template.yaml

AWSTemplateFormatVersion: '2010-09-09'
Transform: AWS::Serverless-2016-10-31

Description: Telegram Bot Connector

Parameters:
  TelegramBotToken:
    Type: String
    Description: Telegram bot token
    NoEcho: true
  TelegramIPsWhitelist:
    Type: CommaDelimitedList
    Description: Comma separate list of IPs of permitted senders commands message, leave empty to disable whitelist.
    Default: "149.154.160.0/20,91.108.4.0/22"
  TelegramApiEndpoint:
    Type: String
    Description: "Telegram API endpoint"
    Default: "https://api.telegram.org"
  EventsLogRetentionInDays:
    Type: Number
    Description: "Log retention in days"
    Default: 7
  TextParseMode:
    Type: String
    Description: "Test parse mode"
    Default: "MarkdownV2"
    AllowedValues:
      - "MarkdownV2"
      - "HTML"

Resources:
      
  ##
  # EventBus
  ##

  EventBus:
    Type: AWS::Events::EventBus
    Properties:
      Name: !Ref AWS::StackName

  ##
  # Events logging
  ##

  LogGroupForEvents:
    Type: AWS::Logs::LogGroup
    Properties:
      LogGroupName: !Sub "/aws/events/${EventBus}"
      RetentionInDays: !Ref EventsLogRetentionInDays
  
  LogsRule:
    Type: AWS::Events::Rule
    Properties:
      EventBusName: !Ref EventBus
      State: "ENABLED"
      EventPattern:
        account:
          - !Ref AWS::AccountId
      Targets: 
        - Id: "logging"
          Arn: !Sub "arn:aws:logs:${AWS::Region}:${AWS::AccountId}:log-group:${LogGroupForEvents}"

  LogGroupPolicyForEvents:
    Type: AWS::Logs::ResourcePolicy
    Properties:
      PolicyName: !Sub "${AWS::StackName}-events-logging"
      PolicyDocument: !Sub >
        {
          "Version": "2012-10-17",
          "Statement": [
            {
              "Sid": "EventBridgetoCWLogsCreateLogStreamPolicy",
              "Effect": "Allow",
              "Principal": {
                "Service": [
                  "events.amazonaws.com"
                ]
              },
              "Action": [
                "logs:CreateLogStream"
              ],
              "Resource": [
                "${LogGroupForEvents.Arn}"
              ]
            },
            {
              "Sid": "EventBridgetoCWLogsPutLogEventsPolicy",
              "Effect": "Allow",
              "Principal": {
                "Service": [
                  "events.amazonaws.com"
                ]
              },
              "Action": [
                "logs:PutLogEvents"
              ],
              "Resource": [
                "${LogGroupForEvents.Arn}"
              ],
              "Condition": {
                "ArnEquals": {"AWS:SourceArn": "${LogsRule.Arn}"}
              }
            }
          ]
        }

  ##
  # IAM role for EventBridge and API Gateway
  ##

  EventsApiDestinationRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Action:
              - sts:AssumeRole
            Principal:
              Service:
                - events.amazonaws.com
      Path: '/service-role/'
      Policies:
        - PolicyName: eventbridge-api-destinations
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Effect: Allow
                Action:
                  - events:InvokeApiDestination
                Resource: 
                  - !GetAtt BotApiDestination.Arn

  WebhookEventBridgeRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Action:
              - 'sts:AssumeRole'
            Principal:
              Service:
                - apigateway.amazonaws.com
      Path: '/service-role/'
      Policies:
        - PolicyName: api-gateway-eventbridge
          PolicyDocument:
            Version: 2012-10-17
            Statement:
              - Effect: Allow
                Action:
                  - 'events:PutEvents'
                Resource:
                  - !GetAtt EventBus.Arn

  ##
  # EventBus API Connection for Telegram
  ##

  BotApiConnection:
    Type: AWS::Events::Connection
    Properties:
      AuthorizationType: API_KEY
      AuthParameters:
        ApiKeyAuthParameters:
          ApiKeyName: x-api-key
          ApiKeyValue: NoValue

  BotApiDestination:
    Type: AWS::Events::ApiDestination
    Properties:
      Name: !Sub "${AWS::StackName}"
      ConnectionArn: !GetAtt BotApiConnection.Arn
      HttpMethod: POST
      InvocationEndpoint: !Sub "${TelegramApiEndpoint}/bot${TelegramBotToken}/*"
      InvocationRateLimitPerSecond: 10

  ##
  # Telegram settings API mapping
  ##

  SetWebhookRule:
    Type: AWS::Events::Rule
    Properties:
      State: ENABLED
      EventBusName: !Ref EventBus
      EventPattern:
        detail-type: ['Set Webhook']
      Targets:
        - Id: telegram-destination
          Arn: !GetAtt BotApiDestination.Arn
          RoleArn: !GetAtt EventsApiDestinationRole.Arn
          HttpParameters:
            PathParameterValues:
              - 'setWebhook'
          InputTransformer:
            InputPathsMap:
              "url": "$.detail.url"
            InputTemplate: |
              {
                "url": "<url>"
              }

  SetChatMenuButtonRule:
    Type: AWS::Events::Rule
    Properties:
      State: ENABLED
      EventBusName: !Ref EventBus
      EventPattern:
        detail-type: ['Set Chat Menu Button']
      Targets:
        - Id: telegram-destination
          Arn: !GetAtt BotApiDestination.Arn
          RoleArn: !GetAtt EventsApiDestinationRole.Arn
          HttpParameters:
            PathParameterValues:
              - 'setChatMenuButton'
          InputTransformer:
            InputPathsMap:
              "chat_id": "$.detail.chat_id"
              "menu_button": "$.detail.menu_button"
            InputTemplate: |
              {
                "chat_id": "<chat_id>",
                "menu_button": <menu_button>
              }

  ##
  # Telegram message API mapping
  ##

  SendMessageRule:
    Type: AWS::Events::Rule
    Properties:
      State: ENABLED
      EventBusName: !Ref EventBus
      EventPattern:
        detail-type: ['Send Message']
      Targets:
        - Id: telegram-destination
          Arn: !GetAtt BotApiDestination.Arn
          RoleArn: !GetAtt EventsApiDestinationRole.Arn
          HttpParameters:
            PathParameterValues:
              - 'sendMessage'
          InputTransformer:
            InputPathsMap:
              "chat_id": "$.detail.chat_id"
              "text": "$.detail.text"
            InputTemplate: !Sub |
              {
                "chat_id": "<chat_id>",
                "text": "<text>",
                "parse_mode": "${TextParseMode}",
                "reply_markup": {
                  "remove_keyboard": true
                }
              }

  EditMessageRule:
    Type: AWS::Events::Rule
    Properties:
      State: ENABLED
      EventBusName: !Ref EventBus
      EventPattern:
        detail-type: ['Edit Message']
      Targets:
        - Id: telegram-destination
          Arn: !GetAtt BotApiDestination.Arn
          RoleArn: !GetAtt EventsApiDestinationRole.Arn
          HttpParameters:
            PathParameterValues:
              - 'editMessageText'
          InputTransformer:
            InputPathsMap:
              "chat_id": "$.detail.chat_id"
              "message_id": "$.detail.message_id"
              "text": "$.detail.text"
            InputTemplate: !Sub |
              {
                "chat_id": "<chat_id>",
                "message_id": "<message_id>",
                "text": "<text>",
                "parse_mode": "${TextParseMode}"
              }

  SendMessageWithKeyboardRule:
    Type: AWS::Events::Rule
    Properties:
      State: ENABLED
      EventBusName: !Ref EventBus
      EventPattern:
        detail-type: ['Send Message With Keyboard']
      Targets:
        - Id: telegram-destination
          Arn: !GetAtt BotApiDestination.Arn
          RoleArn: !GetAtt EventsApiDestinationRole.Arn
          HttpParameters:
            PathParameterValues:
              - 'sendMessage'
          InputTransformer:
            InputPathsMap:
              "chat_id": "$.detail.chat_id"
              "text": "$.detail.text"
              "keyboard": "$.detail.keyboard"
            InputTemplate: !Sub |
              {
                "chat_id": "<chat_id>",
                "text": "<text>",
                "parse_mode": "${TextParseMode}",
                "reply_markup": {
                  "keyboard": <keyboard>,
                  "one_time_keyboard": true,
                  "resize_keyboard": true
                }
              }
              
  SendMessageWithInlineKeyboardRule:
    Type: AWS::Events::Rule
    Properties:
      State: ENABLED
      EventBusName: !Ref EventBus
      EventPattern:
        detail-type: ['Send Message With Inline Keyboard']
      Targets:
        - Id: telegram-destination
          Arn: !GetAtt BotApiDestination.Arn
          RoleArn: !GetAtt EventsApiDestinationRole.Arn
          HttpParameters:
            PathParameterValues:
              - 'sendMessage'
          InputTransformer:
            InputPathsMap:
              "chat_id": "$.detail.chat_id"
              "text": "$.detail.text"
              "keyboard": "$.detail.keyboard"
            InputTemplate: !Sub |
              {
                "chat_id": "<chat_id>",
                "text": "<text>",
                "parse_mode": "${TextParseMode}",
                "reply_markup": {
                  "inline_keyboard": [<keyboard>]
                }
              }

  ##
  # Telegram actions API mapping
  ##

  SendChatActionRule:
    Type: AWS::Events::Rule
    Properties:
      State: ENABLED
      EventBusName: !Ref EventBus
      EventPattern:
        detail-type: ['Send Chat Action']
      Targets:
        - Id: telegram-destination
          Arn: !GetAtt BotApiDestination.Arn
          RoleArn: !GetAtt EventsApiDestinationRole.Arn
          HttpParameters:
            PathParameterValues:
              - 'sendChatAction'
          InputTransformer:
            InputPathsMap:
              "chat_id": "$.detail.chat_id"
              "action": "$.detail.action"
            InputTemplate: |
              {
                "chat_id": "<chat_id>",
                "action": "<action>"
              }

  ##
  # Telegram callbacks API mapping
  ##

  AnswerWebAppQueryRule:
    Type: AWS::Events::Rule
    Properties:
      State: ENABLED
      EventBusName: !Ref EventBus
      EventPattern:
        detail-type: ['Answer Inline Query']
      Targets:
        - Id: telegram-destination
          Arn: !GetAtt BotApiDestination.Arn
          RoleArn: !GetAtt EventsApiDestinationRole.Arn
          HttpParameters:
            PathParameterValues:
              - 'answerInlineQuery'
          InputTransformer:
            InputPathsMap:
              "inline_query_id": "$.detail.inline_query_id"
              "results": "$.detail.results"
            InputTemplate: |
              {
                "inline_query_id": "<inline_query_id>",
                "results": <results>
              }

  ##
  # Rest API endpoint for webhook
  ##

  WebhookApiRole:
    Type: "AWS::IAM::Role"
    Properties:
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: "Allow"
            Principal:
              Service: "apigateway.amazonaws.com"
            Action: 
              - "sts:AssumeRole"
      Policies:
        - PolicyName: ApiDirectWriteEventBridge
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              Action:
                - events:PutEvents
              Effect: Allow
              Resource:
                - !GetAtt EventBus.Arn

  WebhookApi:
    Type: AWS::Serverless::Api
    Properties:
      Name: !Ref AWS::StackName
      StageName: webhook
      Auth:
        ResourcePolicy:
          IpRangeWhitelist: !Ref TelegramIPsWhitelist
      GatewayResponses:
        DEFAULT_4xx:
          StatusCode: 403
          ResponseTemplates: 
            "text/plain": "Forbidden"
        DEFAULT_5xx:
          StatusCode: 500
          ResponseTemplates:
            "text/plain": "Internal Server Error"
      DefinitionBody:
        swagger: 2.0
        info:
          title: "Telegram Bot Webhook"
        schemes:
          - "https"
        paths:
          /:
            post:
              consumes:
                - "application/json"
              produces:
                - "application/json"
              responses:
                "200":
                  description: "200 response"
              x-amazon-apigateway-integration:
                type: "aws"
                httpMethod: "POST"
                uri: !Sub "arn:aws:apigateway:${AWS::Region}:events:action/PutEvents"
                requestTemplates:
                  application/json: !Sub | 
                    #set($context.requestOverride.header.X-Amz-Target = "AWSEvents.PutEvents")
                    #set($context.requestOverride.header.Content-Type = "application/x-amz-json-1.1")
                    {
                      "Entries": [{
                        "EventBusName": "${EventBus}",
                        "Detail": "$util.escapeJavaScript($input.body).replaceAll("\\'","'")",
                        "DetailType": "Webhook Event Received",
                        "Source": "org.telegram.webhook"
                      }]
                    }
                responses:
                  default:
                    statusCode: "200"
                    responseTemplates:
                      "application/json": "{}"
                credentials: !GetAtt WebhookApiRole.Arn
                passthroughBehavior: "when_no_templates"

  ##
  # StepFunctions for connector management
  ##

  InstallStateMachine:
    Type: AWS::Serverless::StateMachine
    Properties:
      Name: !Sub "${AWS::StackName}-install"
      DefinitionUri: states/install.asl.yaml
      DefinitionSubstitutions:
        EventBusName: !Ref EventBus
        EventSource: !Ref AWS::StackName
        WebhookEndpoint: !Sub "https://${WebhookApi}.execute-api.${AWS::Region}.amazonaws.com/webhook/"
      Policies:
        - EventBridgePutEventsPolicy:
            EventBusName: !Ref EventBus
      Events:
        StackCreated:
          Type: EventBridgeRule
          Properties:
            EventBusName: default
            Pattern:
              source:
                - aws.cloudformation
              detail-type:
                - CloudFormation Stack Status Change
              detail:
                stack-id:
                  - !Ref AWS::StackId
                status-details:
                  status:
                    - CREATE_COMPLETE

Outputs:
  WebhookEndpoint:
    Description: The Telegram bot Webhook URL
    Value: !Sub "https://${WebhookApi}.execute-api.${AWS::Region}.amazonaws.com/webhook/"
  EventBusName:
    Description: Name of EventBridge bus used for bi-directional communication
    Value: !Ref EventBus
  LogGroupForEvents:
    Description: Name of CloudWatch Log Group for EventBridge events logging
    Value: !Ref LogGroupForEvents