serverless.yml

service: elasticpypi

provider:
  name: aws
  runtime: python3.6
  memorySize: 128
  stage: mgmt
  region: us-west-2

  environment:
    SERVICE: ${self:service}
    STAGE: '/${self:provider.stage}'
    BUCKET: 'pypi.secure-shared.services'
    TABLE: 'elasticpypi'
    OVERWRITE: false

plugins:
  - serverless-wsgi
  - serverless-apigw-binary
  - serverless-domain-manager

package:
  exclude:
    - node_modules/**
    - tests/**
    - .cache/**
    - __pycache__/**
    - docs/**

functions:
  api:
    handler: wsgi.handler
    events:
      - http:
          path: XtWyM6FBzHqN
          method: get
          integration: lambda-proxy
          cors: ${file(./cors-policy.yml):CORS_POLICY}
      - http:
          path: XtWyM6FBzHqN
          method: post
          integration: lambda-proxy
          cors: ${file(./cors-policy.yml):CORS_POLICY}
      - http:
          path: XtWyM6FBzHqN/{name}
          method: get
          integration: lambda-proxy
          cors: ${file(./cors-policy.yml):CORS_POLICY}
  s3:
    handler: elasticpypi.handler.s3
    events:
      - s3:
          bucket: ${self:provider.environment.BUCKET}
          event: s3:ObjectRemoved:*
      - s3:
          bucket: ${self:provider.environment.BUCKET}
          event: s3:ObjectCreated:*

custom:
  wsgi:
    app: elasticpypi.api.app
  apigwBinary:
    types:
      - '*/*'
      - 'application/x-tar'
      - 'application/x-bzip'
      - 'application/zip'
      - 'application/x-gzip'
  customDomain:
    domainName: 'pypi.secure-shared.services'
    certificateName: '*.secure-shared.services'
    basePath: ''
    stage: ${self:provider.stage}
    createRoute53Record: true

resources:
  Resources:
    packagesTable:
      Type: AWS::DynamoDB::Table
      Properties:
        TableName: ${self:provider.environment.TABLE}
        AttributeDefinitions:
          - AttributeName: 'package_name'
            AttributeType: S
          - AttributeName: 'version'
            AttributeType: S
          - AttributeName: 'normalized_name'
            AttributeType: S
        KeySchema:
          - AttributeName: 'package_name'
            KeyType: HASH
          - AttributeName: 'version'
            KeyType: RANGE
        GlobalSecondaryIndexes:
          - IndexName: 'normalized_name-index'
            KeySchema:
              - AttributeName: 'normalized_name'
                KeyType: HASH
            Projection:
                ProjectionType: ALL
            ProvisionedThroughput:
                ReadCapacityUnits: 1
                WriteCapacityUnits: 1
        ProvisionedThroughput:
          ReadCapacityUnits: 1
          WriteCapacityUnits: 1
    DynamoDBIamPolicy:
      Type: AWS::IAM::Policy
      DependsOn: packagesTable
      Properties:
        PolicyName: ${self:service}-lambda-dynamodb
        PolicyDocument:
          Version: '2012-10-17'
          Statement:
            - Effect: Allow
              Action:
                - dynamodb:GetItem
                - dynamodb:PutItem
                - dynamodb:DeleteItem
                - dynamodb:Query
                - dynamodb:Scan
              Resource:
                - arn:aws:dynamodb:*:*:table/${self:provider.environment.TABLE}
                - arn:aws:dynamodb:*:*:table/${self:provider.environment.TABLE}/*
        Roles:
          - Ref: IamRoleLambdaExecution
    S3IamPolicy:
      Type: AWS::IAM::Policy
      Properties:
        PolicyName: ${self:service}-lambda-s3
        PolicyDocument:
          Version: '2012-10-17'
          Statement:
            - Effect: Allow
              Action: s3:GetObject
              Resource: arn:aws:s3:::${self:provider.environment.BUCKET}/*
            - Effect: Allow
              Action: s3:ListBucket
              Resource: arn:aws:s3:::${self:provider.environment.BUCKET}
            - Effect: Allow
              Action: s3:PutObject
              Resource: arn:aws:s3:::${self:provider.environment.BUCKET}/*
        Roles:
          - Ref: IamRoleLambdaExecution
    ApiGatewayS3IamRoleExecution:
      Type: AWS::IAM::Role
      Properties:
        AssumeRolePolicyDocument:
          Version: "2012-10-17"
          Statement:
            - Effect: "Allow"
              Principal:
                Service:
                  - "apigateway.amazonaws.com"
              Action:
                - "sts:AssumeRole"
        ManagedPolicyArns:
          - arn:aws:iam::aws:policy/service-role/AmazonAPIGatewayPushToCloudWatchLogs
        Path: /
    ApiGatewayS3IamPolicy:
      Type: AWS::IAM::Policy
      DependsOn: ApiGatewayS3IamRoleExecution
      Properties:
        PolicyName: ${self:service}-api_gateway-s3
        PolicyDocument:
          Version: '2012-10-17'
          Statement:
            - Effect: Allow
              Action: s3:GetObject
              Resource: arn:aws:s3:::${self:provider.environment.BUCKET}/*
            - Effect: Allow
              Action: s3:ListBucket
              Resource: arn:aws:s3:::${self:provider.environment.BUCKET}
        Roles:
          - Ref: ApiGatewayS3IamRoleExecution
    Packages:
      Type: AWS::ApiGateway::Resource
      Properties:
        ParentId:
          Fn::GetAtt:
            - ApiGatewayRestApi
            - RootResourceId
        PathPart: packages
        RestApiId:
          Ref: ApiGatewayRestApi
    PackagesName:
      Type: AWS::ApiGateway::Resource
      DependsOn: Packages
      Properties:
        ParentId:
          Ref: Packages
        PathPart: "{name}"
        RestApiId:
          Ref: ApiGatewayRestApi
    PackagesNameMethod:
      Type: AWS::ApiGateway::Method
      DependsOn:
        - PackagesName
        - ApiGatewayS3IamPolicy
      Properties:
        AuthorizationType: "NONE"
        ResourceId:
          Ref: PackagesName
        RestApiId:
          Ref: ApiGatewayRestApi
        HttpMethod: GET
        MethodResponses:
          - StatusCode: 200
            ResponseParameters:
              method.response.header.TimeStamp: true
              method.response.header.Content-Length: true
              method.response.header.Content-Type: true
        RequestParameters:
          method.request.path.name: true
        Integration:
          IntegrationHttpMethod: GET
          Type: AWS
          Uri: arn:aws:apigateway:${self:provider.region}:s3:path/${self:provider.environment.BUCKET}/{key}
          Credentials:
            Fn::GetAtt:
              - ApiGatewayS3IamRoleExecution
              - Arn
          IntegrationResponses:
            - StatusCode: 200
              ResponseParameters:
                method.response.header.TimeStamp: integration.response.header.Date
                method.response.header.Content-Length: integration.response.header.Content-Length
                method.response.header.Content-Type: integration.response.header.Content-Type
          RequestParameters:
            integration.request.path.key: method.request.path.name