template.yaml

AWSTemplateFormatVersion: '2010-09-09'
Transform: AWS::Serverless-2016-10-31
Description: >
  sam-app

  Sample AWS SAM Template
  
# More info about Globals: https://github.com/awslabs/serverless-application-model/blob/master/docs/globals.rst
Globals:
  Function:
    Timeout: 3

Parameters:
  PREFIX:
    Type: String
    Default: SAM
  EMAIL:
    Type: String
    Default: example@mail.io

Resources:

  CognitoUserPool:
    Type: AWS::Cognito::UserPool
    Properties:
      UserPoolName: !Sub "${PREFIX}UserPool"
      Policies:
        PasswordPolicy:
          MinimumLength: 8
      AliasAttributes:
        - email

  CognitoUser:
    Type: AWS::Cognito::UserPoolUser
    Properties: 
      UserPoolId: !Ref CognitoUserPool
      Username: admin
      UserAttributes: 
        - Name: email
          Value: !Sub "${EMAIL}"

  CognitoAppClient:
    Type: AWS::Cognito::UserPoolClient
    Properties: 
      ClientName: !Sub "${PREFIX}AppClient"
      ExplicitAuthFlows: 
        - ALLOW_CUSTOM_AUTH
        - ALLOW_USER_SRP_AUTH
        - ALLOW_REFRESH_TOKEN_AUTH
      GenerateSecret: false
      PreventUserExistenceErrors: "ENABLED"
      RefreshTokenValidity: 30
      UserPoolId: !Ref CognitoUserPool

  DynamoDBTable:
    Type: AWS::DynamoDB::Table
    Properties: 
      AttributeDefinitions: 
        - AttributeName: userid
          AttributeType: S
      KeySchema: 
        - AttributeName: userid
          KeyType: HASH
      ProvisionedThroughput: 
        ReadCapacityUnits: 5
        WriteCapacityUnits: 5

  IamRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: !Sub "${PREFIX}IamRole"
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              Service:
              - lambda.amazonaws.com
            Action:
              - 'sts:AssumeRole'
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/AmazonDynamoDBFullAccess
        - arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole

  ApiEndpoint:
    Type: AWS::Serverless::Api
    Properties:
      StageName: !Sub "${PREFIX}ApiEndpoint"
      Cors: "'*'"
      Auth:
        DefaultAuthorizer: CognitoAuthorizer
        Authorizers:
          CognitoAuthorizer:
            UserPoolArn: !GetAtt CognitoUserPool.Arn

  HelloWorldFunction:
    Type: AWS::Serverless::Function # More info about Function Resource: https://github.com/awslabs/serverless-application-model/blob/master/versions/2016-10-31.md#awsserverlessfunction
    Properties:
      FunctionName: !Sub "${PREFIX}helloWorld"
      CodeUri: functions/hello-world/
      Handler: app.lambdaHandler
      Runtime: nodejs12.x
      Role: !GetAtt IamRole.Arn
      Events:
        HelloWorld:
          Type: Api # More info about API Event Source: https://github.com/awslabs/serverless-application-model/blob/master/versions/2016-10-31.md#api
          Properties:
            RestApiId: !Ref ApiEndpoint
            Path: /hello
            Method: get

Outputs:
  # ServerlessRestApi is an implicit API created out of Events key under Serverless::Function
  # Find out more about other implicit resources you can reference within SAM
  # https://github.com/awslabs/serverless-application-model/blob/master/docs/internals/generated_resources.rst#api
  RestApi:
    Description: "API endpoint URLs for Prod stage:"
    Value: !Sub "https://${ApiEndpoint}.execute-api.${AWS::Region}.amazonaws.com/${PREFIX}ApiEndpoint/hello/"