template.yaml

AWSTemplateFormatVersion: '2010-09-09'
Transform: 'AWS::Serverless-2016-10-31'
Description: A daily Chinese vocabulary app
Parameters:
  WordsBucketName:
    Type: String
  WordsBucketKey:
    Type: String
  # ListsBucketName:
  #   Type: String
  # ListsBucketKey:
  #   Type: String
  OTPSecretKey:
    Type: String
  DynamoBackupsS3BucketName:
    Type: String
  Stage:
    Type: String

Resources:

####################################################################################################
# API Gateway
####################################################################################################

  VocabAppApi:
    Type: AWS::Serverless::Api
    Properties:
      StageName: Prod
      Cors:
        AllowMethods: "'OPTIONS,POST,GET'"
        AllowHeaders: "'*'"
        AllowOrigin: "'*'"
      Auth:
        Authorizers:
          CognitoAuthorizer:
            UserPoolArn: !GetAtt UserPool.Arn

####################################################################################################
# Lambda functions
####################################################################################################

  SendDailyEmail:
    Type: 'AWS::Serverless::Function'
    Properties:
      FunctionName: !Sub SendDailyEmail-${Stage}
      Handler: app.lambda_handler
      Runtime: python3.7
      CodeUri: src/send_daily_email
      Description: A function that sends a daily email to subscribers with a vocab word for each HSK level
      Timeout: 120
      EventInvokeConfig:
        MaximumRetryAttempts: 0
      Policies:
        - SESCrudPolicy:
            IdentityName: haohaotiantian.com
        - S3ReadPolicy:
            BucketName: !Ref WordsBucketName
        - S3ReadPolicy:
            BucketName: !Ref VocabAnnouncementsBucket
        - DynamoDBCrudPolicy:
            TableName: !Ref DynamoDBTable
        - DynamoDBCrudPolicy:
            TableName: !Ref WordHistoryDynamoDBTable
        - DynamoDBCrudPolicy:
            TableName: !Ref SubscriberContactListDynamoDBTable
      Environment:
        Variables:
          WORDS_BUCKET_NAME: !Ref WordsBucketName
          WORDS_BUCKET_KEY: !Ref WordsBucketKey
          # LISTS_BUCKET_NAME: !Ref ListsBucketName
          # LISTS_BUCKET_KEY: !Ref ListsBucketKey
          ANNOUNCEMENTS_BUCKET: !Ref VocabAnnouncementsBucket
          TABLE_NAME: !Ref DynamoDBTable
          # HISTORY_TABLE_NAME: !Ref WordHistoryDynamoDBTable
          CONTACT_TABLE_NAME: !Ref SubscriberContactListDynamoDBTable
          STAGE: !Ref Stage
      Events:
        DailySchedule:
          Type: Schedule
          Properties:
            Schedule: cron(0 20 * * ? *)
      Layers:
      - !Ref Layer

  SampleVocab:
    Type: 'AWS::Serverless::Function'
    Properties:
      FunctionName: !Sub SampleVocab-${Stage}
      Handler: app.lambda_handler
      Runtime: python3.7
      CodeUri: src/sample_vocab
      Description: A function that returns five random words for each HSK level
      MemorySize: 128
      Timeout: 120
      Policies:
        - DynamoDBCrudPolicy:
            TableName: !Ref DynamoDBTable
      Environment:
        Variables:
          TABLE_NAME: !Ref DynamoDBTable
      Events:
        SampleVocabApi:
          Type: Api
          Properties:
            RestApiId: !Ref VocabAppApi
            Path: /sample_vocab
            Method: GET
      Layers:
      - !Ref Layer

  GetReviewWords:
    Type: 'AWS::Serverless::Function'
    Properties:
      FunctionName: !Sub GetReviewWords-${Stage}
      Handler: app.lambda_handler
      Runtime: python3.7
      CodeUri: src/get_review_words
      Description: A function that returns a list of previous daily words.
      MemorySize: 128
      Timeout: 120
      Policies:
        - DynamoDBCrudPolicy:
            TableName: !Ref DynamoDBTable
      Environment:
        Variables:
          TABLE_NAME: !Ref DynamoDBTable
          # TABLE_NAME: !Ref WordHistoryDynamoDBTable
      Events:
        GetReviewWordsApi:
          Type: Api
          Properties:
            RestApiId: !Ref VocabAppApi
            Path: /review
            Method: GET
      Layers:
      - !Ref Layer
  
  SetSubscriptions:
    Type: 'AWS::Serverless::Function'
    Properties:
      FunctionName: !Sub SetSubscriptions-${Stage}
      Handler: app.lambda_handler
      Runtime: python3.7
      CodeUri: src/set_subscriptions
      Description: A function that creates, updates, or deletes users' list subscription
      Timeout: 120
      Policies:
        - DynamoDBCrudPolicy:
            TableName: !Ref DynamoDBTable
      Environment:
        Variables:
          TABLE_NAME: !Ref DynamoDBTable
      Events:
        SetSubsApi:
          Type: Api
          Properties:
            RestApiId: !Ref VocabAppApi
            Path: /set_subs
            Method: POST
      Layers:
      - !Ref Layer

  Unsubscribe:
    Type: 'AWS::Serverless::Function'
    Properties:
      FunctionName: !Sub Unsubscribe-${Stage}
      Handler: app.lambda_handler
      Runtime: python3.7
      CodeUri: src/unsubscribe
      Description: A function that unsubscribes users that are not signed in.
      MemorySize: 128
      Timeout: 120
      Policies:
        - DynamoDBCrudPolicy:
            TableName: !Ref DynamoDBTable
            Events:
        - Statement:
          - Effect: Allow
            Action:
            - cognito-idp:AdminGetUser
            Resource: !GetAtt UserPool.Arn
      Environment:
        Variables:
          TABLE_NAME: !Ref DynamoDBTable
          USER_POOL_ID: !Ref UserPool
      Events:
        UnsubApi:
          Type: Api
          Properties:
            RestApiId: !Ref VocabAppApi
            Path: /unsub
            Method: POST
      Layers:
      - !Ref Layer

  GetUserData:
    Type: 'AWS::Serverless::Function'
    Properties:
      FunctionName: !Sub GetUserData-${Stage}
      Handler: app.lambda_handler
      Runtime: python3.7
      CodeUri: src/get_user_data
      Description: A function that returns details for a specific user.
      MemorySize: 128
      Timeout: 120
      Policies:
        - DynamoDBCrudPolicy:
            TableName: !Ref DynamoDBTable
      Environment:
        Variables:
          TABLE_NAME: !Ref DynamoDBTable
      Events:
        GetUserDataApi:
          Type: Api
          Properties:
            RestApiId: !Ref VocabAppApi
            Path: /user
            Method: GET
            Auth:
              Authorizer: CognitoAuthorizer
      Layers:
      - !Ref Layer

  SetUserData:
    Type: 'AWS::Serverless::Function'
    Properties:
      FunctionName: !Sub SetUserData-${Stage}
      Handler: app.lambda_handler
      Runtime: python3.7
      CodeUri: src/set_user_data
      Description: A function that updates a signed in user's metadata
      Timeout: 120
      Policies:
        - DynamoDBCrudPolicy:
            TableName: !Ref DynamoDBTable
      Environment:
        Variables:
          TABLE_NAME: !Ref DynamoDBTable
      Events:
        SetUserDataApi:
          Type: Api
          Properties:
            RestApiId: !Ref VocabAppApi
            Path: /update_user
            Method: POST
            Auth:
              Authorizer: CognitoAuthorizer
  
  SetLastLogin:
    Type: 'AWS::Serverless::Function'
    Properties:
      FunctionName: !Sub SetLastLogin-${Stage}
      Handler: app.lambda_handler
      Runtime: python3.7
      CodeUri: src/set_last_login
      Description: A function that updates metadata on when the user last logged in
      Timeout: 120
      Policies:
        - DynamoDBCrudPolicy:
            TableName: !Ref DynamoDBTable
      Environment:
        Variables:
          TABLE_NAME: !Ref DynamoDBTable
      Events:
        SetLastLoginApi:
          Type: Api
          Properties:
            RestApiId: !Ref VocabAppApi
            Path: /update_login
            Method: POST
            Auth:
              Authorizer: CognitoAuthorizer

  SetSentence:
    Type: 'AWS::Serverless::Function'
    Properties:
      FunctionName: !Sub SetSentence-${Stage}
      Handler: app.lambda_handler
      Runtime: python3.7
      CodeUri: src/set_sentence
      Description: A function that creates or updates a user's daily sentence
      MemorySize: 128
      Timeout: 120
      Policies:
        - DynamoDBCrudPolicy:
           TableName: !Ref DynamoDBTable
      Environment:
        Variables:
          TABLE_NAME: !Ref DynamoDBTable
      Events:
        SetSentenceApi:
          Type: Api
          Properties:
            RestApiId: !Ref VocabAppApi
            Path: /sentence
            Method: POST
            Auth:
              Authorizer: CognitoAuthorizer
      Layers:
      - !Ref Layer
              
  GetSentences:
    Type: 'AWS::Serverless::Function'
    Properties:
      FunctionName: !Sub GetSentences-${Stage}
      Handler: app.lambda_handler
      Runtime: python3.7
      CodeUri: src/get_sentences
      Description: A function that retrieves a user's daily sentences
      MemorySize: 128
      Timeout: 120
      Policies:
        - DynamoDBCrudPolicy:
           TableName: !Ref DynamoDBTable
      Environment:
        Variables:
          TABLE_NAME: !Ref DynamoDBTable
      Events:
        GetSentencesApi:
          Type: Api
          Properties:
            RestApiId: !Ref VocabAppApi
            # Will this work to have different functions on different methods of the same API path?
            Path: /sentence
            Method: GET
            Auth:
              Authorizer: CognitoAuthorizer
  
  GetCharsForListId:
    Type: 'AWS::Serverless::Function'
    Properties:
      FunctionName: !Sub GetCharsForListId-${Stage}
      Handler: app.lambda_handler
      Runtime: python3.7
      CodeUri: src/get_chars_for_list_id
      Description: Retrieves list of characters for a given list id
      MemorySize: 128
      Timeout: 120
      Policies:
        - DynamoDBCrudPolicy:
            TableName: !Ref DynamoDBTable
      Environment:
        Variables:
          TABLE_NAME: !Ref DynamoDBTable
      Layers:
      - !Ref Layer

  BackupDynamoDBToS3:
    Type: 'AWS::Serverless::Function'
    Properties:
      FunctionName: !Sub BackupDynamoDBToS3-${Stage}
      Handler: app.lambda_handler
      Runtime: python3.7
      CodeUri: src/backup_dynamodb_s3
      Description: A function that scans the contact list database in DynamoDB and saves a back-up to S3
      MemorySize: 128
      Timeout: 120
      Policies:
        - S3WritePolicy:
            BucketName: !Ref DynamoBackupsS3BucketName
        - DynamoDBCrudPolicy:
            TableName: !Ref DynamoDBTable
      Environment:
        Variables:
          BACKUPS_BUCKET_NAME: !Ref DynamoBackupsS3BucketName
          TABLE_NAME: !Ref DynamoDBTable
      Events:
        WeeklyCloudWatchEvent:
          Type: Schedule
          Properties:
            Schedule: cron(0 16 ? * FRI *)

  Layer:
    Type: 'AWS::Serverless::LayerVersion'
    Properties:
      ContentUri: src/layer
      CompatibleRuntimes:
        - python3.7

####################################################################################################
# DynamoDB table
####################################################################################################

  DynamoDBTable:
    Type: AWS::DynamoDB::Table
    DeletionPolicy: Retain
    Properties:
      TableName: !Sub VocabAppTable-${Stage}
      AttributeDefinitions:
        - AttributeName: PK
          AttributeType: S
        - AttributeName: SK
          AttributeType: S
        - AttributeName: GSI1PK
          AttributeType: S
        - AttributeName: GSI1SK
          AttributeType: S
      KeySchema:
        - AttributeName: PK
          KeyType: HASH
        - AttributeName: SK
          KeyType: RANGE
      GlobalSecondaryIndexes:
        - IndexName: GSI1
          KeySchema:
            - AttributeName: GSI1PK
              KeyType: HASH
            - AttributeName: GSI1SK
              KeyType: RANGE
          Projection:
            ProjectionType: ALL
      BillingMode: PAY_PER_REQUEST
      ProvisionedThroughput:
        ReadCapacityUnits: 0
        WriteCapacityUnits: 0

  WordHistoryDynamoDBTable:
    Type: AWS::DynamoDB::Table
    DeletionPolicy: Retain
    Properties:
      TableName: !Sub WordHistory-${Stage}
      AttributeDefinitions:
        - AttributeName: ListId
          AttributeType: S
        - AttributeName: Date
          AttributeType: S
      KeySchema:
        - AttributeName: ListId
          KeyType: HASH
        - AttributeName: Date
          KeyType: RANGE
      BillingMode: PAY_PER_REQUEST
      ProvisionedThroughput:
        ReadCapacityUnits: 0
        WriteCapacityUnits: 0

  SubscriberContactListDynamoDBTable:
    Type: AWS::DynamoDB::Table
    DeletionPolicy: Retain
    Properties:
      TableName: !Sub SubscriberContactList-${Stage}
      AttributeDefinitions:
        - AttributeName: ListId
          AttributeType: S
        - AttributeName: SubscriberEmail
          AttributeType: S
      KeySchema:
        - AttributeName: ListId
          KeyType: HASH
        - AttributeName: SubscriberEmail
          KeyType: RANGE
      BillingMode: PAY_PER_REQUEST
      ProvisionedThroughput:
        ReadCapacityUnits: 0
        WriteCapacityUnits: 0

####################################################################################################
# S3 buckets
####################################################################################################

  VocabAnnouncementsBucket:
    Type: AWS::S3::Bucket
    Properties:
      AccessControl: Private
      BucketName: !Sub hhtt-email-announcements-${Stage}
      PublicAccessBlockConfiguration:
        BlockPublicAcls: true
        BlockPublicPolicy: true
        IgnorePublicAcls: true
        RestrictPublicBuckets: true

  PronunciationAudioBucket:
    Type: AWS::S3::Bucket
    Properties:
      AccessControl: PublicRead
      BucketName: !Sub vocab-audio-${Stage}

  AudioFileBucketPolicy:
    Type: AWS::S3::BucketPolicy
    Properties: 
      Bucket: !Ref PronunciationAudioBucket
      PolicyDocument:
        Statement:
          - Sid: AudioAllowRead
            Effect: Allow
            Principal: "*"
            Action: 
            - s3:GetObject
            Resource:
              - !Join ["", ["arn:aws:s3:::", !Ref PronunciationAudioBucket, "/audio/*"]]
              
####################################################################################################
# State machine
####################################################################################################

  GenerateAudioStateMachine:
    Type: AWS::Serverless::StateMachine
    Properties:
      Name: !Sub GenerateAudioStateMachine-${Stage}
      DefinitionUri: src/generate_audio_state_machine.asl.json
      DefinitionSubstitutions:
        TableName: !Ref DynamoDBTable
        GetCharsForListIdFunction: !Ref GetCharsForListId
        PronunciationAudioBucket: !Ref PronunciationAudioBucket
      Policies:
        - S3WritePolicy:
           BucketName: !Ref PronunciationAudioBucket
        - DynamoDBCrudPolicy:
           TableName: !Ref DynamoDBTable
        - LambdaInvokePolicy:
           FunctionName: !Ref GetCharsForListId
        - Statement:
          - Sid: PollySynthesizeText
            Effect: Allow
            Action:
            - polly:StartSpeechSynthesisTask
            Resource: '*'

####################################################################################################
# Cognito & authentication workflow Lambda functions
####################################################################################################

  UserPool:
    Type: "AWS::Cognito::UserPool"
    Properties:
      UserPoolName: !Sub VocabAppUserPool-${Stage}
      Schema:
        - Name: email
          AttributeDataType: String
          Mutable: true
          Required: true
      Policies:
        PasswordPolicy:
          MinimumLength: 8
          RequireLowercase: false
          RequireNumbers: false
          RequireSymbols: false
          RequireUppercase: false
      UsernameAttributes:
        - email
      MfaConfiguration: "OFF"
      LambdaConfig:
        PreSignUp: !GetAtt PreSignUp.Arn
        DefineAuthChallenge: !GetAtt DefineAuthChallenge.Arn
        CreateAuthChallenge: !GetAtt CreateAuthChallenge.Arn
        VerifyAuthChallengeResponse: !GetAtt VerifyAuthChallengeResponse.Arn

  PreSignUp:
    Type: AWS::Serverless::Function
    Properties:
      CodeUri: src/user_pool_triggers/pre_sign_up/
      Handler: app.lambda_handler
      Runtime: python3.7

  DefineAuthChallenge:
    Type: AWS::Serverless::Function
    Properties:
      CodeUri: src/user_pool_triggers/define_auth_challenge/
      Handler: app.lambda_handler
      Runtime: python3.7
  
  CreateAuthChallenge:
    Type: AWS::Serverless::Function
    Properties:
      CodeUri: src/user_pool_triggers/create_auth_challenge/
      Handler: app.lambda_handler
      Runtime: python3.7
      Environment:
        Variables:
          STAGE: !Ref Stage
          OTP_SECRET_KEY: !Ref OTPSecretKey
      Policies:
        - Version: "2012-10-17"
          Statement:
            - Effect: Allow
              Action:
                - ses:SendEmail
              Resource: "*"
  
  VerifyAuthChallengeResponse:
    Type: AWS::Serverless::Function
    Properties:
      CodeUri: src/user_pool_triggers/verify_auth_challenge_response/
      Handler: app.lambda_handler
      Runtime: python3.7
      Role: !GetAtt VerifyAuthChallengeRole.Arn
  
  # Creatinging a role to attach SetUserAttributesPolicy to
  VerifyAuthChallengeRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - lambda.amazonaws.com
            Action:
              - 'sts:AssumeRole'
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole

  # Giving the VerifyAuthChallenge role the permissions to update the user's email to verified
  SetUserAttributesPolicy:
    Type: AWS::IAM::Policy
    Properties:
      PolicyName: allow-set-user-attributes
      PolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Action:
              - cognito-idp:AdminUpdateUserAttributes
            Resource:
              - !GetAtt UserPool.Arn
      Roles:
        - !Ref VerifyAuthChallengeRole
  
 # Giving the user pool permissions to invoke the Lambda functions
  DefineAuthChallengeInvocationPermission:
    Type: AWS::Lambda::Permission
    Properties:
      Action: lambda:InvokeFunction
      FunctionName: !GetAtt DefineAuthChallenge.Arn
      Principal: cognito-idp.amazonaws.com
      SourceArn: !GetAtt UserPool.Arn
  CreateAuthChallengeInvocationPermission:
    Type: AWS::Lambda::Permission
    Properties:
      Action: lambda:InvokeFunction
      FunctionName: !GetAtt CreateAuthChallenge.Arn
      Principal: cognito-idp.amazonaws.com
      SourceArn: !GetAtt UserPool.Arn
  VerifyAuthChallengeResponseInvocationPermission:
    Type: AWS::Lambda::Permission
    Properties:
      Action: lambda:InvokeFunction
      FunctionName: !GetAtt VerifyAuthChallengeResponse.Arn
      Principal: cognito-idp.amazonaws.com
      SourceArn: !GetAtt UserPool.Arn
  PreSignUpInvocationPermission:
    Type: AWS::Lambda::Permission
    Properties:
      Action: lambda:InvokeFunction
      FunctionName: !GetAtt PreSignUp.Arn
      Principal: cognito-idp.amazonaws.com
      SourceArn: !GetAtt UserPool.Arn
  
  # User pool client only allows custom auth
  # A password is generated for each user, but they are not able to use it to login (since they will be using email)
  UserPoolClient:
    Type: "AWS::Cognito::UserPoolClient"
    Properties:
      ClientName: email-auth-client
      GenerateSecret: false
      UserPoolId: !Ref UserPool
      ExplicitAuthFlows:
        - CUSTOM_AUTH_FLOW_ONLY

####################################################################################################
# Outputs
####################################################################################################

Outputs:
  UserPoolId:
    Description: ID of the User Pool
    Value: !Ref UserPool
  UserPoolClientId:
    Description: ID of the User Pool Client
    Value: !Ref UserPoolClient