template.yaml

AWSTemplateFormatVersion: 2010-09-09
Description: >-
  shorty

Transform:
- AWS::Serverless-2016-10-31

Globals:
  Function:
    Tags:
      Project: shorty
      Environment: Prod

Parameters:
  DomainNameParameter:
    Description: Your custom domain name
    Type: String
  RegionalCertificateArnParameter:
    Description: The ARN of the SSL cert for your domain hosted in ACM
    Type: String

Resources:

  # Adding Cognito resources
  CognitoUserPool:
    Type: AWS::Cognito::UserPool
    Properties:
      UserPoolName: !Sub ${AWS::StackName}-user-pool
      AutoVerifiedAttributes:
        - email
      Policies:
        PasswordPolicy:
          MinimumLength: 8
          RequireLowercase: true
          RequireNumbers: true
          RequireSymbols: true
          RequireUppercase: true

  CognitoUserPoolClient:
    Type: AWS::Cognito::UserPoolClient
    Properties:
      UserPoolId: !Ref CognitoUserPool
      ClientName: !Sub ${AWS::StackName}-client
      GenerateSecret: false
      ExplicitAuthFlows:
        - ALLOW_USER_PASSWORD_AUTH
        - ALLOW_REFRESH_TOKEN_AUTH

  # RestApi resource
  RestApi:
      Type: AWS::Serverless::Api
      Properties:
        StageName: Prod
        EndpointConfiguration:
          Type: REGIONAL
        Cors:
          AllowMethods: "'*'"
          AllowHeaders: "'Content-Type,Authorization,X-Amz-Date,X-Api-Key,X-Amz-Security-Token'"
          AllowOrigin: "'*'"
          MaxAge: "'600'"
        Auth:
          Authorizers:
            CognitoAuthorizer:
              UserPoolArn: !GetAtt CognitoUserPool.Arn

  # Custom Domain name for the api endpoint
  DomainName:
    Type: AWS::ApiGateway::DomainName
    Properties:
      DomainName: !Ref DomainNameParameter
      EndpointConfiguration:
        Types:
          - REGIONAL
      RegionalCertificateArn: !Ref RegionalCertificateArnParameter
    DependsOn: RestApi
  
  # Base Path Mapping to Link the API to the Custom Domain
  BasePathMapping:
    Type: AWS::ApiGateway::BasePathMapping
    Properties:
      DomainName: !Ref DomainName
      RestApiId: !Ref RestApi
      Stage: Prod

  # Function definition for handling "GET /{shortid}"
  getLinkByShortIdFunction:
    Type: AWS::Serverless::Function
    Properties:
      Handler: src/handlers/get-link-by-shortid.getLinkByShortIdFunction
      Runtime: nodejs22.x
      Architectures:
        - x86_64
      MemorySize: 128
      Timeout: 100
      Description: HTTP GET handler to fetch a Link to the DynamoDB table and redirect to the target.
      Policies:
        - DynamoDBCrudPolicy:
            TableName: !Ref LinkTable
      Environment:
        Variables:
          LINK_TABLE: !Ref LinkTable
      Events:
        Api:
          Type: Api
          Properties:
            Path: /{shortid}
            Method: GET
            RestApiId: !Ref RestApi

  postLinkFunction:
    Type: AWS::Serverless::Function
    Properties:
      Handler: src/handlers/post-link.postLinkFunction
      Runtime: nodejs22.x
      Architectures:
        - x86_64
      MemorySize: 128
      Timeout: 100
      Description: HTTP POST handler to add a Link to the DynamoDB table.
      Policies:
        - DynamoDBCrudPolicy:
            TableName: !Ref LinkTable
      Environment:
        Variables:
          LINK_TABLE: !Ref LinkTable
      Events:
        Api:
          Type: Api
          Properties:
            Path: /
            Method: POST
            RestApiId: !Ref RestApi
            Auth:
              Authorizer: CognitoAuthorizer

  LinkTable:
    Type: AWS::Serverless::SimpleTable
    Properties:
      PrimaryKey:
        Name: shortid
        Type: String
      ProvisionedThroughput:
        ReadCapacityUnits: 2
        WriteCapacityUnits: 2

  WebsiteS3Bucket:
    Type: AWS::S3::Bucket
    Properties:
      PublicAccessBlockConfiguration:
        BlockPublicAcls: false
        BlockPublicPolicy: false
        IgnorePublicAcls: false
        RestrictPublicBuckets: false
      WebsiteConfiguration:
        IndexDocument: index.html
        ErrorDocument: error.html
    DeletionPolicy: Retain
    UpdateReplacePolicy: Retain

  WebsiteBucketPolicy:
    Type: AWS::S3::BucketPolicy
    Properties:
      PolicyDocument:
        Id: MyPolicy
        Version: 2012-10-17
        Statement:
          - Sid: PublicReadForGetBucketObjects
            Effect: Allow
            Principal: '*'
            Action: 's3:GetObject'
            Resource: !Join
              - ''
              - - 'arn:aws:s3:::'
                - !Ref WebsiteS3Bucket
                - /*
      Bucket: !Ref WebsiteS3Bucket

Outputs:
  ApiEndpoint:
    Description: "API Gateway endpoint URL for Prod stage"
    Value: !Sub "https://${RestApi}.execute-api.${AWS::Region}.amazonaws.com/Prod"
  ApiHostname:
    Description: "API Gateway endpoint hostname"
    Value: !Sub "${RestApi}.execute-api.${AWS::Region}.amazonaws.com"
  StaticWebsiteURL:
    Value: !Sub "http://${WebsiteS3Bucket}.s3-website-${AWS::Region}.amazonaws.com"
    Description: URL for static website hosted on S3
  S3BucketName:
    Value: !Ref WebsiteS3Bucket
    Description: Name of S3 bucket to hold website content
  UserPoolId:
    Description: "Cognito User Pool ID"
    Value: !Ref CognitoUserPool
  UserPoolClientId:
    Description: "Cognito User Pool Client ID"
    Value: !Ref CognitoUserPoolClient