sftp.config.yaml

# used as the CNAME dns record and in tagging
server_name: sftp

# API_GATEWAY | SERVICE_MANAGED
identity_provider: service_managed

# PUBLIC | VPC_ENDPOINT | VPC
endpoint: public

# when endpoint type is set to VPC you can opt to make 
# the transfer server public by attaching Elastic IPs.
vpc_public: false
max_availability_zones: 3

# PUBLIC | VPC_ENDPOINT
apigateway_endpoint: public

# only has effect if identity_provider == API_GATEWAY
# true | false
dynamic_users: false

# Custom resource to get the private ips of the private vpc endpoint
# set to true if you want to add the vpc endpoint to a target group
output_vpc_endpoint_ips: false

# if endpoint is set to VPC_ENDPOINT a security group is attached.
# use the white list to controll access to the sft server.
# ip_whitelisting:
#   - ip: 0.0.0.0/0
#     desc: public sftp access

# set the format of the hosted zone fo the sftp CNAME record using parameters
dns_format: ${EnvironmentName}.${DnsDomain}

apigateway_identity_provider:
  custom_policies:
    get-secrets:
      action:
        - secretsmanager:GetSecretValue
      resource:
        Fn::Sub: arn:aws:secretsmanager:${AWS::Region}:${AWS::AccountId}:secret:sftp/${EnvironmentName}/*
  roles:
    SftpIdentityProvider:
      policies_inline:
        - cloudwatch-logs
        - get-secrets
  functions:
    SftpIdentityProvider:
      named: true
      code: identity_provider/index.py
      handler: index.handler
      runtime: python3.11
      timeout: 30
      role: SftpIdentityProvider
      log_retention: 90
      environment:
        ENVIRONMENT_NAME:
          Ref: EnvironmentName

output_vpc_endpoint_ips_custom_resource:
  custom_policies:
    lambda:
      action:
        - lambda:InvokeFunction
      resource:
        Fn::Sub: arn:aws:lambda:${AWS::Region}:${AWS::AccountId}:function:GetVpcEndpointIPsCR
    describe-eips:
      action:
        - ec2:DescribeNetworkInterfaces
      resource: '*'
  roles:
    GetVpcEndpointIPs:
      policies_inline:
        - cloudwatch-logs
        - describe-eips
        - lambda
  functions:
    GetVpcEndpointIPsCR:
      named: true
      log_retention: 14
      code: vpc_endpoint_ips/index.py
      handler: index.handler
      runtime: python3.11
      timeout: 60
      role: GetVpcEndpointIPs

dynamic_users_create_and_cleanup:
  custom_policies:
    createuser-iam:
      action:
        - iam:GetRole
        - iam:CreateRole
        - iam:AttachRolePolicy
        - iam:PutRolePolicy
        - iam:CreatePolicy*
      resource:
        - Fn::Sub: arn:aws:iam::${AWS::AccountId}:role/*
        - Fn::Sub: arn:aws:iam::${AWS::AccountId}:policy/*
    createuser-secretsmanager:
      action:
        - secretsmanager:GetSecretValue
        - secretsmanager:DescribeSecret
        - secretsmanager:RestoreSecret
        - secretsmanager:PutSecretValue
        - secretsmanager:CreateSecret
      resource:
        Fn::Sub: arn:aws:secretsmanager:${AWS::Region}:${AWS::AccountId}:secret:*
    createuser-getrandompassword:
      action: secretsmanager:GetRandomPassword
    createuser-snspublish:
      action: sns:Publish
      resource:
        Ref: DynamicSftpUserCreatedTopic
    cleanupusers-iam:
      action:
        - iam:DeleteRolePolicy
        - iam:DeleteRole
        - iam:ListRolePolicies
      resource:
        Fn::Sub: arn:aws:iam::${AWS::AccountId}:role/*SftpAccessRole
    cleanupusers-secretsmanager:
      action:
        - secretsmanager:GetSecretValue
        - secretsmanager:DeleteSecret
      resource: 
        Fn::Sub: arn:aws:secretsmanager:${AWS::Region}:${AWS::AccountId}:secret:sftp/${EnvironmentName}/*
    cleanupusers-listsecrets:
      action: secretsmanager:ListSecrets
  roles:
    CreateDynamicSftpUser:
      policies_inline:
        - cloudwatch-logs
        - createuser-iam
        - createuser-secretsmanager
        - createuser-getrandompassword
        - createuser-snspublish
    CleanupDynamicSftpUsers:
      policies_inline:
        - cloudwatch-logs
        - cleanupusers-iam
        - cleanupusers-secretsmanager
        - cleanupusers-listsecrets
  functions:
    CreateDynamicSftpUser:
      code: create_dynamic_sftp_user/index.py
      handler: index.handler
      runtime: python3.11
      timeout: 60
      role: CreateDynamicSftpUser
      log_retention: 90
      environment:
        ENVIRONMENT_NAME:
          Ref: EnvironmentName
        USER_CREATED_SNS_TOPIC:
          Ref: DynamicSftpUserCreatedTopic
        MESSAGE_S3_PATH: 
          Ref: S3Message
        
    CleanupDynamicSftpUsers:
      code: cleanup_dynamic_sftp_users/index.py
      handler: index.handler
      runtime: python3.11
      timeout: 60
      role: CleanupDynamicSftpUsers
      log_retention: 90
      environment:
        ENVIRONMENT_NAME:
          Ref: EnvironmentName