serverless.yml

org: animl
app: animl
service: animl-api

plugins:
  - serverless-plugin-typescript
  - serverless-offline

custom:
  serverlessPluginTypescript:
    tsConfigFileLocation: './tsconfig.json'

package:
  patterns:
    - '!backups/**'
    - '!.build/**'

provider:
  name: aws
  stage: ${opt:stage, 'dev'}
  region: us-west-2
  profile: animl
  environment:
    REGION: ${self:provider.region}
    STAGE: ${self:provider.stage}
    ACCOUNT: ${aws:accountId}

  iam:
    role:
      statements:
        - Effect: Allow
          Action:
            - sqs:*
          Resource:
            - !Sub 'arn:aws:sqs:${AWS::Region}:${AWS::AccountId}:animl-ingest-${self:provider.stage}-batch-*'
            - Fn::GetAtt:
                - inferenceQueue
                - Arn
            - Fn::GetAtt:
                - taskQueue
                - Arn
        - Effect: Allow
          Action:
            - sagemaker:InvokeEndpoint
          Resource: '*'
        - Effect: Allow
          Action:
            - ses:SendEmail
            - ses:SendRawEmail
          Resource: '*'
        - Effect: Allow
          Action:
            - ssm:GetParameters
          Resource: !Sub arn:aws:ssm:${AWS::Region}:${AWS::AccountId}:parameter/*
        - Effect: Allow
          Action:
            - secretsmanager:GetSecretValue
          Resource: '*'
        - Effect: 'Allow'
          Action:
            - 'lambda:InvokeFunction'
          Resource:
            - !Sub arn:aws:lambda:${AWS::Region}:${AWS::AccountId}:function:IngestDelete-${self:provider.stage}
        - Effect: 'Allow'
          Action:
            - 's3:PutObject'
            - 's3:GetObject'
          Resource:
            - Fn::Join:
                - ''
                - - 'arn:aws:s3:::'
                  - 'animl-images-ingestion-${self:provider.stage}'
            - Fn::Join:
                - ''
                - - 'arn:aws:s3:::'
                  - 'animl-images-ingestion-${self:provider.stage}'
                  - '/*'
        - Effect: 'Allow'
          Action:
            - 'cognito-idp:ListGroups'
            - 'cognito-idp:AdminGetUser'
            - 'cognito-idp:ListUsers'
            - 'cognito-idp:ListUsersInGroup'
            - 'cognito-idp:AdminListGroupsForUser'
            - 'cognito-idp:AdminRemoveUserFromGroup'
            - 'cognito-idp:AdminAddUserToGroup'
            - 'cognito-idp:AdminCreateUser'
            - 'cognito-idp:AdminConfirmSignUp'
            - 'cognito-idp:CreateGroup'
          Resource:
            - !Sub arn:aws:cognito-idp:${AWS::Region}:${AWS::AccountId}:userpool/{{resolve:ssm:/application/cognito/userPoolId:1}}

        - Effect: 'Allow'
          Action:
            - 's3:PutObject'
            - 's3:GetObject'
          Resource:
            - Fn::Join:
                - ''
                - - 'arn:aws:s3:::'
                  - Ref: S3BucketAnimlexporteddata
            - Fn::Join:
                - ''
                - - 'arn:aws:s3:::'
                  - Ref: S3BucketAnimlexporteddata
                  - '/*'
        - Effect: 'Allow'
          Action:
            - 's3:DeleteObject'
          Resource:
            - Fn::Join:
                - ''
                - - 'arn:aws:s3:::'
                  - 'animl-images-serving-${self:provider.stage}'
            - Fn::Join:
                - ''
                - - 'arn:aws:s3:::'
                  - 'animl-images-serving-${self:provider.stage}/*'

  apiGateway:
    apiKeys:
      - name: animlApiKeyInternal-${self:provider.stage}
        value: '{{resolve:secretsmanager:api-key-${self:provider.stage}:SecretString:apikey}}'

functions:
  graphql:
    handler: src/api/handler.server
    runtime: nodejs20.x
    events:
      - http:
          path: /
          method: post
          cors: true
      - http:
          path: /internal
          method: post
          cors: true
          private: true
      - http:
          path: /external
          method: post
          cors:
            headers: '*'
          authorizer:
            name: CognitoAuthN
            type: COGNITO_USER_POOLS
            arn: !Sub arn:aws:cognito-idp:${AWS::Region}:${AWS::AccountId}:userpool/{{resolve:ssm:/application/cognito/userPoolId:1}}
    memorySize: 3008
    timeout: 30
  inference:
    handler: src/ml/handler.inference
    runtime: nodejs20.x
    reservedConcurrency: 20
    events:
      - sqs:
          arn:
            Fn::GetAtt:
              - inferenceQueue
              - Arn
          batchSize: 1
          functionResponseType: ReportBatchItemFailures
    timeout: 120
  batchinference:
    handler: src/ml/handler.inference
    runtime: nodejs20.x
    reservedConcurrency: 8
    memorySize: 2048
    timeout: 120
  task:
    handler: src/task/handler.handler
    runtime: nodejs20.x
    reservedConcurrency: 10
    events:
      - sqs:
          arn:
            Fn::GetAtt:
              - taskQueue
              - Arn
          batchSize: 1
    timeout: 900

resources:
  Resources:
    # Secrets Manager secret for API key
    apiKey:
      Type: AWS::SecretsManager::Secret
      Properties:
        Description: API Key that will allow access for the APIs
        GenerateSecretString:
          GenerateStringKey: apikey
          SecretStringTemplate: '{"user": "api"}'
        Name: api-key-${self:provider.stage}

    # Inference SQS queue
    inferenceQueue:
      Type: AWS::SQS::Queue
      Properties:
        QueueName: inferenceQueue-${self:provider.stage}
        VisibilityTimeout: 120
        RedrivePolicy:
          deadLetterTargetArn:
            'Fn::GetAtt':
              - inferenceDeadLetterQueue
              - Arn
          maxReceiveCount: 5

    # Inference - dead-letter SQS queue
    inferenceDeadLetterQueue:
      Type: 'AWS::SQS::Queue'
      Properties:
        QueueName: inferenceDLQ-${self:provider.stage}
        MessageRetentionPeriod: 1209600 # 14 days in seconds

    # Task SQS queue
    taskQueue:
      Type: AWS::SQS::Queue
      Properties:
        QueueName: taskQueue-${self:provider.stage}
        VisibilityTimeout: 900
        RedrivePolicy:
          deadLetterTargetArn:
            'Fn::GetAtt':
              - taskDeadLetterQueue
              - Arn
          maxReceiveCount: 5

    # Task - dead-letter SQS queue
    taskDeadLetterQueue:
      Type: 'AWS::SQS::Queue'
      Properties:
        QueueName: taskDLQ-${self:provider.stage}
        MessageRetentionPeriod: 1209600 # 14 days in seconds

    # SSM Param - API URL
    SSMParameterApiurl:
      Type: AWS::SSM::Parameter
      Properties:
        Description: Animl API url
        Name: /api/url-${opt:stage, self:provider.stage, 'dev'}
        Type: String
        Value: !Sub https://${ApiGatewayRestApi}.execute-api.${AWS::Region}.amazonaws.com/${opt:stage, self:provider.stage, 'dev'}/internal/

    # SSM Param - inference queue url
    SSMParameterInferencequeue:
      Type: AWS::SSM::Parameter
      Properties:
        Description: Inference queue url
        Name: /ml/inference-queue-url-${opt:stage, self:provider.stage, 'dev'}
        Type: String
        Value: !Ref inferenceQueue

    # SSM Param - task queue url
    SSMParameterTaskqueue:
      Type: AWS::SSM::Parameter
      Properties:
        Description: Task queue url
        Name: /tasks/task-queue-url-${opt:stage, self:provider.stage, 'dev'}
        Type: String
        Value: !Ref taskQueue

    # Exported data bucket
    S3BucketAnimlexporteddata:
      Type: AWS::S3::Bucket
      Properties:
        BucketName: animl-exported-data-${opt:stage, self:provider.stage, 'dev'}
        PublicAccessBlockConfiguration:
          BlockPublicAcls: true
          BlockPublicPolicy: true
          IgnorePublicAcls: true
          RestrictPublicBuckets: true

    # SSM Param - exported data bucket
    SSMParameterAnimlexporteddata:
      Type: AWS::SSM::Parameter
      Properties:
        Description: Animl exported data bucket name
        Name: /exports/exported-data-bucket-${opt:stage, self:provider.stage, 'dev'}
        Type: String
        Value: animl-exported-data-${opt:stage, self:provider.stage, 'dev'}

    # NOTE: SSM Params /ml/megadetector-api-key and /db/mongo-db-url
    # contain secret keys so need to be created manually in the AWS console