serverless.yml

service: watcher

frameworkVersion: '2'

custom:
  stage_long:
    dev: development
    prod: production
  account_id: ${file(./variables.yml):account_id}
  lambdaArnPrefix: arn:aws:lambda:${self:provider.region}:${self:custom.account_id}:function:${self:service}-${self:provider.stage}
  snsArnPrefix: arn:aws:sns:${self:provider.region}:${self:custom.account_id}
  dynamodbArnPrefix: arn:aws:dynamodb:${self:provider.region}:${self:custom.account_id}:table
  layer_core: ${cf:watcherLayerCore-dev.WatcherCoreLayerExport}
  pythonRequirements:
    usePoetry: false
    dockerizePip: true

provider:
  name: aws
  runtime: python3.8
  stage: ${opt:stage, 'dev'}
  region: ${opt:region, 'us-east-1'}
  timeout: 30
  memorySize: 256
  logRetentionInDays: 30
  apiGateway:
    shouldStartNameWithService: true
  deploymentBucket:
    name: serverless-028920223318-us-east-1
    serverSideEncryption: AES256
  versionFunctions: false
  environment:
    STAGE: ${opt:stage, 'dev'}
    REGION: ${self:provider.region}
    SNS_ARN_PREFIX: ${self:custom.snsArnPrefix}
    PYTHONWARNINGS: ignore # https://github.com/jmespath/jmespath.py/issues/187
    PULL_REQUEST_TABLE: watcher-pull-requests
    VERSION_TABLE: watcher-versions
    GITHUB_ORGANIZATION: ${file(variables.yml):GITHUB_ORGANIZATION}
    GITHUB_METADATA_REPO: ${file(variables.yml):GITHUB_METADATA_REPO}
  tags:
    service: watcher
    environment: ${self:custom.stage_long.${self:provider.stage}}
    createdby: serverless
    repository: https://github.com/clowdhaus/watcher
  iam:
    role:
      statements:
        - Effect: Allow
          Action:
            - xray:PutTraceSegments
            - xray:PutTelemetryRecords
          Resource:
            - '*'

resources:
  Resources:
    versionsTable:
      Type: AWS::DynamoDB::Table
      Properties:
        TableName: ${self:provider.environment.VERSION_TABLE}
        BillingMode: PAY_PER_REQUEST
        SSESpecification:
          SSEEnabled: true
        AttributeDefinitions:
          - AttributeName: repository
            AttributeType: S
        KeySchema:
          - AttributeName: repository
            KeyType: HASH
    pullRequestsTable:
      Type: AWS::DynamoDB::Table
      Properties:
        TableName: ${self:provider.environment.PULL_REQUEST_TABLE}
        BillingMode: PAY_PER_REQUEST
        SSESpecification:
          SSEEnabled: true
        AttributeDefinitions:
          - AttributeName: repository
            AttributeType: S
          - AttributeName: pull_request
            AttributeType: N
        KeySchema:
          - AttributeName: repository
            KeyType: HASH
          - AttributeName: pull_request
            KeyType: RANGE

package:
  exclude:
    - '**/*'
  include:
    - lambdas/*.py
    - lambdas/*.yml

plugins:
  - serverless-iam-roles-per-function
  - serverless-python-requirements

functions:
  hubReceive:
    handler: lambdas/hub.receive
    layers:
      - ${self:custom.layer_core}
    timeout: 15
    description: Receive and validate GitHub webhooks before passing along payload
    iamRoleStatementsInherit: true
    iamRoleStatementsName: ${self:service}-${self:provider.stage}-hub-receive
    iamRoleStatements:
      - Effect: Allow
        Action:
          - ssm:GetParameter
        Resource:
          - '*' # arn:aws:ssm:us-east-1:${self:custom.account_id}:parameter/watcher/github_webhook_secret
      - Effect: Allow
        Action:
          - sns:Publish
        Resource:
          - '${self:custom.snsArnPrefix}:Watcher-*'
    events:
      - http:
          path: watcher
          method: post

  versionsSync:
    handler: lambdas/versions.sync
    layers:
      - ${self:custom.layer_core}
    timeout: 300
    memorySize: 512
    description: Sync all repository versions
    environment:
      EMIT_MESSAGE_TOPIC: ${self:custom.snsArnPrefix}:Watcher-VersionsUpdateReadme
    iamRoleStatementsInherit: true
    iamRoleStatementsName: ${self:service}-${self:provider.stage}-versions-sync
    iamRoleStatements:
      - Effect: Allow
        Action:
          - ssm:GetParameter
        Resource:
          - arn:aws:ssm:us-east-1:${self:custom.account_id}:parameter/watcher/github_user_token
      - Effect: Allow
        Action:
          - dynamodb:Scan
          - dynamodb:BatchWriteItem
          - dynamodb:PutItem
          - dynamodb:DeleteItem
          - dynamodb:UpdateItem
        Resource:
          - ${self:custom.dynamodbArnPrefix}/${self:provider.environment.VERSION_TABLE}
      - Effect: Allow
        Action:
          - sns:Publish
        Resource:
          - '${self:custom.snsArnPrefix}:Watcher-*'
    events:
      - schedule:
          name: Watcher-VersionsSync
          description: Sync all repository versions
          rate: cron(0 10 ? * MON-FRI *)

  versionsNewTag:
    handler: lambdas/versions.new_tag
    layers:
      - ${self:custom.layer_core}
    description: Responds to new tag events
    environment:
      EMIT_MESSAGE_TOPIC: ${self:custom.snsArnPrefix}:Watcher-VersionsUpdateReadme
    iamRoleStatementsInherit: true
    iamRoleStatementsName: ${self:service}-${self:provider.stage}-versions-new-tag
    iamRoleStatements:
      - Effect: Allow
        Action:
          - ssm:GetParameter
        Resource:
          - arn:aws:ssm:us-east-1:${self:custom.account_id}:parameter/watcher/github_user_token
      - Effect: Allow
        Action:
          - dynamodb:PutItem
          - dynamodb:DeleteItem
          - dynamodb:UpdateItem
        Resource:
          - ${self:custom.dynamodbArnPrefix}/${self:provider.environment.VERSION_TABLE}
      - Effect: Allow
        Action:
          - sns:Publish
        Resource:
          - '${self:custom.snsArnPrefix}:Watcher-*'
    events:
      - sns:
          topicName: Watcher-Tag
          displayName: Contains tag event payloads

  versionsCreateRelease:
    handler: lambdas/versions.create_release
    layers:
      - ${self:custom.layer_core}
    description: Responds to new tag events to create a release
    iamRoleStatementsInherit: true
    iamRoleStatementsName: ${self:service}-${self:provider.stage}-versions-create-release
    iamRoleStatements:
      - Effect: Allow
        Action:
          - ssm:GetParameter
        Resource:
          - arn:aws:ssm:us-east-1:${self:custom.account_id}:parameter/watcher/github_user_token
    events:
      - sns:
          topicName: Watcher-Tag
          displayName: Contains tag event payloads

  versionsUpdateReadme:
    handler: lambdas/versions.update_readme
    layers:
      - ${self:custom.layer_core}
    timeout: 60
    memorySize: 512
    description: Updates version section of metadata repo README file
    iamRoleStatementsInherit: true
    iamRoleStatementsName: ${self:service}-${self:provider.stage}-versions-update-readme
    iamRoleStatements:
      - Effect: Allow
        Action:
          - ssm:GetParameter
        Resource:
          - arn:aws:ssm:us-east-1:${self:custom.account_id}:parameter/watcher/github_user_token
      - Effect: Allow
        Action:
          - dynamodb:Scan
        Resource:
          - ${self:custom.dynamodbArnPrefix}/${self:provider.environment.VERSION_TABLE}
    events:
      - sns:
          topicName: Watcher-VersionsUpdateReadme
          displayName: Trigger to update versions section of metadata repo README file

  pullRequestsPullRequest:
    handler: lambdas/pull_requests.pull_request
    layers:
      - ${self:custom.layer_core}
    description: Responds to pull request events
    environment:
      EMIT_MESSAGE_TOPIC: ${self:custom.snsArnPrefix}:Watcher-PullRequestsUpdateReadme
    iamRoleStatementsInherit: true
    iamRoleStatementsName: ${self:service}-${self:provider.stage}-hub-pull-request
    iamRoleStatements:
      - Effect: Allow
        Action:
          - ssm:GetParameter
        Resource:
          - arn:aws:ssm:us-east-1:${self:custom.account_id}:parameter/watcher/github_user_token
      - Effect: Allow
        Action:
          - dynamodb:PutItem
          - dynamodb:DeleteItem
          - dynamodb:UpdateItem
        Resource:
          - ${self:custom.dynamodbArnPrefix}/${self:provider.environment.PULL_REQUEST_TABLE}
      - Effect: Allow
        Action:
          - sns:Publish
        Resource:
          - '${self:custom.snsArnPrefix}:Watcher-*'
    events:
      - sns:
          topicName: Watcher-PullRequest
          displayName: Contains pull request event payloads

  pullRequestsUpdateReadme:
    handler: lambdas/pull_requests.update_readme
    layers:
      - ${self:custom.layer_core}
    timeout: 60
    memorySize: 512
    description: Updates pull request section of metadata repo README file
    iamRoleStatementsInherit: true
    iamRoleStatementsName: ${self:service}-${self:provider.stage}-pull-requests-update-readme
    iamRoleStatements:
      - Effect: Allow
        Action:
          - ssm:GetParameter
        Resource:
          - arn:aws:ssm:us-east-1:${self:custom.account_id}:parameter/watcher/github_user_token
      - Effect: Allow
        Action:
          - dynamodb:Scan
        Resource:
          - ${self:custom.dynamodbArnPrefix}/${self:provider.environment.PULL_REQUEST_TABLE}
    events:
      - sns:
          topicName: Watcher-PullRequestsUpdateReadme
          displayName: Trigger to update pull request section of metadata repo README file

  pullRequestsSync:
    handler: lambdas/pull_requests.sync
    layers:
      - ${self:custom.layer_core}
    timeout: 300
    memorySize: 512
    description: Sync all repository pull requests
    environment:
      EMIT_MESSAGE_TOPIC: ${self:custom.snsArnPrefix}:Watcher-PullRequestsUpdateReadme
    iamRoleStatementsInherit: true
    iamRoleStatementsName: ${self:service}-${self:provider.stage}-pull-requests-sync
    iamRoleStatements:
      - Effect: Allow
        Action:
          - ssm:GetParameter
        Resource:
          - arn:aws:ssm:us-east-1:${self:custom.account_id}:parameter/watcher/github_user_token
      - Effect: Allow
        Action:
          - dynamodb:Scan
          - dynamodb:BatchWriteItem
          - dynamodb:PutItem
          - dynamodb:DeleteItem
          - dynamodb:UpdateItem
        Resource:
          - ${self:custom.dynamodbArnPrefix}/${self:provider.environment.PULL_REQUEST_TABLE}
      - Effect: Allow
        Action:
          - sns:Publish
        Resource:
          - '${self:custom.snsArnPrefix}:Watcher-*'
    events:
      - schedule:
          name: Watcher-PullRequestsSync
          description: Sync all repository pull requests
          rate: cron(0 10 ? * MON-FRI *)

  repositoryUpdate:
    handler: lambdas/repository.update
    layers:
      - ${self:custom.layer_core}
    timeout: 120
    memorySize: 256
    description: Responds to repository events
    iamRoleStatementsInherit: true
    iamRoleStatementsName: ${self:service}-${self:provider.stage}-repository-update
    iamRoleStatements:
      - Effect: Allow
        Action:
          - ssm:GetParameter
        Resource:
          - arn:aws:ssm:us-east-1:${self:custom.account_id}:parameter/watcher/github_user_token
    events:
      - sns:
          topicName: Watcher-Repository
          displayName: Contains repository event payloads

  repositorySync:
    handler: lambdas/repository.sync
    layers:
      - ${self:custom.layer_core}
    timeout: 120
    memorySize: 256
    description: Sync all repository's settings to config settings
    environment:
      EMIT_MESSAGE_TOPIC: ${self:custom.snsArnPrefix}:Watcher-Repository
    iamRoleStatementsInherit: true
    iamRoleStatementsName: ${self:service}-${self:provider.stage}-repository-sync
    iamRoleStatements:
      - Effect: Allow
        Action:
          - ssm:GetParameter
        Resource:
          - arn:aws:ssm:us-east-1:${self:custom.account_id}:parameter/watcher/github_user_token
      - Effect: Allow
        Action:
          - sns:Publish
        Resource:
          - '${self:custom.snsArnPrefix}:Watcher-*'
    events:
      - schedule:
          name: Watcher-RepositorySync
          description: Sync all repository settings
          rate: cron(0 6 ? * MON-FRI *)

  repositoryUpdateLabels:
    handler: lambdas/repository.update_labels
    layers:
      - ${self:custom.layer_core}
    timeout: 120
    memorySize: 256
    description: Update repository labels to match config settings
    environment:
      EMIT_MESSAGE_TOPIC: ${self:custom.snsArnPrefix}:Watcher-PullRequestsUpdateReadme
    iamRoleStatementsInherit: true
    iamRoleStatementsName: ${self:service}-${self:provider.stage}-repository-update-labels
    iamRoleStatements:
      - Effect: Allow
        Action:
          - ssm:GetParameter
        Resource:
          - arn:aws:ssm:us-east-1:${self:custom.account_id}:parameter/watcher/github_user_token
    events:
      - sns:
          topicName: Watcher-Label
          displayName: Contains label update payloads

  repositorySyncLabels:
    handler: lambdas/repository.sync_labels
    layers:
      - ${self:custom.layer_core}
    timeout: 120
    memorySize: 256
    description: Sync all repository labels to config settings
    environment:
      EMIT_MESSAGE_TOPIC: ${self:custom.snsArnPrefix}:Watcher-Label
    iamRoleStatementsInherit: true
    iamRoleStatementsName: ${self:service}-${self:provider.stage}-repository-sync-labels
    iamRoleStatements:
      - Effect: Allow
        Action:
          - ssm:GetParameter
        Resource:
          - arn:aws:ssm:us-east-1:${self:custom.account_id}:parameter/watcher/github_user_token
      - Effect: Allow
        Action:
          - sns:Publish
        Resource:
          - '${self:custom.snsArnPrefix}:Watcher-*'
    events:
      - schedule:
          name: Watcher-LabelSync
          description: Sync all repository settings
          rate: cron(30 7 ? * MON-FRI *)