template.yaml

AWSTemplateFormatVersion: "2010-09-09"

Transform: AWS::Serverless-2016-10-31

Description: >
  SAM Template for serverless ordering API application

Globals:
  Function:
    Timeout: 3

Resources:
  OrderTable:
    Type: AWS::DynamoDB::Table
    Properties:
      TableName: order-table
      AttributeDefinitions:
        - AttributeName: user_id
          AttributeType: S
        - AttributeName: id
          AttributeType: S
      KeySchema:
        - AttributeName: user_id
          KeyType: HASH
        - AttributeName: id
          KeyType: RANGE
      ProvisionedThroughput:
        ReadCapacityUnits: 5
        WriteCapacityUnits: 5

  GetOrders:
    Type: AWS::Serverless::Function
    Properties:
      CodeUri: src/api/functions/get-orders/
      Handler: app.getOrders
      Runtime: nodejs18.x
      Environment:
        Variables:
          ORDER_TABLE: !Ref OrderTable
      Policies:
        Statement:
          - Effect: Allow
            Action:
              - dynamodb:GetItem
              - dynamodb:Query
              - dynamodb:Scan
            Resource:
              - !Sub
                - "arn:aws:dynamodb:*:*:table/${Table}"
                - { Table: !Ref OrderTable }
          - Effect: Allow
            Action:
              - logs:*
            Resource:
              - "*"

  GetSingleOrder:
    Type: AWS::Serverless::Function
    Properties:
      CodeUri: src/api/functions/get-single-order/
      Handler: app.getOrderById
      Runtime: nodejs18.x
      Environment:
        Variables:
          ORDER_TABLE: !Ref OrderTable
      Policies:
        Statement:
          - Effect: Allow
            Action:
              - dynamodb:GetItem
            Resource:
              - !Sub
                - "arn:aws:dynamodb:*:*:table/${Table}"
                - { Table: !Ref OrderTable }
          - Effect: Allow
            Action:
              - logs:*
            Resource:
              - "*"

  PostOrders:
    Type: AWS::Serverless::Function
    Properties:
      CodeUri: src/api/functions/post-orders/
      Handler: app.postOrders
      Runtime: nodejs18.x
      Events:
        SQSEventSource:
          Type: SQS
          Properties:
            Queue: !GetAtt OrderQueue.Arn
            BatchSize: 10
      Environment:
        Variables:
          STATE_MACHINE_ARN: !Ref OrderManagementSFN
      Policies:
        Statement:
          - Effect: Allow
            Action:
              - logs:*
            Resource:
              - "*"
          - Effect: Allow
            Action:
              - states:StartExecution
            Resource:
              - !Sub
                - "${StateMachine}"
                - { StateMachine: !Ref OrderManagementSFN }

  UpdateOrder:
    Type: AWS::Serverless::Function
    Properties:
      CodeUri: src/api/functions/update-order/
      Handler: app.updateOrder
      Runtime: nodejs18.x
      Environment:
        Variables:
          ORDER_TABLE: !Ref OrderTable
      Policies:
        Statement:
          - Effect: Allow
            Action:
              - dynamodb:UpdateItem
            Resource:
              - !Sub
                - "arn:aws:dynamodb:*:*:table/${Table}"
                - { Table: !Ref OrderTable }
          - Effect: Allow
            Action:
              - logs:*
            Resource:
              - "*"

  DeleteOrder:
    Type: AWS::Serverless::Function
    Properties:
      CodeUri: src/api/functions/delete-order/
      Handler: app.deleteOrder
      Runtime: nodejs18.x
      Environment:
        Variables:
          ORDER_TABLE: !Ref OrderTable
      Policies:
        Statement:
          - Effect: Allow
            Action:
              - dynamodb:DeleteItem
            Resource:
              - !Sub
                - "arn:aws:dynamodb:*:*:table/${Table}"
                - { Table: !Ref OrderTable }
          - Effect: Allow
            Action:
              - logs:*
            Resource:
              - "*"

  ProcessPaymentFunction:
    Type: AWS::Serverless::Function
    Properties:
      CodeUri: src/manage/functions/process-payment/
      Handler: app.processPayment
      Runtime: nodejs18.x

  SendOrderToRestaurantFunction:
    Type: AWS::Serverless::Function
    Properties:
      CodeUri: src/manage/functions/send-order/
      Handler: app.sendOrder
      Runtime: nodejs18.x

  ManageStateFunction:
    Type: AWS::Serverless::Function
    Properties:
      CodeUri: src/manage/functions/manage-order-state/
      Handler: app.manageState
      Runtime: nodejs18.x
      Environment:
        Variables:
          ORDER_TABLE: !Ref OrderTable
          SNS_TOPIC_ARN: !Ref OrderTopic
      Policies:
        Statement:
          - Effect: Allow
            Action:
              - dynamodb:GetItem
              - dynamodb:Query
              - dynamodb:Scan
              - dynamodb:PutItem
              - dynamodb:UpdateItem
            Resource:
              - !Sub
                - "arn:aws:dynamodb:*:*:table/${Table}"
                - { Table: !Ref OrderTable }
          - Effect: Allow
            Action:
              - logs:*
            Resource:
              - "*"
          - Effect: Allow
            Action:
              - SNS:Publish
            Resource:
              - "*"

  OrderTopic:
    Type: AWS::SNS::Topic
    Properties:
      Subscription:
        - Endpoint: "test@email.com"
          Protocol: "email"
      TopicName: "order-topic"

  OrderManagementSFN:
    Type: AWS::Serverless::StateMachine
    Properties:
      DefinitionUri: src/manage/state-machine/processOrder.asl.json
      DefinitionSubstitutions:
        ManageStateArn: !GetAtt ManageStateFunction.Arn
        ProcessPaymentArn: !GetAtt ProcessPaymentFunction.Arn
        SendOrderToRestaurantArn: !GetAtt SendOrderToRestaurantFunction.Arn
      Policies:
        - LambdaInvokePolicy:
            FunctionName: !Ref ManageStateFunction
        - LambdaInvokePolicy:
            FunctionName: !Ref ProcessPaymentFunction
        - LambdaInvokePolicy:
            FunctionName: !Ref SendOrderToRestaurantFunction

  OrderApi:
    Type: AWS::Serverless::Api
    Properties:
      StageName: Dev
      Cors:
        AllowMethods: "'POST, GET, UPDATE, DELETE'"
        AllowHeaders: "'X-Forwarded-For'"
        AllowOrigin: "'*'"
        MaxAge: "'600'"
      Auth:
        DefaultAuthorizer: MyCognitoAuthorizer
        Authorizers:
          MyCognitoAuthorizer:
            UserPoolArn: !GetAtt OrderCognitoPool.Arn
      DefinitionBody:
        "Fn::Transform":
          Name: "AWS::Include"
          Parameters:
            Location: "./api.yaml"

  ApiGwExecutionRole:
    Type: "AWS::IAM::Role"
    Properties:
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: "Allow"
            Principal:
              Service:
                - "apigateway.amazonaws.com"
                - "lambda.amazonaws.com"
            Action:
              - "sts:AssumeRole"
      Path: "/"

  ApiGwExecutionPolicy:
    Type: "AWS::IAM::Policy"
    Properties:
      PolicyName: "apigw-execution-policy"
      PolicyDocument:
        Version: "2012-10-17"
        Statement:
          Action:
            - sqs:SendMessage
            - lambda:*
          Effect: Allow
          Resource:
            - !GetAtt GetOrders.Arn
            - !GetAtt GetSingleOrder.Arn
            - !GetAtt OrderQueue.Arn
            - !GetAtt UpdateOrder.Arn
            - !GetAtt DeleteOrder.Arn
      Roles:
        - Ref: "ApiGwExecutionRole"

  OrderQueue:
    Type: AWS::SQS::Queue
    Properties:
      RedrivePolicy:
        deadLetterTargetArn: !GetAtt OrderDLQueue.Arn
        maxReceiveCount: 5

  OrderDLQueue:
    Type: AWS::SQS::Queue

  OrderCognitoPool:
    Type: AWS::Cognito::UserPool
    Properties:
      UserPoolName: orders-pool
      Policies:
        PasswordPolicy:
          MinimumLength: 8
      UsernameAttributes:
        - email
      Schema:
        - AttributeDataType: String
          Name: email
          Required: true

  OrderCognitoPoolClient:
    Type: AWS::Cognito::UserPoolClient
    Properties:
      UserPoolId: !Ref OrderCognitoPool
      ClientName: order-pool-client
      ExplicitAuthFlows:
        - ALLOW_ADMIN_USER_PASSWORD_AUTH
        - ALLOW_REFRESH_TOKEN_AUTH
      GenerateSecret: true
      SupportedIdentityProviders:
        - COGNITO
      AllowedOAuthFlows:
        - code
      AllowedOAuthFlowsUserPoolClient: true
      AllowedOAuthScopes:
        - openid
        - profile
        - "order-api/delete_order"
      CallbackURLs:
        - "https://localhost/callback"
    DependsOn: OrderCognitoResourceServer

  OrderCognitoDomain:
    Type: AWS::Cognito::UserPoolDomain
    Properties:
      Domain: !Sub "order-app-${AWS::AccountId}"
      UserPoolId: !Ref OrderCognitoPool

  OrderCognitoResourceServer:
    Type: AWS::Cognito::UserPoolResourceServer
    Properties:
      Identifier: "order-api"
      Name: "order-api"
      Scopes:
        - ScopeName: "delete_order"
          ScopeDescription: "Delete Orders"
      UserPoolId: !Ref OrderCognitoPool

Outputs:
  DynamoDBTableName:
    Description: "DynamoDB Table Name"
    Value: !Ref OrderTable

  GetOrders:
    Description: "GetOrders Lambda Function ARN"
    Value: !GetAtt GetOrders.Arn

  GetSingleOrder:
    Description: "GetSingleOrder Lambda Function ARN"
    Value: !GetAtt GetSingleOrder.Arn

  PostOrders:
    Description: "PostOrders Lambda Function ARN"
    Value: !GetAtt PostOrders.Arn

  UpdateOrder:
    Description: "UpdateOrder Lambda Function ARN"
    Value: !GetAtt UpdateOrder.Arn

  DeleteOrder:
    Description: "DeleteOrder Lambda Function ARN"
    Value: !GetAtt DeleteOrder.Arn

  OrderApiEndpoint:
    Description: "API Gateway endpoint URL for Dev stage for Order Get function"
    Value: !Sub "https://${OrderApi}.execute-api.${AWS::Region}.amazonaws.com/Dev/orders/"

  OrderQueueUrl:
    Description: "URL of order queue"
    Value: !Ref OrderQueue

  OrderDLQueueUrl:
    Description: "URL of order dead-letter queue"
    Value: !Ref OrderDLQueue

  CognitoClientID:
    Description: "The client ID of the Cognito user pool"
    Value: !Ref OrderCognitoPoolClient

  CognitoUserPoolID:
    Description: "ID of the Cognito userpool"
    Value: !Ref OrderCognitoPool

  CognitoDomain:
    Description: "ID of the Cognito Domain"
    Value: !Ref OrderCognitoDomain

  CognitoResourceServer:
    Description: "Cognito Resource Server"
    Value: !Ref OrderCognitoResourceServer