template.yml

AWSTemplateFormatVersion: "2010-09-09"
Transform: AWS::Serverless-2016-10-31
Description: JWT Issuer
Parameters:
  KeyCustodianParameter:
    Type: String
    Description: |
      The private key used for signing requests can either be stored in
      Parameter Store or can be managed by KMS. The Parameter Store option
      encrypts and stores a private key generated by this stack, where
      the generated private key is decrypted and loaded into Lambda at runtime
      when signing keys. The KMS option creates a key managed by KMS, where
      Lambda makes calls to KMS for each JWT signing request but the private
      key can never leave the KMS service. The Parameter Store option is faster
      (because the key is in-memory) and costs less (because KMS is only called
      during Lambda cold starts to decrypt the key). The KMS option is more
      secure (because it's impossible for the key to leak) but it's
      significantly more expensive due to KMS API calls for every signing
      operation.
    Default: ParameterStore
    AllowedValues:
      - KMS
      - ParameterStore
  LogLevelApplicationParameter:
    Type: String
    Description: |
      Choose the log level for application logs that are sent to CloudWatch
      Logs.
    Default: ERROR
    AllowedValues:
      - DEBUG
      - ERROR
  LogLevelSystemParameter:
    Type: String
    Description: |
      Choose the log level for Lambda system-generated logs that are sent to
      CloudWatch Logs.
    Default: WARN
    AllowedValues:
      - DEBUG
      - INFO
      - WARN
Conditions:
  IsKeyCustodianKms: !Equals [!Ref KeyCustodianParameter, KMS]
  IsKeyCustodianParameterStore:
    !Equals [!Ref KeyCustodianParameter, ParameterStore]
Globals:
  Function:
    Runtime: provided.al2023
    Handler: bootstrap
    Timeout: 2
    MemorySize: 128
    Architectures: [arm64]
    LoggingConfig:
      ApplicationLogLevel: !Ref LogLevelApplicationParameter
      LogFormat: JSON
      SystemLogLevel: !Ref LogLevelSystemParameter
    Environment:
      Variables:
        SIGNING_KEY_ARN: !If [IsKeyCustodianKms, !GetAtt Key.Arn, ""]
        STACK_ARN: !Ref AWS::StackId
Resources:
  Key:
    Type: AWS::KMS::Key
    Condition: IsKeyCustodianKms
    Properties:
      Description: JWT Issuer Signing Key
      EnableKeyRotation: false
      KeyPolicy:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Principal:
              AWS: !Sub arn:${AWS::Partition}:iam::${AWS::AccountId}:root
            Action: kms:*
            Resource: "*"
      KeySpec: ECC_NIST_P256
      KeyUsage: SIGN_VERIFY
  KeyGeneratorParameterStoreCustomResource:
    Type: Custom::KeyGeneratorParameterStoreCustomResource
    Condition: IsKeyCustodianParameterStore
    Properties:
      ServiceToken: !GetAtt KeyGeneratorParameterStore.Arn
      Version: "1"
  KeyGeneratorParameterStore:
    Type: AWS::Serverless::Function
    Condition: IsKeyCustodianParameterStore
    Properties:
      CodeUri: ./bin/key_generator
      Policies:
        - Statement:
            - Effect: Allow
              Action:
                - ssm:PutParameter
                - ssm:DeleteParameters
              Resource:
                - !Sub
                  - arn:${AWS::Partition}:ssm:${AWS::Region}:${AWS::AccountId}:parameter/jwt-issuer/${StackPath}/private-key
                  - StackPath: !Select [5, !Split [":", !Ref AWS::StackId]]
                - !Sub
                  - arn:${AWS::Partition}:ssm:${AWS::Region}:${AWS::AccountId}:parameter/jwt-issuer/${StackPath}/public-key
                  - StackPath: !Select [5, !Split [":", !Ref AWS::StackId]]
  KeyInfoLoaderKmsCustomResource:
    Type: Custom::KeyInfoLoaderKmsCustomResource
    Condition: IsKeyCustodianKms
    Properties:
      KeyArn: !GetAtt Key.Arn
      ServiceToken: !GetAtt KeyInfoLoaderKms.Arn
      Version: "1"
  KeyInfoLoaderKms:
    Type: AWS::Serverless::Function
    Condition: IsKeyCustodianKms
    Properties:
      CodeUri: ./bin/key_info_loader
      Policies:
        - Statement:
            - Effect: Allow
              Action:
                - kms:GetPublicKey
              Resource:
                - !GetAtt Key.Arn
  JwtIssuerKms:
    Type: AWS::Serverless::Function
    Condition: IsKeyCustodianKms
    Properties:
      CodeUri: ./bin/jwt_issuer_kms
      MemorySize: 384
      Policies:
        - Statement:
            - Effect: Allow
              Action:
                - kms:Sign
              Resource:
                - !GetAtt Key.Arn
  JwtIssuerParameterStore:
    Type: AWS::Serverless::Function
    Condition: IsKeyCustodianParameterStore
    Properties:
      CodeUri: ./bin/jwt_issuer_parameter_store
      Policies:
        - Statement:
            - Effect: Allow
              Action:
                - ssm:GetParameter
              Resource:
                - !Sub
                  - arn:${AWS::Partition}:ssm:${AWS::Region}:${AWS::AccountId}:parameter/jwt-issuer/${StackPath}/private-key
                  - StackPath: !Select [5, !Split [":", !Ref AWS::StackId]]
                - !Sub
                  - arn:${AWS::Partition}:ssm:${AWS::Region}:${AWS::AccountId}:parameter/jwt-issuer/${StackPath}/public-key
                  - StackPath: !Select [5, !Split [":", !Ref AWS::StackId]]
Outputs:
  JwtIssuerFunctionArn:
    Value: !If
      - IsKeyCustodianKms
      - !GetAtt JwtIssuerKms.Arn
      - !GetAtt JwtIssuerParameterStore.Arn
  KeyArn:
    Value: !If
      - IsKeyCustodianKms
      - !GetAtt KeyInfoLoaderKmsCustomResource.KeyArn
      - !GetAtt KeyGeneratorParameterStoreCustomResource.KeyArn
  KeyID:
    Value: !If
      - IsKeyCustodianKms
      - !GetAtt KeyInfoLoaderKmsCustomResource.KeyID
      - !GetAtt KeyGeneratorParameterStoreCustomResource.KeyID
  PublicKeyPEMBase64:
    Value: !If
      - IsKeyCustodianKms
      - !GetAtt KeyInfoLoaderKmsCustomResource.PublicKeyPEMBase64
      - !GetAtt KeyGeneratorParameterStoreCustomResource.PublicKeyPEMBase64
  SigningMethod:
    Value: !If
      - IsKeyCustodianKms
      - !GetAtt KeyInfoLoaderKmsCustomResource.SigningMethod
      - !GetAtt KeyGeneratorParameterStoreCustomResource.SigningMethod
  Version:
    Value: v1.0