serverless.yml

service: TEMPLATE
# app: TEMPLATE
# org: myorg

plugins:
  - serverless-python-requirements
  - serverless-pseudo-parameters
  - serverless-wsgi

custom:
  stackName: ${self:service}-${self:provider.stage}
  xray: ''  # AWS Xray tracing of requests, queries. Set to 'Active' to actively trace.
  db:
    dbname: TEMPLATE
    minCapacity: 2
    maxCapacity: 4
    secondsUntilAutoPause: 7200  # if not stage=='prd'
  layers:
    # https://github.com/jetbridge/psycopg2-lambda-layer
    psycopg: "arn:aws:lambda:${self:provider.region}:898466741470:layer:psycopg2-py38:1"
    # https://github.com/jetbridge/jetkit-base-lambda-layer
    jkbase: "arn:aws:lambda:${self:provider.region}:898466741470:layer:jetkit-py38:3"
    default:
      - ${self:custom.layers.psycopg}
      - ${self:custom.layers.jkbase}
  secrets:
    prefix: "${self:service}/${self:provider.stage}"
    rds: "${self:custom.secrets.prefix}/rds/credentials"
  vpc:
    securityGroupIds:
      - !GetAtt LambdaSecurityGroup.GroupId
  # uncomment to enable lambda VPC networking:
  #   subnetIds:
  #     - Ref: LambdaSubnetA
  #     - Ref: LambdaSubnetB
  #     - Ref: LambdaSubnetC
  network:
    classB: 10 # second octet of VPC CIDR block (10.classB.0.0/16)
  bastion:  # EC2 host to access database
    sshKeyPairName: ''  # set this to enable bastion ec2 instance
    alertEmails: 'me@mydomain.xyz'  # get SNS notifications of alarms at this address
    banner: https://ops.jetbridge.com/public/banner.txt
    bootstrap: https://ops.jetbridge.com/public/bastion_bootstrap.sh
    instanceType: t3a.nano
    tenancy: default
    bannerEnabled: 'true'
    tcpForwardingEnabled: 'true'
    x11ForwardingEnabled: 'false'
    logRetentionInDays: 731

  # plugins:
  wsgi:
    app: app.app
    packRequirements: false
  pythonRequirements:
    useDownloadCache: true
    useStaticCache: true
    noDeploy:
      # provided by runtime
      - boto3
      - botocore
      - s3transfer
      - docutils

      # provided by layers
      - psycopg2
      - psycopg2-binary
      - werkzeug
      - flask
      - sqlalchemy
      - faker
      - pytest
      - future
      - pytz
      - alembic
      - jinja2
      - beautifulsoup4
      - bs4
      - text_unidecode
      - requests
      - marshmallow
      - python_dateutil
      - soupsieve
      - chardet
      - attrs
      - mako
      - certifi
      - idna
      - urllib3
      - pyparsing
      - packaging
      - more_itertools
      - dateutil
      - click
    slim: true
    slimPatternsAppendDefaults: false  # need dist-info for sqlalchemy plugin
    slimPatterns:
      - '**/*.py[c|o]'
      - '**/__pycache__*'

provider:
  name: aws
  runtime: python3.8
  stage: ${opt:stage, 'dev'}
  region: ${opt:region, 'eu-west-1'}

  # x-ray
  tracing:
    lambda: ${self:custom.xray}

  environment:
    SECRET_PREFIX: ${self:custom.secrets.prefix}
    RDS_SECRETS_NAME: ${self:custom.secrets.rds}

    # aurora data API credentials
    AURORA_SECRET_ARN: !Ref RDSInstanceSecret
    AURORA_CLUSTER_ARN: !Join [':', ["arn:aws:rds:#{AWS::Region}:#{AWS::AccountId}:cluster", !Ref DBCluster]]
    DATABASE_NAME: ${self:custom.db.dbname}

    # comment if connecting to RDS from VPC
    AURORA_DATA_API_ENABLED: 'true'
    SQLALCHEMY_DATABASE_URI: !Join ['/', ["postgresql+auroradataapi://:@", !Ref DBCluster]]

    # uncomment if connecting to RDS from VPC
    # LOAD_RDS_SECRETS: "true"

    STAGE: ${self:provider.stage}
    XRAY: ${self:custom.xray}
    # LOAD_APP_SECRETS: true  # enable to load user-defined secrets
    # SQL_ECHO: true  # enable to print all SQL queries

  iamRoleStatements:
    - Effect: Allow
      Action: secretsmanager:GetSecretValue
      Resource:
        - "arn:aws:secretsmanager:#{AWS::Region}:#{AWS::AccountId}:secret:${self:custom.secrets.prefix}/*"
        - "arn:aws:secretsmanager:#{AWS::Region}:#{AWS::AccountId}:secret:${self:custom.secrets.prefix}/dev-*"
    - Effect: Allow
      Action:
        - rds-data:ExecuteStatement
        - rds-data:BatchExecuteStatement
        - rds-data:BeginTransaction
        - rds-data:RollbackTransaction
        - rds-data:CommitTransaction
        - rds-data:BeginTransaction
      Resource: "arn:aws:rds:#{AWS::Region}:#{AWS::AccountId}:cluster:${self:custom.stackName}"

package:
  exclude:
    - node_modules/**
    - venv/**
    - TEMPLATE/instance.cfg
    - instance.cfg
    - doc/**
    - "**/__pycache__/**"
    - "**/__pycache__"
    - ".#*"
    - ".bento/**"

functions:
  app: # main flask entry point
    handler: wsgi_handler.handler
    events:
      - http: ANY /
      - http: "ANY {proxy+}"
    memorySize: 512
    layers: ${self:custom.layers.default}
    timeout: 10
    vpc: ${self:custom.vpc}

  seed:
    handler: TEMPLATE.commands.seed_handler
    layers: ${self:custom.layers.default}
    timeout: 120
    vpc: ${self:custom.vpc}

  initDb:
    handler: TEMPLATE.commands.init_handler
    layers: ${self:custom.layers.default}
    timeout: 300
    vpc: ${self:custom.vpc}

  migrate:
    handler: TEMPLATE.commands.migrate_handler
    timeout: 900
    layers: ${self:custom.layers.default}
    vpc: ${self:custom.vpc}

resources:
  - ${file(cloudformation/vpc/core.yml)}
  - ${file(cloudformation/vpc/public.yml)}
  - ${file(cloudformation/vpc/database.yml)}
  - ${file(cloudformation/vpc/security.yml)}
  # uncomment to enable lambda VPC networking
  # - ${file(cloudformation/vpc/lambda.yml)}
  - ${file(cloudformation/db/aurora-serverless.yml)}
  - ${file(cloudformation/bastion.yml)}