AWS Cloud Formation template to create a simple read model using AWS Api Gateway & S3

create-read-model-api.json

{
    "AWSTemplateFormatVersion": "2010-09-09",
    "Description": "Produces the simple Read Model API.  Includes S3 storage for static data, a user for accessing and an API",
    "Parameters": {
        "StackName": {
            "Type": "String",
            "Description": "Name to be used for the Stack and all associated items.  Should be unique."
        }
    },
    "Resources": {
        "DataStore": {
            "Type": "AWS::S3::Bucket",
            "Properties": {
                "BucketName": {
                    "Fn::Join": [
                        "",
                        [
                            {
                                "Ref": "StackName"
                            },
                            "-data-store"
                        ]
                    ]
                }
            }
        },
        "DataStoreWriter": {
            "Type": "AWS::IAM::User",
            "Properties": {
                "UserName": {
                    "Fn::Join": [
                        "",
                        [
                            {
                                "Ref": "StackName"
                            },
                            "-data-store-writer"
                        ]
                    ]
                },
                "Policies": [
                    {
                        "PolicyName": {
                            "Fn::Join": [
                                "",
                                [
                                    {
                                        "Ref": "StackName"
                                    },
                                    "-data-store-writer"
                                ]
                            ]
                        },
                        "PolicyDocument": {
                            "Version": "2012-10-17",
                            "Statement": [
                                {
                                    "Effect": "Allow",
                                    "Action": [
                                        "s3:*"
                                    ],
                                    "Resource": {
                                        "Fn::Join": [
                                            "",
                                            [
                                                {
                                                    "Fn::GetAtt": [
                                                        "DataStore",
                                                        "Arn"
                                                    ]
                                                },
                                                "/*"
                                            ]
                                        ]
                                    }
                                }
                            ]
                        }
                    }
                ]
            }
        },
        "DataStoreWriterAccessKey": {
            "Type": "AWS::IAM::AccessKey",
            "DependsOn": "DataStoreWriter",
            "Properties": {
                "Serial": 1,
                "Status": "Active",
                "UserName": {
                    "Fn::Join": [
                        "",
                        [
                            {
                                "Ref": "StackName"
                            },
                            "-data-store-writer"
                        ]
                    ]
                }
            }
        },
        "ApiGatewayRole": {
            "Type": "AWS::IAM::Role",
            "Properties": {
                "RoleName": {
                    "Fn::Join": [
                        "",
                        [
                            {
                                "Ref": "StackName"
                            },
                            "-api-gateway-role"
                        ]
                    ]
                },
                "AssumeRolePolicyDocument": {
                    "Statement": [
                        {
                            "Sid": "",
                            "Effect": "Allow",
                            "Principal": {
                                "Service": "apigateway.amazonaws.com"
                            },
                            "Action": "sts:AssumeRole"
                        }
                    ]
                }
            }
        },
        "ApiGatewayDataStorePolicy": {
            "Type": "AWS::IAM::Policy",
            "Properties": {
                "PolicyName": {
                    "Fn::Join": [
                        "",
                        [
                            {
                                "Ref": "StackName"
                            },
                            "-data-store-read-only"
                        ]
                    ]
                },
                "PolicyDocument": {
                    "Statement": [
                        {
                            "Effect": "Allow",
                            "Action": [
                                "s3:Get*"
                            ],
                            "Resource": {
                                "Fn::Join": [
                                    "",
                                    [
                                        {
                                            "Fn::GetAtt": [
                                                "DataStore",
                                                "Arn"
                                            ]
                                        },
                                        "/*"
                                    ]
                                ]
                            }
                        }
                    ]
                },
                "Roles": [
                    {
                        "Ref": "ApiGatewayRole"
                    }
                ]
            }
        },
        "ApiGateway": {
            "Type": "AWS::ApiGateway::RestApi",
            "Properties": {
                "Name": {
                    "Fn::Join": [
                        "",
                        [
                            {
                                "Ref": "StackName"
                            },
                            " Api"
                        ]
                    ]
                },
                "Description": "A simple Read Model example using S3",
                "FailOnWarnings": true
            }
        },
        "SampleResource": {
            "Type": "AWS::ApiGateway::Resource",
            "Properties": {
                "RestApiId": {
                    "Ref": "ApiGateway"
                },
                "ParentId": {
                    "Fn::GetAtt": [
                        "ApiGateway",
                        "RootResourceId"
                    ]
                },
                "PathPart": "samples"
            }
        },
        "SamplesGetMethod": {
            "Type": "AWS::ApiGateway::Method",
            "Properties": {
                "AuthorizationType": "NONE",
                "HttpMethod": "GET",
                "Integration": {
                    "Type": "AWS",
                    "IntegrationHttpMethod": "GET",
                    "IntegrationResponses": [
                        {
                            "StatusCode": "200",
                            "SelectionPattern": "200"
                        }
                    ],
                    "Uri": {
                        "Fn::Join": [
                            "/",
                            [
                                "arn:aws:apigateway:eu-west-1:s3:path",
                                {
                                    "Fn::Join": [
                                        "",
                                        [
                                            {
                                                "Ref": "StackName"
                                            },
                                            "-data-store"
                                        ]
                                    ]
                                },
                                "payload.json"
                            ]
                        ]
                    },
                    "Credentials": {
                        "Fn::GetAtt": [
                            "ApiGatewayRole",
                            "Arn"
                        ]
                    },
                    "PassthroughBehavior": "WHEN_NO_MATCH"
                },
                "ResourceId": {
                    "Ref": "SampleResource"
                },
                "RestApiId": {
                    "Ref": "ApiGateway"
                },
                "MethodResponses": [
                    {
                        "StatusCode": 200
                    }
                ]
            }
        },
        "ApiGatewayDeployment": {
            "Type": "AWS::ApiGateway::Deployment",
            "DependsOn": "SamplesGetMethod",
            "Properties": {
                "RestApiId": {
                    "Ref": "ApiGateway"
                },
                "Description": "Initial Deployment",
                "StageName": "v1"
            }
        }
    },
    "Outputs": {
        "SamplesUrl": {
            "Description": "Url to access the Samples data",
            "Value": {
                "Fn::Join": [
                    "",
                    [
                        "https://",
                        {
                            "Ref": "ApiGateway"
                        },
                        ".execute-api.eu-west-1.amazonaws.com/v1/samples"
                    ]
                ]
            }
        },
        "S3BucketName": {
            "Description": "Name of S3 bucket created",
            "Value": {
                "Fn::Join": [
                    "",
                    [
                        {
                            "Ref": "StackName"
                        },
                        "-data-store"
                    ]
                ]
            }
        },
        "DataStoreAccessKeyId": {
            "Description": "Access Key Id for the Data Store (S3)",
            "Value": {
                "Ref": "DataStoreWriterAccessKey"
            }
        },
        "DataStoreSecretAccessKey": {
            "Description": "Secret Access Key for the Data Store (S3)",
            "Value": {
                "Fn::GetAtt": [
                    "DataStoreWriterAccessKey",
                    "SecretAccessKey"
                ]
            }
        },
        "DataStoreUser": {
            "Description": "User to upload to the Data Store (S3)",
            "Value": {
                "Fn::Join": [
                    "",
                    [
                        {
                            "Ref": "StackName"
                        },
                        "-data-store-writer"
                    ]
                ]
            }
        }
    }
}