serverless.yaml

frameworkVersion: ">=3.38.0 <4.0.0"

service: okdata-permission-api

provider:
  name: aws
  ecr:
    images:
      okdata-permission-api:
        path: ./
        platform: linux/amd64
  memorySize: 1024
  region: eu-west-1
  endpointType: REGIONAL
  stage: ${opt:stage, 'dev'}
  deploymentBucket:
    name: ${self:custom.deploymentBucket.${self:provider.stage}, self:custom.deploymentBucket.dev}
    serverSideEncryption: AES256
  deploymentPrefix: deploy
  logRetentionInDays: 90
  tracing:
    apiGateway: true
    lambda: true
  iam:
    role:
      permissionsBoundary: "arn:aws:iam::${aws:accountId}:policy/oslokommune/oslokommune-boundary"
      managedPolicies:
        - "arn:aws:iam::${aws:accountId}:policy/okdata-permission-api"
        - "arn:aws:iam::aws:policy/AWSXRayDaemonWriteAccess"
  tags:
    GIT_REV: ${git:branch}:${git:sha1}
    VERSION: ${self:custom.version}
  environment:
    GIT_REV: ${git:branch}:${git:sha1}
    STAGE: ${self:provider.stage}
    VERSION: ${self:custom.version}
    SERVICE_NAME: ${self:service}
    KEYCLOAK_REALM: api-catalog
    KEYCLOAK_SERVER: ${ssm:/dataplatform/shared/keycloak-server-url}
    KEYCLOAK_TEAM_ADMIN_SERVER: ${ssm:/dataplatform/teams-api/kong-keycloak-server-url}
    KEYCLOAK_TEAM_ADMIN_USERNAME: ${self:custom.teamAdminUsername.${self:provider.stage}, self:custom.teamAdminUsername.dev}
    CLIENT_ID: okdata-permission-api
    RESOURCE_SERVER_CLIENT_ID: okdata-resource-server
    ROOT_PATH: "/okdata-permission-api"
    LOG_LEVEL: INFO
    BACKUP_BUCKET_NAME: ${self:custom.backupBucket.${self:provider.stage}, self:custom.backupBucket.dev}

package:
  patterns:
    - '!**/*'
    - app.py
    - jobs/*.py
    - dataplatform_keycloak/*.py
    - handler.py
    - models/*.py
    - resources/*.py
    - webhook_tokens/*.py

functions:
  app:
    image:
      name: okdata-permission-api
      command:
        - handler.handler
    events:
      - http: ANY /
      - http: ANY /{any+}
    timeout: 29
  backup-permissions:
    image:
      name: okdata-permission-api
      command:
        - jobs.backup.backup_permissions
    events:
      - schedule: cron(0 0 * * ? *)
    timeout: 60
  check-users:
    image:
      name: okdata-permission-api
      command:
        - jobs.monitor.check_users
    events:
      - schedule: cron(0 1 * * ? *)
    timeout: 60

plugins:
  - serverless-better-credentials # must be first
  - serverless-plugin-git-variables
  - serverless-prune-plugin

resources:
  Description: |
    ${self:service} ${git:branch}:${git:sha1}
    ${git:message}

custom:
  version: 0.2.0
  prune:
    automatic: true
    number: 3
  exportGitVariables: false
  deploymentBucket:
    prod: ok-origo-dataplatform-config-prod
    dev: ok-origo-dataplatform-config-dev
  backupBucket:
    prod: ok-origo-dataplatform-backup-prod
    dev: ok-origo-dataplatform-backup-dev
  teamAdminUsername:
    prod: teams-admin
    dev: api-catalog-team-admin