aws_iot_heater_template.yaml

---
AWSTemplateFormatVersion: '2010-09-09'
Description: AWS IoT Smart Heater Template
Parameters:
  DeviceID:
    Description: ID of the device which represents a heater
    Type: String
    AllowedPattern: "[a-zA-Z0-9_/#+]*"
    MinLength: '1'
    MaxLength: '2048'
    ConstraintDescription: must contain only alphanumberic characters and underscores
  CognitoIdentityPoolName:
    Type: String
    Description: |
      The name for the Cognito Identity Pool. If not provided, it's generated
      after given DeviceID.
    Default: ''
  CognitoUserPoolName:
    Type: String
    Description: |
      The name for the Cognito User Pool. If not provided, it's generated
      after given DeviceID.
    Default: ''
  CognitoUserPoolClientName:
    Type: String
    Description: |
      The name for the Cognito User Pool. If not provided, it's generated
      after given DeviceID.
    Default: ''
  ReadCapacityUnits:
    Description: Provisioned read throughput
    Type: Number
    Default: '5'
    MinValue: '5'
    MaxValue: '10000'
    ConstraintDescription: must be between 5 and 10000
  WriteCapacityUnits:
    Description: Provisioned write throughput
    Type: Number
    Default: '10'
    MinValue: '5'
    MaxValue: '10000'
    ConstraintDescription: must be between 5 and 10000
  GoogleClientID:
    Description: Google OAuth2 Client ID
    Type: String
    Default: ''
  FacebookClientID:
    Description: Facebook OAuth2 Client ID
    Type: String
    Default: ''
  EndpointAddress:
    Description: |
      Endpoint address, can be fetched from the command line as follows:
      aws iot describe-endpoint
    Type: String
    MinLength: '1'
    MaxLength: '2048'

Conditions:
  EMPTY_CognitoIdentityPoolName:
    Fn::Equals:
    - Ref: CognitoIdentityPoolName
    - ''
  EMPTY_CognitoUserPoolName:
    Fn::Equals:
    - Ref: CognitoUserPoolName
    - ''
  EMPTY_CognitoUserPoolClientName:
    Fn::Equals:
    - Ref: CognitoUserPoolClientName
    - ''
  EMPTY_GoogleClientID:
    Fn::Equals:
    - Ref: GoogleClientID
    - ''
  EMPTY_FacebookClientID:
    Fn::Equals:
    - Ref: FacebookClientID
    - ''

Resources:
  # Helpers for manipulating objects in S3 bucket {{{
  ReferenceDB:
    Type: AWS::DynamoDB::Table
    Properties:
      AttributeDefinitions:
      - AttributeName: key
        AttributeType: S
      KeySchema:
      - AttributeName: key
        KeyType: HASH
      ProvisionedThroughput:
        ReadCapacityUnits: 1
        WriteCapacityUnits: 1
      TableName:
        Fn::Join:
        - "-"
        - - Ref: AWS::StackName
          - reference
  RoleBasePolicy:
    Type: AWS::IAM::ManagedPolicy
    Properties:
      Description:
        Fn::Join:
        - " "
        - - Base policy for all Lambda function roles in
          - Ref: AWS::StackName
          - "."
      PolicyDocument:
        Version: '2012-10-17'
        Statement:
        - Effect: Allow
          Action:
          - logs:CreateLogGroup
          - logs:CreateLogStream
          - logs:PutLogEvents
          Resource: arn:aws:logs:*:*:*
        - Effect: Allow
          Action:
          - dynamodb:GetItem
          - dynamodb:PutItem
          - dynamodb:Scan
          Resource:
            Fn::Join:
            - ''
            - - 'arn:aws:dynamodb:'
              - Ref: AWS::Region
              - ":"
              - Ref: AWS::AccountId
              - ":table/"
              - Ref: ReferenceDB
  S3PutObjectFunctionRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
        - Effect: Allow
          Principal:
            Service:
            - lambda.amazonaws.com
          Action:
          - sts:AssumeRole
      ManagedPolicyArns:
      - Ref: RoleBasePolicy
      Policies:
      - PolicyName: S3Writer
        PolicyDocument:
          Version: '2012-10-17'
          Statement:
          - Effect: Allow
            Action:
            - s3:DeleteObject
            - s3:ListBucket
            - s3:PutObject
            - s3:PutObjectAcl
            Resource: "*"
  S3PutObjectFunction:
    Type: AWS::Lambda::Function
    Properties:
      Code: helpers/cloudformation-helpers
      Description: Used to put objects into S3.
      Handler: aws/s3.putObject
      Role:
        Fn::GetAtt:
        - S3PutObjectFunctionRole
        - Arn
      Runtime: nodejs4.3
      Timeout: 30
    DependsOn:
    - S3PutObjectFunctionRole
  # }}}

  # Helpers for Cognito {{{
  CognitoFunctionRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          Effect: Allow
          Principal:
            Service: lambda.amazonaws.com
          Action: sts:AssumeRole
      Path: "/"
      Policies:
      - PolicyName: cognito-writer
        PolicyDocument:
          Version: '2012-10-17'
          Statement:
          - Effect: Allow
            Action:
            - logs:CreateLogGroup
            - logs:CreateLogStream
            - logs:PutLogEvents
            Resource: arn:aws:logs:*:*:*
          - Effect: Allow
            Action:
            - cognito-identity:CreateIdentityPool
            - cognito-identity:DeleteIdentityPool
            - cognito-identity:UpdateIdentityPool
            - cognito-identity:SetIdentityPoolRoles
            - cognito-idp:*
            Resource: "*"
          - Effect: Allow
            Action:
            - iam:PassRole
            Resource: "*"
  CognitoLambdaFunction:
    Type: AWS::Lambda::Function
    Properties:
      Code: helpers/cloudformation-helpers
      Description: Used to create Custom::CognitoIdentityPool and Custom::CognitoIdentityPoolRoles
      Handler: aws/cognito.handler
      MemorySize: 128
      Role:
        Fn::GetAtt:
        - CognitoFunctionRole
        - Arn
      Runtime: nodejs4.3
      Timeout: 30
    DependsOn:
    - S3PutObjectFunctionRole
  # }}}

  # S3 bucket and files in it {{{
  myS3Bucket:
    Type: AWS::S3::Bucket
    Properties:
      AccessControl: PublicRead
      WebsiteConfiguration:
        IndexDocument: index.html

  heaterVarsFile:
    Type: Custom::heaterVarsFile
    Properties:
      ServiceToken:
        Fn::GetAtt:
        - S3PutObjectFunction
        - Arn
      Bucket:
        Ref: myS3Bucket
      Key: vars.js
      Body:
        Fn::Join: ["\n", [
          "var heaterVars = {",
          {"Fn::Join": ["", ["  region: '", { "Ref": "AWS::Region" }, "',"]]},
          {"Fn::Join": ["", ["  tableName: '", { "Ref": "myDynamoDBTable" }, "',"]]},
          {"Fn::Join": ["", ["  anonUserAccessKeyId: '", { "Ref": "myAnonymousAccessUserAccessKey" }, "',"]]},
          {"Fn::Join": ["", ["  anonUserSecretAccessKey: '", { "Fn::GetAtt": ["myAnonymousAccessUserAccessKey", "SecretAccessKey"] }, "',"]]},
          {"Fn::Join": ["", ["  deviceId: '", { "Ref": "DeviceID" }, "',"]]},
          {"Fn::Join": ["", ["  identityPoolId: '", { "Ref": "CognitoIdentityPool" }, "',"]]},
          {"Fn::Join": ["", ["  accountId: '", { "Ref": "AWS::AccountId" }, "',"]]},
          {"Fn::Join": ["", ["  addIotPolicyLambdaName: '", { "Ref": "myAddIotPolicyLambdaFunction" }, "',"]]},
          {"Fn::Join": ["", ["  googleOAuthClientId: '", { "Ref": "GoogleClientID" }, "',"]]},
          {"Fn::Join": ["", ["  facebookOAuthClientId: '", { "Ref": "FacebookClientID" }, "',"]]},
          {"Fn::Join": ["", ["  endpointAddress: '", { "Ref": "EndpointAddress" }, "',"]]},
          "};",
          ""
        ]]
      ACL: public-read
  # }}}

  # dynamoDB table to save temperature {{{
  myDynamoDBTable:
    Type: AWS::DynamoDB::Table
    Properties:
      AttributeDefinitions:
      - AttributeName: deviceid
        AttributeType: S
      - AttributeName: timestamp
        AttributeType: S
      KeySchema:
      - AttributeName: deviceid
        KeyType: HASH
      - AttributeName: timestamp
        KeyType: RANGE
      ProvisionedThroughput:
        ReadCapacityUnits:
          Ref: ReadCapacityUnits
        WriteCapacityUnits:
          Ref: WriteCapacityUnits
  # }}}

  # Topic rule to save temperature in the dynamoDB table, and a role for it {{{
  myTopicRule:
    Type: AWS::IoT::TopicRule
    Properties:
      TopicRulePayload:
        RuleDisabled: 'false'
        Sql:
          Fn::Join: [ "", ["SELECT state.reported.temp FROM '$aws/things/", { "Ref": "DeviceID" }, "/shadow/update'"] ]
        Actions:
        - DynamoDB:
            TableName:
              Ref: myDynamoDBTable
            HashKeyField: deviceid
            HashKeyValue:
              Ref: DeviceID
            RangeKeyField: timestamp
            RangeKeyValue: "${timestamp()}"
            PayloadField: payload
            RoleArn:
              Fn::GetAtt:
              - myDynamoDBTableRolePutItem
              - Arn

  myDynamoDBTableRolePutItem:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
        - Effect: Allow
          Principal:
            Service:
            - iot.amazonaws.com
          Action:
          - sts:AssumeRole
      Path: "/"
      Policies:
      - PolicyName: allow-put-item
        PolicyDocument:
          Version: '2012-10-17'
          Statement:
          - Effect: Allow
            Action: dynamodb:PutItem
            Resource:
              Fn::Join:
              - ''
              - - 'arn:aws:dynamodb:'
                - Ref: AWS::Region
                - ":"
                - Ref: AWS::AccountId
                - ":table/"
                - Ref: myDynamoDBTable
          - Effect: Allow
            Action: "iot:*"
            Resource: "*"
  # }}}

  # User for anonymous access, and its access key {{{
  myAnonymousAccessUser:
    Type: AWS::IAM::User
    Properties:
      Policies:
      - PolicyName: allow-read
        PolicyDocument:
          Version: '2012-10-17'
          Statement:
          # The user can read dynamoDB table
          - Effect: Allow
            Action:
            - dynamodb:GetItem
            - dynamodb:BatchGetItem
            - dynamodb:Scan
            - dynamodb:Query
            Resource:
              Fn::Join:
              - ''
              - - 'arn:aws:dynamodb:'
                - Ref: AWS::Region
                - ":"
                - Ref: AWS::AccountId
                - ":table/"
                - Ref: myDynamoDBTable
          # The user can also call the Lambda which will attach IoT policy
          # to a user
          - Effect: Allow
            Action:
            - lambda:InvokeFunction
            Resource:
              Fn::GetAtt:
              - myAddIotPolicyLambdaFunction
              - Arn

  myAnonymousAccessUserAccessKey:
    Type: AWS::IAM::AccessKey
    Properties:
      UserName: { Ref: "myAnonymousAccessUser" }
  # }}}

  # Cognito {{{
  CognitoIdentityPool:
    Type: Custom::CognitoIdentityPool
    Properties:
      ServiceToken:
        Fn::GetAtt:
        - CognitoLambdaFunction
        - Arn
      Options:
        AllowUnauthenticatedIdentities: "true"
        IdentityPoolName:
          Fn::If:
          - EMPTY_CognitoIdentityPoolName
          - { "Fn::Join": ["", ["identity_pool_for_", {"Ref": "DeviceID"}]] }
          - Ref: CognitoIdentityPoolName
        SupportedLoginProviders:
          accounts.google.com:
            Fn::If:
            - EMPTY_GoogleClientID
            - Ref: AWS::NoValue
            - Ref: GoogleClientID
          graph.facebook.com:
            Fn::If:
            - EMPTY_FacebookClientID
            - Ref: AWS::NoValue
            - Ref: FacebookClientID

  CognitoIdentityPoolRoles:
    Type: Custom::CognitoIdentityPoolRoles
    Properties:
      ServiceToken:
        Fn::GetAtt:
        - CognitoLambdaFunction
        - Arn
      Options:
        IdentityPoolId:
          Fn::GetAtt:
          - CognitoIdentityPool
          - IdentityPoolId
        Roles:
          authenticated:
            Fn::GetAtt:
            - CognitoAuthenticatedRole
            - Arn
          unauthenticated:
            Fn::GetAtt:
            - CognitoUnauthenticatedRole
            - Arn

  CognitoUnauthenticatedRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
        - Effect: Allow
          Principal:
            Federated: cognito-identity.amazonaws.com
          Action: sts:AssumeRoleWithWebIdentity
          Condition:
            StringEquals:
              cognito-identity.amazonaws.com:aud:
                Fn::GetAtt:
                - CognitoIdentityPool
                - IdentityPoolId
            ForAnyValue:StringLike:
              cognito-identity.amazonaws.com:amr: unauthenticated
      Policies:
      - PolicyName: root
        PolicyDocument:
          Version: '2012-10-17'
          Statement:
          - Effect: Allow
            Action:
            - "iot:GetThingShadow"
            Resource:
              Fn::Join:
              - ''
              - - 'arn:aws:iot:'
                - Ref: AWS::Region
                - ":"
                - Ref: AWS::AccountId
                - ":thing/"
                - Ref: DeviceID

  CognitoAuthenticatedRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
        - Effect: Allow
          Principal:
            Federated: cognito-identity.amazonaws.com
          Action: sts:AssumeRoleWithWebIdentity
          Condition:
            StringEquals:
              cognito-identity.amazonaws.com:aud:
                Fn::GetAtt:
                - CognitoIdentityPool
                - IdentityPoolId
            ForAnyValue:StringLike:
              cognito-identity.amazonaws.com:amr: authenticated
      Policies:
      # This policy is equal to the one for unauthenticated users;
      # unfortunately we can't reuse the same policy for both authenticated
      # and unauthenticated users: it complains that the pool is misconfigured
      - PolicyName: root
        PolicyDocument:
          Version: '2012-10-17'
          Statement:
          - Effect: Allow
            Action:
            - "iot:GetThingShadow"
            Resource:
              Fn::Join:
              - ''
              - - 'arn:aws:iot:'
                - Ref: AWS::Region
                - ":"
                - Ref: AWS::AccountId
                - ":thing/"
                - Ref: DeviceID

  # Heater Admin role
  myHeaterAdminRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
        - Effect: Allow
          Principal:
            Federated: cognito-identity.amazonaws.com
          Action: sts:AssumeRoleWithWebIdentity
      Policies:
      - PolicyName: root
        PolicyDocument:
          Version: '2012-10-17'
          Statement:
          - Effect: Allow
            Action:
            - "iot:GetThingShadow"
            Resource:
              Fn::Join:
              - ''
              - - 'arn:aws:iot:'
                - Ref: AWS::Region
                - ":"
                - Ref: AWS::AccountId
                - ":thing/"
                - Ref: DeviceID
          - Effect: Allow
            Action:
            - "iot:UpdateThingShadow"
            Resource:
              Fn::Join:
              - ''
              - - 'arn:aws:iot:'
                - Ref: AWS::Region
                - ":"
                - Ref: AWS::AccountId
                - ":thing/"
                - Ref: DeviceID

  # }}}

  # Permissive IoT policy {{{
  # Permissive IoT policy, applied to all registered users
  myIotPolicy:
    Type: AWS::IoT::Policy
    Properties:
      PolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Action: "iot:*"
            Resource: "*"

  # Lambda function which attaches myIotPolicy to the given user. Every time
  # the user logs in, JS code in the browser calls this lambda, so that the
  # user can perform MQTT operations.
  myAddIotPolicyLambdaFunction:
    Type: AWS::Lambda::Function
    Properties:
      Code:
        ZipFile:
          Fn::Join:
          - "\n"
          - - "var AWS = require('aws-sdk');"
            - "exports.handler = (event, context, callback) => {"
            - "  var iot = new AWS.Iot();"
            - "  iot.attachPrincipalPolicy({"
            - {"Fn::Join": ["", ["policyName: '", { "Ref": "myIotPolicy" }, "',"]]}
            - "    principal: event.identityId,"
            - "  }, function(err, data) {"
            - "    if(err) {"
            - "      console.error('error', err);"
            - "      context.done(err);"
            - "    } else {"
            - "      console.info('ok', data);"
            - "      context.done(null, {status: 'ok'});"
            - "    }"
            - "  });"
            - "};"
      Handler: index.handler
      Runtime: nodejs4.3
      Role:
        Fn::GetAtt:
        - myAddIotPolicyLambdaFunctionRole
        - Arn

  myAddIotPolicyLambdaFunctionRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
        - Effect: Allow
          Principal:
            Service:
            - lambda.amazonaws.com
          Action:
          - sts:AssumeRole
      Policies:
      - PolicyName: root
        PolicyDocument:
          Version: '2012-10-17'
          Statement:
          - Effect: Allow
            Action:
            - iot:AttachPrincipalPolicy
            Resource: "*"
  # }}}

Outputs:
  S3BucketName:
    Value:
      Ref: myS3Bucket
    Description: Name of the newly created S3 bucket
  S3BucketWebsite:
    Value:
      Fn::Join:
      - ""
      - - "http://"
        - Ref: myS3Bucket
        - ".s3-website-"
        - Ref: AWS::Region
        - ".amazonaws.com"
    Description: URL of the s3 bucket
  TableName:
    Value:
      Ref: myDynamoDBTable
    Description: Table name of the newly created DynamoDB table
  RuleName:
    Value:
      Ref: myTopicRule
    Description: Name of the newly created topic rule