serverless.yml

service: lambda-api-demo
plugins:
  - serverless-offline-ssm
  - serverless-offline
  - serverless-pseudo-parameters
  - serverless-dynamodb-local

custom:
  dynamodb:
    stages:
      - local
      - dev
    start:
      port: 8000
      inMemory: true
      heapInitial: 200m
      heapMax: 1g
      migrate: false
      seed: false
      convertEmptyValues: true
      noStart: true
      sharedDb: true
    seed:
      DemoTable:
        sources:
          - table: DemoDynamodbTable-${opt:stage}
            sources: [./src/data/fakeUsers.json]
  serverless-offline-ssm:
    stages:
      - 
        local
    ssm:
      '/demo/local/rds/demo-db-endpoint': 'localhost'
      '/demo/local/rds/demo-db-name': 'test'
      '/demo/local/rds/demo-db-username': 'notadmin'
      '/demo/local/rds/demo-db-password': 'notpassword'
      '/demo/local/vpc/vpc_endpoint_sns_sg': 'vpc_endpoint_sns_s'
      '/demo/local/vpc/private_subnet_a': 'private_subnet_a'
      '/demo/local/vpc/private_subnet_b': 'private_subnet_b'
      '/demo/local/lambda_security_group': 'lambda_security_group'
      '/demo/local/slack_endpoint': 'http://localhost:3001/local_webhook'
      
provider:
  name: aws
  runtime: nodejs12.x
  region: us-east-2
  timeout: 06
  tracing:
    lambda: true
    apiGateway: true
  environment:
    NODE_ENV: ${opt:stage}
    
functions:
  DemoLambda:
    role: DemoLambdaRole
    handler: src/functions/endpoints/index.handler
    vpc:
      securityGroupIds:
        - ${ssm:/demo/${opt:stage}/lambda_security_group}
        - ${ssm:/demo/${opt:stage}/vpc/vpc_endpoint_sns_sg}
      subnetIds:
        - ${ssm:/demo/${opt:stage}/vpc/private_subnet_a}
        - ${ssm:/demo/${opt:stage}/vpc/private_subnet_b}
    environment:
      TopicArn: arn:aws:sns:${self:provider.region}:#{AWS::AccountId}:demo-sns-topic-${opt:stage}
      DB_HOST: ${ssm:/demo/${opt:stage}/rds/demo-db-endpoint}
      DB_PORT: 5432
      DB_NAME: ${ssm:/demo/${opt:stage}/rds/demo-db-name}
      DB_USER: ${ssm:/demo/${opt:stage}/rds/demo-db-username~true}
      DB_PASS: ${ssm:/demo/${opt:stage}/rds/demo-db-password~true}
    events:
      - http:
          path: /send_data
          method: GET
      - http:
          path: /send_data_rds
          method: GET
      - http:
          path: /health_check
          method: GET
      - http:
          path: /respond_400
          method: POST
      - http:
          path: /throw_error
          method: GET
  SQSHandlerLambda:
    role: SQSHandlerRole
    handler: src/functions/sqs_listener/index.handler
    environment:
      SlackEndpoint: 	${ssm:/demo/${opt:stage}/slack_endpoint}
    events:
      - sqs:
          arn: !GetAtt
            - DemoSQSQueue
            - Arn
          batchSize: 5
resources:
  Resources:
    SnsToQueueSqsPolicy:
      Type: AWS::SQS::QueuePolicy
      Properties:
        PolicyDocument:
          Version: "2012-10-17"
          Statement:
            - Sid: "allow-sns-messages"
              Effect: Allow
              Principal: "*"
              Resource: !GetAtt
                - DemoSQSQueue
                - Arn
              Action: "SQS:SendMessage"
              Condition:
                ArnEquals:
                  "aws:SourceArn": !Ref DemoSnsTopic
        Queues:
          - Ref: DemoSQSQueue
    SQSHandlerRole:
      Type: AWS::IAM::Role
      Properties:
        Path: /${opt:stage}/demos/lambdaApiDemo/serviceRoles/
        RoleName: PullMessagesRole
        AssumeRolePolicyDocument:
          Version: '2012-10-17'
          Statement:
            - Effect: Allow
              Principal:
                Service:
                  - lambda.amazonaws.com
              Action: sts:AssumeRole
        Policies:
          - PolicyName: PullMessagesLambdaPolicy
            PolicyDocument:
              Version: '2012-10-17'
              Statement:
                - Effect: Allow
                  Action:
                    - logs:CreateLogGroup
                    - logs:CreateLogStream
                    - logs:PutLogEvents
                  Resource:
                    - 'Fn::Join':
                      - ':'
                      -
                        - 'arn:aws:logs'
                        - Ref: 'AWS::Region'
                        - Ref: 'AWS::AccountId'
                        - 'log-group:/aws/lambda/*:*:*'
                - Effect: Allow
                  Action:
                    - sqs:ReceiveMessage
                    - sqs:DeleteMessage
                    - sqs:GetQueueAttributes
                  Resource: "*"
                - Effect: Allow
                  Action:
                    - xray:PutTraceSegment
                    - xray:PutTraceSegments
                    - xray:PutTelemetryRecords
                  Resource: "*"
    DemoLambdaRole:
      Type: AWS::IAM::Role
      Properties:
        Path: /${opt:stage}/demos/lambdaApiDemo/serviceRoles/
        RoleName: DemoLambdaRole
        AssumeRolePolicyDocument:
          Version: '2012-10-17'
          Statement:
            - Effect: Allow
              Principal:
                Service:
                  - lambda.amazonaws.com
              Action: sts:AssumeRole
        Policies:
          - PolicyName: DemoLambdaPolicy
            PolicyDocument:
              Version: '2012-10-17'
              Statement:
                - Effect: Allow
                  Action:
                    - logs:CreateLogGroup
                    - logs:CreateLogStream
                    - logs:PutLogEvents
                  Resource:
                    - 'Fn::Join':
                      - ':'
                      -
                        - 'arn:aws:logs'
                        - Ref: 'AWS::Region'
                        - Ref: 'AWS::AccountId'
                        - 'log-group:/aws/lambda/*:*:*'
                - Effect: Allow
                  Action:
                    - xray:PutTraceSegment
                    - xray:PutTraceSegments
                    - xray:PutTelemetryRecords
                  Resource: "*"
                - Effect: Allow
                  Action:
                    - "dynamodb:*"
                  Resource: arn:aws:dynamodb:${self:provider.region}:#{AWS::AccountId}:table/DemoDynamodbTable-${opt:stage}
                - Effect: Allow
                  Action:
                    - "sns:Publish"
                  Resource: arn:aws:sns:${self:provider.region}:#{AWS::AccountId}:demo-sns-topic-${opt:stage}
                - Effect: Allow
                  Action:
                    - "ec2:DescribeNetworkInterfaces"
                    - "ec2:CreateNetworkInterface"
                    - "ec2:DeleteNetworkInterface"
                    - "ec2:DescribeInstances"
                    - "ec2:AttachNetworkInterface"
                  Resource: "*"

    DemoDynamodbTable:
      Type: AWS::DynamoDB::Table
      Properties:
        TableName: DemoDynamodbTable-${opt:stage}
        AttributeDefinitions:
          - AttributeName: UserEmail
            AttributeType: S
          - AttributeName: DateTime
            AttributeType: S
        KeySchema:
          - AttributeName: UserEmail
            KeyType: HASH
          - AttributeName: DateTime
            KeyType: RANGE
        BillingMode: PAY_PER_REQUEST
    DemoSnsTopic:
      Type: AWS::SNS::Topic
      Properties:
        TopicName: demo-sns-topic-${opt:stage}
    DemoSQSQueue:
      Type: AWS::SQS::Queue
      Properties: 
        QueueName: demo-sqs-queue-${opt:stage}
    QueueSubscription:
      Type: 'AWS::SNS::Subscription'
      Properties:
        TopicArn: !Ref DemoSnsTopic
        Endpoint: !GetAtt
          - DemoSQSQueue
          - Arn
        Protocol: sqs
        RawMessageDelivery: 'true'