cfn.yml

AWSTemplateFormatVersion: '2010-09-09'
Parameters:
  S3Bucket:
    Type: String
  S3Key:
    Type: String
  S3ObjectVersion:
    Type: String
  NewEmailTopic:
    Type: String
  MailBucket:
    Type: String
Resources:
  PkpassBucket:
    Type: AWS::S3::Bucket
    Properties:
      LifecycleConfiguration:
        Rules:
          - ExpirationInDays: 90
            Status: Enabled
  NewEmailLambda:
    Type: AWS::Lambda::Function
    Properties:
      Handler: src/stepTrigger.handler
      Runtime: nodejs6.10
      MemorySize: 256
      Timeout: 15
      Code:
        S3Bucket: !Ref S3Bucket
        S3Key: !Ref S3Key
        S3ObjectVersion: !Ref S3ObjectVersion
      Role: !GetAtt NewEmailRole.Arn
      Environment:
        Variables:
          STEP_MACHINE_ARN: !Ref StepFunction
  NewEmailSubscription:
    Type: AWS::SNS::Subscription
    Properties:
      Protocol: lambda
      TopicArn: !Ref NewEmailTopic
      Endpoint: !GetAtt NewEmailLambda.Arn
  NewEmailSnsPermission:
    Type: AWS::Lambda::Permission
    Properties:
      Action: lambda:InvokeFunction
      Principal: sns.amazonaws.com
      SourceArn: !Ref NewEmailTopic
      FunctionName: !GetAtt NewEmailLambda.Arn
  NewEmailRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Action: sts:AssumeRole
            Principal:
              Service: lambda.amazonaws.com
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole
      Policies:
        - PolicyName: AllowStepExecution
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Effect: Allow
                Action: states:StartExecution
                Resource: "*"
  EmailSourceIdentifierLambda:
    Type: AWS::Lambda::Function
    Properties:
      Handler: src/emailSourceIdentifier.handler
      Runtime: nodejs6.10
      MemorySize: 256
      Timeout: 15
      Code:
        S3Bucket: !Ref S3Bucket
        S3Key: !Ref S3Key
        S3ObjectVersion: !Ref S3ObjectVersion
      Role: !GetAtt EmailSourceIdentifierRole.Arn
  EmailSourceIdentifierRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Action: sts:AssumeRole
            Principal:
              Service: lambda.amazonaws.com
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole
      Policies:
        - PolicyName: AllowMailRetrieval
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Effect: Allow
                Action: s3:GetObject
                Resource: !Sub arn:aws:s3:::${MailBucket}/*
  VillageLambda:
    Type: AWS::Lambda::Function
    Properties:
      Handler: src/cinemas.village
      Runtime: nodejs6.10
      MemorySize: 256
      Timeout: 15
      Code:
        S3Bucket: !Ref S3Bucket
        S3Key: !Ref S3Key
        S3ObjectVersion: !Ref S3ObjectVersion
      Role: !GetAtt CinemaRole.Arn
  HoytsLambda:
    Type: AWS::Lambda::Function
    Properties:
      Handler: src/cinemas.hoyts
      Runtime: nodejs6.10
      MemorySize: 256
      Timeout: 15
      Code:
        S3Bucket: !Ref S3Bucket
        S3Key: !Ref S3Key
        S3ObjectVersion: !Ref S3ObjectVersion
      Role: !GetAtt CinemaRole.Arn
  CinemaRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Action: sts:AssumeRole
            Principal:
              Service: lambda.amazonaws.com
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole
      Policies:
        - PolicyName: AllowMailRetrieval
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Effect: Allow
                Action: s3:GetObject
                Resource: !Sub arn:aws:s3:::${MailBucket}/*
  PkpassLambda:
    Type: AWS::Lambda::Function
    Properties:
      Handler: src/pkpass.handler
      Runtime: nodejs6.10
      MemorySize: 256
      Timeout: 60
      Environment:
        Variables:
          OUTPUT_BUCKET: !Ref PkpassBucket
      Code:
        S3Bucket: !Ref S3Bucket
        S3Key: !Ref S3Key
        S3ObjectVersion: !Ref S3ObjectVersion
      Role: !GetAtt PkpassRole.Arn
  PkpassRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Action: sts:AssumeRole
            Principal:
              Service: lambda.amazonaws.com
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole
      Policies:
        - PolicyName: AllowS3Put
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Effect: Allow
                Action: s3:PutObject
                Resource: !Sub arn:aws:s3:::${PkpassBucket}/*
  SendReplyLambda:
    Type: AWS::Lambda::Function
    Properties:
      Handler: src/sendReply.handler
      Runtime: nodejs6.10
      MemorySize: 256
      Timeout: 15
      Code:
        S3Bucket: !Ref S3Bucket
        S3Key: !Ref S3Key
        S3ObjectVersion: !Ref S3ObjectVersion
      Role: !GetAtt SendReplyRole.Arn
  SendReplyRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Action: sts:AssumeRole
            Principal:
              Service: lambda.amazonaws.com
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole
      Policies:
        - PolicyName: AllowMailSending
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Effect: Allow
                Action: ses:SendRawEmail
                Resource: "*"
        - PolicyName: AllowS3Get
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Effect: Allow
                Action: s3:GetObject
                Resource: !Sub arn:aws:s3:::${PkpassBucket}/*
  StepFunction:
    Type: AWS::StepFunctions::StateMachine
    Properties:
      RoleArn: !GetAtt StepFunctionRole.Arn
      DefinitionString: !Sub |
          {
            "Comment": "A test step func",
            "StartAt": "EmailSourceIdentifier",
            "States": {
              "EmailSourceIdentifier": {
                "Type": "Task",
                "Resource": "${EmailSourceIdentifierLambda.Arn}",
                "Next": "EmailSourceChoice"
              },
              "EmailSourceChoice": {
                "Type": "Choice",
                "Choices": [
                  {
                    "Variable": "$.Source",
                    "StringEquals": "Village",
                    "Next": "Village"
                  },
                  {
                    "Variable": "$.Source",
                    "StringEquals": "Hoyts",
                    "Next": "Hoyts"
                  }
                ],
                "Default": "UnknownSource"
              },
              "UnknownSource": {
                "Type": "Fail",
                "Cause": "Unrecognised email"
              },
              "Village": {
                "Type": "Task",
                "Resource": "${VillageLambda.Arn}",
                "Next": "Pkpass"
              },
              "Hoyts": {
                "Type": "Task",
                "Resource": "${HoytsLambda.Arn}",
                "Next": "Pkpass"
              },
              "Pkpass": {
                "Type": "Task",
                "Resource": "${PkpassLambda.Arn}",
                "Next": "SendReply"
              },
              "SendReply": {
                "Type": "Task",
                "Resource": "${SendReplyLambda.Arn}",
                "End": true
              }
            }
          }   
  StepFunctionRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Principal:
              Service: !Sub states.${AWS::Region}.amazonaws.com
            Action: sts:AssumeRole
      Policies:
        - PolicyName: StatesExecutionPolicy
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Effect: Allow
                Action: lambda:InvokeFunction
                Resource: "*"