondary_index
KeySchema:
- AttributeName: email
KeyType: HASH
Projection:
ProjectionType: ALL
ProvisionedThroughput:
ReadCapacityUnits: 1
WriteCapacityUnits: 1
IntegrationTable:
Type: AWS::DynamoDB::Table
DeletionPolicy: Retain
UpdateReplacePolicy: Retain
Properties:
TableName: 'int.v1'
AttributeDefinitions:
- AttributeName: org_uuid
AttributeType: S
- AttributeName: type
AttributeType: S
KeySchema:
- AttributeName: org_uuid
KeyType: HASH
ProvisionedThroughput:
ReadCapacityUnits: 1
WriteCapacityUnits: 1
GlobalSecondaryIndexes:
- IndexName: type_secondary_index
KeySchema:
- AttributeName: type
KeyType: HASH
Projection:
ProjectionType: ALL
ProvisionedThroughput:
ReadCapacityUnits: 1
WriteCapacityUnits: 1
UserTable:
Type: AWS::DynamoDB::Table
DeletionPolicy: Retain
UpdateReplacePolicy: Retain
Properties:
TableName: 'user.v1'
AttributeDefinitions:
- AttributeName: email
AttributeType: S
KeySchema:
- AttributeName: email
KeyType: HASH
ProvisionedThroughput:
ReadCapacityUnits: 1
WriteCapacityUnits: 1
GemLayer:
Type: AWS::Serverless::LayerVersion
Properties:
LayerName: NativeRubyGemLayer3
ContentUri: "s3://forpros-ruby-gem-layer/gem_layer.zip"
CompatibleRuntimes:
- ruby2.7
SendResponse:
Type: AWS::Serverless::Function
Properties:
CodeUri: functions/sendResponse/
Handler: handle_user_response.respond
Runtime: ruby2.7
Layers:
- !Ref GemLayer
Policies:
- AmazonSESFullAccess
- DynamoDBWritePolicy:
TableName: !Ref DARPTable
- DynamoDBReadPolicy:
TableName: !Ref DARPTable
PublishState:
Type: AWS::Serverless::Function
Properties:
Environment:
Variables:
TEXT_EXTRACT_ROLE: !GetAtt TextractRole.Arn
VALID_RECEIPT_TOPIC: !Ref ValidReceiptSNSTopic
USER_RESPONSE_TOPIC: !Ref UserResponseSNSTopic
CodeUri: functions/statePublisher/
Handler: publish_state.handler
Runtime: ruby2.7
Role: !GetAtt TextractRole.Arn
Events:
Stream:
Type: DynamoDB
Properties:
Stream: !GetAtt DARPTable.StreamArn
BatchSize: 10
StartingPosition: LATEST
ApmPoller:
Type: AWS::Serverless::Function
Properties:
CodeUri: functions/apmPoller/
Handler: poller.poll
Runtime: ruby2.7
Role: !GetAtt TextractRole.Arn
Layers:
- !Ref GemLayer
Events:
MySQSEvent:
Type: SQS
Properties:
Queue: !GetAtt ApmJobQueue.Arn
BatchSize: 10
RetryFailedReceipt:
Type: AWS::Serverless::Function
Properties:
CodeUri: functions/retryFailedReceipt/
Handler: retry.execute
Runtime: ruby2.7
Role: !GetAtt TextractRole.Arn
Layers:
- !Ref GemLayer
RetryFailed:
Type: AWS::Serverless::Function
Properties:
CodeUri: functions/retryFailed/
Handler: retry_failed.execute
Runtime: ruby2.7
Role: !GetAtt TextractRole.Arn
Layers:
- !Ref GemLayer
ApmJobQueue:
Type: AWS::SQS::Queue
Properties:
QueueName: 'apmjobqueue'
NewReceiptEmails:
Type: 'AWS::S3::Bucket'
Properties:
BucketName: 'forpros-receipt-emails'
PdfReceipts:
Type: 'AWS::S3::Bucket'
Properties:
BucketName: 'forpros-receipt-pdfs'
TextractData:
Type: 'AWS::S3::Bucket'
Properties:
BucketName: 'forpros-textract-data'
# AWS Cognito resource
ForProsCognitoAuthorizerAPI:
Type: AWS::Serverless::Api
Properties:
StageName: prod
Cors:
AllowMethods: "'*'"
AllowHeaders: "'*'"
AllowOrigin: "'*'"
Auth:
DefaultAuthorizer: ForProsCognitoUserPoolAuthorizer
AddDefaultAuthorizerToCorsPreflight: false
Authorizers:
MyLambdaTokenAuthorizer:
FunctionArn: !GetAtt TokenAuthorizer.Arn
ForProsCognitoUserPoolAuthorizer:
UserPoolArn: !GetAtt ForProsCognitoUserPool.Arn
GatewayResponseDefault4XX:
Type: AWS::ApiGateway::GatewayResponse
Properties:
ResponseParameters:
gatewayresponse.header.Access-Control-Allow-Origin: "'*'"
gatewayresponse.header.Access-Control-Allow-Headers: "'*'"
ResponseType: DEFAULT_4XX
RestApiId:
Ref: ForProsCognitoAuthorizerAPI
ForProsCognitoUserPool:
Type: AWS::Cognito::UserPool
Properties:
UserPoolName: forpros-cognito-user-pool
Policies:
PasswordPolicy:
MinimumLength: 8
RequireLowercase: true
RequireUppercase: true
RequireNumbers: true
RequireSymbols: true
AutoVerifiedAttributes:
- email
UsernameAttributes:
- email
UsernameConfiguration:
CaseSensitive: false
AccountRecoverySetting:
RecoveryMechanisms:
- Name: verified_email
Priority: 1
EmailConfiguration:
SourceArn: arn:aws:ses:us-west-2:437179789324:identity/[email protected]
EmailSendingAccount: DEVELOPER
From: [email protected]
VerificationMessageTemplate:
EmailMessage: "Your verification code is {####}"
EmailSubject: "Your verification link"
EmailMessageByLink: "Please click the link below to verify your email address. {##Verify Email##}"
EmailSubjectByLink: "Your verification link"
DefaultEmailOption: CONFIRM_WITH_LINK
Schema:
- AttributeDataType: String
Name: email
Required: false
- AttributeDataType: String
Name: name
Required: false
- AttributeDataType: Number
Name: phone
Required: false
- AttributeDataType: Number
Name: is_admin
NumberAttributeConstraints:
MinValue: "0"
MaxValue: "1"
Mutable: true
Required: false
CognitoUserPoolClient:
Type: AWS::Cognito::UserPoolClient
Properties:
ClientName: test-auth-cognito-user-pool-react-ui
UserPoolId: !Ref ForProsCognitoUserPool
Outputs:
ApiId:
Description: "API ID"
Value: !Ref ForProsCognitoAuthorizerAPI
ApiUrl:
Description: "API endpoint URL for environment"
Value: !Sub 'https://${ForProsCognitoAuthorizerAPI}.execute-api.${AWS::Region}.amazonaws.com/dev/'
CognitoUserPoolId:
Description: "Cognito User Pool Id"
Value: !Ref ForProsCognitoUserPool
CognitoUserPoolClientId:
Description: "Cognito User Pool Client Id"
Value: !Ref CognitoUserPoolClient
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment