serverless.yml

service:
  name: atlas

plugins:
  - serverless-webpack
  - serverless-dynamodb-local
  - serverless-offline-ssm
  - serverless-offline
  - serverless-iam-roles-per-function
  - serverless-prune-plugin
  - serverless-plugin-tracing
  # - serverless-dotenv-plugin

package:
  individually: false
  include:
    - src/**

custom:
  webpack:
    webpackConfig: ./webpack.config.js
    includeModules: true
  serverless-iamroles:
    defaultInherit: true
  prune:
    automatic: true
    number: 3
  dynamodb:
    stages:
      - dev
      - local
    start:
      migrate: true
  serverless-offline-ssm:
    stages:
      - local

provider:
  name: aws
  runtime: nodejs12.x
  frameworkVersion: ‘1.64.1’
  stage: ${opt:stage, 'local'}
  region: ${opt:region, 'us-east-1'}
  apiGateway:
    minimumCompressionSize: 1024
  environment:
    DEBUG: '*'
    NODE_ENV: ${self:provider.stage}
    BASE_URL: {
      "Fn::Join" : [
        "",
        [
          " https://",
          { "Ref" : "ApiGatewayRestApi" },
          ".execute-api.${self:provider.region}.amazonaws.com/${self:provider.stage}"
        ]
      ]
    }
    AWS_NODEJS_CONNECTION_REUSE_ENABLED: 1
  tracing:
    lambda: true
  iamRoleStatements:
    - Effect: Allow
      Action:
        - xray:PutTraceSegments
        - xray:PutTelemetryRecords
      Resource: "*"

functions:
  # Authorizer
  validateAuth:
    handler: src/middlewares/validateAuth.handle
    environment:
      PUBLIC_KEY: ${ssm:atlas_jwt_public_key~true}

  # Authenticate
  authenticate:
    handler: src/functions/authenticate.handle
    environment:
      PRIVATE_KEY: ${ssm:atlas_jwt_private_key~true}
    events:
      - http:
          path: /authenticate
          method: POST
          cors: true
    iamRoleStatements:
      - Effect: Allow
        Action: dynamodb:Query
        Resource: "arn:aws:dynamodb:${self:provider.region}:*:table/users*"
      - Effect: Allow
        Action: dynamodb:PutItem
        Resource: "arn:aws:dynamodb:${self:provider.region}:*:table/authentication_logs*"

  # Register user
  register:
    handler: src/functions/register.handle
    events:
      - http:
          path: /register
          method: POST
          cors: true
    iamRoleStatements:
      - Effect: Allow
        Action:
          - dynamodb:PutItem
          - dynamodb:Query
        Resource: "arn:aws:dynamodb:${self:provider.region}:*:table/users*"
      - Effect: Allow
        Action:
          - ses:SendTemplatedEmail
        Resource: "*"

  # Return user information
  getUserInfo:
    handler: src/functions/getUserInfo.handle
    events:
      - http:
          path: /me
          method: GET
          cors: true
          authorizer: validateAuth
    iamRoleStatements:
      - Effect: Allow
        Action: dynamodb:Query
        Resource: "arn:aws:dynamodb:${self:provider.region}:*:table/users"

  # Confirm user registration
  confirmRegistration:
    handler: src/functions/confirmRegistration.handle
    events:
      - http:
          path: /confirm
          method: GET
    iamRoleStatements:
      - Effect: Allow
        Action:
          - dynamodb:Update
          - dynamodb:Query
        Resource: "arn:aws:dynamodb:${self:provider.region}:*:table/users"

resources:
  Resources:

    # API Gateway
    GatewayResponse:
      Type: 'AWS::ApiGateway::GatewayResponse'
      Properties:
        ResponseParameters:
          gatewayresponse.header.Access-Control-Allow-Origin: "'*'"
          gatewayresponse.header.Access-Control-Allow-Headers: "'*'"
        ResponseType: EXPIRED_TOKEN
        RestApiId:
          Ref: 'ApiGatewayRestApi'
        StatusCode: '401'

    AuthFailureGatewayResponse:
      Type: 'AWS::ApiGateway::GatewayResponse'
      Properties:
        ResponseParameters:
          gatewayresponse.header.Access-Control-Allow-Origin: "'*'"
          gatewayresponse.header.Access-Control-Allow-Headers: "'*'"
        ResponseType: UNAUTHORIZED
        RestApiId:
          Ref: 'ApiGatewayRestApi'
        StatusCode: '401'

    # DynamoDB
    dbUsers:
      Type: AWS::DynamoDB::Table
      Properties:
        TableName: users
        ProvisionedThroughput:
          ReadCapacityUnits: 5
          WriteCapacityUnits: 5
        AttributeDefinitions:
          - AttributeName: id
            AttributeType: S
          - AttributeName: email
            AttributeType: S
        KeySchema:
          - AttributeName: id
            KeyType: HASH
        GlobalSecondaryIndexes:
          - IndexName: email-index
            KeySchema:
              - AttributeName: email
                KeyType: HASH
            Projection:
              ProjectionType: ALL
            ProvisionedThroughput:
              ReadCapacityUnits: 5
              WriteCapacityUnits: 5

    dbAuthenticationLogs:
      Type: AWS::DynamoDB::Table
      Properties:
        TableName: authentication_logs
        ProvisionedThroughput:
          ReadCapacityUnits: 5
          WriteCapacityUnits: 5
        AttributeDefinitions:
          - AttributeName: id
            AttributeType: S
          - AttributeName: userId
            AttributeType: S
        KeySchema:
          - AttributeName: id
            KeyType: HASH
        GlobalSecondaryIndexes:
          - IndexName: user-index
            KeySchema:
              - AttributeName: userId
                KeyType: HASH
            Projection:
              ProjectionType: ALL
            ProvisionedThroughput:
              ReadCapacityUnits: 5
              WriteCapacityUnits: 5

    dbClients:
      Type: AWS::DynamoDB::Table
      Properties:
        TableName: clients
        ProvisionedThroughput:
          ReadCapacityUnits: 5
          WriteCapacityUnits: 5
        AttributeDefinitions:
          - AttributeName: client_id
            AttributeType: S
        KeySchema:
          - AttributeName: client_id
            KeyType: HASH

    # SES
    registrationEmailTemplate:
      Type: AWS::SES::Template
      Properties:
        Template:
          TemplateName: RegistrationEmail
          SubjectPart: "Verifique sua conta, {{name}}"
          HtmlPart: "<p>Boas-vindas {{name}},</p><p>Verifique seu cadastro na plataforma <a href=\"{{link}}\">clicando aqui</a>.</p>"