serverless.yml

service: graphql

provider:
  name: aws
  runtime: nodejs18.x
  region: us-east-1
  stage: ${opt:stage, 'development'}
  endpointType: PRIVATE
  memorySize: 512

  environment: ${file(./serverless-configs/env.yml):${self:provider.stage}}

  vpc:
    securityGroupIds:
      - Fn::ImportValue: ${self:provider.stage}-GraphQLLambdaSecurityGroup
    subnetIds:
      - ${env:SUBNET_ID_A, 'subnetIdA'}
      - ${env:SUBNET_ID_B, 'subnetIdB'}

  iam:
    role:
      Fn::ImportValue: ${self:provider.stage}-GraphQLApplicationRole

# Package each lambda into individual zip files. This reduces the size of
# each lambda but increases the complexity of the compilation process slightly
package:
  individually: true
  patterns:
    - '!venv/**'
    - '!__pycache__/**'

plugins:
  - serverless-esbuild
  - serverless-offline
  - serverless-plugin-log-subscription
  - serverless-python-requirements

functions:
  graphql:
    handler: src/graphql/handler.default
    timeout: ${env:LAMBDA_TIMEOUT, '30'}
    events:
    - http:
        path: api
        method: post
        cors:
          origin: '*'
          headers:
            - Client-Id
            - Content-Type
            - X-Request-Id
    - http:
        path: api
        method: get
        cors: true

  cloudfrontToCloudwatch:
    handler: src/cloudfrontToCloudwatch/handler.default
    timeout: 300
    role: IamRoleCustomResourcesLambdaExecution
    events:
      - s3:
          bucket: ${env:CLOUDFRONT_BUCKET_NAME, ''}
          event: s3:ObjectCreated:*
          existing: true
          rules:
            - suffix: .gz
            - prefix:
                Fn::Join: [
                  "/", [
                    "cloudfront/AWSLogs",
                    {
                      "Ref": "AWS::AccountId"
                    },
                    "${self:provider.region}/graphql_apigw/"
                  ]
                ]

  earthdataVarinfo:
    runtime: python3.9
    handler: src/earthdataVarinfo/handler.main
    ephemeralStorageSize: 2048
    timeout: ${env:LAMBDA_TIMEOUT, '30'}
    package:
      patterns:
        - '!node_modules/**'

resources:
  Resources:
    # This role must not be changed -- if it is removed Serverless will attempt to automatically
    # recreate it and deployments will fail because our permissions boundary does not allow for
    # creation of roles. This role is used specifically for S3 Lambda triggers that use existing
    # buckets, which is what we're using for forwarding cloudfront logs to Splunk.
    IamRoleCustomResourcesLambdaExecution:
      Type: AWS::IAM::Role
      Properties:
        ManagedPolicyArns:
          - arn:aws:iam::aws:policy/service-role/AWSLambdaVPCAccessExecutionRole
        PermissionsBoundary:
          Fn::Join: [
            "", [
              "arn:aws:iam::",
              {
                "Ref": "AWS::AccountId"
              },
              ":policy/NGAPShRoleBoundary"
            ]
          ]
        AssumeRolePolicyDocument:
          Version: '2012-10-17'
          Statement:
            - Effect: Allow
              Principal:
                Service:
                  - lambda.amazonaws.com
              Action: sts:AssumeRole

    S3CloudfrontLogToCloudwatchPolicy:
      Type: AWS::IAM::Policy
      Properties:
        PolicyDocument:
          Version: "2012-10-17"
          Statement:
            -
              Action:
                - "s3:GetBucketLocation"
                - "s3:ListBucket"
                - "s3:ListAllMyBuckets"
                - "s3:GetObject"
              Effect: "Allow"
              Resource: "*"
        PolicyName: ${self:provider.stage}-S3CloudfrontLogToCloudwatchPolicy
        Roles:
          - Ref: IamRoleCustomResourcesLambdaExecution

configValidationMode: error

custom:
  siteName: graphql-${self:provider.stage}

  # Default is 3000 so to avoid conflicts with other applications we'll define a new port
  serverless-offline:
    httpPort: 3013
    lambdaPort: 3014
    reloadHandler: true
    # Uncomment useInProcess to enable in-process run mode
    # https://github.com/dherault/serverless-offline#run-modes
    # useInProcess: true

  minifyBuild:
    development: false
    sit: true
    uat: true
    prod: true

  esbuild:
    loader:
      .graphql: text
      .gql: text
    minify: ${self:custom.minifyBuild.${self:provider.stage}}
    exclude:
      - '@aws-sdk/client-lambda'
      - '@aws-sdk/client-s3'

  # Forward logs to Splunk
  logSubscription:
    enabled: true
    destinationArn: ${env:LOG_DESTINATION_ARN, ''}

  # Compile Python modules on docker only on non-linux environments
  pythonRequirements:
    dockerizePip: non-linux
    zip: true
    slim: true