serverless.example.yml

service: cidr-house-rules

plugins:
  - serverless-aws-documentation
  - serverless-plugin-aws-alerts

custom:
  alerts:
    stages:
      - production
    topics:
      alarm:
        topic: ${self:service}-${opt:stage}-alerts-alarm
        notifications:
          - protocol: email
            endpoint: name@domain.com # Change this to your email address
    definitions:
      functionErrors:
        threshold: 5
    alarms:
      - functionErrors
      - functionThrottles
  documentation:
    info:
      version: "1"
      title: "cidr-house-rules"
      description: "A lightweight API to expose important AWS resource information across multiple accounts in near-realtime
"
      termsOfService: ""
      contact:
        name: "Silver Mullet"
        url: "https://github.com/silvermullet/cidr-house-rules/Readme.md"
        email: ""

provider:
  name: aws
  runtime: python3.6
  region: us-west-2
  apiKeys:
    - my_api_key
  timeout: 300
  stackTags:
    Product: cidr-house-rules
    Owner:
    Team: dataplatform
  environment:
    DYNAMODB_TABLE_CIDRS: ${self:service}-${opt:stage, self:provider.stage}-cidrs
    DYNAMODB_TABLE_ACCOUNTS: ${self:service}-${opt:stage, self:provider.stage}-accounts
    DYNAMODB_TABLE_NAT_GATEWAYS: ${self:service}-${opt:stage, self:provider.stage}-nat-gateways
    DYNAMODB_TABLE_EIP: ${self:service}-${opt:stage, self:provider.stage}-eip
    DYNAMODB_TABLE_ELB: ${self:service}-${opt:stage, self:provider.stage}-elb
    DYNAMODB_TABLE_AVAILABLE_IPS: ${self:service}-${opt:stage, self:provider.stage}-available-ips
    DYNAMODB_TABLE_ENDPOINT_SERVICES: ${self:service}-${opt:stage, self:provider.stage}-endpoint-services
    ENV: ${opt:stage, self:provider.stage}
  iamRoleStatements:
    - Effect: Allow
      Action: lambda:InvokeFunction
      Resource: "*"
    - Effect: Allow
      Action: sts:AssumeRole
      Resource:
        - "arn:aws:iam::<add_remote_account_number_here>:role/role_cidr_house"
        - "arn:aws:iam::<add_another_remote_account_number_here>:role/role_cidr_house"
        - "arn:aws:iam::<and_add_another_remote_account_number_here>:role/role_cidr_house"
    - Effect: Allow
      Action:
        - dynamodb:Query
        - dynamodb:Scan
        - dynamodb:GetItem
        - dynamodb:PutItem
        - dynamodb:UpdateItem
        - dynamodb:DeleteItem
      Resource:
        - "arn:aws:dynamodb:${opt:region, self:provider.region}:*:table/${self:provider.environment.DYNAMODB_TABLE_CIDRS}"
        - "arn:aws:dynamodb:${opt:region, self:provider.region}:*:table/${self:provider.environment.DYNAMODB_TABLE_ACCOUNTS}"
        - "arn:aws:dynamodb:${opt:region, self:provider.region}:*:table/${self:provider.environment.DYNAMODB_TABLE_NAT_GATEWAYS}"
        - "arn:aws:dynamodb:${opt:region, self:provider.region}:*:table/${self:provider.environment.DYNAMODB_TABLE_EIP}"
        - "arn:aws:dynamodb:${opt:region, self:provider.region}:*:table/${self:provider.environment.DYNAMODB_TABLE_ELB}"
        - "arn:aws:dynamodb:${opt:region, self:provider.region}:*:table/${self:provider.environment.DYNAMODB_TABLE_AVAILABLE_IPS}"
        - "arn:aws:dynamodb:${opt:region, self:provider.region}:*:table/${self:provider.environment.DYNAMODB_TABLE_ENDPOINT_SERVICES}"
    - Effect: Allow
      Action:
        - ec2:Describe*
      Resource:
        - "*"

functions:
  runner-available_ips:
    handler: runner.runner
    environment:
      run: cidr-house-rules-${opt:stage, self:provider.stage}-available_ips
    events:
      - schedule:
          rate: cron(0,30 * * * ? *)
  runner-import_cidrs:
    handler: runner.runner
    environment:
      run: cidr-house-rules-${opt:stage, self:provider.stage}-import_cidrs
    events:
      - schedule:
          rate: cron(5,35 * * * ? *)
  runner-import_nat_gateways:
    handler: runner.runner
    environment:
      run: cidr-house-rules-${opt:stage, self:provider.stage}-import_nat_gateways
    events:
      - schedule:
          rate: cron(8,38 * * * ? *)
  runner-import_eips:
    handler: runner.runner
    environment:
      run: cidr-house-rules-${opt:stage, self:provider.stage}-import_eips
    events:
      - schedule:
          rate: cron(10,40 * * * ? *)
  runner-import_elbs_classic:
    handler: runner.runner
    environment:
      run: cidr-house-rules-${opt:stage, self:provider.stage}-import_elbs_classic
    events:
      - schedule:
          rate: cron(12,42 * * * ? *)
  runner-import_elbsv2:
    handler: runner.runner
    environment:
      run: cidr-house-rules-${opt:stage, self:provider.stage}-import_elbsv2
    events:
      - schedule:
          rate: cron(14,44 * * * ? *)
  runner-import_endpoint_services:
    handler: runner.runner
    environment:
      run: cidr-house-rules-${opt:stage, self:provider.stage}-import_endpoint_services
    events:
      - schedule:
          rate: cron(16,47 * * * ? *)
  import_cidrs:
    handler: import_cidrs.import_cidrs
    memorySize: 128
    environment:
      ttl_expire_time: 172800
  available_ips:
    handler: available_ips.available_ips
    memorySize: 128
    environment:
      ttl_expire_time: 172800
  import_nat_gateways:
    handler: import_nat_gateways.import_nat_gateways
    memorySize: 128
    environment:
      ttl_expire_time: 172800
  import_eips:
    handler: import_eips.import_eips
    memorySize: 128
    environment:
      ttl_expire_time: 172800
  import_elbs_classic:
    handler: import_elbs_classic.import_elbs
    memorySize: 128
    environment:
      ttl_expire_time: 172800
  import_elbsv2:
    handler: import_elbsv2.import_elbs
    memorySize: 128
    environment:
      ttl_expire_time: 172800
    events:
     - schedule: rate(1 hour)
  import_endpoint_services:
    handler: import_endpoint_services.import_endpoint_services
    memorySize: 128
    environment:
      ttl_expire_time: 172800
  check_conflict:
    handler: api_handlers.check_conflict
    events:
      - http:
          path: check_conflict
          method: get
          private: true
          documentation:
            summary: "Check input CIDR for conflicts with existing CIDRs"
            description: "Check input CIDR for conflicts with existing CIDRs"
            tags:
              - "vpc"
              - "networking"
              - "ec2:Describe"
            requestBody:
              description: "Empty body"
            requestHeaders:
              -
                name: "X-Api-Key"
                description: "Requires an active API key for accessing this function"
            queryParams:
              -
                name: "cidr"
                description: "provide the cidr block to check for conflicts against, ie 10.16.0.0/16"
            methodResponses:
              -
                statusCode: "200"
                responseBody:
                  description: "*** Warning, Range overlaps with another in organization *** OR OK, no CIDR conflicts"
  add_account:
    handler: api_handlers.add_account
    events:
      - http:
          path: add_account
          method: get
          private: true
          documentation:
            summary: "Add a new AWS Account to cidr-house-rules service"
            description: "This will add a new account number and alias name to DynamoDB accounts table"
            tags:
              - "accounts"
            requestBody:
              description: "Empty body"
            requestHeaders:
              -
                name: "X-Api-Key"
                description: "Requires an active API key for accessing this function"
            queryParams:
              -
                name: "account"
                description: "provide the AWS account number"
              -
                name: "team"
                description: "provide the AWS account alias name"
            methodResponses:
              -
                statusCode: "200"
                responseBody:
                  description: "OK"
              -
                statusCode: "422"
                responseBody:
                  description: "Invalid input"
  get_nat_gateways_for_all:
    handler: api_handlers.get_nat_gateways_for_all
    events:
      - http:
          path: get_nat_gateways_for_all
          method: get
          private: true
          documentation:
            summary: "Return NAT Gateways for all teams"
            requestBody:
              description: "Empty body"
            requestHeaders:
              -
                name: "X-Api-Key"
                description: "Requires an active API key for accessing this function"
            queryParams:
              -
                name: "results_per_page"
                description: "provide the AWS account number, optional, used if page queyer is specified"
              -
                name: "page"
                description: "provide the AWS account number, optional, default will return all results in one page"
  get_number_of_nat_gateway_pages:
    handler: api_handlers.get_number_of_nat_gateway_pages
    events:
      - http:
          path: get_number_of_nat_gateway_pages
          method: get
          private: true
          documentation:
            summary: "Get the number of pages of NAT gateways with given number of results"
            requestBody:
              description: "Empty body"
            requestHeaders:
              -
                name: "X-Api-Key"
                description: "Requires an active API key for accessing this function"
            queryParams:
              -
                name: "results_per_page"
                description: "provide the AWS account number"
  get_nat_gateways_for_team:
    handler: api_handlers.get_nat_gateways_for_team
    events:
      - http:
          path: get_nat_gateways_for_team
          method: get
          private: true
  get_eips_for_team:
    handler: api_handlers.get_eips_for_team
    events:
      - http:
          path: get_eips_for_team
          method: get
          private: true
  get_elbs_for_all:
    handler: api_handlers.get_elbs_for_all
    events:
      - http:
          path: get_elbs_for_all
          method: get
          private: true
  get_service_endpoints_for_all:
    handler: api_handlers.get_service_endpoints_for_all
    events:
      - http:
          path: get_service_endpoints_for_all
          method: get
          private: true
  get_service_endpoint_for_nlb:
    handler: api_handlers.get_service_endpoint_for_nlb
    events:
      - http:
          path: get_service_endpoint_for_nlb
          method: get
          private: true

resources:
  Resources:
    CIDRDynamoDbTable:
      Type: 'AWS::DynamoDB::Table'
      DeletionPolicy: Delete
      Properties:
        AttributeDefinitions:
          -
            AttributeName: id
            AttributeType: S
        KeySchema:
          -
            AttributeName: id
            KeyType: HASH
        TimeToLiveSpecification:
          Enabled: true
          AttributeName: 'ttl'
        ProvisionedThroughput:
          ReadCapacityUnits: 1
          WriteCapacityUnits: 5
        TableName: '${self:provider.environment.DYNAMODB_TABLE_CIDRS}'
    AccountsDynamoDbTable:
      Type: 'AWS::DynamoDB::Table'
      DeletionPolicy: Delete
      Properties:
        AttributeDefinitions:
          -
            AttributeName: id
            AttributeType: S
        KeySchema:
          -
            AttributeName: id
            KeyType: HASH
        ProvisionedThroughput:
          ReadCapacityUnits: 1
          WriteCapacityUnits: 5
        TableName: '${self:provider.environment.DYNAMODB_TABLE_ACCOUNTS}'
    NatGatewaysDynamoDbTable:
      Type: 'AWS::DynamoDB::Table'
      DeletionPolicy: Delete
      Properties:
        AttributeDefinitions:
          -
            AttributeName: id
            AttributeType: S
        KeySchema:
          -
            AttributeName: id
            KeyType: HASH
        TimeToLiveSpecification:
          Enabled: true
          AttributeName: 'ttl'
        ProvisionedThroughput:
          ReadCapacityUnits: 3
          WriteCapacityUnits: 5
        TableName: '${self:provider.environment.DYNAMODB_TABLE_NAT_GATEWAYS}'
    EIPDynamoDbTable:
      Type: 'AWS::DynamoDB::Table'
      DeletionPolicy: Delete
      Properties:
        AttributeDefinitions:
          -
            AttributeName: id
            AttributeType: S
        KeySchema:
          -
            AttributeName: id
            KeyType: HASH
        TimeToLiveSpecification:
          Enabled: true
          AttributeName: 'ttl'
        ProvisionedThroughput:
          ReadCapacityUnits: 3
          WriteCapacityUnits: 5
        TableName: '${self:provider.environment.DYNAMODB_TABLE_EIP}'
    ELBDynamoDbTable:
      Type: 'AWS::DynamoDB::Table'
      DeletionPolicy: Delete
      Properties:
        AttributeDefinitions:
          -
            AttributeName: id
            AttributeType: S
        KeySchema:
          -
            AttributeName: id
            KeyType: HASH
        TimeToLiveSpecification:
          Enabled: true
          AttributeName: 'ttl'
        ProvisionedThroughput:
          ReadCapacityUnits: 3
          WriteCapacityUnits: 5
        TableName: '${self:provider.environment.DYNAMODB_TABLE_ELB}'
    AvailableIPsDynamoDbTable:
      Type: 'AWS::DynamoDB::Table'
      DeletionPolicy: Delete
      Properties:
        AttributeDefinitions:
          -
            AttributeName: id
            AttributeType: S
        KeySchema:
          -
            AttributeName: id
            KeyType: HASH
        TimeToLiveSpecification:
          Enabled: true
          AttributeName: 'ttl'
        ProvisionedThroughput:
          ReadCapacityUnits: 3
          WriteCapacityUnits: 5
        TableName: '${self:provider.environment.DYNAMODB_TABLE_AVAILABLE_IPS}'
    EndpointServicesDynamoDbTable:
      Type: 'AWS::DynamoDB::Table'
      DeletionPolicy: Delete
      Properties:
        AttributeDefinitions:
          -
            AttributeName: id
            AttributeType: S
        KeySchema:
          -
            AttributeName: id
            KeyType: HASH
        TimeToLiveSpecification:
          Enabled: true
          AttributeName: 'ttl'
        ProvisionedThroughput:
          ReadCapacityUnits: 1
          WriteCapacityUnits: 5
        TableName: '${self:provider.environment.DYNAMODB_TABLE_ENDPOINT_SERVICES}'