stack.yaml

AWSTemplateFormatVersion: 2010-09-09
Parameters:
  UserPoolName:
    Type: String
  IdentityPoolName:
    Type: String
  UserRoleName:
    Type: String
  UserPolicyName:
    Type: String
  AllowedOrigins:
    Type: List<String>
Resources:
  UserPool:
    Type: AWS::Cognito::UserPool
    Properties:
      UserPoolName: !Ref UserPoolName
      UsernameAttributes:
        - email
      AutoVerifiedAttributes:
        - email
      Schema:
        - Name: given_name
          AttributeDataType: String
          Required: true
          Mutable: true
        - Name: family_name
          AttributeDataType: String
          Required: true
          Mutable: true
  UserPoolClient:
    Type: AWS::Cognito::UserPoolClient
    Properties:
      UserPoolId: !Ref UserPool
  IdentityPool:
    Type: AWS::Cognito::IdentityPool
    Properties:
      IdentityPoolName: !Ref IdentityPoolName
      AllowUnauthenticatedIdentities: false
      CognitoIdentityProviders:
        - ClientId: !Ref UserPoolClient
          ProviderName: !GetAtt UserPool.ProviderName
          ServerSideTokenCheck: true
  UserRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: !Ref UserRoleName
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement: 
          - Effect: Allow
            Principal: 
              Federated: cognito-identity.amazonaws.com
            Action: 
              - sts:AssumeRoleWithWebIdentity
            Condition:
              StringEquals:
                cognito-identity.amazonaws.com:aud: !Ref IdentityPool
              ForAnyValue:StringLike:
                cognito-identity.amazonaws.com:amr: authenticated
      Policies:
        - PolicyName: !Ref UserPolicyName
          PolicyDocument:
            Version: 2012-10-17
            Statement:
              - Effect: Allow
                Action:
                  - s3:ListBucket
                Resource:
                  - !Sub arn:aws:s3:::${FileBucket}
                Condition:
                  StringLike:
                    s3:prefix:
                      - ${cognito-identity.amazonaws.com:sub}/
              - Effect: Allow
                Action:
                  - s3:GetObject
                  - s3:PutObject
                  - s3:DeleteObject
                Resource:
                  - !Sub arn:aws:s3:::${FileBucket}/${!cognito-identity.amazonaws.com:sub}
                  - !Sub arn:aws:s3:::${FileBucket}/${!cognito-identity.amazonaws.com:sub}/*
  IdentityPoolRoleAttachment:
    Type: AWS::Cognito::IdentityPoolRoleAttachment
    Properties:
      IdentityPoolId: !Ref IdentityPool
      Roles:
        authenticated: !GetAtt UserRole.Arn
  FileBucket:
    Type: AWS::S3::Bucket
    Properties:
      PublicAccessBlockConfiguration:
        BlockPublicAcls: True
        BlockPublicPolicy: True
        IgnorePublicAcls: True
        RestrictPublicBuckets: True
      CorsConfiguration:
        CorsRules:
          - AllowedMethods:
              - GET
              - PUT
              - DELETE
            AllowedOrigins: !Ref AllowedOrigins
            AllowedHeaders:
              - authorization
              - x-amz-content-sha256
              - x-amz-date
              - x-amz-security-token
              - x-amz-user-agent
              - content-type
              - x-amz-acl
Outputs:
  UserPoolId:
    Value: !Ref UserPool
  UserPoolClientId:
    Value: !Ref UserPoolClient
  IdentityPoolId:
    Value: !Ref IdentityPool
  FileBucketName:
    Value: !Ref FileBucket