AWSTemplateFormatVersion: '2010-09-09'
Description: >-
  Poly for Amazon Connect Quick Start. AWS CloudFormation Template "Poly Integrated
  Amazon Connect CCP.template" which will deploy the Poly Amazon Connect CCP https
  web site to your AWS account. NOTE: For this template the AWS region must be US
  East (N. Virginia) - us-east-1. Please ensure you select this region before deploying,
  or deployment will fail. (qs-1qhm59itf)
Metadata:
  cfn-lint:
    config:
      ignore_checks:
        - W9006
  AWS::CloudFormation::Interface:
    ParameterGroups:
      - Label:
          default: Poly CCP Configuration
        Parameters:
          - AmazonConnectInstanceAlias
          - HostedZone
          - AmazonConnectDomainName
      - Label:
          default: Quick Start Configuration
        Parameters:
          - QSS3BucketName
          - QSS3KeyPrefix
    ParameterLabels:
      AmazonConnectInstanceAlias:
        default: Amazon Connect Instance Alias
      HostedZone:
        default: Route 53 Hosted Zone
      AmazonConnectDomainName:
        default: Hosted Zone Subdomain
      QSS3BucketName:
        default: Quick Start S3 Bucket Name
      QSS3KeyPrefix:
        default: Quick Start S3 Key Prefix
Parameters:
  AmazonConnectInstanceAlias:
    Type: String
    Description: >-
      The Amazon Connect Instance Alias e.g. myamazonconnect, is needed for the Poly
      Amazon Connect CCP to connect to your Amazon Connect instance. You can check
      the name of your instance alias in your AWS Amazon Connect settings.
    AllowedPattern: (?!-)[a-zA-Z0-9-.]{1,63}(?<!-)
    ConstraintDescription: must be your valid Amazon Connect Instance Alias, e.g.
      myamazonconnect
  HostedZone:
    Type: String
    Description: The DNS name of an *existing* Amazon Route 53 hosted zone (domain
      name) in your AWS account with which you want to host your Poly-integrated Amazon
      Connect CCP, e.g. example.com
    AllowedPattern: (?!-)[a-zA-Z0-9-.]{0,63}(?<!-)
    ConstraintDescription: This parameter is optional but if provided must be a valid
      DNS zone name hosted within your AWS Console > Route 53.
    Default: ''
  AmazonConnectDomainName:
    Type: String
    Description: >-
      A subdomain for your hosted zone, e.g. amazonconnect.example.com - Will be used
      to create a CNAME (Alternate Name) in your hosted zone to reach your https Poly-integrated
      Amazon Connect CCP. Note: this CNAME should not exist already.
    AllowedPattern: (?!-)[a-zA-Z0-9-.]{0,63}(?<!-)
    ConstraintDescription: This parameter is optional but if provided must be a valid
      DNS sub-domain name which will be created under your hosted zone during deployment.
    Default: ''
  QSS3BucketName:
    Type: String
    Description: Quick Start S3 Bucket Name
    AllowedPattern: ^[0-9a-zA-Z]+([0-9a-zA-Z-]*[0-9a-zA-Z])*$
    Default: aws-quickstart
  QSS3KeyPrefix:
    Type: String
    Description: Quick Start S3 Key Prefix
    AllowedPattern: ^[0-9a-zA-Z-/]*$
    Default: quickstart-poly-ccp/
Conditions:
  NoHostedZoneCondition: !Equals
    - !Ref 'HostedZone'
    - ''
  NoDomainNameInfoCondition: !Or
    - !Equals
      - !Ref 'AmazonConnectDomainName'
      - ''
    - !Condition 'NoHostedZoneCondition'
  HasHostedZoneCondition: !Not
    - !Condition 'NoHostedZoneCondition'
  HasDomainNameInfoCondition: !And
    - !Not
      - !Equals
        - !Ref 'AmazonConnectDomainName'
        - ''
    - !Condition 'HasHostedZoneCondition'
  UsingDefaultBucket: !Equals [!Ref QSS3BucketName, 'aws-quickstart']
Resources:
  LambdaZipsBucket:
    Type: AWS::S3::Bucket
  CopyZips:
    Type: Custom::CopyZips
    Properties:
      ServiceToken: !GetAtt 'CopyZipsFunction.Arn'
      DestBucket: !Ref 'LambdaZipsBucket'
      SourceBucket: !If [UsingDefaultBucket, !Sub '${QSS3BucketName}-${AWS::Region}', !Ref QSS3BucketName]
      Prefix: !Ref 'QSS3KeyPrefix'
      Objects:
        - functions/deploy.zip
  CopyZipsRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              Service: lambda.amazonaws.com
            Action: sts:AssumeRole
      ManagedPolicyArns:
        - !Sub arn:${AWS::Partition}:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole
      Path: /
      Policies:
        - PolicyName: lambda-copier
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Effect: Allow
                Action:
                  - s3:GetObject
                Resource: !Sub
                  - arn:${AWS::Partition}:s3:::${S3Bucket}/${QSS3KeyPrefix}*
                  - S3Bucket: !If [UsingDefaultBucket, !Sub '${QSS3BucketName}-${AWS::Region}', !Ref QSS3BucketName]
              - Effect: Allow
                Action:
                  - s3:PutObject
                  - s3:DeleteObject
                Resource:
                  - !Sub 'arn:${AWS::Partition}:s3:::${LambdaZipsBucket}/${QSS3KeyPrefix}*'
  CopyZipsFunction:
    Type: AWS::Lambda::Function
    Properties:
      Description: Copies objects from a source S3 bucket to a destination
      Handler: index.handler
      Runtime: python3.8
      Role: !GetAtt 'CopyZipsRole.Arn'
      Timeout: 240
      Code:
        ZipFile: |
          import json
          import logging
          import threading
          import boto3
          import cfnresponse
          def copy_objects(source_bucket, dest_bucket, prefix, objects):
              s3 = boto3.client('s3')
              for o in objects:
                  key = prefix + o
                  copy_source = {
                      'Bucket': source_bucket,
                      'Key': key
                  }
                  print(('copy_source: %s' % copy_source))
                  print(('dest_bucket = %s'%dest_bucket))
                  print(('key = %s' %key))
                  s3.copy_object(CopySource=copy_source, Bucket=dest_bucket,
                        Key=key)
          def delete_objects(bucket, prefix, objects):
              s3 = boto3.client('s3')
              objects = {'Objects': [{'Key': prefix + o} for o in objects]}
              s3.delete_objects(Bucket=bucket, Delete=objects)
          def timeout(event, context):
              logging.error('Execution is about to time out, sending failure response to CloudFormation')
              cfnresponse.send(event, context, cfnresponse.FAILED, {}, None)
          def handler(event, context):
              # make sure we send a failure to CloudFormation if the function
              # is going to timeout
              timer = threading.Timer((context.get_remaining_time_in_millis()
                        / 1000.00) - 0.5, timeout, args=[event, context])
              timer.start()
              print(('Received event: %s' % json.dumps(event)))
              status = cfnresponse.SUCCESS
              try:
                  source_bucket = event['ResourceProperties']['SourceBucket']
                  dest_bucket = event['ResourceProperties']['DestBucket']
                  prefix = event['ResourceProperties']['Prefix']
                  objects = event['ResourceProperties']['Objects']
                  if event['RequestType'] == 'Delete':
                      delete_objects(dest_bucket, prefix, objects)
                  else:
                      copy_objects(source_bucket, dest_bucket, prefix, objects)
              except Exception as e:
                  logging.error('Exception: %s' % e, exc_info=True)
                  status = cfnresponse.FAILED
              finally:
                  timer.cancel()
                  cfnresponse.send(event, context, status, {}, None)

  S3BucketForWebsiteContent:
    Type: AWS::S3::Bucket
    Properties:
      AccessControl: PublicRead
      WebsiteConfiguration:
        IndexDocument: index.html
        ErrorDocument: error.html
  BucketPolicy:
    Type: AWS::S3::BucketPolicy
    Metadata:
      cfn-lint:
        config:
          ignore_checks:
            - EPolicyWildcardPrincipal
    Properties:
      PolicyDocument:
        Id: MyPolicy
        Version: '2012-10-17'
        Statement:
          - Sid: PublicReadForGetBucketObjects
            Effect: Allow
            Principal: '*'
            Action: s3:GetObject
            Resource: !Join
              - ''
              - - !Sub 'arn:${AWS::Partition}:s3:::'
                - !Ref 'S3BucketForWebsiteContent'
                - /*
      Bucket: !Ref 'S3BucketForWebsiteContent'
  AmazonConnectDeploymentFunctionExecutionRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          Effect: Allow
          Principal:
            Service:
              - lambda.amazonaws.com
          Action:
            - sts:AssumeRole
      Path: /
      ManagedPolicyArns:
        - !Sub arn:${AWS::Partition}:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole
        - !Sub arn:${AWS::Partition}:iam::aws:policy/AmazonS3FullAccess
  AmazonConnectDeploymentFunction:
    DependsOn: CopyZips
    Type: AWS::Lambda::Function
    Properties:
      Handler: deploy.handler
      MemorySize: 128
      Role: !GetAtt 'AmazonConnectDeploymentFunctionExecutionRole.Arn'
      Environment:
        Variables:
          BUCKET_NAME: !GetAtt 'S3BucketForWebsiteContent.DomainName'
          AMAZON_CONNECT_INSTANCE_ALIAS: !Ref 'AmazonConnectInstanceAlias'
      Runtime: python3.8
      Timeout: 60
      Code:
        S3Bucket: !Ref 'LambdaZipsBucket'
        S3Key: !Sub '${QSS3KeyPrefix}functions/deploy.zip'
  AmazonConnectDeploymentFunctionCustomAction:
    Type: Custom::AmazonConnectDeploymentFunctionCustomAction
    Version: '1.0'
    Properties:
      ServiceToken: !GetAtt 'AmazonConnectDeploymentFunction.Arn'
      BUCKET_NAME: !GetAtt 'S3BucketForWebsiteContent.DomainName'
      AMAZON_CONNECT_INSTANCE_ALIAS: !Ref 'AmazonConnectInstanceAlias'
  CertificateForCDN:
    Type: AWS::CertificateManager::Certificate
    Condition: HasDomainNameInfoCondition
    Properties:
      DomainName: !Ref 'AmazonConnectDomainName'
      DomainValidationOptions:
        - DomainName: !Ref 'AmazonConnectDomainName'
          ValidationDomain: !Ref 'HostedZone'
      ValidationMethod: DNS
  WebsiteCDNNoDomain:
    Type: AWS::CloudFront::Distribution
    Condition: NoDomainNameInfoCondition
    Properties:
      DistributionConfig:
        Comment: CDN for S3-backed website
        Enabled: true
        DefaultCacheBehavior:
          ForwardedValues:
            QueryString: true
          TargetOriginId: only-origin
          ViewerProtocolPolicy: redirect-to-https
        DefaultRootObject: index.html
        Origins:
          - CustomOriginConfig:
              HTTPPort: 80
              HTTPSPort: 443
              OriginProtocolPolicy: http-only
            DomainName: !GetAtt 'S3BucketForWebsiteContent.DomainName'
            Id: only-origin
        PriceClass: PriceClass_100
  WebsiteCDNWithDomain:
    Type: AWS::CloudFront::Distribution
    Condition: HasDomainNameInfoCondition
    Properties:
      DistributionConfig:
        Comment: CDN for S3-backed website
        Aliases:
          - !Join
            - ''
            - - !Ref 'AmazonConnectDomainName'
        Enabled: true
        DefaultCacheBehavior:
          ForwardedValues:
            QueryString: true
          TargetOriginId: only-origin
          ViewerProtocolPolicy: redirect-to-https
        DefaultRootObject: index.html
        Origins:
          - CustomOriginConfig:
              HTTPPort: 80
              HTTPSPort: 443
              OriginProtocolPolicy: http-only
            DomainName: !GetAtt 'S3BucketForWebsiteContent.DomainName'
            Id: only-origin
        ViewerCertificate:
          AcmCertificateArn: !Ref 'CertificateForCDN'
          SslSupportMethod: sni-only
        PriceClass: PriceClass_100
  WebsiteDNSName:
    Type: AWS::Route53::RecordSet
    Condition: HasDomainNameInfoCondition
    Properties:
      HostedZoneName: !Join
        - ''
        - - !Ref 'HostedZone'
          - .
      Comment: CNAME redirect custom name to CloudFront distribution
      Name: !Join
        - ''
        - - !Ref 'AmazonConnectDomainName'
      Type: CNAME
      TTL: 300
      ResourceRecords:
        - !GetAtt 'WebsiteCDNWithDomain.DomainName'
Outputs:
  WebsiteURL:
    Value: !Join
      - ''
      - - https://
        - !Ref 'AmazonConnectDomainName'
    Description: The deployed web site url. You must add this to the Approved Origins
      in your Amazon Connect Instance > Application Integration > Click +Add origin
    Condition: HasDomainNameInfoCondition
  WebsiteURLCloudFront:
    Value: !Join
      - ''
      - - https://
        - !GetAtt 'WebsiteCDNNoDomain.DomainName'
    Description: The deployed web site url. You must add this to the Approved Origins
      in your Amazon Connect Instance > Application Integration > Click +Add origin
    Condition: NoDomainNameInfoCondition
  NumberOfFilesDeployed:
    Value: !GetAtt 'AmazonConnectDeploymentFunctionCustomAction.NumberOfFilesDeployed'