-
Notifications
You must be signed in to change notification settings - Fork 1
/
Copy pathserverless.yml
123 lines (119 loc) · 3.53 KB
/
serverless.yml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
service: cloudflare-lambda
useDotenv: true
frameworkVersion: ^3.2.1
provider:
name: aws
runtime: java11
memorySize: 1024
timeout: 60
region: us-west-2
stackName: cloudflare-lambda # using a custom stack name to avoid removing and recreating the KMS key
deploymentBucket:
name: ${env:BUCKET}
serverSideEncryption: "AES256"
tracing:
lambda: true
iam:
deploymentRole: "arn:aws:iam::${env:ACCOUNT}:role/cloudformation/deployer/cloudformation-deployer"
role:
statements:
- Effect: Allow
Action:
- route53:GetHostedZone
Resource: '*'
- Effect: Allow
Action:
- logs:CreateLogStream
- logs:CreateLogGroup
Resource:
- Fn::Sub: "arn:aws:logs:${AWS::Region}:${env:ACCOUNT}:log-group:/aws/lambda/cloudflare-lambda-Function-*:*"
- Effect: Allow
Action:
- logs:PutLogEvents
Resource:
- Fn::Sub: "arn:aws:logs:${AWS::Region}:${env:ACCOUNT}:log-group:/aws/lambda/cloudflare-lambda-Function-*:*:*"
logRetentionInDays: 7
stackTags:
Creator: serverless
Environment: ${opt:stage}
Project: ${self:service}
Team: platform
Visibility: internal
package:
artifact: ${env:ARTIFACT_PATH}
functions:
Cloudflare:
handler: com.dwolla.lambda.cloudflare.Handler
resources:
Description: cloudflare-lambda lambda function and supporting resources
Resources:
Key:
Properties:
Description: Encryption key protecting secrets for the Cloudflare lambda
EnableKeyRotation: true
Enabled: true
KeyPolicy:
Statement:
- Principal:
AWS:
- Fn::Sub: arn:aws:iam::${AWS::AccountId}:role/DataEncrypter
Resource:
- "*"
Sid: AllowDataEncrypterToEncrypt
Action:
- kms:Encrypt
- kms:ReEncrypt
- kms:Describe*
- kms:Get*
- kms:List*
Effect: Allow
- Principal:
AWS:
- Fn::GetAtt:
- IamRoleLambdaExecution
- Arn
Resource:
- "*"
Sid: AllowLambdaToDecrypt
Action:
- kms:Decrypt
- kms:DescribeKey
Effect: Allow
- Principal:
AWS:
- Fn::Sub: arn:aws:iam::${AWS::AccountId}:role/cloudformation/deployer/cloudformation-deployer
Resource:
- "*"
Sid: CloudFormationDeploymentRoleOwnsKey
Action:
- kms:Create*
- kms:Describe*
- kms:Enable*
- kms:List*
- kms:Put*
- kms:Update*
- kms:Revoke*
- kms:Disable*
- kms:Get*
- kms:Delete*
- kms:ScheduleKeyDeletion
- kms:CancelKeyDeletion
Effect: Allow
Type: AWS::KMS::Key
KeyAlias:
Properties:
AliasName: alias/CloudflareKey
TargetKeyId:
Ref: Key
Type: AWS::KMS::Alias
Outputs:
CloudflareLambda:
Description: ARN of the Lambda that manages settings at Cloudflare
Value:
'Fn::GetAtt': [CloudflareLambdaFunction, Arn]
Export:
Name: CloudflareLambda
CloudflareKey:
Description: KMS Key Alias for Cloudflare lambda
Value:
Ref: KeyAlias