serverless.yml

service: acme-instant-tunnel
provider:
  name: aws
  runtime: nodejs12.x
  region: ${self:provider.environment.USER_AWS_REGION}
  environment:
    DYNAMODB_TABLE: leasesTable
    AUTH0_CLIENT_ID: ${file(./secrets.json):AUTH0_CLIENT_ID}
    AUTH0_CLIENT_PUBLIC_KEY: ${file(./public_key)}
    VPC_ID: REPLACE WITH YOUR VPC ID
    USER_AWS_REGION: REPLACE WITH YOUR AWS REGION
    S3_BUCKET_NAME: REPLACE WITH A UNIQUE S3 BUCKET NAME
  iamRoleStatements:
    - Effect: 'Allow'
      Action:
        - 'dynamodb:GetItem'
        - 'dynamodb:PutItem'
        - 'dynamodb:UpdateItem'
        - 'dynamodb:DeleteItem'
        - 'dynamodb:ListStreams'
        - 'dynamodb:Query'
        - 'dynamodb:Scan'
        - dynamodb:DescribeStream
        - dynamodb:GetRecords
        - dynamodb:GetShardIterator
        - dynamodb:ListStreams
      Resource:
        - 'arn:aws:dynamodb:${self:provider.region}:*:table/${self:provider.environment.DYNAMODB_TABLE}'
    - Effect: 'Allow'
      Action:
        - 'ec2:DescribeSecurityGroups'
        - 'ec2:AuthorizeSecurityGroupIngress'
        - 'ec2:RevokeSecurityGroupIngress'
        - 'ec2:DescribeInstances'
      Resource:
        - '*'
plugins:
  - serverless-finch
custom:
  client:
    bucketName: ${self:provider.environment.S3_BUCKET_NAME}
    distributionFolder: frontend
    errorDocument: index.html
resources: # CloudFormation template syntax from here on.
  Resources:
    leasesTable:
      Type: AWS::DynamoDB::Table
      Properties:
        TableName: ${self:provider.environment.DYNAMODB_TABLE}
        AttributeDefinitions:
          - AttributeName: leaseId
            AttributeType: S
          - AttributeName: leaseEnd
            AttributeType: N
        KeySchema:
          - AttributeName: leaseId
            KeyType: HASH
          - AttributeName: leaseEnd
            KeyType: RANGE
        ProvisionedThroughput:
          ReadCapacityUnits: 1
          WriteCapacityUnits: 1
        StreamSpecification: 
          StreamViewType: OLD_IMAGE
        TimeToLiveSpecification: 
          AttributeName: leaseEnd
          Enabled: true
    managedSecurityGroup:
      Type: AWS::EC2::SecurityGroup
      Properties:
        GroupName: acmeInstantTunnel
        GroupDescription: Managed by Lambda
        VpcId: ${self:provider.environment.VPC_ID}
    GatewayResponse:
      Type: 'AWS::ApiGateway::GatewayResponse'
      Properties:
        ResponseParameters:
          gatewayresponse.header.Access-Control-Allow-Origin: "'*'"
          gatewayresponse.header.Access-Control-Allow-Headers: "'*'"
        ResponseType: EXPIRED_TOKEN
        RestApiId:
          Ref: 'ApiGatewayRestApi'
        StatusCode: '401'
    AuthFailureGatewayResponse:
      Type: 'AWS::ApiGateway::GatewayResponse'
      Properties:
        ResponseParameters:
          gatewayresponse.header.Access-Control-Allow-Origin: "'*'"
          gatewayresponse.header.Access-Control-Allow-Headers: "'*'"
        ResponseType: UNAUTHORIZED
        RestApiId:
          Ref: 'ApiGatewayRestApi'
        StatusCode: '401'
functions:
  auth:
    handler: handler.auth
  addLease:
    handler: handler.addLease
    events:
      - http:
          path: api/addLease
          method: post
          authorizer: auth
          cors: true
  updateExpiredLeases:
    handler: handler.updateExpiredLeases
    events:
      - stream:
          type: dynamodb
          arn:
            Fn::GetAtt: [leasesTable, StreamArn]
#    The following are a few example events you can configure
#    NOTE: Please make sure to change your handler code to work with those events
#    Check the event documentation for details
#    events:
#      - http:
#          path: users/create
#          method: get
#      - websocket: $connect
#      - s3: ${env:BUCKET}
#      - schedule: rate(10 minutes)
#      - sns: greeter-topic
#      - stream: arn:aws:dynamodb:region:XXXXXX:table/foo/stream/1970-01-01T00:00:00.000
#      - alexaSkill: amzn1.ask.skill.xx-xx-xx-xx
#      - alexaSmartHome: amzn1.ask.skill.xx-xx-xx-xx
#      - iot:
#          sql: "SELECT * FROM 'some_topic'"
#      - cloudwatchEvent:
#          event:
#            source:
#              - "aws.ec2"
#            detail-type:
#              - "EC2 Instance State-change Notification"
#            detail:
#              state:
#                - pending
#      - cloudwatchLog: '/aws/lambda/hello'
#      - cognitoUserPool:
#          pool: MyUserPool
#          trigger: PreSignUp
#      - alb:
#          listenerArn: arn:aws:elasticloadbalancing:us-east-1:XXXXXX:listener/app/my-load-balancer/50dc6c495c0c9188/
#          priority: 1
#          conditions:
#            host: example.com
#            path: /hello

#    Define function environment variables here
#    environment:
#      variable2: value2

# you can add CloudFormation resource templates here
#resources:
#  Resources:
#    NewResource:
#      Type: AWS::S3::Bucket
#      Properties:
#        BucketName: my-new-bucket
#  Outputs:
#     NewOutput:
#       Description: "Description for the output"
#       Value: "Some output value"