stack.yml

---
# Validate this template with
#
#   aws cloudformation validate-template --template-body "file://$(pwd)/stack.yml"

AWSTemplateFormatVersion: 2010-09-09

Parameters:
  GithubOauthToken:
    Description: |-
      Oauth Token, see
      http://docs.aws.amazon.com/codepipeline/latest/userguide/troubleshooting.html#troubleshooting-gs2
    Type: String
    NoEcho: true
  GithubRepoOwner:
    Description: Username (eg. 'brianto')
    Type: String
  GithubRepoName:
    Description: Repository (eg. 'rekt')
    Type: String
    Default: rekt
  GithubRepoBranch:
    Description: Branch (eg. 'master')
    Type: String
    Default: master

Metadata:
  AWS::CloudFormation::Interface:

    ParameterGroups:
      - Label:
          default: Github Repository
        Parameters:
          - GithubRepoOwner
          - GithubRepoName
          - GithubRepoBranch
          - GithubOauthToken

    ParameterLabels:
      GithubRepoOwner:
        default: Owner
      GithubRepoName:
        default: Repository
      GithubRepoBranch:
        default: Branch
      GithubOauthToken:
        default: Oauth Token

Outputs:

  RektWebsiteURL:
    Description: Website URL
    Value: !GetAtt WebsiteBucket.WebsiteURL

Resources:

  ReviewsTable:
    Type: AWS::DynamoDB::Table
    Properties:
      KeySchema:
        - AttributeName: id
          KeyType: HASH
      AttributeDefinitions:
        - AttributeName: id
          AttributeType: S
      ProvisionedThroughput:
        ReadCapacityUnits: 2
        WriteCapacityUnits: 2
      # TODO maybe add GSI for monthly queries

  CommentsTable:
    Type: AWS::DynamoDB::Table
    Properties:
      KeySchema:
        - AttributeName: review
          KeyType: HASH
        - AttributeName: id
          KeyType: RANGE
      AttributeDefinitions:
        - AttributeName: review
          AttributeType: S
        - AttributeName: id
          AttributeType: S
      ProvisionedThroughput:
        ReadCapacityUnits: 2
        WriteCapacityUnits: 2

  # API is populated on first (CodePipeline) build
  # This is only a placeholder until then
  Api:
    Type: AWS::ApiGateway::RestApi
    Properties:
      Name: !Ref AWS::StackName
      Description: Backend API

  MockGetMethod:
    Type: AWS::ApiGateway::Method
    Properties:
      RestApiId: !Ref Api
      ResourceId: !GetAtt Api.RootResourceId
      HttpMethod: GET
      AuthorizationType: NONE
      Integration:
        Type: MOCK

  ApiDeployment:
    Type: AWS::ApiGateway::Deployment
    Properties:
      RestApiId: !Ref Api
    DependsOn:
      - MockGetMethod

  ApiStage:
    Type: AWS::ApiGateway::Stage
    Properties:
      StageName: api
      RestApiId: !Ref Api
      DeploymentId: !Ref ApiDeployment

  PipelineArtifactsBucket:
    Type: AWS::S3::Bucket
    Properties: {}

  WebsiteBucket:
    Type: AWS::S3::Bucket
    Properties:
      AccessControl: PublicRead
      WebsiteConfiguration:
        IndexDocument: index.html

  WebsiteBucketPolicy:
    Type: AWS::S3::BucketPolicy
    Properties:
      Bucket: !Ref WebsiteBucket
      PolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Principal: "*"
            Action: s3:GetObject
            Resource: !Sub arn:aws:s3:::${WebsiteBucket}/*

  Build:
    Type: AWS::CodeBuild::Project
    Properties:
      Name: !Ref AWS::StackName
      ServiceRole: !Ref DeployerRole
      Source:
        Type: CODEPIPELINE
      Artifacts:
        Type: CODEPIPELINE
      Environment:
        ComputeType: BUILD_GENERAL1_SMALL
        Type: LINUX_CONTAINER
        Image: aws/codebuild/nodejs:7.0.0
        EnvironmentVariables:
          - Name: REKT_API_NAME
            Value: !Ref AWS::StackName
          - Name: REKT_API_ID
            Value: !Ref Api
          - Name: REKT_API_GATEWAY_ENDPOINT
            Value: !Sub ${Api}.execute-api.${AWS::Region}.amazonaws.com
          - Name: REKT_API_GATEWAY_STAGE
            Value: !Ref ApiStage
          - Name: REKT_WEBSITE_BUCKET
            Value: !Ref WebsiteBucket
          - Name: REKT_SERVICER_ARN
            Value: !GetAtt ServicerRole.Arn
          - Name: REKT_CREATE_REVIEW_LAMBDA_ARN
            Value: !GetAtt CreateReviewLambda.Arn
          - Name: REKT_GET_REVIEW_LAMBDA_ARN
            Value: !GetAtt GetReviewLambda.Arn
      TimeoutInMinutes: 30

  DeployerRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Action: sts:AssumeRole
            Principal:
              Service:
                - codebuild.amazonaws.com
                - codepipeline.amazonaws.com
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/AWSCodePipelineFullAccess
        - arn:aws:iam::aws:policy/AWSCodeBuildDeveloperAccess
      Policies:
        - PolicyName: !Sub ${AWS::StackName}-deployer
          PolicyDocument:
            Version: 2012-10-17
            Statement:
              - Effect: Allow
                Resource: !Sub arn:aws:logs:${AWS::Region}:${AWS::AccountId}:log-group:/aws/codebuild/${AWS::StackName}:*
                Action:
                  - logs:CreateLogGroup
                  - logs:CreateLogStream
                  - logs:PutLogEvents
              - Effect: Allow
                Resource: !Sub arn:aws:s3:::${AWS::StackName}-*
                Action:
                  - s3:PutObject
                  - s3:GetObject
                  - s3:GetObjectVersion
              - Effect: Allow
                Resource: !Sub arn:aws:lambda:${AWS::Region}:${AWS::AccountId}:function:${AWS::StackName}-*
                Action: lambda:UpdateFunctionCode
              - Effect: Allow
                Resource: !Sub arn:aws:apigateway:${AWS::Region}::/restapis/${Api}
                Action: apigateway:PUT
              - Effect: Allow
                Resource: !Sub arn:aws:apigateway:${AWS::Region}::/restapis/${Api}/deployments
                Action: apigateway:POST

  ServicerRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Action: sts:AssumeRole
            Principal:
              Service:
                - lambda.amazonaws.com
                - apigateway.amazonaws.com
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole
      Policies:
        - PolicyName: !Sub ${AWS::StackName}-servicer
          PolicyDocument:
            Version: 2012-10-17
            Statement:
              - Effect: Allow
                Action: lambda:InvokeFunction
                Resource: !Sub arn:aws:lambda:${AWS::Region}:${AWS::AccountId}:function:${AWS::StackName}-*
              - Effect: Allow
                Resource: !Sub arn:aws:dynamodb:${AWS::Region}:${AWS::AccountId}:table/${AWS::StackName}-*
                Action:
                  - dynamodb:Query
                  - dynamodb:GetItem
                  - dynamodb:PutItem

  CreateReviewLambda:
    Type: AWS::Lambda::Function
    Properties:
      Runtime: nodejs4.3
      Role: !GetAtt ServicerRole.Arn
      Handler: CreateReview.handler
      Environment:
        Variables:
          REKT_REVIEWS_TABLE: !Ref ReviewsTable
      Code:
        ZipFile: // Not Implemented

  GetReviewLambda:
    Type: AWS::Lambda::Function
    Properties:
      Runtime: nodejs4.3
      Role: !GetAtt ServicerRole.Arn
      Handler: GetReview.handler
      Environment:
        Variables:
          REKT_REVIEWS_TABLE: !Ref ReviewsTable
      Code:
        ZipFile: // Not Implemented

  Pipeline:
    Type: AWS::CodePipeline::Pipeline
    Properties:
      Name: !Ref AWS::StackName
      RoleArn: !GetAtt DeployerRole.Arn
      RestartExecutionOnUpdate: Yes
      ArtifactStore:
        Type: S3
        Location: !Ref PipelineArtifactsBucket
      Stages:

        - Name: Source
          Actions:
            - Name: Download
              ActionTypeId:
                Category: Source
                Owner: ThirdParty
                Provider: GitHub
                Version: 1
              Configuration:
                Owner: !Ref GithubRepoOwner
                Repo: !Ref GithubRepoName
                Branch: !Ref GithubRepoBranch
                OAuthToken: !Ref GithubOauthToken
              OutputArtifacts:
                - Name: !Sub ${AWS::StackName}-source

        - Name: Build
          Actions:
            - Name: Frontend
              ActionTypeId:
                Category: Build
                Owner: AWS
                Provider: CodeBuild
                Version: 1
              Configuration:
                ProjectName: !Ref Build
              InputArtifacts:
                - Name: !Sub ${AWS::StackName}-source
              OutputArtifacts:
                - Name: !Sub ${AWS::StackName}-dist