Triển Khai Cognito Và S3 Bucket

  Which template source would you like to use?
	  1 - AWS Quick Start Templates
	  2 - Custom Template Location
  Choice: 1

  Choose an AWS Quick Start application template
	  1 - Hello World Example
	  2 - Multi-step workflow
	  3 - Serverless API
	  4 - Scheduled task
	  5 - Standalone function
	  6 - Data processing
	  7 - Infrastructure event management
	  8 - Machine Learning
  Template: 1

  Use the most popular runtime and package type? (Python and zip) [y/N]: y
  Would you like to enable X-Ray tracing on the function(s) in your application?  [y/N]: n
  Project name [sam-app] : fcjdmssam

  # Creates a user pool in cognito for your app to auth against
  FcjDMSUserPool:
    Type: AWS::Cognito::UserPool
    Properties:
      UserPoolName: "cognito-fcj-dms"
      MfaConfiguration: "OFF"
      AliasAttributes:
        - preferred_username
        - email
      AutoVerifiedAttributes: 
        - email
      EmailConfiguration:
        EmailSendingAccount: COGNITO_DEFAULT
      Policies:
        PasswordPolicy:
          MinimumLength: 8
          RequireLowercase: true
          RequireNumbers: true
          RequireSymbols: false
          RequireUppercase: true
          TemporaryPasswordValidityDays: 30
      UserAttributeUpdateSettings:
        AttributesRequireVerificationBeforeUpdate:
          - email
          
  # Creates a User Pool Client to be used by the identity pool
  FcjDMSUserPoolClient:
    Type: AWS::Cognito::UserPoolClient
    Properties:
      ClientName: "fcj-dms"
      UserPoolId: !Ref FcjDMSUserPool
      GenerateSecret: false
      ExplicitAuthFlows:
        - ALLOW_USER_PASSWORD_AUTH
        - ALLOW_CUSTOM_AUTH
        - ALLOW_USER_SRP_AUTH
        - ALLOW_REFRESH_TOKEN_AUTH
  
  # Creates a federeated Identity pool
  FcjDMSUserPoolIdentityPool:
    Type: "AWS::Cognito::IdentityPool"
    Properties:
      IdentityPoolName: "fcj-dms-identity"
      AllowUnauthenticatedIdentities: true
      CognitoIdentityProviders: 
        - ClientId: !Ref FcjDMSUserPoolClient
          ProviderName: !GetAtt FcjDMSUserPool.ProviderName

Parameters:
  DocumentStoreBucketName:
    Type: String
    Default: fcjdmsstore

  FcjDMSStore:
    Type: AWS::S3::Bucket
    Properties:
      BucketName: !Ref DocumentStoreBucketName
      CorsConfiguration:
        CorsRules:
          - AllowedHeaders:
              - '*'
            AllowedMethods:
              - GET
              - HEAD
              - PUT
              - POST
              - DELETE
            AllowedOrigins:
               - '*'
            ExposedHeaders:
              - x-amz-server-side-encryption
              - x-amz-request-id
              - x-amz-id-2
              - ETag
            MaxAge: 1800

  # Create a role for unauthorized access to AWS resources. Very limited access. Only allows users in the previously created
  CognitoUnAuthorizedRole:
    Type: "AWS::IAM::Role"
    Properties:
      AssumeRolePolicyDocument: 
        Version: "2012-10-17"
        Statement:
          - Effect: "Allow"
            Principal: 
              Federated: "cognito-identity.amazonaws.com"
            Action: 
              - "sts:AssumeRoleWithWebIdentity"
            Condition:
              StringEquals: 
                "cognito-identity.amazonaws.com:aud": !Ref FcjDMSUserPoolIdentityPool
              "ForAnyValue:StringLike":
                "cognito-identity.amazonaws.com:amr": unauthenticated
      Policies:
        - PolicyName: "CognitoUnauthorizedPolicy"
          PolicyDocument: 
            Version: "2012-10-17"
            Statement: 
              - Effect: "Allow"
                Action:
                  - "mobileanalytics:PutEvents"
                  - "cognito-sync:*"
                Resource: "*"
              - Effect: "Allow"
                Action:
                  - "s3:GetObject"
                Resource: !Join
                  - ""
                  - - "arn:aws:s3:::"
                    - !Ref DocumentStoreBucketName
                    - /protected/*
  
  # Create a role for authorized access to AWS resources. Control what your user can access. This example only allows Lambda invokation
  # Only allows users in the previously created Identity Pool
  CognitoAuthorizedRole:
    Type: "AWS::IAM::Role"
    Properties:
      AssumeRolePolicyDocument: 
        Version: "2012-10-17"
        Statement:
          - Effect: "Allow"
            Principal: 
              Federated: "cognito-identity.amazonaws.com"
            Action: 
              - "sts:AssumeRoleWithWebIdentity"
            Condition:
              StringEquals: 
                "cognito-identity.amazonaws.com:aud": !Ref FcjDMSUserPoolIdentityPool
              "ForAnyValue:StringLike":
                "cognito-identity.amazonaws.com:amr": authenticated
      Policies:
        - PolicyName: "CognitoAuthorizedPolicy"
          PolicyDocument: 
            Version: "2012-10-17"
            Statement: 
              - Effect: "Allow"
                Action:
                  - "mobileanalytics:PutEvents"
                  - "cognito-sync:*"
                  - "cognito-identity:*"
                Resource: "*"
              - Effect: "Allow"
                Action:
                  - "lambda:InvokeFunction"
                  - "s3:GetObject"
                  - "s3:PutObject"
                  - "s3:DeleteObject"
                Resource: '*'
              - Effect: "Allow"
                Action:
                  - "s3:GetObject"
                Resource: !Join
                  - ""
                  - - "arn:aws:s3:::"
                    - !Ref DocumentStoreBucketName
                    - /protected/*
  
  # Assigns the roles to the Identity Pool
  IdentityPoolRoleMapping:
    Type: "AWS::Cognito::IdentityPoolRoleAttachment"
    Properties:
      IdentityPoolId: !Ref FcjDMSUserPoolIdentityPool
      Roles:
        authenticated: !GetAtt CognitoAuthorizedRole.Arn
        unauthenticated: !GetAtt CognitoUnAuthorizedRole.Arn