serverless.yml

service: react-aws
useDotenv: true
frameworkVersion: "3"

plugins:
  - serverless-s3-cleaner
  - serverless-dotenv-plugin
  - serverless-functions-base-path

custom:
  cognito:
    issuerUrl:
      Fn::Sub:
        - "https://cognito-idp.${region}.amazonaws.com/${userPool}"
        - region: ${self:provider.region}
          userPool:
            Ref: UserPool
    userClient:
      Ref: UserClient
    userPool:
      Ref: UserPool

  functionsBasePath: dist
  serverless-s3-cleaner:
    buckets:
      - react-aws-uploads
  dotenv:
    exclude:
      - AWS_ACCESS_KEY_ID
      - AWS_SECRET_ACCESS_KEY
      - AWS_SESSION_TOKEN
      - NODE_ENV
    required:
      env:
        - REGION
      file: true

provider:
  name: aws
  stage: prod
  region: us-east-1
  runtime: nodejs20.x
  httpApi:
    name: react-aws
    cors: true
    authorizers:
      cognitoAuthorizer:
        type: jwt
        identitySource: $request.header.Authorization
        issuerUrl: ${self:custom.cognito.issuerUrl}
        audience:
          - ${self:custom.cognito.userClient}
  environment:
    BUCKET_NAME: react-aws-uploads
    USER_POOL: ${self:custom.cognito.userPool}
    USER_CLIENT: ${self:custom.cognito.userClient}
  iam:
    role:
      name: react-aws-role
      statements:
        - Effect: "Allow"
          Action:
            - "s3:Put*"
            - "s3:Get*"
            - "s3:List*"
            - "s3:Delete*"
            - "s3:GetBucketPolicy"
            - "s3:PutBucketPolicy"
          Resource:
            - arn:aws:s3:::react-aws-uploads/*
            - arn:aws:s3:::react-aws-uploads
        - Effect: "Allow"
          Action:
            - dynamodb:Scan
            - dynamodb:GetItem
            - dynamodb:PutItem
            - dynamodb:DeleteItem
            - dynamodb:UpdateItem
            - dynamodb:Query
          Resource:
            - arn:aws:dynamodb:*:*:table/*
        - Effect: "Allow"
          Action:
            - execute-api:Invoke
          Resource:
            - "arn:aws:execute-api:*:*:*"
        - Effect: "Allow"
          Action:
            - cognito-idp:AdminInitiateAuth
            - cognito-idp:AdminCreateUser
            - cognito-idp:AdminSetUserPassword
            - cognito-idp:AdminGetUser
            - cognito-idp:AdminUpdateUserAttributes
            - cognito-idp:ChangePassword
          Resource:
            - "arn:aws:cognito-idp:*:*:userpool/*"

functions:
  createCat:
    handler: handlers/create-cat.handler
    events:
      - httpApi:
          path: /cats
          method: "POST"
          authorizer:
            name: cognitoAuthorizer
  listCats:
    handler: handlers/list-cats.handler
    events:
      - httpApi:
          path: /cats
          method: "GET"
  showCat:
    handler: handlers/show-cat.handler
    events:
      - httpApi:
          path: /cats/{id}
          method: "GET"
  editCat:
    handler: handlers/edit-cat.handler
    events:
      - httpApi:
          path: /cats/{id}
          method: "PATCH"
          authorizer:
            name: cognitoAuthorizer
  deleteCat:
    handler: handlers/delete-cat.handler
    events:
      - httpApi:
          path: /cats/{id}
          method: "DELETE"
          authorizer:
            name: cognitoAuthorizer
  listBreeds:
    handler: handlers/list-breeds.handler
    events:
      - httpApi:
          path: /breeds
          method: "GET"
  listAges:
    handler: handlers/list-ages.handler
    events:
      - httpApi:
          path: /ages
          method: "GET"
  uploadPhoto:
    handler: handlers/upload-photo.handler
    events:
      - httpApi:
          path: /photos
          method: "POST"
          authorizer:
            name: cognitoAuthorizer
  deletePhoto:
    handler: handlers/delete-photo.handler
    events:
      - httpApi:
          path: /photos/{key}
          method: "DELETE"
          authorizer:
            name: cognitoAuthorizer
  signin:
    handler: handlers/signin.handler
    events:
      - httpApi:
          path: /auth/signin
          method: "POST"
  signup:
    handler: handlers/signup.handler
    events:
      - httpApi:
          path: /auth/signup
          method: "POST"

  showMe:
    handler: handlers/show-me.handler
    events:
      - httpApi:
          path: /me
          method: "GET"
          authorizer:
            name: cognitoAuthorizer

  updateMe:
    handler: handlers/update-me.handler
    events:
      - httpApi:
          path: /me
          method: "PATCH"
          authorizer:
            name: cognitoAuthorizer
  changePassword:
    handler: handlers/change-password.handler
    events:
      - httpApi:
          path: /change-password
          method: "PATCH"
          authorizer:
            name: cognitoAuthorizer

resources:
  Resources:
    CatsTable:
      Type: AWS::DynamoDB::Table
      Properties:
        TableName: react-aws-cats
        AttributeDefinitions:
          - AttributeName: id
            AttributeType: S
          - AttributeName: owner_email
            AttributeType: S
        KeySchema:
          - AttributeName: id
            KeyType: HASH
          - AttributeName: owner_email
            KeyType: RANGE
        ProvisionedThroughput:
          ReadCapacityUnits: 1
          WriteCapacityUnits: 1
    UploadsBucket:
      Type: AWS::S3::Bucket
      Properties:
        BucketName: react-aws-uploads
        PublicAccessBlockConfiguration:
          BlockPublicAcls: false
          BlockPublicPolicy: false
          IgnorePublicAcls: false
          RestrictPublicBuckets: false
        CorsConfiguration:
          CorsRules:
            - AllowedHeaders:
                - "*"
              AllowedMethods:
                - GET
              AllowedOrigins:
                - "*"
    UploadsBucketPolicy:
      Type: AWS::S3::BucketPolicy
      DependsOn: UploadsBucket
      Properties:
        Bucket: react-aws-uploads
        PolicyDocument:
          Version: "2012-10-17"
          Statement:
            - Sid: PublicReadGetObject
              Effect: Allow
              Principal: "*"
              Action: s3:GetObject
              Resource: "arn:aws:s3:::react-aws-uploads/*"
    UserPool:
      Type: AWS::Cognito::UserPool
      Properties:
        UserPoolName: react-aws-user-pool
        Schema:
          - Name: email
            Required: true
            Mutable: true
        Policies:
          PasswordPolicy:
            MinimumLength: 6
        AutoVerifiedAttributes:
          - email
    UserClient:
      Type: AWS::Cognito::UserPoolClient
      Properties:
        ClientName: react-aws-user-client
        GenerateSecret: false
        UserPoolId:
          Ref: UserPool
        AccessTokenValidity: 5
        IdTokenValidity: 5
        ExplicitAuthFlows:
          - ADMIN_NO_SRP_AUTH