Merge pull request #250 from awslabs/v3

v3.0.0

Author: echo-bravo-yahoo

README.md

@@ -6,6 +6,7 @@ The Serverless Developer Portal is an application that you use for developer eng
 #### To deploy
 1. Enter a name for ArtifactsS3BucketName: this will create an Amazon S3 bucket with that name for storing the catalog metadata.
 1. Enter a name for DevPortalSiteS3BucketName: this will create an Amazon S3 bucket with that name for the web application code.
+1. Enter a unique prefix for CognitoDomainNameOrPrefix; this will be used in the sign in page's URL.
 1. You should leave all the other settings as-is unless you need to change them. For example, you can optionally enter a custom domain name in the CustomDomainName field.
 1. Acknowledge that the app uses custom roles by checking the box "I acknowledge that this app creates custom IAM roles."
 1. Choose Deploy.
@@ -16,14 +17,14 @@ The Serverless Developer Portal is an application that you use for developer eng
 1. Open the Outputs section. The URL for the developer portal is specified in the WebSiteURL property.
 
 #### Updating to a new version
-The Developer Portal follows the semantic versioning scheme (major.minor.patch). Changes to the minor or patch version are backwards compatible so you should feel safe to get the latest version.
+The Developer Portal follows the semantic versioning scheme (major.minor.patch). Changes to the minor or patch version are backwards compatible so you should feel safe to get the latest version. For changes to major versions, please see [this page on updating](https://github.com/awslabs/aws-api-gateway-developer-portal/wiki/Upgrading/_edit).
 
 To update:
-1. When deploying follow the same steps as previous and use the same values for the parameters. The only difference is passing in a new value for "-StaticAssetRebuildToken". You can use any string for this as long as it is different than previously used (default value is "defaultRebuildToken").
+1. When deploying follow the same steps as previous and use the same values for the parameters. The only difference is passing in a new value for the stack parameter StaticAssetRebuildToken. You can use any string for this as long as it is different than the previously used string.
 
 #### Next steps
 1. Publish an API on it for your customer to look at. Learn how to do that [here](https://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-developer-portal.html#apigateway-developer-portal-publish).
-1. Customize, own, and brand the portal. Learn how to do that [here](https://github.com/awslabs/aws-api-gateway-developer-portal#customization).
+1. Customize, own, and brand the portal. Learn how to do that [here](https://github.com/awslabs/aws-api-gateway-developer-portal/wiki/Customization).
 1. Setup a custom domain on it your customers recognize your brand and the associated APIs. Learn how to do that [here](https://github.com/awslabs/aws-api-gateway-developer-portal#before-going-to-production).
 
 To learn more about the API Gateway Serverless Developer Portal, read the [documentation](https://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-developer-portal.html) or visit the [GitHub repository](https://github.com/awslabs/aws-api-gateway-developer-portal). For more information about Amazon API Gateway, visit the API Gateway [product page](https://aws.amazon.com/api-gateway/).

README_SAR.md

@@ -87,8 +87,7 @@ Parameters:
 
   CognitoDomainNameOrPrefix:
     Type: String
-    Description: The Domain Name (or Prefix) at which your Cognito Hosted UI is located. Omitting this value opts out of the Cognito Hosted UI.
-    Default: ''
+    Description: The Domain Name (or Prefix) at which your Cognito Hosted UI is located. This should be regionally unique.
 
   # CognitoDomainAcmCertArn:
   #   Type: String
@@ -107,12 +106,12 @@ Parameters:
 
   UseRoute53Nameservers:
     Type: String
-    Description: Only applicable if creating a custom domain name for your dev portal. If true, skips creating a Route53 HostedZone and RecordSet. You'll need to provide your own nameserver hosting in place of Route53.
+    Description: Only applicable if creating a custom domain name for your dev portal. Defaults to false, and you'll need to provide your own nameserver hosting. If set to true, a Route53 HostedZone and RecordSet are created for you.
     Default: 'false'
 
   DevelopmentMode:
     Type: String
-    Description: Enabling this weakens security features (OAI, SSL, site S3 bucket with public read ACLs, Cognito callback verification, etc.) for easier development. Do not enable this in production! Additionally, do not update a stack that was previously in development mode to be a production stack; instead, make a new stack that has never been in development mode.
+    Description: Enabling this weakens security features (OAI, SSL, site S3 bucket with public read ACLs, Cognito callback verification, CORS, etc.) for easier development. Do not enable this in production! Additionally, do not update a stack that was previously in development mode to be a production stack; instead, make a new stack that has never been in development mode.
     Default: 'false'
 
 Conditions:
@@ -183,7 +182,11 @@ Resources:
                     responseParameters:
                       method.response.header.Access-Control-Allow-Methods: "'DELETE,GET,HEAD,OPTIONS,PATCH,POST,PUT'"
                       method.response.header.Access-Control-Allow-Headers: "'Content-Type,Authorization,X-Amz-Date,X-Api-Key,X-Amz-Security-Token'"
-                      method.response.header.Access-Control-Allow-Origin: "'*'"
+                      method.response.header.Access-Control-Allow-Origin: !If [ 'DevelopmentMode', "'*'", !If [
+                        'UseCustomDomainName',
+                        !Join ['', [ "'https://", !GetAtt CustomDomainCloudfrontDistribution.DomainName, "'" ]],
+                        !Join ['', [ "'https://", !GetAtt DefaultCloudfrontDistribution.DomainName, "'" ]]
+                      ]]
                 passthroughBehavior: when_no_match
                 requestTemplates:
                   application/json: "{\"statusCode\": 200}"
@@ -226,7 +229,11 @@ Resources:
                     responseParameters:
                       method.response.header.Access-Control-Allow-Methods: "'DELETE,GET,HEAD,OPTIONS,PATCH,POST,PUT'"
                       method.response.header.Access-Control-Allow-Headers: "'Content-Type,Authorization,X-Amz-Date,X-Api-Key,X-Amz-Security-Token'"
-                      method.response.header.Access-Control-Allow-Origin: "'*'"
+                      method.response.header.Access-Control-Allow-Origin: !If [ 'DevelopmentMode', "'*'", !If [
+                        'UseCustomDomainName',
+                        !Join ['', [ "'https://", !GetAtt CustomDomainCloudfrontDistribution.DomainName, "'" ]],
+                        !Join ['', [ "'https://", !GetAtt DefaultCloudfrontDistribution.DomainName, "'" ]]
+                      ]]
                 passthroughBehavior: when_no_match
                 requestTemplates:
                   application/json: "{\"statusCode\": 200}"
@@ -269,7 +276,11 @@ Resources:
                     responseParameters:
                       method.response.header.Access-Control-Allow-Methods: "'DELETE,GET,HEAD,OPTIONS,PATCH,POST,PUT'"
                       method.response.header.Access-Control-Allow-Headers: "'Content-Type,Authorization,X-Amz-Date,X-Api-Key,X-Amz-Security-Token'"
-                      method.response.header.Access-Control-Allow-Origin: "'*'"
+                      method.response.header.Access-Control-Allow-Origin: !If [ 'DevelopmentMode', "'*'", !If [
+                        'UseCustomDomainName',
+                        !Join ['', [ "'https://", !GetAtt CustomDomainCloudfrontDistribution.DomainName, "'" ]],
+                        !Join ['', [ "'https://", !GetAtt DefaultCloudfrontDistribution.DomainName, "'" ]]
+                      ]]
                 passthroughBehavior: when_no_match
                 requestTemplates:
                   application/json: "{\"statusCode\": 200}"
@@ -312,7 +323,11 @@ Resources:
                     responseParameters:
                       method.response.header.Access-Control-Allow-Methods: "'DELETE,GET,HEAD,OPTIONS,PATCH,POST,PUT'"
                       method.response.header.Access-Control-Allow-Headers: "'Content-Type,Authorization,X-Amz-Date,X-Api-Key,X-Amz-Security-Token'"
-                      method.response.header.Access-Control-Allow-Origin: "'*'"
+                      method.response.header.Access-Control-Allow-Origin: !If [ 'DevelopmentMode', "'*'", !If [
+                        'UseCustomDomainName',
+                        !Join ['', [ "'https://", !GetAtt CustomDomainCloudfrontDistribution.DomainName, "'" ]],
+                        !Join ['', [ "'https://", !GetAtt DefaultCloudfrontDistribution.DomainName, "'" ]]
+                      ]]
                 passthroughBehavior: when_no_match
                 requestTemplates:
                   application/json: "{\"statusCode\": 200}"
@@ -381,7 +396,11 @@ Resources:
                     responseParameters:
                       method.response.header.Access-Control-Allow-Methods: "'DELETE,GET,HEAD,OPTIONS,PATCH,POST,PUT'"
                       method.response.header.Access-Control-Allow-Headers: "'Content-Type,Authorization,X-Amz-Date,X-Api-Key,X-Amz-Security-Token'"
-                      method.response.header.Access-Control-Allow-Origin: "'*'"
+                      method.response.header.Access-Control-Allow-Origin: !If [ 'DevelopmentMode', "'*'", !If [
+                        'UseCustomDomainName',
+                        !Join ['', [ "'https://", !GetAtt CustomDomainCloudfrontDistribution.DomainName, "'" ]],
+                        !Join ['', [ "'https://", !GetAtt DefaultCloudfrontDistribution.DomainName, "'" ]]
+                      ]]
                 passthroughBehavior: when_no_match
                 requestTemplates:
                   application/json: "{\"statusCode\": 200}"
@@ -437,7 +456,11 @@ Resources:
                     responseParameters:
                       method.response.header.Access-Control-Allow-Methods: "'DELETE,GET,HEAD,OPTIONS,PATCH,POST,PUT'"
                       method.response.header.Access-Control-Allow-Headers: "'Content-Type,Authorization,X-Amz-Date,X-Api-Key,X-Amz-Security-Token'"
-                      method.response.header.Access-Control-Allow-Origin: "'*'"
+                      method.response.header.Access-Control-Allow-Origin: !If [ 'DevelopmentMode', "'*'", !If [
+                        'UseCustomDomainName',
+                        !Join ['', [ "'https://", !GetAtt CustomDomainCloudfrontDistribution.DomainName, "'" ]],
+                        !Join ['', [ "'https://", !GetAtt DefaultCloudfrontDistribution.DomainName, "'" ]]
+                      ]]
                 passthroughBehavior: when_no_match
                 requestTemplates:
                   application/json: "{\"statusCode\": 200}"
@@ -485,7 +508,11 @@ Resources:
                     responseParameters:
                       method.response.header.Access-Control-Allow-Methods: "'DELETE,GET,HEAD,OPTIONS,PATCH,POST,PUT'"
                       method.response.header.Access-Control-Allow-Headers: "'Content-Type,Authorization,X-Amz-Date,X-Api-Key,X-Amz-Security-Token'"
-                      method.response.header.Access-Control-Allow-Origin: "'*'"
+                      method.response.header.Access-Control-Allow-Origin: !If [ 'DevelopmentMode', "'*'", !If [
+                        'UseCustomDomainName',
+                        !Join ['', [ "'https://", !GetAtt CustomDomainCloudfrontDistribution.DomainName, "'" ]],
+                        !Join ['', [ "'https://", !GetAtt DefaultCloudfrontDistribution.DomainName, "'" ]]
+                      ]]
                 passthroughBehavior: when_no_match
                 requestTemplates:
                   application/json: "{\"statusCode\": 200}"
@@ -640,12 +667,23 @@ Resources:
           - Effect: Allow
             Action:
             - s3:GetObject
+            - s3:DeleteObject
             - s3:PutObject
             Resource: !Join
               - ''
               - - 'arn:aws:s3:::'
                 - !Ref ArtifactsS3BucketName
                 - '/*'
+          - Effect: Allow
+            Action:
+            - apigateway:GET
+            Resource: !Join
+              - ''
+              - - 'arn:aws:apigateway:'
+                - !Ref 'AWS::Region'
+                - '::/restapis/'
+                - !Ref ApiGatewayApi
+                - '/*/exports/*'
           - Effect: Allow
             Action:
             - aws-marketplace:ResolveCustomer
@@ -1009,9 +1047,13 @@ Resources:
 
   CognitoUserPoolClient:
     Type: AWS::Cognito::UserPoolClient
+    # It's really unintuitive, but changing any of the properties here will cause stack updates to deploy non-functionally.
+    # The CognitoUserPoolClientSettings custom resource runs after this resource and adds a bunch of fields.
+    # However, when this is updated and changes, the CUPCS custom resource doesn't re-run, and so a bunch of vital
+    # settings won't be set, e.g., CallbackURL.
     Properties:
       UserPoolId: !Ref CognitoUserPool
-      ClientName: 'CognitoUserPoolClient'
+      ClientName: CognitoIdentityPool
       GenerateSecret: false
       RefreshTokenValidity: 30
 
@@ -1068,16 +1110,16 @@ Resources:
       CallbackURL: !If [ DevelopmentMode,
         [
           'http://localhost:3000/login',
-          !Join [ '', [ 'http://', !GetAtt DevPortalSiteS3Bucket.RegionalDomainName ]]
+          !Join [ '', [ 'https://', !GetAtt DevPortalSiteS3Bucket.RegionalDomainName ]]
         ],
         [
           !Join [ '', [ 'https://', !If [ UseCustomDomainName, !Ref CustomDomainName, !GetAtt DefaultCloudfrontDistribution.DomainName ], '/login' ]]
         ]
       ]
       LogoutURL: !If [ DevelopmentMode,
         [
-          'http://localhost:3000/login',
-          !Join [ '', [ 'http://', !GetAtt DevPortalSiteS3Bucket.RegionalDomainName]]
+          'http://localhost:3000',
+          !Join [ '', [ 'https://', !GetAtt DevPortalSiteS3Bucket.RegionalDomainName]]
         ],
         [
           !Join [ '', [ 'https://', !If [ UseCustomDomainName, !Ref CustomDomainName, !GetAtt DefaultCloudfrontDistribution.DomainName ]]]
@@ -1327,7 +1369,7 @@ Resources:
           - !Join [ '', [ 'www.', !Ref CustomDomainName ] ]
         CustomErrorResponses:
           - ErrorCode: 403
-            ResponseCode: 200
+            ResponseCode: 403
             ResponsePagePath: '/index.html'
         DefaultCacheBehavior:
           ForwardedValues:
@@ -1356,7 +1398,7 @@ Resources:
       DistributionConfig:
         CustomErrorResponses:
           - ErrorCode: 403
-            ResponseCode: 200
+            ResponseCode: 403
             ResponsePagePath: '/index.html'
         DefaultCacheBehavior:
           ForwardedValues:
@@ -1410,7 +1452,7 @@ Resources:
 Outputs:
   WebsiteURL:
     Value: !If [ 'DevelopmentMode',
-      !Join [ '', [ !GetAtt DevPortalSiteS3Bucket.RegionalDomainName, '/index.html' ]],
+      !Join [ '', [ 'https://', !GetAtt DevPortalSiteS3Bucket.RegionalDomainName, '/index.html' ]],
       !If [
         'UseCustomDomainName',
         !Join [ '', [ 'https://', !GetAtt CustomDomainCloudfrontDistribution.DomainName ]],

cloudformation/template.yaml

@@ -1 +1,2 @@
-NODE_PATH=src/
+NODE_PATH=src/
+SKIP_PREFLIGHT_CHECK=true