serverless.example.yml

# This is a reference example of a secured FHIR server using the latest HL7 implementation guides.
#Deploy this before your desired authorization servers.

service: secured-fhir-service

plugins:
  - serverless-certificate-creator
  - serverless-domain-manager

params:
  default:
    #The domain name you want publicly as the base domain name for the FHIR service.
    FHIR_BASE_DOMAIN: fhir.your.tld

    #Route53 hosted domain for FHIR service (include the period at the end)
    FHIR_BASE_TLD: your.tld.

    #Backend fhir service base FHIR_SERVICE_URL
    BACKEND_FHIR_SERVICE_URL: http://your_fhir_base_url_here

    #Backend signing algorithm for jwt
    BACKEND_SIGNING_ALGORITHM: RS256

##Shouldn't have to touch anything below this line!##
provider:
  name: aws
  runtime: nodejs18.x
  region: us-east-1
  stage: dev
  logs:
    restApi: true

  httpApi:
    disableDefaultEndpoint: true

## Uncomment if your server is in AWS, and you wish to lock it down to a VPC.
# Note- this example deployment does not fully manage your VPC configuration in AWS.
# If you uncomment this, you'll need to decide how your Lambdas will get internet access
# and also how the Lambdas will access any internal AWS resources.
#  vpc:
#    securityGroupIds:
#      - sg-youridhere

#    subnetIds:
#      - subnet-youridhere

  environment:
    FHIR_BASE_DOMAIN: ${param:FHIR_BASE_DOMAIN}
    BACKEND_FHIR_SERVICE_URL: ${param:BACKEND_FHIR_SERVICE_URL}
    BACKEND_SIGNING_ALGORITHM: ${param:BACKEND_SIGNING_ALGORITHM}

#Lambda functions
functions:
##Authorizer
  globalFhirAuthorizer:
    handler: ${self:provider.name}/fhirGlobalAuthorizer.handler

##METADATA ENDPOINTS
  smart-config-endpoint:
    handler: ${self:provider.name}/metadata_endpoints.smartConfigHandler
    events:
      - http:
          path: /{tenantId}/smart-configuration
          method: GET
          cors: true
          request:
            parameters:
              paths:
                tenantId: true
      - http:
          path: /{tenantId}/.well-known/smart-configuration
          method: GET
          cors: true
          request:
            parameters:
              paths:
                tenantId: true

  metadata-endpoint:
    handler: ${self:provider.name}/metadata_endpoints.legacyMetadataHandler
    events:
      - http:
          path: /{tenantId}/metadata
          method: GET
          cors: true
          request:
            parameters:
              paths:
                tenantId: true

  udap-config-endpoint:
    handler: ${self:provider.name}/metadata_endpoints.udapConfigHandler
    events:
      - http:
          path: /{tenantId}/.well-known/udap
          method: GET
          cors: true
          request:
            parameters:
              paths:
                tenantId: true

#Patient match endpoint
  patient-match-endpoint:
    handler: ${self:provider.name}/match_operation.matchHandler
    timeout: 30
    events:
      - http:
          path: /{tenantId}/Patient/$match
          method: POST
          authorizer:
            name: globalFhirAuthorizer
            resultTtlInSeconds: 0
            type: request
          cors: true
          request:
            parameters:
              paths:
                tenantId: true

  read-endpoint:
    handler: ${self:provider.name}/read_operation.readHandler
    timeout: 30
    events:
      - http:
          path: /{tenantId}/{fhirResource}
          method: GET
          authorizer:
            name: globalFhirAuthorizer
            resultTtlInSeconds: 0
            type: request
          cors: true 
          request:
            parameters:
              paths:
                tenantId: true
                fhirResource: true
      - http:
          path: /{tenantId}/{fhirResource}/{proxy+}
          method: GET
          authorizer:
            name: globalFhirAuthorizer
            resultTtlInSeconds: 0
            type: request
          cors: true 
          request:
            parameters:
              paths:
                tenantId: true
                fhirResource: true
                proxy: true

custom:
  customCertificate:
    certificateName: ${param:FHIR_BASE_DOMAIN}
    hostedZoneNames: ${param:FHIR_BASE_TLD}
    subjectAlternativeNames:
      - ${param:FHIR_BASE_DOMAIN}

  customDomain:
    domainName: ${param:FHIR_BASE_DOMAIN}
    certificateName: ${param:FHIR_BASE_DOMAIN}
    basePath: ''
    stage: ${self:provider.stage}
    createRoute53Record: true
    endpointType: regional