serverless.yml

service: LdapPasswordRotation

frameworkVersion: "3"

plugins:
  - serverless-prune-plugin

package:
  individually: true
  patterns:
    - "!.venv/**"
    - "!node_modules/**"
    - "!config/**"
    - "!requirements.txt"
    - "!package.json"
    - "!package-lock.json"
    - "!Makefile"
    - "!Pipfile"
    - "!Pipfile.lock"

provider:
  name: aws
  runtime: python3.9
  timeout: 30
  logRetentionInDays: 14
  stage: ${opt:stage, 'dev'}
  region: eu-central-1
  environment:
    SERVICE: ${self:service}
    STAGE: ${self:provider.stage}
    VPC_ID: ${self:custom.file.VPC_ID}
    SECRETS_MANAGER_KEY_USERNAME: ${self:custom.file.SECRETS_MANAGER_KEY_USERNAME}
    SECRETS_MANAGER_KEY_PASSWORD: ${self:custom.file.SECRETS_MANAGER_KEY_PASSWORD}
    SECRETS_MANAGER_KEY_DN: ${self:custom.file.SECRETS_MANAGER_KEY_DN}
    SECRETS_MANAGER_REGION: ${self:custom.file.SECRETS_MANAGER_REGION}
    EXCLUDE_CHARACTERS_USER: ${self:custom.file.EXCLUDE_CHARACTERS_USER}
    EXCLUDE_CHARACTERS_PW: ${self:custom.file.EXCLUDE_CHARACTERS_PW}
    EXCLUDE_CHARACTERS_NEW_PW: ${self:custom.file.EXCLUDE_CHARACTERS_NEW_PW}
    LDAP_SERVER_LIST: ${self:custom.file.LDAP_SERVER_LIST}
    LDAP_SERVER_PORT: ${self:custom.file.LDAP_SERVER_PORT}
    LDAP_BASE_DN: ${self:custom.file.LDAP_BASE_DN}
    LDAP_USER_AUTH_ATTRIBUTE: ${self:custom.file.LDAP_USER_AUTH_ATTRIBUTE}
  vpc:
    securityGroupIds:
      - Ref: LambdaSecurityGroup
    subnetIds:
      - ${self:custom.file.SUBNET1_ID}
      - ${self:custom.file.SUBNET2_ID}
  iam:
    role:
      statements:
        - Effect: "Allow"
          Resource: "*"
          Action:
            - "secretsmanager:DescribeSecret"
            - "secretsmanager:GetRandomPassword"
            - "secretsmanager:GetSecretValue"
            - "secretsmanager:PutSecretValue"
            - "secretsmanager:UpdateSecretVersionStage"

custom:
  file: ${file(./config/serverless.${self:provider.stage}.yml)}
  prune:
    automatic: true
    number: 10

layers:
  ldappw:
    path: layer
    compatibleRuntimes:
      - python3.7
      - python3.8
      - python3.9
    compatibleArchitectures:
      - x86_64
      - arm64

functions:
  app:
    handler: src.lambda_function.lambda_handler
    layers:
      - Ref: LdappwLambdaLayer
    environment:
      STAGE: ${self:provider.stage}

resources:
  Resources:
    LambdaSecurityGroup:
      Type: AWS::EC2::SecurityGroup
      Properties:
        GroupDescription: Service Lambda function
        SecurityGroupEgress:
          - IpProtocol: -1
            CidrIp: 0.0.0.0/0
        VpcId: ${self:custom.file.VPC_ID}
    SecretsManagerInvokePermission:
      Type: AWS::Lambda::Permission
      Properties:
        FunctionName: { "Fn::GetAtt": ["AppLambdaFunction", "Arn"] }
        Action: lambda:InvokeFunction
        Principal: secretsmanager.amazonaws.com