serverless.yml

org: lucasbrogni
app: zero-trust-file-apis
service: zero-trust-confidential-files-api

provider:
  name: aws
  runtime: nodejs20.x
  stage: ${opt:stage, 'dev'}
  environment:
    USER_TABLE_NAME: Users-${self:provider.stage}
    RESEND_API_KEY: ${param:resendApiKey}
    MFA_CODE_TABLE_NAME: MfaCodes-${self:provider.stage}
    MFA_TTL_SECONDS: 300
    JWT_SECRET: ${param:jwtSecret}
    EMAIL_FROM: ${param:emailFrom}
    S3_UPLOAD_BUCKET_NAME: ${param:s3UploadBucketName}-${self:provider.stage}
    S3_PRESIGNED_URL_EXPIRATION: 300
    GEMINI_API_KEY: ${param:geminiApiKey}
    GEMINI_API_URL: ${param:geminiApiURL}
    INVOICES_TABLE_NAME: Invoices-${self:provider.stage}

  httpApi:
    authorizers:
      authorizer:
        type: request
        identitySource: "$request.header.Authorization"
        functionName: authorizer
        enableSimpleResponses: true

functions:
  signup:
    handler: auth/signup.handler
    events:
      - httpApi:
          path: /signup
          method: post
    role: SignupLambdaRole

  signin:
    handler: auth/signin.handler
    events:
      - httpApi:
          path: /signin
          method: post
    role: SigninLambdaRole

  verifyMfa:
    handler: auth/verify-mfa.handler
    events:
      - httpApi:
          path: /verify-mfa
          method: post
    role: VerifyMfaLambdaRole

  authorizer:
    handler: auth/jwt-authorizer.handler

  getPresignedURLForUpload:
    handler: getPresignedURLForUpload/index.handler
    events:
      - httpApi:
          path: /files/get-upload-url
          method: post
          authorizer: 
            type: request
            name: authorizer
    role: GetPresignedURLForUploadLambdaRole

  getListOfUserFiles:
    handler: getFilesForUser/index.handler
    events:
      - httpApi:
          path: /files/list
          method: get
          authorizer: 
            type: request
            name: authorizer
    role: GetListOfUserFilesLambdaRole

  getPresignedURLForDownload:
    handler: getPresignedURLForDownload/index.handler
    events:
      - httpApi:
          path: /files/get-download-url/{fileName}
          method: get
          authorizer: 
            type: request
            name: authorizer
    role: GetPresignedURLForDownloadLambdaRole

  processInvoiceS3:
    handler: invoiceProcessor/index.handler
    events: 
      - s3: 
          bucket: ${param:s3UploadBucketName}-${self:provider.stage}
          event: s3:ObjectCreated:*
    role: ProcessInvoiceLambdaRole

resources:
  Resources:                
    UsersTable:
      Type: AWS::DynamoDB::Table
      Properties:
        TableName: Users-${self:provider.stage}
        AttributeDefinitions:
          - AttributeName: email
            AttributeType: S
        KeySchema:
          - AttributeName: email
            KeyType: HASH
        BillingMode: PAY_PER_REQUEST
        TimeToLiveSpecification:
          AttributeName: ttl
          Enabled: false

    MfaCodesTable:
      Type: AWS::DynamoDB::Table
      Properties:
        TableName: MfaCodes-${self:provider.stage}
        AttributeDefinitions:
          - AttributeName: email
            AttributeType: S
        KeySchema:
          - AttributeName: email
            KeyType: HASH
        BillingMode: PAY_PER_REQUEST
        TimeToLiveSpecification:
          AttributeName: ttl
          Enabled: true

    SignupLambdaRole:
      Type: AWS::IAM::Role
      Properties:
        RoleName: zero-trust-confidential-files-api-signup-lambda-role-${self:provider.stage}
        AssumeRolePolicyDocument:
          Version: "2012-10-17"
          Statement:
            - Effect: Allow
              Principal:
                Service:
                  - lambda.amazonaws.com
              Action:
                - sts:AssumeRole
        Policies:
          - PolicyName: SignupLambdaPolicy
            PolicyDocument:
              Version: "2012-10-17"
              Statement:
                - Effect: Allow
                  Action:
                    - dynamodb:PutItem
                  Resource:
                    - arn:aws:dynamodb:${aws:region}:${aws:accountId}:table/Users-${self:provider.stage}

    SigninLambdaRole:
      Type: AWS::IAM::Role
      Properties:
        RoleName: zero-trust-confidential-files-api-signin-lambda-role-${self:provider.stage}
        AssumeRolePolicyDocument:
          Version: "2012-10-17"
          Statement:
            - Effect: Allow
              Principal:
                Service:
                  - lambda.amazonaws.com
              Action:
                - sts:AssumeRole
        Policies:
          - PolicyName: SigninLambdaPolicy
            PolicyDocument:
              Version: "2012-10-17"
              Statement:
                - Effect: Allow
                  Action:
                    - dynamodb:GetItem
                  Resource:
                    - arn:aws:dynamodb:${aws:region}:${aws:accountId}:table/Users-${self:provider.stage}
                - Effect: Allow
                  Action:
                    - dynamodb:PutItem
                  Resource:
                    - arn:aws:dynamodb:${aws:region}:${aws:accountId}:table/MfaCodes-${self:provider.stage}

    VerifyMfaLambdaRole:
      Type: AWS::IAM::Role
      Properties:
        RoleName: zero-trust-confidential-files-api-verify-mfa-lambda-role-${self:provider.stage}
        AssumeRolePolicyDocument:
          Version: "2012-10-17"
          Statement:
            - Effect: Allow
              Principal:
                Service:
                  - lambda.amazonaws.com
              Action:
                - sts:AssumeRole
        Policies:
          - PolicyName: VerifyMfaLambdaPolicy
            PolicyDocument:
              Version: "2012-10-17"
              Statement:
                - Effect: Allow
                  Action:
                    - dynamodb:GetItem
                    - dynamodb:DeleteItem
                  Resource:
                    - arn:aws:dynamodb:${aws:region}:${aws:accountId}:table/MfaCodes-${self:provider.stage}

    GetPresignedURLForUploadLambdaRole:
      Type: AWS::IAM::Role
      Properties:
        RoleName: get-presigned-url-for-upload-lambda-role-${self:provider.stage}
        AssumeRolePolicyDocument:
          Version: "2012-10-17"
          Statement:
            - Effect: Allow
              Principal:
                Service:
                  - lambda.amazonaws.com
              Action:
                - sts:AssumeRole
        Policies:
          - PolicyName: GetPresignedURLLambdaPolicy
            PolicyDocument:
              Version: "2012-10-17"
              Statement:
                - Effect: Allow
                  Action:
                    - s3:PutObject
                  Resource:
                    - arn:aws:s3:::${param:s3UploadBucketName}-${self:provider.stage}/*

    GetListOfUserFilesLambdaRole:
      Type: AWS::IAM::Role
      Properties:
        RoleName: get-list-of-user-files-lambda-role-${self:provider.stage}
        AssumeRolePolicyDocument:
          Version: "2012-10-17"
          Statement:
            - Effect: Allow
              Principal:
                Service:
                  - lambda.amazonaws.com
              Action:
                - sts:AssumeRole  
        Policies:
          - PolicyName: GetPresignedURLLambdaPolicy
            PolicyDocument:
              Version: "2012-10-17"
              Statement:
                - Effect: Allow
                  Action:
                    - s3:ListBucket
                  Resource:
                    - arn:aws:s3:::${param:s3UploadBucketName}-${self:provider.stage}

    GetPresignedURLForDownloadLambdaRole:
      Type: AWS::IAM::Role
      Properties:
        RoleName: get-presigned-url-for-download-lambda-role-${self:provider.stage}
        AssumeRolePolicyDocument:
          Version: "2012-10-17"
          Statement:  
            - Effect: Allow
              Principal:
                Service:
                  - lambda.amazonaws.com
              Action:
                - sts:AssumeRole
        Policies: 
          - PolicyName: GetPresignedURLLambdaPolicy
            PolicyDocument:
              Version: "2012-10-17"
              Statement:
                - Effect: Allow
                  Action:
                    - s3:ListBucket
                  Resource:
                    - arn:aws:s3:::${param:s3UploadBucketName}-${self:provider.stage}
                - Effect: Allow
                  Action:
                    - s3:GetObject
                    - s3:HeadObject
                  Resource:
                    - arn:aws:s3:::${param:s3UploadBucketName}-${self:provider.stage}/*

    InvoicesTable: 
      Type: AWS::DynamoDB::Table
      Properties:
        TableName: Invoices-${self:provider.stage}
        AttributeDefinitions:
          - AttributeName: invoiceId
            AttributeType: S
          - AttributeName: date
            AttributeType: S
        KeySchema:
          - AttributeName: invoiceId
            KeyType: HASH
        GlobalSecondaryIndexes:
          - IndexName: DateIndex
            KeySchema:
              - AttributeName: date
                KeyType: HASH
            Projection:
              ProjectionType: ALL
        BillingMode: PAY_PER_REQUEST


    ProcessInvoiceLambdaRole: 
      Type: AWS::IAM::Role
      Properties:
        RoleName: ProcessInvoiceLambdaRole-${self:provider.stage}
        AssumeRolePolicyDocument:
          Version: "2012-10-17"
          Statement:  
            - Effect: Allow
              Principal:
                Service:
                  - lambda.amazonaws.com
              Action:
                - sts:AssumeRole
        Policies: 
          - PolicyName: ProcessInvoiceLambdaPolicy
            PolicyDocument:
              Version: "2012-10-17"
              Statement:
                - Effect: Allow
                  Action:
                    - s3:ListBucket
                  Resource:
                    - arn:aws:s3:::${param:s3UploadBucketName}-${self:provider.stage}
                - Effect: Allow
                  Action:
                    - s3:GetObject 
                  Resource:
                    - arn:aws:s3:::${param:s3UploadBucketName}-${self:provider.stage}/*
                - Effect: Allow
                  Action:
                    - dynamodb:PutItem
                    - dynamodb:UpdateItem
                  Resource:
                    - arn:aws:dynamodb:${aws:region}:${aws:accountId}:table/Invoices-${self:provider.stage}
                    - arn:aws:dynamodb:${aws:region}:${aws:accountId}:table/Invoices-${self:provider.stage}/index/*
                - Effect: Allow
                  Action:
                    - logs:CreateLogGroup
                    - logs:CreateLogStream
                    - logs:PutLogEvents
                  Resource:
                    - arn:aws:logs:${aws:region}:${aws:accountId}:log-group:/aws/lambda/zero-trust-confidential-files-api-${self:provider.stage}-processInvoiceS3:*:*
            

package:
  exclude:
    - .gitignore
    - .git/**
    - __tests__/**