cloudformation.yml

---
AWSTemplateFormatVersion: '2010-09-09'
Description: Serverless Contact Us form for static website
Metadata:
  AWS::CloudFormation::Interface:
    ParameterGroups:
      -
        Label:
          default: "Configuration"
        Parameters:
          - ToEmailAddress
          - ReCaptchaSecret
Parameters:
  ToEmailAddress:
    Type: String
    Description: Email address you want contact form submittions to go to
  ReCaptchaSecret:
    Type: String
    Description: Your Google reCAPTCHA secret
Resources:

  #
  # SNS Topic
  #
  ContactUsSNSTopic:
    Type: AWS::SNS::Topic
    Properties:
      DisplayName:
        Fn::Join:
          - ''
          - - Ref: AWS::StackName
            - ' Topic'
      Subscription:
        - Endpoint: !Ref ToEmailAddress
          Protocol: email
      TopicName:
        Fn::Join:
          - ''
          - - Ref: AWS::StackName
            - '-topic'

  #
  # Role that our Lambda will assume to provide access to other AWS resources
  #
  IamRoleLambdaExecution:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - lambda.amazonaws.com
            Action:
              - sts:AssumeRole
      Path: '/'

  #
  # Create a Policy and attach it to our Lambda Role.
  #
  IamPolicyLambdaExecution:
    Type: AWS::IAM::Policy
    Properties:
      PolicyName: IamPolicyLambdaExecution
      PolicyDocument:
        Version: '2012-10-17'
        Statement:
        - Effect: Allow
          Action:
            - logs:CreateLogGroup
            - logs:CreateLogStream
          Resource: arn:aws:logs:us-east-1:*:*
        - Effect: Allow
          Action:
            - logs:PutLogEvents
          Resource: arn:aws:logs:us-east-1:*:*
          Resource: '*'
        - Effect: Allow
          Action:
            - sns:Publish
          Resource: arn:aws:logs:us-east-1:*:*
          Resource: !Ref ContactUsSNSTopic
      Roles:
      - Ref: IamRoleLambdaExecution

  #
  # Our Lambda function.  Basic code has been added.  You will replace the code later via your Github repo.
  #
  ContactUsFunction:
    Type: AWS::Lambda::Function
    Properties:
      Handler: index.handler
      Timeout: 5
      Role:
        Fn::GetAtt:
          - IamRoleLambdaExecution
          - Arn
      Code:
        ZipFile: !Sub |
          var https = require('https');
          var querystring = require('querystring');
          var AWS = require("aws-sdk");

          exports.handler = function (event, context, callback) {
              // Validate the recaptcha
              var input_data = JSON.parse(event.body);
              var postData = querystring.stringify({
                  'secret': '${ReCaptchaSecret}',
                  'response': input_data['g-recaptcha-response']
              });

              var options = {
                  hostname: 'www.google.com',
                  port: 443,
                  path: '/recaptcha/api/siteverify',
                  method: 'POST',
                  headers: {
                      'Content-Type': 'application/x-www-form-urlencoded',
                      'Content-Length': Buffer.byteLength(postData)
                  }
              };

              var req = https.request(options, function(res) {
                  res.setEncoding('utf8');
                  res.on('data', function(chunk) {
                      var captchaResponse = JSON.parse(chunk);
                      if (captchaResponse.success) {
                          var sns = new AWS.SNS();
                          delete input_data['g-recaptcha-response'];
                          var message = "";
                          Object.keys(input_data).forEach(function(key) {
                             message += key+':\n';
                             message += '\t'+input_data[key]+'\n\n';
                          });
                          var params = {
                              Message: message,
                              Subject: "${AWS::StackName} Contact Us",
                              TopicArn: "${ContactUsSNSTopic}"
                          };
                          sns.publish(params, function (err, response) {
                              callback(null, {
                                  statusCode: '200',
                                  headers: {
                                      "Access-Control-Allow-Origin" : "*", // Required for CORS support to work
                                      "Access-Control-Allow-Credentials" : true // Required for cookies, authorization headers with HTTPS
                                  },
                                  body: JSON.stringify(response)
                              });
                          });
                      } else {
                          callback(null, {
                              statusCode: '500',
                              headers: {
                                  "Access-Control-Allow-Origin" : "*", // Required for CORS support to work
                                  "Access-Control-Allow-Credentials" : true // Required for cookies, authorization headers with HTTPS
                              },
                              body: JSON.stringify({message:'Invalid recaptcha'})
                          });
                      }
                  });
              });

              req.on('error', function(e) {
                  callback(null, {
                      statusCode: '500',
                      headers: {
                          "Access-Control-Allow-Origin" : "*", // Required for CORS support to work
                          "Access-Control-Allow-Credentials" : true // Required for cookies, authorization headers with HTTPS
                      },
                      body: JSON.stringify({message:e.message})
                  });
              });

              // write data to request body
              req.write(postData);
              req.end();
          };
      Runtime: nodejs6.10

  #
  # Create the API Gateway
  #
  ApiGatewayContactUs:
    Type: AWS::ApiGateway::RestApi
    Properties:
      Name: ApiGatewayContactUs

  ApiGatewayResource:
    Type: AWS::ApiGateway::Resource
    Properties:
      ParentId:
        Fn::GetAtt:
          - ApiGatewayContactUs
          - RootResourceId
      PathPart: api
      RestApiId:
        Ref: ApiGatewayContactUs

  ApiGatewayMethodOptions:
    Type: AWS::ApiGateway::Method
    Properties:
      AuthorizationType: NONE
      ResourceId:
        Ref: ApiGatewayResource
      RestApiId:
        Ref: ApiGatewayContactUs
      HttpMethod: OPTIONS
      Integration:
        IntegrationResponses:
        - StatusCode: 200
          ResponseParameters:
            method.response.header.Access-Control-Allow-Headers: "'Content-Type,X-Amz-Date,Authorization,X-Api-Key,X-Amz-Security-Token,X-Amz-User-Agent'"
            method.response.header.Access-Control-Allow-Methods: "'POST,OPTIONS'"
            method.response.header.Access-Control-Allow-Origin: "'*'"
            method.response.header.Access-Control-Allow-Credentials: "'false'"
          ResponseTemplates:
            application/json: ''
        PassthroughBehavior: WHEN_NO_MATCH
        RequestTemplates:
          application/json: '{"statusCode": 200}'
        Type: MOCK
      MethodResponses:
      - StatusCode: 200
        ResponseModels:
          application/json: 'Empty'
        ResponseParameters:
            method.response.header.Access-Control-Allow-Headers: false
            method.response.header.Access-Control-Allow-Methods: false
            method.response.header.Access-Control-Allow-Origin: false
            method.response.header.Access-Control-Allow-Credentials: true

  ApiGatewayMethodPost:
    Type: AWS::ApiGateway::Method
    Properties:
      HttpMethod: POST
      RequestParameters: {}
      ResourceId:
        Ref: ApiGatewayResource
      RestApiId:
        Ref: ApiGatewayContactUs
      AuthorizationType: NONE
      Integration:
        IntegrationHttpMethod: POST
        Type: AWS_PROXY
        Uri:
          Fn::Join:
            - ''
            - - 'arn:aws:apigateway:'
              - Ref: AWS::Region
              - ':lambda:path/2015-03-31/functions/'
              - Fn::GetAtt:
                - ContactUsFunction
                - Arn
              - '/invocations'
      MethodResponses: []

  ApiGatewayDeployment:
    Type: AWS::ApiGateway::Deployment
    Properties:
      RestApiId:
        Ref: ApiGatewayContactUs
      StageName: prod
    DependsOn:
    - ApiGatewayMethodPost
    - ApiGatewayMethodOptions

  #
  # We need to give API Gateway permission to invoke our Lambda function.
  #
  ContactUsFunctionPermission:
    Type: AWS::Lambda::Permission
    Properties:
      Action: lambda:invokeFunction
      FunctionName:
        Ref: ContactUsFunction
      Principal: apigateway.amazonaws.com
      SourceArn:
        Fn::Join:
          - ''
          - - 'arn:aws:execute-api:'
            - Ref: AWS::Region
            - ':'
            - Ref: AWS::AccountId
            - ':'
            - Ref: ApiGatewayContactUs
            - '/*/*'

Outputs:
  ApiUrl:
    Description: URL of your API endpoint
    Value: !Join
      - ''
      - - https://
        - !Ref ApiGatewayContactUs
        - '.execute-api.'
        - !Ref 'AWS::Region'
        - '.amazonaws.com/prod/api'