service: heisenberg-presigned-url
package:
  excludeDevDependencies: true
  individually: true
  exclude:
    - database/**
    - docker/**
    - openapi/**
    - .serverless/**
    - serverless/**
    - src/**
    - tests/**
    - .env
    - .env.example
    - env.yml.example
    - "*.env.yml"
    - .gitlab-ci.yml
    - .gitignore
    - README.md
    - node_modules/**
    - tests/**

plugins:
  - serverless-jetpack
  - serverless-import-apigateway

app:  heisenberg-presigned-url

provider:
  name: aws
  runtime: nodejs14.x
  stage: ${opt:stage}
  region: eu-west-1
  deploymentBucket:
    name: heisenberg-serverless-deployments-${self:custom.stage}
  logs:
    restApi: true

custom:
  # General
  stage: "${self:provider.stage}"
  region: ${opt:region, self:provider.region}
  accountId: ${file(./serverless/helpers/account-id.js):getAccountId}
  # API Gateway
  importApiGateway:
    name: admin-${self:custom.stage}  # Required 
    path: / 
  # Authorizer
  superAdminAuthorizer: !ImportValue ${self:custom.stage}AdminApiGatewaySuperAdminAuthorizerId
  prescriptionAuthorizer: !ImportValue ${self:custom.stage}AdminApiGatewayPrescriptionAuthorizerId
  fulfilmentAuthorizer: !ImportValue ${self:custom.stage}AdminApiGatewayFulfilmentAuthorizerId
  packagingAuthorizer: !ImportValue ${self:custom.stage}AdminApiGatewayPackagingAuthorizerId
  customerAuthorizer: !ImportValue ${self:custom.stage}AdminApiGatewayCustomerAuthorizerId
  cognitoAuthorizer: !ImportValue ${self:custom.stage}AdminApiGatewayCognitoAuthorizerId
  # Layer
  authorizeLayer: arn:aws:lambda:${self:custom.region}:${self:custom.accountId}:layer:authorize-${self:custom.stage}:${file(${self:custom.stage}.env.yml):layer-versions.AUTHORIZE}
  awsServicesLayer: arn:aws:lambda:${self:custom.region}:${self:custom.accountId}:layer:aws-services-${self:custom.stage}:${file(${self:custom.stage}.env.yml):layer-versions.AWS_SERVICES}
  databaseLayer: arn:aws:lambda:${self:custom.region}:${self:custom.accountId}:layer:database-${self:custom.stage}:${file(${self:custom.stage}.env.yml):layer-versions.DATABASE}
  generalUtilsLayer: arn:aws:lambda:${self:custom.region}:${self:custom.accountId}:layer:general-utils-${self:custom.stage}:${file(${self:custom.stage}.env.yml):layer-versions.GENERAL_UTILS}
  emailLayer: arn:aws:lambda:${self:custom.region}:${self:custom.accountId}:layer:email-${self:custom.stage}:${file(${self:custom.stage}.env.yml):layer-versions.EMAIL}
  # Bucket
  bucketName: ${file(${self:custom.stage}.env.yml):s3_prescription.S3_BUCKET}

functions:
  AdminGeneratePresignedUrlFunction:
    handler: src/presigned-url/generate-upload/handler.handle
    vpc:
        securityGroupIds:
          - {"Fn::ImportValue": "${self:custom.stage}LambdaSecurityGroup"}
        subnetIds:
          - {"Fn::ImportValue": "${self:custom.stage}PublicSubnet1"}
          - {"Fn::ImportValue": "${self:custom.stage}PublicSubnet2"}
    name: admin-presigned-url-generate-upload-${self:custom.stage}
    memorySize: 128
    timeout: 6
    role: AdminS3ContentRole
    events:
      - http: 
          path: presigned-url/generate-upload
          method: post
          cors:
            origin: '*'
            headers: 
              - Content-Type
              - X-Amz-Date
              - Authorization
              - X-Api-Key
              - X-Amz-Security-Token
              - AccessToken
              - IdToken
            allowCredentials: false
          authorizer:
            type: COGNITO_USER_POOLS
            authorizerId: ${self:custom.cognitoAuthorizer}
    layers:
      - ${self:custom.generalUtilsLayer}
      - ${self:custom.databaseLayer}
    package:
      include:
        - src/presigned-url/generate-upload/*.js
    dependsOn:
      AdminVPCPermissionPolicy

  AdminGeneratePresignedGetFunction:
    handler: src/presigned-url/generate-download/handler.handle
    vpc:
        securityGroupIds:
          - {"Fn::ImportValue": "${self:custom.stage}LambdaSecurityGroup"}
        subnetIds:
          - {"Fn::ImportValue": "${self:custom.stage}PublicSubnet1"}
          - {"Fn::ImportValue": "${self:custom.stage}PublicSubnet2"}
    name: admin-presigned-url-generate-download-${self:custom.stage}
    memorySize: 128
    timeout: 6
    role: AdminS3ContentRole
    events:
      - http: 
          path: presigned-url/generate-download
          method: post
          cors:
            origin: '*'
            headers: 
              - Content-Type
              - X-Amz-Date
              - Authorization
              - X-Api-Key
              - X-Amz-Security-Token
              - AccessToken
              - IdToken
            allowCredentials: false
          authorizer:
            type: COGNITO_USER_POOLS
            authorizerId: ${self:custom.cognitoAuthorizer}
          
    layers:
      - ${self:custom.generalUtilsLayer}
      - ${self:custom.databaseLayer}
    package:
      include:
        - src/presigned-url/generate-download/*.js
    dependsOn:
      AdminVPCPermissionPolicy

resources:
  Resources:
    # Role
    AdminS3ContentRole:
      Type: AWS::IAM::Role
      Properties:
        RoleName: ${self:service}-S3ContentRole-${self:custom.stage}
        AssumeRolePolicyDocument:
          Version: "2012-10-17"
          Statement:
            - Effect: Allow
              Principal:
                Service:
                  - lambda.amazonaws.com
              Action: sts:AssumeRole
    # Policies
    AdminS3UploadPolicy:
      Type: AWS::IAM::Policy
      Properties:
        PolicyName: ${self:service}-AdminS3UploadPolicy-${self:custom.stage}
        PolicyDocument:
          Version: "2012-10-17"
          Statement:
            - Effect: Allow
              Action:
                - s3:PutObject
                - s3:GetObject
              Resource:
                - arn:aws:s3:::${self:custom.bucketName}/*
        Roles:
          - Ref: AdminS3ContentRole

    AdminLoggingPermissionPolicy:
      Type: AWS::IAM::Policy
      Properties:
        PolicyName: ${self:service}-AdminLoggingPermission-${self:custom.stage}
        PolicyDocument:
          Version: "2012-10-17"
          Statement:
            - Effect: Allow
              Action:
                - logs:CreateLogGroup
                - logs:CreateLogStream
                - logs:PutLogEvents
              Resource:
                - Fn::Join:
                    - ""
                    - - "arn:aws:logs:${self:custom.region}:"
                      - Ref: "AWS::AccountId"
                      - ":log-group:/aws/lambda/*"
        Roles:
          - Ref: AdminS3ContentRole
          
    AdminVPCPermissionPolicy:
      Type: AWS::IAM::Policy
      Properties:
        PolicyName: ${self:service}-AdminVPCPermission-${self:custom.stage}
        PolicyDocument:
          Version: "2012-10-17"
          Statement:
            - Effect: Allow
              Action:
                - ec2:DescribeNetworkInterfaces
                - ec2:CreateNetworkInterface
                - ec2:DeleteNetworkInterface
                - ec2:DescribeInstances
                - ec2:AttachNetworkInterface
              Resource: "*"
        Roles:
          - Ref: AdminS3ContentRole