serverless.yml

org: upstandfm
app: api
service: infra

provider:
  name: aws
  stage: ${opt:stage, 'prod'}
  region: ${opt:region, 'eu-central-1'}
  cfnRole: ${secrets:CFN_ROLE_ARN}
  deploymentBucket:
    name: upstandfm-deployments
    serverSideEncryption: AES256 # when using server-side encryption

package:
  exclude:
    - ./*

resources:
  # CloudFormation template syntax
  Resources:
    # DynamoDB
    #
    # For more info see:
    # https://docs.aws.amazon.com/en_pv/AWSCloudFormation/latest/UserGuide/aws-resource-dynamodb-table.html

    workspacesTable:
      Type: AWS::DynamoDB::Table
      Properties:
        TableName: Workspaces
        AttributeDefinitions:
          - AttributeName: pk
            AttributeType: S
          - AttributeName: sk
            AttributeType: S
        KeySchema:
          - AttributeName: pk
            KeyType: HASH
          - AttributeName: sk
            KeyType: RANGE
        ProvisionedThroughput:
          ReadCapacityUnits: 1
          WriteCapacityUnits: 1

    invitesTable:
      Type: AWS::DynamoDB::Table
      Properties:
        TableName: Invites
        AttributeDefinitions:
          - AttributeName: pk
            AttributeType: S
          - AttributeName: sk
            AttributeType: S
        KeySchema:
          - AttributeName: pk
            KeyType: HASH
          - AttributeName: sk
            KeyType: RANGE
        ProvisionedThroughput:
          ReadCapacityUnits: 1
          WriteCapacityUnits: 1
        StreamSpecification:
          StreamViewType: NEW_AND_OLD_IMAGES

    # SNS
    #
    # For more info see:
    # https://docs.aws.amazon.com/en_pv/AWSCloudFormation/latest/UserGuide/aws-properties-sns-topic.html

    newS3AudioRecordingTopic:
      Type: AWS::SNS::Topic
      Properties:
        TopicName: new-s3-audio-recording

    newS3TranscodedAudioRecordingTopic:
      Type: AWS::SNS::Topic
      Properties:
        TopicName: new-s3-transcoded-audio-recording

    newInviteTopic:
      Type: AWS::SNS::Topic
      Properties:
        TopicName: new-invite

    deletedInviteTopic:
      Type: AWS::SNS::Topic
      Properties:
        TopicName: deleted-invite

    # S3
    #
    # For more info on policies see:
    # https://docs.aws.amazon.com/en_pv/AWSCloudFormation/latest/UserGuide/aws-properties-sns-policy.html
    #
    # For more info on buckets see:
    # https://docs.aws.amazon.com/en_pv/AWSCloudFormation/latest/UserGuide/aws-properties-s3-bucket.html

    s3PublishTopicPolicy:
      Type: AWS::SNS::TopicPolicy
      Properties:
        Topics:
          - !Ref newS3AudioRecordingTopic
          - !Ref newS3TranscodedAudioRecordingTopic
        PolicyDocument:
          Version: "2012-10-17"
          Statement:
            - Sid: "s3-publish-to-sns-new-audio-recording-topic"
              Effect: Allow
              Action: sns:Publish
              Resource: !Ref newS3AudioRecordingTopic
              Principal:
                Service: s3.amazonaws.com
            - Sid: "s3-publish-to-sns-new-transcoded-audio-recording-topic"
              Effect: Allow
              Action: sns:Publish
              Resource: !Ref newS3TranscodedAudioRecordingTopic
              Principal:
                Service: s3.amazonaws.com

    recordingsBucket:
      Type: AWS::S3::Bucket
      DependsOn: s3PublishTopicPolicy
      Properties:
        BucketName: upstandfm-recordings
        BucketEncryption:
          ServerSideEncryptionConfiguration:
            - ServerSideEncryptionByDefault:
                SSEAlgorithm: AES256
        PublicAccessBlockConfiguration:
          BlockPublicAcls: true
          BlockPublicPolicy: true
          IgnorePublicAcls: true
          RestrictPublicBuckets: true
        CorsConfiguration:
          CorsRules:
            - AllowedHeaders:
                - "*"
              AllowedMethods:
                - HEAD
                - PUT
              AllowedOrigins:
                - "*"
        NotificationConfiguration:
          TopicConfigurations:
            - Event: s3:ObjectCreated:*
              # For more info see:
              # https://docs.aws.amazon.com/AmazonS3/latest/dev/NotificationHowTo.html
              Filter:
                S3Key:
                  Rules:
                    - Name: prefix
                      Value: audio/
                    - Name: suffix
                      Value: .webm
              Topic: !Ref newS3AudioRecordingTopic

    transcodedRecordingsBucket:
      Type: AWS::S3::Bucket
      DependsOn: s3PublishTopicPolicy
      Properties:
        BucketName: upstandfm-transcoded-recordings
        BucketEncryption:
          ServerSideEncryptionConfiguration:
            - ServerSideEncryptionByDefault:
                SSEAlgorithm: AES256
        PublicAccessBlockConfiguration:
          BlockPublicAcls: true
          BlockPublicPolicy: true
          IgnorePublicAcls: true
          RestrictPublicBuckets: true
        CorsConfiguration:
          CorsRules:
            - AllowedHeaders:
                - "*"
              AllowedMethods:
                - GET
                - HEAD
              AllowedOrigins:
                - "*"
        NotificationConfiguration:
          TopicConfigurations:
            - Event: s3:ObjectCreated:*
              Filter:
                S3Key:
                  Rules:
                    - Name: prefix
                      Value: audio/
              Topic: !Ref newS3TranscodedAudioRecordingTopic

# Serverless output variables
# For more info see:
# https://serverless.com/framework/docs/dashboard/output-variables/
outputs:
  # DynamoDB
  workspacesTableArn:
    "Fn::GetAtt": [workspacesTable, Arn]
  invitesTableArn:
    "Fn::GetAtt": [invitesTable, Arn]
  invitesTableStreamArn:
    "Fn::GetAtt": [invitesTable, StreamArn]

  # SNS
  newS3AudioRecordingTopicArn: !Ref newS3AudioRecordingTopic
  newS3TranscodedAudioRecordingTopicArn: !Ref newS3TranscodedAudioRecordingTopic
  newInviteTopicArn: !Ref newInviteTopic
  deleteInviteTopicArn: !Ref deletedInviteTopic

  # S3
  recordingsBucketArn:
    "Fn::GetAtt": [recordingsBucket, Arn]
  transcodedRecordingsBucketArn:
    "Fn::GetAtt": [transcodedRecordingsBucket, Arn]