template.yaml

AWSTemplateFormatVersion: "2010-09-09"
Transform: "AWS::Serverless-2016-10-31"
Parameters:
  IOTHostName:
    Type: String
  ScriptsPrincipalArn:
    Description: References the user, group, role etc. that can assume driver/rider roles
    Type: String

Resources:
  DriversRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          -
            Effect: Allow
            Principal:
              AWS:
                - !Ref ScriptsPrincipalArn
            Action:
              sts:AssumeRole
          - Effect: Allow
            Principal:
              AWS:
                - !GetAtt AuthApiFunctionsRole.Arn
            Action:
              sts:AssumeRole
      Path: /
      Policies:
        -
          PolicyName: OTDriversPolicy
          PolicyDocument:
            Version: 2012-10-17
            Statement:
              -
                Effect: Allow
                Action: iot:Publish
                Resource:
                  - arn:aws:iot:*:*:topic/ot/drivers/broadcast
              -
                Effect: Allow
                Action: iot:Subscribe
                Resource:
                  - arn:aws:iot:*:*:topicfilter/ot/riders/searching/*
              -
                Effect: Allow
                Action: iot:Receive
                Resource:
                  - arn:aws:iot:*:*:topic/ot/riders/searching/*

  RidersRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          -
            Effect: Allow
            Principal:
              AWS:
                - !Ref ScriptsPrincipalArn
            Action:
              sts:AssumeRole
          - Effect: Allow
            Principal:
              AWS:
                - !GetAtt AuthApiFunctionsRole.Arn
            Action:
              sts:AssumeRole
      Path: /
      Policies:
        -
          PolicyName: OTRidersPolicy
          PolicyDocument:
            Version: 2012-10-17
            Statement:
              -
                Effect: Allow
                Action: iot:Publish
                Resource:
                  - arn:aws:iot:*:*:topic/ot/riders/broadcast
              -
                Effect: Allow
                Action: iot:Subscribe
                Resource:
                  - arn:aws:iot:*:*:topicfilter/ot/drivers/available/*
              -
                Effect: Allow
                Action: iot:Receive
                Resource:
                  - arn:aws:iot:*:*:topic/ot/drivers/available/*

  PublishDriversAvailableRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          -
            Effect: Allow
            Principal:
              Service:
                - lambda.amazonaws.com
            Action:
              sts:AssumeRole
      Path: /

  PublishRidersSearchingRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          -
            Effect: Allow
            Principal:
              Service:
                - lambda.amazonaws.com
            Action:
              sts:AssumeRole
      Path: /

  AllUsersPolicy:
    Type: AWS::IAM::Policy
    Properties:
      PolicyName: OTAllUsersPolicy
      PolicyDocument:
        Version: 2012-10-17
        Statement:
          -
            Effect: Allow
            Action: iot:Connect
            Resource: 'arn:aws:iot:*:*:client/${aws:userid}'
          -
            Effect: Allow
            Action: iot:Subscribe
            Resource: 'arn:aws:iot:*:*:topicfilter/ot/replies/${aws:userid}'
          -
            Effect: Allow
            Action:
              - iot:Publish
              - iot:Receive
            Resource:
              - arn:aws:iot:*:*:topic/ot/replies/*
      Roles:
        - !Ref DriversRole
        - !Ref RidersRole
        - !Ref PublishDriversAvailableRole
        - !Ref PublishRidersSearchingRole

  AllFunctionsPolicy:
    Type: AWS::IAM::Policy
    Properties:
      PolicyName: OTAllFunctionsPolicy
      PolicyDocument:
        Version: 2012-10-17
        Statement:
          -
            Effect: Allow
            Action: logs:CreateLogGroup
            Resource: !Sub "arn:aws:logs:${AWS::Region}:${AWS::AccountId}:*"
          -
            Effect: Allow
            Action: logs:CreateLogStream
            Resource: !Sub "arn:aws:logs:${AWS::Region}:${AWS::AccountId}:log-group:/aws/lambda/*:*"
          -
            Effect: Allow
            Action: logs:PutLogEvents
            Resource: !Sub "arn:aws:logs:${AWS::Region}:${AWS::AccountId}:log-group:/aws/lambda/*:*:*"
          -
            Effect: Allow
            Action: iot:Connect
            Resource: '*'
          -
            Effect: Allow
            Action: iot:Publish
            Resource: '*'
      Roles:
        - !Ref PublishDriversAvailableRole
        - !Ref PublishRidersSearchingRole
        - !Ref AuthApiFunctionsRole

  PublishDriversAvailableFn:
    Type: AWS::Serverless::Function
    Properties:
      CodeUri: build/
      FunctionName: "OTPublishDriversAvailable"
      Handler: drivers_available.handler
      Runtime: python3.6
      Role: !GetAtt PublishDriversAvailableRole.Arn
      Timeout: 6
      Environment:
        Variables:
          OT_IOT_HOST: !Ref IOTHostName

  PublishRidersSearchingFn:
    Type: AWS::Serverless::Function
    Properties:
      CodeUri: build/
      FunctionName: "OTPublishRidersSearching"
      Handler: riders_searching.handler
      Runtime: python3.6
      Role: !GetAtt PublishRidersSearchingRole.Arn
      Timeout: 6
      Environment:
        Variables:
          OT_IOT_HOST: !Ref IOTHostName

  DriversAvailableRule:
    Type: AWS::IoT::TopicRule
    Properties:
      RuleName: OTDriversAvailableRule
      TopicRulePayload:
        RuleDisabled: false
        AwsIotSqlVersion: 2016-03-23
        Sql: >-
          SELECT *, clientid() as auth_client_id FROM 'ot/drivers/broadcast' WHERE status='available'
        Actions:
          -
            Lambda:
              FunctionArn: !GetAtt PublishDriversAvailableFn.Arn

  RidersSearchingRule:
    Type: AWS::IoT::TopicRule
    Properties:
      RuleName: OTRidersSearchingRule
      TopicRulePayload:
        RuleDisabled: false
        AwsIotSqlVersion: 2016-03-23
        Sql: >-
          SELECT *, clientid() as auth_client_id FROM 'ot/riders/broadcast' WHERE status='searching'
        Actions:
          -
            Lambda:
              FunctionArn: !GetAtt PublishRidersSearchingFn.Arn

  DriversAvailablePublishInvokePermission:
    Type: AWS::Lambda::Permission
    Properties:
      FunctionName: !GetAtt PublishDriversAvailableFn.Arn
      Action: lambda:InvokeFunction
      Principal: iot.amazonaws.com
      SourceAccount: !Ref AWS::AccountId
      SourceArn: !GetAtt DriversAvailableRule.Arn

  RidersSearchingPublishInvokePermission:
    Type: AWS::Lambda::Permission
    Properties:
      FunctionName: !GetAtt PublishRidersSearchingFn.Arn
      Action: lambda:InvokeFunction
      Principal: iot.amazonaws.com
      SourceAccount: !Ref AWS::AccountId
      SourceArn: !GetAtt RidersSearchingRule.Arn

  RegistrationsTable:
    Type: AWS::DynamoDB::Table
    Properties:
      AttributeDefinitions:
        -
          AttributeName: reg_id
          AttributeType: S
      KeySchema:
        -
          AttributeName: reg_id
          KeyType: HASH
      ProvisionedThroughput:
        ReadCapacityUnits: 2
        WriteCapacityUnits: 2
      TableName: OTRegistrations
      TimeToLiveSpecification:
        AttributeName: expires_epoch
        Enabled: true

  AuthApiFunctionsRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          -
            Effect: Allow
            Principal:
              Service:
                - lambda.amazonaws.com
            Action:
              sts:AssumeRole
      Path: /
      Policies:
        -
          PolicyName: OTAuthApiFunctionsPolicy
          PolicyDocument:
            Version: 2012-10-17
            Statement:
              -
                Effect: Allow
                Action:
                  - dynamodb:GetItem
                  - dynamodb:PutItem
                  - dynamodb:UpdateItem
                Resource:
                  - !GetAtt RegistrationsTable.Arn
              -
                Effect: Deny
                Action: sns:Publish
                Resource: 'arn:aws:sns:*:*:*'
              -
                Effect: Allow
                Action: sns:Publish
                Resource: '*'

  ApiRegisterFn:
    Type: AWS::Serverless::Function
    Properties:
      CodeUri: build/
      FunctionName: "OTApiRegister"
      Handler: api_register.handler
      Runtime: python3.6
      Role: !GetAtt AuthApiFunctionsRole.Arn
      Timeout: 6
      Environment:
        Variables:
          REGS_TABLE_NAME: !Ref RegistrationsTable
          DRIVERS_ROLE_ARN: !GetAtt DriversRole.Arn
          RIDERS_ROLE_ARN: !GetAtt RidersRole.Arn
      Events:
        PostRegistration:
          Type: Api
          Properties:
            Path: /registrations
            Method: post

  ApiCredentialsFn:
    Type: AWS::Serverless::Function
    Properties:
      CodeUri: build/
      FunctionName: "OTApiCredentials"
      Handler: api_credentials.handler
      Runtime: python3.6
      Role: !GetAtt AuthApiFunctionsRole.Arn
      Timeout: 6
      Environment:
        Variables:
          REGS_TABLE_NAME: !Ref RegistrationsTable
          DRIVERS_ROLE_ID: !GetAtt DriversRole.RoleId
          DRIVERS_ROLE_ARN: !GetAtt DriversRole.Arn
          RIDERS_ROLE_ID: !GetAtt RidersRole.RoleId
          RIDERS_ROLE_ARN: !GetAtt RidersRole.Arn
      Events:
        GetRegistrationCredentials:
          Type: Api
          Properties:
            Path: /registrations/{reg_id}/credentials
            Method: put


Outputs:
  DriversRoleArn:
    Value: !GetAtt DriversRole.Arn
  RidersRoleArn:
    Value: !GetAtt RidersRole.Arn