template.yaml

# This is the SAM template that represents the architecture of your serverless application
# https://docs.aws.amazon.com/serverless-application-model/latest/developerguide/serverless-sam-template-basics.html

# The AWSTemplateFormatVersion identifies the capabilities of the template
# https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/format-version-structure.html
AWSTemplateFormatVersion: 2010-09-09
Description: >-
  developer-sailpoint-site
# Transform section specifies one or more macros that AWS CloudFormation uses to process your template
# https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/transform-section-structure.html
Transform:
- AWS::Serverless-2016-10-31

# Resources declares the AWS resources that you want to include in the stack
# https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/resources-section-structure.html
Resources:
  # Each Lambda function is defined by properties:
  # https://github.com/awslabs/serverless-application-model/blob/master/versions/2016-10-31.md#awsserverlessfunction

  # This is an API gateway associated with the developerSailpointGetByIdFunction and developerSailpointPutItemFunctions

  MessageApiAuthRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: "Allow"
            Principal:
              Service:
                - "apigateway.amazonaws.com"
            Action:
              - sts:AssumeRole
      Policies:
        - PolicyName: "InvokeMessageAuthFunction"
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Effect: "Allow"
                Action:
                  - lambda:InvokeAsync
                  - lambda:InvokeFunction
                Resource: !GetAtt DeveloperSailpointAuthFunction.Arn
  DeveloperSailpointApiGatewayApiv2:
    Type: AWS::Serverless::HttpApi
    Properties:
      StageName: Prod
      CorsConfiguration:
        AllowMethods: 
          - "OPTIONS"
          - "GET"
          - "POST"
        AllowHeaders: 
          - "Content-Type"
        AllowOrigins:
          - "https://developer.sailpoint.com"
      DefaultRouteSettings:
        DetailedMetricsEnabled: true
      Auth:
        DefaultAuthorizer: LambdaAuthorizer
        Authorizers:
          LambdaAuthorizer:
            FunctionPayloadType: REQUEST
            FunctionArn: !GetAtt DeveloperSailpointAuthFunction.Arn
            FunctionInvokeRole: !GetAtt MessageApiAuthRole.Arn
            Identity:
              Headers:
                - Authorization
            AuthorizerPayloadFormatVersion: 2.0
            EnableSimpleResponses: false
  DeveloperSailpointAuthFunction:
    Type: AWS::Serverless::Function
    Properties:
      Environment:
        Variables:
          AUTH_USERNAME: !Ref AuthUsername
          AUTH_PASSWORD: !Ref AuthPassword
      CodeUri: backend/src/auth/
      Handler: index.authHandler
      Runtime: nodejs18.x
      Architectures:
        - x86_64
      MemorySize: 128
      Timeout: 100
  # This is a Lambda function config associated with the source code: get-by-id.js
  developerSailpointGetByIdFunction:
    Type: AWS::Serverless::Function
    Properties:
      CodeUri: backend/src/handlers/
      Handler: get-by-id.getByIdHandler
      Runtime: nodejs18.x
      Architectures:
        - x86_64
      MemorySize: 128
      Timeout: 100
      Description: A simple example includes a HTTP get method to get one item by id from a DynamoDB table.
      Policies:
        # Give Create/Read/Update/Delete Permissions to the CMSTable
        - DynamoDBCrudPolicy:
            TableName: !Ref CMSTable
      Environment:
        Variables:
          # Make table name accessible as environment variable from function code during execution
          SAMPLE_TABLE: !Ref CMSTable
          # Make DynamoDB endpoint accessible as environment variable from function code during execution
          ENDPOINT_OVERRIDE: ""
      Events:
        Api:
          Type: HttpApi
          Properties:
            Path: /{id}
            Method: GET
            ApiId:
              Ref: DeveloperSailpointApiGatewayApiv2
            Auth:
              Authorizer: NONE
  # Each Lambda function is defined by properties:
  # https://github.com/awslabs/serverless-application-model/blob/master/versions/2016-10-31.md#awsserverlessfunction
  # DynamoDB table to store item: {id: <ID>, name: <NAME>}
  CMSTable:
    Type: AWS::Serverless::SimpleTable
    Properties:
      PrimaryKey:
        Name: id
        Type: String
      ProvisionedThroughput:
        ReadCapacityUnits: 20
        WriteCapacityUnits: 2
  # S3 Bucket to host single page app website
  DeveloperSailpointWebSiteBucket:
    Type: "AWS::S3::Bucket"
    Properties:
      BucketEncryption:
        ServerSideEncryptionConfiguration:
          - BucketKeyEnabled: true
      WebsiteConfiguration:
        IndexDocument: index.html
        ErrorDocument: 404.html
      PublicAccessBlockConfiguration:
        BlockPublicAcls: false
        BlockPublicPolicy: false
        IgnorePublicAcls: false
        RestrictPublicBuckets: false
  DeveloperSailpointWebSiteBucketPolicy:
    Type: "AWS::S3::BucketPolicy"
    Properties:
      Bucket: !Ref DeveloperSailpointWebSiteBucket
      PolicyDocument:
        Version: "2012-10-17"
        Id: "PolicyForCloudFrontPrivateContent"
        Statement:
        - Sid: "AllowCloudFrontServicePrincipal"
          Effect: "Allow"
          Principal:
            Service: "cloudfront.amazonaws.com"
          Action: "s3:GetObject"
          Resource: !Join [ "", [ "arn:aws:s3:::", !Ref DeveloperSailpointWebSiteBucket, "/*" ] ]
          Condition:
            StringEquals:
              "AWS:SourceArn": !Join [ "", [ "arn:aws:cloudfront::", !Ref "AWS::AccountId", ":distribution/", !Ref DeveloperSailpointCloudFrontDistribution ] ]
        - Sid: "PublicReadGetObject"
          Effect: "Allow"
          Principal: "*"
          Action:
            - "s3:GetObject"
          Resource: !Join [ "", [ "arn:aws:s3:::", !Ref DeveloperSailpointWebSiteBucket, "/*" ] ]
  # CloudFront Distribution for hosting the single page app website
  DeveloperSailpointCloudFrontDistribution:
    Type: "AWS::CloudFront::Distribution"
    Properties:
      DistributionConfig:
        Origins:
        - DomainName: !Join ["", [!Ref DeveloperSailpointWebSiteBucket, ".s3-website-", !Ref "AWS::Region", ".amazonaws.com"]]
          Id: "DeveloperSailpointWebS3Origin"
          CustomOriginConfig:
            OriginProtocolPolicy: "http-only"
        Enabled: true
        DefaultRootObject: "index.html"
        HttpVersion: "http2"
        DefaultCacheBehavior:
          AllowedMethods:
          - "DELETE"
          - "GET"
          - "HEAD"
          - "OPTIONS"
          - "PATCH"
          - "POST"
          - "PUT"
          CachedMethods:
          - "GET"
          - "HEAD"
          TargetOriginId: "DeveloperSailpointWebS3Origin"
          ForwardedValues:
            QueryString: false
            Cookies:
              Forward: "none"
          ViewerProtocolPolicy: "allow-all"
          MinTTL: 0
          DefaultTTL: 3600
          MaxTTL: 86400
        PriceClass: "PriceClass_200"
        Restrictions:
          GeoRestriction:
            RestrictionType: "whitelist"
            Locations:
            - "US"
            - "CA"
            - "GB"
            - "DE"
        ViewerCertificate:
          CloudFrontDefaultCertificate: true
  CloudFrontOriginAccessControl:
    Type: "AWS::CloudFront::OriginAccessControl"
    Properties:
      OriginAccessControlConfig:
        Name: !Sub "${AWS::StackName}-OAC"
        OriginAccessControlOriginType: "s3"
        SigningBehavior: "always"
        SigningProtocol: "sigv4"
Parameters:
  AuthUsername:
    Type: String
    Description: Username for basic auth
  AuthPassword:
    Type: String
    Description: Password for basic auth
Outputs:
  DeveloperSailpointAPIGatewayEndpoint:
    Description: "API Gateway endpoint URL for Prod stage"
    Value: !Sub "https://${DeveloperSailpointApiGatewayApiv2}.execute-api.${AWS::Region}.amazonaws.com/Prod/"
  DeveloperSailpointCloudFrontDistributionId:
    Description: "CloudFront Distribution ID for hosting web front end"
    Value: !Ref DeveloperSailpointCloudFrontDistribution
  DeveloperSailpointCloudFrontDistributionDomainName:
    Description: "CloudFront Distribution Domain Name for accessing web front end"
    Value: !GetAtt DeveloperSailpointCloudFrontDistribution.DomainName
  DeveloperSailpointWebS3BucketName:
    Description: "S3 Bucket for hosting web frontend"
    Value: !Ref DeveloperSailpointWebSiteBucket
  ApiGatewayRestApiId:
    Description: "API Gateway endpoint URL for Prod stage"
    Value: !Ref DeveloperSailpointApiGatewayApiv2