serverless.yml

service: red-x

plugins:
  - serverless-python-requirements

package:
  exclude:
    - node_modules/**
    - env/**
    - requirements/**

provider:
  name: aws
  runtime: python3.6
  memorySize: 128

  custom:
    defaultAdmin: root
    kmsAdminName: ${env:AWS_KMS_ADMIN_ROLE, self:provider.custom.defaultAdmin}

  stage: prd
  region: us-east-1
  iamRoleStatements:
    - Effect: "Allow"
      Action:
        - "s3:ListBucket"
      Resource: { "Fn::Join" : ["", ["arn:aws:s3:::", { "Ref" : "ServerlessDeploymentBucket" } ] ]  }
    - Effect: "Allow"
      Action:
        - "s3:PutObject"
      Resource:
        Fn::Join:
          - ""
          - - "arn:aws:s3:::"
            - "Ref" : "ServerlessDeploymentBucket"
            - "/*"
    - Effect: "Allow"
      Action:
        - "route53:ListResourceRecordSets"
      Resource: "*"
    - Effect: "Allow"
      Action:
        - "ssm:DescribeParameters"
      Resource: { "Fn::Join" : ["", [ "arn:aws:ssm", ":", { Ref: "AWS::Region" }, ":", { Ref: "AWS::AccountId" }, ":parameter/*" ] ] }
    - Effect: "Allow"
      Action:
        - "ssm:GetParameters"
        - "ssm:GetParametersByPath"
      Resource: { "Fn::Join" : ["", [ "arn:aws:ssm", ":", { Ref: "AWS::Region" }, ":", { Ref: "AWS::AccountId" }, ":parameter/red-x/*" ] ] }
    - Effect: "Allow"
      Action:
        - "kms:decrypt"
      Resource: { "Fn::GetAtt": ["redXKey", "Arn"] }
    - Effect: "Allow"
      Action:
        - "sns:Publish"
      Resource: { "Ref": "redxTopic" }

functions:
  check_delegations:
    handler: check_delegations.handler
    timeout: 60
    events:
      - schedule: cron(0 10 * * ? *)
  check_abandoned_records:
    handler: check_abandoned_records.handler
    timeout: 60
    events:
      - schedule: cron(0 10 * * ? *)

resources:
  Resources:
    redxTopic:
      Type: AWS::SNS::Topic
      Properties:
        DisplayName: Red-X
        TopicName: Red-X-Errors
    redXKeyAlias:
      Type: AWS::KMS::Alias
      Properties:
        AliasName: 'alias/red-x/settings'
        TargetKeyId: { Ref: "redXKey" }
    redXKey:
      Type: AWS::KMS::Key
      Properties:
        Description: For encrypting SSM Paramaters used by Red-X
        Enabled: true
        EnableKeyRotation: true
        KeyPolicy:
          Version: "2012-10-17"
          Id: 'red-x-key-policy'
          Statement:
            -
              Sid: "allow-account-owner-admin"
              Effect: Allow
              Principal:
                AWS: { "Fn::Join" : ["", [ "arn:aws:iam:", ":", { Ref: "AWS::AccountId" }, ":root" ] ] }
              Action:
                - "kms:*"
              Resource: "*"
            -
              Sid: "allow-admin-access"
              Effect: Allow
              Principal:
                AWS: { "Fn::Join" : ["", [ "arn:aws:iam:", ":", { Ref: "AWS::AccountId" }, ":${self:provider.custom.kmsAdminName}" ] ] }
              Action:
                - "kms:Create*"
                - "kms:Describe*"
                - "kms:Enable*"
                - "kms:List*"
                - "kms:Put*"
                - "kms:Update*"
                - "kms:Revoke*"
                - "kms:Disable*"
                - "kms:Get*"
                - "kms:Delete*"
                - "kms:TagResource"
                - "kms:UntagResource"
                - "kms:ScheduleKeyDeletion"
                - "kms:CancelKeyDeletion"
              Resource: "*"
            -
              Sid: "allow-ssm-use"
              Effect: Allow
              Principal:
                AWS: "*"
              Action:
                - kms:Encrypt
                - kms:Decrypt
                - kms:ReEncrypt
                - kms:GenerateDataKey
                - kms:DescribeKey
              Resource: "*"
              Condition:
                StringEquals:
                  "kms:CallerAccount": { Ref: "AWS::AccountId" }
                  "kms:ViaService": { "Fn::Join" : ["", [ "ssm.", { Ref: "AWS::Region" }, ".amazonaws.com" ]]}