serverless.yml

service: ${self:custom.serviceName}

custom:
  setupFile: ./setup.${self:provider.stage}.json
  serviceName: ${file(${self:custom.setupFile}):serviceName}
  rulesBucket: ${self:custom.serviceName}-${file(${self:custom.setupFile}):rulesBucket}
  rulesFile: ${file(${self:custom.setupFile}):rulesFile}
  regexpFile: ${file(${self:custom.setupFile}):regexpFile}
  regexpFileTTL: ${file(${self:custom.setupFile}):regexpFileTTL}
  minTTL: ${file(${self:custom.setupFile}):cloudfront-minTTL}
  maxTTL: ${file(${self:custom.setupFile}):cloudfront-maxTTL}
  defaultTTL: ${file(${self:custom.setupFile}):cloudfront-defaultTTL}
  apiKey: ${file(${self:custom.setupFile}):api-key}
  fakeOrigin: ${file(${self:custom.setupFile}):fakeOrigin}
  distributionId: ${file(${self:custom.setupFile}):distributionId}
  #R53HostedZone: ${file(${self:custom.setupFile}):R53HostedZone}
  
  s3Sync:
    - bucketName: ${self:custom.rulesBucket} 
      localDir: ${file(${self:custom.setupFile}):rulesBucket}
      deleteRemoved: true

  #cfdDomain:
  #  domainNames:
  #    - "*.labs.xxxx.es"
  #  cloudFront: CloudFrontDistribution
  #  retries: 15
  #  minimumProtocolVersion: TLSv1.2_2018

plugins:
  - '@silvermine/serverless-plugin-cloudfront-lambda-edge'
  - serverless-s3-sync
#  - serverless-cloudfront-distribution-certificate

package:
   patterns:
      - '!node_modules/**'

provider:
  name: aws
  runtime: nodejs18.x
  stage: ${opt:stage, 'demo'}
  region: ${env:region, 'us-east-1'}
  memorySize: 128
  timeout: 5
  stackTags:
    name: ${self:service}
  iam:
    role:
      statements:
        - Effect: 'Allow'
          Action:
            - 's3:*'
          Resource: "*"
        - Effect: 'Allow'
          Action: sts:AssumeRole
          Resource: "*"
        - Effect: 'Allow'
          Action: cloudfront:CreateInvalidation
          Resource: "*"

functions:
  invalidate:
    handler: functions/cf-invalidate/index.handler
    lambdaAtEdge:
        distribution: 'CloudFrontDistribution'
        eventType: 'origin-request'
        pathPattern: '/invalidate*'
  http-redirect:
    handler: functions/query/index.handler
    lambdaAtEdge:
        distribution: 'CloudFrontDistribution'
        eventType: 'origin-request'

resources:
   Resources:
    RulesData:
      Type: AWS::S3::Bucket
      Properties:
        BucketName: ${self:custom.rulesBucket}

    IamRoleLambdaExecution:
      Type: AWS::IAM::Role
      Properties:
        AssumeRolePolicyDocument:
          Statement:
            - Effect: Allow
              Principal:
                Service:
                  - lambda.amazonaws.com
                  - edgelambda.amazonaws.com

    # RouteDNSName:
    #   Type: AWS::Route53::RecordSetGroup
    #   Properties:
    #     HostedZoneId: ${self:custom.R53HostedZone}
    #     RecordSets:
    #       - Name: 'drivemonitor.itlabs.uoc.es'
    #         Type: CNAME
    #         AliasTarget:
    #             HostedZoneId: ${self:custom.R53HostedZone}
    #             DNSName: !GetAtt [CloudFrontDistribution, DomainName]
    #             EvaluateTargetHealth: false
    #       - Name: 'redirect.itlabs.uoc.es'
    #         Type: CNAME
    #         AliasTarget:
    #             HostedZoneId: ${self:custom.R53HostedZone}
    #             DNSName: !GetAtt [CloudFrontDistribution, DomainName]
    #             EvaluateTargetHealth: false

    CloudFrontDistribution:
      Type: AWS::CloudFront::Distribution
      Properties:
        DistributionConfig:
          #Aliases:
          #  - 'redirect.labs.xxxx.es'
          #  - 'domain.labs.xxxx.es'
          Comment: ${self:custom.serviceName}

          CacheBehaviors:
            - TargetOriginId: ${self:custom.serviceName}
              ViewerProtocolPolicy: 'redirect-to-https'
              DefaultTTL: 0
              MaxTTL: 0
              MinTTL: 0
              ForwardedValues:
                QueryString: false
              AllowedMethods:
                - GET
                - HEAD
                - OPTIONS
                - PUT
                - POST
                - PATCH
                - DELETE
              PathPattern: '/sign*'

            - TargetOriginId: ${self:custom.serviceName}
              ViewerProtocolPolicy: 'redirect-to-https'
              DefaultTTL: 0
              MaxTTL: 0
              MinTTL: 0
              ForwardedValues:
                QueryString: false
                Headers:
                  - x-api-key
                  - invalidatePath

              AllowedMethods:
                - GET
                - HEAD
                - OPTIONS
                - PUT
                - POST
                - PATCH
                - DELETE
              PathPattern: '/invalidate*'

          DefaultCacheBehavior:
            TargetOriginId: ${self:custom.serviceName}
            ViewerProtocolPolicy: 'redirect-to-https'
            DefaultTTL: ${self:custom.defaultTTL}
            MaxTTL: ${self:custom.maxTTL}
            MinTTL: ${self:custom.minTTL}
            ForwardedValues:
              QueryString: false
              Headers:
                - Host
            AllowedMethods:
              - GET
              - HEAD
              - OPTIONS
              - PUT
              - POST
              - PATCH
              - DELETE

          Enabled: true
          
          Origins:
            - Id: ${self:custom.serviceName}
              DomainName: ${self:custom.fakeOrigin}
              CustomOriginConfig:
                OriginProtocolPolicy: 'https-only'
              OriginCustomHeaders:
                - HeaderName: 'bucket'
                  HeaderValue: ${self:custom.rulesBucket}
                - HeaderName: 'rules'
                  HeaderValue: ${self:custom.rulesFile}
                - HeaderName: 'regexp'
                  HeaderValue: ${self:custom.regexpFile}
                - HeaderName: 'role'
                  HeaderValue: { "Fn::GetAtt" : [ "IamRoleLambdaExecution", "Arn" ] }
                - HeaderName: 'api-key'
                  HeaderValue: ${self:custom.apiKey}
                - HeaderName: 'cloudfrontid'
                  HeaderValue: ${self:custom.distributionId}
                - HeaderName: 'regexpTTL'
                  HeaderValue: ${self:custom.regexpFileTTL}