serverless.yml

org: johnbelisle
app: serverless-ddns
service: serverless-ddns 

# You can pin your service to only deploy with a specific Serverless version
# Check out our docs for more details
# frameworkVersion: "=X.X.X"

provider:
  name: aws
  runtime: nodejs12.x
  stage: ${opt:stage, 'dev'}
  region: us-east-1
  logs:
    restApi: true
  tracing:
    apiGateway: true
    lambda: true


custom:
  config: ${file(config.${self:provider.stage}.json)} 
  customDomain:
    domainName: ${self:custom.config.apiDomainName}
    # stage: 
    # basePath: api
    certificateName: '${self:custom.config.apiDomainName}'
    createRoute53Record: true
    endpointType: 'edge'  

plugins:
  - serverless-domain-manager

functions:
  echo-ip:
    handler: src/echoip.handler
    role: basicLambdaRole
    memorySize: 128
    events:
      - http:
          path: /
          method: GET
  update-home-dns:
    handler: src/updateHomeDNS.handler
    role: lambdaUpdateRoute53Role
    memorySize: 128
    environment:
      DNS_HOST_NAME: ${self:custom.config.ddnsHostName}
      TOPIC_ARN: ${self:custom.config.notificationTopicARN}
    events:      
      - http:
          path: /      
          method: POST
          authorizer:
            type: aws_iam                     
resources:
  Resources:    
    basicLambdaRole:
      Type: AWS::IAM::Role
      Properties:
        RoleName: BasicLambdaRoleServerlessDDNS-${self:provider.stage}
        AssumeRolePolicyDocument:
          Version: '2012-10-17'
          Statement:
            - Effect: Allow
              Principal:
                Service:
                  - lambda.amazonaws.com
              Action: sts:AssumeRole        
        Policies:
          - PolicyName: BasicLambdaRoleLoggingPolicy-${self:provider.stage}
            PolicyDocument:            
              Version: '2012-10-17'
              Statement:
                - Effect: Allow
                  Action:
                    - logs:CreateLogGroup
                    - logs:CreateLogStream
                    - logs:PutLogEvents
                  Resource: { "Fn::Join" : ["", ["arn:aws:logs:",{"Ref":"AWS::Region"},":",{"Ref":"AWS::AccountId"},":log-group:/aws/lambda/*:*"]]}
                - Effect: Allow
                  Action:
                    - xray:PutTraceSegments
                  Resource:
                    - "*"                  
    lambdaUpdateRoute53Role:
      Type: AWS::IAM::Role
      Properties:
        RoleName: UpdateLambdaRoleServerlessDDNS-${self:provider.stage}
        AssumeRolePolicyDocument:
          Version: '2012-10-17'
          Statement:
            - Effect: Allow
              Principal:
                Service:
                  - lambda.amazonaws.com
              Action: sts:AssumeRole        
        Policies:
          - PolicyName: UpdateRoute53LambdaRolePolicy-${self:provider.stage}
            PolicyDocument:            
              Version: '2012-10-17'
              Statement:
                - Effect: Allow
                  Action:
                    - logs:CreateLogGroup
                    - logs:CreateLogStream
                    - logs:PutLogEvents
                  Resource: { "Fn::Join" : ["", ["arn:aws:logs:",{"Ref":"AWS::Region"},":",{"Ref":"AWS::AccountId"},":log-group:/aws/lambda/*:*"]]}
                - Effect: Allow
                  Action:
                    - route53:ListHostedZones
                    - route53:ChangeResourceRecordSets
                    - route53:ListResourceRecordSets
                  Resource:
                    - "*"
                - Effect: Allow
                  Action:
                    - sns:Publish
                    - sns:Subscribe
                  Resource: arn:aws:sns:us-east-1:197556904653:NotifyMe
                - Effect: Allow
                  Action:
                    - xray:PutTraceSegments
                  Resource:
                    - "*"
    InvokeUpdateHomeDDNSAPIPolicy:
      Type: "AWS::IAM::ManagedPolicy"
      Properties:
        Description: "Policy for allowing invoke access to the updateHomeDDNS secured API"
        PolicyDocument:
          Version: '2012-10-17'
          Statement:
            Effect: Allow
            Action: execute-api:Invoke
            Resource: { "Fn::Join" : ["", ["arn:aws:execute-api:",{"Ref":"AWS::Region"},":",{"Ref":"AWS::AccountId"},":",{"Ref":"ApiGatewayRestApi"},"/*"]]}
    APIUser:
      Type: "AWS::IAM::User"
      Properties:
        ManagedPolicyArns:
          - { "Ref": "InvokeUpdateHomeDDNSAPIPolicy" }
        UserName: update-homeddns-api-user-${self:provider.stage}    
    MockResource:
      Type: AWS::ApiGateway::Resource
      Properties:
        ParentId:
          Fn::GetAtt:
            - ApiGatewayRestApi # our default Rest API logical ID
            - RootResourceId
        PathPart: favicon.ico # the endpoint in your API that is set as proxy
        RestApiId:
          Ref: ApiGatewayRestApi
    MockMethod:
      Type: AWS::ApiGateway::Method
      Properties:
        AuthorizationType: None
        HttpMethod: GET
        ResourceId:
          Ref: MockResource
        RestApiId:
          Ref: ApiGatewayRestApi
        MethodResponses:
          - StatusCode: 200
        Integration:
          RequestTemplates:
            application/json: |
              {"statusCode": 200}
          Type: MOCK
          IntegrationResponses:
            - ResponseTemplates:
                application/json: ''
              StatusCode: 200