housing-repairs-online-frontend/serverless.yml at main · LBHackney-IT/housing-repairs-online-frontend · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
service: housing-repairs-online-frontend

provider:
  name: aws
  runtime: nodejs20.x
  region: eu-west-2
  stage: ${opt:stage}
  versionFunctions: true

functions:
  HousingRepairsOnlineFrontend:
    name: ${self:service}-${self:provider.stage}
    handler: lambda.handler
    timeout: 29
    package:
      excludeDevDependencies: true
      individually: true
      patterns:
        - 'build/_next/standalone/**'
        - '!build/_next/standalone/.next/cache/**'
        - 'build/_next/static/**'
        - lambda.js
        - next.config.js
        - public/**
        - '!node_modules/**'
        - 'lambda/node_modules/**'
    environment:
      NODE_PATH: '/var/task/lambda/node_modules'
      REPAIRS_API_IDENTIFIER: ${ssm:/HousingRepairsOnlineApi/${self:provider.stage}/authentication-identifier}
      REPAIRS_API_BASE_URL: ${ssm:/HousingRepairsOnlineApi/${self:provider.stage}/repairs-api-base-url}
    role: lambdaExecutionRole
    events:
      - httpApi:
          path: /
          method: ANY
      - httpApi:
          path: /{any+}
          method: ANY

resources:
  Resources:
    lambdaExecutionRole:
      Type: AWS::IAM::Role
      Properties:
        Path: /${self:service}/
        RoleName: ${self:service}-lambdaExecutionRole
        AssumeRolePolicyDocument:
          Version: '2012-10-17'
          Statement:
            - Effect: Allow
              Principal:
                Service:
                  - lambda.amazonaws.com
              Action: sts:AssumeRole
        ManagedPolicyArns:
          - arn:aws:iam::aws:policy/service-role/AWSLambdaVPCAccessExecutionRole
          - arn:aws:iam::aws:policy/AWSXRayDaemonWriteAccess
        Policies:
          - PolicyName: manageLogs
            PolicyDocument:
              Version: '2012-10-17'
              Statement:
                - Effect: Allow
                  Action:
                    - logs:CreateLogGroup
                    - logs:CreateLogStream
                    - logs:PutLogEvents
                  Resource:
                    - 'Fn::Join':
                        - ':'
                        - - 'arn:aws:logs'
                          - Ref: 'AWS::Region'
                          - Ref: 'AWS::AccountId'
                          - 'log-group:/aws/lambda/*:*:*'
                - Effect: 'Allow'
                  Action:
                    - 's3:PutObject'
                    - 's3:GetObject'
                  Resource:
                    Fn::Join:
                      - ''
                      - - 'arn:aws:s3:::'
                        - 'Ref': 'ServerlessDeploymentBucket'
          - PolicyName: lambdaInvocation
            PolicyDocument:
              Version: '2012-10-17'
              Statement:
                - Effect: Allow
                  Action:
                    - 'lambda:InvokeFunction'
                  Resource: '*'
    CloudFrontDistribution:
      Type: AWS::CloudFront::Distribution
      Properties:
        DistributionConfig:
          Aliases:
            - ${self:custom.aliases.${self:provider.stage}}
          PriceClass: PriceClass_100
          ViewerCertificate:
            AcmCertificateArn: ${self:custom.certificate-arn.${self:provider.stage}}
            MinimumProtocolVersion: TLSv1.2_2018
            SslSupportMethod: sni-only
          DefaultCacheBehavior:
            TargetOriginId: ${self:service}-${self:provider.stage}-custom-origin
            ViewerProtocolPolicy: 'redirect-to-https'
            AllowedMethods:
              - GET
              - HEAD
              - OPTIONS
              - PUT
              - PATCH
              - POST
              - DELETE
            DefaultTTL: 0
            MaxTTL: 0
            MinTTL: 0
            ForwardedValues:
              QueryString: true
              Cookies:
                Forward: all
          Enabled: true
          Origins:
            - Id: ${self:service}-${self:provider.stage}-custom-origin
              DomainName: ${self:custom.domain-name}
              CustomOriginConfig:
                HTTPPort: 80
                HTTPSPort: 443
                OriginProtocolPolicy: https-only
    staticImagesBucket:
      Type: AWS::S3::Bucket
      Properties:
        BucketName: repairs-online-${opt:stage}-static-images
        Tags:
          - Key: Confidentiality
            Value: Public

custom:
  domain-name:
    Fn::Join:
      - '.'
      - - ${self:custom.gateway-id.${self:provider.stage}}
        - execute-api
        - eu-west-2
        - amazonaws.com
  aliases:
    development: housingrepairs-development.hackney.gov.uk
    staging: housingrepairs-staging.hackney.gov.uk
    production: housingrepairs.hackney.gov.uk
  certificate-arn:
    development: arn:aws:acm:us-east-1:364864573329:certificate/a5935e70-ab94-4326-b2f0-c527eb7c214f
    staging: arn:aws:acm:us-east-1:087586271961:certificate/ff3800a6-62f7-497a-a2d0-e482d76614ec
    production: arn:aws:acm:us-east-1:282997303675:certificate/6714a979-786f-426b-9fe0-349b65ba825f
  gateway-id:
    development: n2sbci4mna
    staging: 0iow0m4lk1
    production: salzoo2y60