commitment-form-processor.template

AWSTemplateFormatVersion: '2010-09-09'
Transform: 'AWS::Serverless-2016-10-31'
Parameters:
  GoogleClientEmail:
    Type: String
  GooglePrivateKeyEncrypted:
    Type: String
  GoogleSpreadsheetId:
    Type: String
  KmsKeyArn:
    Type: String
  Stage:
    Type: String
  ForwardAddress:
    Type: String
  EmailBucket:
    Type: String
  ForwardFromName:
    Type: String
  ForwardFromAddress:
    Type: String
Resources:
  ReplyFunction:
    Type: 'AWS::Serverless::Function'
    Properties:
      Handler: src/reply.handler
      Runtime: nodejs6.10
      CodeUri: 'commitment-form-processor.zip'
      AutoPublishAlias: !Ref Stage
      Description: Sends an email to the user after commitment.
      MemorySize: 128
      Timeout: 6
      Role: !GetAtt ReplyFunctionRole.Arn
      Tags:
        group: jesuscares
      Tracing: Active
  ReplyFunctionRole:
    Type: 'AWS::IAM::Role'
    Properties:
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          -
            Effect: Allow
            Principal:
              Service:
                - lambda.amazonaws.com
            Action:
              -
                sts:AssumeRole
      ManagedPolicyArns:
          - 'arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole'
          - 'arn:aws:iam::aws:policy/AWSXrayWriteOnlyAccess'
      Policies:
        -
          PolicyName: ReplyFunctionPolicy
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              -
                Effect: Allow
                Action:
                  -
                    ses:SendTemplatedEmail
                Resource:
                  -
                    '*'
  WriteSheetFunction:
    Type: 'AWS::Serverless::Function'
    Properties:
      Handler: src/write-sheet.handler
      Runtime: nodejs6.10
      CodeUri: 'commitment-form-processor.zip'
      AutoPublishAlias: !Ref Stage
      Description: Writes a Google sheet with a user's commitment form information.
      MemorySize: 128
      Timeout: 10
      Role: !GetAtt WriteSheetFunctionRole.Arn
      Environment:
        Variables:
          CLIENT_EMAIL: !Ref GoogleClientEmail
          SPREADSHEET_ID: !Ref GoogleSpreadsheetId
          private_key: !Ref GooglePrivateKeyEncrypted
      Tags:
        group: jesuscares
      Tracing: Active
      KmsKeyArn: !Ref KmsKeyArn
  WriteSheetFunctionRole:
    Type: 'AWS::IAM::Role'
    Properties:
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          -
            Effect: Allow
            Principal:
              Service:
                - lambda.amazonaws.com
            Action:
              -
                sts:AssumeRole
      ManagedPolicyArns:
        - 'arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole'
        - 'arn:aws:iam::aws:policy/AWSXrayWriteOnlyAccess'
  ForwardFunction:
    Type: 'AWS::Serverless::Function'
    Properties:
      Handler: src/forward.handler
      Runtime: nodejs6.10
      CodeUri: 'commitment-form-processor.zip'
      AutoPublishAlias: !Ref Stage
      Description: 'Forwards emails from the email address used in commitment form processor reply handler to the specified email address.'
      MemorySize: 128
      Timeout: 8
      Role: !GetAtt ForwardFunctionRole.Arn
      Environment:
        Variables:
          FORWARD_ADDRESS: !Ref ForwardAddress
          EMAIL_BUCKET: !Ref EmailBucket
          FROM_NAME: !Ref ForwardFromName
          FROM_ADDRESS: !Ref ForwardFromAddress
      Tags:
        group: jesuscares
      Tracing: Active
  ForwardFunctionRole:
    Type: 'AWS::IAM::Role'
    Properties:
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          -
            Effect: Allow
            Principal:
              Service:
                - lambda.amazonaws.com
            Action:
              -
                sts:AssumeRole
      ManagedPolicyArns:
        - 'arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole'
        - 'arn:aws:iam::aws:policy/AWSXrayWriteOnlyAccess'
      Policies:
        -
          PolicyName: ForwardFunctionS3Policy
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              -
                Effect: Allow
                Action:
                  -
                    s3:GetObject
                Resource:
                  -
                    !Join
                      - ''
                      - - 'arn:aws:s3:::'
                        - !Ref EmailBucket
                        - '*'
        -
          PolicyName: ForwardFunctionSesPolicy
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              -
                Effect: Allow
                Action:
                  -
                    ses:SendEmail
                Resource:
                  -
                    '*'
  Api:
    Type: 'AWS::Serverless::Api'
    Properties:
      StageName: !Ref Stage
      DefinitionBody:
        swagger: "2.0"
        info:
          title: "JesusCares Forms API"
        basePath: "/prod"
        schemes:
        - "https"
        paths:
          /rest/forms:
            post:
              description: "Accepts commitment form submissions for processing."
              consumes:
              - "application/json"
              produces:
              - "application/json"
              parameters:
              - in: "body"
                name: "CommitmentFormJSON"
                description: "Commitment form values to be submitted."
                required: true
                schema:
                  $ref: "#/definitions/CommitmentFormJSON"
              responses:
                '200':
                  description: "Request was successful. Form will be processed."
                  schema:
                    $ref: "#/definitions/Response"
                  headers:
                    Access-Control-Allow-Origin:
                      type: "string"
                '400':
                  description: "Request was unsuccessful, client error"
                  schema:
                    $ref: "#/definitions/Response"
                '500':
                  description: "Request was unsuccessful, server error"
                  schema:
                    $ref: "#/definitions/Response"
              x-amazon-apigateway-integration:
                credentials: !GetAtt ApiGatewayStepFunctionsRole.Arn
                responses:
                  4\d{2}:
                    statusCode: "400"
                    responseTemplates:
                      application/json: "#set($inputRoot = $input.path('$'))\n{\n  \"success\"\
                        \ : false,\n  \"message\" : \"Request was not successful, client error.\"\
                        \n}"
                  5\d{2}:
                    statusCode: "500"
                    responseTemplates:
                      application/json: "#set($inputRoot = $input.path('$'))\n{\n  \"success\"\
                        \ : false,\n  \"message\" : \"Request was not successful, server error.\"\
                        \n}"
                  2\d{2}:
                    statusCode: "200"
                    responseParameters:
                      method.response.header.Access-Control-Allow-Origin: "'*'"
                    responseTemplates:
                      application/json: "#set($inputRoot = $input.path('$'))\n{\n  \"success\"\
                        \ : true,\n  \"message\" : 'Request successful'\n}"
                uri:
                  !Join
                    - ''
                    - - 'arn:aws:apigateway:'
                      - !Ref 'AWS::Region'
                      - ':states:action/StartExecution'
                passthroughBehavior: "when_no_templates"
                httpMethod: "POST"
                requestTemplates:
                  application/json:
                    !Join
                      - ''
                      - - "{\n    \"input\": \"$util.escapeJavaScript($input.json('$'))\"\
                      ,\n    \"stateMachineArn\": \""
                        - !Ref StateMachine
                        - "\"\
                        \n} "
                type: "aws"
            options:
              consumes:
              - "application/json"
              produces:
              - "application/json"
              responses:
                '200':
                  description: "200 response"
                  schema:
                    $ref: "#/definitions/Empty"
                  headers:
                    Access-Control-Allow-Origin:
                      type: "string"
                    Access-Control-Allow-Methods:
                      type: "string"
                    Access-Control-Allow-Headers:
                      type: "string"
              x-amazon-apigateway-integration:
                responses:
                  default:
                    statusCode: "200"
                    responseParameters:
                      method.response.header.Access-Control-Allow-Methods: "'POST,OPTIONS'"
                      method.response.header.Access-Control-Allow-Headers: "'Content-Type,X-Amz-Date,Authorization,X-Api-Key,X-Amz-Security-Token'"
                      method.response.header.Access-Control-Allow-Origin: "'*'"
                passthroughBehavior: "when_no_match"
                requestTemplates:
                  application/json: "{\"statusCode\": 200}"
                type: "mock"
        definitions:
          Response:
            type: "object"
            properties:
              success:
                type: "boolean"
              message:
                type: "string"
            title: "CommitmentFormJSON"
          CommitmentFormJSON:
            type: "object"
            required:
            - "commitment"
            - "email"
            - "first-name"
            - "last-name"
            - "type"
            properties:
              language:
                type: "string"
              type:
                type: "string"
              first-name:
                type: "string"
              last-name:
                type: "string"
              email:
                type: "string"
              commitment:
                type: "string"
              age:
                type: "integer"
            title: "CommitmentFormJSON"
          Empty:
            type: "object"
            title: "Empty Schema"
        x-amazon-apigateway-documentation:
          version: "1"
          createdDate: "2017-11-27T21:15:33Z"
          documentationParts:
          - location:
              type: "METHOD"
              path: "/rest/forms"
              method: "POST"
            properties:
              description: "Accepts commitment form submissions for processing."
          - location:
              type: "MODEL"
              name: "Empty"
            properties:
              title: "Empty Schema"
          - location:
              type: "REQUEST_BODY"
              path: "/rest/forms"
              method: "POST"
            properties:
              description: "Commitment form values to be submitted."
          - location:
              type: "RESOURCE"
              path: "/rest/forms"
            properties:
              description: "Handles commitment forms."
          - location:
              type: "RESPONSE"
              path: "/rest/donate"
              method: "OPTIONS"
              statusCode: "200"
            properties:
              description: "200 response"
          - location:
              type: "RESPONSE"
              path: "/rest/donate"
              method: "POST"
              statusCode: "200"
            properties:
              description: "200 response"
          - location:
              type: "RESPONSE"
              path: "/rest/forms"
              method: "POST"
              statusCode: "200"
            properties:
              description: "Request was successful. Form will be processed."
          - location:
              type: "RESPONSE"
              path: "/rest/forms"
              method: "POST"
              statusCode: "400"
            properties:
              description: "Request was unsuccessful, client error"
          - location:
              type: "RESPONSE"
              path: "/rest/forms"
              method: "POST"
              statusCode: "500"
            properties:
              description: "Request was unsuccessful, server error"
  ApiGatewayStepFunctionsRole:
    Type: 'AWS::IAM::Role'
    Properties:
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          -
            Effect: Allow
            Principal:
              Service:
                - apigateway.amazonaws.com
            Action:
              -
                sts:AssumeRole
      ManagedPolicyArns:
        - 'arn:aws:iam::aws:policy/service-role/AmazonAPIGatewayPushToCloudWatchLogs'
      Policies:
        -
          PolicyName: StateMachineStartExecution
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              -
                Effect: Allow
                Action:
                  -
                    states:StartExecution
                Resource:
                  -
                    !Ref StateMachine
    DependsOn: StateMachine
  StateMachine:
    Type: 'AWS::StepFunctions::StateMachine'
    Properties:
      DefinitionString:
        Fn::Sub:
          - '{"Comment":"Jesus Cares commitment forms","StartAt":"Parallel","States":{"Parallel":{"Type":"Parallel","Next":"FinalState","Branches":[{"StartAt":"AutoReply","States":{"AutoReply":{"Type":"Task","Resource":"${replyLambdaArn}","End":true}}},{"StartAt":"WriteSheet","States":{"WriteSheet":{"Type":"Task","Resource":"${writeSheetLambdaArn}","End":true}}}]},"FinalState":{"Type":"Pass","End":true}}}'
          - {replyLambdaArn: !GetAtt ReplyFunction.Arn, writeSheetLambdaArn: !GetAtt WriteSheetFunction.Arn}
      RoleArn: !GetAtt StateMachineRole.Arn
  StateMachineRole:
    Type: 'AWS::IAM::Role'
    Properties:
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          -
            Effect: Allow
            Principal:
              Service:
                -
                  !Join
                    - ''
                    - - 'states.'
                      - !Ref "AWS::Region"
                      - '.amazonaws.com'
            Action:
              -
                sts:AssumeRole
      Path: '/service-role/'
      Policies:
          -
            PolicyName: LambdaInvoke
            PolicyDocument:
              Version: '2012-10-17'
              Statement:
                -
                  Effect: Allow
                  Action:
                    -
                      lambda:InvokeFunction
                  Resource:
                    -
                      '*'