template_base.yml

AWSTemplateFormatVersion: '2010-09-09'
Transform: AWS::Serverless-2016-10-31

Parameters:
    InputEnv:
        Type: String
        AllowedValues: [production, deployed_dev, development]
    InputRollbarResponder:
        Type: String
    InputRollbarAccounts:
        Type: String
    InputDomainBranded:
        Type: String
    InputDomainUnbranded:
        Type: String
    InputCertArn:
        Type: String
    InputSesArn:
        Type: String


Globals:
    Function:
        Runtime: nodejs24.x
        MemorySize: 128
        Timeout: 10


Resources:

    # BUCKETS

    DisplayerBucket:
        # Displayer bucket holds displayer code and nothing more
        # SECURITY Users must never have write access to this bucket (not even their own prefix)
        #   Since Cloudfront serves from this bucket, all user subdomains serve any uploads
        #   e.g. a user could upload malicious html that extracts secrets from indexedb
        #       They then get ppl to click a link to the html file but with another users' subdomain
        #   So users must use a separate bucket for messages (unlike when self-hosting)
        Type: AWS::S3::Bucket
        Properties:
            BucketName: !Join ['', [!Ref AWS::StackName, -displayer]]
            BucketEncryption:
                ServerSideEncryptionConfiguration:
                    -   ServerSideEncryptionByDefault:
                            SSEAlgorithm: AES256

    DisplayerBucketPolicy:
        # Anyone can read objects in displayer bucket, no one can write
        Type: AWS::S3::BucketPolicy
        Properties:
            Bucket: !Ref DisplayerBucket
            PolicyDocument:
                Version: '2012-10-17'
                Statement:
                    Effect: 'Allow'
                    Principal: '*'
                    Action: 's3:GetObject'
                    Resource: !Join ['', [!GetAtt DisplayerBucket.Arn, '/*']]

    MessagesBucket:
        # Messages bucket holds encrypted messages and supports expiring tagged objects
        Type: AWS::S3::Bucket
        Properties:
            BucketName: !Ref AWS::StackName
            BucketEncryption:
                ServerSideEncryptionConfiguration:
                    -   ServerSideEncryptionByDefault:
                            SSEAlgorithm: AES256
            CorsConfiguration:
                CorsRules:
                    -   AllowedMethods: [GET]
                        # NOTE CORS Doesn't allow wildcard subdomain so S3 will return exact value
                        AllowedOrigins:
                            -   !Join ['', ['https://*.', !Ref InputDomainBranded]]
                            -   !Join ['', ['https://*.', !Ref InputDomainUnbranded]]
            LifecycleConfiguration:
                Rules: [
                    # Ensure max 2 year expiry can't be avoided by not including a lifespan tag
                    {Status: Enabled, Prefix: messages/, ExpirationInDays: 731},
                    MESSAGE_EXPIRY_RULES
                ]

    MessagesBucketPolicy:
        # Anyone can read objects in messages bucket (user role allows writing to own prefix)
        Type: AWS::S3::BucketPolicy
        Properties:
            Bucket: !Ref MessagesBucket
            PolicyDocument:
                Version: '2012-10-17'
                Statement:
                    Effect: 'Allow'
                    Principal: '*'
                    Action: 's3:GetObject'
                    Resource: !Join ['', [!GetAtt MessagesBucket.Arn, '/*']]

    ResponsesBucket:
        # Responses bucket holds private encrypted responses (user role allows reading own prefix)
        Type: AWS::S3::Bucket
        Properties:
            BucketName: !Join ['', [!Ref AWS::StackName, -stello-resp]]
            BucketEncryption:
                ServerSideEncryptionConfiguration:
                    -   ServerSideEncryptionByDefault:
                            SSEAlgorithm: AES256
            LifecycleConfiguration:
                Rules:
                    -   Status: Enabled
                        Prefix: responses/
                        ExpirationInDays: 365  # Ensure unreceived responses eventually cleaned up

            PublicAccessBlockConfiguration:
                # Not necessary, but just in case...
                BlockPublicAcls: true
                BlockPublicPolicy: true
                IgnorePublicAcls: true
                RestrictPublicBuckets: true

    # CLOUDFRONT

    DisplayerCloudfront:
        Type: AWS::CloudFront::Distribution
        Properties:
            DistributionConfig:
                Enabled: true
                HttpVersion: http2  # Requires TLS 1.2
                Aliases:
                    -   !Join ['', ['*.', !Ref InputDomainBranded]]
                    -   !Join ['', ['*.', !Ref InputDomainUnbranded]]
                DefaultRootObject: index.html
                ViewerCertificate:
                    AcmCertificateArn: !Ref InputCertArn
                    SslSupportMethod: sni-only
                    MinimumProtocolVersion: TLSv1.2_2021  # Drops insecure ciphers (still compat.)
                Origins:
                    -   Id: primary
                        DomainName: !GetAtt DisplayerBucket.RegionalDomainName
                        CustomOriginConfig:
                            OriginProtocolPolicy: https-only
                            OriginSSLProtocols: [TLSv1.2]  # Only needs supporting by S3
                DefaultCacheBehavior:
                    TargetOriginId: primary
                    ViewerProtocolPolicy: https-only
                    CachePolicyId: 658327ea-f89d-4fab-a63d-7e88639e58f6  # CachingOptimized
                    FunctionAssociations:
                        -   EventType: viewer-response
                            FunctionARN: !GetAtt DisplayerCloudfrontFunction.FunctionMetadata.FunctionARN

    DisplayerCloudfrontFunction:
        Type: AWS::CloudFront::Function
        Properties:
            Name: viewer_response
            AutoPublish: true
            FunctionConfig:
                Runtime: cloudfront-js-1.0
                Comment: ''
            # SECURITY headers (must be lowercase)
            # referrer-policy: Ensure linked sites cannot identify user via displayer domain
            # x-robots-tag: Ensure search engines never index displayer and reveal it publicly
            # x-content-type-options: Protect against content type manipulation
            # permissions-policy: Disable document.domain to reduce risk of subdomain exploit
            # cross-origin-opener-policy: Prevent sites from opening displayer and controlling it
            # cross-origin-resource-policy: Prevent other sites from loading displayer's assets
            # cross-origin-embedder-policy: Require CORP/CORS for all resources (no exceptions)
            #     NOTE Can't use as would block video iframes
            # strict-transport-security: Tell browsers to only ever use HTTPS for future requests
            # content-security-policy: Prevent requests to other origins & inline attacks etc
            # WARN Keep CSP in sync with displayer's meta tag CSP
            # NOTE 'unsafe-hashes' & 'sha256-tbWZ...' is for Chrome 100's PDF viewer
            #       See https://bugs.chromium.org/p/chromium/issues/detail?id=1117326
            #       This allows any element to have style="position:absolute; left: 0; top: 0;"
            #       Not ideal, but low risk, only allows moving something to top left of window
            #       TODO Rm once Chrome fixes the issue and enough users update Chrome to that ver.
            FunctionCode: !Sub |
                function handler(event){
                    event.response.headers['referrer-policy'] = {value: 'no-referrer'}
                    event.response.headers['x-robots-tag'] = {value: 'none'}
                    event.response.headers['x-content-type-options'] = {value: 'nosniff'}
                    event.response.headers['permissions-policy'] = {value: 'document-domain=()'}
                    event.response.headers['cross-origin-opener-policy'] = {value: 'same-origin'}
                    event.response.headers['cross-origin-resource-policy'] = {value: 'same-origin'}
                    event.response.headers['strict-transport-security'] =
                        {value: 'max-age=63072000; includeSubDomains; preload'}
                    event.response.headers['content-security-policy'] = {
                        value: ""
                            + "frame-ancestors 'none';"
                            + "form-action 'none';"
                            + "base-uri 'none';"
                            + "default-src 'none';"
                            + "img-src 'self' blob:;"
                            + "script-src 'self';"
                            + "style-src 'self' 'sha256-cqgHpNtbR0J523Ke5PUmEVVN9xHiKgXSborCQc3QnFA=' 'unsafe-hashes' 'sha256-tbWZ4NP1341cpcrZVDn7B3o9bt/muXgduILAnC0Zbaw=';"
                            + "connect-src 'self' https://api.${InputDomainBranded} https://api.${InputDomainUnbranded} https://${MessagesBucket.RegionalDomainName} https://api.rollbar.com;"
                            + "frame-src https://www.youtube-nocookie.com https://player.vimeo.com;"
                    }
                    return event.response
                }

    # GATEWAY

    Gateway:
        Type: AWS::Serverless::HttpApi
        Properties:
            DisableExecuteApiEndpoint: true

    GatewayDomainBranded:
        Type: AWS::ApiGatewayV2::ApiMapping
        Properties:
            ApiId: !Ref Gateway
            DomainName: !Join ['', ['api.', !Ref InputDomainBranded]]
            Stage: !Ref Gateway.Stage

    GatewayDomainUnbranded:
        Type: AWS::ApiGatewayV2::ApiMapping
        Properties:
            ApiId: !Ref Gateway
            DomainName: !Join ['', ['api.', !Ref InputDomainUnbranded]]
            Stage: !Ref Gateway.Stage


    # RESPONDER

    ResponderOptions:
        # Separate route for options as shouldn't have permissions
        Type: AWS::Serverless::Function
        Properties:
            Runtime: python3.13
            Handler: responder.entry
            CodeUri: responder/
            Events:
                ApiEvent:
                    Type: HttpApi
                    Properties:
                        ApiId: !Ref Gateway
                        Method: OPTIONS
                        Path: /{all+}
            Environment:
                Variables:
                    stello_env: !Ref InputEnv
                    stello_version: INPUT_VERSION
                    stello_msgs_bucket: !Ref AWS::StackName
                    stello_region: !Ref AWS::Region
                    stello_rollbar_responder: !Ref InputRollbarResponder
                    stello_domain_branded: !Ref InputDomainBranded
                    stello_domain_unbranded: !Ref InputDomainUnbranded

    InviterImage:
        # NOTE For simpler deployment, inviter code is embedded in responder
        Type: AWS::Serverless::Function
        Properties:
            Runtime: python3.13
            Handler: responder.entry
            CodeUri: responder/
            Events:
                ApiEvent:
                    Type: HttpApi
                    Properties:
                        ApiId: !Ref Gateway
                        Method: GET
                        Path: /inviter/image
            Environment:
                Variables:
                    stello_env: !Ref InputEnv
                    stello_version: INPUT_VERSION
                    stello_msgs_bucket: !Ref AWS::StackName
                    stello_region: !Ref AWS::Region
                    stello_rollbar_responder: !Ref InputRollbarResponder
                    stello_domain_branded: !Ref InputDomainBranded
                    stello_domain_unbranded: !Ref InputDomainUnbranded
            Policies:
                -   Version: '2012-10-17'
                    Statement:
                        -   Effect: Allow
                            Resource: !Join ['', [!GetAtt MessagesBucket.Arn, '/messages/*/invite_images/*']]
                            Action: ['s3:GetObject']

    ResponderRead:
        Type: AWS::Serverless::Function
        Properties:
            Runtime: python3.13
            Handler: responder.entry
            CodeUri: responder/
            Events:
                ApiEvent:
                    Type: HttpApi
                    Properties:
                        ApiId: !Ref Gateway  # Legit property, despite linter error
                        Method: POST
                        Path: /responder/read
            Environment:
                Variables:
                    stello_env: !Ref InputEnv
                    stello_version: INPUT_VERSION
                    stello_msgs_bucket: !Ref AWS::StackName
                    stello_region: !Ref AWS::Region
                    stello_rollbar_responder: !Ref InputRollbarResponder
                    stello_domain_branded: !Ref InputDomainBranded
                    stello_domain_unbranded: !Ref InputDomainUnbranded
            Policies:
                -   Version: '2012-10-17'
                    Statement:
                        # Get config and put responses
                        -   Effect: Allow
                            Resource: !Join ['', [!GetAtt ResponsesBucket.Arn, '/config/*/config']]
                            Action: ['s3:GetObject']
                        -   Effect: Allow
                            Resource: !Join ['', [!GetAtt ResponsesBucket.Arn, '/responses/*/*']]
                            Action: ['s3:PutObject']
                        # Needed for read response only
                        -   Effect: Allow
                            Resource: !Join ['', [!GetAtt MessagesBucket.Arn, '/messages/*/copies/*']]
                            Action: ['s3:GetObjectTagging', 's3:PutObjectTagging', 's3:DeleteObject']
                        -   Effect: Allow
                            Resource: !Join ['', [!GetAtt MessagesBucket.Arn, '/messages/*/invite_images/*']]
                            Action: ['s3:DeleteObject']

    ResponderReply:
        Type: AWS::Serverless::Function
        Properties:
            Runtime: python3.13
            Handler: responder.entry
            CodeUri: responder/
            Events:
                ApiEvent:
                    Type: HttpApi
                    Properties:
                        ApiId: !Ref Gateway
                        Method: POST
                        Path: /responder/reply
            Environment:
                Variables:
                    stello_env: !Ref InputEnv
                    stello_version: INPUT_VERSION
                    stello_msgs_bucket: !Ref AWS::StackName
                    stello_region: !Ref AWS::Region
                    stello_rollbar_responder: !Ref InputRollbarResponder
                    stello_domain_branded: !Ref InputDomainBranded
                    stello_domain_unbranded: !Ref InputDomainUnbranded
            Policies:
                -   Version: '2012-10-17'
                    Statement:
                        # Get config and put responses
                        -   Effect: Allow
                            Resource: !Join ['', [!GetAtt ResponsesBucket.Arn, '/config/*/config']]
                            Action: ['s3:GetObject']
                        -   Effect: Allow
                            Resource: !Join ['', [!GetAtt ResponsesBucket.Arn, '/responses/*/*']]
                            Action: ['s3:PutObject']
                        # Needed to send notifications
                        -   Effect: Allow
                            Resource: !GetAtt ResponsesBucket.Arn
                            Action: ['s3:ListBucket']
                        -   Effect: Allow
                            Resource: !Ref InputSesArn
                            Action: ['ses:SendEmail']

    ResponderReaction:
        Type: AWS::Serverless::Function
        Properties:
            Runtime: python3.13
            Handler: responder.entry
            CodeUri: responder/
            Events:
                ApiEvent:
                    Type: HttpApi
                    Properties:
                        ApiId: !Ref Gateway
                        Method: POST
                        Path: /responder/reaction
            Environment:
                Variables:
                    stello_env: !Ref InputEnv
                    stello_version: INPUT_VERSION
                    stello_msgs_bucket: !Ref AWS::StackName
                    stello_region: !Ref AWS::Region
                    stello_rollbar_responder: !Ref InputRollbarResponder
                    stello_domain_branded: !Ref InputDomainBranded
                    stello_domain_unbranded: !Ref InputDomainUnbranded
            Policies:
                -   Version: '2012-10-17'
                    Statement:
                        # Get config and put responses
                        -   Effect: Allow
                            Resource: !Join ['', [!GetAtt ResponsesBucket.Arn, '/config/*/config']]
                            Action: ['s3:GetObject']
                        -   Effect: Allow
                            Resource: !Join ['', [!GetAtt ResponsesBucket.Arn, '/responses/*/*']]
                            Action: ['s3:PutObject']
                        # Needed to send notifications
                        -   Effect: Allow
                            Resource: !GetAtt ResponsesBucket.Arn
                            Action: ['s3:ListBucket']
                        -   Effect: Allow
                            Resource: !Ref InputSesArn
                            Action: ['ses:SendEmail']

    ResponderSubscribe:
        Type: AWS::Serverless::Function
        Properties:
            Runtime: python3.13
            Handler: responder.entry
            CodeUri: responder/
            Events:
                ApiEvent:
                    Type: HttpApi
                    Properties:
                        ApiId: !Ref Gateway
                        Method: POST
                        Path: /responder/subscribe
            Environment:
                Variables:
                    stello_env: !Ref InputEnv
                    stello_version: INPUT_VERSION
                    stello_msgs_bucket: !Ref AWS::StackName
                    stello_region: !Ref AWS::Region
                    stello_rollbar_responder: !Ref InputRollbarResponder
                    stello_domain_branded: !Ref InputDomainBranded
                    stello_domain_unbranded: !Ref InputDomainUnbranded
            Policies:
                -   Version: '2012-10-17'
                    Statement:
                        # Get config and put responses
                        -   Effect: Allow
                            Resource: !Join ['', [!GetAtt ResponsesBucket.Arn, '/config/*/config']]
                            Action: ['s3:GetObject']
                        -   Effect: Allow
                            Resource: !Join ['', [!GetAtt ResponsesBucket.Arn, '/responses/*/*']]
                            Action: ['s3:PutObject']
                        # Needed to send notifications
                        -   Effect: Allow
                            Resource: !GetAtt ResponsesBucket.Arn
                            Action: ['s3:ListBucket']
                        -   Effect: Allow
                            Resource: !Ref InputSesArn
                            Action: ['ses:SendEmail']

    ResponderSubscription:
        Type: AWS::Serverless::Function
        Properties:
            Runtime: python3.13
            Handler: responder.entry
            CodeUri: responder/
            Events:
                ApiEvent:
                    Type: HttpApi
                    Properties:
                        ApiId: !Ref Gateway
                        Method: POST
                        Path: /responder/subscription
            Environment:
                Variables:
                    stello_env: !Ref InputEnv
                    stello_version: INPUT_VERSION
                    stello_msgs_bucket: !Ref AWS::StackName
                    stello_region: !Ref AWS::Region
                    stello_rollbar_responder: !Ref InputRollbarResponder
                    stello_domain_branded: !Ref InputDomainBranded
                    stello_domain_unbranded: !Ref InputDomainUnbranded
            Policies:
                -   Version: '2012-10-17'
                    Statement:
                        # Get config and put responses
                        -   Effect: Allow
                            Resource: !Join ['', [!GetAtt ResponsesBucket.Arn, '/config/*/config']]
                            Action: ['s3:GetObject']
                        -   Effect: Allow
                            Resource: !Join ['', [!GetAtt ResponsesBucket.Arn, '/responses/*/*']]
                            Action: ['s3:PutObject']

    ResponderAddress:
        Type: AWS::Serverless::Function
        Properties:
            Runtime: python3.13
            Handler: responder.entry
            CodeUri: responder/
            Events:
                ApiEvent:
                    Type: HttpApi
                    Properties:
                        ApiId: !Ref Gateway
                        Method: POST
                        Path: /responder/address
            Environment:
                Variables:
                    stello_env: !Ref InputEnv
                    stello_version: INPUT_VERSION
                    stello_msgs_bucket: !Ref AWS::StackName
                    stello_region: !Ref AWS::Region
                    stello_rollbar_responder: !Ref InputRollbarResponder
                    stello_domain_branded: !Ref InputDomainBranded
                    stello_domain_unbranded: !Ref InputDomainUnbranded
            Policies:
                -   Version: '2012-10-17'
                    Statement:
                        # Get config and put responses
                        -   Effect: Allow
                            Resource: !Join ['', [!GetAtt ResponsesBucket.Arn, '/config/*/config']]
                            Action: ['s3:GetObject']
                        -   Effect: Allow
                            Resource: !Join ['', [!GetAtt ResponsesBucket.Arn, '/responses/*/*']]
                            Action: ['s3:PutObject']

    ResponderResend:
        Type: AWS::Serverless::Function
        Properties:
            Runtime: python3.13
            Handler: responder.entry
            CodeUri: responder/
            Events:
                ApiEvent:
                    Type: HttpApi
                    Properties:
                        ApiId: !Ref Gateway
                        Method: POST
                        Path: /responder/resend
            Environment:
                Variables:
                    stello_env: !Ref InputEnv
                    stello_version: INPUT_VERSION
                    stello_msgs_bucket: !Ref AWS::StackName
                    stello_region: !Ref AWS::Region
                    stello_rollbar_responder: !Ref InputRollbarResponder
                    stello_domain_branded: !Ref InputDomainBranded
                    stello_domain_unbranded: !Ref InputDomainUnbranded
            Policies:
                -   Version: '2012-10-17'
                    Statement:
                        # Get config and put responses
                        -   Effect: Allow
                            Resource: !Join ['', [!GetAtt ResponsesBucket.Arn, '/config/*/config']]
                            Action: ['s3:GetObject']
                        -   Effect: Allow
                            Resource: !Join ['', [!GetAtt ResponsesBucket.Arn, '/responses/*/*']]
                            Action: ['s3:PutObject']
                        # Needed to send notifications
                        -   Effect: Allow
                            Resource: !GetAtt ResponsesBucket.Arn
                            Action: ['s3:ListBucket']
                        -   Effect: Allow
                            Resource: !Ref InputSesArn
                            Action: ['ses:SendEmail']

    # ACCOUNTS

    AccountsAvailable:
        Type: AWS::Serverless::Function
        Properties:
            Handler: dist/handle_available.handler
            CodeUri: accounts/
            Events:
                ApiEvent:
                    Type: HttpApi
                    Properties:
                        ApiId: !Ref Gateway  # Legit property, despite linter error
                        Method: POST
                        Path: /accounts/available
            Environment:
                Variables:
                    stello_env: !Ref InputEnv
                    stello_version: INPUT_VERSION
                    stello_region: !Ref AWS::Region
                    stello_rollbar: !Ref InputRollbarAccounts
                    stello_user_pool: !Ref UserPool
            Policies:
                -   Version: '2012-10-17'
                    Statement:
                        -   Effect: Allow
                            Resource: !GetAtt UserPool.Arn
                            Action:
                                -   cognito-idp:AdminGetUser

    AccountsCreate:
        Type: AWS::Serverless::Function
        Properties:
            Handler: dist/handle_create.handler
            CodeUri: accounts/
            Events:
                ApiEvent:
                    Type: HttpApi
                    Properties:
                        ApiId: !Ref Gateway  # Legit property, despite linter error
                        Method: POST
                        Path: /accounts/create
            Environment:
                Variables:
                    stello_env: !Ref InputEnv
                    stello_version: INPUT_VERSION
                    stello_region: !Ref AWS::Region
                    stello_rollbar: !Ref InputRollbarAccounts
                    stello_user_pool: !Ref UserPool
            Policies:
                -   Version: '2012-10-17'
                    Statement:
                        -   Effect: Allow
                            Resource: !GetAtt UserPool.Arn
                            Action:
                                -   cognito-idp:ListUsers
                                -   cognito-idp:AdminCreateUser
                                -   cognito-idp:AdminSetUserPassword

    # COGNITO

    UserPool:
        Type: AWS::Cognito::UserPool
        Properties:
            UserPoolName: !Ref AWS::StackName
            MfaConfiguration: 'OFF'
            AdminCreateUserConfig:
                AllowAdminCreateUserOnly: true
            UsernameConfiguration:
                CaseSensitive: false  # Will be used as a subdomain which isn't case-sensitive
            Schema:
                # WARN Keep all mutable so can update if needed, as Cognito forbids schema changes
                # NOTE Non-dev attributes are returned in API calls, so not hidden from user
                # NOTE Depending on the context, attributes may need prefix dev:custom: or custom:
                # NOTE cognito:username is the attribute for the builtin username field
                -   Name: hashed_email
                    AttributeDataType: String
                    Mutable: true
                -   Name: hashed_email_init
                    AttributeDataType: String
                    Mutable: true
                    DeveloperOnlyAttribute: true
                -   Name: hashed_ip
                    AttributeDataType: String
                    Mutable: true
                    DeveloperOnlyAttribute: true
                -   Name: plan
                    AttributeDataType: String
                    Mutable: true
                    DeveloperOnlyAttribute: true
                # These attributes are no longer used and only exist as Cognito forbids deletion
                -   Name: hashed_email_orig
                    AttributeDataType: String
                    Mutable: false
                    DeveloperOnlyAttribute: true
                -   Name: ip
                    AttributeDataType: String
                    Mutable: false
                    DeveloperOnlyAttribute: true
            AccountRecoverySetting:
                RecoveryMechanisms:
                    -   Name: admin_only
                        Priority: 1
            Policies:
                PasswordPolicy:
                    # Don't require char groups as a random password may not fulfill one or more
                    RequireLowercase: false
                    RequireUppercase: false
                    RequireNumbers: false
                    RequireSymbols: false
                    MinimumLength: 32  # Length of a uuid4

    UserPoolClient:
        Type: AWS::Cognito::UserPoolClient
        Properties:
            ClientName: stello
            UserPoolId: !Ref UserPool
            GenerateSecret: false  # Can't keep secret in desktop clients
            EnableTokenRevocation: true
            TokenValidityUnits:
                AccessToken: days
                IdToken: days
                RefreshToken: days
            AccessTokenValidity: 1
            IdTokenValidity: 1  # Can't be greater than refresh
            RefreshTokenValidity: 1  # Refresh tokens are not used since have access to user/pass
            ExplicitAuthFlows: [ALLOW_USER_PASSWORD_AUTH, ALLOW_REFRESH_TOKEN_AUTH]
            PreventUserExistenceErrors: 'ENABLED'  # Recommended, but provide availability fn anyway

    IdentityPool:
        Type: AWS::Cognito::IdentityPool
        Properties:
            IdentityPoolName: !Ref AWS::StackName
            AllowUnauthenticatedIdentities: false
            AllowClassicFlow: false
            CognitoIdentityProviders:
                -   ClientId: !Ref UserPoolClient
                    ProviderName: !GetAtt UserPool.ProviderName
                    ServerSideTokenCheck: true  # Check user not e.g. deleted before granting access

    IdentityPoolRoleAttachment:
        Type: AWS::Cognito::IdentityPoolRoleAttachment
        Properties:
            IdentityPoolId: !Ref IdentityPool
            Roles:
                authenticated: !GetAtt IdentityPoolRole.Arn

    IdentityPoolRole:
        Type: AWS::IAM::Role
        Properties:
            RoleName: !Join ['', [!Ref AWS::StackName, -user]]
            AssumeRolePolicyDocument:
                # See https://docs.aws.amazon.com/cognito/latest/developerguide/using-attributes-for-access-control-policy-example.html
                Version: '2012-10-17'
                Statement:
                    -   Effect: Allow
                        Principal:
                            Federated: cognito-identity.amazonaws.com
                        # NOTE TagSession needed for using PrincipalTag variables
                        Action: [sts:AssumeRoleWithWebIdentity, sts:TagSession]
                        Condition:
                            StringEquals:
                                cognito-identity.amazonaws.com:aud: !Ref IdentityPool
                            ForAnyValue:StringLike:
                                cognito-identity.amazonaws.com:amr: authenticated
            Policies:
                -   PolicyName: main
                    PolicyDocument:
                        Version: '2012-10-17'
                        Statement:
                            # SECURITY Every permission granted must be for own prefix/resource only

                            # List own messages
                            -   Effect: Allow
                                Resource: !GetAtt MessagesBucket.Arn
                                Action: ['s3:ListBucket']
                                Condition:
                                    StringLike:
                                        s3:prefix: 'messages/${aws:PrincipalTag/username}/*'

                            # Put/delete own messages
                            -   Effect: Allow
                                Resource: !Join ['/', [!GetAtt MessagesBucket.Arn,
                                    'messages/${aws:PrincipalTag/username}/*']]
                                Action: ['s3:PutObject', 's3:PutObjectTagging', 's3:DeleteObject']
                                # SECURITY tags could be used for other reasons in an AWS account
                                #      So must ensure user can only set stello- tags
                                # NOTE Tags can be set via PutObject (not just PutObjectTagging)
                                # NOTE ForAllValues:StringLike means for every value in
                                #      s3:RequestObjectTagKeys, ensure it is included in given array
                                #      See https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_multi-value-conditions.html
                                Condition:
                                    ForAllValues:StringLike:
                                        s3:RequestObjectTagKeys: ['stello-lifespan', 'stello-reads',
                                            'stello-max-reads']

                            # Put/delete own displayer config (config prefix not subject to expiry)
                            -   Effect: Allow
                                Resource: !Join ['/', [!GetAtt MessagesBucket.Arn,
                                    'config/${aws:PrincipalTag/username}/config']]
                                Action: ['s3:PutObject', 's3:DeleteObject']

                            # Put/delete own subscribe config (config prefix not subject to expiry)
                            -   Effect: Allow
                                Resource: !Join ['/', [!GetAtt MessagesBucket.Arn,
                                    'config/${aws:PrincipalTag/username}/subscribe']]
                                Action: ['s3:PutObject', 's3:DeleteObject']

                            # List own responses
                            -   Effect: Allow
                                Resource: !GetAtt ResponsesBucket.Arn
                                Action: ['s3:ListBucket']
                                Condition:
                                    StringLike:
                                        s3:prefix: 'responses/${aws:PrincipalTag/username}/*'

                            # Get/delete own responses
                            -   Effect: Allow
                                Resource: !Join ['/', [!GetAtt ResponsesBucket.Arn,
                                    'responses/${aws:PrincipalTag/username}/*']]
                                Action: ['s3:GetObject', 's3:DeleteObject']

                            # Put/Delete own responder config (config prefix not subject to expiry)
                            -   Effect: Allow
                                Resource: !Join ['/', [!GetAtt ResponsesBucket.Arn,
                                    'config/${aws:PrincipalTag/username}/config']]
                                Action: ['s3:PutObject', 's3:DeleteObject']