template-auth.yaml

AWSTemplateFormatVersion: "2010-09-09"
Transform: AWS::Serverless-2016-10-31
# https://github.com/awsdocs/amazon-api-gateway-developer-guide/blob/main/cloudformation-templates/HTTP/http-with-jwt-auth.yaml
# https://aws.amazon.com/blogs/security/how-to-secure-api-gateway-http-endpoints-with-jwt-authorizer/
Resources:
  CargoLambdaUserPool:
    Type: AWS::Cognito::UserPool
    Properties:
      UserPoolName: !Ref AWS::StackName
      AutoVerifiedAttributes:
        - email
      Schema:
        - Name: email
          AttributeDataType: String
          Mutable: false
          Required: true
  CargoLambdaUserPoolClient:
    Type: AWS::Cognito::UserPoolClient
    Properties:
      # TODO: reduce token lifetimes
      AllowedOAuthFlows:
        - code
        # TODO: Switch off of implicit
        # - implicit
      AllowedOAuthScopes:
        # - aws.cognito.signin.user.admin
        # - email
        - openid
        # - profile
      AllowedOAuthFlowsUserPoolClient: true
      ClientName: !Ref AWS::StackName
      CallbackURLs:
        - "http://localhost:8080"
        - "http://localhost:8080/"
        - "http://localhost:8080/callback"
        - "http://localhost:8080/callback/"
        - "https://oauth.pstmn.io/v1/vscode-callback"
      # https://docs.aws.amazon.com/
      #   cognito/latest/developerguide/token-revocation.html
      # https://docs.aws.amazon.com/
      #   cognito/latest/developerguide/revocation-endpoint.html
      EnableTokenRevocation: true
      ExplicitAuthFlows:
        - ALLOW_USER_PASSWORD_AUTH
        - ALLOW_REFRESH_TOKEN_AUTH
      GenerateSecret: false
      SupportedIdentityProviders:
        - COGNITO
      UserPoolId: !Ref CargoLambdaUserPool
  CargoLambdaHttpApi:
    # https://docs.aws.amazon.com/serverless-application-model/latest/
    #   developerguide/sam-resource-httpapi.html
    Type: AWS::Serverless::HttpApi
    Properties:
      # https://docs.aws.amazon.com/serverless-application-model/latest/
      #   developerguide/sam-property-httpapi-httpapiauth.html
      # https://docs.aws.amazon.com/apigatewayv2/latest/api-reference/
      #   apis-apiid-authorizers-authorizerid.html
      Auth:
        # https://docs.aws.amazon.com/apigateway/latest/developerguide/
        #   http-api-jwt-authorizer.html
        Authorizers:
          CargoLambdaJwtAuthorizer:
            # AuthorizationScopes:
            #   - scope1
            #   - scope2
            IdentitySource: "$request.header.Authorization"
            JwtConfiguration:
              # TODO: add PKCE
              Audience:
                - !Ref CargoLambdaUserPoolClient
              Issuer: !Join
                - ""
                - - "https://cognito-idp."
                  - !Ref "AWS::Region"
                  - "."
                  - !Ref "AWS::URLSuffix"
                  - "/"
                  - !Ref CargoLambdaUserPool
        DefaultAuthorizer: CargoLambdaJwtAuthorizer
        # EnableIamAuthorizer: false
      # https://docs.aws.amazon.com/serverless-application-model/latest/
      #   developerguide/sam-resource-httpapi.html#sam-httpapi-corsconfiguration
      CorsConfiguration:
        AllowHeaders:
          - Authorization
          - Content-Type
        AllowMethods:
          # - DELETE
          - GET
          - OPTIONS
          # - POST
          # - PUT
        AllowOrigins:
          - "http://localhost:8080"
      Description: Cargo Lambda Prototype HTTP API
      FailOnWarnings: true
      Name: !Ref AWS::StackName
  CargoLambdaUserPoolDomain:
    Type: AWS::Cognito::UserPoolDomain
    Properties:
      Domain: !Ref AWS::StackName
      UserPoolId: !Ref CargoLambdaUserPool
  CargoLambdaFunctionLogGroup:
    Type: AWS::Logs::LogGroup
    Properties:
      LogGroupName: !Sub "/aws/lambda/${AWS::StackName}"
      RetentionInDays: 7
  CargoLambdaFunction:
    Type: AWS::Serverless::Function
    Properties:
      CodeUri: target/lambda/cargo-lambda-prototype/
      Description: Cargo Lambda Prototype Lambda Function
      Events:
        CargoLambdaEvent:
          Type: HttpApi
          Properties:
            ApiId: !Ref CargoLambdaHttpApi
            Method: GET
            Path: /
      FunctionName: !Ref AWS::StackName
      Handler: rust.handler
      LoggingConfig:
        # ApplicationLogLevel: TRACE
        LogFormat: Text
        LogGroup: !Ref CargoLambdaFunctionLogGroup
        # SystemLogLevel: DEBUG
      # MemorySize: 128
      Runtime: provided.al2023
      # Timeout: 3
Outputs:
  CargoLambdaClientId:
    Description: "The ID of the User Pool Client is the OAuth 2.0 client ID"
    Value: !Ref CargoLambdaUserPoolClient
  CargoLambdaHttpApiUrl:
    Description: "URL of the Cargo Lambda Prototype HTTP API endpoint"
    Value: !Join
      - ""
      - - "https://"
        - !Ref CargoLambdaHttpApi
        - ".execute-api."
        - !Ref "AWS::Region"
        - "."
        - !Ref "AWS::URLSuffix"
        - "/"
  CargoLambdaIssuerUrl:
    Description: "The URL for the OAuth 2.0 token issuer"
    Value: !Join
      - ""
      - - "https://cognito-idp."
        - !Ref "AWS::Region"
        - "."
        - !Ref "AWS::URLSuffix"
        - "/"
        - !Ref CargoLambdaUserPool
  CargoLambdaSignupUrl:
    Description: "The login / signup URL"
    Value: !Join
      - ""
      - - "https://"
        - !Ref CargoLambdaUserPoolDomain
        - ".auth."
        - !Ref "AWS::Region"
        - ".amazoncognito.com"
        - "/login"
        - "?client_id="
        - !Ref CargoLambdaUserPoolClient
        - "&code_challenge=A1b2C3"
        - "&code_challenge_method=S256"
        - "&redirect_uri=http%3A%2F%2Flocalhost%3A8080"
        - "&response_type=code"
        - "&scope=openid"