cloudformation.yaml

---
  AWSTemplateFormatVersion: '2010-09-09'
  Transform: AWS::Serverless-2016-10-31
  Description: EZproxy External Authenticator for Ex Libris
  Parameters:
    AlmaApiKey:
      Type: String
      Description: Alma API Key
      Default: ''
    GroupMapping:
      Type: String
      Description: Stringified JSON of Alma Group to EZproxy Group Mapping
      Default: '{"Everyone":["*"]}'
  Resources:
    ProxyAPI:
      Type: AWS::Serverless::HttpApi
      Properties:
        DefinitionBody: 
          openapi: "3.0.1"
          info:
            title: "EZproxyAuthenticator"          
          paths:
            /{proxy+}:
              x-amazon-apigateway-any-method:
               x-amazon-apigateway-integration:
                 payloadFormatVersion: "2.0"
                 type: "aws_proxy"
                 httpMethod: "POST"
                 uri:
                   Fn::Sub: "arn:aws:apigateway:${AWS::Region}:lambda:path/2015-03-31/functions/${EZproxyAuthenticator.Arn}/invocations"
    Dependencies:
      Type: "AWS::Serverless::LayerVersion"
      Properties:
        LayerName: !Sub "${AWS::StackName}-Dependencies"
        ContentUri: ./dependencies
        CompatibleRuntimes:
          - nodejs10.x
          - nodejs12.x
        LicenseInfo: 'Apache-2.0'
    LambdaExecutionRole:
      Type: AWS::IAM::Role
      Properties:
        AssumeRolePolicyDocument:
          Version: '2012-10-17'
          Statement:
            Effect: Allow
            Principal:
              Service: lambda.amazonaws.com
            Action: sts:AssumeRole
        Path: "/"
        Policies:
        - PolicyName: logs
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
            - Effect: Allow
              Action:
              - logs:CreateLogGroup
              - logs:CreateLogStream
              - logs:PutLogEvents
              Resource: arn:aws:logs:*:*:*
    LambdaApiGatewayExecutionPermission:
      Type: AWS::Lambda::Permission
      Properties:
        Action: lambda:InvokeFunction
        FunctionName: !GetAtt EZproxyAuthenticator.Arn
        Principal: apigateway.amazonaws.com
        SourceArn: !Join
          - ''
          - - 'arn:aws:execute-api:'
            - !Ref AWS::Region
            - ":"
            - !Ref AWS::AccountId
            - ":"
            - !Ref ProxyAPI
            - "/*/*"
    EZproxyAuthenticator:
      Type: AWS::Serverless::Function
      Properties:
        FunctionName: !Sub "${AWS::StackName}-Function"
        CodeUri: ./app
        Layers:
          - !Ref Dependencies
        Handler: index.handler
        Role: !GetAtt LambdaExecutionRole.Arn
        Runtime: nodejs12.x
        Timeout: 60
        Environment:
          Variables:
            ALMA_APIKEY: !Ref AlmaApiKey
            EZPROXY_GROUP_MAPPING: !Ref GroupMapping
  Outputs:
    ApiUrl:
      Description: URL of the Authenticator
      Value: !Join
        - ''
        - - https://
          - !Ref ProxyAPI
          - ".execute-api."
          - !Ref AWS::Region
          - ".amazonaws.com/"