serverless.yml

service: lambdaautotraining

provider:
  name: aws
  runtime: nodejs10.x

  stage: dev
  region: us-east-1
  
  role: IamRole

  environment:
    SERVICE: ${self:service}
    REGION: ${self:provider.region}
    BUCKET: ${self:service}-${opt:stage, self:provider.stage}
    STAGE: ${opt:stage, self:provider.stage}
    DYNAMODB_TABLE_MODELS: ${self:service}-models-${opt:stage, self:provider.stage}
    DYNAMODB_TABLE_DATA: ${self:service}-data-${opt:stage, self:provider.stage}
    FUNCTION_PREFIX: ${self:service}-${opt:stage, self:provider.stage}-
    IAM_ROLE: ${self:service}-${opt:stage, self:provider.stage}-${self:provider.region}-managedrole
    API_URL:
      Fn::Join:
        - ""
        - - "https://"
          - Ref: "ApiGatewayRestApi"
          - ".execute-api.${self:provider.region}.amazonaws.com/${self:provider.stage}"

package:
  exclude:
    - py/**

functions:
  upload:
    handler: js/upload.upload
    events:
      - http:
          path: upload
          method: post
        
  train:
    handler: js/train.train
    environment:
      AMI_ID: ami-0f812849f5bc97db5
      KEY_NAME: ec2testing
      INSTANCE_TYPE: t2.micro
      SPOT_DURATION: 60
      VALID_HRS: 4
      ECR_ID: 530583866435
      ECR_REPO: lambda-auto-training/lambda-auto-training-${opt:stage, self:provider.stage}
    events:
      - stream:
          type: dynamodb
          arn:
            Fn::GetAtt: [DataDynamoDbTable, StreamArn]
          batchSize: 100
          batchWindow: 300
        
  infer:
    handler: js/infer.infer
    events:
      - http:
          path: infer
          method: post
          
  test:
    handler: js/test.test  
    events:
      - schedule:
          rate: rate(2 minutes)
          enabled: false
    
  s3proxy:
    handler: js/s3proxy.s3proxy
    events:
      - http:
          path: s3proxy/{key}/{filename}
          method: get
  
resources:
 Resources:
    Bucket:
      Type: AWS::S3::Bucket
      Properties:
        BucketName: ${self:provider.environment.BUCKET}
    ModelsDynamoDbTable:
      Type: 'AWS::DynamoDB::Table'
      DeletionPolicy: Retain
      Properties:
        AttributeDefinitions:
          -
            AttributeName: created
            AttributeType: N
        KeySchema:
          -
            AttributeName: created
            KeyType: HASH
        ProvisionedThroughput:
          ReadCapacityUnits: 1
          WriteCapacityUnits: 1
        TableName: ${self:provider.environment.DYNAMODB_TABLE_MODELS}
    DataDynamoDbTable:
      Type: 'AWS::DynamoDB::Table'
      DeletionPolicy: Retain
      Properties:
        AttributeDefinitions:
          -
            AttributeName: created
            AttributeType: N
        KeySchema:
          -
            AttributeName: created
            KeyType: HASH
        ProvisionedThroughput:
          ReadCapacityUnits: 1
          WriteCapacityUnits: 1
        TableName: ${self:provider.environment.DYNAMODB_TABLE_DATA}
        StreamSpecification:
          StreamViewType: NEW_AND_OLD_IMAGES
    IamRole:
      Type: AWS::IAM::Role
      Properties:
        Path: /
        RoleName: ${self:service}-${opt:stage, self:provider.stage}-${self:provider.region}-managedrole
        AssumeRolePolicyDocument:
          Version: '2012-10-17'
          Statement:
            - Effect: Allow
              Principal:
                Service:
                  - lambda.amazonaws.com
                  - ec2.amazonaws.com # added for transfer in train.js
              Action: sts:AssumeRole
        Policies:
          - PolicyName: ${self:service}-${opt:stage, self:provider.stage}-${self:provider.region}-managedpolicy
            PolicyDocument:
              Version: '2012-10-17'
              Statement:
                # Begin default Serverless policies
                - Effect: Allow 
                  Action:
                    - logs:CreateLogGroup
                    - logs:CreateLogStream
                    - logs:PutLogEvents
                  Resource:
                    - 'Fn::Join':
                      - ':'
                      -
                        - 'arn:aws:logs'
                        - Ref: 'AWS::Region'
                        - Ref: 'AWS::AccountId'
                        - 'log-group:/aws/lambda/*:*:*'
                -  Effect: "Allow"
                   Action:
                     - "s3:PutObject"
                   Resource:
                     Fn::Join:
                       - ""
                       - - "arn:aws:s3:::"
                         - "Ref" : "ServerlessDeploymentBucket"
                # Begin custom policies
                - Effect: Allow
                  Action:
                    - s3:*
                  Resource:
                   Fn::Join:
                     - ""
                     - - "arn:aws:s3:::"
                       - ${self:provider.environment.BUCKET}
                       - "/*"
                - Effect: Allow
                  Action:
                    - dynamodb:Query
                    - dynamodb:Scan
                    - dynamodb:GetItem
                    - dynamodb:PutItem
                    - dynamodb:UpdateItem
                    - dynamodb:DeleteItem
                    - dynamodb:GetRecords
                    - dynamodb:GetShardIterator
                    - dynamodb:DescribeStream
                    - dynamodb:ListStreams
                    - dynamodb:BatchWriteItem
                  Resource:
                    - "arn:aws:dynamodb:${opt:region, self:provider.region}:*:table/${self:provider.environment.DYNAMODB_TABLE_MODELS}"
                    - "arn:aws:dynamodb:${opt:region, self:provider.region}:*:table/${self:provider.environment.DYNAMODB_TABLE_DATA}"
                    - { Fn::GetAtt: [ DataDynamoDbTable, Arn ] }
                # For custom role stream policy must be explicitly defined
                - Effect: Allow
                  Action:
                    - dynamodb:GetRecords
                    - dynamodb:GetShardIterator
                    - dynamodb:DescribeStream
                    - dynamodb:ListStreams
                  Resource:
                    - "arn:aws:dynamodb:${opt:region, self:provider.region}:*:table/${self:provider.environment.DYNAMODB_TABLE_DATA}/stream/*"
                - Effect: Allow
                  Action:
                    - ec2:RunInstances
                    - ec2:TerminateInstances
                    - cloudwatch:PutMetricAlarm
                    - cloudwatch:DescribeAlarms
                    - cloudwatch:EnableAlarmActions
                  Resource: "*"   
                # Allow for transferring role to EC2 and creating EC2 instance profile
                - Effect: Allow
                  Action:
                    - iam:PassRole
                    - iam:GetInstanceProfile
                    - iam:CreateInstanceProfile
                    - iam:AddRoleToInstanceProfile
                  Resource: "*"
                # Used only by EC2 when role is transfered  
                - Effect: Allow
                  Action:
                    - ecr:GetAuthorizationToken
                    - ecr:GetDownloadUrlForLayer
                    - ecr:BatchGetImage
                    - ecr:BatchCheckLayerAvailability
                  Resource:
                    - "*"