template.yaml

# Copyright 2019 Ben Kehoe
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#     http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

Transform: 'AWS::Serverless-2016-10-31'
Metadata:
  AWS::ServerlessRepo::Application:
    Name: sfn-callback-urls
    Description: Easy handling of Step Function tokens as callback URLs
    Author: Ben Kehoe
    Labels:
      - stepfunctions
      - callback
      - email
    SpdxLicenseId: Apache-2.0
    LicenseUrl: LICENSE
    ReadmeUrl: README.md
    HomePageUrl: https://github.com/benkehoe/sfn-callback-urls
    SemanticVersion: 1.0.0
    SourceCodeUrl: https://github.com/benkehoe/sfn-callback-urls
Parameters:
  DisableEncryption:
    Description: Disable encryption for callback payloads
    Type: String
    AllowedValues:
      - "true"
      - "false"
    Default: "false"
  EncryptionKeyArn:
    Description: If encryption is enabled, set this to use your own KMS key, or set to NONE to create one
    Type: String
    Default: 'NONE'
  EnableOutputParameters:
    Description: Allow the use of query parameters to customize the result of callbacks
    Type: String
    AllowedValues:
      - "true"
      - "false"
    Default: "false"
  EnablePostActions:
    Description: Allow the use of post actions, which pass the callback request body to Step Functions
    Type: String
    AllowedValues:
      - "true"
      - "false"
    Default: "false"
  VerboseLogging:
    Description: Log requests and payloads
    Type: String
    AllowedValues:
      - "true"
      - "false"
    Default: "false"
Conditions:
  EncryptionEnabled:
    Fn::Equals: [ !Ref DisableEncryption, "false" ]
  CreateKey:
    Fn::And:
      - Fn::Equals: [ !Ref DisableEncryption, "false" ]
      - Fn::Equals: [ !Ref EncryptionKeyArn, "NONE" ]
  OutputParametersDisabled:
    Fn::Equals: [ !Ref EnableOutputParameters, "false" ]
  PostActionsDisabled:
    Fn::Equals: [ !Ref EnablePostActions, "false" ]
  VerboseLoggingEnabled:
    Fn::Equals: [ !Ref VerboseLogging, "true" ]
Outputs:
  Api:
    Value: !Sub "https://${Api}.execute-api.${AWS::Region}.amazonaws.com/${ApiStage}"
  Function:
    Value: !Ref CreateUrls
  Policy:
    Value: !Ref CreateUrlsPolicy
Resources:
  CreateUrlsPolicy:
    Type: AWS::IAM::ManagedPolicy
    Properties:
      Description: Permission to call the API and the function directly
      PolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Action: execute-api:Invoke
            Resource: !Sub arn:aws:execute-api:${AWS::Region}:${AWS::AccountId}:${Api}/${ApiStage}/*
          - Effect: Allow
            Action: lambda:Invoke
            Resource: !GetAtt CreateUrls.Arn

  Api:
    Type: AWS::ApiGateway::RestApi
    Properties:
      Name: Callback URLs service for Step Functions
      EndpointConfiguration:
        Types:
        - REGIONAL

  CreateUrlsResource:
    Type: AWS::ApiGateway::Resource
    Properties:
      ParentId: !GetAtt Api.RootResourceId
      PathPart: urls
      RestApiId: !Ref Api

  CreateUrlsMethod:
    Type: AWS::ApiGateway::Method
    Properties:
      HttpMethod: POST
      ResourceId: !Ref CreateUrlsResource
      RestApiId: !Ref Api
      AuthorizationType: AWS_IAM
      Integration:
        Type: AWS_PROXY
        IntegrationHttpMethod: POST
        Uri: !Sub "arn:aws:apigateway:${AWS::Region}:lambda:path/2015-03-31/functions/arn:aws:lambda:${AWS::Region}:${AWS::AccountId}:function:${CreateUrlsForApi}/invocations"
  
  CreateUrlsInvokePermission:
    Type: AWS::Lambda::Permission
    Properties:
      FunctionName: !Ref CreateUrlsForApi
      Action: "lambda:InvokeFunction"
      Principal: apigateway.amazonaws.com

  ProcessCallbackResource:
    Type: AWS::ApiGateway::Resource
    Properties:
      ParentId: !GetAtt Api.RootResourceId
      PathPart: respond
      RestApiId: !Ref Api

  ProcessCallbackGetMethod:
    Type: AWS::ApiGateway::Method
    Properties:
      HttpMethod: GET
      ResourceId: !Ref ProcessCallbackResource
      RestApiId: !Ref Api
      AuthorizationType: NONE
      Integration:
        Type: AWS_PROXY
        IntegrationHttpMethod: POST
        Uri: !Sub "arn:aws:apigateway:${AWS::Region}:lambda:path/2015-03-31/functions/arn:aws:lambda:${AWS::Region}:${AWS::AccountId}:function:${ProcessCallbackFunction}/invocations"

  ProcessCallbackPostMethod:
    Type: AWS::ApiGateway::Method
    Properties:
      HttpMethod: POST
      ResourceId: !Ref ProcessCallbackResource
      RestApiId: !Ref Api
      AuthorizationType: NONE
      Integration:
        Type: AWS_PROXY
        IntegrationHttpMethod: POST
        Uri: !Sub "arn:aws:apigateway:${AWS::Region}:lambda:path/2015-03-31/functions/arn:aws:lambda:${AWS::Region}:${AWS::AccountId}:function:${ProcessCallbackFunction}/invocations"

  ProcessCallbackInvokePermission:
    Type: AWS::Lambda::Permission
    Properties:
      FunctionName: !Ref ProcessCallbackFunction
      Action: "lambda:InvokeFunction"
      Principal: apigateway.amazonaws.com

  CreateUrlsRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument: |
        {
          "Version": "2012-10-17",
          "Statement": [
            {
              "Effect": "Allow",
              "Principal": {
                "Service": "lambda.amazonaws.com"
              },
              "Action": "sts:AssumeRole"
            }
          ]
        }

  CreateUrlsLogsPolicy:
    Type: AWS::IAM::Policy
    Properties:
      Roles:
      - !Ref CreateUrlsRole
      PolicyName: LambdaLogging
      PolicyDocument:
        Version: "2012-10-17"
        Statement: 
          - Effect: Allow
            Action:
              - "logs:CreateLogStream"
              - "logs:CreateLogGroup"
            Resource:
              - !Sub "arn:aws:logs:${AWS::Region}:${AWS::AccountId}:log-group:/aws/lambda/${CreateUrls}:*"
              - !Sub "arn:aws:logs:${AWS::Region}:${AWS::AccountId}:log-group:/aws/lambda/${CreateUrlsForApi}:*"
          - Effect: Allow
            Action:
              - "logs:PutLogEvents"
            Resource:
              - !Sub "arn:aws:logs:${AWS::Region}:${AWS::AccountId}:log-group:/aws/lambda/${CreateUrls}:log-stream:*"
              - !Sub "arn:aws:logs:${AWS::Region}:${AWS::AccountId}:log-group:/aws/lambda/${CreateUrlsForApi}:log-stream:*"

  CreateUrlsForApi:
    Type: 'AWS::Serverless::Function'
    Properties:
      CodeUri: ./src
      Runtime: python3.6
      Handler: create_urls.api_handler
      Role: !GetAtt CreateUrlsRole.Arn
      MemorySize: 1024
      Environment:
        Variables:
          DISABLE_OUTPUT_PARAMETERS: {"Fn::If": [OutputParametersDisabled, "true", "false"]}
          DISABLE_POST_ACTIONS: {"Fn::If": [PostActionsDisabled, "true", "false"]}
          VERBOSE: {"Fn::If": [VerboseLoggingEnabled, "true", "false"]}
          KEY_ID: 
            "Fn::If":
              - EncryptionEnabled
              - "Fn::If":
                  - CreateKey
                  - !Ref EncryptionKey
                  - !Ref EncryptionKeyArn
              - !Ref AWS::NoValue
  
  CreateUrls:
    Type: 'AWS::Serverless::Function'
    Properties:
      CodeUri: ./src
      Runtime: python3.6
      Handler: create_urls.direct_handler
      Role: !GetAtt CreateUrlsRole.Arn
      MemorySize: 1024
      Environment:
        Variables:
          DISABLE_OUTPUT_PARAMETERS: {"Fn::If": [OutputParametersDisabled, "true", "false"]}
          DISABLE_POST_ACTIONS: {"Fn::If": [PostActionsDisabled, "true", "false"]}
          VERBOSE: {"Fn::If": [VerboseLoggingEnabled, "true", "false"]}
          API_ID: !Ref Api
          STAGE: !Ref ApiStage
          KEY_ID: 
            "Fn::If":
              - EncryptionEnabled
              - "Fn::If":
                  - CreateKey
                  - !Ref EncryptionKey
                  - !Ref EncryptionKeyArn
              - !Ref AWS::NoValue
  
  ProcessCallbackRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument: |
        {
          "Version": "2012-10-17",
          "Statement": [
            {
              "Effect": "Allow",
              "Principal": {
                "Service": "lambda.amazonaws.com"
              },
              "Action": "sts:AssumeRole"
            }
          ]
        }

  ProcessCallbackSfnPolicy:
    Type: AWS::IAM::Policy
    Properties:
      Roles:
      - !Ref ProcessCallbackRole
      PolicyName: AccessSfn
      PolicyDocument:
        Version: "2012-10-17"
        Statement: 
          - Effect: Allow
            Action:
              - "states:SendTaskSuccess"
              - "states:SendTaskFailure"
              - "states:SendTaskHeartbeat"
            Resource: "*"
    
  ProcessCallbackLogsPolicy:
    Type: AWS::IAM::Policy
    Properties:
      Roles:
      - !Ref ProcessCallbackRole
      PolicyName: LambdaLogging
      PolicyDocument:
        Version: "2012-10-17"
        Statement: 
          - Effect: Allow
            Action:
              - "logs:CreateLogStream"
              - "logs:CreateLogGroup"
            Resource: !Sub "arn:aws:logs:${AWS::Region}:${AWS::AccountId}:log-group:/aws/lambda/${ProcessCallbackFunction}:*"
          - Effect: Allow
            Action:
              - "logs:PutLogEvents"
            Resource: !Sub "arn:aws:logs:${AWS::Region}:${AWS::AccountId}:log-group:/aws/lambda/${ProcessCallbackFunction}:log-stream:*"

  ProcessCallbackFunction:
    Type: 'AWS::Serverless::Function'
    Properties:
      CodeUri: ./src
      Runtime: python3.6
      Handler: process_callback.handler
      Role: !GetAtt ProcessCallbackRole.Arn
      MemorySize: 1024
      Timeout: 15
      Environment:
        Variables:
          DISABLE_OUTPUT_PARAMETERS: {"Fn::If": [OutputParametersDisabled, "true", "false"]}
          DISABLE_POST_ACTIONS: {"Fn::If": [PostActionsDisabled, "true", "false"]}
          VERBOSE: {"Fn::If": [VerboseLoggingEnabled, "true", "false"]}
          KEY_ID:
            "Fn::If":
              - EncryptionEnabled
              - "Fn::If":
                  - CreateKey
                  - !Ref EncryptionKey
                  - !Ref EncryptionKeyArn
              - !Ref AWS::NoValue
  
  ApiDeployment:
    Type: AWS::ApiGateway::Deployment
    DependsOn:
      - CreateUrlsMethod
      - ProcessCallbackGetMethod
      - ProcessCallbackPostMethod
    Properties:
      RestApiId: !Ref Api
  
  ApiStage:
    Type: AWS::ApiGateway::Stage
    Properties:
      RestApiId: !Ref Api
      StageName: v1
      DeploymentId: !Ref ApiDeployment
  
  EncryptionKey:
    Type: AWS::KMS::Key
    Condition: CreateKey
    Properties:
      KeyPolicy: !Sub |
        {
          "Version": "2012-10-17",
          "Id": "key-default-1",
          "Statement": [{
            "Sid": "Enable IAM User Permissions",
            "Effect": "Allow",
            "Principal": {"AWS": "arn:aws:iam::${AWS::AccountId}:root"},
            "Action": "kms:*",
            "Resource": "*"
          }]
        }
  
  EncryptionKeyPolicy:
    Type: AWS::IAM::Policy
    Condition: EncryptionEnabled
    Properties:
      Roles:
      - !Ref CreateUrlsRole
      - !Ref ProcessCallbackRole
      PolicyName: AccessEncryptionKey
      PolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Action:
              - "kms:GenerateDataKey"
              - "kms:Decrypt"
            Resource:
              "Fn::If":
                - CreateKey
                - !GetAtt EncryptionKey.Arn
                - !Ref EncryptionKeyArn