bootstrap.yml

AWSTemplateFormatVersion: '2010-09-09'
Description: Core resources for apisq (https://github.com/apisq/bootstrap)

Parameters:
  CustomDomainName:
    Type: String
    Default: ''
  CustomDomainCertId:
    Type: String
    Default: ''

Conditions:
  HasCustomDomain:
    Fn::And:
      - Fn::Not: [{ Fn::Equals: [{ Ref: CustomDomainName }, ''] }]
      - Fn::Not: [{ Fn::Equals: [{ Ref: CustomDomainCertId }, ''] }]

Resources:

  AssetsBucket:
    Type: AWS::S3::Bucket
    Properties:
      BucketName:
        # apisq-bootstrap-us-east-1-112233445566
        Fn::Sub: ${AWS::StackName}-${AWS::Region}-${AWS::AccountId}
      BucketEncryption:
        ServerSideEncryptionConfiguration:
          - ServerSideEncryptionByDefault:
              SSEAlgorithm: AES256
      PublicAccessBlockConfiguration:
        BlockPublicAcls: true
        BlockPublicPolicy: true
        IgnorePublicAcls: true
        RestrictPublicBuckets: true
      Tags:
        - Key: Name
          Value: apisq-bootstrap-assets-bucket
        - Key: Source
          Value: apisq/bootstrap
    DeletionPolicy: Retain

  CustomDomain:
    Type: AWS::ApiGateway::DomainName
    Condition: HasCustomDomain
    Properties:
      DomainName:
        Ref:  CustomDomainName
      EndpointConfiguration:
        Types: [REGIONAL]
      SecurityPolicy: TLS_1_2
      RegionalCertificateArn:
        Fn::Sub: arn:aws:acm:${AWS::Region}:${AWS::AccountId}:certificate/${CustomDomainCertId}
      Tags:
        - Key: Name
          Value: apisq-bootstrap-api-gateway-custom-domain
        - Key: Source
          Value: apisq/bootstrap

  DeployRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName:
        # apisq-bootstrap-us-east-1-deploy-role
        Fn::Sub: ${AWS::StackName}-${AWS::Region}-deploy-role
      Description: Execution role assumed by CloudFormation to deploy apisq resources
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Principal:
              Service: cloudformation.amazonaws.com
            Action: sts:AssumeRole
      ManagedPolicyArns:
        - Ref: DeployPolicy1
        - Ref: DeployPolicy2
      Tags:
        - Key: Name
          Value: apisq-bootstrap-deploy-role
        - Key: Source
          Value: apisq/bootstrap

  DeployPolicy1:
    Type: AWS::IAM::ManagedPolicy
    Properties:
      ManagedPolicyName:
        # apisq-bootstrap-us-east-1-deploy-policy-1
        Fn::Sub: ${AWS::StackName}-${AWS::Region}-deploy-policy-1
      Description: (Policy 1) apisq deploy resources permissions
      PolicyDocument:
        Version: "2012-10-17"
        Statement:
          # Generic read
          - Effect: Allow
            Action:
              - ec2:Describe*
              - kms:ListAliases
            Resource: '*'

          # Allow all Lambda actions
          - Effect: Allow
            Action: lambda:*
            Resource:
              Fn::Sub: arn:aws:lambda:${AWS::Region}:${AWS::AccountId}:function:apisq-*
          # Except Invoke*
          - Effect: Deny
            Action: lambda:Invoke*
            Resource: '*'

          # Allow all DynamoDB actions
          - Effect: Allow
            Action: dynamodb:*
            Resource:
              - Fn::Sub: 'arn:aws:dynamodb:${AWS::Region}:${AWS::AccountId}:table:apisq-*'
              - Fn::Sub: 'arn:aws:dynamodb::${AWS::AccountId}:global-table:apisq-*'
          # Except *Item actions
          - Effect: Deny
            Action: dynamodb:*Item
            Resource: '*'

          # Allow API-Gateway permissions
          - Effect: Allow
            Action: apigateway:*
            Resource:
              Fn::Sub: arn:aws:apigateway:${AWS::Region}::*

          # Allow Cloudwatch Logs permissions
          - Effect: Allow
            Action: logs:DescribeLogGroups
            Resource:
              Fn::Sub:  "arn:aws:logs:${AWS::Region}:${AWS::AccountId}:log-group::log-stream:"
          - Effect: Allow
            Action: logs:*
            Resource:
              - Fn::Sub: 'arn:aws:logs:${AWS::Region}:${AWS::AccountId}:log-group:*apisq-*'
              - Fn::Sub: 'arn:aws:logs:${AWS::Region}:${AWS::AccountId}:log-group:*apisq-*:log-stream:'
              - Fn::Sub: 'arn:aws:logs:${AWS::Region}:${AWS::AccountId}:log-group:*apisq-*:log-stream:*'

          # Allow Eventbridge permissions
          - Effect: Allow
            Action: events:*
            Resource:
              - Fn::Sub: arn:aws:events:${AWS::Region}:${AWS::AccountId}:rule/apisq-*
              - Fn::Sub: arn:aws:events:${AWS::Region}:${AWS::AccountId}:rule/*/apisq-*
          # Except PutEvents action
          - Effect: Deny
            Action: events:PutEvents
            Resource: '*'

          # Allow S3 permissions
          - Effect: Allow
            Action: s3:*
            Resource:
              Fn::Sub: arn:aws:s3:::apisq-data-${AWS::Region}-${AWS::AccountId}-*
          # Except *Object actions
          - Effect: Deny
            Action: s3:*Object*
            Resource:
              Fn::Sub: arn:aws:s3:::apisq-data-${AWS::Region}-${AWS::AccountId}-*

          # Allow KMS permissions
          - Effect: Allow
            Action: kms:CreateKey
            Resource:
              Fn::Sub: arn:aws:kms:${AWS::Region}:${AWS::AccountId}:key/*
            Condition:
              StringLike:
                aws:RequestTag/Source: apisq/*
          - Effect: Allow
            Action:
              - kms:DescribeKey
              - kms:CreateAlias
              - kms:CreateGrant
              - kms:DeleteAlias
              - kms:EnableKeyRotation
              - kms:GetKey*
              - kms:ListResourceTags
              - kms:PutKeyPolicy
              - kms:RetireGrant
              - kms:ScheduleKeyDeletion
              - kms:UpdateKeyDescription
              - kms:TagResource
              - kms:UntagResource
            Resource:
              Fn::Sub: arn:aws:kms:${AWS::Region}:${AWS::AccountId}:key/*
            Condition:
              StringLike:
                aws:ResourceTag/Source: apisq/*
          - Effect: Allow
            Action:
              - kms:DescribeKey
              - kms:CreateAlias
              - kms:CreateGrant
              - kms:DeleteAlias
              - kms:RetireGrant
              - kms:TagResource
              - kms:UntagResource
            Resource:
              Fn::Sub: arn:aws:kms:${AWS::Region}:${AWS::AccountId}:alias/apisq-*

          # Allow the IAM CreateRole action only if the permission boundary is set
          - Effect: Allow
            Action:
              - iam:CreateRole
              - iam:PutRolePermissionsBoundary
            Resource:
              Fn::Sub: arn:aws:iam::${AWS::AccountId}:role/apisq-execution-*-role
            Condition:
              StringEquals:
                iam:PermissionsBoundary:
                  Ref: PermssionBoundaryPolicy
          # Allow specific IAM actions targeting the execution roles
          - Effect: Allow
            Action:
              - iam:GetRole*
              - iam:ListRole*
              - iam:DeleteRole
              - iam:PutRolePolicy
              - iam:DeleteRolePolicy
              - iam:TagRole
              - iam:UntagRole
              - iam:PassRole
            Resource:
              - Fn::Sub: arn:aws:iam::${AWS::AccountId}:role/apisq-execution-*-role

  DeployPolicy2:
    Type: AWS::IAM::ManagedPolicy
    Properties:
      ManagedPolicyName:
        # apisq-bootstrap-us-east-1-deploy-policy-2
        Fn::Sub: ${AWS::StackName}-${AWS::Region}-deploy-policy-2
      Description: (Policy 3) Deploy resources permissions
      PolicyDocument:
        Version: "2012-10-17"
        Statement:
          # Allow all Secret Manager actions
          - Effect: Allow
            Action: secretsmanager:*
            Resource:
              Fn::Sub: arn:aws:secretsmanager:${AWS::Region}:${AWS::AccountId}:secret:apisq-*

          # Allow all SSM Parameter Store actions
          - Effect: Allow
            Action: ssm:*Parameter*
            Resource:
              Fn::Sub: arn:aws:ssm:${AWS::Region}:${AWS::AccountId}:parameter/apisq/*

          # Allow all Step Functions actions
          - Effect: Allow
            Action: states:*
            Resource:
              Fn::Sub: arn:aws:states:${AWS::Region}:${AWS::AccountId}:stateMachine:apisq-*

          # Allow all SQS actions
          - Effect: Allow
            Action: sqs:*
            Resource:
              Fn::Sub: arn:aws:sqs:${AWS::Region}:${AWS::AccountId}:apisq-*
          # Except the one that sends/receives data from the queue
          - Effect: Deny
            Action:
              - sqs:ReceiveMessage
              - sqs:SendMessage
            Resource:
              Fn::Sub: arn:aws:sqs:${AWS::Region}:${AWS::AccountId}:apisq-*

          # Allow all SNS actions
          - Effect: Allow
            Action: sns:*
            Resource:
              Fn::Sub: arn:aws:sns:${AWS::Region}:${AWS::AccountId}:apisq-*
          # Except the one that sends messages to topics
          - Effect: Deny
            Action: sns:Publish
            Resource:
              Fn::Sub: arn:aws:sns:${AWS::Region}:${AWS::AccountId}:apisq-*

  PermssionBoundaryPolicy:
    Type: AWS::IAM::ManagedPolicy
    Properties:
      ManagedPolicyName:
        # apisq-bootstrap-us-east-1-execution-permissions-boundary
        Fn::Sub: ${AWS::StackName}-${AWS::Region}-execution-permissions-boundary
      Description: (Policy 3) Deploy resources permissions
      PolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Action: lambda:*Invoke*
            Resource:
              Fn::Sub: arn:aws:lambda:${AWS::Region}:${AWS::AccountId}:function:apisq-*

          - Effect: Allow
            Action:
              - dynamodb:BatchGetItem
              - dynamodb:BatchWriteItem
              - dynamodb:GetItem
              - dynamodb:PutItem
              - dynamodb:UpdateItem
              - dynamodb:DeleteItem
              - dynamodb:Query
              - dynamodb:Scan
            Resource:
              - Fn::Sub: arn:aws:dynamodb:${AWS::Region}:${AWS::AccountId}:table:apisq-*
              - Fn::Sub: arn:aws:dynamodb::${AWS::AccountId}:global-table:apisq-*

          - Effect: Allow
            Action: execute-api:Invoke
            Resource:
              Fn::Sub: arn:aws:execute-api:${AWS::Region}:${AWS::AccountId}:*

          - Effect: Allow
            Action:
              - logs:CreateLogGroup
              - logs:CreateLogStream
              - logs:PutLogEvents
            Resource:
              - Fn::Sub: 'arn:aws:logs:${AWS::Region}:${AWS::AccountId}:log-group:*apisq-*'
              - Fn::Sub: 'arn:aws:logs:${AWS::Region}:${AWS::AccountId}:log-group:*apisq-*:log-stream:'
              - Fn::Sub: 'arn:aws:logs:${AWS::Region}:${AWS::AccountId}:log-group:*apisq-*:log-stream:*'

          - Effect: Allow
            Action: events:PutEvents
            Resource:
              Fn::Sub: arn:aws:events:${AWS::Region}:${AWS::AccountId}:event-bus/*

          - Effect: Allow
            Action:
              - ssm:GetParameter
              - ssm:GetParameters
              - ssm:GetParametersByPath
              - ssm:DescribeParameters
            Resource:
              Fn::Sub: arn:aws:ssm:${AWS::Region}:${AWS::AccountId}:parameter/apisq/*

          - Effect: Allow
            Action: s3:GetObject
            Resource:
              Fn::Sub: arn:aws:s3:::${AWS::StackName}-${AWS::Region}-${AWS::AccountId}/*
          - Effect: Allow
            Action:
              - s3:DeleteObject
              - s3:GetObject
              - s3:ListBucket
              - s3:PutObject
            Resource:
              Fn::Sub: arn:aws:s3:::apisq-data-${AWS::Region}-${AWS::AccountId}-*

          - Effect: Allow
            Action:
              - secretsmanager:DescribeSecret
              - secretsmanager:GetResourcePolicy
              - secretsmanager:GetSecretValue
              - secretsmanager:ListSecrets
            Resource:
              Fn::Sub: arn:aws:secretsmanager:${AWS::Region}:${AWS::AccountId}:secret:apisq-*

          - Effect: Allow
            Action:
              - sns:Publish
              - sns:Subscribe
              - sns:Unsubscribe
            Resource:
              Fn::Sub: arn:aws:sns:${AWS::Region}:${AWS::AccountId}:apisq-*

          - Effect: Allow
            Action: sqs:SendMessage
            Resource:
              Fn::Sub: arn:aws:sqs:${AWS::Region}:${AWS::AccountId}:apisq-*

          - Effect: Allow
            Action: states:StartExecution
            Resource:
              Fn::Sub: arn:aws:states:${AWS::Region}:${AWS::AccountId}:stateMachine:apisq-*

Outputs:
  Version:
    Description: Bootstrap version
    Value: '0.1.0'
    Export:
      Name:
        # apisq-bootstrap-version
        Fn::Sub: ${AWS::StackName}-version
  AssetsBucketName:
    Description: Bucket Name
    Value:
      # apisq-bootstrap-us-east-1-112233445566
      Ref: AssetsBucket
    Export:
      Name:
        # apisq-bootstrap-assets-bucket
        Fn::Sub: ${AWS::StackName}-assets-bucket
  AssetsBucketArn:
    Description: Bucket ARN
    Value:
      # arn:aws:s3:::apisq-bootstrap-us-east-1-112233445566
      Fn::GetAtt: [AssetsBucket, Arn]
    Export:
      Name:
        # apisq-bootstrap-assets-bucket-arn
        Fn::Sub: ${AWS::StackName}-assets-bucket-arn
  DeployRoleName:
    Description: Deploy Role Name
    Value:
      # apisq-bootstrap-us-east-1-deploy-role
      Ref: DeployRole
    Export:
      Name:
        # apisq-bootstrap-deploy-role
        Fn::Sub: ${AWS::StackName}-deploy-role
  DeployRoleArn:
    Description: Deploy Role ARN
    Value:
      # arn:aws:iam:112233445566::role/apisq-bootstrap-us-east-1-deploy-role
      Fn::GetAtt: [DeployRole, Arn]
    Export:
      Name:
        # apisq-bootstrap-deploy-role-arn
        Fn::Sub: ${AWS::StackName}-deploy-role-arn
  ExecutionPermissionsBoundary:
    Description: Execution Role Permission Boundary
    Value:
      # apisq-bootstrap-us-east-1-permissions-policy
      Ref: PermssionBoundaryPolicy
    Export:
      Name:
        # apisq-bootstrap-execution-permission-boundary
        Fn::Sub: ${AWS::StackName}-execution-permission-boundary
  CustomDomainName:
    Description: Custom Domain Name
    Condition: HasCustomDomain
    Value:
      Ref: CustomDomain
    Export:
      Name:
        # apisq-bootstrap-custom-domain
        Fn::Sub: ${AWS::StackName}-custom-domain
  CustomDomainArn:
    Description: Custom Domain ARN
    Condition: HasCustomDomain
    Value:
      Fn::GetAtt: [CustomDomain, DomainNameArn]
    Export:
      Name:
        # apisq-bootstrap-custom-domain-arn
        Fn::Sub: ${AWS::StackName}-custom-domain-arn