subhub/services/fxa/serverless.yml

251 строка
8.3 KiB
YAML

# This Source Code Form is subject to the terms of the Mozilla Public
# License, v. 2.0. If a copy of the MPL was not distributed with this
# file, You can obtain one at https://mozilla.org/MPL/2.0/.
---
service:
name: fxa
package:
individually: true
exclude:
- 'node_modules/*'
include:
- 'handler.py'
- 'src/**'
custom:
stage: ${opt:stage, self:provider.stage}
prefix: ${self:provider.stage}-${self:service.name}
subdomain: ${self:provider.stage}.${self:service.name}
pythonRequirements:
dockerizePip: 'non-linux'
fileName: "../../src/app_requirements.txt"
packageExternal:
external:
- '../../src/hub'
- '../../src/shared'
- '../../src'
git-repo: "https://github.com/mozilla/subhub"
alerts:
dashboards: true
serverlessTerminationProtection:
stages:
- prod
customDomain:
domainName: ${self:custom.subdomain}.mozilla-subhub.app
certificateName: ${self:custom.subdomain}.mozilla-subhub.app
basePath: 'v1'
stage: ${self:provider.stage}
createRoute53Record: true
hostedZoneId: Z2KY0AWCLX3H6L
endpointType: regional
access:
prod: restricted
prod-test: restricted
stage: restricted
qa: restricted
dev: unfettered
fab: unfettered
resourcePolicies:
unfettered:
- Effect: Allow
Principal: "*"
Action: execute-api:Invoke
Resource:
- execute-api:/*/*/*
restricted:
- Effect: Allow
Principal: "*"
Action: execute-api:Invoke
Resource:
- execute-api:/*/*/version
- Effect: Allow
Principal: "*"
Action: execute-api:Invoke
Resource:
- execute-api:/*/*/deployed
- Effect: Allow
Principal: "*"
Action: execute-api:Invoke
Resource:
- execute-api:/*/*/swagger.json
- Effect: Allow
Principal: "*"
Action: execute-api:Invoke
Resource:
- execute-api:/*/*/ui/*
- Effect: Allow
Principal: "*"
Action: execute-api:Invoke
Resource:
- execute-api:/*/*/support/*
Condition:
IpAddress:
aws:SourceIp: ${file(whitelist.yml):support.${self:provider.stage}}
- Effect: Allow
Principal: "*"
Action: execute-api:Invoke
Resource:
- execute-api:/*/*/customer/*
- execute-api:/*/*/plans
Condition:
IpAddress:
aws:SourceIp: ${file(whitelist.yml):payments.${self:provider.stage}}
- Effect: Allow
Principal: "*"
Action: execute-api:Invoke
Resource:
- execute-api:/*/*/hub
Condition:
IpAddress:
aws:SourceIp: ${file(whitelist.yml):hub}
plugins:
- serverless-python-requirements
- serverless-domain-manager
- serverless-package-external
- serverless-plugin-canary-deployments
- serverless-stack-termination-protection
provider:
name: aws
runtime: python3.7
region: us-west-2
stage: ${opt:stage}
stackName: ${self:custom.prefix}-stack
apiName: ${self:custom.prefix}-apigw
deploymentPrefix: ${self:custom.prefix}
endpointType: regional
logRetentionInDays: 90
logs:
# NOTE: https://github.com/serverless/serverless/issues/6112
# Logging documentation:
# https://serverless.com/framework/docs/providers/aws/events/apigateway/
restApi: true
memorySize: ${file(functions.yml):${self:provider.stage}.LAMBDA_MEMORY_SIZE}
timeout: ${file(functions.yml):${self:provider.stage}.LAMBDA_TIMEOUT}
snsaccount: ${file(accounts.yml):fxa.${self:provider.stage}}
environment: ${file(env.yml):${self:custom.stage}, file(env.yml):default}
tags: ${file(resources/tags.yml):${self:custom.stage}, file(resources/tags.yml):default}
stackTags:
service: ${self:service}
# Reference: https://serverless.com/blog/abcs-of-iam-permissions/
iamRoleStatements:
- Effect: Allow
Action:
- codedeploy:*
Resource:
- "*"
- Effect: Allow
Action:
- 'dynamodb:Query'
- 'dynamodb:Scan'
- 'dynamodb:GetItem'
- 'dynamodb:PutItem'
- 'dynamodb:UpdateItem'
- 'dynamodb:DeleteItem'
- 'dynamodb:DescribeTable'
- 'dynamodb:CreateTable'
Resource: 'arn:aws:dynamodb:us-west-2:*:*'
- Effect: Allow
Action:
- 'secretsmanager:GetSecretValue'
Resource:
- 'Fn::Join': [':', ['arn:aws:secretsmanager', Ref: AWS::Region, Ref: AWS::AccountId, 'secret:${self:provider.stage}/*']]
- Effect: Allow
Action:
- logs:CreateLogGroup
- logs:CreateLogStream
- logs:PutLogEvents
Resource:
- 'Fn::Join': [':', ['arn:aws:logs', Ref: AWS::Region, Ref: AWS::AccountId, 'log-group:/aws/lambda/*:*:*']]
- Effect: Allow
Action:
- kms:Decrypt
Resource:
- 'Fn::Join': [':', ['arn:aws:kms', Ref: AWS::Region, Ref: AWS::AccountId, 'alias/*']]
- 'Fn::Join': [':', ['arn:aws:kms', Ref: AWS::Region, Ref: AWS::AccountId, 'key/*']]
- Effect: Allow
Action:
- sns:Publish
Resource:
- 'Fn::Join': [':', ['arn:aws:sns', Ref: AWS::Region, Ref: AWS::AccountId, '${self:provider.stage}-fxa-event-data']]
resourcePolicy: ${self:custom.resourcePolicies.${self:custom.access.${self:provider.stage}}}
functions:
hub:
name: ${self:custom.prefix}-hub
description: >
Function for handling subscription services interactions
handler: hubhandler.handle
events:
- http: {
path: /hub,
method: post,
cors: false,
private: false
}
- http: {
path: "/hub/{proxy+}",
method: any,
cors: false,
private: false
}
type: ${file(functions.yml):${self:provider.stage}.DEPLOYMENT_TYPE}
reservedConcurrency: ${file(functions.yml):${self:provider.stage}.LAMBDA_RESERVED_CONCURRENCY}
deploymentSettings:
# Available AWS CodeDeploy Preference Types
# Canary10Percent30Minutes
# Canary10Percent5Minutes
# Canary10Percent10Minutes
# Canary10Percent15Minutes
# Linear10PercentEvery10Minutes
# Linear10PercentEvery1Minute
# Linear10PercentEvery2Minutes
# Linear10PercentEvery3Minutes
# AllAtOnce
# Reference: https://docs.aws.amazon.com/serverless-application-model/latest/developerguide/automating-updates-to-serverless-apps.html
type: Linear10PercentEvery1Minute
alias: Live
alarms:
- name: HubAlarm
namespace: 'AWS/Lambda'
metric: Errors
threshold: 1
statistic: Minimum
period: 60
evaluationPeriods: 1
comparisonOperator: GreaterThanOrEqualToThreshold
mia:
name: ${self:custom.prefix}-mia
description: >
Function for reconcilation of missing hub events
handler: miahandler.handle
events:
# Invoke Lambda function on a schedule (either cron or rate limited). This fires an
#
# Reference: Serverless Event Scheduling
# https://serverless.com/framework/docs/providers/aws/events/schedule/
# Reference: AWS Cloudwatch Scheduled Event:
# https://docs.aws.amazon.com/AmazonCloudWatch/latest/events/EventTypes.html#schedule_event_type
#
# Rate Syntax, http://docs.aws.amazon.com/AmazonCloudWatch/latest/events/ScheduledEvents.html#RateExpressions
# rate(value unit)
# where value is an unsigned integer
# and the unit is a unit of time in the set of (minute, minutes, hour, hours, day, days)
#
# Cron Syntax, http://docs.aws.amazon.com/lambda/latest/dg/tutorial-scheduled-events-schedule-expressions.html
# cron(minutes day-of-month(DOM) month day-of-week(DOW) year)
# where
# Field | Values | Wildcards
# Minutes | 0-59 | ,-*/
# Hours | 0-23 | ,-*/
# DOM | 1-31 | ,-*/?LW
# Month | 1-12 | ,-*/
# DOW | 1-7 | ,-*?/L#
# Year | 192199 | ,-*/
- schedule: rate(${file(functions.yml):${self:provider.stage}.MIA_RATE_SCHEDULE})
reservedConcurrency: ${file(functions.yml):${self:provider.stage}.LAMBDA_RESERVED_CONCURRENCY}
resources:
- ${file(resources/sns-topic.yml)}