serverless.yml

service:
  name: udacity-backend-todo

custom:
  webpack:
    webpackConfig: ./webpack.config.js
    includeModules: true
  documentation:
    api:
      info:
        version: v1.0.0
        title: Udacity Todo
        description: Todo for Udacity Nanodegree Project
    models:
      - name: TodoRequest
        contentType: application/json
        schema: ${file(models/create-todo-request.json)}

plugins:
  - serverless-webpack
  - serverless-iam-roles-per-function
  - serverless-plugin-tracing

provider:
  name: aws
  runtime: nodejs12.x
  stage: ${opt:stage, 'dev'}
  region: ${opt:region, 'us-east-1'}
  apiGateway:
    minimumCompressionSize: 1024 # Enable gzip compression for responses > 1 KB
  environment:
    AWS_NODEJS_CONNECTION_REUSE_ENABLED: 1
    TODOS_TABLE: Todos-${self:provider.stage}
    TODOS_USER_INDEX: TodoUserIndex
    TODOS_IMAGES_S3_BUCKET: udacity-backend-images-${self:provider.stage}
    TODOS_SIGNED_URL_EXPIRATION: 300
  tracing:
    lambda: true
    apiGateway: true
  iamRoleStatements:
    - Effect: Allow
      Action:
        - 'xray:PutTraceSegments'
        - 'xray:PutTelemetryRecords'
      Resource: '*'
#    - Effect: Allow
#      Action:
#        - dynamodb:Query
#      Resource: arn:aws:dynamodb:${self:provider.region}:*:table/${self:provider.environment.TODOS_TABLE}/index/${self:provider.environment.TODOS_USER_INDEX}
#    - Effect: Allow
#      Action:
#        - s3:PutObject
#        - s3:GetObject
#      Resource: arn:aws:s3:::${self:provider.environment.TODOS_IMAGES_S3_BUCKET}/*

functions:

  Auth:
    handler: src/lambda/auth/auth0Authorizer.handler
    environment: 
      AUTH_URL: https://udagram-acioli.auth0.com/.well-known/jwks.json
  
  CreateTodo:
    handler: src/lambda/http/createTodo.handler
    events:
      - http:
          method: post
          path: todos
          cors: true
          authorizer: Auth
          reqValidatorName: RequestBodyValidator
          documentation:
            summary: Create Todo
            description: Create a new todo item
            requestModels:
              'application/json': TodoRequest
    iamRoleStatements:
      - Effect: Allow
        Action:
          - dynamodb:PutItem
        Resource: arn:aws:dynamodb:${self:provider.region}:*:table/${self:provider.environment.TODOS_TABLE}

  DeleteTodo:
    handler: src/lambda/http/deleteTodo.handler
    events:
      - http:
          method: delete
          path: todos/{todoId}
          cors: true
          authorizer: Auth
    iamRoleStatements:
      - Effect: Allow
        Action:
          - dynamodb:DeleteItem
        Resource: arn:aws:dynamodb:${self:provider.region}:*:table/${self:provider.environment.TODOS_TABLE}

  UpdateTodo:
    handler: src/lambda/http/updateTodo.handler
    events:
      - http:
          method: patch
          path: todos/{todoId}
          cors: true
          authorizer: Auth
          reqValidatorName: RequestBodyValidator
          documentation:
            summary: Update todo
            description: Update todo item
            requestModels:
              'application/json': TodoRequest
    iamRoleStatements:
      - Effect: Allow
        Action:
          - dynamodb:UpdateItem
        Resource: arn:aws:dynamodb:${self:provider.region}:*:table/${self:provider.environment.TODOS_TABLE}

  GenerateUploadUrl:
    handler: src/lambda/http/generateUploadUrl.handler
    events:
      - http:
          method: post
          path: todos/{todoId}/attachment
          cors: true
          authorizer: Auth
    iamRoleStatements:
      - Effect: Allow
        Action:
          - s3:PutObject
          - s3:GetObject
        Resource: arn:aws:s3:::${self:provider.environment.TODOS_IMAGES_S3_BUCKET}/*

  GetTodos:
    handler: src/lambda/http/getTodos.handler
    events:
      - http:
          method: get
          path: todos
          cors: true
          authorizer: Auth
    iamRoleStatements:
      - Effect: Allow
        Action:
          - dynamodb:Query
        Resource: arn:aws:dynamodb:${self:provider.region}:*:table/${self:provider.environment.TODOS_TABLE}/index/${self:provider.environment.TODOS_USER_INDEX}
      - Effect: Allow
        Action:
          - s3:HeadObject
        Resource: arn:aws:s3:::${self:provider.environment.TODOS_IMAGES_S3_BUCKET}

resources:
  Resources:

    RequestBodyValidator:
      Type: AWS::ApiGateway::RequestValidator
      Properties:
        Name: 'request-body-validator'
        RestApiId:
          Ref: ApiGatewayRestApi
        ValidateRequestBody: true
        ValidateRequestParameters: false

    AttachmentBucket:
      Type: AWS::S3::Bucket
      Properties:
        BucketName: ${self:provider.environment.TODOS_IMAGES_S3_BUCKET}
        CorsConfiguration:
          CorsRules:
            -
              AllowedOrigins:
                - '*'
              AllowedHeaders:
                - '*'
              AllowedMethods:
                - GET
                - POST
                - PUT
                - DELETE
                - HEAD
              MaxAge: 3000
    
    BucketPolicy:
      Type: AWS::S3::BucketPolicy
      Properties:
        PolicyDocument:
          Id: MyPolicy
          Version: "2012-10-17"
          Statement:
            - Sid: PublicReadForGetBucketObjects
              Effect: Allow
              Principal: '*'
              Action: 's3:GetObject'
              Resource: 'arn:aws:s3:::${self:provider.environment.TODOS_IMAGES_S3_BUCKET}/*'
        Bucket: !Ref AttachmentBucket

    TodosDynamoDBTable:
      Type: AWS::DynamoDB::Table
      Properties:
        AttributeDefinitions:
          - AttributeName: todoId
            AttributeType: S
          - AttributeName: userId
            AttributeType: S
        KeySchema:
          - AttributeName: todoId
            KeyType: HASH
        GlobalSecondaryIndexes:
          - IndexName: ${self:provider.environment.TODOS_USER_INDEX}
            KeySchema:
            - AttributeName: userId
              KeyType: HASH
            Projection:
              ProjectionType: ALL
        BillingMode: PAY_PER_REQUEST
        TableName: ${self:provider.environment.TODOS_TABLE}