workshop.yml

---
AWSTemplateFormatVersion: 2010-09-09
Description: AWS SaaS Factory Bootcamp Master Stack
Parameters:
  AssetsBucket:
    Description: S3 bucket containing workshop assets.
    Type: String
    Default: aws-bootcamp-us-east-1
  AssetsBucketPrefix:
    Description: S3 folder containing workshop assets. Leave blank if you did not put the assets in a subfolder.
    Type: String
    Default: ''
  ParticipantAssumedRoleArn:
    Description: Workshop Studio Participant IAM Role. Leave blank when not using Workshop Studio.
    Type: String
    Default: ''
Conditions:
  HasAssetBucketPrefix: !Not [!Equals ['', !Ref AssetsBucketPrefix]]
Resources:
  WorkshopBucket:
    Type: AWS::S3::Bucket
    Properties:
      BucketEncryption:
        ServerSideEncryptionConfiguration:
          - ServerSideEncryptionByDefault:
              SSEAlgorithm: AES256
  WorkshopBucketSsmParam:
    Type: AWS::SSM::Parameter
    Properties:
      Name: saas-bootcamp-bucket
      Type: String
      Value: !Ref WorkshopBucket
  WorkshopBucketPrefixSsmParam:
    Type: AWS::SSM::Parameter
    Properties:
      Name: saas-bootcamp-bucket-prefix
      Type: String
      Value: !If [HasAssetBucketPrefix, !Ref AssetsBucketPrefix, 'N/A']
  WebsiteBucket:
    Type: AWS::S3::Bucket
    Properties:
      BucketEncryption:
        ServerSideEncryptionConfiguration:
          - ServerSideEncryptionByDefault:
              SSEAlgorithm: AES256
  ArtifactBucket:
    Type: AWS::S3::Bucket
    Properties:
      BucketEncryption:
        ServerSideEncryptionConfiguration:
          - ServerSideEncryptionByDefault:
              SSEAlgorithm: AES256
      VersioningConfiguration:
        Status: Enabled
      NotificationConfiguration:
        EventBridgeConfiguration:
          EventBridgeEnabled: true
  S3ObjectsExecutionRole:
    Type: AWS::IAM::Role
    DependsOn: WorkshopBucket
    Properties:
      RoleName: !Sub saas-bootcamp-s3-copy-role-${AWS::Region}
      Path: '/'
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - lambda.amazonaws.com
            Action:
              - sts:AssumeRole
      Policies:
        - PolicyName: saas-bootcamp-s3-copy-policy
          PolicyDocument:
            Version: 2012-10-17
            Statement:
              - Effect: Allow
                Action:
                  - logs:PutLogEvents
                Resource: !Sub arn:aws:logs:${AWS::Region}:${AWS::AccountId}:log-group:*:log-stream:*
              - Effect: Allow
                Action:
                  - logs:CreateLogStream
                  - logs:DescribeLogStreams
                Resource:
                  - !Sub arn:aws:logs:${AWS::Region}:${AWS::AccountId}:log-group:*
              - Effect: Allow
                Action:
                  - s3:GetObject
                Resource:
                  - !Sub arn:${AWS::Partition}:s3:::${AssetsBucket}/${AssetsBucketPrefix}*
              - Effect: Allow
                Action:
                  - s3:ListBucket
                  - s3:ListBucketVersions
                  - s3:GetBucketVersioning
                Resource:
                  - !Sub arn:aws:s3:::${WorkshopBucket}
                  - !Sub arn:aws:s3:::${ArtifactBucket}
                  - !Sub arn:aws:s3:::${WebsiteBucket}
              - Effect: Allow
                Action:
                  - s3:PutObject
                  - s3:DeleteObject
                  - s3:DeleteObjectVersion
                Resource:
                  - !Sub arn:aws:s3:::${WorkshopBucket}/*
                  - !Sub arn:aws:s3:::${ArtifactBucket}/*
                  - !Sub arn:aws:s3:::${WebsiteBucket}/*
  CopyS3ObjectsLogs:
    Type: AWS::Logs::LogGroup
    Properties:
      LogGroupName: /aws/lambda/saas-bootcamp-s3-copy
      RetentionInDays: 7
  CopyS3Objects:
    Type: AWS::Lambda::Function
    DependsOn:
      - CopyS3ObjectsLogs
    Properties:
      FunctionName: saas-bootcamp-s3-copy
      Role: !GetAtt S3ObjectsExecutionRole.Arn
      Runtime: python3.9
      Timeout: 600
      MemorySize: 512
      Handler: index.lambda_handler
      Code:
        ZipFile: |
          import json
          import boto3
          import cfnresponse
          from botocore.exceptions import ClientError
          
          def lambda_handler(event, context):
            print(json.dumps(event, default=str))
            source_bucket_slash = event['ResourceProperties']['Source']
            if source_bucket_slash.endswith ('/'):
              source_bucket = source_bucket_slash[:-1]
            else:
              source_bucket = source_bucket_slash
            source_prefix = event['ResourceProperties']['SourcePrefix']
            destination_bucket = event['ResourceProperties']['Destination']
            destination_region = event['ResourceProperties']['DestinationRegion']
            objects_to_copy = event['ResourceProperties']['Objects']
            
            if event['RequestType'] in ['Create', 'Update']:
              if not objects_to_copy:
                # If we weren't given a specific list of objects to copy,
                # just copy everything to the destination bucket
                s3 = boto3.client('s3')
                source_objects = s3.list_objects_v2(Bucket=source_bucket, Prefix=source_prefix)
                objects_to_copy = list(map(lambda obj : obj['Key'], source_objects.get('Contents', [])))
            
              print("Creating S3 client in destination region %s" % destination_region)
              s3 = boto3.client('s3', region_name=destination_region)
              for key in objects_to_copy:
                print("Copying %s/%s -> %s/%s" % (source_bucket, key, destination_bucket, key))
                try:
                    s3.copy_object(CopySource={'Bucket':source_bucket, 'Key':key}, Bucket=destination_bucket, Key=key)
                except ClientError as s3_error:
                    cfnresponse.send(event, context, cfnresponse.FAILED, {"Reason": str(s3_error)})
                    raise
              cfnresponse.send(event, context, cfnresponse.SUCCESS, {})
            elif event['RequestType'] == 'Delete':
              cfnresponse.send(event, context, cfnresponse.SUCCESS, {})
            else:
              cfnresponse.send(event, context, cfnresponse.FAILED, {"Reason": "Unknown RequestType %s" % event['RequestType']})
  InvokeLambdaCopyS3Objects:
    Type: Custom::CustomResource
    DependsOn:
      - CopyS3ObjectsLogs
    Properties:
      ServiceToken: !GetAtt CopyS3Objects.Arn
      Source: !Ref AssetsBucket
      SourcePrefix: !Ref AssetsBucketPrefix
      Destination: !Ref WorkshopBucket
      DestinationRegion: !Ref AWS::Region
      Objects:
        - !Sub ${AssetsBucketPrefix}resources/baseline.yml
        - !Sub ${AssetsBucketPrefix}resources/api-gateway.yml
        - !Sub ${AssetsBucketPrefix}resources/auth-service.yml
        - !Sub ${AssetsBucketPrefix}resources/tenant-service.yml
        - !Sub ${AssetsBucketPrefix}resources/user-service.yml
        - !Sub ${AssetsBucketPrefix}resources/registration-service.yml
        - !Sub ${AssetsBucketPrefix}resources/order-service.yml
        - !Sub ${AssetsBucketPrefix}resources/product-service.yml
        - !Sub ${AssetsBucketPrefix}resources/web-client.yml
        - !Sub ${AssetsBucketPrefix}source/shared-modules/config-helper/config.js
        - !Sub ${AssetsBucketPrefix}source/shared-modules/config-helper/package.json
        - !Sub ${AssetsBucketPrefix}source/shared-modules/config-helper/config/default.json
        - !Sub ${AssetsBucketPrefix}source/shared-modules/config-helper/config/development.json
        - !Sub ${AssetsBucketPrefix}source/shared-modules/config-helper/config/production.json
        - !Sub ${AssetsBucketPrefix}source/shared-modules/token-manager/token-manager.js
        - !Sub ${AssetsBucketPrefix}source/shared-modules/token-manager/package.json
        - !Sub ${AssetsBucketPrefix}source/shared-modules/dynamodb-helper/dynamodb-helper.js
        - !Sub ${AssetsBucketPrefix}source/shared-modules/dynamodb-helper/package.json
        - !Sub ${AssetsBucketPrefix}source/auth-manager/Dockerfile
        - !Sub ${AssetsBucketPrefix}source/auth-manager/server.js
        - !Sub ${AssetsBucketPrefix}source/auth-manager/package.json
        - !Sub ${AssetsBucketPrefix}source/tenant-manager/Dockerfile
        - !Sub ${AssetsBucketPrefix}source/tenant-manager/server.js
        - !Sub ${AssetsBucketPrefix}source/tenant-manager/package.json
        - !Sub ${AssetsBucketPrefix}source/user-manager/cognito-user.js
        - !Sub ${AssetsBucketPrefix}source/user-manager/Dockerfile
        - !Sub ${AssetsBucketPrefix}source/user-manager/server.js
        - !Sub ${AssetsBucketPrefix}source/user-manager/package.json
        - !Sub ${AssetsBucketPrefix}source/tenant-registration/Dockerfile
        - !Sub ${AssetsBucketPrefix}source/tenant-registration/server.js
        - !Sub ${AssetsBucketPrefix}source/tenant-registration/package.json
        - !Sub ${AssetsBucketPrefix}source/order-manager/Dockerfile
        - !Sub ${AssetsBucketPrefix}source/order-manager/server.js
        - !Sub ${AssetsBucketPrefix}source/order-manager/package.json
        - !Sub ${AssetsBucketPrefix}source/product-manager/Dockerfile
        - !Sub ${AssetsBucketPrefix}source/product-manager/server.js
        - !Sub ${AssetsBucketPrefix}source/product-manager/package.json
        - !Sub ${AssetsBucketPrefix}source/web-client/Gruntfile.js
        - !Sub ${AssetsBucketPrefix}source/web-client/app/404.html
        - !Sub ${AssetsBucketPrefix}source/web-client/app/config.json
        - !Sub ${AssetsBucketPrefix}source/web-client/app/favicon.ico
        - !Sub ${AssetsBucketPrefix}source/web-client/app/images/Auctioneer2-300px.png
        - !Sub ${AssetsBucketPrefix}source/web-client/app/images/chart.png
        - !Sub ${AssetsBucketPrefix}source/web-client/app/images/favicon.ico
        - !Sub ${AssetsBucketPrefix}source/web-client/app/images/green-circle.png
        - !Sub ${AssetsBucketPrefix}source/web-client/app/images/matt-icons_package-300px.png
        - !Sub ${AssetsBucketPrefix}source/web-client/app/images/matt-icons_package-800px.png
        - !Sub ${AssetsBucketPrefix}source/web-client/app/images/monitor.png
        - !Sub ${AssetsBucketPrefix}source/web-client/app/images/red-circle.png
        - !Sub ${AssetsBucketPrefix}source/web-client/app/images/yeoman.png
        - !Sub ${AssetsBucketPrefix}source/web-client/app/index.html
        - !Sub ${AssetsBucketPrefix}source/web-client/app/robots.txt
        - !Sub ${AssetsBucketPrefix}source/web-client/app/scripts/app.js
        - !Sub ${AssetsBucketPrefix}source/web-client/app/scripts/constants.js
        - !Sub ${AssetsBucketPrefix}source/web-client/app/scripts/controllers/confirm.js
        - !Sub ${AssetsBucketPrefix}source/web-client/app/scripts/controllers/login.js
        - !Sub ${AssetsBucketPrefix}source/web-client/app/scripts/controllers/main.js
        - !Sub ${AssetsBucketPrefix}source/web-client/app/scripts/controllers/order-add.js
        - !Sub ${AssetsBucketPrefix}source/web-client/app/scripts/controllers/order-delete.js
        - !Sub ${AssetsBucketPrefix}source/web-client/app/scripts/controllers/order-edit.js
        - !Sub ${AssetsBucketPrefix}source/web-client/app/scripts/controllers/orders.js
        - !Sub ${AssetsBucketPrefix}source/web-client/app/scripts/controllers/product-add.js
        - !Sub ${AssetsBucketPrefix}source/web-client/app/scripts/controllers/product-delete.js
        - !Sub ${AssetsBucketPrefix}source/web-client/app/scripts/controllers/product-edit.js
        - !Sub ${AssetsBucketPrefix}source/web-client/app/scripts/controllers/product-view.js
        - !Sub ${AssetsBucketPrefix}source/web-client/app/scripts/controllers/products.js
        - !Sub ${AssetsBucketPrefix}source/web-client/app/scripts/controllers/register.js
        - !Sub ${AssetsBucketPrefix}source/web-client/app/scripts/controllers/tenant-delete.js
        - !Sub ${AssetsBucketPrefix}source/web-client/app/scripts/controllers/tenant-edit.js
        - !Sub ${AssetsBucketPrefix}source/web-client/app/scripts/controllers/tenants.js
        - !Sub ${AssetsBucketPrefix}source/web-client/app/scripts/controllers/user-add.js
        - !Sub ${AssetsBucketPrefix}source/web-client/app/scripts/controllers/user-delete.js
        - !Sub ${AssetsBucketPrefix}source/web-client/app/scripts/controllers/user-edit.js
        - !Sub ${AssetsBucketPrefix}source/web-client/app/scripts/controllers/user-enable.js
        - !Sub ${AssetsBucketPrefix}source/web-client/app/scripts/controllers/users.js
        - !Sub ${AssetsBucketPrefix}source/web-client/app/styles/main.css
        - !Sub ${AssetsBucketPrefix}source/web-client/app/styles/main.scss
        - !Sub ${AssetsBucketPrefix}source/web-client/app/views/confirm.html
        - !Sub ${AssetsBucketPrefix}source/web-client/app/views/login.html
        - !Sub ${AssetsBucketPrefix}source/web-client/app/views/main.html
        - !Sub ${AssetsBucketPrefix}source/web-client/app/views/order-add.html
        - !Sub ${AssetsBucketPrefix}source/web-client/app/views/order-delete.html
        - !Sub ${AssetsBucketPrefix}source/web-client/app/views/order-edit.html
        - !Sub ${AssetsBucketPrefix}source/web-client/app/views/order-nav.html
        - !Sub ${AssetsBucketPrefix}source/web-client/app/views/orders.html
        - !Sub ${AssetsBucketPrefix}source/web-client/app/views/product-add.html
        - !Sub ${AssetsBucketPrefix}source/web-client/app/views/product-delete.html
        - !Sub ${AssetsBucketPrefix}source/web-client/app/views/product-edit.html
        - !Sub ${AssetsBucketPrefix}source/web-client/app/views/product-nav.html
        - !Sub ${AssetsBucketPrefix}source/web-client/app/views/product-view.html
        - !Sub ${AssetsBucketPrefix}source/web-client/app/views/products.html
        - !Sub ${AssetsBucketPrefix}source/web-client/app/views/register.html
        - !Sub ${AssetsBucketPrefix}source/web-client/app/views/tenant-delete.html
        - !Sub ${AssetsBucketPrefix}source/web-client/app/views/tenant-edit.html
        - !Sub ${AssetsBucketPrefix}source/web-client/app/views/tenants.html
        - !Sub ${AssetsBucketPrefix}source/web-client/app/views/user-add.html
        - !Sub ${AssetsBucketPrefix}source/web-client/app/views/user-delete.html
        - !Sub ${AssetsBucketPrefix}source/web-client/app/views/user-edit.html
        - !Sub ${AssetsBucketPrefix}source/web-client/app/views/user-enable.html
        - !Sub ${AssetsBucketPrefix}source/web-client/app/views/user-nav.html
        - !Sub ${AssetsBucketPrefix}source/web-client/app/views/users.html
        - !Sub ${AssetsBucketPrefix}source/web-client/bower.json
        - !Sub ${AssetsBucketPrefix}source/web-client/package.json
  ClearS3BucketLogs:
    Type: AWS::Logs::LogGroup
    Properties:
      LogGroupName: /aws/lambda/saas-bootcamp-s3-clear
      RetentionInDays: 7
  ClearS3Bucket:
    Type: AWS::Lambda::Function
    Properties:
      FunctionName: saas-bootcamp-s3-clear
      Role: !GetAtt S3ObjectsExecutionRole.Arn
      Runtime: python3.9
      Timeout: 900
      MemorySize: 512
      Handler: index.lambda_handler
      Code:
        ZipFile: |
          import json
          import boto3
          import cfnresponse
          from botocore.exceptions import ClientError
          
          def lambda_handler(event, context):
              print(json.dumps(event, default=str))
              if event['RequestType'] in ['Create', 'Update']:
                  cfnresponse.send(event, context, cfnresponse.SUCCESS, {})
              elif event['RequestType'] == 'Delete':
                  s3 = boto3.client('s3')
                  bucket = event['ResourceProperties']['Bucket']
                  objects_to_delete = []
                  try:
                      versioning_response = s3.get_bucket_versioning(Bucket=bucket)
                      print(json.dumps(versioning_response, default=str))
                      if 'Status' in versioning_response and versioning_response['Status'] in ['Enabled', 'Suspended']:
                          print("Bucket %s is versioned (%s)" % (bucket, versioning_response['Status']))
                          key_token = ''
                          version_token = ''
                          while True:
                              if not version_token:
                                  list_response = s3.list_object_versions(Bucket=bucket, KeyMarker=key_token)
                              else:
                                  list_response = s3.list_object_versions(Bucket=bucket, KeyMarker=key_token, VersionIdMarker=version_token)
                              key_token = list_response['NextKeyMarker'] if 'NextKeyMarker' in list_response else ''
                              version_token = list_response['NextVersionIdMarker'] if 'NextVersionIdMarker' in list_response else ''
                              if 'Versions' in list_response:
                                  for s3_object in list_response['Versions']:
                                      objects_to_delete.append({'Key': s3_object['Key'], 'VersionId': s3_object['VersionId']})
                              if not list_response['IsTruncated']:
                                  break
                      else:
                          print("Bucket %s is not versioned" % bucket)
                          token = ''
                          while True:
                              if not token:
                                  list_response = s3.list_objects_v2(Bucket=bucket)
                              else:
                                  list_response = s3.list_objects_v2(Bucket=bucket, ContinuationToken=token)
                              token = list_response['NextContinuationToken'] if 'NextContinuationToken' in list_response else ''
                              if 'Contents' in list_response:
                                  for s3_object in list_response['Contents']:
                                      objects_to_delete.append({'Key': s3_object['Key']})
                              if not list_response['IsTruncated']:
                                  break
                      if len(objects_to_delete) > 0:
                          print("Deleting %d objects" % len(objects_to_delete))
                          max_batch_size = 1000
                          batch_start = 0
                          batch_end = 0
                          while batch_end < len(objects_to_delete):
                              batch_start = batch_end
                              batch_end += max_batch_size
                              if (batch_end > len(objects_to_delete)):
                                  batch_end = len(objects_to_delete)
                              delete_response = s3.delete_objects(Bucket=bucket, Delete={'Objects': objects_to_delete[batch_start:batch_end]})
                              print("Cleaned up %d objects in bucket %s" % (len(delete_response['Deleted']), bucket))
                      else:
                          print("Bucket %s is empty. Nothing to clean up." % bucket)
                      
                      # Tell CloudFormation we're all done
                      cfnresponse.send(event, context, cfnresponse.SUCCESS, {})
                  except ClientError as s3_error:
                      cfnresponse.send(event, context, cfnresponse.FAILED, {"Reason": str(s3_error)})
                      raise
              else:
                  cfnresponse.send(event, context, cfnresponse.FAILED, {"Reason": "Unknown RequestType %s" % event['RequestType']})
  InvokeClearS3BucketWorkshopS3Bucket:
    Type: Custom::CustomResource
    DependsOn:
      - ClearS3BucketLogs
    Properties:
      ServiceToken: !GetAtt ClearS3Bucket.Arn
      Bucket: !Ref WorkshopBucket
  InvokeLambdaClearArtifactBucket:
    Type: Custom::CustomResource
    DependsOn:
      - ClearS3BucketLogs
    Properties:
      ServiceToken: !GetAtt ClearS3Bucket.Arn
      Bucket: !Ref ArtifactBucket
  InvokeLambdaClearWebsiteBucket:
    Type: Custom::CustomResource
    DependsOn:
      - ClearS3BucketLogs
    Properties:
      ServiceToken: !GetAtt ClearS3Bucket.Arn
      Bucket: !Ref WebsiteBucket
  Baseline:
    Type: AWS::CloudFormation::Stack
    DependsOn: InvokeLambdaCopyS3Objects
    Properties:
      TemplateURL: !Sub https://s3.${AWS::Region}.amazonaws.com/${WorkshopBucket}/${AssetsBucketPrefix}resources/baseline.yml
      Parameters:
        ParticipantAssumedRoleArn: !Ref ParticipantAssumedRoleArn
        WorkshopBucket: !Ref WorkshopBucket
        AssetsBucketPrefix: !Ref AssetsBucketPrefix
        ArtifactBucket: !Ref ArtifactBucket
        WebsiteBucket: !Ref WebsiteBucket
Outputs:
  SaaSFactoryBootcampStack:
    Description: Saas Bootcamp CloudFormation stack
    Value: !Ref AWS::StackName
  ApiGatewayEndpoint:
    Description: API Gateway Invoke URL
    Value: !GetAtt Baseline.Outputs.ApiGatewayEndpoint
  WebAppUrl:
    Description: Web application URL
    Value: !GetAtt Baseline.Outputs.WebAppUrl
  ParticipantAssumedRoleArn:
    Description: ParticipantAssumedRoleArn
    Value: !Ref ParticipantAssumedRoleArn
...