serverless.yml

service: fotopia-web-app

frameworkVersion: ">=1.1.0 <2.0.0"

plugins:
  - serverless-domain-manager
  - serverless-webpack
  - serverless-s3-remover

custom:
  webpack:
    includeModules:
      forceExclude:
        - aws-sdk
        - tape
  remover:
     buckets:
       - ${self:provider.environment.S3_BUCKET}
       - ${self:provider.environment.S3_BUCKET_GENERATED}
  customDomain:
    domainName: ${self:provider.environment.CUSTOM_DOMAIN}
    basePath: ''
    stage: ${opt:stage, self:provider.stage}
    createRoute53Record: true
    enabled: ${self:provider.environment.USE_CUSTOM_DOMAIN}
  fotopia:
    nameSpace: ${file(./serverlessEnv.js):config.NAME_SPACE}
    resourcePrefix: ${self:service}-${self:custom.fotopia.nameSpace}-${opt:stage, self:provider.stage}
provider:
  name: aws
  runtime: nodejs12.x
  region: us-east-1
  environment:
    DYNAMODB_TABLE: ${self:service}-${opt:stage, self:provider.stage}
    DYNAMODB_TABLE_INDEXES: ${self:service}-${opt:stage, self:provider.stage}-indexes
    S3_BUCKET: ${self:custom.fotopia.resourcePrefix}
    S3_BUCKET_GENERATED: ${self:custom.fotopia.resourcePrefix}-generated
    LAMBDA_PREFIX: ${self:service}-${opt:stage, self:provider.stage}-
    USER_POOL_NAME: ${self:service}-${opt:stage, self:provider.stage}-user-pool
    USER_POOL_APP_CLIENT: ${self:service}-${opt:stage, self:provider.stage}-user-pool-client
    IDENTITY_POOL: fotopia ${opt:stage, self:provider.stage} identity pool
    COGNITO_AUTHORIZED_ROLE_NAME: ${self:service}-${opt:stage, self:provider.stage}-auth-role-name
    COGNITO_AUTHORIZED_POLICY: ${self:service}-${opt:stage, self:provider.stage}-auth-policy
    COGNITO_AUTHORIZED_S3_POLICY: ${self:service}-${opt:stage, self:provider.stage}-auth-s3-policy
    COGNITO_AUTHORIZED_API_POLICY: ${self:service}-${opt:stage, self:provider.stage}-auth-api-policy
    COGNITO_UNAUTHORIZED_ROLE_NAME: ${self:service}-${opt:stage, self:provider.stage}-unauth-role-name
    CUSTOM_DOMAIN: ${file(./serverlessEnv.js):config.${opt:stage, self:provider.stage}.CUSTOM_DOMAIN}
    USE_CUSTOM_DOMAIN: ${file(./serverlessEnv.js):config.${opt:stage, self:provider.stage}.USE_CUSTOM_DOMAIN}
    FOTOPIA_GROUP: ${file(./serverlessEnv.js):config.FOTOPIA_GROUP}-${opt:stage, self:provider.stage}
  iamRoleStatements:
    - Effect: Allow
      Action:
        - dynamodb:Query
        - dynamodb:Scan
        - dynamodb:GetItem
        - dynamodb:PutItem
        - dynamodb:UpdateItem
        - dynamodb:DeleteItem
        - dynamodb:DescribeStream
        - dynamodb:GetRecords
        - dynamodb:GetShardIterator
        - dynamodb:ListStreams
        - dynamodb:BatchGetItem
        - dynamodb:BatchWriteItem
      Resource:
        - "arn:aws:dynamodb:${opt:region, self:provider.region}:*:table/${self:provider.environment.DYNAMODB_TABLE}"
        - "arn:aws:dynamodb:${opt:region, self:provider.region}:*:table/${self:provider.environment.DYNAMODB_TABLE}/index/*"
        - "arn:aws:dynamodb:${opt:region, self:provider.region}:*:table/${self:provider.environment.DYNAMODB_TABLE_INDEXES}"
    - Effect: Allow
      Action:
        - lambda:InvokeFunction
        - lambda:InvokeAsync
      Resource:
        - "*"
        - "arn:aws:lambda:*:*:*"
    - Effect: Allow
      Action:
        - logs:CreateLogGroup
        - logs:CreateLogStream
        - logs:PutLogEvents
        - logs:DescribeLogStreams
      Resource:
        - "arn:aws:logs:*:*:*"
    - Effect: "Allow"
      Action:
        - "s3:GetObject"
        - "s3:PutObject"
        - "s3:DeleteObject"
        - "s3:ListBucket"
      Resource:
        - "arn:aws:s3:::${self:provider.environment.S3_BUCKET}/*"
    - Effect: "Allow"
      Action:
        - "s3:GetObject"
        - "s3:PutObject"
        - "s3:DeleteObject"
        - "s3:ListBucket"
      Resource: "arn:aws:s3:::${self:provider.environment.S3_BUCKET_GENERATED}/*"
    - Effect: "Allow"
      Action:
        - "rekognition:IndexFaces"
        - "rekognition:CreateCollection"
        - "rekognition:DeleteCollection"
        - "rekognition:DeleteFaces"
        - "rekognition:DetectLabels"
        - "rekognition:ListFaces"
        - "rekognition:SearchFaces"
      Resource: "*"
functions:
  create:
    handler: fotos/create.createItem
    memorySize: 128
    timeout: 20
    events:
      - http:
          path: create
          method: post
          cors: true
          authorizer: aws_iam
  fotoEvents:
    handler: fotos/fotoEvents.handler
    events:
      - s3:
          bucket: ${self:provider.environment.S3_BUCKET}
          event: s3:ObjectCreated:*
          existing: true
  collectionCreate:
    handler: fotos/collection.createCollection
    memorySize: 128
  collectionDelete:
    handler: fotos/collection.deleteCollection
    memorySize: 128
  query:
    handler: fotos/query.queryItems
    memorySize: 128
    timeout: 20
    events:
      - http:
          path: query
          method: post
          cors: true
          authorizer: aws_iam

  get:
    handler: fotos/get.getItem
    memorySize: 128
    events:
      - http:
          path: foto/{username}/{id}
          method: get
          cors: true
          authorizer: aws_iam
          request:
            parameters:
              headers:
                x-trace-meta-parent-id: false
                x-trace-meta-trace-id: false

  update:
    handler: fotos/update.updateItem
    memorySize: 128
    events:
      - http:
          path: foto/{username}/{id}
          method: put
          cors: true
          authorizer: aws_iam

  delete:
    handler: fotos/delete.deleteItem
    memorySize: 128
    timeout: 20
    events:
      - http:
          path: foto/{username}/{id}
          method: delete
          cors: true
          authorizer: aws_iam

  thumbs:
    handler: fotos/thumbs.createThumb
    memorySize: 128
    events:
      - http:
          path: thumbs
          method: post
          cors: true
          authorizer: aws_iam

  indexes:
    handler: fotos/indexes.getItem
    memorySize: 128
    events:
      - http:
          path: indexes
          method: get
          cors: true
          authorizer: aws_iam
          request:
            parameters:
              headers:
                x-trace-meta-parent-id: false
                x-trace-meta-trace-id: false

  indexesUpdate:
    handler: fotos/indexes.putItem
    memorySize: 128
    events:
      - http:
          path: indexes/update
          method: put
          cors: true
          authorizer: aws_iam

  people:
    handler: fotos/people.getItem
    memorySize: 128
    events:
      - http:
          path: people
          method: get
          cors: true
          authorizer: aws_iam
          request:
            parameters:
              headers:
                x-trace-meta-parent-id: false
                x-trace-meta-trace-id: false

  peopleUpdate:
    handler: fotos/people.putItem
    memorySize: 128
    events:
      - http:
          path: people/update
          method: put
          cors: true
          authorizer: aws_iam

  peopleMerge:
    handler: fotos/peopleMerge.mergePeople
    memorySize: 128
    events:
      - http:
          path: people/merge
          method: post
          cors: true
          authorizer: aws_iam

  personThumb:
      handler: fotos/personThumb.createThumb
      memorySize: 128
      timeout: 20
      events:
        - http:
            path: people/thumbs
            method: post
            cors: true
            authorizer: aws_iam

  person:
    handler: fotos/person.updatePerson
    memorySize: 128
    events:
      - http:
          path: person/{id}
          method: put
          cors: true
          authorizer: aws_iam

  stream:
    handler: fotos/stream.indexRecords
    memorySize: 128
    events:
      - stream:
          type: dynamodb
          arn:
            Fn::GetAtt:
              - FotopiaDynamoDbTable
              - StreamArn

  faces:
    handler: fotos/faces.addToPerson
    memorySize: 128
    timeout: 20
    events:
      - http:
          path: faces
          method: post
          cors: true
          authorizer: aws_iam

resources:
  Resources:
    FotopiaDynamoDbTable:
      Type: 'AWS::DynamoDB::Table'
      DeletionPolicy: Delete
      Properties:
        AttributeDefinitions:
          - AttributeName: username
            AttributeType: S
          - AttributeName: id
            AttributeType: S
          - AttributeName: birthtime
            AttributeType: N
          - AttributeName: group
            AttributeType: S
        KeySchema:
          - AttributeName: username
            KeyType: HASH
          - AttributeName: id
            KeyType: RANGE
        BillingMode: PAY_PER_REQUEST
        TableName: ${self:provider.environment.DYNAMODB_TABLE}
        LocalSecondaryIndexes:
          -
            IndexName: "UsernameBirthtimeIndex"
            KeySchema:
              -
                AttributeName: "username"
                KeyType: "HASH"
              -
                AttributeName: "birthtime"
                KeyType: "RANGE"
            Projection:
              NonKeyAttributes:
                - "id"
              ProjectionType: "INCLUDE"
        GlobalSecondaryIndexes:
          -
            IndexName: "GroupBirthtimeIndex"
            KeySchema:
              -
                AttributeName: "group"
                KeyType: "HASH"
              -
                AttributeName: "birthtime"
                KeyType: "RANGE"
            Projection:
              NonKeyAttributes:
                - "id"
                - "username"
                - "people"
                - "tags"
                - "img_key"
                - "img_thumb_key"
                - "meta"
                - "userIdentityId"
              ProjectionType: "INCLUDE"
        StreamSpecification:
          StreamViewType: NEW_AND_OLD_IMAGES
    IndexesDynamoDbTable:
      Type: 'AWS::DynamoDB::Table'
      DeletionPolicy: Delete
      Properties:
        AttributeDefinitions:
          - AttributeName: id
            AttributeType: S
        KeySchema:
          - AttributeName: id
            KeyType: HASH
        BillingMode: PAY_PER_REQUEST
        TableName: ${self:provider.environment.DYNAMODB_TABLE_INDEXES}
        StreamSpecification:
          StreamViewType: NEW_AND_OLD_IMAGES
    S3BucketFotos:
      Type: AWS::S3::Bucket
      DeletionPolicy: Delete
      Properties:
        BucketName: ${self:provider.environment.S3_BUCKET}
        CorsConfiguration:
          CorsRules:
            - AllowedHeaders:
                - "*"
              AllowedMethods:
                - HEAD
                - GET
                - PUT
                - POST
                - DELETE
              AllowedOrigins:
                - "*"
    S3BucketFotosThumbs:
      Type: AWS::S3::Bucket
      DeletionPolicy: Delete
      Properties:
        BucketName: ${self:provider.environment.S3_BUCKET_GENERATED}
    UserPool:
      Type: "AWS::Cognito::UserPool"
      Properties:
        UserPoolName: ${self:provider.environment.USER_POOL_NAME}
        AdminCreateUserConfig:
          AllowAdminCreateUserOnly: true
        AutoVerifiedAttributes:
          - email
        AliasAttributes:
          - email
        Schema:
          - Name: name
            AttributeDataType: String
            Mutable: true
            Required: false
          - Name: email
            AttributeDataType: String
            Mutable: false
            Required: true
    UserPoolClient:
      Type: "AWS::Cognito::UserPoolClient"
      Properties:
        ClientName: ${self:provider.environment.USER_POOL_APP_CLIENT}
        RefreshTokenValidity: 30
        ExplicitAuthFlows: [ADMIN_NO_SRP_AUTH]
        GenerateSecret: false
        UserPoolId:
          Ref: UserPool
    IdentityPool:
      Type: "AWS::Cognito::IdentityPool"
      Properties:
        IdentityPoolName: ${self:provider.environment.IDENTITY_POOL}
        AllowUnauthenticatedIdentities: true
        CognitoIdentityProviders:
          - ClientId:
              Ref: UserPoolClient
            ProviderName:
              Fn::GetAtt: [ UserPool, ProviderName ]
    CognitoUnauthorizedRole:
      Type: "AWS::IAM::Role"
      Properties:
        RoleName: ${self:provider.environment.COGNITO_UNAUTHORIZED_ROLE_NAME}
        AssumeRolePolicyDocument:
          Version: "2012-10-17"
          Statement:
            - Effect: "Allow"
              Principal:
                Federated: "cognito-identity.amazonaws.com"
              Action:
                - "sts:AssumeRoleWithWebIdentity"
              Condition:
                StringEquals:
                  "cognito-identity.amazonaws.com:aud":
                    Ref: IdentityPool
                "ForAnyValue:StringLike":
                  "cognito-identity.amazonaws.com:amr": unauthenticated
        Policies:
          - PolicyName: "CognitoUnauthorizedPolicy"
            PolicyDocument:
              Version: "2012-10-17"
              Statement:
                - Effect: "Allow"
                  Action:
                    - "mobileanalytics:PutEvents"
                    - "cognito-sync:*"
                  Resource: "*"
    CognitoAuthorizedRole:
      Type: "AWS::IAM::Role"
      Properties:
        RoleName: ${self:provider.environment.COGNITO_AUTHORIZED_ROLE_NAME}
        AssumeRolePolicyDocument:
          Version: "2012-10-17"
          Statement:
            - Effect: "Allow"
              Principal:
                Federated: "cognito-identity.amazonaws.com"
              Action:
                - "sts:AssumeRoleWithWebIdentity"
              Condition:
                StringEquals:
                  "cognito-identity.amazonaws.com:aud":
                    Ref: IdentityPool
        Policies:
          - PolicyName: ${self:provider.environment.COGNITO_AUTHORIZED_POLICY}
            PolicyDocument:
              Version: "2012-10-17"
              Statement:
                - Effect: "Allow"
                  Action:
                    - "mobileanalytics:PutEvents"
                    - "cognito-sync:*"
                    - "cognito-identity:*"
                  Resource: "*"
          - PolicyName: ${self:provider.environment.COGNITO_AUTHORIZED_S3_POLICY}
            PolicyDocument:
              Version: "2012-10-17"
              Statement:
                - Effect: "Allow"
                  Action:
                    - "s3:GetObject"
                    - "s3:PutObject"
                  Resource: arn:aws:s3:::${self:provider.environment.S3_BUCKET}/*
                - Effect: "Allow"
                  Action:
                    - "s3:GetObject"
                  Resource: arn:aws:s3:::${self:provider.environment.S3_BUCKET_GENERATED}/*
          - PolicyName: ${self:provider.environment.COGNITO_AUTHORIZED_API_POLICY}
            PolicyDocument:
              Version: "2012-10-17"
              Statement:
                - Effect: "Allow"
                  Action:
                    - "execute-api:Invoke"
                  Resource: "arn:aws:execute-api:${self:provider.region}:*:*/*"
    IdentityPoolRoleMapping:
      Type: "AWS::Cognito::IdentityPoolRoleAttachment"
      Properties:
        IdentityPoolId:
          Ref: IdentityPool
        Roles:
          authenticated:
            Fn::GetAtt: [ CognitoAuthorizedRole, Arn ]
          unauthenticated:
            Fn::GetAtt: [ CognitoUnauthorizedRole, Arn ]
  Outputs:
    UserPoolId:
      Value:
        Ref: UserPool
      Export:
        Name: "UserPool::Id-${opt:stage, self:provider.stage}"
    UserPoolClientId:
      Value:
        Ref: UserPoolClient
      Export:
        Name: "UserPoolClient::Id-${opt:stage, self:provider.stage}"
    IdentityPoolId:
      Value:
        Ref: IdentityPool
      Export:
        Name: "IdentityPool::Id-${opt:stage, self:provider.stage}"
    CognitoAuthorizedRoleArn:
      Value:
        Fn::GetAtt: [ CognitoAuthorizedRole, Arn ]
      Export:
        Name: "CognitoAuthorizedRole::Arn-${opt:stage, self:provider.stage}"
    CognitoUnauthorizedRoleArn:
      Value:
        Fn::GetAtt: [ CognitoUnauthorizedRole, Arn ]
      Export:
        Name: "CognitoUnauthorizedRole::Arn-${opt:stage, self:provider.stage}"
    Region:
      Value: ${self:provider.region}
    Bucket:
      Value: ${self:provider.environment.S3_BUCKET}
    BucketGenerated:
      Value: ${self:provider.environment.S3_BUCKET_GENERATED}
package:
  exclude:
    - node_modules/**
    - '!node_modules/uuid/**'
    - '!node_modules/babel-runtime/**'
    - '!node_modules/sharp/**'
    - '!node_modules/dynamodb-data-types/**'
    - '!node_modules/exifreader/**'