serverless.yml

service:
  name: serverless-instagram-app

plugins:
  - serverless-webpack
  - serverless-iam-roles-per-function
  - serverless-dynamodb-local
  - serverless-offline

provider:
  name: aws
  runtime: nodejs12.x

  stage: ${opt:stage, 'dev'}
  region: ${opt:region, 'us-east-2'}

  tracing:
    lambda: true
    apiGateway: true

  environment:
    FEEDS_TABLE: feeds-${self:provider.stage}
    FEED_INDEX_NAME: FeedIdIndex
    IMAGES_S3_BUCKET: instagram-harriet-${self:provider.stage}

custom:
  serverless-offline:
    port: 3000

  dynamodb:
    start:
      port: 8001
      inMemory: true
      migrate: true

functions:
  Auth:
    handler: src/lambda/auth/auth0Authorizer.handler

  GetFeeds:
    handler: src/lambda/http/getFeeds.handler
    events:
      - http:
          method: get
          path: feeds
          cors: true
          authorizer: Auth
    iamRoleStatements:
      - Effect: Allow
        Action:
          - dynamodb:Query
        Resource: arn:aws:dynamodb:${self:provider.region}:*:table/${self:provider.environment.FEEDS_TABLE}
      - Effect: Allow
        Action:
          - dynamodb:Query
        Resource: arn:aws:dynamodb:${self:provider.region}:*:table/${self:provider.environment.FEEDS_TABLE}/index/${self:provider.environment.FEED_INDEX_NAME}
      - Effect: Allow
        Action:
          - xray:PutTraceSegments
          - xray:PutTelemetryRecords
        Resource: "*"

  CreateFeeds:
    handler: src/lambda/http/createFeed.handler
    events:
      - http:
          method: post
          path: feeds
          cors: true
          authorizer: Auth
          request:
            schema:
              application/json: ${file(models/create-feed-request.json)}
    iamRoleStatements:
      - Effect: Allow
        Action:
          - dynamodb:PutItem
        Resource: arn:aws:dynamodb:${self:provider.region}:*:table/${self:provider.environment.FEEDS_TABLE}
      - Effect: Allow
        Action:
          - xray:PutTraceSegments
          - xray:PutTelemetryRecords
        Resource: "*"

  UpdateFeed:
    handler: src/lambda/http/updateFeed.handler
    events:
      - http:
          method: patch
          path: feeds/{feedId}
          cors: true
          authorizer: Auth
          request:
            schema:
              application/json: ${file(models/update-feed-request.json)}
    iamRoleStatements:
      - Effect: Allow
        Action:
          - dynamodb:UpdateItem
        Resource: arn:aws:dynamodb:${self:provider.region}:*:table/${self:provider.environment.FEEDS_TABLE}
      - Effect: Allow
        Action:
          - xray:PutTraceSegments
          - xray:PutTelemetryRecords
        Resource: "*"

  DeleteFeed:
    handler: src/lambda/http/deleteFeed.handler
    events:
      - http:
          method: delete
          path: feeds/{feedId}
          cors: true
          authorizer: Auth
    iamRoleStatements:
      - Effect: Allow
        Action:
          - dynamodb:DeleteItem
        Resource: arn:aws:dynamodb:${self:provider.region}:*:table/${self:provider.environment.FEEDS_TABLE}
      - Effect: Allow
        Action:
          - xray:PutTraceSegments
          - xray:PutTelemetryRecords
        Resource: "*"

  GenerateUrl:
    handler: src/lambda/http/generateUploadUrl.handler
    events:
      - http:
          method: post
          path: feeds/attachment/{imageKey}
          cors: true
          authorizer: Auth
    iamRoleStatements:
      - Effect: Allow
        Action:
          - dynamodb:Query
          - dynamodb:UpdateItem
        Resource: arn:aws:dynamodb:${self:provider.region}:*:table/${self:provider.environment.FEEDS_TABLE}
      - Effect: Allow
        Action:
          - dynamodb:Query
        Resource: arn:aws:dynamodb:${self:provider.region}:*:table/${self:provider.environment.FEEDS_TABLE}/index/${self:provider.environment.FEED_INDEX_NAME}
      - Effect: Allow
        Action:
          - s3:PutObject
          - s3:GetObject
        Resource: arn:aws:s3:::${self:provider.environment.IMAGES_S3_BUCKET}/*
      - Effect: Allow
        Action:
          - xray:PutTraceSegments
          - xray:PutTelemetryRecords
        Resource: "*"

resources:
  Resources:
    GatewayResponseDefault4XX:
      Type: AWS::ApiGateway::GatewayResponse
      Properties:
        ResponseParameters:
          gatewayresponse.header.Access-Control-Allow-Origin: "'*'"
          gatewayresponse.header.Access-Control-Allow-Headers: "'Content-Type,X-Amz-Date,Authorization,X-Api-Key,X-Amz-Security-Token'"
          gatewayresponse.header.Access-Control-Allow-Methods: "'GET,OPTIONS,POST'"
        ResponseType: DEFAULT_4XX
        RestApiId:
          Ref: ApiGatewayRestApi

    FeedsTable:
      Type: AWS::DynamoDB::Table
      Properties:
        AttributeDefinitions:
          - AttributeName: feedId
            AttributeType: S
          - AttributeName: createdAt
            AttributeType: S
          - AttributeName: userId
            AttributeType: S
        KeySchema:
          - AttributeName: userId
            KeyType: HASH
          - AttributeName: feedId
            KeyType: RANGE
        BillingMode: PAY_PER_REQUEST
        TableName: ${self:provider.environment.FEEDS_TABLE}
        GlobalSecondaryIndexes:
          - IndexName: ${self:provider.environment.FEED_INDEX_NAME}
            KeySchema:
              - AttributeName: createdAt
                KeyType: HASH
            Projection:
              ProjectionType: ALL

    AttachmentsBucket:
      Type: AWS::S3::Bucket
      Properties:
        BucketName: ${self:provider.environment.IMAGES_S3_BUCKET}
        CorsConfiguration:
          CorsRules:
            - AllowedOrigins:
                - "*"
              AllowedHeaders:
                - "*"
              AllowedMethods:
                - GET
                - PUT
                - POST
                - DELETE
                - HEAD
              MaxAge: 3000

    BucketPolicy:
      Type: AWS::S3::BucketPolicy
      Properties:
        PolicyDocument:
          Id: MyPolicy
          Version: "2012-10-17"
          Statement:
            - Sid: PublicReadForGetBucketObjects
              Effect: Allow
              Principal: "*"
              Action: "s3:GetObject"
              Resource: "arn:aws:s3:::${self:provider.environment.IMAGES_S3_BUCKET}/*"
        Bucket: !Ref AttachmentsBucket