cloudformation.yaml

AWSTemplateFormatVersion: '2010-09-09'
Parameters:
  CodeSourceBucket:
    Description: Bucket in which to find the code for the Lambda functions.
    Type: String
    Default: ''
    # Permit the standard S3 bucket expression or an empty bucket.
    AllowedPattern: '(^[a-zA-Z0-9.\-_]{1,255}$|^$)'
  CodeSourceTallyObject:
    Description: Object in which to find the zipfile for the code for the tally
      functions.
    Type: String
    Default: ''
    # Prevent people from including a starting slash.
    AllowedPattern: '(^[^/].*$|^$)'
  CodeSourceSubmitObject:
    Description: Object in which to find the zipfile for the code for the submit
      functions.
    Type: String
    Default: ''
    # Prevent people from including a starting slash.
    AllowedPattern: '(^[^/].*$|^$)'
  CodeSourceRegisterObject:
    Description: Object in which to find the zipfile for the code for the register
      functions.
    Type: String
    Default: ''
    # Prevent people from including a starting slash.
    AllowedPattern: '(^[^/].*$|^$)'
  ScoreCacheLifetime:
    Description: Duration to keep scores for a single team cached to control for
      load on key-values store backend.
    Type: Number
    Default: 30
  FlagCacheLifetime:
    Description: Duration to keep flag configuration cached to control for load
      on key-value store backend.
    Type: Number
    Default: 600
  KeyValueBackend:
    Description: Which backend to use for key-value store for scorekeeping. This
      only controls which backend is used for the Scores, not for the flag/game
      definitions.
    Type: String
    Default: DynamoDB
    ConstraintDescription: Must specify either 'DynamoDB'' or 'S3'
    AllowedValues:
    - DynamoDB
    # - SimpleDB
    # - S3
  XraySampleRate:
    Description: The probability that an event will be traced via Xray, expressed
      as a floating point value in [0, 1].
    MaxValue: 1
    MinValue: 0
    Type: Number
    Default: 0
    ConstraintDescription: Value must be a probability, and thus in the range [0, 1]
  SESRegion:
    Description: Region to invoke SES out of for sending emails to registrants
    Type: String
    Default: us-east-1
    AllowedValues:
    - us-east-1
    - us-west-2
    - eu-west-1
  SESEmailSource:
    Description: Email address (must be validated within SES) to send emails from
    Type: String
  HMACSecret:
    Description: String that is used as the secret key for the HMAC to validate emails during registration.
    Type: String
  RegistrationMode:
    Description: Determines whether to permit registration from emails that aren't already in the DB.
      This does not exempt registrants from confirming their email address, as we still need to know that
      we can contact them at that address.
    Type: String
    AllowedValues:
      - Open
      - Closed

Conditions:
  TallyCodePlaceholder:
    !Or
    - !Equals [ !Ref CodeSourceBucket, "" ]
    - !Equals [ !Ref CodeSourceTallyObject, "" ]
  SubmitCodePlaceholder:
    !Or
    - !Equals [ !Ref CodeSourceBucket, "" ]
    - !Equals [ !Ref CodeSourceSubmitObject, "" ]
  RegisterCodePlaceholder:
    !Or
    - !Equals [ !Ref CodeSourceBucket, "" ]
    - !Equals [ !Ref CodeSourceSubmitObject, "" ]

Resources:
  RegistrantsTable:
    Type: AWS::DynamoDB::Table
    Properties:
      AttributeDefinitions:
      - {AttributeName: email, AttributeType: S}
      KeySchema:
      - {AttributeName: email, KeyType: HASH}
      ProvisionedThroughput:
        ReadCapacityUnits: 1
        WriteCapacityUnits: 1

  FlagsTable:
    Type: AWS::DynamoDB::Table
    Properties:
      AttributeDefinitions:
      - {AttributeName: flag, AttributeType: S}
      KeySchema:
      - {AttributeName: flag, KeyType: HASH}
      ProvisionedThroughput:
        ReadCapacityUnits: 1
        WriteCapacityUnits: 1

  ScoresTable:
    Type: AWS::DynamoDB::Table
    Properties:
      AttributeDefinitions:
      - {AttributeName: team, AttributeType: N}
      KeySchema:
      - {AttributeName: team, KeyType: HASH}
      ProvisionedThroughput:
        ReadCapacityUnits: 5
        WriteCapacityUnits: 5

  API:
    Type: AWS::ApiGateway::RestApi
    Properties:
      Description: API endpoint for tallying scores based on keyed flags.
      Name: !Ref AWS::StackName

  FlagResource:
    Type: AWS::ApiGateway::Resource
    Properties:
      PathPart: flag
      ParentId: !GetAtt API.RootResourceId
      RestApiId: !Ref API
  FlagPostMethod:
    Type: AWS::ApiGateway::Method
    Properties:
      HttpMethod: POST
      MethodResponses:
        - StatusCode: 200
          ResponseParameters:
            method.response.header.Access-Control-Allow-Origin: true
      AuthorizationType: NONE
      ApiKeyRequired: false
      ResourceId: !Ref FlagResource
      RestApiId: !Ref API
      Integration:
        Type: AWS
        Uri: !Sub arn:aws:apigateway:${AWS::Region}:lambda:path/2015-03-31/functions/arn:aws:lambda:${AWS::Region}:${AWS::AccountId}:function:${SubmitFunction}/invocations
        IntegrationHttpMethod: POST
        IntegrationResponses:
          - StatusCode: 200
            ResponseParameters:
              method.response.header.Access-Control-Allow-Origin: "'*'"
        PassthroughBehavior: WHEN_NO_TEMPLATES
        RequestTemplates:
          application/json:
            !Sub |
              {
                "ScoresTable": "${ScoresTable}",
                "FlagsTable": "${FlagsTable}",
                "RegistrantsTable": "${RegistrantsTable}",
                "KeyValueBackend": "${KeyValueBackend}",
                "ScoreCacheLifetime": "${ScoreCacheLifetime}",
                "FlagCacheLifetime": "${FlagCacheLifetime}",
                "team": "$input.path('$.team')",
                "flag": "$input.path('$.flag')",
                "auth_key": "$input.path('$.auth_key')"
              }
  FlagOptions:
    Type: AWS::ApiGateway::Method
    Properties:
      ApiKeyRequired: false
      ResourceId: !Ref FlagResource
      RestApiId: !Ref API
      AuthorizationType: NONE
      HttpMethod: OPTIONS
      Integration:
        IntegrationHttpMethod: OPTIONS
        IntegrationResponses:
        - StatusCode: 200
          ResponseParameters:
            method.response.header.Access-Control-Allow-Headers: "'Content-Type,X-Amz-Date,Authorization,X-Api-Key,X-Amz-Security-Token'"
            method.response.header.Access-Control-Allow-Methods: "'POST,OPTIONS'"
            method.response.header.Access-Control-Allow-Origin: "'*'"
        PassthroughBehavior: WHEN_NO_TEMPLATES
        RequestTemplates:
          application/json: '{"statusCode": 200}'
        Type: MOCK
      MethodResponses:
      - StatusCode: 200
        ResponseParameters:
          method.response.header.Access-Control-Allow-Headers: true
          method.response.header.Access-Control-Allow-Methods: true
          method.response.header.Access-Control-Allow-Origin: true

  ScoreResource:
    Type: AWS::ApiGateway::Resource
    Properties:
      PathPart: score
      ParentId: !GetAtt API.RootResourceId
      RestApiId: !Ref API
  TeamPathPart:
    Type: AWS::ApiGateway::Resource
    Properties:
      PathPart: '{Team}'
      ParentId: !Ref ScoreResource
      RestApiId: !Ref API
  ScoreGetMethod:
    Type: AWS::ApiGateway::Method
    Properties:
      HttpMethod: GET
      MethodResponses:
        - StatusCode: 200
          ResponseParameters:
            method.response.header.Access-Control-Allow-Origin: true
      RequestParameters:
        method.request.path.Team: true
      AuthorizationType: NONE
      ApiKeyRequired: false
      ResourceId: !Ref TeamPathPart
      RestApiId: !Ref API
      Integration:
        Type: AWS
        Uri: !Sub arn:aws:apigateway:${AWS::Region}:lambda:path/2015-03-31/functions/arn:aws:lambda:${AWS::Region}:${AWS::AccountId}:function:${TallyFunction}/invocations
        IntegrationHttpMethod: POST
        IntegrationResponses:
          - StatusCode: 200
            ResponseParameters:
              method.response.header.Access-Control-Allow-Origin: "'*'"
        PassthroughBehavior: WHEN_NO_TEMPLATES
        RequestTemplates:
          application/json:
            !Sub |
              {
                "ScoresTable": "${ScoresTable}",
                "FlagsTable": "${FlagsTable}",
                "KeyValueBackend": "${KeyValueBackend}",
                "ScoreCacheLifetime": "${ScoreCacheLifetime}",
                "FlagCacheLifetime": "${FlagCacheLifetime}",
                "team": "$input.params('Team')"
              }
  ScoreOptions:
    Type: AWS::ApiGateway::Method
    Properties:
      ApiKeyRequired: false
      ResourceId: !Ref TeamPathPart
      RestApiId: !Ref API
      AuthorizationType: NONE
      HttpMethod: OPTIONS
      Integration:
        IntegrationHttpMethod: OPTIONS
        IntegrationResponses:
        - StatusCode: 200
          ResponseParameters:
            method.response.header.Access-Control-Allow-Headers: "'Content-Type,X-Amz-Date,Authorization,X-Api-Key,X-Amz-Security-Token'"
            method.response.header.Access-Control-Allow-Methods: "'GET,OPTIONS'"
            method.response.header.Access-Control-Allow-Origin: "'*'"
        PassthroughBehavior: WHEN_NO_TEMPLATES
        RequestTemplates:
          application/json: '{"statusCode": 200}'
        Type: MOCK
      MethodResponses:
      - StatusCode: 200
        ResponseParameters:
          method.response.header.Access-Control-Allow-Headers: true
          method.response.header.Access-Control-Allow-Methods: true
          method.response.header.Access-Control-Allow-Origin: true

  RegisterResource:
    Type: AWS::ApiGateway::Resource
    Properties:
      PathPart: register
      ParentId: !GetAtt API.RootResourceId
      RestApiId: !Ref API
  RegisterPostMethod:
    Type: AWS::ApiGateway::Method
    Properties:
      HttpMethod: POST
      MethodResponses:
        - StatusCode: 200
          ResponseParameters:
            method.response.header.Access-Control-Allow-Origin: true
      AuthorizationType: NONE
      ApiKeyRequired: false
      ResourceId: !Ref RegisterResource
      RestApiId: !Ref API
      Integration:
        Type: AWS
        Uri: !Sub arn:aws:apigateway:${AWS::Region}:lambda:path/2015-03-31/functions/arn:aws:lambda:${AWS::Region}:${AWS::AccountId}:function:${RegisterFunction}/invocations
        IntegrationHttpMethod: POST
        IntegrationResponses:
          - StatusCode: 200
            ResponseParameters:
              method.response.header.Access-Control-Allow-Origin: "'*'"
        PassthroughBehavior: WHEN_NO_TEMPLATES
        RequestTemplates:
          application/json:
            !Sub |
              {
                "Method": "POST",
                "ScoresTable": "${ScoresTable}",
                "FlagsTable": "${FlagsTable}",
                "RegistrantsTable": "${RegistrantsTable}",
                "KeyValueBackend": "${KeyValueBackend}",
                "ScoreCacheLifetime": "${ScoreCacheLifetime}",
                "FlagCacheLifetime": "${FlagCacheLifetime}",
                "email": "$input.path('$.email')",
                "username": "$input.path('$.username')"
              }
  RegisterGetMethod:
    Type: AWS::ApiGateway::Method
    Properties:
      HttpMethod: GET
      MethodResponses:
        - StatusCode: 200
          ResponseParameters:
            method.response.header.Access-Control-Allow-Origin: true
      AuthorizationType: NONE
      ApiKeyRequired: false
      ResourceId: !Ref RegisterResource
      RestApiId: !Ref API
      Integration:
        Type: AWS
        Uri: !Sub arn:aws:apigateway:${AWS::Region}:lambda:path/2015-03-31/functions/arn:aws:lambda:${AWS::Region}:${AWS::AccountId}:function:${RegisterFunction}/invocations
        IntegrationHttpMethod: POST
        IntegrationResponses:
          - StatusCode: 200
            ResponseParameters:
              method.response.header.Access-Control-Allow-Origin: "'*'"
        PassthroughBehavior: WHEN_NO_TEMPLATES
        RequestTemplates:
          application/json:
            !Sub |
              {
                "Method": "GET",
                "ScoresTable": "${ScoresTable}",
                "FlagsTable": "${FlagsTable}",
                "RegistrantsTable": "${RegistrantsTable}",
                "KeyValueBackend": "${KeyValueBackend}",
                "ScoreCacheLifetime": "${ScoreCacheLifetime}",
                "FlagCacheLifetime": "${FlagCacheLifetime}",
                "confirmation_token": "$input.params('confirmation_token')"
              }
  RegisterOptions:
    Type: AWS::ApiGateway::Method
    Properties:
      ApiKeyRequired: false
      ResourceId: !Ref RegisterResource
      RestApiId: !Ref API
      AuthorizationType: NONE
      HttpMethod: OPTIONS
      Integration:
        IntegrationHttpMethod: OPTIONS
        IntegrationResponses:
        - StatusCode: 200
          ResponseParameters:
            method.response.header.Access-Control-Allow-Headers: "'Content-Type,X-Amz-Date,Authorization,X-Api-Key,X-Amz-Security-Token'"
            method.response.header.Access-Control-Allow-Methods: "'POST,OPTIONS'"
            method.response.header.Access-Control-Allow-Origin: "'*'"
        PassthroughBehavior: WHEN_NO_TEMPLATES
        RequestTemplates:
          application/json: '{"statusCode": 200}'
        Type: MOCK
      MethodResponses:
      - StatusCode: 200
        ResponseParameters:
          method.response.header.Access-Control-Allow-Headers: true
          method.response.header.Access-Control-Allow-Methods: true
          method.response.header.Access-Control-Allow-Origin: true

  APIDeployment:
    Type: AWS::ApiGateway::Deployment
    DependsOn:
      - FlagResource
      - FlagPostMethod
      - ScoreResource
      - TeamPathPart
      - ScoreGetMethod
      - RegisterPostMethod
      - RegisterResource
    Properties:
      Description: Initial CloudFormation deployment stage
      RestApiId: !Ref API
      StageName: Main

  FlagPostPermission:
    Type: AWS::Lambda::Permission
    DependsOn:
      - FlagPostMethod
    Properties:
      FunctionName: !Sub arn:aws:lambda:${AWS::Region}:${AWS::AccountId}:function:${SubmitFunction}
      Action: lambda:InvokeFunction
      SourceArn: !Sub arn:aws:execute-api:${AWS::Region}:${AWS::AccountId}:${API}/*/POST/flag
      Principal: apigateway.amazonaws.com

  ScoreGetPermission:
    Type: AWS::Lambda::Permission
    DependsOn:
      - ScoreGetMethod
    Properties:
      FunctionName: !Sub arn:aws:lambda:${AWS::Region}:${AWS::AccountId}:function:${TallyFunction}
      Action: lambda:InvokeFunction
      SourceArn: !Sub arn:aws:execute-api:${AWS::Region}:${AWS::AccountId}:${API}/*/GET/score/*
      Principal: apigateway.amazonaws.com

  RegisterPostPermission:
    Type: AWS::Lambda::Permission
    DependsOn:
      - RegisterPostMethod
    Properties:
      FunctionName: !Sub arn:aws:lambda:${AWS::Region}:${AWS::AccountId}:function:${RegisterFunction}
      Action: lambda:InvokeFunction
      SourceArn: !Sub arn:aws:execute-api:${AWS::Region}:${AWS::AccountId}:${API}/*/POST/register
      Principal: apigateway.amazonaws.com

  RegisterGetPermission:
    Type: AWS::Lambda::Permission
    DependsOn:
      - RegisterGetMethod
    Properties:
      FunctionName: !Sub arn:aws:lambda:${AWS::Region}:${AWS::AccountId}:function:${RegisterFunction}
      Action: lambda:InvokeFunction
      SourceArn: !Sub arn:aws:execute-api:${AWS::Region}:${AWS::AccountId}:${API}/*/GET/register
      Principal: apigateway.amazonaws.com

  RegisterFunction:
    Type: AWS::Lambda::Function
    DependsOn:
      - RegisterLambdaRole
    Properties:
      Description: Ingest an email and username, and register the user.
      Role: !Sub arn:aws:iam::${AWS::AccountId}:role/${RegisterLambdaRole}
      TracingConfig:
        Mode: Active
      MemorySize: "128"
      Timeout: "5"
      Environment:
        Variables:
          XraySampleRate: !Ref XraySampleRate
          SCORECARD_LOG_EVENTS: "TRUE"
          SES_EMAIL_SOURCE: !Ref SESEmailSource
          SES_REGION: !Ref SESRegion
          HMAC_SECRET: !Ref HMACSecret
          REGISTRATION_MODE: !Ref RegistrationMode
          API_URL: !Sub https://${API}.execute-api.${AWS::Region}.amazonaws.com/Main
      Runtime: python3.6
      Handler: Register.lambda_handler
      Code:
        !If
          - RegisterCodePlaceholder
          - ZipFile: |
              def handler(event, context):
                  return True
          - S3Bucket: !Ref CodeSourceBucket
            S3Key: !Ref CodeSourceRegisterObject

  SubmitFunction:
    Type: AWS::Lambda::Function
    DependsOn:
      - SubmitLambdaRole
    Properties:
      Description: Ingest a submission and update the key-value backend tables
        appropriately.
      Role: !Sub arn:aws:iam::${AWS::AccountId}:role/${SubmitLambdaRole}
      TracingConfig:
        Mode: Active
      MemorySize: "128"
      Timeout: "5"
      Environment:
        Variables:
          XraySampleRate: !Ref XraySampleRate
          SCORECARD_LOG_EVENTS: "TRUE"
      Runtime: python2.7
      Handler: ScoreCardSubmit.lambda_handler
      Code:
        !If
          - SubmitCodePlaceholder
          - ZipFile: |
              def handler(event, context):
                  return True
          - S3Bucket: !Ref CodeSourceBucket
            S3Key: !Ref CodeSourceSubmitObject

  TallyFunction:
    Type: AWS::Lambda::Function
    DependsOn:
      - TallyLambdaRole
    Properties:
      Description: Given a team ID, tally the score for that team from the key-value
        backend.
      Role: !Sub arn:aws:iam::${AWS::AccountId}:role/${TallyLambdaRole}
      TracingConfig:
        Mode: Active
      MemorySize: "128"
      Timeout: "5"
      Environment:
        Variables:
          XraySampleRate: !Ref XraySampleRate
      Runtime: python2.7
      Handler: ScoreCardTally.lambda_handler
      Code:
        !If
          - TallyCodePlaceholder
          - ZipFile: |
              def handler(event, context):
                  return True
          - S3Bucket: !Ref CodeSourceBucket
            S3Key: !Ref CodeSourceTallyObject

  TallyInstanceProfile:
    Type: AWS::IAM::InstanceProfile
    Properties:
      Roles:
        - !Ref TallyLambdaRole

  TallyLambdaRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Statement:
          - Action: sts:AssumeRole
            Effect: Allow
            Principal:
              Service:
                - lambda.amazonaws.com
                - ec2.amazonaws.com
                - ecs-tasks.amazonaws.com
        Version: '2012-10-17'
      Policies:
        - PolicyName: TallyLambdaPolicy
          PolicyDocument:
            Statement:
              - Action:
                  - dynamodb:GetItem
                Effect: Allow
                Resource: !Sub arn:aws:dynamodb:${AWS::Region}:${AWS::AccountId}:table/${ScoresTable}
              - Action:
                  - dynamodb:Scan
                Effect: Allow
                Resource: !Sub arn:aws:dynamodb:${AWS::Region}:${AWS::AccountId}:table/${FlagsTable}
              - Action:
                  - xray:PutTraceSegments
                  - xray:PutTelemetryRecords
                Effect: Allow
                Resource: '*'
              - Action:
                  - logs:CreateLogGroup
                  - logs:CreateLogStream
                  - logs:PutLogEvents
                Effect: Allow
                Resource: "*"
            Version: '2012-10-17'

  SubmitLambdaRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Statement:
          - Action: sts:AssumeRole
            Effect: Allow
            Principal:
              Service: lambda.amazonaws.com
        Version: '2012-10-17'
      Policies:
        - PolicyName: SubmitLambdaPolicy
          PolicyDocument:
            Statement:
              - Action:
                  - dynamodb:UpdateItem
                Effect: Allow
                Resource: !Sub arn:aws:dynamodb:${AWS::Region}:${AWS::AccountId}:table/${ScoresTable}
              - Action:
                  - dynamodb:Scan
                Effect: Allow
                Resource: !Sub arn:aws:dynamodb:${AWS::Region}:${AWS::AccountId}:table/${FlagsTable}
              - Action:
                - dynamodb:GetItem
                Effect: Allow
                Resource: !Sub arn:aws:dynamodb:${AWS::Region}:${AWS::AccountId}:table/${RegistrantsTable}
              - Action:
                  - xray:PutTraceSegments
                  - xray:PutTelemetryRecords
                Effect: Allow
                Resource: '*'
              - Action:
                  - logs:CreateLogGroup
                  - logs:CreateLogStream
                  - logs:PutLogEvents
                Effect: Allow
                Resource: "*"
            Version: '2012-10-17'

  RegisterLambdaRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Statement:
          - Action: sts:AssumeRole
            Effect: Allow
            Principal:
              Service: lambda.amazonaws.com
        Version: '2012-10-17'
      Policies:
        - PolicyName: RegisterLambdaPolicy
          PolicyDocument:
            Statement:
              - Action:
                  - dynamodb:GetItem
                  - dynamodb:PutItem
                  - dynamodb:Scan
                Effect: Allow
                Resource: !Sub arn:aws:dynamodb:${AWS::Region}:${AWS::AccountId}:table/${RegistrantsTable}
              - Action:
                - ses:sendEmail
                Effect: Allow
                Resource: '*'
                Condition:
                  StringEquals:
                    ses:FromAddress: !Ref SESEmailSource
              - Action:
                  - xray:PutTraceSegments
                  - xray:PutTelemetryRecords
                Effect: Allow
                Resource: '*'
              - Action:
                  - logs:CreateLogGroup
                  - logs:CreateLogStream
                  - logs:PutLogEvents
                Effect: Allow
                Resource: "*"
            Version: '2012-10-17'