serverless.yml

service: auto-cleanup-app

custom:
  log_level: INFO # DEBUG for dev | INFO for prod
  region: ${opt:region, "ap-southeast-2"} # AWS deployment region
  pythonRequirements:
    layer:
      name: ${self:service}-${self:provider.stage}-requirements
      compatibleRuntimes:
        - python3.9
    slim: true

provider:
  name: aws
  runtime: python3.9
  stage: ${opt:stage, "prod"} # overwrite via CLI "--stage dev"
  region: ${self:custom.region}
  apiGateway:
    minimumCompressionSize: 1024
  iam:
    role:
      statements:
        - Effect: Allow
          Action: "*"
          Resource: "*"
          Condition:
            ForAnyValue:StringEquals:
              aws:CalledVia:
                - cloudformation.amazonaws.com
        - Effect: Allow
          Action:
            - airflow:DeleteEnvironment
            - airflow:GetEnvironment
            - airflow:ListEnvironments
          Resource: "*"
        - Effect: Allow
          Action:
            - amplify:DeleteApp
            - amplify:ListApps
          Resource: "*"
        - Effect: Allow
          Action:
            - cloudformation:DeleteStack
            - cloudformation:DescribeStacks
            - cloudformation:DescribeStackResources
            - cloudformation:ListStackResources
            - cloudformation:ListStacks
            - cloudformation:UpdateTerminationProtection
          Resource: "*"
        - Effect: Allow
          Action:
            - codecommit:GetRepository
          Resource: "*"
        - Effect: Allow
          Action:
            - dynamodb:BatchWriteItem
            - dynamodb:DeleteItem
            - dynamodb:DeleteTable
            - dynamodb:DescribeTable
            - dynamodb:GetItem
            - dynamodb:ListTables
            - dynamodb:PutItem
            - dynamodb:Scan
          Resource: "*"
        - Effect: Allow
          Action:
            - ec2:DeleteNatGateway
            - ec2:DeleteSecurityGroup
            - ec2:DeleteSnapshot
            - ec2:DeleteVolume
            - ec2:DeregisterImage
            - ec2:DescribeAddresses
            - ec2:DescribeImages
            - ec2:DescribeInstanceAttribute
            - ec2:DescribeInstances
            - ec2:DescribeNatGateways
            - ec2:DescribeSecurityGroups
            - ec2:DescribeSnapshots
            - ec2:DescribeVolumes
            - ec2:ModifyInstanceAttribute
            - ec2:ReleaseAddress
            - ec2:StopInstances
            - ec2:TerminateInstances
          Resource: "*"
        - Effect: Allow
          Action:
            - ecr:BatchDeleteImage
            - ecr:DeleteRepository
            - ecr:DescribeImages
            - ecr:DescribeRepositories
            - ecr:ListImages
          Resource: "*"
        - Effect: Allow
          Action:
            - ecs:DeleteCluster
            - ecs:DeleteService
            - ecs:DescribeClusters
            - ecs:DescribeServices
            - ecs:ListClusters
            - ecs:ListServices
          Resource: "*"
        - Effect: Allow
          Action:
            - eks:DeleteCluster
            - eks:DeleteFargateProfile
            - eks:DeleteNodegroup
            - eks:DescribeCluster
            - eks:DescribeFargateProfile
            - eks:DescribeNodegroup
            - eks:ListClusters
            - eks:ListFargateProfiles
            - eks:ListNodegroups
          Resource: "*"
        - Effect: Allow
          Action:
            - elasticbeanstalk:DeleteApplication
            - elasticbeanstalk:DescribeApplications
          Resource: "*"
        - Effect: Allow
          Action:
            - elasticache:DeleteCacheCluster
            - elasticache:DeleteReplicationGroup
            - elasticache:DescribeCacheClusters
            - elasticache:DescribeReplicationGroups
          Resource: "*"
        - Effect: Allow
          Action:
            - elasticfilesystem:DeleteFileSystem
            - elasticfilesystem:DeleteMountTarget
            - elasticfilesystem:DescribeFileSystems
            - elasticfilesystem:DescribeMountTargets
          Resource: "*"
        - Effect: Allow
          Action:
            - elasticloadbalancing:DeleteLoadBalancer
            - elasticloadbalancing:DescribeLoadBalancers
            - elasticloadbalancing:ModifyLoadBalancerAttributes
          Resource: "*"
        - Effect: Allow
          Action:
            - elasticmapreduce:ListClusters
            - elasticmapreduce:TerminateJobFlows
          Resource: "*"
        - Effect: Allow
          Action:
            - es:DeleteElasticsearchDomain
            - es:DescribeElasticsearchDomainConfig
            - es:ListDomainNames
          Resource: "*"
        - Effect: Allow
          Action:
            - glue:DeleteCrawler
            - glue:DeleteDatabase
            - glue:DeleteDevEndPoint
            - glue:GetCrawlers
            - glue:GetDatabases
            - glue:GetDevEndpoints
            - glue:GetTable
          Resource: "*"
        - Effect: Allow
          Action:
            - iam:DeleteAccessKey
            - iam:DeleteInstanceProfile
            - iam:DeleteLoginProfile
            - iam:DeletePolicy
            - iam:DeletePolicyVersion
            - iam:DeleteRole
            - iam:DeleteRolePolicy
            - iam:DeleteUser
            - iam:DeleteUserPolicy
            - iam:DetachGroupPolicy
            - iam:DetachRolePolicy
            - iam:DetachUserPolicy
            - iam:GenerateServiceLastAccessedDetails
            - iam:GetAccessKeyLastUsed
            - iam:GetServiceLastAccessedDetails
            - iam:ListAccessKeys
            - iam:ListAttachedRolePolicies
            - iam:ListEntitiesForPolicy
            - iam:ListGroupsForUser
            - iam:ListInstanceProfilesForRole
            - iam:ListPolicies
            - iam:ListPolicyVersions
            - iam:ListRolePolicies
            - iam:ListRoles
            - iam:ListUserPolicies
            - iam:ListUsers
            - iam:RemoveRoleFromInstanceProfile
            - iam:RemoveUserFromGroup
          Resource: "*"
        - Effect: Allow
          Action:
            - kafka:DeleteCluster
            - kafka:ListClustersV2
            - ec2:DeleteVpcEndpoints
          Resource: "*"
        - Effect: Allow
          Action:
            - kinesis:DeleteStream
            - kinesis:DescribeStream
            - kinesis:ListStreams
          Resource: "*"
        - Effect: Allow
          Action:
            - kms:DescribeKey
            - kms:ListKeys
            - kms:ScheduleKeyDeletion
          Resource: "*"
        - Effect: Allow
          Action:
            - lambda:DeleteFunction
            - lambda:ListFunctions
          Resource: "*"
        - Effect: Allow
          Action:
            - logs:DeleteLogGroup
            - logs:DescribeLogGroups
          Resource: "*"
        - Effect: Allow
          Action:
            - redshift:DeleteCluster
            - redshift:DeleteClusterSnapshot
            - redshift:DescribeClusterSnapshots
            - redshift:DescribeClusters
          Resource: "*"
        - Effect: Allow
          Action:
            - rds:DeleteDBCluster
            - rds:DeleteDBClusterSnapshot
            - rds:DeleteDBInstance
            - rds:DeleteDBSnapshot
            - rds:DescribeDBClusters
            - rds:DescribeDBClusterSnapshots
            - rds:DescribeDBInstances
            - rds:DescribeDBSnapshots
            - rds:ModifyDBCluster
            - rds:ModifyDBInstance
          Resource: "*"
        - Effect: Allow
          Action:
            - s3:Delete*
            - s3:Get*
            - s3:List*
            - s3:Put*
          Resource: "*"
        - Effect: Allow
          Action:
            - sagemaker:DeleteApp
            - sagemaker:DeleteEndpoint
            - sagemaker:DeleteNotebookInstance
            - sagemaker:ListApps
            - sagemaker:ListEndpoints
            - sagemaker:ListNotebookInstances
            - sagemaker:StopNotebookInstance
          Resource: "*"
        - Effect: Allow
          Action:
            - sts:GetCallerIdentity
          Resource: "*"
        - Effect: Allow
          Action:
            - transfer:DeleteServer
            - transfer:ListServers
          Resource: "*"
  tracing:
    apiGateway: true
    lambda: true

package:
  individually: true
  patterns:
    - "!node_modules/**"

functions:
  AutoCleanup:
    handler: src/main.lambda_handler
    name: ${self:service}-${self:provider.stage}
    description: Removes unused AWS resources based on time of creation
    memorySize: 512
    timeout: 900
    maximumRetryAttempts: 0
    package:
      patterns:
        - "!**"
        - "src/**"
    layers:
      - Ref: PythonRequirementsLambdaLayer
    environment:
      LOG_LEVEL: ${self:custom.log_level}
      EXECUTION_LOG_BUCKET:
        Ref: ExecutionLogBucket
      SETTINGS_TABLE:
        Ref: SettingsTable
      ALLOWLIST_TABLE:
        Ref: AllowlistTable
    events:
      - schedule:
          rate: rate(3 days)
          enabled: true

resources:
  Resources:
    SettingsTable:
      Type: AWS::DynamoDB::Table
      Properties:
        TableName: ${self:service}-${self:provider.stage}-settings
        AttributeDefinitions:
          - AttributeName: key
            AttributeType: S
        KeySchema:
          - AttributeName: key
            KeyType: HASH
        BillingMode: PAY_PER_REQUEST
        PointInTimeRecoverySpecification:
          PointInTimeRecoveryEnabled: true
    AllowlistTable:
      Type: AWS::DynamoDB::Table
      Properties:
        TableName: ${self:service}-${self:provider.stage}-allowlist
        AttributeDefinitions:
          - AttributeName: resource_id
            AttributeType: S
        KeySchema:
          - AttributeName: resource_id
            KeyType: HASH
        TimeToLiveSpecification:
          AttributeName: expiration
          Enabled: true
        BillingMode: PAY_PER_REQUEST
        PointInTimeRecoverySpecification:
          PointInTimeRecoveryEnabled: true
    ExecutionLogBucket:
      Type: AWS::S3::Bucket
      DeletionPolicy: Retain
      Properties:
        BucketName: !Sub ${self:service}-${self:provider.stage}-execution-log-${AWS::AccountId}
        AccessControl: Private
        BucketEncryption:
          ServerSideEncryptionConfiguration:
            - ServerSideEncryptionByDefault:
                SSEAlgorithm: AES256
    AthenaResultsBucket:
      Type: AWS::S3::Bucket
      DeletionPolicy: Retain
      Properties:
        BucketName: !Sub ${self:service}-${self:provider.stage}-athena-results-${AWS::AccountId}
        AccessControl: Private
        BucketEncryption:
          ServerSideEncryptionConfiguration:
            - ServerSideEncryptionByDefault:
                SSEAlgorithm: AES256
        LifecycleConfiguration:
          Rules:
            - Id: DeleteAfter7Days
              Status: "Enabled"
              ExpirationInDays: 7
    AutoCleanupDatabase:
      Type: "AWS::Glue::Database"
      Properties:
        DatabaseInput:
          Name: ${self:service}-${self:provider.stage}
        CatalogId: !Ref AWS::AccountId
    ExecutionLogTable:
      Type: AWS::Glue::Table
      Properties:
        CatalogId: !Ref AWS::AccountId
        DatabaseName: !Ref AutoCleanupDatabase
        TableInput:
          Name: execution_log
          StorageDescriptor:
            Columns:
              - Name: platform
                Type: string
              - Name: region
                Type: string
              - Name: service
                Type: string
              - Name: resource
                Type: string
              - Name: resource_id
                Type: string
              - Name: action
                Type: string
              - Name: timestamp
                Type: timestamp
              - Name: dry_run_flag
                Type: boolean
              - Name: execution_id
                Type: string
            Compressed: False
            Location: !Join ["", ["s3://", !Ref ExecutionLogBucket, "/"]]
            InputFormat: org.apache.hadoop.mapred.TextInputFormat
            OutputFormat: org.apache.hadoop.hive.ql.io.IgnoreKeyTextOutputFormat
            SerdeInfo:
              SerializationLibrary: org.apache.hadoop.hive.serde2.lazy.LazySimpleSerDe
              Parameters:
                field.delim: ","
          Parameters:
            delimiter: ","
            classification: csv
            "skip.header.line.count": 1
            has_encrypted_data: true
  Outputs:
    ExecutionLogBucketName:
      Value:
        Ref: ExecutionLogBucket
    SettingsTableName:
      Value:
        Ref: SettingsTable
    AllowlistTableName:
      Value:
        Ref: AllowlistTable

plugins:
  - serverless-python-requirements