serverless.yml

service: serverless-mailing-list
# app and org for use with dashboard.serverless.com
#app: serverless-mailing-list
#org: your-org-name

frameworkVersion: "=2.70.0"

provider:
  name: aws
  runtime: python3.8
  architecture: arm64
  memorySize: 128
  lambdaHashingVersion: 20201221
  region: ${opt:region, env:AWS_REGION, 'us-east-1'}
  logRetentionInDays: ${opt:logretention, env:AWS_LOG_RETENTION, '14'}
  httpApi:
    useProviderTags: true
    cors: true
  tags:
    Purpose: ${self:custom.stack_name}
  deploymentBucket:
    tags:
      Purpose: ${self:service}

  environment:
    BASE_PATH: ${self:custom.config.BASE_PATH}
    TEMPLATE_BUCKET: !Ref TemplateBucket
    SUBSCRIBERS_DYNAMODB_TABLE: !Ref Subscribers
    ISSUES_DYNAMODB_TABLE: !Ref Issues
    SES_SENDER_IDENTITY_ARN: ${self:custom.config.SES_SENDER_IDENTITY_ARN}
    SES_CONFIGURATION_SET_ARN: ${self:custom.config.SES_CONFIGURATION_SET_ARN}
    SES_FIFO_QUEUE: !Ref SesQueue
    SES_LAMBDA_RUN_TIME_SECONDS: ${self:custom.config.SES_LAMBDA_RUN_TIME_SECONDS}
    SES_SEND_RATE_PER_SECOND: ${self:custom.config.SES_SEND_RATE_PER_SECOND}
    DYNAMODB_BACKUP_RETENTION_DAYS: ${self:custom.config.DYNAMODB_BACKUP_RETENTION_DAYS}
    CREATE_ISSUE_PASSKEY: ${self:custom.config.CREATE_ISSUE_PASSKEY}

  iamRoleStatements:
    - Effect: Allow
      Action:
        - dynamodb:Query
        - dynamodb:Scan
        - dynamodb:GetItem
        - dynamodb:PutItem
        - dynamodb:UpdateItem
        - dynamodb:DeleteItem
        - dynamodb:CreateBackup
      Resource:
        - !GetAtt
          - Subscribers
          - Arn
        - !GetAtt
          - Issues
          - Arn
    - Effect: Allow
      Action:
        - dynamodb:ListBackups
        - dynamodb:DeleteBackup
      Resource:
        - Fn::Join:
          - ""
          - - !GetAtt
              - Subscribers
              - Arn
            - "/backup/*"
        - Fn::Join:
          - ""
          - - !GetAtt
              - Issues
              - Arn
            - "/backup/*"
    - Effect: Allow
      Action:
        - s3:GetObject
        - s3:HeadObject
      Resource:
        Fn::Join:
          - ""
          - - "arn:aws:s3:::"
            - "Ref" : "TemplateBucket"
            - "/*"
    - Effect: Allow
      Action:
        - ses:sendEmail
      Resource:
        - ${self:custom.config.SES_SENDER_IDENTITY_ARN}
        - ${self:custom.config.SES_CONFIGURATION_SET_ARN}
    - Effect: Allow
      Action:
        - sqs:GetQueueAttributes
        - sqs:sendMessage
        - sqs:ReceiveMessage
        - sqs:DeleteMessage
      Resource:
        - !GetAtt
          - SesQueue
          - Arn

custom:
  default_stage: dev
  stage: ${opt:stage, self:custom.default_stage}
  stack_name: ${self:service}-${self:custom.stage}
  bucket_prefix: org.dltj
  # Store configuration and secrets in `config.yml`.  See
  # http://www.goingserverless.com/blog/keeping-secrets-out-of-git
  config: ${file(config.yml):${self:custom.stage}}

  pythonRequirements:
    pythonBin: .venv/bin/python
    dockerizePip: false

  customDomain:
    domainName: ${self:custom.config.HOSTNAME}
    stage: ${self:custom.stage}
    basePath: ${self:custom.config.BASE_PATH}
    certificateName: ${self:custom.config.CERTIFICATE_NAME}
    createRoute53Record: true
    endpointType: 'regional'
    securityPolicy: tls_1_2
    apiType: http
    autoDomain: false
	
  prune:
    automatic: true
    number: 3

functions:
  homepage:
    handler: homepage.endpoint
    description: Render and output the homepage
    events:
      - httpApi: 'GET /'
    onError: ${self:custom.config.LAMBDA_ON_FAILURE_SNS}

  subscribe:
    handler: subscribe.endpoint
    description: Handle a subscription request form
    events:
      - httpApi: 'POST /subscribe'
    onError: ${self:custom.config.LAMBDA_ON_FAILURE_SNS}

  confirm:
    handler: confirm.endpoint
    description: Handle a subscription confirmation link
    events:
      - httpApi: 'GET /subscribe/confirm/{email}/{identifier}'
    onError: ${self:custom.config.LAMBDA_ON_FAILURE_SNS}

  unsubscribe:
    handler: unsubscribe.endpoint
    description: Handle an unsubscribe confirmation link
    events:
      - httpApi: 'GET /unsubscribe/{email}/{identifier}'
    onError: ${self:custom.config.LAMBDA_ON_FAILURE_SNS}

  create_issue:
    handler: create_issue.endpoint
    description: Parse issue HTML and enqueue emails to subscribers
    events:
      - httpApi: 'POST /create_issue'
    timeout: 600
    onError: ${self:custom.config.LAMBDA_ON_FAILURE_SNS}

  send_issue:
    handler: send_issue.endpoint
    description: Send enqueued subscriber emails
    events:
      - schedule: rate(${self:custom.config.SES_LAMBDA_RUN_RATE })
    timeout: 600
    onError: ${self:custom.config.LAMBDA_ON_FAILURE_SNS}

  dynamodb_backup:
    handler: dynamodb_backup.endpoint
    description: Backup DynamoDB databases
    events: 
      - schedule: rate(1 day)
    onError: ${self:custom.config.LAMBDA_ON_FAILURE_SNS}


# CloudFormation resource templates
resources:
  Resources:
    SesQueue:
      Type: AWS::SQS::Queue
      Properties:
        FifoQueue: true
        QueueName: ${self:custom.stack_name}-Ses.fifo
        ContentBasedDeduplication: true
        Tags:
          - Key: Purpose
            Value: ${self:custom.stack_name}

    DeadLetterQueue:
      Type: AWS::SQS::Queue
      Properties:
        QueueName: ${self:custom.stack_name}-Deadletter
        Tags:
          - Key: Purpose
            Value: ${self:custom.stack_name}
    
    SesHealthTopic:
      Type: AWS::SNS::Topic
      Properties:
        TopicName: ${self:custom.stack_name}-SesHealth
        DisplayName: ${self:custom.stack_name} SES Health
        Subscription:
          - Endpoint: !GetAtt
            - SesHealthQueue
            - Arn
            Protocol: sqs
        Tags:
          - Key: Purpose
            Value: ${self:custom.stack_name}

    SesHealthQueue:
      Type: AWS::SQS::Queue
      Properties:
        QueueName: ${self:custom.stack_name}-SesHealth
        Tags:
          - Key: Purpose
            Value: ${self:custom.stack_name}
    
    Subscribers:
      Type: AWS::DynamoDB::Table
      Properties:
        TableName: ${self:custom.stack_name}-subscribers
        AttributeDefinitions: 
          - AttributeName: email
            AttributeType: S
        BillingMode: PAY_PER_REQUEST
        KeySchema:
          - AttributeName: email
            KeyType: HASH
        TableClass: STANDARD_INFREQUENT_ACCESS
        Tags:
          - Key: Purpose
            Value: ${self:custom.stack_name}

    Issues:
      Type: AWS::DynamoDB::Table
      Properties:
        TableName: ${self:custom.stack_name}-issues
        AttributeDefinitions: 
          - AttributeName: issue_number
            AttributeType: N
        BillingMode: PAY_PER_REQUEST
        KeySchema:
          - AttributeName: issue_number
            KeyType: HASH
        TableClass: STANDARD_INFREQUENT_ACCESS
        Tags:
          - Key: Purpose
            Value: ${self:custom.stack_name}

    TemplateBucket:
      Type: AWS::S3::Bucket
      Properties:
        BucketName: ${self:custom.bucket_prefix}.${self:custom.stack_name}.templates
        AccessControl: Private
        Tags:
          - Key: Purpose
            Value: ${self:custom.stack_name}


  Outputs:
    SesHealthTopic:
      Description: Topic ARN for SES Feedback Notifications
      Value: !Ref SesHealthTopic
    TemplateBucket:
      Description: S3 Bucket to store template files
      Value: !Ref TemplateBucket

package:
  include:
    # - something
  exclude:
    - node_modules/**
    - .venv/**
    - env/**
    - __pycache__
    - config.yml
    - html-templates/**

plugins:
  - serverless-python-requirements
  - serverless-domain-manager
  - serverless-prune-plugin