serverless.yml

service: mhd
provider:
  name: aws
  stage: ${opt:stage, 'development'}
  region: ${opt:region, 'us-west-2'}
  runtime: ${opt:runtime, 'nodejs12.x'}
  apiGateway:
    minimumCompressionSize: 1024
  environment:
    AWS_NODEJS_CONNECTION_REUSE_ENABLED: 1
    ENVIRONMENT: ${self:provider.stage}
    REGION: ${self:provider.region}
  logs:
    restApi:
      fullExecutionData: false
      level: ERROR
      websocket:
        level: ERROR
        fullExecutionData: false
  tags:
    provider: serverless
  tracing:
    apiGateway: true
    lambda: true
  vpc:
    securityGroupIds:
      - ${ssm:/development/vpc/sg/apigw/id}
    subnetIds: ${ssm:/development/vpc/subnet/private/arns~split}
  iamRoleStatements:
    - Effect: Allow
      Action:
        - "dynamodb:*"
      Resource:
        - "arn:aws:dynamodb:#{AWS::Region}:#{AWS::AccountId}:table/*"
    - Effect: Allow
      Action:
        - xray:PutTraceSegments
        - xray:PutTelemetryRecords
      Resource:
        - "*"

custom:
  webpack:
    webpackConfig: ./webpack.config.js
    includeModules: true

functions:
  auth0:
    handler: handlers/authorizer.authenticate
    environment:
      A0_ALGORITHM: RS256
      A0_DOMAIN: mhp.us.auth0.com
  index:
    handler: handlers/proxy.index
    events:
      - http:
          path: /
          method: get
          authorizer: auth0
          connectionType: vpc-link
          connectionId: ${ssm:/development/vpc/apigw/link/id~true}
          cors: true
      - http:
          path: /{proxy+}
          method: any
          authorizer: auth0
          connectionType: vpc-link
          connectionId: ${ssm:/development/vpc/apigw/link/id~true}
          cors: true
  login:
    handler: handlers/user.session
    environment:
      A0_DOMAIN: mhp.us.auth0.com
      A0_CLIENT_ID: ${ssm:/development/vendor/auth0/client/id~true}
      A0_CLIENT_SECRET: ${ssm:/development/vendor/auth0/client/secret~true}
    events:
      - http:
          path: /login
          method: post
          connectionType: vpc-link
          connectionId: ${ssm:/development/vpc/apigw/link/id~true}
          cors: true
  mfa:
    handler: handlers/user.mfa
    resultTtlInSeconds: 0
    environment:
      A0_DOMAIN: mhp.us.auth0.com
      A0_CLIENT_ID: ${ssm:/development/vendor/auth0/client/id~true}
      A0_CLIENT_SECRET: ${ssm:/development/vendor/auth0/client/secret~true}
    events:
      - http:
          path: /mfa
          method: post
          cors: true
  register:
    handler: handlers/user.signup
    resultTtlInSeconds: 0
    environment:
      A0_DOMAIN: mhp.us.auth0.com
      A0_CLIENT_ID: ${ssm:/development/vendor/auth0/client/id~true}
      A0_CLIENT_SECRET: ${ssm:/development/vendor/auth0/client/secret~true}
    events:
      - http:
          path: /register
          method: post
          cors: true
  streamsUser:
    handler: handlers/streams.user
    environment:
      REGISTRATION_ARN: "arn:aws:states:#{AWS::Region}:#{AWS::AccountId}:stateMachine:${self:service}-${self:provider.stage}-registration"
    iamRoleStatements:
      - Effect: Allow
        Action:
          - states:DescribeStateMachine
          - states:ListActivities
          - states:ListExecutions
          - states:ListStateMachines
          - states:StartExecution
          - states:UpdateStateMachine
        Resource:
          - "arn:aws:states:#{AWS::Region}:#{AWS::AccountId}:stateMachine:*"
    events:
      - stream:
          arn: ${ssm:/development/ddb/stream/arn}
          batchSize: 100
          startingPosition: TRIM_HORIZON
          maximumRetryAttempts: 0
          enabled: true
          destinations:
            onFailure: ${ssm:/development/sns/dlq/stream/arn}
  user:
    handler: handlers/user.query
    resultTtlInSeconds: 0
    environment:
      A0_DOMAIN: mhp.us.auth0.com
      A0_CLIENT_ID: ${ssm:/development/vendor/auth0/client/id~true}
      A0_CLIENT_SECRET: ${ssm:/development/vendor/auth0/client/secret~true}
    events:
      - http:
          path: /user
          method: post
          authorizer: auth0
          connectionType: vpc-link
          connectionId: ${ssm:/development/vpc/apigw/link/id~true}
          cors: true
  mixpanel:
    handler: handlers/bi.mixpanel
    resultTtlInSeconds: 0
  signup:
    handler: handlers/bi.mixpanel
    resultTtlInSeconds: 0

stepFunctions:
  stateMachines:
    registration:
      name: "${self:service}-${self:provider.stage}-registration"
      definition:
        StartAt: beacon
        States:
          beacon:
            Type: Task
            Resource: "arn:aws:lambda:#{AWS::Region}:#{AWS::AccountId}:function:${self:service}-${opt:stage}-mixpanel"
            End: true

resources:
  Resources:
    GatewayResponseDefault4XX:
      Type: 'AWS::ApiGateway::GatewayResponse'
      Properties:
        ResponseParameters:
          gatewayresponse.header.Access-Control-Allow-Origin: "'*'"
          gatewayresponse.header.Access-Control-Allow-Headers: "'*'"
        ResponseType: DEFAULT_4XX
        RestApiId:
          Ref: 'ApiGatewayRestApi'

package:
  individually: true

plugins:
  - serverless-webpack
  - serverless-iam-roles-per-function
  - serverless-step-functions
  - serverless-pseudo-parameters
  - serverless-offline
  # - serverless-plugin-warmup