serverless.yml

service: mfa-api

frameworkVersion: ^3.7

provider:
  name: aws
  runtime: nodejs18.x
  timeout: 30

  # Experimented with various memory sizes. Manually calling the totpValidate
  # function once every few seconds, the average durations were as follows:
  #   512 MB = 48 ms
  #   256 MB = 71 ms
  #   128 MB = 159 ms
  memorySize: 512
  apiGateway:
    apiKeys:
    - ${self:custom.namespace}_global
  iam:
    role:
      statements:
      - Effect: Allow
        Action:
        - dynamodb:DescribeTable
        - dynamodb:Query
        - dynamodb:Scan
        - dynamodb:GetItem
        - dynamodb:PutItem
        - dynamodb:UpdateItem
        - dynamodb:DeleteItem
        Resource: "arn:aws:dynamodb:*:*:table/${self:custom.namespace}_*"

custom:
  namespace: ${self:service}_${sls:stage}
  apiKeyTable: ${self:custom.namespace}_api-key_global
  totpTable: ${self:custom.namespace}_totp_global
  u2fTable: ${self:custom.namespace}_u2f_global
  dev_env: staging
  prod_env: production
  secondaryRegion: ${env:AWS_REGION_SECONDARY, "us-west-2"}
  functionTags:
    itse_app_name: ${self:service}
    itse_app_env: ${self:custom.${sls:stage}_env}
    itse_app_customer: "shared"
    managed_by: "serverless"
  resourceTags:
    - Key: "itse_app_name"
      Value: ${self:service}
    - Key: "itse_app_env"
      Value: ${self:custom.${sls:stage}_env}
    - Key: "itse_app_customer"
      Value: "shared"
    - Key: "managed_by"
      Value: "serverless"
  globalTableReplicas:
    - Region: ${aws:region}
      Tags: ${self:custom.resourceTags}
    - Region: ${self:custom.secondaryRegion}
      Tags: ${self:custom.resourceTags}

functions:
  apiKeyActivate:
    handler: handlers/api-key.activate
    name: ${self:custom.namespace}_apiKeyActivate
    environment:
      API_KEY_TABLE_NAME: ${self:custom.apiKeyTable}
    events:
      - http:
          path: api-key/activate
          method: post
          private: true
    tags: ${self:custom.functionTags}
  apiKeyCreate:
    handler: handlers/api-key.create
    name: ${self:custom.namespace}_apiKeyCreate
    environment:
      API_KEY_TABLE_NAME: ${self:custom.apiKeyTable}
    events:
      - http:
          path: api-key
          method: post
          private: true
    tags: ${self:custom.functionTags}
  totpCreate:
    handler: handlers/totp.create
    name: ${self:custom.namespace}_totpCreate
    environment:
      API_KEY_TABLE_NAME: ${self:custom.apiKeyTable}
      TOTP_TABLE_NAME: ${self:custom.totpTable}
    events:
      - http:
          path: totp
          method: post
    tags: ${self:custom.functionTags}
  totpDelete:
    handler: handlers/totp.delete
    name: ${self:custom.namespace}_totpDelete
    environment:
      API_KEY_TABLE_NAME: ${self:custom.apiKeyTable}
      TOTP_TABLE_NAME: ${self:custom.totpTable}
    events:
      - http:
          path: totp/{uuid}
          method: delete
    tags: ${self:custom.functionTags}
  totpValidate:
    handler: handlers/totp.validate
    name: ${self:custom.namespace}_totpValidate
    environment:
      API_KEY_TABLE_NAME: ${self:custom.apiKeyTable}
      TOTP_TABLE_NAME: ${self:custom.totpTable}
    events:
      - http:
          path: totp/{uuid}/validate
          method: post
    tags: ${self:custom.functionTags}
  u2fCreateAuthentication:
    handler: handlers/u2f.createAuthentication
    name: ${self:custom.namespace}_u2fCreateAuthentication
    environment:
      API_KEY_TABLE_NAME: ${self:custom.apiKeyTable}
      U2F_TABLE_NAME: ${self:custom.u2fTable}
    events:
      - http:
          path: u2f/{uuid}/auth
          method: post
    tags: ${self:custom.functionTags}
  u2fCreateRegistration:
    handler: handlers/u2f.createRegistration
    name: ${self:custom.namespace}_u2fCreateRegistration
    environment:
      API_KEY_TABLE_NAME: ${self:custom.apiKeyTable}
      U2F_TABLE_NAME: ${self:custom.u2fTable}
    events:
      - http:
          path: u2f
          method: post
    tags: ${self:custom.functionTags}
  u2fDelete:
    handler: handlers/u2f.delete
    name: ${self:custom.namespace}_u2fDelete
    environment:
      API_KEY_TABLE_NAME: ${self:custom.apiKeyTable}
      U2F_TABLE_NAME: ${self:custom.u2fTable}
    events:
      - http:
          path: u2f/{uuid}
          method: delete
    tags: ${self:custom.functionTags}
  u2fValidateAuthentication:
    handler: handlers/u2f.validateAuthentication
    name: ${self:custom.namespace}_u2fValidateAuthentication
    environment:
      API_KEY_TABLE_NAME: ${self:custom.apiKeyTable}
      U2F_TABLE_NAME: ${self:custom.u2fTable}
    events:
      - http:
          path: u2f/{uuid}/auth
          method: put
    tags: ${self:custom.functionTags}
  u2fValidateRegistration:
    handler: handlers/u2f.validateRegistration
    name: ${self:custom.namespace}_u2fValidateRegistration
    environment:
      API_KEY_TABLE_NAME: ${self:custom.apiKeyTable}
      U2F_TABLE_NAME: ${self:custom.u2fTable}
    events:
      - http:
          path: u2f/{uuid}
          method: put
    tags: ${self:custom.functionTags}

resources:
  Resources:
    ApiKeyActivateLogGroup:
      Type: AWS::Logs::LogGroup
      Properties:
        RetentionInDays: "60"
        Tags: ${self:custom.resourceTags}
    ApiKeyCreateLogGroup:
      Type: AWS::Logs::LogGroup
      Properties:
        RetentionInDays: "60"
        Tags: ${self:custom.resourceTags}
    TotpCreateLogGroup:
      Type: AWS::Logs::LogGroup
      Properties:
        RetentionInDays: "60"
        Tags: ${self:custom.resourceTags}
    TotpDeleteLogGroup:
      Type: AWS::Logs::LogGroup
      Properties:
        RetentionInDays: "60"
        Tags: ${self:custom.resourceTags}
    TotpValidateLogGroup:
      Type: AWS::Logs::LogGroup
      Properties:
        RetentionInDays: "60"
        Tags: ${self:custom.resourceTags}
    U2fCreateAuthenticationLogGroup:
      Type: AWS::Logs::LogGroup
      Properties:
        RetentionInDays: "60"
        Tags: ${self:custom.resourceTags}
    U2fCreateRegistrationLogGroup:
      Type: AWS::Logs::LogGroup
      Properties:
        RetentionInDays: "60"
        Tags: ${self:custom.resourceTags}
    U2fDeleteLogGroup:
      Type: AWS::Logs::LogGroup
      Properties:
        RetentionInDays: "60"
        Tags: ${self:custom.resourceTags}
    U2fValidateAuthenticationLogGroup:
      Type: AWS::Logs::LogGroup
      Properties:
        RetentionInDays: "60"
        Tags: ${self:custom.resourceTags}
    U2fValidateRegistrationLogGroup:
      Type: AWS::Logs::LogGroup
      Properties:
        RetentionInDays: "60"
        Tags: ${self:custom.resourceTags}