serverless.yml

service:
  name: serverless-notes-app

plugins:
  - serverless-webpack
  - serverless-iam-roles-per-function
  - serverless-offline
  - serverless-dynamodb-local
  - serverless-aws-documentation
  - serverless-reqvalidator-plugin

provider:
  name: aws
  runtime: nodejs12.x

  stage: ${opt:stage, 'dev'}
  region: ${opt:region, 'us-east-1'}
  environment:
    NOTES_TABLE: Notes-${self:provider.stage}
    USER_INDEX: userIdIndex
    SIGNED_URL_EXPIRATION: 300
    ATTACHMENTS_S3_BUCKET: attachments-icxpp-${self:provider.stage}

custom:
  serverless-offline:
    httpPort: 4000

  dynamodb:
    start:
      port: 8000
      inMemory: true
      migrate: true
    stages: # Add this section of the config
      - dev

  documentation:
    api:
      info:
        version: v1.0.0
        title: Serverless Notes Application
        description: Serverless Notes Application
    models:
      - name: CreateNotesRequest
        contentType: application/json
        schema: ${file(models/create-notes-request.json)}

functions:
  Auth:
    handler: src/lambda/auth/auth0Authorizer.handler

  GetNotes:
    handler: src/lambda/http/getNotes.handler
    events:
      - http:
          method: get
          path: notes
          cors: true
          authorizer: Auth
    iamRoleStatements:
      - Effect: Allow
        Action:
          - dynamodb:Query
        Resource: arn:aws:dynamodb:${self:provider.region}:*:table/${self:provider.environment.NOTES_TABLE}
      - Effect: Allow
        Action:
          - dynamodb:Query
        Resource: arn:aws:dynamodb:${self:provider.region}:*:table/${self:provider.environment.NOTES_TABLE}/index/${self:provider.environment.USER_INDEX}
      - Effect: Allow
        Action:
          - logs:CreateLogStream
          - logs:CreateLogGroup
          - logs:PutLogEvents
        Resource: arn:aws:logs:${self:provider.region}:*:log-group:/aws/lambda/serverless-notes-app-dev-GetNotes:*:*
      - Effect: Allow
        Action:
          - "xray:PutTraceSegments"
          - "xray:PutTelemetryRecords"
        Resource:
          - "*"

  CreateNotes:
    handler: src/lambda/http/createNotes.handler
    events:
      - http:
          method: post
          path: notes
          cors: true
          authorizer: Auth
          reqValidatorName: RequestBodyValidator
          documentation:
            summary: Create note items
            description: Create note items
            requestModels:
              'application/json': CreateNotesRequest
    iamRoleStatements:
      - Effect: Allow
        Action:
          - dynamodb:PutItem
        Resource: arn:aws:dynamodb:${self:provider.region}:*:table/${self:provider.environment.NOTES_TABLE}
      - Effect: Allow
        Action:
          - logs:CreateLogStream
          - logs:CreateLogGroup
        Resource: arn:aws:logs:${self:provider.region}:*:log-group:/aws/lambda/serverless-notes-app-dev-CreateNotes:*:*
      - Effect: Allow
        Action:
          - logs:PutLogEvents
        Resource: arn:aws:logs:${self:provider.region}:*:log-group:/aws/lambda/serverless-notes-app-dev-CreateNotes:*:*
      - Effect: Allow
        Action:
          - "xray:PutTraceSegments"
          - "xray:PutTelemetryRecords"
        Resource:
          - "*"

  UpdateNote:
    handler: src/lambda/http/updateNote.handler
    events:
      - http:
          method: patch
          path: notes/{noteId}
          cors: true
          authorizer: Auth
    iamRoleStatements:
      - Effect: Allow
        Action:
          - dynamodb:UpdateItem
          - dynamodb:GetItem
        Resource: arn:aws:dynamodb:${self:provider.region}:*:table/${self:provider.environment.NOTES_TABLE}
      - Effect: Allow
        Action:
          - logs:CreateLogStream
          - logs:CreateLogGroup
          - logs:PutLogEvents
        Resource: arn:aws:logs:${self:provider.region}:*:log-group:/aws/lambda/serverless-notes-app-dev-UpdateNote:*:*
      - Effect: Allow
        Action:
          - "xray:PutTraceSegments"
          - "xray:PutTelemetryRecords"
        Resource:
          - "*"

  DeleteNote:
    handler: src/lambda/http/deleteNote.handler
    events:
      - http:
          method: delete
          path: notes/{noteId}
          cors: true
          authorizer: Auth
    iamRoleStatements:
      - Effect: Allow
        Action:
          - dynamodb:DeleteItem
          - dynamodb:GetItem
        Resource: arn:aws:dynamodb:${self:provider.region}:*:table/${self:provider.environment.NOTES_TABLE}
      - Effect: Allow
        Action:
          - logs:CreateLogStream
          - logs:CreateLogGroup
        Resource: arn:aws:logs:${self:provider.region}:*:log-group:/aws/lambda/serverless-notes-app-dev-DeleteNote:*:*
      - Effect: Allow
        Action:
          - logs:PutLogEvents
        Resource: arn:aws:logs:${self:provider.region}:*:log-group:/aws/lambda/serverless-notes-app-dev-DeleteNote:*:*
      - Effect: Allow
        Action:
          - "xray:PutTraceSegments"
          - "xray:PutTelemetryRecords"
        Resource:
          - "*"

  GenerateUploadUrl:
    handler: src/lambda/http/generateUploadUrl.handler
    events:
      - http:
          method: post
          path: notes/{noteId}/attachment
          cors: true
          authorizer: Auth
    iamRoleStatements:
      - Effect: Allow
        Action:
          - s3:PutObject
        Resource: arn:aws:s3:::${self:provider.environment.ATTACHMENTS_S3_BUCKET}/*
      - Effect: Allow
        Action:
          - logs:CreateLogStream
          - logs:CreateLogGroup
          - logs:PutLogEvents
        Resource: arn:aws:logs:${self:provider.region}:*:log-group:/aws/lambda/serverless-notes-app-dev-GenerateUploadUrl:*:*
      - Effect: Allow
        Action:
          - dynamodb:GetItem
          - dynamodb:UpdateItem
        Resource: arn:aws:dynamodb:${self:provider.region}:*:table/${self:provider.environment.NOTES_TABLE}
      - Effect: Allow
        Action:
          - "xray:PutTraceSegments"
          - "xray:PutTelemetryRecords"
        Resource:
          - "*"

resources:
  Resources:
    GatewayResponseDefault4XX:
      Type: AWS::ApiGateway::GatewayResponse
      Properties:
        ResponseParameters:
          gatewayresponse.header.Access-Control-Allow-Origin: "'*'"
          gatewayresponse.header.Access-Control-Allow-Headers: "'Content-Type,X-Amz-Date,Authorization,X-Api-Key,X-Amz-Security-Token'"
          gatewayresponse.header.Access-Control-Allow-Methods: "'GET,OPTIONS,POST,PATCH,DELETE'"
        ResponseType: DEFAULT_4XX
        RestApiId:
          Ref: ApiGatewayRestApi

    NotesDynamoDBTable:
      Type: AWS::DynamoDB::Table
      Properties:
        AttributeDefinitions:
          - AttributeName: userId
            AttributeType: S
          - AttributeName: createdAt
            AttributeType: S
          - AttributeName: noteId
            AttributeType: S
        KeySchema:
          - AttributeName: userId
            KeyType: HASH
          - AttributeName: noteId
            KeyType: RANGE
        BillingMode: PAY_PER_REQUEST
        TableName: ${self:provider.environment.NOTES_TABLE}
        LocalSecondaryIndexes:
          - IndexName: ${self:provider.environment.USER_INDEX}
            KeySchema:
              - AttributeName: userId
                KeyType: HASH
              - AttributeName: createdAt
                KeyType: RANGE
            Projection:
              ProjectionType: ALL

    AttachmentsBucket:
      Type: AWS::S3::Bucket
      Properties:
        BucketName: ${self:provider.environment.ATTACHMENTS_S3_BUCKET}
        CorsConfiguration:
          CorsRules:
            -
              AllowedOrigins:
                - '*'
              AllowedHeaders:
                - '*'
              AllowedMethods:
                - GET
                - PUT
                - POST
                - DELETE
                - HEAD
              MaxAge: 3000

    BucketPolicy:
      Type: AWS::S3::BucketPolicy
      Properties:
        PolicyDocument:
          Id: MyPolicy
          Version: "2012-10-17"
          Statement:
            - Sid: PublicReadForGetBucketObjects
              Effect: Allow
              Principal: '*'
              Action:
                - s3:GetObject
                - s3:PutObject
              Resource: 'arn:aws:s3:::${self:provider.environment.ATTACHMENTS_S3_BUCKET}/*'
        Bucket: !Ref AttachmentsBucket

    RequestBodyValidator:
      Type: AWS::ApiGateway::RequestValidator
      Properties:
        Name: 'request-body-validator'
        RestApiId:
          Ref: ApiGatewayRestApi
        ValidateRequestBody: true
        ValidateRequestParameters: false