serverless.yml

service: ${self:custom.project}-verify-ui
useDotenv: true

provider:
  deploymentBucket:
    name: ${self:custom.infra.deploymentBucket}
  stackName: ${self:custom.project}-${self:provider.stage}-verify-ui
  apiName: ${self:provider.stackName}
  environment:
    NODE_ENV: "development"
    DEBUG: "*,-follow-redirects"
    AWS_LAMBDA_EXEC_WRAPPER: /opt/bootstrap
    HOSTNAME: 0.0.0.0
    PORT: 8000
    STAGE: ${self:provider.stage}
  name: aws
  runtime: nodejs18.x
  region: ap-southeast-1
  deploymentMethod: direct
  stage: ${opt:stage, "dev"}
  memorySize: 256
  timeout: 900
  tracing:
    lambda: true
    apiGateway: true
  logs:
    restApi:
      accessLogging: true
      executionLogging: true
      format: '{"id":"$context.requestId","extendedId":"$context.extendedRequestId","path":"$context.path","method":"$context.httpMethod","time":"$context.requestTime","source":"$context.identity.sourceIp","resourcePath":"$context.resourcePath","error":{"message":"$context.error.message","type":"$context.error.responseType","validation":"$context.error.validationErrorString"},"waf":{"response":"$context.wafResponseCode","error":"$context.waf.error","status":"$context.waf.status"},"response":{"latency":"$context.responseLatency","length":"$context.responseLength","status":"$context.status"},"apikey":"$context.identity.apiKeyId","xray":"$context.xrayTraceId"}'
      level: INFO
      # ALWAYS PUT TO FALSE, NEVER LOG RESPONSE DATA BECAUSE IT CAN BE SENSITIVE
      fullExecutionData: false
      roleManagedExternally: true
      role: ${ssm:/${self:custom.project}/${self:provider.stage}/cloudwatch-log-role-arn}
  apiGateway:
    resourcePolicy:
      - Effect: Allow
        Principal: "*"
        Action: execute-api:Invoke
        Resource:
          - execute-api:/*/*/*
    metrics: true
    shouldStartNameWithService: true
    binaryMediaTypes:
      - "*/*"
  endpointType: ${ssm:/${self:custom.project}/${self:provider.stage}/api-gateway-endpoint-type, "REGIONAL"}
  versionFunctions: false

package:
  artifact: .next/standalone/artifact.zip

# Reference: https://github.com/awslabs/aws-lambda-web-adapter
functions:
  nextApplication:
    name: ${self:provider.stackName}-next
    iamRoleStatementsName: "${self:provider.stackName}-next"
    # Provisioned concurrency is the number of pre-initialized execution environments you want to allocate to your function, around USD40 each
    provisionedConcurrency: ${ssm:/${self:custom.project}/${self:provider.stage}/lambda-concurrency}
    layers:
      - arn:aws:lambda:ap-southeast-1:753240598075:layer:LambdaAdapterLayerX86:18
    handler: run.sh
    events:
      - http:
          path: "{proxy+}"
          method: any
      - http:
          path: ""
          method: any
    vpc:
      securityGroupIds:
        - ${self:custom.infra.securityGroupIds}
      subnetIds:
        Fn::Split:
          - ","
          - ${self:custom.infra.subnetIds}
custom:
  project: ${env:PROJECT_NAME}
  setCustomDomain:
    "true":
      - domainName: '${ssm:/${self:custom.project}/${self:provider.stage}/verify-api-domain-name, ""}'
        basePath: ""
        createRoute53Record: false,
        endpointType: "${self:provider.endpointType}"
        securityPolicy: "tls_1_2"
        autoDomain: true
    "false": []
  customDomains: "${self:custom.setCustomDomain.${ssm:/${self:custom.project}/${self:provider.stage}/verify-auto-create-domain, 'true'}}"
  infra:
    deploymentBucket: "${ssm:/${self:custom.project}/${self:provider.stage}/deployment-bucket}"
    securityGroupIds: "${ssm:/${self:custom.project}/${self:provider.stage}/security-group-ids}"
    subnetIds: "${ssm:/${self:custom.project}/${self:provider.stage}/subnet-ids}"
  associateWaf:
    name: ${ssm:/${self:custom.project}/${self:provider.stage}/wafv2-name}
    version: "V2"

resources:
  Resources:
    IamRoleLambdaExecution:
      Type: "AWS::IAM::Role"
      Properties:
        AssumeRolePolicyDocument:
          Version: "2012-10-17"
          Statement:
            - Effect: Allow
              Principal:
                Service: lambda.amazonaws.com
              Action: sts:AssumeRole
              Condition:
                ArnLike:
                  "aws:SourceArn": "arn:aws:lambda:${aws:region}:${aws:accountId}:*:*"

plugins:
  - serverless-domain-manager
  - serverless-associate-waf
  - serverless-iamroles