serverless.yml

service: appsyncmasterclass-backend
frameworkVersion: '2'

plugins:
  - serverless-appsync-plugin
  - serverless-iam-roles-per-function
  - serverless-export-env
  - serverless-layers
  - serverless-plugin-ifelse
  - serverless-lumigo

provider:
  name: aws
  runtime: nodejs12.x
  region: eu-west-1
  tracing:
    lambda: true
    apiGateway: false
  environment:
    STAGE: ${self:custom.stage}
    AWS_NODEJS_CONNECTION_REUSE_ENABLED: "1"
  iamRoleStatements:
    - Effect: Allow
      Action:
        - xray:PutTraceSegments
        - xray:PutTelemetryRecords
      Resource: '*'

package:
  exclude:
    - package-lock.json
    - package.json

custom:
  serverless-iam-roles-per-function:
    defaultInherit: true

  region: ${opt:region, self:provider.region}
  stage: ${opt:stage, self:provider.stage}
  appSync:
    - ${file(serverless.appsync-api.yml)}

  serverless-layers:
    layersDeploymentBucket: ${ssm:/appsyncmasterclass/${self:custom.stage}/layer-deployment-bucket}

  appSyncLogLevel:
    default: ALL
    prod: ERROR

  appSyncCaching:
    default:
    prod:
      behavior: PER_RESOLVER_CACHING
      ttl: 3600
      type: T2_SMALL

  serverlessIfElse:
    - If: '"${self:custom.stage}" == "prod"'
      ElseExclude:
        - functions.setResolverLogLevelToAll
        - functions.setResolverLogLevelToError

  lumigo:
    token: ${ssm:/${self:custom.stage}/lumigo-token~true}
    skipInstallNodeTracer: true

functions:
  confirmUserSignup:
    handler: functions/confirm-user-signup.handler
    environment:
      USERS_TABLE: !Ref UsersTable
    iamRoleStatements:
      - Effect: Allow
        Action: dynamodb:PutItem
        Resource: !GetAtt UsersTable.Arn

  getImageUploadUrl:
    handler: functions/get-upload-url.handler
    environment:
      BUCKET_NAME: !Ref AssetsBucket
    iamRoleStatements:
      - Effect: Allow
        Action:
          - s3:PutObject
          - s3:PutObjectAcl
        Resource: !Sub ${AssetsBucket.Arn}/*

  tweet:
    handler: functions/tweet.handler
    environment:
      USERS_TABLE: !Ref UsersTable
      TWEETS_TABLE: !Ref TweetsTable
      TIMELINES_TABLE: !Ref TimelinesTable
    iamRoleStatements:
      - Effect: Allow
        Action: dynamodb:UpdateItem
        Resource: !GetAtt UsersTable.Arn
      - Effect: Allow
        Action: dynamodb:PutItem
        Resource:
          - !GetAtt TweetsTable.Arn
          - !GetAtt TimelinesTable.Arn

  retweet:
    handler: functions/retweet.handler
    environment:
      USERS_TABLE: !Ref UsersTable
      TWEETS_TABLE: !Ref TweetsTable
      TIMELINES_TABLE: !Ref TimelinesTable
      RETWEETS_TABLE: !Ref RetweetsTable
    iamRoleStatements:
      - Effect: Allow
        Action: dynamodb:GetItem
        Resource: !GetAtt TweetsTable.Arn
      - Effect: Allow
        Action: dynamodb:UpdateItem
        Resource: 
          - !GetAtt TweetsTable.Arn
          - !GetAtt UsersTable.Arn
      - Effect: Allow
        Action: dynamodb:PutItem
        Resource:
          - !GetAtt TweetsTable.Arn
          - !GetAtt TimelinesTable.Arn
          - !GetAtt RetweetsTable.Arn

  reply:
    handler: functions/reply.handler
    environment:
      USERS_TABLE: !Ref UsersTable
      TWEETS_TABLE: !Ref TweetsTable
      TIMELINES_TABLE: !Ref TimelinesTable
    iamRoleStatements:
      - Effect: Allow
        Action: dynamodb:GetItem
        Resource: !GetAtt TweetsTable.Arn
      - Effect: Allow
        Action: dynamodb:UpdateItem
        Resource: 
          - !GetAtt TweetsTable.Arn
          - !GetAtt UsersTable.Arn
      - Effect: Allow
        Action: dynamodb:PutItem
        Resource:
          - !GetAtt TweetsTable.Arn
          - !GetAtt TimelinesTable.Arn

  unretweet:
    handler: functions/unretweet.handler
    environment:
      USERS_TABLE: !Ref UsersTable
      TWEETS_TABLE: !Ref TweetsTable
      TIMELINES_TABLE: !Ref TimelinesTable
      RETWEETS_TABLE: !Ref RetweetsTable
    iamRoleStatements:
      - Effect: Allow
        Action: dynamodb:GetItem
        Resource: !GetAtt TweetsTable.Arn
      - Effect: Allow
        Action: dynamodb:Query
        Resource: !Sub "${TweetsTable.Arn}/index/retweetsByCreator"
      - Effect: Allow
        Action: dynamodb:UpdateItem
        Resource: 
          - !GetAtt TweetsTable.Arn
          - !GetAtt UsersTable.Arn
      - Effect: Allow
        Action: dynamodb:DeleteItem
        Resource:
          - !GetAtt TweetsTable.Arn
          - !GetAtt TimelinesTable.Arn
          - !GetAtt RetweetsTable.Arn

  distributeTweets:
    handler: functions/distribute-tweets.handler
    environment:
      RELATIONSHIPS_TABLE: !Ref RelationshipsTable
      TIMELINES_TABLE: !Ref TimelinesTable
    events:
      - stream:
          type: dynamodb
          arn: !GetAtt TweetsTable.StreamArn
    iamRoleStatements:
      - Effect: Allow
        Action: 
          - dynamodb:PutItem
          - dynamodb:DeleteItem
          - dynamodb:BatchWriteItem
        Resource: !GetAtt TimelinesTable.Arn
      - Effect: Allow
        Action: dynamodb:Query
        Resource: !Sub "${RelationshipsTable.Arn}/index/byOtherUser"

  distributeTweetsToFollower:
    handler: functions/distribute-tweets-to-follower.handler
    environment:
      TWEETS_TABLE: !Ref TweetsTable
      TIMELINES_TABLE: !Ref TimelinesTable
      MAX_TWEETS: "100"
    events:
      - stream:
          type: dynamodb
          arn: !GetAtt RelationshipsTable.StreamArn
    iamRoleStatementsName: ${self:service}-${self:custom.stage}-distributeTweetsToFollower
    iamRoleStatements:
      - Effect: Allow
        Action: dynamodb:Query
        Resource:
          - !Sub "${TweetsTable.Arn}/index/byCreator"
          - !Sub "${TimelinesTable.Arn}/index/byDistributedFrom"
      - Effect: Allow
        Action: 
          - dynamodb:BatchWriteItem
          - dynamodb:PutItem
          - dynamodb:DeleteItem
        Resource: !GetAtt TimelinesTable.Arn

  syncUsersToAlgolia:
    handler: functions/sync-users-to-algolia.handler
    events:
      - stream:
          type: dynamodb
          arn: !GetAtt UsersTable.StreamArn
    iamRoleStatements:
      - Effect: Allow
        Action: ssm:GetParameters
        Resource:
          - !Sub arn:aws:ssm:${AWS::Region}:${AWS::AccountId}:parameter/${self:custom.stage}/algolia-app-id
          - !Sub arn:aws:ssm:${AWS::Region}:${AWS::AccountId}:parameter/${self:custom.stage}/algolia-admin-key

  syncTweetsToAlgolia:
    handler: functions/sync-tweets-to-algolia.handler
    events:
      - stream:
          type: dynamodb
          arn: !GetAtt TweetsTable.StreamArn
    iamRoleStatements:
      - Effect: Allow
        Action: ssm:GetParameters
        Resource:
          - !Sub arn:aws:ssm:${AWS::Region}:${AWS::AccountId}:parameter/${self:custom.stage}/algolia-app-id
          - !Sub arn:aws:ssm:${AWS::Region}:${AWS::AccountId}:parameter/${self:custom.stage}/algolia-admin-key

  search:
    handler: functions/search.handler
    iamRoleStatements:
      - Effect: Allow
        Action: ssm:GetParameters
        Resource:
          - !Sub arn:aws:ssm:${AWS::Region}:${AWS::AccountId}:parameter/${self:custom.stage}/algolia-app-id
          - !Sub arn:aws:ssm:${AWS::Region}:${AWS::AccountId}:parameter/${self:custom.stage}/algolia-admin-key

  getHashTag:
    handler: functions/get-hash-tag.handler
    iamRoleStatements:
      - Effect: Allow
        Action: ssm:GetParameters
        Resource:
          - !Sub arn:aws:ssm:${AWS::Region}:${AWS::AccountId}:parameter/${self:custom.stage}/algolia-app-id
          - !Sub arn:aws:ssm:${AWS::Region}:${AWS::AccountId}:parameter/${self:custom.stage}/algolia-admin-key

  notify:
    handler: functions/notify.handler
    environment:
      GRAPHQL_API_URL: !GetAtt AppsyncmasterclassGraphQlApi.GraphQLUrl
      TWEETS_TABLE: !Ref TweetsTable
      USERS_TABLE: !Ref UsersTable
    events:
      - stream:
          type: dynamodb
          arn: !GetAtt TweetsTable.StreamArn
    iamRoleStatements:
      - Effect: Allow
        Action: appsync:GraphQL
        Resource: !Sub ${AppsyncmasterclassGraphQlApi.Arn}/*
      - Effect: Allow
        Action: dynamodb:GetItem
        Resource: !GetAtt TweetsTable.Arn
      - Effect: Allow
        Action: dynamodb:Query
        Resource: !Sub ${UsersTable.Arn}/index/byScreenName

  notifyLiked:
    handler: functions/notify-liked.handler
    environment:
      GRAPHQL_API_URL: !GetAtt AppsyncmasterclassGraphQlApi.GraphQLUrl
      TWEETS_TABLE: !Ref TweetsTable
    events:
      - stream:
          type: dynamodb
          arn: !GetAtt LikesTable.StreamArn
    iamRoleStatements:
      - Effect: Allow
        Action: appsync:GraphQL
        Resource: !Sub ${AppsyncmasterclassGraphQlApi.Arn}/*
      - Effect: Allow
        Action: dynamodb:GetItem
        Resource: !GetAtt TweetsTable.Arn

  notifyDmed:
    handler: functions/notify-dmed.handler
    environment:
      GRAPHQL_API_URL: !GetAtt AppsyncmasterclassGraphQlApi.GraphQLUrl
    events:
      - stream:
          type: dynamodb
          arn: !GetAtt DirectMessagesTable.StreamArn
    iamRoleStatements:
      - Effect: Allow
        Action: appsync:GraphQL
        Resource: !Sub ${AppsyncmasterclassGraphQlApi.Arn}/*

  sendDirectMessage:
    handler: functions/send-direct-message.handler
    environment:
      CONVERSATIONS_TABLE: !Ref ConversationsTable
      DIRECT_MESSAGES_TABLE: !Ref DirectMessagesTable
    iamRoleStatements:
      - Effect: Allow
        Action: dynamodb:PutItem
        Resource: !GetAtt DirectMessagesTable.Arn
      - Effect: Allow
        Action: dynamodb:UpdateItem
        Resource: !GetAtt ConversationsTable.Arn

  getTweetCreator:
    handler: functions/get-tweet-creator.handler
    environment:
      USERS_TABLE: !Ref UsersTable
    iamRoleStatements:
      - Effect: Allow
        Action: dynamodb:BatchGetItem
        Resource: !GetAtt UsersTable.Arn

  firehoseTransformer:
    handler: functions/firehose-transformer.handler
    timeout: 61

  setResolverLogLevelToAll:
    handler: functions/set-resolver-log-level.handler
    events:
      - schedule: cron(6 * * * ? *) # 6 mins past the hour every hour
    environment:
      APPSYNC_API_ID: !GetAtt AppsyncmasterclassGraphQlApi.ApiId
      FIELD_LOG_LEVEL: ALL
    iamRoleStatementsName: ${self:service}-${self:custom.stage}-setLogLevelToAll
    iamRoleStatements:
      - Effect: Allow
        Action:
          - appsync:GetGraphqlApi
          - appsync:UpdateGraphqlApi
        Resource: !Ref AppsyncmasterclassGraphQlApi
      - Effect: Allow
        Action: iam:PassRole
        Resource: !GetAtt AppSyncLoggingServiceRole.Arn

  setResolverLogLevelToError:
    handler: functions/set-resolver-log-level.handler
    events:
      - schedule: cron(12 * * * ? *) # 12 mins past the hour every hour
    environment:
      APPSYNC_API_ID: !GetAtt AppsyncmasterclassGraphQlApi.ApiId
      FIELD_LOG_LEVEL: ERROR
    iamRoleStatementsName: ${self:service}-${self:custom.stage}-setLogLevelToErr
    iamRoleStatements:
      - Effect: Allow
        Action:
          - appsync:GetGraphqlApi
          - appsync:UpdateGraphqlApi
        Resource: !Ref AppsyncmasterclassGraphQlApi
      - Effect: Allow
        Action: iam:PassRole
        Resource: !GetAtt AppSyncLoggingServiceRole.Arn

resources:
  Resources:
    UsersTable:
      Type: AWS::DynamoDB::Table
      Properties:
        BillingMode: PAY_PER_REQUEST
        KeySchema:
          - AttributeName: id
            KeyType: HASH
        AttributeDefinitions:
          - AttributeName: id
            AttributeType: S
          - AttributeName: screenName
            AttributeType: S
        GlobalSecondaryIndexes:
          - IndexName: byScreenName
            KeySchema:
              - AttributeName: screenName
                KeyType: HASH
            Projection:
              ProjectionType: ALL
        StreamSpecification:
          StreamViewType: NEW_AND_OLD_IMAGES
        Tags:
          - Key: Environment
            Value: ${self:custom.stage}
          - Key: Name
            Value: users-table

    TweetsTable:
      Type: AWS::DynamoDB::Table
      Properties:
        BillingMode: PAY_PER_REQUEST
        KeySchema:
          - AttributeName: id
            KeyType: HASH
        AttributeDefinitions:
          - AttributeName: id
            AttributeType: S
          - AttributeName: creator
            AttributeType: S
          - AttributeName: retweetOf
            AttributeType: S
          - AttributeName: inReplyToTweetId
            AttributeType: S
        GlobalSecondaryIndexes:
          - IndexName: byCreator
            KeySchema:
              - AttributeName: creator
                KeyType: HASH
              - AttributeName: id
                KeyType: RANGE
            Projection:
              ProjectionType: ALL
          - IndexName: retweetsByCreator
            KeySchema:
              - AttributeName: creator
                KeyType: HASH
              - AttributeName: retweetOf
                KeyType: RANGE
            Projection:
              ProjectionType: ALL
          - IndexName: repliesForTweet
            KeySchema:
              - AttributeName: inReplyToTweetId
                KeyType: HASH
              - AttributeName: id
                KeyType: RANGE
            Projection:
              ProjectionType: ALL
        StreamSpecification:
          StreamViewType: NEW_AND_OLD_IMAGES
        Tags:
          - Key: Environment
            Value: ${self:custom.stage}
          - Key: Name
            Value: tweets-table

    TimelinesTable:
      Type: AWS::DynamoDB::Table
      Properties:
        BillingMode: PAY_PER_REQUEST
        KeySchema:
          - AttributeName: userId
            KeyType: HASH
          - AttributeName: tweetId
            KeyType: RANGE
        AttributeDefinitions:
          - AttributeName: userId
            AttributeType: S
          - AttributeName: tweetId
            AttributeType: S
          - AttributeName: distributedFrom
            AttributeType: S
        GlobalSecondaryIndexes:
          - IndexName: byDistributedFrom
            KeySchema:
              - AttributeName: userId
                KeyType: HASH
              - AttributeName: distributedFrom
                KeyType: RANGE
            Projection:
              ProjectionType: ALL
        Tags:
          - Key: Environment
            Value: ${self:custom.stage}
          - Key: Name
            Value: timelines-table

    LikesTable:
      Type: AWS::DynamoDB::Table
      Properties:
        BillingMode: PAY_PER_REQUEST
        KeySchema:
          - AttributeName: userId
            KeyType: HASH
          - AttributeName: tweetId
            KeyType: RANGE
        AttributeDefinitions:
          - AttributeName: userId
            AttributeType: S
          - AttributeName: tweetId
            AttributeType: S
        StreamSpecification:
          StreamViewType: NEW_AND_OLD_IMAGES
        Tags:
          - Key: Environment
            Value: ${self:custom.stage}
          - Key: Name
            Value: likes-table

    RetweetsTable:
      Type: AWS::DynamoDB::Table
      Properties:
        BillingMode: PAY_PER_REQUEST
        KeySchema:
          - AttributeName: userId
            KeyType: HASH
          - AttributeName: tweetId
            KeyType: RANGE
        AttributeDefinitions:
          - AttributeName: userId
            AttributeType: S
          - AttributeName: tweetId
            AttributeType: S
        Tags:
          - Key: Environment
            Value: ${self:custom.stage}
          - Key: Name
            Value: retweets-table

    RelationshipsTable:
      Type: AWS::DynamoDB::Table
      Properties:
        BillingMode: PAY_PER_REQUEST
        KeySchema:
          - AttributeName: userId
            KeyType: HASH
          - AttributeName: sk
            KeyType: RANGE
        AttributeDefinitions:
          - AttributeName: userId
            AttributeType: S
          - AttributeName: sk
            AttributeType: S
          - AttributeName: otherUserId
            AttributeType: S
        GlobalSecondaryIndexes:
          - IndexName: byOtherUser
            KeySchema:
              - AttributeName: otherUserId
                KeyType: HASH
              - AttributeName: sk
                KeyType: RANGE
            Projection:
              ProjectionType: ALL
        StreamSpecification:
          StreamViewType: NEW_AND_OLD_IMAGES
        Tags:
          - Key: Environment
            Value: ${self:custom.stage}
          - Key: Name
            Value: relationships-table
            
    NotificationsTable:
      Type: AWS::DynamoDB::Table
      Properties:
        BillingMode: PAY_PER_REQUEST
        KeySchema:
          - AttributeName: id
            KeyType: HASH
          - AttributeName: userId
            KeyType: RANGE
        AttributeDefinitions:
          - AttributeName: id
            AttributeType: S
          - AttributeName: userId
            AttributeType: S
        GlobalSecondaryIndexes:
          - IndexName: byUserId
            KeySchema:
              - AttributeName: userId
                KeyType: HASH
              - AttributeName: id
                KeyType: RANGE
            Projection:
              ProjectionType: ALL
        Tags:
          - Key: Environment
            Value: ${self:custom.stage}
          - Key: Name
            Value: notifications-table            
           
    ConversationsTable:
      Type: AWS::DynamoDB::Table
      Properties:
        BillingMode: PAY_PER_REQUEST
        KeySchema:
          - AttributeName: userId
            KeyType: HASH
          - AttributeName: otherUserId
            KeyType: RANGE
        AttributeDefinitions:
          - AttributeName: userId
            AttributeType: S
          - AttributeName: otherUserId
            AttributeType: S
          - AttributeName: lastModified
            AttributeType: S
        GlobalSecondaryIndexes:
          - IndexName: byUserId
            KeySchema:
              - AttributeName: userId
                KeyType: HASH
              - AttributeName: lastModified
                KeyType: RANGE
            Projection:
              ProjectionType: ALL
        Tags:
          - Key: Environment
            Value: ${self:custom.stage}
          - Key: Name
            Value: conversations-table  
           
    DirectMessagesTable:
      Type: AWS::DynamoDB::Table
      Properties:
        BillingMode: PAY_PER_REQUEST
        KeySchema:
          - AttributeName: conversationId
            KeyType: HASH
          - AttributeName: messageId
            KeyType: RANGE
        AttributeDefinitions:
          - AttributeName: conversationId
            AttributeType: S
          - AttributeName: messageId
            AttributeType: S
        StreamSpecification:
          StreamViewType: NEW_AND_OLD_IMAGES
        Tags:
          - Key: Environment
            Value: ${self:custom.stage}
          - Key: Name
            Value: direct-messages-table  

    CognitoUserPool:
      Type: AWS::Cognito::UserPool
      Properties:
        AutoVerifiedAttributes:
          - email
        Policies:
          PasswordPolicy:
            MinimumLength: 8
            RequireLowercase: false
            RequireNumbers: false
            RequireUppercase: false
            RequireSymbols: false
        UsernameAttributes:
          - email
        Schema:
          - AttributeDataType: String
            Name: name
            Required: false
            Mutable: true
        LambdaConfig:
          PostConfirmation: !GetAtt ConfirmUserSignupLambdaFunction.Arn

    UserPoolInvokeConfirmUserSignupLambdaPermission:
      Type: AWS::Lambda::Permission
      Properties:
        Action: lambda:invokeFunction
        FunctionName: !Ref ConfirmUserSignupLambdaFunction
        Principal: cognito-idp.amazonaws.com
        SourceArn: !GetAtt CognitoUserPool.Arn

    WebUserPoolClient:
      Type: AWS::Cognito::UserPoolClient
      Properties:
        UserPoolId: !Ref CognitoUserPool
        ClientName: web
        ExplicitAuthFlows:
          - ALLOW_USER_SRP_AUTH
          - ALLOW_USER_PASSWORD_AUTH
          - ALLOW_REFRESH_TOKEN_AUTH
        PreventUserExistenceErrors: ENABLED

    AssetsBucket:
      Type: AWS::S3::Bucket
      Properties:
        AccelerateConfiguration:
          AccelerationStatus: Enabled
        CorsConfiguration:
          CorsRules:
            - AllowedMethods:
                - GET
                - PUT
              AllowedOrigins:
                - '*'
              AllowedHeaders:
                - '*'

    AnalyticsBucket:
      Type: AWS::S3::Bucket
      Properties:
        PublicAccessBlockConfiguration:
          BlockPublicAcls: true
          BlockPublicPolicy: true
          IgnorePublicAcls: true
          RestrictPublicBuckets: true

    FirehoseStream:
      Type: AWS::KinesisFirehose::DeliveryStream
      Properties:
        DeliveryStreamType: DirectPut
        ExtendedS3DestinationConfiguration:
          BucketARN: !GetAtt AnalyticsBucket.Arn
          BufferingHints:
            IntervalInSeconds: 60
            SizeInMBs: 1
          CloudWatchLoggingOptions:
            Enabled: true
            LogGroupName: !Ref FirehoseLogGroup
            LogStreamName: !Ref FirehoseLogStream
          CompressionFormat: GZIP
          RoleARN: !GetAtt FirehoseDeliveryIamRole.Arn
          Prefix: analytics/year=!{timestamp:yyyy}/month=!{timestamp:MM}/day=!{timestamp:dd}/hour=!{timestamp:HH}/
          ErrorOutputPrefix: analytics_errors/year=!{timestamp:yyyy}/month=!{timestamp:MM}/day=!{timestamp:dd}/hour=!{timestamp:HH}/!{firehose:error-output-type}
          ProcessingConfiguration:
            Enabled: true
            Processors:
              - Type: Lambda
                Parameters:
                  - ParameterName: LambdaArn
                    ParameterValue: !GetAtt FirehoseTransformerLambdaFunction.Arn

    FirehoseLogGroup:
      Type: AWS::Logs::LogGroup
      Properties:
        RetentionInDays: 14

    FirehoseLogStream:
      Type: AWS::Logs::LogStream
      Properties:
        LogGroupName:
          Ref: FirehoseLogGroup

    FirehoseDeliveryIamRole:
      Type: AWS::IAM::Role
      Properties:
        AssumeRolePolicyDocument:
          Version: "2012-10-17"
          Statement:
            - Effect: Allow
              Principal:
                Service: firehose.amazonaws.com
              Action: sts:AssumeRole
        Path: "/"
        Policies:
          - PolicyName: root
            PolicyDocument:
              Version: "2012-10-17"
              Statement:
                - Effect: Allow
                  Action:
                    - s3:AbortMultipartUpload
                    - s3:GetBucketLocation
                    - s3:GetObject
                    - s3:ListBucket
                    - s3:ListBucketMultipartUploads
                    - s3:PutObject
                  Resource:
                    - !GetAtt AnalyticsBucket.Arn
                    - !Sub ${AnalyticsBucket.Arn}/*
                - Effect: Allow
                  Action: logs:PutLogEvents
                  Resource: !Sub arn:aws:logs:${AWS::Region}:${AWS::AccountId}:log-group:${FirehoseLogGroup}:log-stream:*
                - Effect: Allow
                  Action:
                    - lambda:InvokeFunction
                    - lambda:GetFunctionConfiguration
                  Resource: !GetAtt FirehoseTransformerLambdaFunction.Arn

    IdentityPool:
      Type: AWS::Cognito::IdentityPool
      Properties:
        AllowUnauthenticatedIdentities: true
        AllowClassicFlow: false
        CognitoIdentityProviders:
          - ClientId: !Ref WebUserPoolClient
            ProviderName: !GetAtt CognitoUserPool.ProviderName
            ServerSideTokenCheck: true

    UnauthedClientRole:
      Type: AWS::IAM::Role
      Properties:
        AssumeRolePolicyDocument:
          Version: "2012-10-17"
          Statement:
            - Effect: Allow
              Principal:
                Federated: cognito-identity.amazonaws.com
              Action: sts:AssumeRoleWithWebIdentity
              Condition:
                StringEquals:
                  cognito-identity.amazonaws.com:aud: !Ref IdentityPool
                ForAnyValue:StringLike:
                  cognito-identity.amazonaws.com:amr: unauthenticated
        Policies:
          - PolicyName: CognitoPolicy
            PolicyDocument:
              Version: "2012-10-17"
              Statement:
                - Effect: Allow
                  Action:
                    - firehose:PutRecord
                    - firehose:PutRecordBatch
                  Resource: !GetAtt FirehoseStream.Arn
                - Effect: Allow
                  Action: appsync:GraphQL
                  Resource: 
                    - !Sub ${AppsyncmasterclassGraphQlApi.Arn}/types/Query/fields/getAnalyticsConfig
                    - !Sub ${AppsyncmasterclassGraphQlApi.Arn}/types/AnalyticsConfig

    AuthedClientRole:
      Type: AWS::IAM::Role
      Properties:
        AssumeRolePolicyDocument:
          Version: "2012-10-17"
          Statement:
            - Effect: Allow
              Principal:
                Federated: cognito-identity.amazonaws.com
              Action: sts:AssumeRoleWithWebIdentity
              Condition:
                StringEquals:
                  cognito-identity.amazonaws.com:aud: !Ref IdentityPool
                ForAnyValue:StringLike:
                  cognito-identity.amazonaws.com:amr: authenticated
        Policies:
          - PolicyName: CognitoPolicy
            PolicyDocument:
              Version: "2012-10-17"
              Statement:
                - Effect: Allow
                  Action:
                    - firehose:PutRecord
                    - firehose:PutRecordBatch
                  Resource: !GetAtt FirehoseStream.Arn
                - Effect: Allow
                  Action: appsync:GraphQL
                  Resource: 
                    - !Sub ${AppsyncmasterclassGraphQlApi.Arn}/types/Query/fields/getAnalyticsConfig
                    - !Sub ${AppsyncmasterclassGraphQlApi.Arn}/types/AnalyticsConfig

    IdentityPoolRoleMapping:
      Type: AWS::Cognito::IdentityPoolRoleAttachment
      Properties:
        IdentityPoolId: !Ref IdentityPool
        Roles:
          authenticated: !GetAtt AuthedClientRole.Arn
          unauthenticated: !GetAtt UnauthedClientRole.Arn

    AppSyncLoggingServiceRole:
      Type: AWS::IAM::Role
      Properties:
        AssumeRolePolicyDocument:
          Version: '2012-10-17'
          Statement:
            - Effect: Allow
              Principal:
                Service: appsync.amazonaws.com
              Action: sts:AssumeRole
        Path: /service-role/
        Policies:
          - PolicyName: root
            PolicyDocument:
              Version: '2012-10-17'
              Statement:
                - Effect: Allow
                  Action: 
                    - logs:CreateLogGroup
                    - logs:CreateLogStream
                    - logs:PutLogEvents
                  Resource: !Sub arn:aws:logs:${AWS::Region}:${AWS::AccountId}:*

  Outputs:
    AwsRegion:
      Value: ${self:custom.region}

    CognitoUserPoolId:
      Value: !Ref CognitoUserPool

    WebCognitoUserPoolClientId:
      Value: !Ref WebUserPoolClient

    ApiUrl:
      Value: !GetAtt AppsyncmasterclassGraphQlApi.GraphQLUrl

    CognitoUserPoolProviderName:
      Value: !GetAtt CognitoUserPool.ProviderName

    CognitoIdentityPoolId:
      Value: !Ref IdentityPool

    FirehoseStreamName:
      Value: !Ref FirehoseStream