serverless.yml

# NOTE: Service name must match the repository name, but replace all '.' with '-' (this is a restriction of Cloudformation naming conventions)
service: aws-certbot

custom:
  stage: ${opt:stage}
  region: ${opt:region}
  table: ${self:service}.${self:custom.stage}
  emailMappingTable: ${self:service}.nameEmailMapping
  officeSlackCustomFieldId:
    dev: Xf1LTXNG6P
    master: Xf1LTXNG6P
  cohortSlackCustomFieldId:
    dev: Xf1M339XQX
    master: Xf1M339XQX
  clientSecret: xoxb-149685676326-618359348662-E5cgXkkRClUUR7Lf5HbtXXRr
  clientSecret_user: xoxp-149685676326-604707647410-609851737281-df95205a2da44f63d5492c4c9e3548e5
  slackToken: PwS7X21qRovjuYJcwXuFEV2V

provider:
  name: aws
  runtime: nodejs12.x
  stage: ${self:custom.stage}
  environment:
    TABLE: ${self:custom.table}
    MAPPING_TABLE: ${self:custom.emailMappingTable}
    SERVICE_AND_STAGE: ${self:service}
    GET_SLACK_PROFILE_SERVICE_URL:
      Fn::Join:
        - ""
        - - "https://"
          - Ref: "ApiGatewayRestApi"
          - ".execute-api.${self:provider.region}.amazonaws.com/${self:provider.stage}/slack/profile"
    OFFICE_SLACK_CUSTOM_FIELD_ID: ${self:custom.officeSlackCustomFieldId.${self:provider.stage}}
    COHORT_SLACK_CUSTOM_FIELD_ID: ${self:custom.cohortSlackCustomFieldId.${self:provider.stage}}
  # NOTE: Codebuild passes the lambda role from the security stack to the serverless deploy command in the live CI/CD pipeline
  region: ${self:custom.region}
  stackTags:
    Type: service
  iamRoleStatements: # permissions for all of functions
    - Effect: Allow
      Action:
        - dynamodb:GetItem
        - dynamodb:PutItem
        - dynamodb:UpdateItem
        - dynamodb:DeleteItem
        - dynamodb:Scan
      Resource: 
        - Fn::GetAtt:
          - DynamoTable
          - Arn
        - Fn::GetAtt:
          - EmailMappingDynamoTable
          - Arn
    - Effect: Allow
      Action:
        - logs:CreateLogGroup
        - logs:CreateLogStream
        - logs:PutLogEvents
        - logs:DescribeLogStreams
      Resource:
        Fn::Join:
          - ''
          - - 'arn:aws:logs:'
            - Ref: AWS::Region
            - ':*:*'
    - Effect: Allow
      Action:
        - lambda:InvokeAsync
        - lambda:InvokeFunction
      Resource:
        Fn::Join:
        - ''
        - - 'arn:aws:lambda:'
          - Ref: AWS::Region
          - ':'
          - Ref: AWS::AccountId
          - ':function:'
          - ${self:service}
          - '-'
          - ${self:provider.stage}
          - '-*'

functions:
  hello:
    environment:
      SLACK_APP_AUTH_TOKEN: ${self:custom.clientSecret}
      VERIFICATION_TOKEN: ${self:custom.slackToken}
    handler: functions/index.hello
    events:
      - http:
          path: hello/world
          method: post
          cors: true

  postCert:
    environment:
      VERIFICATION_TOKEN: ${self:custom.slackToken}
    handler: functions/postCert.handler
    timeout: 30
    events:
      - http:
          path: cert
          method: post
          cors: true

  getData:
    environment:
      SLACK_APP_AUTH_TOKEN: ${self:custom.clientSecret}
      VERIFICATION_TOKEN: ${self:custom.slackToken}
    handler: functions/getData.handler
    timeout: 30
    events:
      - http:
          path: awsCertData
          method: post
          cors: true

  postMapping:
    environment:
      VERIFICATION_TOKEN: ${self:custom.slackToken}
    handler: functions/postMapping.handler
    timeout: 30
    events:
      - http:
          path: mapping
          method: post
          cors: true

  sendReminders:
    environment:
      SLACK_APP_AUTH_TOKEN: ${self:custom.clientSecret}
      REMINDER_DAYS: 90
    handler: functions/sendReminders.handler
    timeout: 60
    events:
      - schedule: cron(0 17 * * ? *)

  updateFins:
    environment:
    handler: functions/updateFins.handler
    timeout: 60
    events:
      - schedule: cron(0 5 * * ? *)

  getSlackProfileService:
    environment:
      SLACK_APP_AUTH_TOKEN: ${self:custom.clientSecret}
      SLACK_APP_USER_AUTH_TOKEN: ${self:custom.clientSecret_user}
    handler: functions/getSlackProfileService.handler
    timeout: 30
    events:
      - http:
          path: slack/profile
          method: get
          cors: true

resources:
  Resources:

#    TODO: If needed, add CloudFormation resources
#    EXAMPLE: S3 Bucket 
#    NewResource:
#      Type: AWS::S3::Bucket
#      Properties:
#        BucketName: my-new-bucket
    DynamoTable:
      Type: AWS::DynamoDB::Table
      Properties:
        TableName: '${self:custom.table}'
        AttributeDefinitions:
          - AttributeName: certKey
            AttributeType: S
        KeySchema:
          - AttributeName: certKey
            KeyType: HASH
        ProvisionedThroughput:
          ReadCapacityUnits: 1
          WriteCapacityUnits: 1
    EmailMappingDynamoTable:
      Type: AWS::DynamoDB::Table
      Properties:
        TableName: '${self:custom.emailMappingTable}'
        AttributeDefinitions:
          - AttributeName: fin
            AttributeType: S
        KeySchema:
          - AttributeName: fin
            KeyType: HASH
        ProvisionedThroughput:
          ReadCapacityUnits: 1
          WriteCapacityUnits: 1

  Outputs:

#     TODO: If needed, add Cloudformation Outputs
#     EXAMPLE: Cloudformation Output
#     NewOutput:
#       Description: "Description for the output"
#       Value: "Some output value"