template.yml

AWSTemplateFormatVersion: '2010-09-09'
Transform: AWS::Serverless-2016-10-31
Description: Lambda with spring boot.

Resources:
  PsipherFunction:
    Type: AWS::Serverless::Function
    Properties:
      Handler: com.psipher.application.LambdaHandler::handleRequest
      Runtime: java8
      CodeUri: target/psipher-0.0.1-SNAPSHOT.jar
      MemorySize: 1512
      Policies: [AWSLambdaBasicExecutionRole, AWSLambdaDynamoDBExecutionRole, AmazonDynamoDBFullAccess, AWSKeyManagementServicePowerUser]
      Timeout: 60
      Events:
        GetResource:
          Type: Api
          Properties:
            Path: /{proxy+}
            Method: any

  PsipherDynamoDBTable:
    Type: AWS::DynamoDB::Table
    Properties:
      AttributeDefinitions:
        - AttributeName: "userId"
          AttributeType: "S"
      KeySchema:
        - AttributeName: "userId"
          KeyType: "HASH"
      ProvisionedThroughput:
        ReadCapacityUnits: "1"
        WriteCapacityUnits: "1"
      TableName: "UserDetails"

  encryptPsipher:
    Type: AWS::KMS::Key
    Properties:
      Description: Psipher symmetric CMK
      KeyPolicy:
        Version: '2012-10-17'
        Id: 'key-consolepolicy-3'
        Statement:
        - Sid: Enable IAM User Permissions
          Effect: Allow
          Principal:
            AWS:
              Fn::Join:
              - ''
              - - 'arn:aws:iam::'
                - Ref: AWS::AccountId
                - ':root'
          Action: kms:*
          Resource: '*'
        - Sid: Allow access for Key Administrators
          Effect: Allow
          Principal:
            AWS:
              - Fn::Join:
                - ''
                - - 'arn:aws:iam::'
                  - Ref: AWS::AccountId
                  - ':role/vocareum'
              - Fn::Join:
                - ''
                - - 'arn:aws:iam::'
                  - Ref: AWS::AccountId
                  - ':role/'
                  - Ref: PsipherFunctionRole
          Action:
            - kms:Create*
            - kms:Describe*
            - kms:Enable*
            - kms:List*
            - kms:Put*
            - kms:Update*
            - kms:Revoke*
            - kms:Disable*
            - kms:Get*
            - kms:Delete*
            - kms:TagResource
            - kms:UntagResource
            - kms:ScheduleKeyDeletion
            - kms:CancelKeyDeletion
          Resource: "*"
        - Sid: Allow use of the key
          Effect: Allow
          Principal:
            AWS:
              - Fn::Join:
                - ''
                - - 'arn:aws:iam::'
                  - Ref: AWS::AccountId
                  - ':role/'
                  - Ref: PsipherFunctionRole
          Action:
            - kms:Encrypt
            - kms:Decrypt
            - kms:ReEncrypt*
            - kms:GenerateDataKey*
            - kms:DescribeKey
          Resource: "*"
        - Sid: Allow attachment of persistent resources
          Effect: Allow
          Principal:
            AWS:
              - Fn::Join:
                - ''
                - - 'arn:aws:iam::'
                  - Ref: AWS::AccountId
                  - ':role/'
                  - Ref: PsipherFunctionRole
          Action:
            - kms:CreateGrant
            - kms:ListGrants
            - kms:RevokeGrant
          Resource: "*"
          Condition:
            StringEquals:
              kms:ViaService: lambda.us-east-1.amazonaws.com
            Bool:
              kms:GrantIsForAWSResource: 'true'

  psipherKmsAlias:
    Type: AWS::KMS::Alias
    Properties:
      AliasName: alias/encryptPsipher
      TargetKeyId:
        Ref: encryptPsipher
    DependsOn : encryptPsipher

Outputs:
  SpringBootPsipherApi:
    Description: URL for application /ping can be replaced by the url mapped
    Value: !Sub 'https://${ServerlessRestApi}.execute-api.${AWS::Region}.amazonaws.com/Stage/ping'
    Export:
      Name: SpringBootPsipherApi