template.yml

AWSTemplateFormatVersion : '2010-09-09'
Transform: AWS::Serverless-2016-10-31
Description: require.id API
Metadata:
  AWS::ServerlessRepo::Application:
    Name: require-id
    Description: require.id API
    Author: require-id
    HomePageUrl: https://require.id/
    SourceCodeUrl: https://github.com/require-id
Resources:
  RequireIDAPIGatewayExecutionRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Statement:
        - Effect: Allow
          Principal:
            Service: apigateway.amazonaws.com
          Action:
          - sts:AssumeRole
      Path: '/'
      Policies:
      - PolicyName: execution
        PolicyDocument:
          Statement:
          - Effect: Allow
            Action:
            - logs:CreateLogGroup
            - logs:CreateLogStream
            - logs:PutLogEvents
            Resource: '*'
          - Effect: Allow
            Action:
            - lambda:InvokeFunction
            Resource: "*"
  RequireIDGateway:
    Type: AWS::Serverless::Api
    Properties:
      StageName: default
      EndpointConfiguration: EDGE
      DefinitionBody:
        openapi: 3.0.1
        info:
          title: require.id API
        x-amazon-apigateway-api-key-source: HEADER
        components:
          securitySchemes:
            ApiKeyAuth:
              type: apiKey
              name: x-api-key
              in: header
        paths:
          /api/status:
            get:
              security:
              - ApiKeyAuth: []
              x-amazon-apigateway-integration:
                uri: !Sub "arn:aws:apigateway:${AWS::Region}:lambda:path/2015-03-31/functions/${RequireIDLambda.Arn}/invocations"
                passthroughBehavior: when_no_match
                httpMethod: POST
                type: aws_proxy
                credentials: !GetAtt RequireIDAPIGatewayExecutionRole.Arn
          /user/poll:
            get:
              security:
              - ApiKeyAuth: []
              x-amazon-apigateway-integration:
                uri: !Sub "arn:aws:apigateway:${AWS::Region}:lambda:path/2015-03-31/functions/${RequireIDLambda.Arn}/invocations"
                passthroughBehavior: when_no_match
                httpMethod: POST
                type: aws_proxy
                credentials: !GetAtt RequireIDAPIGatewayExecutionRole.Arn
          /user/response:
            post:
              security:
              - ApiKeyAuth: []
              x-amazon-apigateway-integration:
                uri: !Sub "arn:aws:apigateway:${AWS::Region}:lambda:path/2015-03-31/functions/${RequireIDLambda.Arn}/invocations"
                passthroughBehavior: when_no_match
                httpMethod: POST
                type: aws_proxy
                credentials: !GetAtt RequireIDAPIGatewayExecutionRole.Arn
          /user/subscribe:
            post:
              security:
              - ApiKeyAuth: []
              x-amazon-apigateway-integration:
                uri: !Sub "arn:aws:apigateway:${AWS::Region}:lambda:path/2015-03-31/functions/${RequireIDLambda.Arn}/invocations"
                passthroughBehavior: when_no_match
                httpMethod: POST
                type: aws_proxy
                credentials: !GetAtt RequireIDAPIGatewayExecutionRole.Arn
          /user/unsubscribe:
            post:
              security:
              - ApiKeyAuth: []
              x-amazon-apigateway-integration:
                uri: !Sub "arn:aws:apigateway:${AWS::Region}:lambda:path/2015-03-31/functions/${RequireIDLambda.Arn}/invocations"
                passthroughBehavior: when_no_match
                httpMethod: POST
                type: aws_proxy
                credentials: !GetAtt RequireIDAPIGatewayExecutionRole.Arn
          /backup/store:
            post:
              security:
              - ApiKeyAuth: []
              x-amazon-apigateway-integration:
                uri: !Sub "arn:aws:apigateway:${AWS::Region}:lambda:path/2015-03-31/functions/${RequireIDLambda.Arn}/invocations"
                passthroughBehavior: when_no_match
                httpMethod: POST
                type: aws_proxy
                credentials: !GetAtt RequireIDAPIGatewayExecutionRole.Arn
          /backup/load:
            get:
              security:
              - ApiKeyAuth: []
              x-amazon-apigateway-integration:
                uri: !Sub "arn:aws:apigateway:${AWS::Region}:lambda:path/2015-03-31/functions/${RequireIDLambda.Arn}/invocations"
                passthroughBehavior: when_no_match
                httpMethod: POST
                type: aws_proxy
                credentials: !GetAtt RequireIDAPIGatewayExecutionRole.Arn
          /backup/delete:
            delete:
              security:
              - ApiKeyAuth: []
              x-amazon-apigateway-integration:
                uri: !Sub "arn:aws:apigateway:${AWS::Region}:lambda:path/2015-03-31/functions/${RequireIDLambda.Arn}/invocations"
                passthroughBehavior: when_no_match
                httpMethod: POST
                type: aws_proxy
                credentials: !GetAtt RequireIDAPIGatewayExecutionRole.Arn
          /prompt/new:
            post:
              x-amazon-apigateway-integration:
                uri: !Sub "arn:aws:apigateway:${AWS::Region}:lambda:path/2015-03-31/functions/${RequireIDLambda.Arn}/invocations"
                passthroughBehavior: when_no_match
                httpMethod: POST
                type: aws_proxy
                credentials: !GetAtt RequireIDAPIGatewayExecutionRole.Arn
          /prompt/poll:
            get:
              x-amazon-apigateway-integration:
                uri: !Sub "arn:aws:apigateway:${AWS::Region}:lambda:path/2015-03-31/functions/${RequireIDLambda.Arn}/invocations"
                passthroughBehavior: when_no_match
                httpMethod: POST
                type: aws_proxy
                credentials: !GetAtt RequireIDAPIGatewayExecutionRole.Arn
          /prompt/abort:
            delete:
              x-amazon-apigateway-integration:
                uri: !Sub "arn:aws:apigateway:${AWS::Region}:lambda:path/2015-03-31/functions/${RequireIDLambda.Arn}/invocations"
                passthroughBehavior: when_no_match
                httpMethod: POST
                type: aws_proxy
                credentials: !GetAtt RequireIDAPIGatewayExecutionRole.Arn
  RequireIDAppApiKey:
    Type: AWS::ApiGateway::ApiKey
    DependsOn:
      - RequireIDAppUsagePlan
    Properties:
      Name: RequireIDAppApiKey
      Enabled: "true"
      StageKeys:
        - RestApiId: !Ref RequireIDGateway
          StageName: !Ref RequireIDGateway.Stage
  RequireIDPromptApiKey:
    Type: AWS::ApiGateway::ApiKey
    DependsOn:
      - RequireIDPromptUsagePlan
    Properties:
      Name: RequireIDPromptApiKey
      Enabled: "true"
      Value: hL30bXrRVVJ6kUjQ62lg
      StageKeys:
        - RestApiId: !Ref RequireIDGateway
          StageName: !Ref RequireIDGateway.Stage
  RequireIDAppUsagePlan:
    Type: AWS::ApiGateway::UsagePlan
    DependsOn:
      - RequireIDGateway
    Properties:
      Throttle:
        BurstLimit: 20
        RateLimit: 5
      ApiStages:
      - ApiId: !Ref RequireIDGateway
        Stage: !Ref RequireIDGateway.Stage
      UsagePlanName: RequireIDAppUsagePlan
  RequireIDAppUsagePlanKey:
    Type: AWS::ApiGateway::UsagePlanKey
    Properties :
      KeyId: !Ref RequireIDAppApiKey
      UsagePlanId: !Ref RequireIDAppUsagePlan
      KeyType: API_KEY
  RequireIDPromptUsagePlan:
    Type: AWS::ApiGateway::UsagePlan
    DependsOn:
      - RequireIDGateway
    Properties:
      Throttle:
        BurstLimit: 20
        RateLimit: 5
      ApiStages:
      - ApiId: !Ref RequireIDGateway
        Stage: !Ref RequireIDGateway.Stage
      UsagePlanName: RequireIDPromptUsagePlan
  RequireIDPromptUsagePlanKey:
    Type: AWS::ApiGateway::UsagePlanKey
    Properties :
      KeyId: !Ref RequireIDPromptApiKey
      UsagePlanId: !Ref RequireIDPromptUsagePlan
      KeyType: API_KEY
  RequireIDLambdaExecutionRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Statement:
        - Effect: Allow
          Principal:
            Service: lambda.amazonaws.com
          Action:
          - sts:AssumeRole
      ManagedPolicyArns:
      - "arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"
      Path: '/'
      Policies:
      - PolicyName: RequireIDS3Policy
        PolicyDocument:
          Statement:
          - Effect: Allow
            Action:
            - s3:GetObject
            - s3:PutObject
            - s3:DeleteObject
            Resource: !Sub "arn:aws:s3:::require-id-data/*"
  RequireIDLambda:
    Type: AWS::Serverless::Function
    Properties:
      Runtime: python3.7
      Handler: app.router.handler
      CodeUri: app/src
      Role: !GetAtt RequireIDLambdaExecutionRole.Arn
      Timeout: 15
      MemorySize: 512
      Environment:
        Variables:
          STORAGE_METHOD: s3
          AWS_S3_BUCKET: "require-id-data"
          USE_LAMBDA_ROLE: true
          DEBUG: true
      Events:
        ApiStatus:
          Type: Api
          Properties:
            Path: /api/status
            RestApiId: !Ref RequireIDGateway
            Method: GET
        UserPoll:
          Type: Api
          Properties:
            Path: /user/poll
            RestApiId: !Ref RequireIDGateway
            Method: GET
        UserResponse:
          Type: Api
          Properties:
            Path: /user/response
            RestApiId: !Ref RequireIDGateway
            Method: POST
        UserSubscribe:
          Type: Api
          Properties:
            Path: /user/subscribe
            RestApiId: !Ref RequireIDGateway
            Method: POST
        UserUnsubscribe:
          Type: Api
          Properties:
            Path: /user/unsubscribe
            RestApiId: !Ref RequireIDGateway
            Method: POST
        BackupStore:
          Type: Api
          Properties:
            Path: /backup/store
            RestApiId: !Ref RequireIDGateway
            Method: POST
        BackupLoad:
          Type: Api
          Properties:
            Path: /backup/load
            RestApiId: !Ref RequireIDGateway
            Method: GET
        BackupDelete:
          Type: Api
          Properties:
            Path: /backup/delete
            RestApiId: !Ref RequireIDGateway
            Method: DELETE
        PromptNew:
          Type: Api
          Properties:
            Path: /prompt/new
            RestApiId: !Ref RequireIDGateway
            Method: POST
        PromptPoll:
          Type: Api
          Properties:
            Path: /prompt/poll
            RestApiId: !Ref RequireIDGateway
            Method: GET
        PromptAbort:
          Type: Api
          Properties:
            Path: /prompt/abort
            RestApiId: !Ref RequireIDGateway
            Method: DELETE