quickstart-aws-acm-certificate.template.yml

---
AWSTemplateFormatVersion: '2010-09-09'
Description: "(qs-1qu5sufei) Creates R53 records and ACM Certificate."
Metadata:
  AWS::CloudFormation::Interface:
    ParameterGroups:
    - Label:
        default: DNS Configuration
      Parameters:
      - DomainName
      - HostedZoneID
    - Label:
        default: AWS Quick Start Configuration
      Parameters:
      - QSS3BucketName
      - QSS3BucketRegion
      - QSS3KeyPrefix
    ParameterLabels:
      QSS3KeyPrefix:
        default: Quick Start S3 Key Prefix
      QSS3BucketName:
        default: Quick Start S3 Bucket Name
      QSS3BucketRegion:
        default: Quick Start S3 Bucket Region
      DomainName:
        default: Domain Name
      HostedZoneID:
        default: Route 53 Hosted Zone ID
Parameters:
  # Quick Start Configuration  
  QSS3BucketName:
    AllowedPattern: '^[0-9a-zA-Z]+([0-9a-zA-Z-]*[0-9a-zA-Z])*$'
    ConstraintDescription:
      Quick Start bucket name can include numbers, lowercase
      letters, uppercase letters, and hyphens (-). It cannot start or end with a hyphen
      (-).
    Default: aws-quickstart
    Description:
      S3 bucket name for the Quick Start assets. Quick Start bucket name
      can include numbers, lowercase letters, uppercase letters, and hyphens (-).
      It cannot start or end with a hyphen (-).
    Type: String
  QSS3BucketRegion:
    Default: 'us-east-1'
    Description: 'The AWS Region where the Quick Start S3 bucket (QSS3BucketName) is hosted. When using your own bucket, you must specify this value.'
    Type: String
  QSS3KeyPrefix:
    AllowedPattern: '^[0-9a-zA-Z-/]*$'
    ConstraintDescription:
      Quick Start key prefix can include numbers, lowercase letters,
      uppercase letters, hyphens (-), and forward slash (/).
    Default: quickstart-aws-acm-certificate/
    Description:
      S3 key prefix for the Quick Start assets. Quick Start key prefix
      can include numbers, lowercase letters, uppercase letters, hyphens (-), and
      forward slash (/).
    Type: String
  HostedZoneID:
    Description: 'OPTIONAL: Route 53 Hosted Zone ID to use. If left blank, Route 53
      will not be configured and DNS must be setup manually. If you specify this,
      you must also specify DomainName'
    Type: String
    MaxLength: '32'
    Default: ''
  DomainName:
    Description: 'OPTIONAL: Domain Name configured for the cluster. If left blank,
      DNS must be configured manually, and an existing certificate must be used.'
    Type: String
    Default: ''
Conditions:
  UsingDefaultBucket: !Equals [!Ref QSS3BucketName, 'aws-quickstart']
  SetupRoute53:
    Fn::And:
    - Fn::Not:
      - Fn::Equals:
        - Ref: HostedZoneID
        - ''
    - Fn::Not:
      - Fn::Equals:
        - Ref: DomainName
        - ''
  UseEmailForACMValidation:
    Fn::And:
    - Fn::Equals:
      - Ref: HostedZoneID
      - ''
    - Fn::Not:
      - Fn::Equals:
        - Ref: DomainName
        - ''
  IsSubmodule:
    Fn::Not:
    - Fn::Equals:
        - Ref: QSS3KeyPrefix
        - quickstart-aws-acm-certificate/
Resources:
  # So we can copy the ACM lambda everywhere
  CopyZips:
    Metadata:
      cfn-lint:
        config:
          ignore_checks:
          - W9198
    Type: AWS::CloudFormation::Stack
    Properties:
      TemplateURL:
        !Sub
          - 'https://${S3Bucket}.s3.${S3Region}.${AWS::URLSuffix}/${QSS3KeyPrefix}submodules/lambda-copyzips/templates/copy-zips.template.yaml'
          - S3Region: !If [UsingDefaultBucket, !Ref 'AWS::Region', !Ref QSS3BucketRegion]
            S3Bucket: !If [UsingDefaultBucket, !Sub '${QSS3BucketName}-${AWS::Region}', !Ref QSS3BucketName]
      Parameters:
        QSS3BucketName: !Ref QSS3BucketName
        QSS3BucketRegion: !Ref QSS3BucketRegion
        QSS3KeyPrefix: !Ref QSS3KeyPrefix
        SourceObjects: "functions/packages/ACMCert/lambda.zip"
  ACMCertificateRole:
    Condition: SetupRoute53
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
        - Effect: Allow
          Principal:
            Service: lambda.amazonaws.com
          Action: sts:AssumeRole
      ManagedPolicyArns:
        - !Sub arn:${AWS::Partition}:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole
      Path: "/"
      Policies:
      - PolicyName: lambda-acm
        PolicyDocument:
          Version: '2012-10-17'
          Statement:
          - Effect: Allow
            Action:
            - acm:RequestCertificate
            - acm:DescribeCertificate
            - acm:DeleteCertificate
            Resource:
            - "*"
          - Effect: Allow
            Action:
            - lambda:InvokeFunction
            Resource:
            - "*"
          - Effect: Allow
            Action:
            - route53:ChangeResourceRecordSets
            Resource:
              - Fn::Sub: arn:${AWS::Partition}:route53:::hostedzone/${HostedZoneID}
          - Effect: Allow
            Action:
            - logs:FilterLogEvents
            Resource:
            - "*"
  ACMCertificateLambda:
    Condition: SetupRoute53
    Type: AWS::Lambda::Function
    Properties:
      Description: Creates and verifies an ACM certificate using DNS validation and
        route53
      Handler: lambda_function.handler
      Runtime: python2.7
      Role:
        Fn::GetAtt:
        - ACMCertificateRole
        - Arn
      Timeout: 900
      Code:
        S3Bucket: !GetAtt "CopyZips.Outputs.LambdaZipsBucket"
        S3Key: !Sub "${QSS3KeyPrefix}functions/packages/ACMCert/lambda.zip"
  ACMCertificateDNS:
    Condition: SetupRoute53
    Type: AWS::CloudFormation::CustomResource
    Properties:
      ServiceToken:
        Fn::GetAtt:
        - ACMCertificateLambda
        - Arn
      HostedZoneId:
        Ref: HostedZoneID
      HostNames:
      - Ref: DomainName
      - Fn::Join:
        - ''
        - - "*."
          - Ref: DomainName
  ACMCertificateEmail:
    Condition: UseEmailForACMValidation
    Type: AWS::CertificateManager::Certificate
    Properties:
      DomainName:
        Ref: DomainName
      SubjectAlternativeNames:
      - Fn::Join:
        - ''
        - - "*."
          - Ref: DomainName
      DomainValidationOptions:
      - DomainName:
          Ref: DomainName
        ValidationDomain:
          Ref: DomainName
Outputs:
  ACMCertificate:
    Description: ARN of the ACM-Generated SSL Certificate
    Value:
      Fn::If:
      - SetupRoute53
      - Fn::GetAtt:
        - ACMCertificateDNS
        - Arn
      - Ref: ACMCertificateEmail