cf.yml

Parameters:

  CognitoIdentityPoolId:
    Type: String
    Description: the _pre-existing_ id for a cognito identity pool

  GoogleClientID:
    Type: String
    Description: the _pre-existing_ id for google oauth

  GoogleMapsAPIKey:
    Type: String
    Description: the _pre-existing_ google maps api key

  HostedZoneName:
    Type: String
    Description: Route53 hosted zone domain name e.g. yourdomain.com (don't include trailing '.')

  WebsiteSubDomain:
    Type: String
    Description: subdomain for frontend website

  UbuntuAMIParameter:
    Type: String
    Default: ami-ae6259cd
    Description: Ubuntu 16.04 AMI (default is ap-southeast-2 image) Choose relevant ubuntu image for your region.

  SpatialServicesSubDomain:
    Type: String
    Description: sub domain which API Gateway will proxy to

  LetsencryptEmail:
    Type: String
    Description: email address for letsencrypt cert registration purposes

  KeyPairParameter:
    Type: AWS::EC2::KeyPair::KeyName
    Description: Keypair for EC2 instance


Mappings:
  HostedZoneIdMap:
    us-east-1:
      hostedZoneid: Z3AQBSTGFYJSTF
    us-east-2:
      hostedZoneid: Z2O1EMRO9K5GLX
    us-west-1:
      hostedZoneid: Z2F56UZL2M1ACD
    us-west-2:
      hostedZoneid: Z3BJ6K6RIION7M
    ca-central-1:
      hostedZoneid: Z1QDHH18159H29
    ap-south-1:
      hostedZoneid: Z11RGJOFQNVJUP
    ap-northeast-2:
      hostedZoneid: Z3W03O7B5YMIYP
    ap-southeast-1:
      hostedZoneid: Z3O0J2DXBE1FTB
    ap-southeast-2:
      hostedZoneid: Z1WCIGYICN2BYD
    ap-northeast-1:
      hostedZoneid: Z2M4EHUR26P7ZW
    eu-central-1:
      hostedZoneid: Z21DNDUVLTQW6Q
    eu-west-1:
      hostedZoneid: Z1BKCTXD74EZPE
    eu-west-2:
      hostedZoneid: Z3GKZC51ZF0DB4
    sa-east-1:
      hostedZoneid: Z7KQH4QJS55SO

Resources:

  VPC:
    Type: "AWS::EC2::VPC"
    Properties:
      CidrBlock: 10.0.0.0/16
      EnableDnsSupport: true
      EnableDnsHostnames: true
      InstanceTenancy: default
      Tags:
        - Key: Name
          Value: !Join [ "-", [ !Ref "AWS::StackName", vpc ] ]

  InternetGateway:
    Type: "AWS::EC2::InternetGateway"
    Properties:
      Tags:
        - Key: Name
          Value: !Join [ "-", [ !Ref "AWS::StackName", ig ] ]

  VPCGatewayAttachment:
    Type: "AWS::EC2::VPCGatewayAttachment"
    Properties:
      InternetGatewayId: !Ref InternetGateway
      VpcId: !Ref VPC


  PublicSubnet:
    Type: "AWS::EC2::Subnet"
    Properties:
      AvailabilityZone: ap-southeast-2a
      CidrBlock: 10.0.1.0/24
      MapPublicIpOnLaunch: true
      Tags:
        - Key: Name
          Value: !Join [ "-", [ !Ref "AWS::StackName", public-subnet ] ]
      VpcId: !Ref VPC

  PublicRouteTable:
    Type: "AWS::EC2::RouteTable"
    Properties:
      VpcId: !Ref VPC
      Tags:
        - Key: Name
          Value: !Join [ "-", [ !Ref "AWS::StackName", public ] ]

  PublicRouteTableAssoc:
    Type: "AWS::EC2::SubnetRouteTableAssociation"
    Properties:
      RouteTableId: !Ref PublicRouteTable
      SubnetId: !Ref PublicSubnet

  IGRoute:
    DependsOn: VPCGatewayAttachment
    Type: "AWS::EC2::Route"
    Properties:
      DestinationCidrBlock: 0.0.0.0/0
      GatewayId: !Ref InternetGateway
      RouteTableId: !Ref PublicRouteTable

  EC2SecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: !Join [ "-", [ !Ref "AWS::StackName", sg ] ]
      SecurityGroupIngress:
        -
          IpProtocol: "tcp"
          FromPort: "22"
          ToPort: "22"
          CidrIp: "0.0.0.0/0"
        -
          IpProtocol: "tcp"
          FromPort: "5000"
          ToPort: "5000"
          CidrIp: "0.0.0.0/0"
        -
          IpProtocol: "tcp"
          FromPort: "443"
          ToPort: "443"
          CidrIp: "0.0.0.0/0"
        -
          IpProtocol: "tcp"
          FromPort: "80"
          ToPort: "80"
          CidrIp: "0.0.0.0/0"
      VpcId:
        !Ref VPC

  EC2Role:
    Type: "AWS::IAM::Role"
    Properties:
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          -
            Effect: "Allow"
            Principal:
              Service:
                - "ec2.amazonaws.com"
            Action:
              - "sts:AssumeRole"
      Path: "/"
      Policies:
        -
          PolicyName: "inline-policy"
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              -
                Effect: "Allow"
                Action:
                  - apigateway:GET
                Resource: !Sub arn:aws:apigateway:${AWS::Region}::/clientcertificates/${APIGClientCertificate}

  EC2InstanceProfile:
    Type: "AWS::IAM::InstanceProfile"
    Properties:
      Roles:
        - !Ref EC2Role

  SpatialServicesEC2:
    DependsOn:
      - APIGClientCertificate
    Type: AWS::EC2::Instance
    Properties:
      InstanceType: t2.nano
      ImageId:
        Ref: UbuntuAMIParameter
      KeyName:
        Ref: KeyPairParameter
      Tags:
        - Key: Name
          Value: !Join [ "-", [ !Ref "AWS::StackName", spatial-ec2  ] ]
      SecurityGroupIds:
        - !Ref EC2SecurityGroup
      IamInstanceProfile: !Ref EC2InstanceProfile
      SubnetId: !Ref PublicSubnet
      UserData:
        Fn::Base64: !Sub |
          #!/bin/bash
          export APIG_CLIENT_CERT=${APIGClientCertificate}
          export FQDN=${SpatialServicesSubDomain}.${HostedZoneName}
          export EMAIL=${LetsencryptEmail}
          export AWS_DEFAULT_REGION=${AWS::Region}
          echo $FQDN
          echo $EMAIL
          apt-get update
          apt-get install -y git
          apt-get install -y postgresql-client
          git clone https://github.com/gsat-technology/termini
          chmod u+x ./termini/ec2-conf/*.sh
          ./termini/ec2-conf/install-docker.sh
          ./termini/ec2-conf/install-nginx.sh $FQDN $EMAIL
          docker-compose -f ./termini/docker-compose.yml up --build -d
          export PGPASSWORD=docker
          psql -U docker -h localhost -p 5432 postgres -c "CREATE DATABASE spatial;"
          #previous command may not work if postgis not fully in service
          #below while loop keeps trying until it works
          while [ $? -ne 0 ]; do sleep 1 ; psql -U docker -h localhost -p 5432 postgres -c "CREATE DATABASE spatial;" ; done
          psql -U docker -h localhost -p 5432 spatial -f ./termini/files/spatial.dump.sql
          #configure api gateway client certificate
          pip install awscli
          apt-get install -y jq
          mkdir /etc/nginx/apig
          aws apigateway get-client-certificate --client-certificate-id $APIG_CLIENT_CERT \
            | jq .pemEncodedCertificate --raw-output > /etc/nginx/apig/client.crt
          service nginx restart



  EC2DNSRecord:
    Type: "AWS::Route53::RecordSet"
    Properties:
      HostedZoneName: !Join [ ".", [ !Ref HostedZoneName, "" ] ]
      Name: !Join [ ".", [ !Ref SpatialServicesSubDomain, !Ref HostedZoneName ] ]
      ResourceRecords:
        - !GetAtt SpatialServicesEC2.PublicIp
      TTL: 300
      Type: A

  WebsiteDNS:
    Type: AWS::Route53::RecordSetGroup
    Properties:
      HostedZoneName: !Sub ${HostedZoneName}.
      Comment: alias pointing to website-enabled s3 bucket
      RecordSets:
      - Name: !Sub ${PublicWebsiteS3Bucket}.
        Type: A
        AliasTarget:
          #AWS does not document very well what value is needed for HostedZoneId
          #find ids in table called 'Amazon Simple Storage Service Website Endpoints'
          #on this page: http://docs.aws.amazon.com/general/latest/gr/rande.html#s3_region
          HostedZoneId: !FindInMap [HostedZoneIdMap, !Ref "AWS::Region", hostedZoneid]
          DNSName: !Sub s3-website-${AWS::Region}.amazonaws.com

  APIGateway:
    Type: "AWS::ApiGateway::RestApi"
    Properties:
      Name:
        !Join [ "_", [ !Ref "AWS::StackName", APIG ] ]

  APIGTerminiResource:
    Type: "AWS::ApiGateway::Resource"
    Properties:
      ParentId:
        !GetAtt APIGateway.RootResourceId
      PathPart: termini
      RestApiId: !Ref APIGateway

  TerminiResourceGET:
    Type: AWS::ApiGateway::Method
    Properties:
      AuthorizationType: AWS_IAM
      HttpMethod: GET
      ResourceId:
        !Ref APIGTerminiResource
      RestApiId:
        !Ref APIGateway
      Integration:
        IntegrationHttpMethod: GET
        Type: HTTP_PROXY
        Uri: !Sub https://${SpatialServicesSubDomain}.${HostedZoneName}/termini

  TerminiResourceOPTIONS:
    Type: AWS::ApiGateway::Method
    Properties:
      AuthorizationType: NONE
      RestApiId: !Ref APIGateway
      ResourceId: !Ref APIGTerminiResource
      HttpMethod: OPTIONS
      Integration:
        IntegrationResponses:
        - StatusCode: 200
          ResponseParameters:
            method.response.header.Access-Control-Allow-Headers: "'Content-Type,X-Amz-Date,Authorization,X-Api-Key,X-Amz-Security-Token'"
            method.response.header.Access-Control-Allow-Methods: "'GET'"
            method.response.header.Access-Control-Allow-Origin: "'*'"
          ResponseTemplates:
            application/json: ''
        RequestTemplates:
          application/json: '{"statusCode": 200}'
        Type: MOCK
      MethodResponses:
      - StatusCode: 200
        ResponseModels:
          application/json: 'Empty'
        ResponseParameters:
            method.response.header.Access-Control-Allow-Headers: false
            method.response.header.Access-Control-Allow-Methods: false
            method.response.header.Access-Control-Allow-Origin: false

  #Note this resource is required even though it will
  #actually create a stage called 'dummystage' which won't
  #be used. Some info from AWS forum here:
  #https://forums.aws.amazon.com/thread.jspa?messageID=737087
  APIGDeploymentProd:
    DependsOn:
      - APIGTerminiResource
      - TerminiResourceGET
    Type: "AWS::ApiGateway::Deployment"
    Properties:
      RestApiId:
        !Ref APIGateway
      StageName: dummystage


  APIGStage:
    Type: "AWS::ApiGateway::Stage"
    Properties:
      ClientCertificateId: !Ref APIGClientCertificate
      DeploymentId: !Ref APIGDeploymentProd
      RestApiId: !Ref APIGateway
      StageName: LATEST
      MethodSettings:
        -
          LoggingLevel: INFO
          DataTraceEnabled: "true"
          #does all resource and ticks all
          #the boxes at the stage level
          ResourcePath: /*
          HttpMethod: "*"
          #or use the below to target the 'termini' resource
          #ResourcePath: /~1termini
          MetricsEnabled: "true"


  APIGClientCertificate:
    Type: "AWS::ApiGateway::ClientCertificate"
    Properties:
      Description: !Sub ${AWS::Region}-client-cert

  APIGAccount:
    Type: "AWS::ApiGateway::Account"
    Properties:
      CloudWatchRoleArn: !GetAtt APIGCloudWatchLogsRole.Arn

  APIGCloudWatchLogsRole:
    Type: "AWS::IAM::Role"
    Properties:
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          -
            Effect: "Allow"
            Principal:
              Service:
                - "apigateway.amazonaws.com"
            Action:
              - "sts:AssumeRole"
      Path: "/"
      Policies:
        -
          PolicyName: "inline-policy"
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              -
                Effect: "Allow"
                Action:
                  - logs:CreateLogGroup
                  - logs:CreateLogStream
                  - logs:DescribeLogGroups
                  - logs:DescribeLogStreams
                  - logs:PutLogEvents
                  - logs:GetLogEvents
                  - logs:FilterLogEvents
                Resource: "*"

  PublicWebsiteS3Bucket:
    Type: AWS::S3::Bucket
    Properties:
      AccessControl: LogDeliveryWrite
      BucketName: !Sub ${WebsiteSubDomain}.${HostedZoneName}
      WebsiteConfiguration:
        IndexDocument: index.html
      LoggingConfiguration:
        LogFilePrefix: logs/
    DeletionPolicy: Delete

  PublicWebsitePolicy:
    Type: "AWS::S3::BucketPolicy"
    Properties:
      Bucket: !Ref PublicWebsiteS3Bucket
      PolicyDocument:
        Statement:
          -
            Action:
              - s3:GetObject
            Effect: "Allow"
            Resource:
              !Join [ "", [ "arn:aws:s3:::", !Ref PublicWebsiteS3Bucket, "/*"  ] ]
            #NotResource:
            #  !Join [ "", [ "arn:aws:s3:::", !Ref PublicWebsiteS3Bucket, "/logs"  ] ]
            Principal: "*"

  CognitoAuthedRole:
    Type: "AWS::IAM::Role"
    Properties:
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          -
            Effect: "Allow"
            Principal:
              Federated:
                - "cognito-identity.amazonaws.com"
            Action:
              - "sts:AssumeRoleWithWebIdentity"
            Condition:
              StringEquals:
                cognito-identity.amazonaws.com:aud: !Ref CognitoIdentityPoolId
              ForAnyValue:StringLike:
                cognito-identity.amazonaws.com:amr: authenticated

      Path: "/"
      Policies:
        -
          PolicyName: "inline-policy"
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              -
                Effect: "Allow"
                Action:
                  - execute-api:Invoke
                Resource: !Sub arn:aws:execute-api:${AWS::Region}:${AWS::AccountId}:${APIGateway}/LATEST/GET/termini

  # LogGroupAPIGBase:
  #   Type: "AWS::Logs::LogGroup"
  #   Properties:
  #     LogGroupName: !Sub API-Gateway-Execution-Logs_${APIGateway}
  #     RetentionInDays: 1
  #
  # LogGroupAPIGLatest:
  #   Type: "AWS::Logs::LogGroup"
  #   Properties:
  #     LogGroupName: !Sub API-Gateway-Execution-Logs_${APIGateway}/LATEST
  #     RetentionInDays: 1
  #
  # LogGroupAPIGDummyStage:
  #   Type: "AWS::Logs::LogGroup"
  #   Properties:
  #     LogGroupName: !Sub API-Gateway-Execution-Logs_${APIGateway}/dummystage
  #     RetentionInDays: 1

Outputs:
  APIGEndpoint:
    Description: APIG endpoint
    Value:
      !Sub https://${APIGateway}.execute-api.${AWS::Region}.amazonaws.com/LATEST

  APIGID:
    Description: APIG Id
    Value:
      !Ref APIGateway

  CognitoAuthedRoleArn:
    Description: Cognito authed role arn
    Value:
      !GetAtt CognitoAuthedRole.Arn

  PublicWebsiteS3Bucket:
    Description: Public website bucket name
    Value: !Ref PublicWebsiteS3Bucket

  CognitoIdentityPoolId:
    Description: cognito identity pool id
    Value: !Ref CognitoIdentityPoolId

  GoogleClientID:
    Description: google oauth client id
    Value: !Ref GoogleClientID

  GoogleMapsAPIKey:
    Description: google maps api key
    Value: !Ref GoogleMapsAPIKey

  Region:
    Description: aws region of this deployment
    Value: !Ref AWS::Region