serverless.yml

service: okta-hooks
frameworkVersion: '3'
configValidationMode: error
plugins:
  - serverless-webpack

provider:
  name: aws
  runtime: nodejs18.x
  stage: ${env:ENVIRONMENT}
  region: us-east-1
  vpc:
    securityGroupIds:
      - sg-888294ed
    subnetIds:
      - subnet-f2c2dfda # us-east-1a
      - subnet-1508db62 # us-east-1b
      - subnet-3fd94266 # us-east-1c
  stackTags:
    Name: ${env:PROJECT_NAME}-${self:custom.environmentMap.${env:ENVIRONMENT}}
    owner: devops-engineering-team@cru.org
    application: ${env:PROJECT_NAME}
    env: ${self:custom.environmentMap.${env:ENVIRONMENT}}
    managed_by: serverless-framework
    function: lambda
  iam:
    role:
      statements:
        - Effect: Allow
          Action:
            - SNS:Publish
            - SNS:Subscribe
          Resource:
            Ref: OktaEventsSNSTopic
        - Effect: Allow
          Action:
            - dynamodb:Query
            - dynamodb:Scan
            - dynamodb:GetItem
            - dynamodb:PutItem
            - dynamodb:UpdateItem
            - dynamodb:DeleteItem
            - dynamodb:BatchWriteItem
          Resource:
            - Fn::GetAtt: [ OktaRestrictedDomainsTable, Arn ]
  layers:
    - arn:aws:lambda:us-east-1:072686360478:layer:node-16_14_2:1
  environment: ${file(env.js)}

package:
  individually: true
  patterns:
    - '!.webpack/**'
    - '!test/**'
    - '!**/*.test.js'
    - '!.deployment/**'

custom:
  webpack:
    webpackConfig: ./webpack.config.js
    includeModules: true
    packager: yarn
    excludeFiles: '**/*.test.js'
    excludeRegex: \.ts|test|\.map
  environmentMap:
    production: prod
    staging: stage
    development: dev
    lab: lab

resources:
  extensions:
    IamRoleLambdaExecution:
      Properties:
        ManagedPolicyArns:
          - arn:aws:iam::aws:policy/service-role/AWSLambdaVPCAccessExecutionRole
          - arn:aws:iam::aws:policy/service-role/AWSLambdaENIManagementAccess

    VerificationAlbListenerRule2:
      Properties:
        # serverless framework only allows a single header condition, we handle all verification conditions here
        Conditions:
          - Field: path-pattern
            Values:
              - /events
          - Field: http-request-method
            HttpRequestMethodConfig:
              Values:
                - GET
          - Field: http-header
            HttpHeaderConfig:
              HttpHeaderName: Authorization
              Values:
                - ${env:OKTA_SHARED_SECRET}
          - Field: http-header
            HttpHeaderConfig:
              HttpHeaderName: X-Okta-Verification-Challenge
              Values:
                - ?*

  Resources:
    OktaLoadBalancer:
      Type: AWS::ElasticLoadBalancingV2::LoadBalancer
      Properties:
        Name: okta-hooks-${env:ENVIRONMENT}-alb
        Type: application
        Scheme: internet-facing
        IpAddressType: ipv4
        SecurityGroups:
          - sg-888294ed
        Subnets:
          - subnet-f5c2dfdd # us-east-1a
          - subnet-2808db5f # us-east-1b
          - subnet-9eda41c7 # us-east-1c
        LoadBalancerAttributes:
          - Key: access_logs.s3.enabled
            Value: true
          - Key: access_logs.s3.bucket
            Value: cru-alb-logs
          - Key: access_logs.s3.prefix
            Value: okta-hooks/${env:ENVIRONMENT}

    OktaLoadBalancerListener:
      Type: AWS::ElasticLoadBalancingV2::Listener
      Properties:
        LoadBalancerArn:
          Ref: OktaLoadBalancer
        Certificates:
          - CertificateArn: "arn:aws:acm:us-east-1:056154071827:certificate/dc6b7f6b-5d69-4382-9585-26c641e6b12b"
        DefaultActions:
          - Type: fixed-response
            Order: 1
            FixedResponseConfig:
              StatusCode: 403
              ContentType: application/json
              MessageBody: '{"error": "Forbidden"}'
        Port: 443
        Protocol: HTTPS

    OktaEventsSNSTopic:
      Type: AWS::SNS::Topic
      Properties:
        DisplayName: Okta Events
        TopicName: ${self:service}-${env:ENVIRONMENT}-lifecycle-events

    OktaRestrictedDomainsTable:
      Type: AWS::DynamoDB::Table
      Properties:
        TableName: ${self:service}-${env:ENVIRONMENT}-restricted-domains
        AttributeDefinitions:
          - AttributeName: DomainName
            AttributeType: S
        KeySchema:
          - AttributeName: DomainName
            KeyType: HASH
        BillingMode: PAY_PER_REQUEST

functions:
  registration:
    handler: hooks/inline/registration.handler
    memorySize: 128
    timeout: 5
    description: Registration hook to generate a new GUID and prevent signup with restricted domain.
    environment:
      DYNAMODB_RESTRICTED_DOMAINS:
        Ref: OktaRestrictedDomainsTable
    events:
      - alb:
          listenerArn:
            Ref: OktaLoadBalancerListener
          priority: 1
          conditions:
            header:
              name: Authorization
              values:
                - ${env:OKTA_SHARED_SECRET}
            method:
              - POST
            path: /registration

  verification:
    handler: hooks/event/verification.handler
    memorySize: 128
    timeout: 5
    description: Event hook Verification
    events:
      - alb:
          listenerArn:
            Ref: OktaLoadBalancerListener
          priority: 2
          conditions: # conditions required here but overwritten in Resources block.
            path: /events

  events:
    handler: hooks/event/events.handler
    memorySize: 128
    timeout: 5
    description: Event hook for all okta events
    environment:
      SNS_OKTA_EVENTS_ARN:
        Ref: OktaEventsSNSTopic
    events:
      - alb:
          listenerArn:
            Ref: OktaLoadBalancerListener
          priority: 3
          conditions:
            header:
              name: Authorization
              values:
                - ${env:OKTA_SHARED_SECRET}
            method:
              - POST
            path: /events

  userLifecycleCreate:
    handler: sns/user/lifecycle/create.handler
    description: Handle all `user.lifecycle.create` okta events
    memorySize: 256
    timeout: 12
    events:
      - sns:
          arn: !Ref OktaEventsSNSTopic
          topicName: ${self:service}-${env:ENVIRONMENT}-lifecycle-events
          filterPolicy:
            eventType:
              - user.lifecycle.create

  userLifecycleStatusChange:
    handler: sns/user/lifecycle/status-change.handler
    description: Handles all `user.lifecycle.deactivated` and `user.lifecycle.reactivate` okta events
    memorySize: 128
    timeout: 6
    events:
      - sns:
          arn: !Ref OktaEventsSNSTopic
          topicName: ${self:service}-${env:ENVIRONMENT}-lifecycle-events
          filterPolicy:
            eventType:
              - user.lifecycle.deactivate
              - user.lifecycle.reactivate

  userAccountUpdateProfile:
    handler: sns/user/account/update-profile.handler
    description: Handle all `user.account.update_profile` okta events
    memorySize: 256
    timeout: 12
    events:
      - sns:
          arn: !Ref OktaEventsSNSTopic
          topicName: ${self:service}-${env:ENVIRONMENT}-lifecycle-events
          filterPolicy:
            eventType:
              - user.account.update_profile

  syncRestrictedDomains:
    handler: schedule/sync-restricted-domains.handler
    description: Sync list of restricted domains from Google Sheet
    memorySize: 1024
    timeout: 120
    environment:
      DYNAMODB_RESTRICTED_DOMAINS:
        Ref: OktaRestrictedDomainsTable
    events:
      # Run daily at 12:00a and 12:00p UTC
      - schedule: cron(0 0,12 * * ? *)

  syncMissingOktaUsers:
    handler: schedule/sync-missing-okta-users.handler
    description: Query okta users missing Global Registry IDs and enqueue to SNS to re-sync them.
    memorySize: 1024
    timeout: 120
    environment:
      SNS_OKTA_EVENTS_ARN:
        Ref: OktaEventsSNSTopic
    events:
      # Run every 30 minutes.
      - schedule: cron(0/30 * * * ? *)