serverless.yml

service: saml-to

frameworkVersion: 3.38.0
variablesResolutionMode: "20210326"
configValidationMode: off
disabledDeprecations:
  - "*"

provider:
  name: aws
  runtime: nodejs18.x
  iam:
    role:
      statements:
        - Effect: Allow
          Action:
            - "dynamodb:*"
            - "kms:*"
            - "secretsmanager:*"
            - "sns:*"
            - "sqs:*"
          Resource: "*"
  stage: ${opt:stage, "local"}
  logRetentionInDays: 1
  tracing:
    apiGateway: true
    lambda: true
  environment:
    STAGE: ${self:provider.stage}
    GITHUB_APP_ID: ${file(config.cjs):GH_APP_ID}
    GITHUB_CLIENT_ID: ${file(config.cjs):GH_CLIENT_ID}
    GITHUB_CLIENT_IDS: ${file(config.cjs):GH_CLIENT_ID}
    GITHUB_APP_URL: ${file(config.cjs):GH_APP_URL}
    SELF_HOSTED: true

functions:
  auth:
    handler: /opt/src/lambda.handler
    timeout: 29
    layers:
      - arn:aws:lambda:us-east-1:580360238192:layer:${file(config.cjs):auth-sls-rest-api}:1
    environment:
      SERVICE_NAME: auth-sls-rest-api
      SERVICE_SLUG: auth
      TOPIC_ARN: !Ref AuthTopic
    events:
      - http:
          path: /auth
          method: any
      - http:
          path: /auth
          method: options
      - http:
          path: /auth/{proxy+}
          method: any
      - http:
          path: /auth/{proxy+}
          method: options
      - stream:
          type: dynamodb
          batchSize: 1
          maximumRecordAgeInSeconds: 600
          arn:
            Fn::GetAtt: [AuthTable, StreamArn]
  github:
    handler: /opt/src/lambda.handler
    timeout: 29
    layers:
      - arn:aws:lambda:us-east-1:034541671702:layer:openssl-lambda:1
      - arn:aws:lambda:us-east-1:580360238192:layer:${file(config.cjs):github-sls-rest-api}:1
    environment:
      SERVICE_NAME: github-sls-rest-api
      SERVICE_SLUG: github
      TOPIC_ARN: !Ref GithubTopic
    events:
      - http:
          path: /github
          method: any
      - http:
          path: /github
          method: options
      - http:
          path: /github/{proxy+}
          method: any
      - http:
          path: /github/{proxy+}
          method: options
      - sns:
          arn: !Ref AuthTopic
          topicName: auth-sls-rest-api-${self:provider.stage}
      - sns:
          arn: !Ref GithubTopic
          topicName: github-sls-rest-api-${self:provider.stage}
      - stream:
          type: dynamodb
          batchSize: 1
          maximumRecordAgeInSeconds: 600
          arn:
            Fn::GetAtt: [GithubTable, StreamArn]

resources:
  Resources:
    KmsKey:
      Type: AWS::KMS::Key

    KmsAlias:
      Type: AWS::KMS::Alias
      Properties:
        AliasName: alias/${self:provider.stage}
        TargetKeyId: !Ref KmsKey

    AuthJwks:
      Type: AWS::SecretsManager::Secret
      Properties:
        Name: lambda/${self:provider.stage}/auth-sls-rest-api/jwks
        SecretString: "{}"

    AuthSecret:
      Type: AWS::SecretsManager::Secret
      Properties:
        Name: lambda/${self:provider.stage}/auth-sls-rest-api
        SecretString: ${file(config.cjs):SECRETS}

    GithubSecret:
      Type: AWS::SecretsManager::Secret
      Properties:
        Name: lambda/${self:provider.stage}/github-sls-rest-api
        SecretString: ${file(config.cjs):SECRETS}

    AuthTopic:
      Type: AWS::SNS::Topic
      Properties:
        TopicName: auth-sls-rest-api-${self:provider.stage}

    GithubTopic:
      Type: AWS::SNS::Topic
      Properties:
        TopicName: github-sls-rest-api-${self:provider.stage}

    AuthTable:
      Type: AWS::DynamoDB::Table
      Properties:
        TableName: ${self:provider.stage}-auth-sls-rest-api
        KeySchema:
          - AttributeName: pk
            KeyType: HASH
          - AttributeName: sk
            KeyType: RANGE
        AttributeDefinitions:
          - AttributeName: pk
            AttributeType: S
          - AttributeName: sk
            AttributeType: S
        GlobalSecondaryIndexes:
          - IndexName: sk-pk-index
            KeySchema:
              - AttributeName: sk
                KeyType: HASH
              - AttributeName: pk
                KeyType: RANGE
            Projection:
              ProjectionType: ALL
        StreamSpecification:
          StreamViewType: NEW_AND_OLD_IMAGES
        TimeToLiveSpecification:
          AttributeName: expires
          Enabled: true
        PointInTimeRecoverySpecification:
          PointInTimeRecoveryEnabled: true
        SSESpecification:
          SSEEnabled: true
        BillingMode: PAY_PER_REQUEST

    GithubTable:
      Type: AWS::DynamoDB::Table
      Properties:
        TableName: ${self:provider.stage}-github-sls-rest-api
        KeySchema:
          - AttributeName: pk
            KeyType: HASH
          - AttributeName: sk
            KeyType: RANGE
        AttributeDefinitions:
          - AttributeName: pk
            AttributeType: S
          - AttributeName: sk
            AttributeType: S
        GlobalSecondaryIndexes:
          - IndexName: sk-pk-index
            KeySchema:
              - AttributeName: sk
                KeyType: HASH
              - AttributeName: pk
                KeyType: RANGE
            Projection:
              ProjectionType: ALL
        StreamSpecification:
          StreamViewType: NEW_AND_OLD_IMAGES
        TimeToLiveSpecification:
          AttributeName: expires
          Enabled: true
        PointInTimeRecoverySpecification:
          PointInTimeRecoveryEnabled: true
        SSESpecification:
          SSEEnabled: true
        BillingMode: PAY_PER_REQUEST

    GithubIdpRequestsTable:
      Type: AWS::DynamoDB::Table
      Properties:
        TableName: ${self:provider.stage}-github-sls-rest-api-idp-requests
        KeySchema:
          - AttributeName: pk
            KeyType: HASH
          - AttributeName: sk
            KeyType: RANGE
        AttributeDefinitions:
          - AttributeName: pk
            AttributeType: S
          - AttributeName: sk
            AttributeType: S
        GlobalSecondaryIndexes:
          - IndexName: sk-pk-index
            KeySchema:
              - AttributeName: sk
                KeyType: HASH
              - AttributeName: pk
                KeyType: RANGE
            Projection:
              ProjectionType: ALL
        StreamSpecification:
          StreamViewType: NEW_AND_OLD_IMAGES
        TimeToLiveSpecification:
          AttributeName: expires
          Enabled: true
        PointInTimeRecoverySpecification:
          PointInTimeRecoveryEnabled: true
        SSESpecification:
          SSEEnabled: true
        BillingMode: PAY_PER_REQUEST

    GithubCachedConfigTable:
      Type: AWS::DynamoDB::Table
      Properties:
        TableName: ${self:provider.stage}-github-sls-rest-api-cached-config
        KeySchema:
          - AttributeName: pk
            KeyType: HASH
          - AttributeName: sk
            KeyType: RANGE
        AttributeDefinitions:
          - AttributeName: pk
            AttributeType: S
          - AttributeName: sk
            AttributeType: S
        GlobalSecondaryIndexes:
          - IndexName: sk-pk-index
            KeySchema:
              - AttributeName: sk
                KeyType: HASH
              - AttributeName: pk
                KeyType: RANGE
            Projection:
              ProjectionType: ALL
        StreamSpecification:
          StreamViewType: NEW_AND_OLD_IMAGES
        TimeToLiveSpecification:
          AttributeName: expires
          Enabled: true
        PointInTimeRecoverySpecification:
          PointInTimeRecoveryEnabled: true
        SSESpecification:
          SSEEnabled: true
        BillingMode: PAY_PER_REQUEST