serverless.yml

---
service: crossfeed

frameworkVersion: '3'
useDotenv: true
configValidationMode: error

custom:
  customDomain:
    domainName: ${file(env.yml):${self:provider.stage}.DOMAIN, ''}
    basePath: ''
    certificateName: ${file(env.yml):${self:provider.stage}.CERT_DOMAIN, ''}
    stage: ${self:provider.stage}
    createRoute53Record: false
  prune:
    automatic: true
    includeLayers: true
    number: 3
  pythonRequirements:
    dockerizePip: true
    noDeploy:
      - boto3
      - botocore
      - docker
      - pytest
      - pytest-django
      - pytest-env
      - pylint
      - mypy
      - mypy-extensions
      - python-dotenv
      - pika
      - isort
      - black
      - pipdeptree
      - MarkupSafe
      - uvloop

  # Resource policies for GovCloud (Private) vs Non-GovCloud (Regional)
  privateResourcePolicy:
    - Effect: Deny
      Principal: '*'
      Action: 'execute-api:Invoke'
      Resource: execute-api:/${self:provider.stage}/*/*
      Condition:
        StringNotEquals:
          'aws:sourceVpce': ${file(env.yml):${self:provider.stage}.VPC_ENDPOINT, ''}
    - Effect: Allow
      Principal: '*'
      Action: execute-api:Invoke
      Resource: execute-api:/${self:provider.stage}/*/*

  regionalResourcePolicy:
    - Effect: Allow
      Principal: '*'
      Action: execute-api:Invoke
      Resource: execute-api:/${self:provider.stage}/*/*
      Condition:
        IpAddress:
          aws:SourceIp:
            'Fn::Split':
              - ','
              - ${file(env.yml):${self:provider.stage}.DMZ_CIDR, ''}

  # Conditional logic for GovCloud vs
  # non-GovCloud (Private endpoints require a VPC Endpoint)
  serverlessIfElse:
    - If: '"${file(env.yml):${self:provider.stage}.ENDPOINT_TYPE}" == "PRIVATE"'
      Set:
        provider.vpcEndpointIds:
          - ${file(env.yml):${self:provider.stage}.VPC_ENDPOINT, ''}
        provider.apiGateway.resourcePolicy: ${self:custom.privateResourcePolicy}
      ElseSet:
        provider.apiGateway.resourcePolicy: ${self:custom.regionalResourcePolicy}
      ElseExclude:
        - provider.vpcEndpointIds

provider:
  name: aws
  region: ${file(env.yml):${self:provider.stage}.REGION, ''}
  endpointType: ${file(env.yml):${self:provider.stage}.ENDPOINT_TYPE, ''}
  runtime: python3.11
  timeout: 30
  stage: ${opt:stage, 'dev'}
  environment: ${file(env.yml):${self:provider.stage}, ''}
  vpc: ${file(env.yml):${self:provider.stage}-vpc, ''}
  logs:
    restApi: true
  deploymentBucket:
    serverSideEncryption: AES256
  apiGateway:
    binaryMediaTypes:
      - image/*
      - font/*
    resourcePolicy:
      - Effect: Allow
        Principal: '*'
        Action: execute-api:Invoke
        Resource: execute-api:/${self:provider.stage}/*/*

  iam:
    role:
      statements:
        # TODO: make the resources more specific. See Resource: '*' was
        - Effect: Allow
          Action:
            - lambda:InvokeAsync
            - lambda:InvokeFunction
            - cognito-idp:AdminDisableUser
            - cognito-idp:ListUsers
            - cognito-idp:AdminSetUserPassword
          Resource: '*'
        - Effect: Allow
          Action:
            - ecs:RunTask
            - ecs:ListTasks
            - ecs:DescribeTasks
            - ecs:DescribeServices
            - ecs:UpdateService
            - iam:PassRole
            - logs:GetLogEvents
          Resource: '*'
        - Effect: Allow
          Action:
            - ses:SendRawEmail
            - ses:SendEmail
          Resource: '*'
        - Effect: Allow
          Action:
            - s3:GetObject
            - s3:GetObjectAcl
            - s3:PutObject
            - s3:PutObjectAcl
            - s3:PutBucketAcl
            - s3:GetBucketAcl
          Resource: '*'
        - Effect: Allow
          Action:
            - sts:AssumeRole
          Resource: '*'
        - Effect: Allow
          Action:
            - sqs:ListQueues
            - sqs:ReceiveMessage
            - sqs:DeleteMessage
            - sqs:SendMessage
            - sqs:GetQueueAttributes
          Resource: '*'
        - Effect: Allow
          Action:
            - logs:CreateExportTask
            - logs:CreateLogStream
            - logs:Describe*
            - logs:Get*
            - logs:List*
            - logs:PutLogEvents
            - logs:StartQuery
            - logs:StopQuery
            - logs:TestMetricFilter
            - logs:FilterLogEvents
            - logs:StartLiveTail
            - logs:StopLiveTail
          Resource: '*'
        - Effect: Allow
          Action:
            - ssm:DescribeParameters
            - ssm:GetParameter
            - ssm:GetParameters
            - ssm:GetParametersByPath
            - ssm:PutParameter
          Resource: '*'

resources:
  Conditions:
    IsDMZ:
      Fn::Or:
        - Fn::Equals:
            - ${self:provider.stage}
            - staging-cd
        - Fn::Equals:
            - ${self:provider.stage}
            - integration
  Resources:
    ASMSyncQueue:
      Type: AWS::SQS::Queue
      Properties:
        QueueName: ${self:provider.stage}-asmSync-queue
        VisibilityTimeout: 18000  # 5 hours
        MaximumMessageSize: 262144  # 256 KB
        MessageRetentionPeriod: 604800  # 7 days

functions:
  - ${file(./src/tasks/functions.yml)}
  - ${file(./src/api/functions.yml)}

plugins:
  - serverless-better-credentials
  - serverless-domain-manager
  - serverless-dotenv-plugin
  - serverless-python-requirements
  - serverless-plugin-ifelse
  - serverless-prune-versions