HttpApiCorsCf

Description: Web Application lambdas
Transform: AWS::Serverless-2016-10-31
AWSTemplateFormatVersion: '2010-09-09'
Parameters:
  Version:
    Description: Version of this template
    Type: String
  EnvName:
    Description: An environment name that is prefixed to resource names
    Type: String
    Default: dev
  BasePath:
    Description: Basepath where apis are served
    Type: String
    Default: path

Mappings:
  EnvMap:
    dev:
      ApiDomain: api.dev.example.com
      CorsDomain: 'https://app.dev.example.com'
    prd:
      ApiDomain: api.example.com
      CorsDomain: 'https://app.example.com'

Resources:
  ApiGatewayRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              Service: apigateway.amazonaws.com
            Action:
              - sts:AssumeRole
      Policies:
        - PolicyName: root
          PolicyDocument:
            Version: 2012-10-17
            Statement:
              - Effect: Allow
                Action: 'lambda:InvokeFunction'
                Resource: '*'
  ApiHandlerRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: !Sub '${AWS::StackName}-ApiHandlerRole'
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole
        - arn:aws:iam::aws:policy/AWSXrayWriteOnlyAccess
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Sid: AllowLambdaServiceToAssumeRole
            Effect: Allow
            Action:
              - sts:AssumeRole
            Principal:
              Service:
                - lambda.amazonaws.com
                - apigateway.amazonaws.com
      Policies:
        - PolicyName: RealsyncApiHandlerPolicy
          PolicyDocument:
            Version: 2012-10-17
            Statement:
              - Effect: Allow
                Action:
                  - 'lambda:InvokeFunction'
                Resource:
                  - !Sub 'arn:aws:lambda:${AWS::Region}:${AWS::AccountId}:function:${EnvName}-*'

  ApiAccessLogsLogGroup:
    Type: AWS::Logs::LogGroup
    Properties:
      LogGroupName: !Sub /aws/apigateway/${AWS::StackName}-ApiAccessLogs
      RetentionInDays: 7

  ApiMapping:
    Type: AWS::ApiGatewayV2::ApiMapping
    Properties:
      DomainName: !FindInMap [EnvMap, !Ref EnvName, ApiDomain]
      ApiId: !Ref Api
      Stage: !Ref ApiApiGatewayDefaultStage
      ApiMappingKey: !Sub ${BasePath}

  Api:
    Type: 'AWS::Serverless::HttpApi'
    Properties:
      FailOnWarnings: True
      RouteSettings:
        "$default":
          ThrottlingBurstLimit: 200
          ThrottlingRateLimit: 0.7
      CorsConfiguration:
        MaxAge: 86400
        AllowCredentials: true
        AllowMethods:
          - GET
          - OPTIONS
          - POST
          - PATCH
          - DELETE
          - PUT
        AllowHeaders:
          - 'Content-Type'
          - 'X-Amz-Date'
          - 'Authorization'
          - 'X-Api-Key'
          - 'Cookie'
          - 'access-control-allow-credentials'
        AllowOrigins:
          - !FindInMap [EnvMap, !Ref EnvName, CorsDomain]
      DefinitionBody:
        info:
          version: '1.0'
          title:
            Ref: AWS::StackName
        x-amazon-apigateway-gateway-responses:
          DEFAULT_4XX:
            responseParameters:
              gatewayresponse.header.Access-Control-Allow-Credentials: true
              gatewayresponse.header.Access-Control-Allow-Headers: "'Content-Type,X-Amz-Date,Authorization,X-Api-Key,Cookie,access-control-allow-credentials'"
              gatewayresponse.header.Access-Control-Allow-Methods: "'GET,OPTIONS,POST,PATCH,DELETE,PUT'"
              gatewayresponse.header.Access-Control-Allow-Origin:
                Fn::Join:
                  - ""
                  -
                    - "'"
                    - Fn::FindInMap: [EnvMap, !Ref EnvName, CorsDomain]
                    - "'"
          DEFAULT_5XX:
            responseParameters:
              gatewayresponse.header.Access-Control-Allow-Credentials: true
              gatewayresponse.header.Access-Control-Allow-Headers: "'Content-Type,X-Amz-Date,Authorization,X-Api-Key,Cookie,access-control-allow-credentials'"
              gatewayresponse.header.Access-Control-Allow-Methods: "'GET,OPTIONS,POST,PATCH,DELETE,PUT'"
              gatewayresponse.header.Access-Control-Allow-Origin:
                Fn::Join:
                  - ""
                  -
                    - "'"
                    - Fn::FindInMap: [EnvMap, !Ref EnvName, CorsDomain]
                    - "'"
        paths:
          "/{proxy+}":
            x-amazon-apigateway-any-method:
              x-amazon-apigateway-integration:
                httpMethod: POST
                type: aws_proxy
                uri:
                  Fn::Sub: arn:${AWS::Partition}:apigateway:${AWS::Region}:lambda:path/2015-03-31/functions/${ApiHandler.Arn}/invocations
                payloadFormatVersion: '1.0'
              responses: {}
        openapi: 3.0.1
        tags:
          - name: httpapi:createdBy
            x-amazon-apigateway-tag-value: SAM

  ApiHandler:
    Type: AWS::Serverless::Function
    Properties:
      FunctionName: !Sub ${AWS::StackName}-ApiHandler
      Role: !GetAtt ApiHandlerRole.Arn
      Handler: com.web.Handler::handleRequest
      Runtime: java11
      CodeUri: target/lambda-package.zip
      MemorySize: 704
      Policies: AWSLambdaBasicExecutionRole
      Timeout: 900
      Environment:
        Variables:
          JAVA_TOOL_OPTIONS: '-Dcom.sun.xml.bind.v2.bytecode.ClassTailor.noOptimize=true'
          EnvName: !Sub ${EnvName}
      Events:
        ProxyApi:
          Type: HttpApi
          Properties:
            ApiId: !Ref Api
            Path: /{proxy+}
            Method: any
            TimeoutInMillis: 30000
            PayloadFormatVersion: "1.0"