{ "AWSTemplateFormatVersion": "2010-09-09", "Transform": "AWS::Serverless-2016-10-31", "Outputs": { "RestAPIId": { "Value": { "Ref": "RestAPI" } }, "APIHandlerName": { "Value": { "Ref": "APIHandler" } }, "APIHandlerArn": { "Value": { "Fn::GetAtt": [ "APIHandler", "Arn" ] } }, "EndpointURL": { "Value": { "Fn::Sub": "https://${RestAPI}.execute-api.${AWS::Region}.${AWS::URLSuffix}/store/" } }, "WaitingRoomURL": { "Value": { "Fn::Sub": [ "https://${CloudFrontDomainName}/waiting-room-site/index.html?eventId=${EventID}&publicApiUrl=${PublicAPIEndpoint}&commerceApiUrl=https://${RestAPI}.execute-api.${AWS::Region}.amazonaws.com/store", { "CloudFrontDomainName": { "Fn::GetAtt": [ "SampleWebContentCloudFront", "DomainName" ] } } ] } }, "ControlPanelURL": { "Value": { "Fn::Sub": [ "https://${CloudFrontDomainName}/control-panel/index.html?eventId=${EventID}&publicApiUrl=${PublicAPIEndpoint}&privateApiUrl=${PrivateAPIEndpoint}®ionName=${AWS::Region}", { "CloudFrontDomainName": { "Fn::GetAtt": [ "SampleWebContentCloudFront", "DomainName" ] } } ] } } }, "Resources": { "DefaultRole": { "Type": "AWS::IAM::Role", "Properties": { "AssumeRolePolicyDocument": { "Version": "2012-10-17", "Statement": [ { "Sid": "", "Effect": "Allow", "Principal": { "Service": "lambda.amazonaws.com" }, "Action": "sts:AssumeRole" } ] }, "Policies": [ { "PolicyDocument": { "Version": "2012-10-17", "Statement": [ { "Sid": "e74c1fd6fae1d4af2dc0c7b3f7d87f5d051e8fe5", "Action": "s3:*", "Effect": "Deny", "Resource": "arn:aws:s3:::*", "Condition": { "StringNotEquals": { "s3:ResourceAccount": { "Fn::Sub": "${AWS::AccountId}" } } } }, { "Effect": "Allow", "Action": [ "s3:PutObject", "s3:ListBucket", "s3:DeleteObject" ], "Resource": [ { "Fn::GetAtt": [ "SampleWebContentBucket", "Arn" ] }, { "Fn::Join": [ "/", [ { "Fn::GetAtt": [ "SampleWebContentBucket", "Arn" ] }, "*" ] ] } ], "Sid": "1a85431c16a6568990f6dceb8c964199d651fa8c" }, { "Effect": "Allow", "Action": [ "logs:CreateLogGroup", "logs:CreateLogStream", "logs:DescribeLogGroups", "logs:DescribeLogStreams", "logs:PutLogEvents", "logs:GetLogEvents", "logs:FilterLogEvents" ], "Resource": { "Fn::Sub": "arn:aws:logs:${AWS::Region}:${AWS::AccountId}:log-group:*:*" } } ] }, "PolicyName": "DefaultRolePolicy" } ] } }, "RestAPI": { "Type": "AWS::Serverless::Api", "Properties": { "EndpointConfiguration": "EDGE", "StageName": "store", "DefinitionBody": { "swagger": "2.0", "info": { "version": "1.0", "title": { "Fn::Sub": "${AWS::StackName}-sample-protected-api" }, "description": "Waiting Room Sample Protected API" }, "schemes": [ "https" ], "paths": { "/checkout": { "get": { "consumes": [ "application/json" ], "produces": [ "application/json" ], "responses": { "200": { "description": "200 response", "schema": { "$ref": "#/definitions/Empty" } } }, "x-amazon-apigateway-integration": { "responses": { "default": { "statusCode": "200" } }, "uri": { "Fn::Sub": "arn:${AWS::Partition}:apigateway:${AWS::Region}:lambda:path/2015-03-31/functions/${APIHandler.Arn}/invocations" }, "passthroughBehavior": "when_no_match", "httpMethod": "POST", "contentHandling": "CONVERT_TO_TEXT", "type": "aws_proxy" }, "summary": "This function represents a /checkout API endpoint.", "security": [ { "WaitingRoomAuthorizer": [] } ] }, "options": { "consumes": [ "application/json" ], "produces": [ "application/json" ], "responses": { "200": { "description": "200 response", "schema": { "$ref": "#/definitions/Empty" }, "headers": { "Access-Control-Allow-Methods": { "type": "string" }, "Access-Control-Allow-Origin": { "type": "string" }, "Access-Control-Allow-Headers": { "type": "string" }, "Access-Control-Expose-Headers": { "type": "string" }, "Access-Control-Max-Age": { "type": "string" }, "Access-Control-Allow-Credentials": { "type": "string" } } } }, "x-amazon-apigateway-integration": { "responses": { "default": { "statusCode": "200", "responseParameters": { "method.response.header.Access-Control-Allow-Methods": "'GET,OPTIONS'", "method.response.header.Access-Control-Allow-Origin": "'*'", "method.response.header.Access-Control-Allow-Headers": "'*,Authorization,Content-Type,X-Amz-Date,X-Amz-Security-Token,X-Api-Key'", "method.response.header.Access-Control-Expose-Headers": "'*'", "method.response.header.Access-Control-Max-Age": "'600'", "method.response.header.Access-Control-Allow-Credentials": "'true'" } } }, "requestTemplates": { "application/json": "{\"statusCode\": 200}" }, "passthroughBehavior": "when_no_match", "type": "mock", "contentHandling": "CONVERT_TO_TEXT" } } }, "/search": { "get": { "consumes": [ "application/json" ], "produces": [ "application/json" ], "responses": { "200": { "description": "200 response", "schema": { "$ref": "#/definitions/Empty" } } }, "x-amazon-apigateway-integration": { "responses": { "default": { "statusCode": "200" } }, "uri": { "Fn::Sub": "arn:${AWS::Partition}:apigateway:${AWS::Region}:lambda:path/2015-03-31/functions/${APIHandler.Arn}/invocations" }, "passthroughBehavior": "when_no_match", "httpMethod": "POST", "contentHandling": "CONVERT_TO_TEXT", "type": "aws_proxy" }, "summary": "This function represents a /search API endpoint.", "security": [ { "WaitingRoomAuthorizer": [] } ] }, "options": { "consumes": [ "application/json" ], "produces": [ "application/json" ], "responses": { "200": { "description": "200 response", "schema": { "$ref": "#/definitions/Empty" }, "headers": { "Access-Control-Allow-Methods": { "type": "string" }, "Access-Control-Allow-Origin": { "type": "string" }, "Access-Control-Allow-Headers": { "type": "string" }, "Access-Control-Expose-Headers": { "type": "string" }, "Access-Control-Max-Age": { "type": "string" }, "Access-Control-Allow-Credentials": { "type": "string" } } } }, "x-amazon-apigateway-integration": { "responses": { "default": { "statusCode": "200", "responseParameters": { "method.response.header.Access-Control-Allow-Methods": "'GET,OPTIONS'", "method.response.header.Access-Control-Allow-Origin": "'*'", "method.response.header.Access-Control-Allow-Headers": "'*,Authorization,Content-Type,X-Amz-Date,X-Amz-Security-Token,X-Api-Key'", "method.response.header.Access-Control-Expose-Headers": "'*'", "method.response.header.Access-Control-Max-Age": "'600'", "method.response.header.Access-Control-Allow-Credentials": "'true'" } } }, "requestTemplates": { "application/json": "{\"statusCode\": 200}" }, "passthroughBehavior": "when_no_match", "type": "mock", "contentHandling": "CONVERT_TO_TEXT" } } }, "/layaway": { "get": { "consumes": [ "application/json" ], "produces": [ "application/json" ], "responses": { "200": { "description": "200 response", "schema": { "$ref": "#/definitions/Empty" } } }, "x-amazon-apigateway-integration": { "responses": { "default": { "statusCode": "200" } }, "uri": { "Fn::Sub": "arn:${AWS::Partition}:apigateway:${AWS::Region}:lambda:path/2015-03-31/functions/${APIHandler.Arn}/invocations" }, "passthroughBehavior": "when_no_match", "httpMethod": "POST", "contentHandling": "CONVERT_TO_TEXT", "type": "aws_proxy" }, "summary": "This function represents a /layaway API endpoint.", "security": [ { "WaitingRoomAuthorizer": [] } ] }, "options": { "consumes": [ "application/json" ], "produces": [ "application/json" ], "responses": { "200": { "description": "200 response", "schema": { "$ref": "#/definitions/Empty" }, "headers": { "Access-Control-Allow-Methods": { "type": "string" }, "Access-Control-Allow-Origin": { "type": "string" }, "Access-Control-Allow-Headers": { "type": "string" }, "Access-Control-Expose-Headers": { "type": "string" }, "Access-Control-Max-Age": { "type": "string" }, "Access-Control-Allow-Credentials": { "type": "string" } } } }, "x-amazon-apigateway-integration": { "responses": { "default": { "statusCode": "200", "responseParameters": { "method.response.header.Access-Control-Allow-Methods": "'GET,OPTIONS'", "method.response.header.Access-Control-Allow-Origin": "'*'", "method.response.header.Access-Control-Allow-Headers": "'*,Authorization,Content-Type,X-Amz-Date,X-Amz-Security-Token,X-Api-Key'", "method.response.header.Access-Control-Expose-Headers": "'*'", "method.response.header.Access-Control-Max-Age": "'600'", "method.response.header.Access-Control-Allow-Credentials": "'true'" } } }, "requestTemplates": { "application/json": "{\"statusCode\": 200}" }, "passthroughBehavior": "when_no_match", "type": "mock", "contentHandling": "CONVERT_TO_TEXT" } } } }, "definitions": { "Empty": { "type": "object", "title": "Empty Schema" } }, "x-amazon-apigateway-binary-media-types": [ "application/octet-stream", "application/x-tar", "application/zip", "audio/basic", "audio/ogg", "audio/mp4", "audio/mpeg", "audio/wav", "audio/webm", "image/png", "image/jpg", "image/jpeg", "image/gif", "video/ogg", "video/mpeg", "video/webm" ], "securityDefinitions": { "WaitingRoomAuthorizer": { "in": "header", "type": "apiKey", "name": "Authorization", "x-amazon-apigateway-authtype": "custom", "x-amazon-apigateway-authorizer": { "type": "token", "authorizerUri": { "Fn::Sub": "arn:aws:apigateway:${APIGatewayRegion}:lambda:path/2015-03-31/functions/${AuthorizerARN}/invocations" }, "authorizerResultTtlInSeconds": 300 } } } } } }, "APIHandler": { "Type": "AWS::Serverless::Function", "Properties": { "Runtime": "python3.8", "Handler": "app.app", "CodeUri": { "Bucket": { "Fn::Join": [ "-", [ { "Fn::FindInMap": [ "SourceCode", "General", "S3Bucket" ] }, { "Ref": "AWS::Region" } ] ] }, "Key": { "Fn::Join": [ "/", [ { "Fn::FindInMap": [ "SourceCode", "General", "KeyPrefix" ] }, "aws-virtual-waiting-room-sample-1637685532.zip" ] ] } }, "Tags": { "aws-chalice": "version=1.22.3:stage=dev:app=core-api-authorizers-sample" }, "Tracing": "PassThrough", "Timeout": 60, "MemorySize": 1024, "Role": { "Fn::GetAtt": [ "DefaultRole", "Arn" ] }, "Environment": { "Variables": { "SOLUTION_ID": { "Fn::FindInMap": [ "SolutionId", "UserAgent", "Extra" ] } } } }, "Metadata": { "cfn_nag": { "rules_to_suppress": [ { "id": "W89", "reason": "Lambda does not need to be in the Waiting Room VPC." }, { "id": "W92", "reason": "Lambda does not require ReservedConcurrentExecutions." } ] } } }, "APIHandlerInvokePermission": { "Type": "AWS::Lambda::Permission", "Properties": { "FunctionName": { "Ref": "APIHandler" }, "Action": "lambda:InvokeFunction", "Principal": "apigateway.amazonaws.com", "SourceArn": { "Fn::Sub": [ "arn:${AWS::Partition}:execute-api:${AWS::Region}:${AWS::AccountId}:${RestAPIId}/*", { "RestAPIId": { "Ref": "RestAPI" } } ] } } }, "AuthorizerInvokePermission": { "Type": "AWS::Lambda::Permission", "Properties": { "FunctionName": { "Ref": "AuthorizerARN" }, "Action": "lambda:InvokeFunction", "Principal": "apigateway.amazonaws.com", "SourceArn": { "Fn::Sub": [ "arn:${AWS::Partition}:execute-api:${AWS::Region}:${AWS::AccountId}:${RestAPIId}/*", { "RestAPIId": { "Ref": "RestAPI" } } ] } } }, "BucketLoaderFunction": { "Type": "AWS::Serverless::Function", "Properties": { "Runtime": "python3.8", "Handler": "cfn_bucket_loader.handler", "CodeUri": { "Bucket": { "Fn::Join": [ "-", [ { "Fn::FindInMap": [ "SourceCode", "General", "S3Bucket" ] }, { "Ref": "AWS::Region" } ] ] }, "Key": { "Fn::Join": [ "/", [ { "Fn::FindInMap": [ "SourceCode", "General", "KeyPrefix" ] }, "aws-virtual-waiting-room-sample-custom-resources-1637685532.zip" ] ] } }, "Tracing": "PassThrough", "Timeout": 60, "MemorySize": 1024, "Role": { "Fn::GetAtt": [ "DefaultRole", "Arn" ] }, "Environment": { "Variables": { "SOLUTION_ID": { "Fn::FindInMap": [ "SolutionId", "UserAgent", "Extra" ] } } } }, "Metadata": { "cfn_nag": { "rules_to_suppress": [ { "id": "W89", "reason": "Lambda does not need to be in the Waiting Room VPC." }, { "id": "W92", "reason": "Lambda does not require ReservedConcurrentExecutions." } ] } } }, "BucketLoaderResource": { "Type": "AWS::CloudFormation::CustomResource", "Properties": { "ServiceToken": { "Fn::GetAtt": [ "BucketLoaderFunction", "Arn" ] }, "BucketName": { "Ref": "SampleWebContentBucket" }, "APIs": { "public_api": { "Fn::Sub": "${PublicAPIEndpoint}" }, "private_api": { "Fn::Sub": "${PrivateAPIEndpoint}" }, "sample_api": { "Fn::Sub": "https://${RestAPI}.execute-api.${AWS::Region}.${AWS::URLSuffix}/store" } }, "Timestamp": "1637685532" } }, "SampleWebContentBucketOAI": { "Type": "AWS::CloudFront::CloudFrontOriginAccessIdentity", "Properties": { "CloudFrontOriginAccessIdentityConfig": { "Comment": "OAI for sample web content" } } }, "SampleWebContentCloudFront": { "Type": "AWS::CloudFront::Distribution", "Properties": { "DistributionConfig": { "Comment": "CDN for Virtual Waiting Room sample web content", "DefaultRootObject": "index.html", "DefaultCacheBehavior": { "TargetOriginId": "origin-www-bucket", "ForwardedValues": { "QueryString": false, "Cookies": { "Forward": "none" }, "Headers": [ "Origin", "Access-Control-Request-Method", "Access-Control-Request-Headers" ] }, "ViewerProtocolPolicy": "redirect-to-https", "AllowedMethods": [ "HEAD", "GET", "OPTIONS" ], "CachedMethods": [ "HEAD", "GET", "OPTIONS" ], "Compress": true, "MinTTL": 0, "DefaultTTL": 30, "MaxTTL": 60 }, "Enabled": true, "Origins": [ { "DomainName": { "Fn::Join": [ "", [ { "Ref": "SampleWebContentBucket" }, ".s3.amazonaws.com" ] ] }, "Id": "origin-www-bucket", "S3OriginConfig": { "OriginAccessIdentity": { "Fn::Join": [ "", [ "origin-access-identity/cloudfront/", { "Ref": "SampleWebContentBucketOAI" } ] ] } } } ], "ViewerCertificate": { "CloudFrontDefaultCertificate": true, "MinimumProtocolVersion": "TLSv1.2_2019" }, "Logging": { "Bucket": { "Fn::Join": [ "", [ { "Ref": "SampleWebLoggingBucket" }, ".s3.amazonaws.com" ] ] }, "IncludeCookies": true, "Prefix": "cf/" } } }, "Metadata": { "cfn_nag": { "rules_to_suppress": [ { "id": "W70", "reason": "If the distribution uses the CloudFront domain name such as d111111abcdef8.cloudfront.net (you set CloudFrontDefaultCertificate to true), CloudFront automatically sets the security policy to TLSv1 regardless of the value that you set here." } ] } } }, "SampleWebContentBucketPolicy": { "Type": "AWS::S3::BucketPolicy", "Properties": { "Bucket": { "Ref": "SampleWebContentBucket" }, "PolicyDocument": { "Version": "2012-10-17", "Id": "PolicyForCloudFrontPrivateContent", "Statement": [ { "Effect": "Allow", "Principal": { "CanonicalUser": { "Fn::GetAtt": [ "SampleWebContentBucketOAI", "S3CanonicalUserId" ] } }, "Action": "s3:GetObject", "Resource": { "Fn::Join": [ "", [ { "Fn::GetAtt": [ "SampleWebContentBucket", "Arn" ] }, "/*" ] ] } }, { "Effect": "Deny", "Principal": "*", "Action": "s3:*", "Resource": [ { "Fn::Join": [ "", [ { "Fn::GetAtt": [ "SampleWebContentBucket", "Arn" ] }, "/*" ] ] }, { "Fn::GetAtt": [ "SampleWebContentBucket", "Arn" ] } ], "Condition": { "Bool": { "aws:SecureTransport": "false" } } } ] } } }, "SampleWebLoggingBucketPolicy": { "Type": "AWS::S3::BucketPolicy", "Properties": { "Bucket": { "Ref": "SampleWebLoggingBucket" }, "PolicyDocument": { "Version": "2012-10-17", "Id": "PolicyForCloudFrontPrivateLogging", "Statement": [ { "Effect": "Deny", "Principal": "*", "Action": "s3:*", "Resource": [ { "Fn::Join": [ "", [ { "Fn::GetAtt": [ "SampleWebLoggingBucket", "Arn" ] }, "/*" ] ] }, { "Fn::GetAtt": [ "SampleWebLoggingBucket", "Arn" ] } ], "Condition": { "Bool": { "aws:SecureTransport": "false" } } } ] } } }, "SampleWebContentBucket": { "Type": "AWS::S3::Bucket", "Properties": { "CorsConfiguration": { "CorsRules": [ { "AllowedHeaders": [ "*" ], "AllowedMethods": [ "GET" ], "AllowedOrigins": [ "*" ] } ] }, "BucketEncryption": { "ServerSideEncryptionConfiguration": [ { "ServerSideEncryptionByDefault": { "SSEAlgorithm": "AES256" } } ] }, "LoggingConfiguration": { "DestinationBucketName": { "Ref": "SampleWebLoggingBucket" }, "LogFilePrefix": "www/" } } }, "SampleWebLoggingBucket": { "Type": "AWS::S3::Bucket", "DeletionPolicy": "Retain", "UpdateReplacePolicy": "Retain", "Properties": { "AccessControl": "LogDeliveryWrite", "BucketEncryption": { "ServerSideEncryptionConfiguration": [ { "ServerSideEncryptionByDefault": { "SSEAlgorithm": "AES256" } } ] }, "LifecycleConfiguration": { "Rules": [ { "AbortIncompleteMultipartUpload": { "DaysAfterInitiation": 5 }, "ExpirationInDays": 3650, "Id": "Expire Objects After 10 Years", "NoncurrentVersionExpirationInDays": 3650, "Status": "Enabled" } ] } }, "Metadata": { "cfn_nag": { "rules_to_suppress": [ { "id": "W35", "reason": "This is the logging bucket. No access logging needed." }, { "id": "W51", "reason": "This is the logging bucket. No bucket policy needed." } ] } } } }, "Description": "AWS Virtual Waiting Room API Sample v1.0.0", "Parameters": { "AuthorizerARN": { "Description": "ARN of the API Gateway Lambda Authorizer", "Type": "String" }, "APIGatewayRegion": { "Description": "AWS Region name of the API Gateway", "Type": "String" }, "PublicAPIEndpoint": { "Description": "Public endpoint URL for the virtual waiting room APIs", "Type": "String" }, "PrivateAPIEndpoint": { "Description": "Private endpoint URL for the virtual waiting room APIs", "Type": "String" }, "EventID": { "Description": "Event ID of waiting room", "Type": "String" } }, "Mappings": { "SourceCode": { "General": { "S3Bucket": "solutions", "KeyPrefix": "aws-virtual-waiting-room/v1.0.0" } }, "SolutionId": { "UserAgent": { "Extra": "AwsSolution/SO0166/v1.0.0" } } } }