@incdevco/framework/stacks/main/user/stack.json

node.js lambda framework

{
  "AWSTemplateFormatVersion": "2010-09-09",
  "Description": "main user stack",
  "Parameters": {
    "AssetsS3Bucket": {
      "Type": "String"
    },
    "GoogleClientId": {
      "Type": "String"
    },
    "Stage": {
      "Description": "stage of the stack",
      "Type": "String"
    }
  },
  "Conditions": {
    "IsProduction": {"Fn::Equals": [{"Ref": "Stage"}, "production"]}
  },
  "Mappings": {
    
  },
  "Resources": {
    "AuthenticatedRole": {
      "Type": "AWS::IAM::Role",
      "Properties": {
        "AssumeRolePolicyDocument": {
          "Version": "2012-10-17",
          "Statement": [
            {
              "Effect": "Allow",
              "Principal": {
                "Federated": "cognito-identity.amazonaws.com"
              },
              "Action": "sts:AssumeRoleWithWebIdentity",
              "Condition": {
                "StringEquals": {
                  "cognito-identity.amazonaws.com:aud": {"Ref": "IdentityPool"}
                },
                "ForAnyValue:StringLike": {
                  "cognito-identity.amazonaws.com:amr": "authenticated"
                }
              }
            }
          ]
        },
        "Path": "/",
        "Policies": [
          {
            "PolicyName": "cognito",
            "PolicyDocument": {
              "Version": "2012-10-17",
              "Statement": [
                {
                  "Effect": "Allow",
                  "Action": [
                    "mobileanalytics:PutEvents",
                    "cognito-sync:*",
                    "cognito-identity:*"
                  ],
                  "Resource": [
                    "*"
                  ]
                }
              ]
            }
          }
        ]
      }
    },
    "IdentityPool": {
      "Type": "AWS::Cognito::IdentityPool",
      "Properties": {
        "IdentityPoolName": "users",
        "AllowUnauthenticatedIdentities": true,
        "SupportedLoginProviders": {
          "accounts.google.com": {"Ref": "GoogleClientId"}
        },
        "CognitoIdentityProviders": []
      }
    },
    "IdentityPoolRoleAttachment": {
      "Type": "AWS::Cognito::IdentityPoolRoleAttachment",
      "Properties": {
        "IdentityPoolId": {"Ref": "IdentityPool"},
        "Roles": {
          "authenticated": {"Fn::GetAtt": ["AuthenticatedRole", "Arn"]},
          "unauthenticated": {"Fn::GetAtt": ["UnauthenticatedRole", "Arn"]}
        }
      }
    },
    "UnauthenticatedRole": {
      "Type": "AWS::IAM::Role",
      "Properties": {
        "AssumeRolePolicyDocument": {
          "Version": "2012-10-17",
          "Statement": [
            {
              "Effect": "Allow",
              "Principal": {
                "Federated": "cognito-identity.amazonaws.com"
              },
              "Action": "sts:AssumeRoleWithWebIdentity",
              "Condition": {
                "StringEquals": {
                  "cognito-identity.amazonaws.com:aud": {"Ref": "IdentityPool"}
                },
                "ForAnyValue:StringLike": {
                  "cognito-identity.amazonaws.com:amr": "unauthenticated"
                }
              }
            }
          ]
        },
        "Path": "/",
        "Policies": [ 
          {
            "PolicyName": "cognito",
            "PolicyDocument": {
              "Version": "2012-10-17",
              "Statement": [
                {
                  "Effect": "Allow",
                  "Action": [
                    "mobileanalytics:PutEvents",
                    "cognito-sync:*"
                  ],
                  "Resource": [
                    "*"
                  ]
                }
              ]
            }
          }
        ]
      }
    }
  },
  "Outputs": {
    "IdentityPoolId": {
      "Value": {"Ref": "IdentityPool"}
    }
  }
}