serverless_template.yml

service: image-service

provider:
  name: aws
  runtime: nodejs8.10
  region: us-east-1
  stage: ${opt:stage, self:custom.defaultStage}
  profile: ${self:provider.stage, 'default'}
  endpointType: REGIONAL
  timeout: 30
  deploymentBucket:
      name: "pinster-serverless-deploy-${self:provider.stage}"
  package:
    exclude:
      - .git/**
      - .circleci/
      - lambda/test
      - node_modules
      - "*.md"
      - "*.rb"
      - Gemfile
      - Gemfile.lock
      - .eslintrc.json

  iamRoleStatements:
    - Effect: 'Allow'
      Action:
        - "sns:Publish"
      Resource:
        - "${self:custom.failure_notification_sns_arn}"

    - Effect: "Allow"
      Action:
        - "s3:*"
      Resource:
        - "arn:aws:s3:::${self:custom.imageHostBucket}/*"
        - "arn:aws:s3:::${self:custom.imageUploadBucket}/*"
        
    - Effect: "Allow"
      Action:
        - "states:StartExecution"
      Resource:
        - "*"

    - Effect: "Allow"
      Action:
        - "rekognition:*"
      Resource:
        - "*"

    - Effect: "Allow"
      Action:
        - "lambda:InvokeFunction"
      Resource:
        - "arn:aws:lambda:::${self:custom.imageUploadBucket}/*"

custom:
  logRetentionInDays: 14
  defaultStage: dev
  customDomain:
    domainName: images.image-service-${self:provider.stage}.pinster.io
    basePath: '(none)'
    stage: ${self:provider.stage}
    createRoute53Record: true
    certificateName: images.image-service-dev.pinster.io # This is the name of the cert, it covers prod too.
    endpointType: 'regional'
  failure_notification_sns: ImageServiceFailureSNS${self:provider.stage}
  failure_notification_sns_arn:
    Fn::Join:
      - ":"
      - - arn
        - aws
        - sns
        - Ref: AWS::Region
        - Ref: AWS::AccountId
        - ${self:custom.failure_notification_sns}
  imageHostBucket: image-service-${self:provider.stage}.pinster.io
  imageHostBucketUrl: https://${self:custom.imageHostBucket}
  imageUploadBucket: image-service-upload-${self:provider.stage}.pinster.io
  thumbnailProcessorName: thumbnail-processor-${self:provider.stage}
  pinsterApiUrl: https://api-${self:provider.stage}.pinster.io
  imageServiceUrl: https://${self:custom.customDomain.domainName}

functions:
  imageUploader:
    handler: lambda/lambda.upload
    events:
      - http:
          method: post
          cors: true
          path: /
    memorySize: 1024
    environment:
          BUCKET_NAME: ${self:custom.imageUploadBucket}
          API_PUBLIC_KEY: API_PUBLIC_KEY_CHANGE_ME
          PINSTER_API_URL: ${self:custom.pinsterApiUrl}
          IMAGE_SERVICE_URL: ${self:custom.imageServiceUrl}

  startExecution:
    handler: lambda/lambda.startExecution
    events:
      - s3:
          bucket: ${self:custom.imageUploadBucket}
          event: s3:ObjectCreated:*
          rules:
            - prefix: raw/
    memorySize: 128
    environment:
      STATEMACHINE_ARN: "arn:aws:states:#{AWS::Region}:#{AWS::AccountId}:stateMachine:${self:custom.thumbnailProcessorName}"

  generateThumbnail:
    handler: lambda/lambda.generateThumbnail
    events:
      - http:
          method: get
          path: generate
          cors: true
    memorySize: 2048
    environment:
          BUCKET: ${self:custom.imageHostBucket}
          URL: ${self:custom.imageHostBucketUrl}

  moderate:
    handler: lambda/lambda.moderate
    memorySize: 128

  moveImage:
    handler: lambda/lambda.moveImage
    memorySize: 512
    environment:
        BUCKET: ${self:custom.imageHostBucket}
        PREFIX: ""
        URL: ${self:custom.imageHostBucketUrl}

  notifySuccess:
    handler: lambda/lambda.notifySuccess
    memorySize: 128
    environment:
      PINSTER_API_URL: ${self:custom.pinsterApiUrl}
      PRIVATE_KEY: PRIVATE_KEY_CHANGE_ME
      IMAGE_SERVICE_URL: ${self:custom.imageServiceUrl}

  notifyFailure:
    handler: lambda/lambda.notifyFailure
    memorySize: 128
    environment:
      PINSTER_API_URL: ${self:custom.pinsterApiUrl}
      SNS_ARN: ${self:custom.failure_notification_sns_arn}
      PRIVATE_KEY: PRIVATE_KEY_CHANGE_ME
      IMAGE_SERVICE_URL: ${self:custom.imageServiceUrl}

stepFunctions:
  stateMachines:
    imageUploadHandlerMachine:
      name: ${self:custom.thumbnailProcessorName}
      definition:
        Comment: "StateMachine for images"
        StartAt: Moderate
        States:
          Moderate:
            Type: Task
            Resource: "arn:aws:lambda:#{AWS::Region}:#{AWS::AccountId}:function:${self:service}-${opt:stage}-moderate"
            Next: MoveImage
            Catch:
            - ErrorEquals:
              - ModerationThresholdExceeded
              Next: NotifyFailure
          MoveImage:
            Type: Task
            Resource: "arn:aws:lambda:#{AWS::Region}:#{AWS::AccountId}:function:${self:service}-${opt:stage}-moveImage"
            Next: NotifySuccess
          NotifySuccess:
            Type: Task
            Resource: "arn:aws:lambda:#{AWS::Region}:#{AWS::AccountId}:function:${self:service}-${opt:stage}-notifySuccess"
            End: true
          NotifyFailure:
            Type: Task
            Resource: "arn:aws:lambda:#{AWS::Region}:#{AWS::AccountId}:function:${self:service}-${opt:stage}-notifyFailure"
            End: true

resources:
  Resources:
  # if the bucket name is changed then this resource name must be changed! This is a stupid limitation of serverless
  # This is handled by serverless.rb
  # https://github.com/serverless/serverless/issues/2486
  # https://github.com/serverless/serverless/issues/2749
    S3BucketImageserviceuploadpinsterio:
      Type: 'AWS::S3::Bucket'
      Properties:
        BucketName: ${self:custom.imageUploadBucket}
        AccessControl: PublicReadWrite
        CorsConfiguration:
          CorsRules:
            - AllowedHeaders: ['*']
              AllowedMethods: [PUT, POST]
              AllowedOrigins: ['*']
              MaxAge: '3600'
    S3BucketPermissionsImageUpload:
      Type: AWS::S3::BucketPolicy
      Properties:
        Bucket: ${self:custom.imageUploadBucket}
        PolicyDocument:
          Statement:
            - Principal: "*"
              Action:
                - s3:PutObject
              Effect: Allow
              Sid: "AddPerm"
              Resource: arn:aws:s3:::${self:custom.imageUploadBucket}/*

    ImageHostBucket:
      Type: 'AWS::S3::Bucket'
      Properties:
        BucketName: ${self:custom.imageHostBucket}
        AccessControl: PublicReadWrite
        CorsConfiguration:
          CorsRules:
            - AllowedHeaders: ['*']
              AllowedMethods: [GET, PUT, HEAD]
              AllowedOrigins: ['*']
              MaxAge: '3600'
        WebsiteConfiguration:
                IndexDocument: index.html
                RoutingRules:
                - RedirectRule:
                    HostName: ${self:custom.customDomain.domainName}
                    HttpRedirectCode: 307
                    Protocol: https
                    ReplaceKeyPrefixWith: generate?key=
                  RoutingRuleCondition:
                    HttpErrorCodeReturnedEquals: 404
    S3BucketPermissionsImageHost:
      Type: AWS::S3::BucketPolicy
      Properties:
        Bucket: ${self:custom.imageHostBucket}
        PolicyDocument:
          Statement:
            - Principal: "*"
              Action:
                - s3:GetObject
                - s3:PutObject
              Effect: Allow
              Sid: "AddPerm"
              Resource: arn:aws:s3:::${self:custom.imageHostBucket}/*

    ImageHostCloudfront:
      Type: AWS::CloudFront::Distribution
      DependsOn:
        - ImageHostBucket
      Properties:
        DistributionConfig:
          Aliases:
            - ${self:custom.imageHostBucket}
          Comment: "Image hosting for ${self:provider.stage}"
          Origins:
            - DomainName: "${self:custom.imageHostBucket}.s3-website-us-east-1.amazonaws.com"
              Id: S3Origin
              CustomOriginConfig:
                HTTPPort: '80'
                HTTPSPort: '443'
                OriginProtocolPolicy: http-only
          Enabled: true
          HttpVersion: 'http2'
          DefaultRootObject: index.html
          DefaultCacheBehavior:
            AllowedMethods:
              - GET
              - HEAD
            Compress: true
            #This prevents CloudFront from caching our 307 redirect when we need to create a thumbnail on the fly.
            #This also means that any item we want to serve from CloudFront MUST have a Cache-Control header set.
            #Otherwise CloudFront will not cache anything.
            DefaultTTL: 0
            TargetOriginId: S3Origin
            ForwardedValues:
              QueryString: true
              Cookies:
                Forward: none
            ViewerProtocolPolicy: redirect-to-https
          PriceClass: PriceClass_100
          ViewerCertificate:
            AcmCertificateArn: arn:aws:acm:us-east-1:582149114309:certificate/4527b2fc-14a6-417c-a35c-82f5426e516a
            SslSupportMethod: sni-only

    ImageHostDNSName:
      Type: AWS::Route53::RecordSetGroup
      Properties:
        HostedZoneName: pinster.io.
        RecordSets:
        - Name: "${self:custom.imageHostBucket}"
          Type: CNAME
          TTL: 900
          ResourceRecords:
            - Fn::GetAtt:
              - ImageHostCloudfront
              - DomainName
    ImageServiceFailureSNS:
      Type: "AWS::SNS::Topic"
      Properties:
        TopicName: "${self:custom.failure_notification_sns}"
plugins:
  - serverless-step-functions
  - serverless-pseudo-parameters
  - serverless-domain-manager
  - serverless-plugin-log-retention