serverless.yml

org: animl
app: animl
service: animl-email-relay

provider:
  name: aws
  runtime: python3.7
  stage: ${opt:stage, 'dev'}
  region: us-west-2
  profile: animl
  iamRoleStatements:
    - Effect: 'Allow'
      Action:
        - 's3:GetObject'
        - 's3:ListBucket'
        - 's3:DeleteObject'
      Resource:
        - Fn::Join:
          - ''
          - - 'arn:aws:s3:::'
            - Ref: S3BucketAnimlemailstaging
        - Fn::Join:
          - ''
          - - 'arn:aws:s3:::'
            - Ref: S3BucketAnimlemailstaging
            - '/*'
    - Effect: 'Allow'
      Action:
        - 's3:PutObject'    
      Resource:
        - Fn::Join:
          - ''
          - - 'arn:aws:s3:::'
            - animl-data-staging-${opt:stage, self:provider.stage, 'dev'}
        - Fn::Join:
          - ''
          - - 'arn:aws:s3:::'
            - animl-data-staging-${opt:stage, self:provider.stage, 'dev'}
            - '/*'
    - Effect: Allow
      Action:
        - ssm:GetParameter
        - ssm:GetParameters
      Resource: 
        - !Sub arn:aws:ssm:${AWS::Region}:${AWS::AccountId}:parameter/*
  iamManagedPolicies:
    - 'arn:aws:iam::aws:policy/AWSLambdaExecute'
  environment:
    STAGE: ${opt:stage, self:provider.stage, 'dev'}

functions:
  RelayImages:
    name: RelayImagesLambdaFunction-${opt:stage, self:provider.stage, 'dev'}
    handler: src/handler.handler
    reservedConcurrency: 10 # max number of lambdas to invoke at one time
    events:
      - s3:
          bucket: animl-email-staging-${opt:stage, self:provider.stage, 'dev'}
          event: s3:ObjectCreated:*
          existing: true
    layers:
      - arn:aws:lambda:${self:provider.region}:445285296882:layer:perl-5-26-runtime:12

resources:
  Resources:
    # Staging bucket
    S3BucketAnimlemailstaging:
      Type: AWS::S3::Bucket
      Properties:
        BucketName: animl-email-staging-${opt:stage, self:provider.stage, 'dev'}
        PublicAccessBlockConfiguration:
          BlockPublicAcls: true
          BlockPublicPolicy: true
          IgnorePublicAcls: true
          RestrictPublicBuckets: true
    # Bucket policy for animl-email-staging
    S3BucketPolicyAnimlEmailStagingBucketPolicy:
      Type: AWS::S3::BucketPolicy
      Properties: 
        Bucket: 
          Ref: S3BucketAnimlemailstaging
        PolicyDocument: 
          Statement: 
            -
              Action: 
                - "s3:PutObject"
              Effect: "Allow"
              Resource:
                - "arn:aws:s3:::animl-email-staging-${opt:stage, self:provider.stage, 'dev'}/*"
                - "arn:aws:s3:::animl-email-staging-${opt:stage, self:provider.stage, 'dev'}"
              Principal:
                Service: ses.amazonaws.com
              Condition:
                StringEquals:
                  "aws:Referer": { Ref: AWS::AccountId }
    # # Lambda Permission grants the bucket permission to invoke the function
    # LambdaPermissionAnimlemailstaging:
    #   Type: AWS::Lambda::Permission
    #   Properties:
    #     FunctionName:
    #       Fn::GetAtt: # grabs function arn
    #         - relayImagesLambdaFunction
    #         - Arn
    #     Principal: s3.amazonaws.com
    #     Action: lambda:InvokeFunction
    #     SourceAccount:
    #       Ref: AWS::AccountId
    #     SourceArn: arn:aws:s3:::animl-email-staging-${opt:stage, self:provider.stage, 'dev'}


custom:
  pythonRequirements:
    dockerizePip: non-linux
    dockerFile: Dockerfile
    useDownloadCache: false
    useStaticCache: false
    dockerExtraFiles:
      - -r /output/exiftool/

plugins:
  - serverless-python-requirements