serverless.yml

service: auth-${opt:stage}-${self:custom.version}

custom:
  stage: ${opt:stage, self:provider.stage}
  version: "0001"
  output:
    file: .serverless/output.json
  config:
    CACHE_INSTANCE_SIZE: cache.t2.micro

frameworkVersion: ">=1.28.0 <2.0.0"

plugins:
  - serverless-deployment-bucket
  - serverless-plugin-additional-stacks
  - serverless-offline

provider:
  name: aws
  runtime: go1.x
  region: ${opt:region, 'us-west-2'}
  accountId: '779089996899'
  deploymentBucket:
    name: auth-${opt:stage}-deployment-bucket-${self:custom.version}
    serverSideEncryption: AES256
  environment:
    REDIS_ENDPOINT:
      "Fn::Join": [":", ["Fn::GetAtt": [ServerlessElasticacheCluster, RedisEndpoint.Address], "Fn::GetAtt": [ServerlessElasticacheCluster, RedisEndpoint.Port]]]
    JWT_SECRET: ${ssm:/ncnt/auth/jwt/secret/${opt:stage}~true}

functions:
  secret:
    handler: bin/auth/create/secret
    vpc:
      securityGroupIds:
        - "Fn::GetAtt": ServerlessSecurityGroup.GroupId
      subnetIds:
        - Ref: ServerlessPrivateSubnetA
    events:
      - http:
          path: /secret
          method: get
          cors:
            origin: '*'
            headers:
              - Content-Type
              - X-Amz-Date
              - Authorization
              - X-Api-Key
              - X-Amz-Security-Token
              - X-Amz-User-Agent
            allowCredentials: false
  jwt:
    handler: bin/auth/create/jwt
    vpc:
      securityGroupIds:
        - "Fn::GetAtt": ServerlessSecurityGroup.GroupId
      subnetIds:
        - Ref: ServerlessPrivateSubnetA
    events:
      - http:
          path: /sign
          method: get
          cors:
            origin: '*'
            headers:
              - Content-Type
              - X-Amz-Date
              - Authorization
              - X-Api-Key
              - X-Amz-Security-Token
              - X-Amz-User-Agent
            allowCredentials: false
  validate:
    handler: bin/auth/validate/jwt
    vpc:
      securityGroupIds:
        - "Fn::GetAtt": ServerlessSecurityGroup.GroupId
      subnetIds:
        - Ref: ServerlessPrivateSubnetA
resources:
  Resources:
    ServerlessVPC:
      Type: AWS::EC2::VPC
      Properties:
        CidrBlock: "10.0.0.0/16"
    ElasticIpLambda:
      Type: AWS::EC2::EIP
      Properties:
        Domain: vpc
    InternetGatewayLambda:
      Type: AWS::EC2::InternetGateway
    VPCGatewayAttachmentLambda:
      Type: AWS::EC2::VPCGatewayAttachment
      Properties:
        VpcId:
          Ref: ServerlessVPC
        InternetGatewayId:
          Ref: InternetGatewayLambda
    NatGatewayLambda:
      Type: AWS::EC2::NatGateway
      Properties:
        AllocationId:
          Fn::GetAtt:
            - ElasticIpLambda
            - AllocationId
        SubnetId:
          Ref: ServerlessPublicSubnetA
    ServerlessPrivateSubnetA:
      DependsOn: ServerlessVPC
      Type: AWS::EC2::Subnet
      Properties:
        VpcId:
          Ref: ServerlessVPC
        AvailabilityZone: ${self:provider.region}a
        CidrBlock: "10.0.1.0/24"
    ServerlessPublicSubnetA:
      DependsOn: ServerlessVPC
      Type: AWS::EC2::Subnet
      Properties:
        VpcId:
          Ref: ServerlessVPC
        AvailabilityZone: ${self:provider.region}a
        CidrBlock: "10.0.2.0/24"
    DefaultPrivateRouteTable:
      Type: AWS::EC2::RouteTable
      Properties:
        VpcId:
          Ref: ServerlessVPC
    DefaultPrivateRoute:
      Type: AWS::EC2::Route
      Properties:
        RouteTableId:
          Ref: DefaultPrivateRouteTable
        DestinationCidrBlock: 0.0.0.0/0
        NatGatewayId:
          Ref: NatGatewayLambda
    DefaultPublicRouteTable:
      Type: AWS::EC2::RouteTable
      Properties:
        VpcId:
          Ref: ServerlessVPC
    DefaultPublicRoute:
      Type: AWS::EC2::Route
      Properties:
        RouteTableId:
          Ref: DefaultPublicRouteTable
        DestinationCidrBlock: 0.0.0.0/0
        GatewayId:
          Ref: InternetGatewayLambda
    SubnetRouteTableAssociationLambdaPrivateA:
      Type: AWS::EC2::SubnetRouteTableAssociation
      Properties:
        SubnetId:
          Ref: ServerlessPrivateSubnetA
        RouteTableId:
          Ref: DefaultPrivateRouteTable
    SubnetRouteTableAssociationLambdaPublicA:
      Type: AWS::EC2::SubnetRouteTableAssociation
      Properties:
        SubnetId:
          Ref: ServerlessPublicSubnetA
        RouteTableId:
          Ref: DefaultPublicRouteTable
    ServerlessSecurityGroup:
      DependsOn: ServerlessVPC
      Type: AWS::EC2::SecurityGroup
      Properties:
        GroupDescription: SecurityGroup for Serverless Functions
        VpcId:
          Ref: ServerlessVPC
    ServerlessStorageSecurityGroup:
      DependsOn: ServerlessVPC
      Type: AWS::EC2::SecurityGroup
      Properties:
        GroupDescription: Ingress for Redis Cluster
        VpcId:
          Ref: ServerlessVPC
        SecurityGroupIngress:
        - IpProtocol: tcp
          FromPort: '6379'
          ToPort: '6379'
          SourceSecurityGroupId:
            Ref: ServerlessSecurityGroup
    ServerlessCacheSubnetGroup:
      Type: AWS::ElastiCache::SubnetGroup
      Properties:
        Description: "Cache Subnet Group"
        SubnetIds:
        - Ref: ServerlessPrivateSubnetA
    ServerlessElasticacheCluster:
      DependsOn: ServerlessStorageSecurityGroup
      Type: AWS::ElastiCache::CacheCluster
      Properties:
        AutoMinorVersionUpgrade: true
        Engine: redis
        CacheNodeType: ${self:custom.config.CACHE_INSTANCE_SIZE}
        NumCacheNodes: 1
        VpcSecurityGroupIds:
        - "Fn::GetAtt": ServerlessStorageSecurityGroup.GroupId
        CacheSubnetGroupName:
          Ref: ServerlessCacheSubnetGroup
    

package:
 exclude:
   - node_modules/**
   - '!node_modules/.cache'
   - Gopkg.lock
 include:
   - bin/**/**
   - bin/**/**/**