template.yaml

AWSTemplateFormatVersion: 2010-09-09
Transform: AWS::Serverless-2016-10-31
Description: A community managed patch server for Jamf Pro.

Parameters:

  ParameterStorePath:
    Type: String
    Description: The root path for parameter store values.
    Default: /communitypatch

  DomainName:
    Type: String
    Description: The custom domain name for the API.

  HostedZoneId:
    Type: AWS::Route53::HostedZone::Id
    Description: The ID of hosted zone for the Route53 record.

  CertificateId:
    Type: String
    Description: The UUID for the certificate to use for the custom domain.

# SAM Globals

Globals:
  Function:
    Runtime: python3.6
    Handler: index.lambda_handler
    MemorySize: 256
    Environment:
      Variables:
        CONTRIBUTORS_TABLE: !Ref ContributorsTable
        DOMAIN_NAME: !Ref DomainName
        EMAIL_SNS_TOPIC: !Ref SendEmailTopic
        PARAM_STORE_PATH: !Ref ParameterStorePath
        TITLES_BUCKET: !Ref TitlesBucket
        TITLES_TABLE: !Ref TitlesTable

Resources:

# S3 Buckets

  TitlesBucket:
    Type: AWS::S3::Bucket

  TitlesBucketPolicy:
    Type: AWS::S3::BucketPolicy
    Properties:
      Bucket: !Ref TitlesBucket
      PolicyDocument:
        Statement:
          - Action: s3:GetObject
            Effect: Allow
            Resource: !Sub '${TitlesBucket.Arn}/*'
            Principal:
              AWS: !Sub 'arn:aws:iam::cloudfront:user/CloudFront Origin Access Identity ${CloudFrontOriginAccessIdentity}'

  WebContentBucket:
    Type: AWS::S3::Bucket

  WebContentBucketPolicy:
    Type: AWS::S3::BucketPolicy
    Properties:
      Bucket: !Ref WebContentBucket
      PolicyDocument:
        Statement:
          - Action: s3:GetObject
            Effect: Allow
            Resource: !Sub '${WebContentBucket.Arn}/*'
            Principal:
              AWS: !Sub 'arn:aws:iam::cloudfront:user/CloudFront Origin Access Identity ${CloudFrontOriginAccessIdentity}'

# DynamoDB Tables

  ContributorsTable:
    Type: AWS::Serverless::SimpleTable
    Properties:
      PrimaryKey:
        Name: id
        Type: String

  BlackListedTokensTable:
    Type: AWS::Serverless::SimpleTable
    Properties:
      PrimaryKey:
        Name: token_id
        Type: String

  TitlesTable:
    Type: AWS::DynamoDB::Table
    Properties:
      BillingMode: PAY_PER_REQUEST

      AttributeDefinitions:
      - AttributeName: contributor_id
        AttributeType: S
      - AttributeName: title_id
        AttributeType: S

      KeySchema:
      - AttributeName: contributor_id
        KeyType: HASH
      - AttributeName: title_id
        KeyType: RANGE

# SNS Topics

  SendEmailTopic:
    Type: AWS::SNS::Topic

# API Gateway

  ApiGateway:
    Type: AWS::Serverless::Api
    Properties:
      StageName: Prod
      DefinitionBody:
        swagger: "2.0"
        info:
          title: !Ref AWS::StackName

        securityDefinitions:
          authorizer:
            type: apiKey
            name: Authorization
            in: header
            x-amazon-apigateway-authtype: custom
            x-amazon-apigateway-authorizer:
              type: token
              authorizerUri: !Sub 'arn:aws:apigateway:${AWS::Region}:lambda:path/2015-03-31/functions/${Authorizer.Arn}/invocations'
              authorizerResultTtlInSeconds: 300

        paths:

          "/":
            get:
              x-amazon-apigateway-integration:
                contentHandling: "CONVERT_TO_TEXT"
                type: aws
                httpMethod: post
                uri: !Sub "arn:aws:apigateway:${AWS::Region}:lambda:path/2015-03-31/functions/${WebView.Arn}/invocations"
                passthroughBehavior: "when_no_match"
                responses:
                  default:
                    statusCode: "200"
                    responseParameters:
                      method.response.header.Content-Type: "'text/html'"
                    responseTemplates:
                      text/html: "$input.path('$')"
              produces:
                - "text/html"
              responses:
                "200":
                  description: "200 response"
                  headers:
                    Content-Type:
                      type: "string"

          "/api/v1/contributors":
            get:
              x-amazon-apigateway-integration:
                httpMethod: post
                type: aws_proxy
                uri: !Sub 'arn:aws:apigateway:${AWS::Region}:lambda:path/2015-03-31/functions/${ApiContributorsGet.Arn}/invocations'
              responses: {}

          "/api/v1/contributors/register":
            post:
              x-amazon-apigateway-integration:
                httpMethod: post
                type: aws_proxy
                uri: !Sub 'arn:aws:apigateway:${AWS::Region}:lambda:path/2015-03-31/functions/${ApiContributorRegistration.Arn}/invocations'
              responses: {}

          "/api/v1/contributors/verify":
            get:
              x-amazon-apigateway-integration:
                httpMethod: post
                type: aws_proxy
                uri: !Sub 'arn:aws:apigateway:${AWS::Region}:lambda:path/2015-03-31/functions/${ApiContributorVerification.Arn}/invocations'
              responses: {}

          "/api/v1/titles":
            post:
              x-amazon-apigateway-integration:
                httpMethod: post
                type: aws_proxy
                uri: !Sub 'arn:aws:apigateway:${AWS::Region}:lambda:path/2015-03-31/functions/${ApiTitlesCreate.Arn}/invocations'
              responses: {}
              security:
                - authorizer: []

          "/api/v1/titles/{title}/version":
            post:
              x-amazon-apigateway-integration:
                httpMethod: post
                type: aws_proxy
                uri: !Sub 'arn:aws:apigateway:${AWS::Region}:lambda:path/2015-03-31/functions/${ApiTitleVersions.Arn}/invocations'
              responses: {}
              security:
                - authorizer: []

          "/api/v1/titles/{title}/version/{version}":
            delete:
              x-amazon-apigateway-integration:
                httpMethod: post
                type: aws_proxy
                uri: !Sub 'arn:aws:apigateway:${AWS::Region}:lambda:path/2015-03-31/functions/${ApiTitleVersions.Arn}/invocations'
              responses: {}
              security:
                - authorizer: []

          "/api/v1/titles/{title}/versions":
            post:
              x-amazon-apigateway-integration:
                httpMethod: post
                type: aws_proxy
                uri: !Sub 'arn:aws:apigateway:${AWS::Region}:lambda:path/2015-03-31/functions/${ApiTitleVersions.Arn}/invocations'
              responses: {}
              security:
                - authorizer: []

            "/api/v1/titles/{title}/versions/{version}":
              delete:
                x-amazon-apigateway-integration:
                  httpMethod: post
                  type: aws_proxy
                  uri: !Sub 'arn:aws:apigateway:${AWS::Region}:lambda:path/2015-03-31/functions/${ApiTitleVersions.Arn}/invocations'
                responses: {}
                security:
                  - authorizer: []

          "/api/v1/titles/{title}":
            delete:
              x-amazon-apigateway-integration:
                httpMethod: post
                type: aws_proxy
                uri: !Sub 'arn:aws:apigateway:${AWS::Region}:lambda:path/2015-03-31/functions/${ApiTitlesDelete.Arn}/invocations'
              responses: {}
              security:
              - authorizer: []

          "/jamf/v1/{contributor}/software":
            get:
              x-amazon-apigateway-integration:
                httpMethod: post
                type: aws_proxy
                uri: !Sub 'arn:aws:apigateway:${AWS::Region}:lambda:path/2015-03-31/functions/${ApiJamfSoftware.Arn}/invocations'
              responses: {}

          "/jamf/v1/{contributor}/software/{titles}":
            get:
              x-amazon-apigateway-integration:
                httpMethod: post
                type: aws_proxy
                uri: !Sub 'arn:aws:apigateway:${AWS::Region}:lambda:path/2015-03-31/functions/${ApiJamfSoftware.Arn}/invocations'
              responses: {}

          "/jamf/v1/{contributor}/patch/{title}":
            get:
              x-amazon-apigateway-integration:
                httpMethod: post
                type: aws_proxy
                uri: !Sub 'arn:aws:apigateway:${AWS::Region}:lambda:path/2015-03-31/functions/${ApiJamfPatch.Arn}/invocations'
              responses: {}

#  ApiGatewayUsagePlan:
#    Type: AWS::ApiGateway::UsagePlan
#    Properties:
#      ApiStages:
#        - ApiId: !Ref ApiGateway
#          Stage: Prod
#      Quota:
#        Limit: 1000
#        Period: DAY
#      Throttle: ThrottleSettings

# CloudFront Distribution

  CloudFrontOriginAccessIdentity:
    Type: AWS::CloudFront::CloudFrontOriginAccessIdentity
    Properties:
      CloudFrontOriginAccessIdentityConfig:
        Comment: !Sub '${AWS::StackName}-origin-access-identity'

  CloudFrontDistribution:
    Type: AWS::CloudFront::Distribution
    Properties:
      DistributionConfig:
        Enabled: true
        Comment: Unified domain for CommunityPatch.

        Aliases:
          - !Ref DomainName

        ViewerCertificate:
          AcmCertificateArn: !Sub 'arn:aws:acm:us-east-1:${AWS::AccountId}:certificate/${CertificateId}'
          SslSupportMethod: sni-only
          MinimumProtocolVersion: TLSv1.1_2016

        DefaultCacheBehavior:
          AllowedMethods:
            - DELETE
            - GET
            - HEAD
            - OPTIONS
            - PATCH
            - POST
            - PUT
          CachedMethods:
            - GET
            - HEAD
            - OPTIONS
          Compress: true
          DefaultTTL: 300
          ForwardedValues:
            Headers:
              - Accept
              - Referer
              - Authorization
              - Content-Type
            QueryString: true
          MaxTTL: 300
          TargetOriginId: ApiGatewayOrigin
          ViewerProtocolPolicy: https-only

        CacheBehaviors:
          - Compress: true
            DefaultTTL: 300
            ForwardedValues:
              QueryString: true
            PathPattern: '/titles/*'
            MaxTTL: 300
            TargetOriginId: TitlesBucketOrigin
            ViewerProtocolPolicy: allow-all

          - Compress: true
            ForwardedValues:
              QueryString: true
            PathPattern: '/images/*'
            TargetOriginId: WebContentBucketOrigin
            ViewerProtocolPolicy: allow-all

          - Compress: true
            ForwardedValues:
              QueryString: true
            PathPattern: '/css/*'
            TargetOriginId: WebContentBucketOrigin
            ViewerProtocolPolicy: allow-all

        Origins:
          - DomainName: !Sub '${ApiGateway}.execute-api.${AWS::Region}.amazonaws.com'
            Id: ApiGatewayOrigin
            CustomOriginConfig:
              OriginProtocolPolicy: https-only
            OriginPath: /Prod

          - DomainName: !GetAtt TitlesBucket.DomainName
            Id: TitlesBucketOrigin
            S3OriginConfig:
              OriginAccessIdentity: !Sub 'origin-access-identity/cloudfront/${CloudFrontOriginAccessIdentity}'

          - DomainName: !GetAtt WebContentBucket.DomainName
            Id: WebContentBucketOrigin
            S3OriginConfig:
              OriginAccessIdentity: !Sub 'origin-access-identity/cloudfront/${CloudFrontOriginAccessIdentity}'

# Route 53 Record

  CloudFrontRoute53Record:
    Type: AWS::Route53::RecordSet
    Properties:
      Name: !Ref DomainName
      Type: A
      HostedZoneId: !Ref HostedZoneId
      AliasTarget:
        DNSName: !GetAtt CloudFrontDistribution.DomainName
        EvaluateTargetHealth: false
        HostedZoneId: Z2FDTNDATAQYW2

# Lambda Layers

  ApiShared:
    Type: AWS::Serverless::Function
    Properties:
      CodeUri: ./src/layers/api_shared

  ApiSharedLayer:
    Type: AWS::Serverless::LayerVersion
    Properties:
      ContentUri: ./.aws-sam/build/ApiShared
      CompatibleRuntimes:
        - python3.6
      RetentionPolicy: Delete
    DependsOn:
      - ApiShared

  SecurityShared:
    Type: AWS::Serverless::Function
    Properties:
      CodeUri: ./src/layers/security_shared

  SecuritySharedLayer:
    Type: AWS::Serverless::LayerVersion
    Properties:
      ContentUri: ./.aws-sam/build/SecurityShared
      CompatibleRuntimes:
        - python3.6
      RetentionPolicy: Delete
    DependsOn:
      - SecurityShared

# Web View

  WebView:
    Type: AWS::Serverless::Function
    Description: Renders the main web page displaying all available titles.
    Properties:
      CodeUri: ./src/functions/web_view
      Timeout: 15
      Events:
        Index:
          Type: Api
          Properties:
            Path: /
            Method: get
            RestApiId:
                Ref: ApiGateway


# Contributor Management

  ApiContributorRegistration:
    Type: AWS::Serverless::Function
    Description: Creates and rotates tokens.
    Properties:
      CodeUri: ./src/functions/contributors/api_contributor_registration
      Handler: api_contributor_registration.lambda_handler
      Layers:
        - !Ref ApiSharedLayer
        - !Ref SecuritySharedLayer
      Policies:
        Statement:
          - Effect: Allow
            Action: dynamodb:PutItem
            Resource: !Sub 'arn:aws:dynamodb:${AWS::Region}:${AWS::AccountId}:table/${ContributorsTable}'
          - Effect: Allow
            Action: sns:Publish
            Resource: !Ref SendEmailTopic
          - Effect: Allow
            Action: ssm:GetParameter*
            Resource: !Sub 'arn:aws:ssm:${AWS::Region}:${AWS::AccountId}:parameter${ParameterStorePath}*'
      Events:
        ApiContributorRegistration:
          Type: Api
          Properties:
            Path: /api/v1/contributors/register
            Method: post
            RestApiId:
                Ref: ApiGateway

  ApiContributorVerification:
    Type: AWS::Serverless::Function
    Description: Generate an API token upon account verification.
    Properties:
      CodeUri: ./src/functions/contributors/api_contributor_verification
      Handler: api_contributor_verification.lambda_handler
      Layers:
        - !Ref SecuritySharedLayer
      Policies:
        Statement:
          - Effect: Allow
            Action:
              - dynamodb:GetItem
              - dynamodb:UpdateItem
            Resource: !Sub 'arn:aws:dynamodb:${AWS::Region}:${AWS::AccountId}:table/${ContributorsTable}'
          - Effect: Allow
            Action: sns:Publish
            Resource: !Ref SendEmailTopic
          - Effect: Allow
            Action: ssm:GetParameter*
            Resource: !Sub 'arn:aws:ssm:${AWS::Region}:${AWS::AccountId}:parameter${ParameterStorePath}*'
      Events:
        ApiContributorRegistration:
          Type: Api
          Properties:
            Path: /api/v1/contributors/verify
            Method: get
            RestApiId:
                Ref: ApiGateway

  ApiContributorsGet:
    Type: AWS::Serverless::Function
    Description: List contributors on CommunityPatch.
    Properties:
      CodeUri: ./src/functions/contributors/api_contributors_get
      Handler: api_contributors_get.lambda_handler
      Layers:
        - !Ref ApiSharedLayer
        - !Ref SecuritySharedLayer
      Policies:
        - DynamoDBReadPolicy:
            TableName: !Ref ContributorsTable
        - DynamoDBReadPolicy:
            TableName: !Ref TitlesTable
      Events:
        ApiContributorRegistration:
          Type: Api
          Properties:
            Path: /api/v1/contributors
            Method: get
            RestApiId:
              Ref: ApiGateway

# Token Authorizer

  Authorizer:
    Type: AWS::Serverless::Function
    Description: Token validation for Uploader.
    Properties:
      CodeUri: ./src/functions/authorizer
      Handler: authorizer.lambda_handler
      Layers:
        - !Ref SecuritySharedLayer
      Environment:
        Variables:
          BLACKLIST_TABLE: !Ref BlackListedTokensTable
      Policies:
        Statement:
          - Effect: Allow
            Action: dynamodb:GetItem
            Resource: !Sub 'arn:aws:dynamodb:${AWS::Region}:${AWS::AccountId}:table/${BlackListedTokensTable}'
          - Effect: Allow
            Action: ssm:GetParameter*
            Resource: !Sub 'arn:aws:ssm:${AWS::Region}:${AWS::AccountId}:parameter${ParameterStorePath}*'

  AuthorizerPermissions:
    Type: AWS::Lambda::Permission
    DependsOn:
      - ApiGateway
      - Authorizer
    Properties:
      Action: lambda:InvokeFunction
      FunctionName:
        Ref: Authorizer
      Principal: apigateway.amazonaws.com

# Titles API

  ApiTitlesCreate:
    Type: AWS::Serverless::Function
    Description: Handles API requests for creating software title definitions.
    Properties:
      CodeUri: ./src/functions/titles/api_titles_create
      Handler: api_titles_create.lambda_handler
      Layers:
        - !Ref ApiSharedLayer
      Policies:
        - DynamoDBCrudPolicy:
            TableName: !Ref TitlesTable
        - S3CrudPolicy:
            BucketName: !Ref TitlesBucket
      Events:
        CreateTitle:
          Type: Api
          Properties:
            Path: /api/v1/titles
            Method: post
            RestApiId:
                Ref: ApiGateway

  ApiTitleVersions:
    Type: AWS::Serverless::Function
    Properties:
      CodeUri: ./src/functions/titles/api_versions
      Layers:
        - !Ref ApiSharedLayer
      Policies:
        - DynamoDBCrudPolicy:
            TableName: !Ref TitlesTable
        - S3CrudPolicy:
            BucketName: !Ref TitlesBucket
      Events:
        NewVersionDep:
          Type: Api
          Properties:
            Path: /api/v1/titles/{title}/version
            Method: post
            RestApiId:
                Ref: ApiGateway
        DeleteVersionDep:
          Type: Api
          Properties:
            Path: /api/v1/titles/{title}/version/{version}
            Method: delete
            RestApiId:
              Ref: ApiGateway
        NewVersion:
          Type: Api
          Properties:
            Path: /api/v1/titles/{title}/versions
            Method: post
            RestApiId:
              Ref: ApiGateway
          DeleteVersion:
            Type: Api
            Properties:
              Path: /api/v1/titles/{title}/versions/{version}
              Method: delete
              RestApiId:
                Ref: ApiGateway

  ApiTitlesDelete:
    Type: AWS::Serverless::Function
    Description: Handles API requests for deleting patch definitions.
    Properties:
      CodeUri: ./src/functions/titles/api_titles_delete
      Handler: api_titles_delete.lambda_handler
      Layers:
        - !Ref ApiSharedLayer
      Policies:
        Statement:
        - Effect: Allow
          Action: s3:DeleteObject
          Resource: !Sub 'arn:aws:s3:::${TitlesBucket}/*'
        - Effect: Allow
          Action:
          - dynamodb:GetItem
          - dynamodb:DeleteItem
          Resource: !Sub 'arn:aws:dynamodb:${AWS::Region}:${AWS::AccountId}:table/${TitlesTable}'
      Events:
        DeleteTitle:
          Type: Api
          Properties:
            Path: /api/v1/titles/{title}
            Method: delete
            RestApiId:
              Ref: ApiGateway

# Jamf API

  ApiJamfSoftware:
    Type: AWS::Serverless::Function
    Description: Handles Jamf Pro requests for software lists.
    Properties:
      CodeUri: ./src/functions/jamf/api_jamf_software
      Handler: api_jamf_software.lambda_handler
      Layers:
        - !Ref ApiSharedLayer
      Policies:
        Statement:
          - Effect: Allow
            Action:
             - dynamodb:GetItem
             - dynamodb:Query
            Resource: !Sub 'arn:aws:dynamodb:${AWS::Region}:${AWS::AccountId}:table/${TitlesTable}'
      Events:
        GetAllSoftware:
          Type: Api
          Properties:
            Path: /jamf/v1/{contributor}/software
            Method: get
            RestApiId:
                Ref: ApiGateway
        GetSelectSoftware:
          Type: Api
          Properties:
            Path: /jamf/v1/{contributor}/software/{titles}
            Method: get
            RestApiId:
                Ref: ApiGateway

  ApiJamfPatch:
    Type: AWS::Serverless::Function
    Description: Handles Jamf Pro requests for patch definitions.
    Properties:
      CodeUri: ./src/functions/jamf/api_jamf_patch
      Handler: api_jamf_patch.lambda_handler
      Layers:
        - !Ref ApiSharedLayer
      Policies:
        Statement:
          - Effect: Allow
            Action: s3:GetObject
            Resource: !Sub 'arn:aws:s3:::${TitlesBucket}/*'
      Events:
        GetPatch:
          Type: Api
          Properties:
            Path: /jamf/v1/{contributor}/patch/{title}
            Method: get
            RestApiId:
                Ref: ApiGateway

# Email Service

  EmailService:
    Type: AWS::Serverless::Function
    Description: Email notification service.
    Properties:
      Handler: email_service.lambda_handler
      CodeUri: ./src/functions/email_service
      Policies:
        Statement:
          - Effect: Allow
            Action: ses:SendEmail
            Resource: '*'
            Condition:
              StringEquals:
                ses:FromAddress: !Sub 'noreply@${DomainName}'
      Events:
        SnsTopic:
          Type: SNS
          Properties:
            Topic: !Ref SendEmailTopic