resources.yaml

Parameters:
  ResourceSuffix:
    Description: Suffix to append to all resources
    Type: String
    Default: ""
  BucketName:
    Description: Name of the S3 bucket
    Type: String
    Default: "ob-publish"

Resources:
  #######################################################
  # Policies
  #######################################################
  CommonAccessPolicy:
    Type: AWS::IAM::ManagedPolicy
    Properties:
      Description: Policy to grant common access to DynamoDB tables and CloudFormation outputs
      PolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Action:
              - dynamodb:GetItem
              - dynamodb:Query
              - dynamodb:Scan
              - dynamodb:PutItem
              - dynamodb:UpdateItem
              - dynamodb:DeleteItem
            Resource:
              - !GetAtt ObSessionTable.Arn
              - !GetAtt ObAgentConfigTable.Arn
              - !GetAtt ObEventActionTable.Arn
              - !GetAtt ObClientTable.Arn
          - Effect: Allow
            Action:
              - cloudformation:DescribeStacks
            Resource: !Sub 'arn:aws:cloudformation:${AWS::Region}:${AWS::AccountId}:stack/${AWS::StackName}/*'
          - Effect: Allow
            Action:
              - sns:Publish
            Resource:
              - !Sub 'arn:aws:sns:${AWS::Region}:${AWS::AccountId}:ObInfra-${ResourceSuffix}'
              - !Sub 'arn:aws:sns:${AWS::Region}:${AWS::AccountId}:ObBusiness-${ResourceSuffix}'
#          - Effect: Allow
#            Action:
#              - s3:PutObject
#              - s3:GetObject
#            Resource: !GetAtt ObBucket.Arn


  ObBucket:
    Type: 'AWS::S3::Bucket'
    Properties:
      BucketName: !Sub '${BucketName}'

      PublicAccessBlockConfiguration:
        BlockPublicAcls: false
        BlockPublicPolicy: false
        IgnorePublicAcls: false
        RestrictPublicBuckets: false

  ObBucketPolicy:
    Type: 'AWS::S3::BucketPolicy'
    Properties:
      Bucket:
        Ref: 'ObBucket'
      PolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal: '*'
            Action:
              - s3:GetObject
              - s3:PutObject
            Resource:
              Fn::Join:
                - ''
                - - 'arn:aws:s3:::'
                  - Ref: 'ObBucket'
                  - '/*'

  InfraTopic:
    Type: AWS::SNS::Topic
    Properties:
      TopicName: !Sub
        - 'ObInfra-${ResourceSuffix}'
        - ResourceSuffix: !Ref ResourceSuffix
      DisplayName: Infrastructure Notifications

  BusinessTopic:
    Type: AWS::SNS::Topic
    Properties:
      TopicName: !Sub
        - 'ObBusiness-${ResourceSuffix}'
        - ResourceSuffix: !Ref ResourceSuffix
      DisplayName: Business Notifications

  #######################################################
  # Tables
  #######################################################
  ObSessionTable:
    Type: AWS::DynamoDB::Table
    Properties:
      AttributeDefinitions:
        - AttributeName: client_id
          AttributeType: S
        - AttributeName: session_id
          AttributeType: S
      KeySchema:
        - AttributeName: client_id
          KeyType: HASH
        - AttributeName: session_id
          KeyType: RANGE
      ProvisionedThroughput:
        ReadCapacityUnits: 5
        WriteCapacityUnits: 5
      TableName: !Sub
        - 'ObSessionTable-${ResourceSuffix}'
        - ResourceSuffix: !Ref ResourceSuffix
  ObAgentConfigTable:
    Type: AWS::DynamoDB::Table
    Properties:
      AttributeDefinitions:
        - AttributeName: client_id
          AttributeType: S
        - AttributeName: profile_name
          AttributeType: S
      KeySchema:
        - AttributeName: client_id
          KeyType: HASH
        - AttributeName: profile_name
          KeyType: RANGE
      ProvisionedThroughput:
        ReadCapacityUnits: 5
        WriteCapacityUnits: 5
      TableName: !Sub
        - 'ObAgentConfigTable-${ResourceSuffix}'
        - ResourceSuffix: !Ref ResourceSuffix

  ObEventActionTable:
    Type: AWS::DynamoDB::Table
    Properties:
      AttributeDefinitions:
        - AttributeName: action_id
          AttributeType: S
        - AttributeName: session_id
          AttributeType: S
      KeySchema:
        - AttributeName: action_id
          KeyType: HASH
        - AttributeName: session_id
          KeyType: RANGE
      ProvisionedThroughput:
        ReadCapacityUnits: 5
        WriteCapacityUnits: 5
      TableName: !Sub
        - 'ObEventActionTable-${ResourceSuffix}'
        - ResourceSuffix: !Ref ResourceSuffix

  ObClientTable:
    Type: AWS::DynamoDB::Table
    Properties:
      AttributeDefinitions:
        - AttributeName: email
          AttributeType: S
        - AttributeName: leadmo_location_id
          AttributeType: S
      KeySchema:
        - AttributeName: email
          KeyType: HASH
      ProvisionedThroughput:
        ReadCapacityUnits: 5
        WriteCapacityUnits: 5
      TableName: !Sub
        - 'ObClientTable-${ResourceSuffix}'
        - ResourceSuffix: !Ref ResourceSuffix
      GlobalSecondaryIndexes:
        - IndexName: LocationIndex
          KeySchema:
            - AttributeName: leadmo_location_id
              KeyType: HASH
          Projection:
            ProjectionType: ALL
          ProvisionedThroughput:
            ReadCapacityUnits: 5
            WriteCapacityUnits: 5


Outputs:

    ObSessionTableName:
        Description: ObSessionTable
        Value: !Ref ObSessionTable
        Export:
          Name: !Sub '${AWS::StackName}-ObSessionTableName'

    ObAgentConfigTableName:
        Description: ObAgentConfigTable
        Value: !Ref ObAgentConfigTable
        Export:
            Name: !Sub '${AWS::StackName}-ObAgentConfigTableName'

    ObClientTableName:
        Description: ObClientTable
        Value: !Ref ObClientTable
        Export:
            Name: !Sub '${AWS::StackName}-ObClientTableName'

    ObActionTableName:
      Description: ObEventActionTable
      Value: !Ref ObEventActionTable
      Export:
        Name: !Sub '${AWS::StackName}-ObEventActionTableName'

    ObEventActionTableName:
        Description: ObEventActionTable
        Value: !Ref ObEventActionTable
        Export:
            Name: !Sub '${AWS::StackName}-ObActionTableName'




    ObSessionTableArn:
        Description: ObSessionTableArn
        Value: !GetAtt ObSessionTable.Arn
        Export:
            Name: !Sub '${AWS::StackName}-ObSessionTableArn'

    ObAgentConfigTableArn:
        Description: ObAgentConfigTableArn
        Value: !GetAtt ObAgentConfigTable.Arn
        Export:
            Name: !Sub '${AWS::StackName}-ObAgentConfigTableArn'

    ObEventActionTableArn:
        Description: ObEventActionTable
        Value: !GetAtt ObEventActionTable.Arn
        Export:
            Name: !Sub '${AWS::StackName}-ObEventActionTableArn'

    ObActionTableArn:
      Description: ObEventActionTable
      Value: !GetAtt ObEventActionTable.Arn
      Export:
        Name: !Sub '${AWS::StackName}-ObActionTableArn'

    ObClientTableArn:
        Description: ObClientTableArn
        Value: !GetAtt ObClientTable.Arn
        Export:
            Name: !Sub '${AWS::StackName}-ObClientTableArn'

    ObBucketArn:
        Description: ObBucketArn
        Value: !GetAtt ObBucket.Arn
        Export:
            Name: !Sub '${AWS::StackName}-ObBucketArn'



    CommonAccessPolicyArn:
        Description: CommonAccessPolicyArn
        Value: !Ref CommonAccessPolicy
        Export:
            Name: !Sub '${AWS::StackName}-CommonAccessPolicyArn'

    ObBucketName:
        Description: ObBucketName
        Value: !Ref ObBucket
        Export:
            Name: !Sub '${AWS::StackName}-ObBucketName'