iot-provisioning-secretfree/template.yaml at master · aws-iot-builder-tools/iot-provisioning-secretfree · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
AWSTemplateFormatVersion: 2010-09-09
Transform: AWS::Serverless-2016-10-31
Description: >-
  AWS CloudFormation template for secretfree provisioning
Parameters:
  TemplateBucket:
    Default: elberger-secretfree-template
    Description: >-
      The S3 bucket into which the template, lambda functions, and Web
      content have been uploaded.
    Type: String
  SkuName:
    Default: widgiot
    Description: >-
      Usually the shortened product name, uniquely representing a
      product line. This is done to keep multiple product capabilities
      and certificate issuance separate from one another.
    Type: String
  AcmPcaCaArn:
    Default: put-your-arn-here
    Description: >-
      The CA Arn for ACM PCA CA.  Note that this value is not
      validated and is applied to the lambda function environment.
    Type: String
  CertValidityDays:
    Default: '180'
    Description: >-
      ACM PCA cert generation: certificate validity in days.
    Type: Number
  SigningAlgorithm:
    Default: SHA256WITHRSA
    Description: >-
      Valid ACM PCA signing algorithm used in vending the certificate.
    Type: String

Outputs:
  ProvisioningTableArn:
    Description: >-
      The ARN for the provisioning DynamoDB table.
    Value: !GetAtt ProvisioningTable.Arn
    Export:
      Name: !Sub "${AWS::StackName}-ProvisioningTableArn"
  ProvisioningTableStream:
    Description: >-
      The Stream ARN for the provisioning DynamoDB table.
    Value: !GetAtt ProvisioningTable.StreamArn
    Export:
      Name: !Sub "${AWS::StackName}-ProvisioningTableStream"
  ProvisioningTableName:
    Description: >-
      The simple name for the provisioning DynamoDB table.
    Value: !Ref ProvisioningTable
    Export:
      Name: !Sub "${AWS::StackName}-ProvisioningTableName"

Resources:
  PerSkuLambdaAuthorizer:
    Type: AWS::Serverless::Function
    Properties:
      FunctionName: !Sub ${SkuName}-secretfree-authorizer
      CodeUri: src/authorizer
      Handler: main.lambda_handler
      Runtime: python3.13
      MemorySize: 1024
      Environment:
        Variables:
          SECRETFREE_TABLENAME: !Ref ProvisioningTable

  PerSkuLambdaProvisioningACMPCA:
    Type: AWS::Serverless::Function
    Properties:
      FunctionName: !Sub ${SkuName}-secretfree-acmpca
      CodeUri: src/issuer_acmpca
      Handler: main.lambda_handler
      Runtime: python3.13
      MemorySize: 1024
      Environment:
        Variables:
          ACMPCA_CA_ARN: !Ref AcmPcaCaArn
          SKUNAME: !Ref SkuName
          CERT_VALIDITY_DAYS: !Ref CertValidityDays
          CERT_SIGNING_ALGO: !Ref SigningAlgorithm

  PerSkuLambdaProvisioningIotCore:
    Type: AWS::Serverless::Function
    Properties:
      FunctionName: secretfree-iotcore
      CodeUri: src/issuer-iotcore
      Handler: main.lambda_handler
      Runtime: python3.13
      MemorySize: 1024
      Environment:
        Variables:
          SKUNAME: !Ref SkuName

  ProvisioningTable:
    Type: AWS::DynamoDB::Table
    Properties:
      AttributeDefinitions:
        -
          AttributeName: "device-id"
          AttributeType: "S"
      BillingMode: PAY_PER_REQUEST
      KeySchema:
        -
          AttributeName: "device-id"
          KeyType: "HASH"
      TableName: !Sub ${SkuName}-iot-provisioning-secretfree
      StreamSpecification:
        StreamViewType: NEW_AND_OLD_IMAGES

  SecretfreeApi:
    Type: AWS::Serverless::Api
    Properties:
      DefinitionUri: ./api-definition.yaml
      StageName: dev

  ApiToAuthorizer:
    Type: AWS::Serverless::Connector
    Properties:
      Source:
        Id: SecretfreeApi
      Destination:
        Id: PerSkuLambdaAuthorizer
      Permissions:
        - Write

  ApiToIotcHandler:
    Type: AWS::Serverless::Connector
    Properties:
      Source:
        Id: SecretfreeApi
      Destination:
        Id: PerSkuLambdaProvisioningIotCore
      Permissions:
        - Write

  ApiToAcmpcaHandler:
    Type: AWS::Serverless::Connector
    Properties:
      Source:
        Id: SecretfreeApi
      Destination:
        Id: PerSkuLambdaProvisioningACMPCA
      Permissions:
        - Write