serverless.yml

service: api-extractor
frameworkVersion: '3'
useDotenv: true

provider:
  name: aws
  region: us-east-2
  runtime: python3.8
  timeout: 30

package:
  patterns:
    - '!node_modules/**'
    - '!venv/**'
    - '!.venv/**'
    - '!fake-api/**'
    - '!docs/**'
    - '!.git/**'

custom: ${file(./config.js)}

functions:
  ConfigApi:
    role: ApiConfigRol
    handler: src.api.main.handler
    layers:
      - arn:aws:lambda:us-east-2:770693421928:layer:Klayers-p38-requests:7
      - arn:aws:lambda:us-east-2:770693421928:layer:Klayers-p38-pydantic:5
    environment:
      STAGE: ${opt:stage, 'dev'}
      DEFAULT_OUTPUT_BUCKET_SUFFIX: ${env:DEFAULT_OUTPUT_BUCKET_SUFFIX, '1'}
    events:
      - httpApi:
          path: /config
          method: get
      - httpApi:
          path: /config/{id}
          method: get
      - httpApi:
          path: /config
          method: post
      - httpApi:
          path: /config/{id}
          method: put
      - httpApi:
          path: /config/{id}
          method: delete
      - httpApi:
          path: /config/{id}/history
          method: get
      - httpApi:
          path: /config/{id}/execute
          method: post
      - httpApi:
          path: /extractions/{id}/logs
          method: get
      - httpApi:
          path: /api-keys
          method: post
      - httpApi:
          path: /api-keys/{name}/refresh
          method: post
      - httpApi:
          path: /api-keys/{name}
          method: delete
  
  ApiExtractor:
    role: ExtractorRol
    handler: src.extractor.main.handler
    layers:
      - arn:aws:lambda:us-east-2:770693421928:layer:Klayers-p38-pandas:8
      - arn:aws:lambda:us-east-2:770693421928:layer:Klayers-p38-requests:7
      - arn:aws:lambda:us-east-2:770693421928:layer:Klayers-p38-pydantic:5
    environment:
      STAGE: ${opt:stage, 'dev'}
      DEFAULT_OUTPUT_BUCKET_SUFFIX: ${env:DEFAULT_OUTPUT_BUCKET_SUFFIX, '1'}
    events:
      - eventBridge:
          enabled: true
          schedule: cron(${env:EVENT_BRIDGE_SCHEDULE, '0 1 * * ? *'})

resources:
  Resources:

    ApiExtractorConfigTable:
      Type: AWS::DynamoDB::Table
      Properties:
        TableName: ApiExtractorConfig-${opt:stage, 'dev'}
        BillingMode: PAY_PER_REQUEST
        AttributeDefinitions:
          - AttributeName: id
            AttributeType: S
        KeySchema:
          - AttributeName: id
            KeyType: HASH

    ApiExtractorConfigHistoryTable:
      Type: AWS::DynamoDB::Table
      Properties:
        TableName: ApiExtractorConfigHistory-${opt:stage, 'dev'}
        BillingMode: PAY_PER_REQUEST
        AttributeDefinitions:
          - AttributeName: id
            AttributeType: S
          - AttributeName: updated_at
            AttributeType: S
        KeySchema:
          - AttributeName: id
            KeyType: HASH
          - AttributeName: updated_at
            KeyType: RANGE

    ApiExtractorExecutionLogsTable:
      Type: AWS::DynamoDB::Table
      Properties:
        TableName: ApiExtractorExecutionLogs-${opt:stage, 'dev'}
        BillingMode: PAY_PER_REQUEST
        AttributeDefinitions:
          - AttributeName: extraction_id
            AttributeType: S
          - AttributeName: created_at
            AttributeType: S
        KeySchema:
          - AttributeName: extraction_id
            KeyType: HASH
          - AttributeName: created_at
            KeyType: RANGE

    ApiConfigKeysSecret:
      Type: AWS::SecretsManager::Secret
      Properties:
        Description: "Api Keys for Api Extractor Config api"
        Name: api-extractor-config/${opt:stage, 'dev'}/apikeys
        SecretString: '{"rootkey": "${self:custom.root_api_key}"}'

    ExtractorSecret:
      Type: AWS::SecretsManager::Secret
      Properties:
        Description: "Secrets for Extractor"
        Name: api-extractor-config/${opt:stage, 'dev'}/extractor-secrets
        SecretString: '{"zoho_refresh_token": "", "zoho_client_id": "", "zoho_client_secret": ""}'

    ExtractorOutputBucket:
      Type: AWS::S3::Bucket
      Properties:
        BucketName: api-extractor-output-${opt:stage, 'dev'}-${env:DEFAULT_OUTPUT_BUCKET_SUFFIX, '1'}
       
    ApiConfigRol:
      Type: AWS::IAM::Role
      Properties:
        Path: /api-consumer/config/
        RoleName: ApiExtractorConfig-${opt:stage, 'dev'}
        AssumeRolePolicyDocument:
          Version: '2012-10-17'
          Statement:
            - Effect: Allow
              Principal:
                Service:
                  - lambda.amazonaws.com
              Action: sts:AssumeRole
        Policies:
          - PolicyName: ApiConfigPolicy-${opt:stage, 'dev'}
            PolicyDocument:
              Version: '2012-10-17'
              Statement:
                - Effect: Allow
                  Action:
                    - logs:CreateLogGroup
                    - logs:CreateLogStream
                    - logs:PutLogEvents
                  Resource:
                    - 'Fn::Join':
                      - ':'
                      -
                        - 'arn:aws:logs'
                        - Ref: 'AWS::Region'
                        - Ref: 'AWS::AccountId'
                        - 'log-group:/aws/lambda/*:*:*'
                - Effect: Allow
                  Action:
                    - dynamodb:*
                  Resource:
                    - 'Fn::GetAtt': ['ApiExtractorConfigTable', 'Arn']
                    - 'Fn::GetAtt': ['ApiExtractorConfigHistoryTable', 'Arn']
                    - 'Fn::GetAtt': ['ApiExtractorExecutionLogsTable', 'Arn']
                - Effect: Allow
                  Action:
                    - secretsmanager:*
                  Resource:
                    - Ref: 'ApiConfigKeysSecret'
                - Effect: Allow
                  Action:
                    - lambda:InvokeAsync
                    - lambda:InvokeFunction
                    - lambda:InvokeFunctionUrl
                  Resource:
                    - 'Fn::GetAtt': ['ApiExtractorLambdaFunction', 'Arn']

    ExtractorRol:
      Type: AWS::IAM::Role
      Properties:
        Path: /api-consumer/extractor/
        RoleName: ApiExtractor-${opt:stage, 'dev'}
        AssumeRolePolicyDocument:
          Version: '2012-10-17'
          Statement:
            - Effect: Allow
              Principal:
                Service:
                  - lambda.amazonaws.com
              Action: sts:AssumeRole
        Policies:
          - PolicyName: ApiExtractorPolicy-${opt:stage, 'dev'}
            PolicyDocument:
              Version: '2012-10-17'
              Statement:
                - Effect: Allow
                  Action:
                    - logs:CreateLogGroup
                    - logs:CreateLogStream
                    - logs:PutLogEvents
                  Resource:
                    - 'Fn::Join':
                      - ':'
                      -
                        - 'arn:aws:logs'
                        - Ref: 'AWS::Region'
                        - Ref: 'AWS::AccountId'
                        - 'log-group:/aws/lambda/*:*:*'
                - Effect: Allow
                  Action:
                    - secretsmanager:*
                  Resource:
                    - Ref: 'ApiConfigKeysSecret'
                    - Ref: 'ExtractorSecret'
                - Effect: Allow
                  Action:
                    - dynamodb:*
                  Resource:
                    - 'Fn::GetAtt': ['ApiExtractorExecutionLogsTable', 'Arn']
                    - 'Fn::GetAtt': ['ApiExtractorConfigTable', 'Arn']
                - Effect: Allow
                  Action:
                    - s3:*
                  Resource:
                    - 'Fn::Join':
                      - '/'
                      - 
                        - 'Fn::GetAtt': ['ExtractorOutputBucket', 'Arn']
                        - '*'

  Outputs:
    RootApiKey:
      Value: '${self:custom.root_api_key}'