template.yaml

AWSTemplateFormatVersion: '2010-09-09'
Transform: AWS::Serverless-2016-10-31
Description: >
  MealMatch.io API

  AWS SAM CloudFormation Stack for MealMatch.io's API

# More info about Globals: https://github.com/awslabs/serverless-application-model/blob/master/docs/globals.rst
Globals:
  Function:
    Timeout: 3

Parameters:
  Env:
    Type: String
    AllowedValues:
      - dev
      - staging
      - prod

Resources:
  ########################
  #
  # Lambda Functions
  #
  ########################
  PlacesFunction:
    Type: AWS::Serverless::Function # More info about Function Resource: https://github.com/awslabs/serverless-application-model/blob/master/versions/2016-10-31.md#awsserverlessfunction
    Properties:
      CodeUri: src/places/
      Handler: index.handler
      Runtime: nodejs12.x
      Events:
        Nearby:
          Type: Api # More info about API Event Source: https://github.com/awslabs/serverless-application-model/blob/master/versions/2016-10-31.md#api
          Properties:
            Path: /places/nearby
            RestApiId: !Ref MealMatchAPIGateway
            Method: get
        Search:
          Type: Api # More info about API Event Source: https://github.com/awslabs/serverless-application-model/blob/master/versions/2016-10-31.md#api
          Properties:
            Path: /places/search
            RestApiId: !Ref MealMatchAPIGateway
            Method: get
        Details:
          Type: Api
          Properties:
            Path: /places
            RestApiId: !Ref MealMatchAPIGateway
            Method: get
      Layers:
        - !Ref UtilsLayer
      Tracing: Active
      Environment:
        Variables:
          NODE_ENV: !Ref Env
      Policies:
        - Statement:
          - Sid: SSMDescribeParametersPolicy
            Effect: Allow
            Action:
              - ssm:DescribeParameters
            Resource: '*'
          - Sid: SSMGetParameterPolicy
            Effect: Allow
            Action:
              - ssm:GetParameters
              - ssm:GetParameter
            Resource: '*'

  # Runs from a Cognito Post Confirmation trigger to transfer users from Cognito User Pool to DynamoDB
  UsersCognitoPostConfirmationFunction:
    Type: AWS::Serverless::Function
    Properties:
      CodeUri: src/users/post-confirmation
      Handler: index.handler
      Runtime: nodejs12.x
      Layers:
        - !Ref UtilsLayer
      Tracing: Active
      Environment:
        Variables:
          NODE_ENV: !Ref Env
          USERS_TABLE: !Ref UserTable
      Policies:
        - Statement:
          - Sid: DynamoDBUsersTablePowerUser
            Effect: Allow
            Action:
              - dynamodb:*
            Resource: !GetAtt UserTable.Arn

  CategoriesRestaurantsFunction:
    Type: AWS::Serverless::Function
    Properties:
      CodeUri: src/categories/restaurants/
      Handler: index.handler
      Runtime: nodejs12.x
      Layers:
        - !Ref UtilsLayer
      Tracing: Active
      Events:
        RespondInvite:
          Type: Api
          Properties:
            Path: /categories/restaurants
            RestApiId: !Ref MealMatchAPIGateway
            Method: get
      Environment:
        Variables:
          NODE_ENV: !Ref Env
          FOURSQUARE_API_CLIENT_ID: '{{resolve:secretsmanager:prod-foursquare-api-credentials:SecretString:ClientId}}'
          FOURSQUARE_API_CLIENT_SECRET: '{{resolve:secretsmanager:prod-foursquare-api-credentials:SecretString:ClientSecret}}'

  UsersAppetiteFunction:
    Type: AWS::Serverless::Function
    Properties:
      CodeUri: src/users/appetite/
      Handler: index.handler
      Runtime: nodejs12.x
      Events:
        GetMutualAppetite:
          Type: Api
          Properties:
            Path: /users/appetite
            RestApiId: !Ref MealMatchAPIGateway
            Method: get
        EditUserAppetite:
          Type: Api
          Properties:
            Path: /users/appetite
            RestApiId: !Ref MealMatchAPIGateway
            Method: post
      Layers:
        - !Ref UtilsLayer
      Tracing: Active
      Environment:
        Variables:
          NODE_ENV: !Ref Env
          USER_TABLE: User
      Policies:
        - Statement:
          - Sid: DynamoDBUserTablePowerUser
            Effect: Allow
            Action:
              - dynamodb:GetItem
              - dynamodb:GetRecords
              - dynamodb:PutItem
              - dynamodb:UpdateItem
            Resource: !GetAtt UserTable.Arn
          - Sid: DynamoDBUserAppetiteGSIQueryUser
            Effect: Allow
            Action:
              - dynamodb:Query
            Resource: !Sub ${UserTable.Arn}/index/gsiUserAppetite

  SearchFunction:
    Type: AWS::Serverless::Function
    Properties:
      CodeUri: src/search/
      Handler: index.handler
      Runtime: nodejs12.x
      Events:
        Search:
          Type: Api
          Properties:
            Path: /search
            RestApiId: !Ref MealMatchAPIGateway
            Method: get
      Layers:
        - !Ref UtilsLayer
      Tracing: Active
      Environment:
        Variables:
          NODE_ENV: !Ref Env
          USER_TABLE: User
      Policies:
        - Statement:
          - Sid: DynamoDBUserTablePowerUser
            Effect: Allow
            Action:
              - dynamodb:GetItem
              - dynamodb:GetRecords
              - dynamodb:Scan
            Resource: !GetAtt UserTable.Arn

  UsersGetInfoFunction:
    Type: AWS::Serverless::Function
    Properties:
      CodeUri: src/users/info/
      Handler: get.handler
      Runtime: nodejs12.x
      Events:
        Fetch:
          Type: Api
          Properties:
            Path: /users/info
            RestApiId: !Ref MealMatchAPIGateway
            Method: get
      Layers:
        - !Ref UtilsLayer
      Tracing: Active
      Environment:
        Variables:
          NODE_ENV: !Ref Env
          USERS_TABLE: User
      Policies:
        - Statement:
          - Sid: DynamoDBUserTablePowerUser
            Effect: Allow
            Action:
              - dynamodb:GetItem
              - dynamodb:GetRecords
            Resource: !GetAtt UserTable.Arn

  UsersEditInfoFunction:
    Type: AWS::Serverless::Function
    Properties:
      CodeUri: src/users/info/
      Handler: edit.handler
      Runtime: nodejs12.x
      Events:
        EditInfo:
          Type: Api
          Properties:
            Path: /users/info
            RestApiId: !Ref MealMatchAPIGateway
            Method: post
      Layers:
        - !Ref UtilsLayer
      Tracing: Active
      Environment:
        Variables:
          NODE_ENV: !Ref Env
          USERS_TABLE: User
      Policies:
        - Statement:
          - Sid: DynamoDBUserTablePowerUser
            Effect: Allow
            Action:
              - dynamodb:GetItem
              - dynamodb:GetRecords
              - dynamodb:PutItem
              - dynamodb:UpdateItem
            Resource: !GetAtt UserTable.Arn

  SubmitUsernameFunction:
    Type: AWS::Serverless::Function
    Properties:
      CodeUri: src/users/info/
      Handler: submit-username.handler
      Runtime: nodejs12.x
      Events:
        EditUsername:
          Type: Api
          Properties:
            Path: /users/submit-username
            RestApiId: !Ref MealMatchAPIGateway
            Method: post
      Layers:
        - !Ref UtilsLayer
      Tracing: Active
      Environment:
        Variables:
          NODE_ENV: !Ref Env
          USERS_TABLE: User
          USERNAMES_TABLE: Usernames
      Policies:
        - Statement:
          - Sid: DynamoDBUserUsernamesTablePowerUser
            Effect: Allow
            Action:
              - dynamodb:GetItem
              - dynamodb:GetRecords
              - dynamodb:PutItem
              - dynamodb:UpdateItem
            Resource:
              - !GetAtt UserTable.Arn
              - !GetAtt UsernamesTable.Arn

  GroupMutualAppetitesFunction:
    Type: AWS::Serverless::Function
    Properties:
      CodeUri: src/groups/mutual-appetite/
      Handler: index.handler
      Runtime: nodejs12.x
      Events:
        GetMutualAppetite:
          Type: Api
          Properties:
            Path: /groups/mutual-appetite
            RestApiId: !Ref MealMatchAPIGateway
            Method: get
      Layers:
        - !Ref UtilsLayer
      Tracing: Active
      Environment:
        Variables:
          NODE_ENV: !Ref Env
          USERS_TABLE: User
          GROUPS_TABLE: Groups
      Policies:
        - Statement:
          - Sid: DynamoDBUserGroupsTablePowerUser
            Effect: Allow
            Action:
              - dynamodb:GetItem
              - dynamodb:GetRecords
            Resource:
              - !GetAtt UserTable.Arn
              - !GetAtt GroupsTable.Arn
          - Sid: DynamoDBUserAppetiteGSIQueryUser
            Effect: Allow
            Action:
              - dynamodb:Query
            Resource: !Sub ${UserTable.Arn}/index/gsiUserAppetite

  GroupInvitesSNSFunction:
    Type: AWS::Serverless::Function
    Properties:
      CodeUri: src/groups/sns/
      Handler: index.handler
      Runtime: nodejs12.x
      Layers:
        - !Ref UtilsLayer
      Tracing: Active
      Environment:
        Variables:
          NODE_ENV: !Ref Env
          USERS_TABLE: User
          GROUPS_TABLE: Groups
      Policies:
        - Statement:
          - Sid: DynamoDBUserTablePowerUser
            Effect: Allow
            Action:
              - dynamodb:GetItem
              - dynamodb:GetRecords
              - dynamodb:PutItem
              - dynamodb:UpdateItem
            Resource:
              - !GetAtt UserTable.Arn
              - !GetAtt GroupsTable.Arn

  CreateGroupFunction:
    Type: AWS::Serverless::Function
    Properties:
      CodeUri: src/groups/create/
      Handler: index.handler
      Runtime: nodejs12.x
      Layers:
        - !Ref UtilsLayer
      Tracing: Active
      Events:
        Create:
          Type: Api
          Properties:
            Path: /groups/create
            RestApiId: !Ref MealMatchAPIGateway
            Method: post
      Environment:
        Variables:
          NODE_ENV: !Ref Env
          USERS_TABLE: User
          GROUPS_TABLE: Groups
      Policies:
        - Statement:
          - Sid: DynamoDBUserTablePowerUser
            Effect: Allow
            Action:
              - dynamodb:GetItem
              - dynamodb:GetRecords
              - dynamodb:PutItem
              - dynamodb:UpdateItem
            Resource:
              - !GetAtt UserTable.Arn
              - !GetAtt GroupsTable.Arn

  ViewGroupFunction:
    Type: AWS::Serverless::Function
    Properties:
      CodeUri: src/groups/view/
      Handler: index.handler
      Runtime: nodejs12.x
      Layers:
        - !Ref UtilsLayer
      Tracing: Active
      Events:
        Create:
          Type: Api
          Properties:
            Path: /groups/view
            RestApiId: !Ref MealMatchAPIGateway
            Method: get
      Environment:
        Variables:
          NODE_ENV: !Ref Env
          USERS_TABLE: User
          GROUPS_TABLE: Groups
      Policies:
        - Statement:
          - Sid: DynamoDBUserGroupsTableGetter
            Effect: Allow
            Action:
              - dynamodb:GetItem
              - dynamodb:GetRecords
            Resource:
              - !GetAtt UserTable.Arn
              - !GetAtt GroupsTable.Arn

  PublishSNSGroupInviteFunction:
    Type: AWS::Serverless::Function
    Properties:
      CodeUri: src/groups/invite/
      Handler: index.handler
      Runtime: nodejs12.x
      Layers:
        - !Ref UtilsLayer
      Tracing: Active
      Events:
        Invite:
          Type: Api
          Properties:
            Path: /groups/invite
            RestApiId: !Ref MealMatchAPIGateway
            Method: post
      Environment:
        Variables:
          NODE_ENV: !Ref Env
          GROUP_INVITES_SNS_TOPIC_ARN: !Ref GroupInvitesSNSTopic
      Policies:
        - Statement:
          - Sid: GroupInvitesSNSPublisher
            Effect: Allow
            Action:
              - SNS:Publish
            Resource:
              - !Ref GroupInvitesSNSTopic

  UsersGroupsRespondFunction:
    Type: AWS::Serverless::Function
    Properties:
      CodeUri: src/users/groups/respond/
      Handler: index.handler
      Runtime: nodejs12.x
      Layers:
        - !Ref UtilsLayer
      Tracing: Active
      Events:
        RespondInvite:
          Type: Api
          Properties:
            Path: /users/groups/respond
            RestApiId: !Ref MealMatchAPIGateway
            Method: post
      Environment:
        Variables:
          NODE_ENV: !Ref Env
          USERS_TABLE: User
          GROUPS_TABLE: Groups
      Policies:
        - Statement:
          - Sid: DynamoDBUserGroupsTablePowerUser
            Effect: Allow
            Action:
              - dynamodb:GetItem
              - dynamodb:GetRecords
              - dynamodb:PutItem
              - dynamodb:UpdateItem
            Resource:
              - !GetAtt UserTable.Arn
              - !GetAtt GroupsTable.Arn

  UsersGroupsLeaveFunction:
    Type: AWS::Serverless::Function
    Properties:
      CodeUri: src/users/groups/leave/
      Handler: index.handler
      Runtime: nodejs12.x
      Layers:
        - !Ref UtilsLayer
      Tracing: Active
      Events:
        RespondInvite:
          Type: Api
          Properties:
            Path: /users/groups/leave
            RestApiId: !Ref MealMatchAPIGateway
            Method: post
      Environment:
        Variables:
          NODE_ENV: !Ref Env
          USERS_TABLE: User
          GROUPS_TABLE: Groups
      Policies:
        - Statement:
          - Sid: DynamoDBUserGroupsTablePowerUser
            Effect: Allow
            Action:
              - dynamodb:GetItem
              - dynamodb:GetRecords
              - dynamodb:PutItem
              - dynamodb:UpdateItem
              - dynamodb:DeleteItem
            Resource:
              - !GetAtt UserTable.Arn
              - !GetAtt GroupsTable.Arn

  GroupsKickUserFunction:
    Type: AWS::Serverless::Function
    Properties:
      CodeUri: src/groups/kick/
      Handler: index.handler
      Runtime: nodejs12.x
      Layers:
        - !Ref UtilsLayer
      Tracing: Active
      Events:
        RespondInvite:
          Type: Api
          Properties:
            Path: /groups/kick
            RestApiId: !Ref MealMatchAPIGateway
            Method: post
      Environment:
        Variables:
          NODE_ENV: !Ref Env
          USERS_TABLE: User
          GROUPS_TABLE: Groups
      Policies:
        - Statement:
          - Sid: DynamoDBUserGroupsTablePowerUser
            Effect: Allow
            Action:
              - dynamodb:GetItem
              - dynamodb:GetRecords
              - dynamodb:PutItem
              - dynamodb:UpdateItem
            Resource:
              - !GetAtt UserTable.Arn
              - !GetAtt GroupsTable.Arn

  UserAvatarSubmitFunction:
    Type: AWS::Serverless::Function
    Properties:
      CodeUri: src/users/avatar/
      Handler: submit.handler
      Runtime: nodejs12.x
      Layers:
        - !Ref UtilsLayer
      Tracing: Active
      Events:
        RespondInvite:
          Type: Api
          Properties:
            Path: /users/avatar
            RestApiId: !Ref MealMatchAPIGateway
            Method: post
      Environment:
        Variables:
          NODE_ENV: !Ref Env
          USERS_TABLE: User
      Policies:
        - Statement:
          - Sid: DynamoDBUsersTableUpdate
            Effect: Allow
            Action:
              - dynamodb:GetItem
              - dynamodb:PutItem
              - dynamodb:UpdateItem
            Resource:
              - !GetAtt UserTable.Arn

  ########################
  #
  # API Gateway
  #
  ########################
  MealMatchAPIGateway:
    Type: AWS::Serverless::Api
    Properties:
      StageName: Prod
      Cors: "'*'"
      Auth:
        DefaultAuthorizer: MealMatchCognitoAuthorizer
        Authorizers:
          MealMatchCognitoAuthorizer:
            UserPoolArn: '{{resolve:ssm:MealMatchCognitoUserPoolArn:3}}'

  ########################
  #
  # Layers
  #
  ########################
  UtilsLayer:
    Type: AWS::Serverless::LayerVersion
    Properties:
      LayerName: Utils
      Description: Shared utilities for Lambdas
      ContentUri: src/layers
      CompatibleRuntimes:
        - nodejs12.x

  ########################
  #
  # API Gateway Custom Domain Name
  #
  ########################
  ApiDomain:
    Type: AWS::ApiGateway::DomainName
    Properties:
      RegionalCertificateArn: '{{resolve:ssm:MealMatchApiCertificateArn:1}}'
      DomainName: !Sub '${Env}.api.mealmatch.io'
      EndpointConfiguration:
        Types:
          - REGIONAL
      SecurityPolicy: TLS_1_2

  ########################
  #
  # API Gateway BasePathMapping for Custom Domain
  #
  ########################
  ApiDomainMapping:
    Type: AWS::ApiGateway::BasePathMapping
    Properties:
      DomainName: !Ref ApiDomain
      RestApiId: !Ref MealMatchAPIGateway
      Stage: !Ref MealMatchAPIGateway.Stage
    DependsOn:
      - MealMatchAPIGateway
      - ApiDomain

  ########################
  #
  # DynamoDB Tables
  #
  ########################
  UserTable:
    Type: AWS::DynamoDB::Table
    Properties:
      TableName: User
      ProvisionedThroughput:
        ReadCapacityUnits: 5
        WriteCapacityUnits: 5
      AttributeDefinitions:
        - AttributeName: id
          AttributeType: S
        - AttributeName: display_username
          AttributeType: S
      KeySchema:
        - AttributeName: id
          KeyType: HASH
      GlobalSecondaryIndexes:
        - IndexName: gsiDisplayUsername
          KeySchema:
            - AttributeName: display_username
              KeyType: HASH
          Projection:
            ProjectionType: KEYS_ONLY
          ProvisionedThroughput:
            ReadCapacityUnits: 5
            WriteCapacityUnits: 5
        - IndexName: gsiUserAppetite
          KeySchema:
            - AttributeName: display_username
              KeyType: HASH
          Projection:
            NonKeyAttributes:
              - appetite
            ProjectionType: INCLUDE
          ProvisionedThroughput:
            ReadCapacityUnits: 5
            WriteCapacityUnits: 5

  GroupsTable:
    Type: AWS::DynamoDB::Table
    Properties:
      TableName: Groups
      ProvisionedThroughput:
        ReadCapacityUnits: 5
        WriteCapacityUnits: 5
      AttributeDefinitions:
        - AttributeName: id
          AttributeType: S
      KeySchema:
      - AttributeName: id
        KeyType: HASH

  UsernamesTable:
    Type: AWS::DynamoDB::Table
    Properties:
      TableName: Usernames
      ProvisionedThroughput:
        ReadCapacityUnits: 5
        WriteCapacityUnits: 5
      AttributeDefinitions:
        - AttributeName: display_username
          AttributeType: S
      KeySchema:
        - AttributeName: display_username
          KeyType: HASH

  ########################
  #
  # SNS Topics
  #
  ########################
  GroupInvitesSNSTopic:
    Type: AWS::SNS::Topic
    Properties:
      TopicName: GroupInvites
      DisplayName: MealMatch.io Group Invites
      Subscription:
        - Endpoint: !GetAtt GroupInvitesSNSFunction.Arn
          Protocol: lambda

  GroupInvitesLambdaInvokePermission:
    Type: AWS::Lambda::Permission
    Properties:
      Action: 'lambda:InvokeFunction'
      FunctionName: !Ref GroupInvitesSNSFunction
      Principal: "sns.amazonaws.com"

  ########################
  #
  # S3 Buckets
  #
  ########################
  AssetsBucket:
    Type: AWS::S3::Bucket
    Properties:
      BucketEncryption:
        ServerSideEncryptionConfiguration:
          - BucketKeyEnabled: true
            ServerSideEncryptionByDefault:
             SSEAlgorithm: AES256
      BucketName: mealmatch-assets
      CorsConfiguration:
        CorsRules:
          - AllowedOrigins:
              - '*'
            AllowedMethods:
              - GET
              - POST
              - PUT
              - DELETE
            AllowedHeaders:
              - '*'
            Id: AllowGETAccess
            MaxAge: 3600

Outputs:
  # ServerlessRestApi is an implicit API created out of Events key under Serverless::Function
  # Find out more about other implicit resources you can reference within SAM
  # https://github.com/awslabs/serverless-application-model/blob/master/docs/internals/generated_resources.rst#api
  PlacesApi:
    Description: "API Gateway endpoint URL for Prod stage for Places endpoint"
    Value: !Sub "https://${MealMatchAPIGateway}.execute-api.${AWS::Region}.amazonaws.com/Prod/places/"
  PlacesFunction:
    Description: "Places Lambda Function ARN"
    Value: !GetAtt PlacesFunction.Arn
  PlacesFunctionIamRole:
    Description: "Implicit IAM Role created for Places function"
    Value: !GetAtt PlacesFunctionRole.Arn
  CustomApiDomain:
    Description: "Custom domain name for the API"
    Value: !GetAtt ApiDomain.RegionalDomainName
  AssetsBucket:
    Description: "S3 Bucket for assets"
    Value: !GetAtt AssetsBucket.Arn