user-management.yaml

---
AWSTemplateFormatVersion: "2010-09-09"

Description:
  Creates a Cognito User Pool for the Wild Rydes serverless web application workshop

Parameters:
  WebsiteBucket:
    Type: String
    Description: The name for the bucket hosting your website, e.g. 'wildrydes-yourname.'

Metadata:
  AWS::CloudFormation::Interface:
    ParameterGroups:
      -
        Label:
          default: "Module 1 Details"
        Parameters:
          - WebsiteBucket
    ParameterLabels:
      WebsiteBucket:
        default: "Website Bucket Name"

Resources:

  UserPool:
    Type: AWS::Cognito::UserPool
    Properties:
      UserPoolName: WildRydes
      AliasAttributes:
        - email
      AutoVerifiedAttributes:
        - email

  UserPoolClient:
    Type: AWS::Cognito::UserPoolClient
    Properties:
      ClientName: WildRydesWeb
      UserPoolId: !Ref UserPool
      GenerateSecret: false

  UpdateConfig:
    Properties:
      ServiceToken: !GetAtt UpdateConfigFunction.Arn
      UserPool: !Ref UserPool
      Client: !Ref UserPoolClient
      Region: !Ref "AWS::Region"
      Bucket: !Ref WebsiteBucket
    Type: "Custom::ConfigFile"

  CognitoConfigRole:
    Type: AWS::IAM::Role
    Properties:

      Path: /wildrydes/
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          -
            Effect: Allow
            Principal:
              Service: lambda.amazonaws.com
            Action: sts:AssumeRole
      Policies:
        -
          PolicyName: CognitoConfig
          PolicyDocument:
            Version: 2012-10-17
            Statement:
              -
                Sid: Logging
                Effect: Allow
                Action:
                  - "logs:CreateLogGroup"
                  - "logs:CreateLogStream"
                  - "logs:PutLogEvents"
                Resource: "*"
              -
                Sid: Cognito
                Effect: Allow
                Action:
                  - "cognito-idp:CreateUserPool"
                  - "cognito-idp:DeleteUserPool"
                  - "cognito-idp:CreateUserPoolClient"
                  - "cognito-idp:DeleteUserPoolClient"
                Resource: "*"
              -
                Sid: ConfigBucketWriteAccess
                Effect: Allow
                Action:
                  - "s3:PutObject"
                  - "s3:PutObjectAcl"
                  - "s3:PutObjectVersionAcl"
                Resource:
                  - !Sub "arn:aws:s3:::${WebsiteBucket}/*"

  UpdateConfigFunction:
    Properties:
      Description: Updates object on S3 for client-side configuration
      Handler: index.handler
      Runtime: python2.7
      Role: !GetAtt CognitoConfigRole.Arn
      Timeout: 120
      Code:
        ZipFile: |
          import json
          import boto3
          import cfnresponse

          s3 = boto3.resource('s3')

          def create(properties, physical_id):
            userPoolId = properties['UserPool']
            clientId = properties['Client']
            region = properties['Region']
            bucket = properties['Bucket']

            object = s3.Object(bucket, 'js/config.js')
            config_content = """
          var _config = {
              cognito: {
                  userPoolId: '%s', // e.g. us-east-2_uXboG5pAb
                  userPoolClientId: '%s', // e.g. 25ddkmj4v6hfsfvruhpfi7n4hv
                  region: '%s', // e.g. us-east-2
              },
              api: {
                  invokeUrl: '', // Base URL of your API including the stage, e.g. 'https://rc7nyt4tql.execute-api.us-west-2.amazonaws.com/prod'
              }
          };
              """
            config_content = config_content % (userPoolId, clientId, region)
            config = s3.Object(bucket,'js/config.js')
            config.put(Body=config_content)
            return cfnresponse.SUCCESS, None

          def update(properties, physical_id):
            return create(properties, physical_id)

          def delete(properties, physical_id):
            return cfnresponse.SUCCESS, physical_id

          def handler(event, context):
            print "Received event: %s" % json.dumps(event)

            status = cfnresponse.FAILED
            new_physical_id = None

            try:
              properties = event.get('ResourceProperties')
              physical_id = event.get('PhysicalResourceId')

              status, new_physical_id = {
                'Create': create,
                'Update': update,
                'Delete': delete
              }.get(event['RequestType'], lambda x, y: (cfnresponse.FAILED, None))(properties, physical_id)
            except Exception as e:
              print "Exception: %s" % e
              status = cfnresponse.FAILED
            finally:
              cfnresponse.send(event, context, status, {}, new_physical_id)


    Type: AWS::Lambda::Function