#167 - Add support for GovCloud (US) Regions

formkiq · Sep 3, 2023 · 81449f1 · 81449f1
1 parent 3ee9edd
commit 81449f1
Show file tree

Hide file tree

Showing 18 changed files with 380 additions and 150 deletions.
diff --git a/build.gradle b/build.gradle
@@ -25,7 +25,7 @@ def getCmdParam() {
 repositories { mavenCentral() }
 
 allprojects {
-  version = '1.12.0'
+  version = '1.12.1'
   ext.awsCognitoVersion = '1.5.1'
   group = 'com.formkiq.stacks'
 

diff --git a/console/src/main/resources/cloudformation/template-install.yaml b/console/src/main/resources/cloudformation/template-install.yaml
@@ -101,6 +101,10 @@ Parameters:
     Type: String
     Default: ""
 
+  Partition:
+    Description: The partition in which the resource is located. A partition is a group of AWS Regions
+    Type: String
+
 Conditions:
 
   HasCertificateStackName:
@@ -224,7 +228,7 @@ Resources:
               Action:
               - ssm:GetParameter
               Resource: 
-              - Fn::Sub: "arn:aws:ssm:${AWS::Region}:${AWS::AccountId}:parameter/formkiq/*"
+              - Fn::Sub: "arn:${Partition}:ssm:${AWS::Region}:${AWS::AccountId}:parameter/formkiq/*"
             - Effect: Allow
               Action:
               - s3:GetObject
@@ -234,11 +238,11 @@ Resources:
               Resource: 
               - Fn::Join:
                 - ''
-                - - 'arn:aws:s3:::'
+                - - Fn::Sub: "arn:${Partition}:s3:::"
                   - Ref: ConsoleBucket
               - Fn::Join:
                 - ''
-                - - 'arn:aws:s3:::'
+                - - Fn::Sub: "arn:${Partition}:s3:::"
                   - Ref: ConsoleBucket
                   - '/*'
             - Effect: Allow
@@ -249,11 +253,11 @@ Resources:
               Resource:
               - Fn::Join:
                 - ''
-                - - 'arn:aws:s3:::'
+                - - Fn::Sub: "arn:${Partition}:s3:::"
                   - Ref: CognitoConfigBucket
               - Fn::Join:
                 - ''
-                - - 'arn:aws:s3:::'
+                - - Fn::Sub: "arn:${Partition}:s3:::"
                   - Ref: CognitoConfigBucket
                   - '/*'
             - Effect: Allow
@@ -262,7 +266,7 @@ Resources:
               Resource: 
               - Fn::Join:
                 - ''
-                - - 'arn:aws:s3:::'
+                - - Fn::Sub: "arn:${Partition}:s3:::"
                   - Ref: DistributionBucket
                   - '/*'
             - Effect: Allow

diff --git a/console/src/main/resources/cloudformation/template-users.yaml b/console/src/main/resources/cloudformation/template-users.yaml
@@ -40,6 +40,10 @@ Parameters:
     Description: Cognito User Pool Client
     AllowedPattern: ".+"    
 
+  Partition:
+    Description: The partition in which the resource is located. A partition is a group of AWS Regions
+    Type: String
+
 Resources:
 
   ConsoleAdminUser:
@@ -203,7 +207,7 @@ Resources:
               - "sts:AssumeRole"
       Path: "/"
       ManagedPolicyArns:
-      - arn:aws:iam::aws:policy/service-role/AWSLambdaVPCAccessExecutionRole      
+      - Fn::Sub: "arn:${Partition}:iam::${Partition}:policy/service-role/AWSLambdaVPCAccessExecutionRole"      
       Policies: 
         - 
           PolicyName: 

diff --git a/console/src/main/resources/cloudformation/template.yaml b/console/src/main/resources/cloudformation/template.yaml
@@ -37,7 +37,22 @@ Conditions:
       - Fn::Equals: 
         - Ref: CertificateStackName
         - ''
-
+
+  IsNotGovCloud:
+    Fn::And:
+      - Fn::Not:
+          - Fn::Equals:
+              - Ref: AWS::Region
+              - us-east-2
+      - Fn::Not:
+          - Fn::Equals:
+              - Ref: AWS::Region
+              - us-gov-west-1
+      - Fn::Not:
+          - Fn::Equals:
+              - Ref: AWS::Region
+              - us-gov-east-1
+
 Resources:
 
   Console:
@@ -158,6 +173,7 @@ Resources:
 
   CloudFrontDistribution:
     Type: AWS::CloudFront::Distribution
+    Condition: IsNotGovCloud
     Properties:
       DistributionConfig:
         Origins:
@@ -228,6 +244,7 @@ Resources:
 
   ConsoleUrlParameter:
     Type: AWS::SSM::Parameter
+    Condition: IsNotGovCloud
     Properties:
       Description: "The URL for the FormKiQ Console"
       Name: 
@@ -258,13 +275,15 @@ Resources:
           Fn::Sub: "${AWS::StackName}"
 
   CloudFrontOriginAccessIdentity:
+    Condition: IsNotGovCloud
     Type: AWS::CloudFront::CloudFrontOriginAccessIdentity
     Properties:
       CloudFrontOriginAccessIdentityConfig:
         Comment: 
           Fn::Sub: "FormKiQ Console CloudFront Identity"
 
   ConsoleBucketPolicy:
+    Condition: IsNotGovCloud
     Type: "AWS::S3::BucketPolicy"
     Properties: 
       Bucket: 
@@ -303,13 +322,16 @@ Outputs:
             - 'https://'
             - Fn::ImportValue:
                 Fn::Sub: '${CertificateStackName}-ConsoleDomain'
-      - Fn::Join: 
-          - ""
-          - 
-            - 'https://'
-            - Fn::GetAtt:
-              - CloudFrontDistribution
-              - DomainName
+      - Fn::If:
+        - IsNotGovCloud
+        - Fn::Join: 
+            - ""
+            - 
+              - 'https://'
+              - Fn::GetAtt:
+                - CloudFrontDistribution
+                - DomainName
+        - "none"
 
   ConsoleBucket:
     Value:
@@ -329,6 +351,9 @@ Outputs:
 
   CloudFrontDistributionDomainName:
     Value:
-      Fn::GetAtt:
-      - CloudFrontDistribution
-      - DomainName
+      Fn::If:
+      - IsNotGovCloud
+      - Fn::GetAtt:
+        - CloudFrontDistribution
+        - DomainName
+      - ""
diff --git a/docs/openapi/openapi-iam.yaml b/docs/openapi/openapi-iam.yaml
@@ -32,7 +32,7 @@
               - OAuth(JWT)
               - AWS IAM
               - API Key
-          version: 1.12.0
+          version: 1.12.1
         tags:
         - name: documents
           description: API for the add, updating and fetching of documents
@@ -4540,7 +4540,7 @@
           x-amazon-apigateway-integrations:
             lambdaApi200:
               uri:
-                Fn::Sub: arn:aws:apigateway:${AWS::Region}:lambda:path/2015-03-31/functions/${DocumentsApiRequests.Arn}/invocations
+                Fn::Sub: arn:${Partition}:apigateway:${AWS::Region}:lambda:path/2015-03-31/functions/${DocumentsApiRequests.Arn}/invocations
               responses:
                 default:
                   statusCode: "200"
@@ -4554,7 +4554,7 @@
               payloadFormatVersion: "1.0"
             ocrLambdaApi200:
               uri:
-                Fn::Sub: arn:aws:apigateway:${AWS::Region}:lambda:path/2015-03-31/functions/${DocumentsApiRequests.Arn}/invocations
+                Fn::Sub: arn:${Partition}:apigateway:${AWS::Region}:lambda:path/2015-03-31/functions/${DocumentsApiRequests.Arn}/invocations
               responses:
                 default:
                   statusCode: "200"
@@ -4568,7 +4568,7 @@
               payloadFormatVersion: "1.0"
             antivirusLambdaApi200:
               uri:
-                Fn::Sub: arn:aws:apigateway:${AWS::Region}:lambda:path/2015-03-31/functions/${DocumentsApiRequests.Arn}/invocations
+                Fn::Sub: arn:${Partition}:apigateway:${AWS::Region}:lambda:path/2015-03-31/functions/${DocumentsApiRequests.Arn}/invocations
               responses:
                 default:
                   statusCode: "200"
@@ -4582,7 +4582,7 @@
               payloadFormatVersion: "1.0"
             searchLambdaApi200:
               uri:
-                Fn::Sub: arn:aws:apigateway:${AWS::Region}:lambda:path/2015-03-31/functions/${DocumentsApiRequests.Arn}/invocations
+                Fn::Sub: arn:${Partition}:apigateway:${AWS::Region}:lambda:path/2015-03-31/functions/${DocumentsApiRequests.Arn}/invocations
               responses:
                 default:
                   statusCode: "200"
@@ -4596,7 +4596,7 @@
               payloadFormatVersion: "1.0"
             fulltextLambdaApi200:
               uri:
-                Fn::Sub: arn:aws:apigateway:${AWS::Region}:lambda:path/2015-03-31/functions/${DocumentsApiRequests.Arn}/invocations
+                Fn::Sub: arn:${Partition}:apigateway:${AWS::Region}:lambda:path/2015-03-31/functions/${DocumentsApiRequests.Arn}/invocations
               responses:
                 default:
                   statusCode: "200"
@@ -4610,7 +4610,7 @@
               payloadFormatVersion: "1.0"
             onlyOfficeLambdaApi200:
               uri:
-                Fn::Sub: arn:aws:apigateway:${AWS::Region}:lambda:path/2015-03-31/functions/${DocumentsApiRequests.Arn}/invocations
+                Fn::Sub: arn:${Partition}:apigateway:${AWS::Region}:lambda:path/2015-03-31/functions/${DocumentsApiRequests.Arn}/invocations
               responses:
                 default:
                   statusCode: "200"
@@ -4624,7 +4624,7 @@
               payloadFormatVersion: "1.0"
             esignatureLambdaApi200:
               uri:
-                Fn::Sub: arn:aws:apigateway:${AWS::Region}:lambda:path/2015-03-31/functions/${DocumentsApiRequests.Arn}/invocations
+                Fn::Sub: arn:${Partition}:apigateway:${AWS::Region}:lambda:path/2015-03-31/functions/${DocumentsApiRequests.Arn}/invocations
               responses:
                 default:
                   statusCode: "200"
@@ -4638,7 +4638,7 @@
               payloadFormatVersion: "1.0"
             lambdaApi201:
               uri:
-                Fn::Sub: arn:aws:apigateway:${AWS::Region}:lambda:path/2015-03-31/functions/${DocumentsApiRequests.Arn}/invocations
+                Fn::Sub: arn:${Partition}:apigateway:${AWS::Region}:lambda:path/2015-03-31/functions/${DocumentsApiRequests.Arn}/invocations
               responses:
                 default:
                   statusCode: "201"

diff --git a/docs/openapi/openapi-jwt.yaml b/docs/openapi/openapi-jwt.yaml
@@ -32,7 +32,7 @@
               - OAuth(JWT)
               - AWS IAM
               - API Key
-          version: 1.12.0
+          version: 1.12.1
         tags:
         - name: documents
           description: API for the add, updating and fetching of documents
@@ -4546,7 +4546,7 @@
           x-amazon-apigateway-integrations:
             lambdaApi200:
               uri:
-                Fn::Sub: arn:aws:apigateway:${AWS::Region}:lambda:path/2015-03-31/functions/${DocumentsApiRequests.Arn}/invocations
+                Fn::Sub: arn:${Partition}:apigateway:${AWS::Region}:lambda:path/2015-03-31/functions/${DocumentsApiRequests.Arn}/invocations
               responses:
                 default:
                   statusCode: "200"
@@ -4560,7 +4560,7 @@
               payloadFormatVersion: "1.0"
             ocrLambdaApi200:
               uri:
-                Fn::Sub: arn:aws:apigateway:${AWS::Region}:lambda:path/2015-03-31/functions/${DocumentsApiRequests.Arn}/invocations
+                Fn::Sub: arn:${Partition}:apigateway:${AWS::Region}:lambda:path/2015-03-31/functions/${DocumentsApiRequests.Arn}/invocations
               responses:
                 default:
                   statusCode: "200"
@@ -4574,7 +4574,7 @@
               payloadFormatVersion: "1.0"
             antivirusLambdaApi200:
               uri:
-                Fn::Sub: arn:aws:apigateway:${AWS::Region}:lambda:path/2015-03-31/functions/${DocumentsApiRequests.Arn}/invocations
+                Fn::Sub: arn:${Partition}:apigateway:${AWS::Region}:lambda:path/2015-03-31/functions/${DocumentsApiRequests.Arn}/invocations
               responses:
                 default:
                   statusCode: "200"
@@ -4588,7 +4588,7 @@
               payloadFormatVersion: "1.0"
             searchLambdaApi200:
               uri:
-                Fn::Sub: arn:aws:apigateway:${AWS::Region}:lambda:path/2015-03-31/functions/${DocumentsApiRequests.Arn}/invocations
+                Fn::Sub: arn:${Partition}:apigateway:${AWS::Region}:lambda:path/2015-03-31/functions/${DocumentsApiRequests.Arn}/invocations
               responses:
                 default:
                   statusCode: "200"
@@ -4602,7 +4602,7 @@
               payloadFormatVersion: "1.0"
             fulltextLambdaApi200:
               uri:
-                Fn::Sub: arn:aws:apigateway:${AWS::Region}:lambda:path/2015-03-31/functions/${DocumentsApiRequests.Arn}/invocations
+                Fn::Sub: arn:${Partition}:apigateway:${AWS::Region}:lambda:path/2015-03-31/functions/${DocumentsApiRequests.Arn}/invocations
               responses:
                 default:
                   statusCode: "200"
@@ -4616,7 +4616,7 @@
               payloadFormatVersion: "1.0"
             onlyOfficeLambdaApi200:
               uri:
-                Fn::Sub: arn:aws:apigateway:${AWS::Region}:lambda:path/2015-03-31/functions/${DocumentsApiRequests.Arn}/invocations
+                Fn::Sub: arn:${Partition}:apigateway:${AWS::Region}:lambda:path/2015-03-31/functions/${DocumentsApiRequests.Arn}/invocations
               responses:
                 default:
                   statusCode: "200"
@@ -4630,7 +4630,7 @@
               payloadFormatVersion: "1.0"
             esignatureLambdaApi200:
               uri:
-                Fn::Sub: arn:aws:apigateway:${AWS::Region}:lambda:path/2015-03-31/functions/${DocumentsApiRequests.Arn}/invocations
+                Fn::Sub: arn:${Partition}:apigateway:${AWS::Region}:lambda:path/2015-03-31/functions/${DocumentsApiRequests.Arn}/invocations
               responses:
                 default:
                   statusCode: "200"
@@ -4644,7 +4644,7 @@
               payloadFormatVersion: "1.0"
             lambdaApi201:
               uri:
-                Fn::Sub: arn:aws:apigateway:${AWS::Region}:lambda:path/2015-03-31/functions/${DocumentsApiRequests.Arn}/invocations
+                Fn::Sub: arn:${Partition}:apigateway:${AWS::Region}:lambda:path/2015-03-31/functions/${DocumentsApiRequests.Arn}/invocations
               responses:
                 default:
                   statusCode: "201"