template.yaml

AWSTemplateFormatVersion: '2010-09-09'
Transform: 'AWS::Serverless-2016-10-31'
Description: Lambda and API Gateway for CVM
Parameters:
  DeviceTableName:
    Description: The Dynamodb table name of your device info.
    Type: String
    Default: deviceInfo
  IotDataEndpoint:
    Description: The IoT data endpoint for updating shadow.
    Type: String
Outputs:
  LambdaArn:
    Description: "Lambda Arn"
    Value: !GetAtt LambdaRole.Arn
  Api:
    Description: "API Gateway endpoint URL for Prod stage"
    Value: !Sub "https://${ServerlessRestApi}.execute-api.${AWS::Region}.amazonaws.com/Prod"
Resources:
  CVMIoTResource:
    Type: 'AWS::Serverless::Function'
    Properties:
      Runtime: nodejs16.x
      MemorySize: 1024
      Timeout: 15
      CodeUri: ./lambda
      Handler: index.handler
      Description: API used for CVM requests
      Role: !GetAtt LambdaRole.Arn
      Environment:
        Variables:
          REGION: !Ref AWS::Region
          DYNAMODB_TABLE_NAME: !Ref DeviceInfoDynamoDBTable
          IOT_DATA_ENDPOINT: !Ref IotDataEndpoint
      Events:
        CVMIoTApi:
            Type: Api
            Properties:
                Path: /getcert
                Method: GET
        ShadowIoTApi:
            Type: Api
            Properties:
                Path: /shadow
                Method: ANY
  DeviceInfoDynamoDBTable:
    Type: AWS::DynamoDB::Table
    Properties:
      TableName:
        Ref: DeviceTableName
      AttributeDefinitions:
      - AttributeName: serialNumber
        AttributeType: S
      KeySchema:
      - AttributeName: serialNumber
        KeyType: HASH
      ProvisionedThroughput:
        ReadCapacityUnits: '5'
        WriteCapacityUnits: '5'
  LambdaRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
        - Effect: Allow
          Principal:
            Service: lambda.amazonaws.com
          Action:
          - sts:AssumeRole
      Path: "/"
      Policies:
      - PolicyName: logs
        PolicyDocument:
          Version: '2012-10-17'
          Statement:
          - Effect: Allow
            Action:
            - logs:*
            Resource: arn:aws:logs:*:*:*
      - PolicyName: dynamodb
        PolicyDocument:
          Version: '2012-10-17'
          Statement:
          - Sid: '1'
            Effect: Allow
            Action:
            - dynamodb:Query
            - dynamodb:UpdateItem
            Resource:
            - Fn::Join:
              - ''
              - - 'arn:aws:dynamodb:'
                - Ref: AWS::Region
                - ":"
                - Ref: AWS::AccountId
                - ":table/"
                - Ref: DeviceTableName
      - PolicyName: IoTPolicy
        PolicyDocument:
          Version: '2012-10-17'
          Statement:
          - Sid: '1'
            Effect: Allow
            Action:
            - iot:CreateThing
            - iot:AttachPolicy
            - iot:DetachPolicy 
            - iot:AttachThingPrincipal
            - iot:DetachThingPrincipal
            - iot:CreatePolicy
            - iot:CreateKeysAndCertificate
            - iot:UpdateCertificate
            - iot:DeleteCertificate
            - iot:GetThingShadow
            - iot:UpdateThingShadow
            Resource: "*"
  GreengrassV2TokenExchangeRole:
    Type: 'AWS::IAM::Role'
    Properties:
      RoleName: 'GreengrassV2TokenExchangeRole'
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: 'Allow'
            Principal:
              Service: 'credentials.iot.amazonaws.com'
            Action: 'sts:AssumeRole'

  GreengrassV2TokenExchangeRoleAccessPolicy:
    Type: 'AWS::IAM::Policy'
    Properties:
      PolicyName: 'GreengrassV2TokenExchangeRoleAccess'
      PolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: 'Allow'
            Action:
              - 'logs:CreateLogGroup'
              - 'logs:CreateLogStream'
              - 'logs:PutLogEvents'
              - 'logs:DescribeLogStreams'
              - 's3:GetBucketLocation'
            Resource: '*'
      Roles:
        - Ref: 'GreengrassV2TokenExchangeRole'

  GreengrassCoreTokenExchangeRoleAlias:
    Type: 'AWS::IoT::RoleAlias'
    Properties:
      RoleAlias: 'GreengrassCoreTokenExchangeRoleAlias'
      RoleArn: !GetAtt GreengrassV2TokenExchangeRole.Arn

  GreengrassCoreTokenExchangeRoleAliasPolicy:
    Type: 'AWS::IoT::Policy'
    Properties:
      PolicyName: 'GreengrassCoreTokenExchangeRoleAliasPolicy'
      PolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: 'Allow'
            Action: 'iot:AssumeRoleWithCertificate'
            Resource: !Sub 'arn:aws:iot:${AWS::Region}:${AWS::AccountId}:rolealias/GreengrassCoreTokenExchangeRoleAlias'