serverless.yml

service: estate-id-api
frameworkVersion: '3'

plugins:
  - serverless-offline
  - serverless-export-env
  - serverless-plugin-typescript

provider:
  name: aws
  runtime: nodejs16.x
  versionFunctions: false
  stage: ${opt:stage, 'dev'}
  region: ap-northeast-1
  timeout: 10
  apiGateway:
    shouldStartNameWithService: true
  endpointType: REGIONAL
  environment:
    STAGE: ${self:provider.stage}

    # App configs
    ZOOM: ${self:custom.zoomLevel}
    ACCESS_TOKEN_SALT: ${env:ACCESS_TOKEN_SALT}
    # IPC configs
    INCREMENTP_VERIFICATION_API_ENDPOINT: "https://d3q1ylas6o7xmg.cloudfront.net/v1"
    INCREMENTP_VERIFICATION_API_KEY: ${env:INCREMENTP_VERIFICATION_API_KEY}
    # Internal Stack Refs
    AWS_DYNAMODB_API_KEY_TABLE_NAME: ${self:custom.awsDynamodbApiKeyTableName}
    AWS_DYNAMODB_ESTATE_ID_TABLE_NAME: ${self:custom.awsDynamodbEstateIdTableName}
    AWS_DYNAMODB_LOG_TABLE_NAME: ${self:custom.${self:provider.stage}.AWS_DYNAMODB_LOG_TABLE_NAME}
    AWS_S3_LOG_STREAM_OUTPUT_BUCKET_NAME: ${self:custom.awsS3LogStreamOutputBucketName}

    AUTH0_CLIENT_ID: ${self:custom.${self:provider.stage}.AUTH0_CLIENT_ID}
    AUTH0_DOMAIN: ${self:custom.${self:provider.stage}.AUTH0_DOMAIN}
    AUTH0_MGMT_DOMAIN: ${self:custom.${self:provider.stage}.AUTH0_MGMT_DOMAIN, self:provider.environment.AUTH0_DOMAIN}

    RELEASE_VER: ${env:GITHUB_SHA, self:provider.stage}
    SENTRY_DSN: ${env:SENTRY_DSN, ''}
    AWS_NODEJS_CONNECTION_REUSE_ENABLED: 1

    GEOLONIA_API_KEY: ${env:GEOLONIA_API_KEY, ''}

  layers:
    - arn:aws:lambda:ap-northeast-1:943013980633:layer:SentryNodeServerlessSDK:38

  iam:
    role:
      statements:
        - Effect: Allow
          Action:
            - ssm:GetParameter
            - kms:Decrypt
          Resource:
            - !Join
              - ":"
              - - "arn:aws:ssm"
                - !Ref AWS::Region
                - !Ref AWS::AccountId
                - parameter/propid/auth0/${self:provider.environment.AUTH0_CLIENT_ID}
            - !Join
              - ":"
              - - "arn:aws:ssm"
                - !Ref AWS::Region
                - !Ref AWS::AccountId
                - parameter/propid/slack/${self:provider.stage}
            - !Join
              - ":"
              - - "arn:aws:kms"
                - !Ref AWS::Region
                - !Ref AWS::AccountId
                - "key/alias/aws/ssm"

        - Effect: Allow
          Action:
            - dynamodb:GetItem
            - dynamodb:PutItem
            - dynamodb:UpdateItem
            - dynamodb:Query
          Resource:
            - !GetAtt estateIdTable.Arn
            - !Join
              - ""
              - - !GetAtt estateIdTable.Arn
                - "/index/*"
            - !GetAtt apiKeyTable.Arn
            - !Join
              - ""
              - - !GetAtt apiKeyTable.Arn
                - "/index/*"

        - Effect: Allow
          Action:
            - dynamodb:GetItem
            - dynamodb:PutItem
            - dynamodb:DeleteItem
            - dynamodb:Query
          Resource:
            - !GetAtt logTable.Arn

        - Effect: Allow
          Action:
            - s3:PutObject
          Resource:
            - arn:aws:s3:::${self:custom.awsS3LogStreamOutputBucketName}
            - arn:aws:s3:::${self:custom.awsS3LogStreamOutputBucketName}/*

custom:
  # [ATTENTION] All Estate IDs will be changed If zoom altered.
  zoomLevel: 22
  awsDynamodbApiKeyTableName: estate-id-api-key-${self:provider.stage}
  awsDynamodbEstateIdTableName: estate-id-${self:provider.stage}
  awsS3LogStreamOutputBucketName: prop-id-log-stream-output-bucket-${self:provider.stage}
  awsSqsEventFailureDestQueueName: prop-id-event-failure-dest-queue-${self:provider.stage}

  local:
    AUTH0_CLIENT_ID: "Odt4Kq2h7HTJsbkzhVrY4Rm7QLhMkFLH"
    AUTH0_DOMAIN: "prop-id-dev.jp.auth0.com"
    AWS_DYNAMODB_LOG_TABLE_NAME: estate-id-log-local
  dev:
    # V1 のユーザープールで認証する
    AUTH0_CLIENT_ID: ${env:AUTH0_CLIENT_ID_V1, ''}
    AUTH0_DOMAIN: "auth.propid.jp"
    AUTH0_MGMT_DOMAIN: "prop-id.jp.auth0.com"
    # AUTH0_CLIENT_ID: ${env:AUTH0_CLIENT_ID_DEV, ''}
    # AUTH0_DOMAIN: "prop-id-dev.jp.auth0.com"
    admin_origins: "http://127.0.0.1:*,http://localhost:*,https://*-g-prop-id-app.netlify.app,https://geolonia.github.io"
    AWS_DYNAMODB_LOG_TABLE_NAME: !Ref logTable
  v1:
    AUTH0_CLIENT_ID: ${env:AUTH0_CLIENT_ID_V1, ''}
    AUTH0_DOMAIN: "auth.propid.jp"
    AUTH0_MGMT_DOMAIN: "prop-id.jp.auth0.com"
    admin_origins: "https://app.propid.jp"
    AWS_DYNAMODB_LOG_TABLE_NAME: !Ref logTable

package:
  patterns:
    - "*.json"
    - "!dist/**/*"
    - "!.build/**/*"
    - "!node_modules/.yarn-integrity"
    - "!node_modules/.bin/*"

resources:
  Resources:
    apiKeyTable:
      Type: AWS::DynamoDB::Table
      DeletionPolicy: Retain
      Properties:
        TableName: ${self:custom.awsDynamodbApiKeyTableName}
        AttributeDefinitions:
          - AttributeName: apiKey
            AttributeType: S
          - AttributeName: GSI1PK
            AttributeType: S
          - AttributeName: GSI1SK
            AttributeType: S
        KeySchema:
          - AttributeName: apiKey
            KeyType: HASH
        GlobalSecondaryIndexes:
          - IndexName: GSI1PK-GSI1SK-index
            KeySchema:
              - AttributeName: GSI1PK
                KeyType: HASH
              - AttributeName: GSI1SK
                KeyType: RANGE
            Projection:
              ProjectionType: ALL
        BillingMode: PAY_PER_REQUEST

    estateIdTable:
      Type: AWS::DynamoDB::Table
      DeletionPolicy: Retain
      Properties:
        TableName: ${self:custom.awsDynamodbEstateIdTableName}
        AttributeDefinitions:
          - AttributeName: estateId
            AttributeType: S
          - AttributeName: address
            AttributeType: S
          - AttributeName: tileXY
            AttributeType: S
          - AttributeName: serial
            AttributeType: N
        KeySchema:
          - AttributeName: estateId
            KeyType: HASH
        GlobalSecondaryIndexes:
          - IndexName: address-index
            KeySchema:
              - AttributeName: address
                KeyType: HASH
            Projection:
              ProjectionType: ALL
          - IndexName: tileXY-index
            KeySchema:
              - AttributeName: tileXY
                KeyType: HASH
              - AttributeName: serial
                KeyType: RANGE
            Projection:
              ProjectionType: ALL
        BillingMode: PAY_PER_REQUEST
        StreamSpecification:
          StreamViewType: 'NEW_IMAGE'

    logTable:
      Type: AWS::DynamoDB::Table
      DeletionPolicy: Retain
      Properties:
        AttributeDefinitions:
          - AttributeName: PK
            AttributeType: S
          - AttributeName: SK
            AttributeType: S
        KeySchema:
          - AttributeName: PK
            KeyType: HASH
          - AttributeName: SK
            KeyType: RANGE
        TimeToLiveSpecification:
          AttributeName: ttl
          Enabled: true
        BillingMode: PAY_PER_REQUEST
        StreamSpecification:
          StreamViewType: 'NEW_IMAGE'

    logStreamOutputBucket:
      DeletionPolicy: Retain
      Type: AWS::S3::Bucket
      Properties:
        BucketName: ${self:custom.awsS3LogStreamOutputBucketName}

    eventFailureDestQueue:
      Type: AWS::SQS::Queue
      Properties:
        QueueName: ${self:custom.awsSqsEventFailureDestQueueName}

functions:
  public:
    handler: src/public.handler
    events:
      - http:
          path: '/'
          method: get

  idQuery:
    handler: src/idQuery/index.handler
    events:
      - http:
          path: '/{estateId}'
          method: get
          request:
            parameters:
              paths:
                estateId: true

      - http:
          path: '/{estateId}/split'
          method: post
          request:
            parameters:
              paths:
                estateId: true

  admin:
    handler: src/admin.handler
    events:
      - http:
          path: '/admin/keys'
          method: get
          cors: &default_cors
            cacheControl: 'max-age=600, s-maxage=600, proxy-revalidate'
            origin: ${self:custom.${self:provider.stage}.admin_origins, '*'}

      - http:
          path: '/admin/keys'
          method: post
          cors: *default_cors

      - http:
          path: '/admin/keys/{keyId}/reissue'
          method: patch
          request:
            parameters:
              paths:
                keyId: true
          cors: *default_cors

      - http:
          path: '/admin/query'
          method: get
          cors: *default_cors

      - http:
          path: '/admin/query/{estateId}'
          method: get
          request:
            parameters:
              paths:
                estateId: true
          cors: *default_cors

      - http:
          path: '/admin/query/{estateId}/split'
          method: post
          request:
            parameters:
              paths:
                estateId: true
          cors: *default_cors

      - http:
          path: '/admin/feedback'
          method: post
          cors: *default_cors

      - http:
          path: '/admin/feedback_reaction'
          method: post

  idEvents:
    handler: src/idEvents.handler
    events:
      - stream:
          type: dynamodb
          arn: !GetAtt estateIdTable.StreamArn
          batchWindow: 30
          batchSize: 10
          maximumRetryAttempts: 3
          destinations:
            onFailure: arn:aws:sqs:ap-northeast-1:${aws:accountId}:${self:custom.awsSqsEventFailureDestQueueName}

  logEvents:
    handler: src/logEvents.handler
    events:
      - stream:
          type: dynamodb
          arn: !GetAtt logTable.StreamArn
          batchWindow: 30
          batchSize: 100
          maximumRetryAttempts: 3
          destinations:
            onFailure: arn:aws:sqs:ap-northeast-1:${aws:accountId}:${self:custom.awsSqsEventFailureDestQueueName}