serverless.yml

service: bee-to-bee-api

plugins:
  - serverless-python-requirements
  - serverless-wsgi
  - serverless-iam-roles-per-function
  - serverless-plugin-log-retention

provider:
  name: aws
  stage: dev
  runtime: python3.7
  
  region: eu-west-1   # eu-central-1
  deploymentBucket:
    name: bee-to-bee-deployment
    blockPublicAccess: true
    maxPreviousDeploymentArtifacts: 5 
    serverSideEncryption: AES256

  memorySize: 256
  timeout: 20

  apiGateway:
    minimumCompressionSize: 1024

  tracing:
    lambda: true
    apiGateway: true

  environment:
    SQLALCHEMY_DATABASE_URI: ${ssm:/btb/${self:custom.stage}/dburl~true}
    STAGE: ${self:custom.stage}
    MAX_CONTACT_REQUESTS: 10
    EMAIL_SENDER: ${ssm:/btb/${self:custom.stage}/emailsender}
    PYTHONIOENCODING: UTF8
    FRONTEND_URL: 
      Fn::Join:
        - ''       
        -  - 'https://'
           - Fn::Select:
             - 0
             - ${ssm:/btb/${self:custom.stage}/cloudfronturl~split}

  vpc:
    securityGroupIds:
      - Fn::ImportValue: DatabaseSecurityGroupId

    subnetIds:
      - Fn::ImportValue: DatabaseSubnetAId
      - Fn::ImportValue: DatabaseSubnetBId
      - Fn::ImportValue: DatabaseSubnetCId

  iamRoleStatements:
      - Effect: Allow
        Action:
          - xray:PutTraceSegments
          - xray:PutTelemetryRecords
        Resource: "*"

package:
  include:
    - btb/**
    - pgsql/**

  exclude:
    - "**"

custom:
  stage: ${opt:stage, self:provider.stage}
  serverless-iam-roles-per-function:
    defaultInherit: true

  wsgi:
    app: btb.api.wsgi.app
    packRequirements: false

  pythonRequirements:
    dockerizePip: non-linux

  logRetentionInDays: 30

functions:
  dbupdate:
    handler: btb.update.handler
    timeout: 900
    reservedConcurrency: 1

  custom-message:
    handler: btb.cognito.handler
    vpc: 
      securityGroupIds: []
      subnetIds: []

    events:
      - cognitoUserPool:
          pool: MyUserPool # searches for CognitoUserPoolMyUserPool
          trigger: CustomMessage

  graphql:
    handler: wsgi_handler.handler
    iamRoleStatements:
      - Effect: Allow
        Action:
          - ses:SendEMail
          - ses:SendRawEmail

        Resource:
          - "*"
          
      - Effect: Allow
        Action:
          - xray:PutTraceSegments
          - xray:PutTelemetryRecords
        Resource: "*"

    events:
      - http:
          method: ANY
          path: /graphql
          cors: true

          authorizer:
            type: COGNITO_USER_POOLS
            authorizerId:
              Ref: ApiGatewayAuthorizer

      - http:
          method: ANY
          path: /graphql/{proxy+}
          cors: true

          authorizer:
            type: COGNITO_USER_POOLS
            authorizerId:
              Ref: ApiGatewayAuthorizer

resources:
  Resources:
    DBUpdateAsyncConfig:
      Type: AWS::Lambda::EventInvokeConfig
      Properties:
        FunctionName:
          Ref: DbupdateLambdaFunction
        MaximumRetryAttempts: 0
        Qualifier: $LATEST

    CustomDashmessageAsyncConfig:
      Type: AWS::Lambda::EventInvokeConfig
      Properties:
        FunctionName:
          Ref: CustomDashmessageLambdaFunction
        MaximumRetryAttempts: 0
        Qualifier: $LATEST

    GraphqlUpdateAsyncConfig:
      Type: AWS::Lambda::EventInvokeConfig
      Properties:
        FunctionName:
          Ref: GraphqlLambdaFunction
        MaximumRetryAttempts: 0
        Qualifier: $LATEST

    CognitoUserPoolMyUserPool:
      Type: AWS::Cognito::UserPool
      Properties:
        MfaConfiguration: OFF
        AdminCreateUserConfig:
          AllowAdminCreateUserOnly: false

        AutoVerifiedAttributes:
          - email
          
        UserPoolName: ${self:service}-${self:custom.stage}-pool
        UsernameAttributes:
          - email

        EmailConfiguration:
          SourceArn: ${ssm:/btb/prod/cognitosender}

        VerificationMessageTemplate:
          DefaultEmailOption: CONFIRM_WITH_CODE

        Policies:
          PasswordPolicy:
            MinimumLength: 6
            RequireLowercase: False
            RequireNumbers: False
            RequireSymbols: False
            RequireUppercase: True
            TemporaryPasswordValidityDays: 1

    CognitoIdentityPool:
      Type: AWS::Cognito::IdentityPool
      Properties:
        IdentityPoolName: ${self:service}-${self:custom.stage}-identity-pool
        AllowUnauthenticatedIdentities: true

        CognitoIdentityProviders:
          - ClientId:
              Ref: CognitoUserPoolClient
            ProviderName:
              Fn::GetAtt:
                - CognitoUserPoolMyUserPool
                - ProviderName

    CognitoUserPoolDomain:
      Type: AWS::Cognito::UserPoolDomain
      Properties:
        Domain: ${self:service}-${self:custom.stage}-pool-client  
        UserPoolId:
          Ref: CognitoUserPoolMyUserPool

    CognitoUserPoolClient:
      Type: AWS::Cognito::UserPoolClient
      Properties:
        ClientName: ${self:service}-${self:custom.stage}-pool-client
        GenerateSecret: False
        
        CallbackURLs:
          - http://localhost:3000
        LogoutURLs:
          - http://localhost:3000

        AllowedOAuthFlows: 
          - implicit
        AllowedOAuthScopes: 
          - email
          - openid
        SupportedIdentityProviders: 
          - COGNITO
        UserPoolId:
          Ref: CognitoUserPoolMyUserPool
        
    ApiGatewayAuthorizer:
      Type: AWS::ApiGateway::Authorizer
      DependsOn:
        - ApiGatewayRestApi
      Properties:
        AuthorizerResultTtlInSeconds: 300
        IdentitySource: method.request.header.Authorization
        Name: ${self:service}-${self:custom.stage}-authorizer
        RestApiId:
          Ref: ApiGatewayRestApi

        Type: COGNITO_USER_POOLS
        ProviderARNs:
          - Fn::GetAtt:
              - CognitoUserPoolMyUserPool
              - Arn

  Outputs:
    UserPoolOutput:
      Value:
        Ref: CognitoUserPoolMyUserPool
      Export:
        Name: CognitoUserPool-${self:custom.stage}

    CognitoUserPoolClientOutput:
      Value:
        Ref: CognitoUserPoolClient
      Export:
        Name: CognitoUserPoolClient-${self:custom.stage}

    IdentityPoolOutput:
      Value:
        Ref: CognitoIdentityPool
      Export:
        Name: CognitoIdentityPool-${self:custom.stage}

    ApiGatewayRestApiOutput:
      Value:
        Ref: ApiGatewayRestApi
      Export:
        Name: ApiGatewayRestApiId-${self:custom.stage}