splitstack-postsapi/serverless.yaml at master · SWO-GS/splitstack-postsapi · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
service: postsapi
provider:
  name: aws
  runtime: nodejs12.x
  iamRoleStatements:
    -
      Effect: "Allow"
      Action: [ logs:CreateLogStream ]
      Resource:
        Fn::Join:
          - ""
          - ["arn:aws:logs:", {Ref: "AWS::Region"}, ":", {Ref: "AWS::AccountId"}, ":log-group:/aws/lambda/postsapi-*:*"]
    -
      Effect: Allow
      Action: [ logs:PutLogEvents ]
      Resource:
        Fn::Join:
          - ""
          - ["arn:aws:logs:", {Ref: "AWS::Region"}, ":", {Ref: "AWS::AccountId"}, ":log-group:/aws/lambda/postsapi-*:*:*"]
    -
      Effect: Allow
      Action: [ dynamodb:* ]
      Resource:
       Fn::Join:
          - ""
          - ["arn:aws:dynamodb:", {Ref: "AWS::Region"}, ":", {Ref: "AWS::AccountId"}, ":table/postsapi-${opt:stage}-*"]
functions:
  generalAuthorizer:
    handler: generalAuthorizer.handler
    environment:
      SECRET: ${self:custom.config.encryption.secret}
custom:
  # NOTE: Change this if you plan to use/deploy this template!
  config: ${file(config.yaml)}
resources:
  Resources:

    # Rest API
    ApiGatewayRestApi:
      Type: AWS::ApiGateway::RestApi
      Properties:
        Name: postsapi
        Description: Posts API Gateway

    # Rest API Paths
    ApiGatewayResourceUsers:
      Type: AWS::ApiGateway::Resource
      Properties:
        RestApiId: { Ref: "ApiGatewayRestApi" }
        ParentId: { Fn::GetAtt: "ApiGatewayRestApi.RootResourceId" }
        PathPart: users
    ApiGatewayResourceUsersMe:
      Type: AWS::ApiGateway::Resource
      Properties:
        RestApiId: { Ref: "ApiGatewayRestApi" }
        ParentId: { Ref: "ApiGatewayResourceUsers" }
        PathPart: "me"

    # Authorizer
    ApiGatewayAuthorizer:
      Type: AWS::ApiGateway::Authorizer
      Properties:
        AuthorizerResultTtlInSeconds: 300
        AuthorizerUri:
          Fn::Join:
            - ''
            -
              - 'arn:aws:apigateway:'
              - Ref: "AWS::Region"
              - ':lambda:path/2015-03-31/functions/'
              - Fn::GetAtt: "GeneralAuthorizerLambdaFunction.Arn"
              - "/invocations"
        IdentitySource: method.request.header.Authorization
        IdentityValidationExpression: "Bearer .+"
        RestApiId: { Ref: ApiGatewayRestApi }
        Type: TOKEN
        Name: postsapi-${opt:stage}-authorizer
    ApiGatewayAuthorizerPermission:
      Type: AWS::Lambda::Permission
      Properties:
        FunctionName:
          Fn::GetAtt: GeneralAuthorizerLambdaFunction.Arn
        Action: lambda:InvokeFunction
        Principal:
          Fn::Join: ["",["apigateway.", { Ref: "AWS::URLSuffix"}]]

    # Tables
    UsersTable:
      Type: AWS::DynamoDB::Table
      Properties:
        TableName: postsapi-${opt:stage}-users
        AttributeDefinitions:
          -
            AttributeName: userId
            AttributeType: S
        KeySchema:
          -
            AttributeName: userId
            KeyType: HASH
        ProvisionedThroughput:
          ReadCapacityUnits: 1
          WriteCapacityUnits: 1
    PostsTable:
      Type: AWS::DynamoDB::Table
      Properties:
        TableName: postsapi-${opt:stage}-posts
        AttributeDefinitions:
          -
            AttributeName: postId
            AttributeType: S
          -
            AttributeName: userId
            AttributeType: S
        KeySchema:
          -
            AttributeName: postId
            KeyType: HASH
        ProvisionedThroughput:
          ReadCapacityUnits: 1
          WriteCapacityUnits: 1
        GlobalSecondaryIndexes:
          - IndexName: userId
            KeySchema:
              -
                AttributeName: userId
                KeyType: HASH
            Projection:
              ProjectionType: ALL
            ProvisionedThroughput:
              ReadCapacityUnits: 1
              WriteCapacityUnits: 1

  Outputs:
    # RestApi resource ID (e.g. ei829oe)
    RestApiId:
      Value:
        Ref: ApiGatewayRestApi
      Export:
        Name: postsapi-${opt:stage}-RestApiId
    # RestApi Root Resource (the implicit '/' path)
    RootResourceId:
      Value:
        Fn::GetAtt: ApiGatewayRestApi.RootResourceId
      Export:
        Name: postsapi-${opt:stage}-RootResourceId
    # The IAM Role for Lambda execution
    IamRoleLambdaExecution:
      Value:
        Fn::GetAtt: IamRoleLambdaExecution.Arn
      Export:
        Name: postsapi-${opt:stage}-IamRoleLambdaExecution
    # The Authorizer (only if you are using an API Gateway authorizer)
    ApiGatewayAuthorizerId:
      Value:
        Ref: ApiGatewayAuthorizer
      Export:
        Name: postsapi-${opt:stage}-ApiGatewayAuthorizerId
    # Path Resources
    ApiGatewayResourceUsers:
      Value:
        Ref: ApiGatewayResourceUsers
      Export:
        Name: postsapi-${opt:stage}-ApiGatewayResourceUsers
    ApiGatewayResourceUsersMe:
      Value:
        Ref: ApiGatewayResourceUsersMe
      Export:
        Name: postsapi-${opt:stage}-ApiGatewayResourceUsersMe
    # Table Resources
    UsersTable:
      Value:
        Ref: UsersTable
      Export:
        Name: postsapi-${opt:stage}-UsersTable
    PostsTable:
      Value:
        Ref: PostsTable
      Export:
        Name: postsapi-${opt:stage}-PostsTable