serverless.yml

service: thumbbuster

custom:
  transformBucketName: thumbbuster-${opt:stage, 'dev'}-transform-bucket
  uploadBucketName: thumbbuster-${opt:stage, 'dev'}-upload-bucket
  s3OriginId: transform-origin-${opt:stage, 'dev'}

provider:
  name: aws
  stage: ${opt:stage, 'dev'}
  runtime: nodejs16.x
  profile: serverless-admin
  region: us-east-2
  environment:
    TRANSFORM_BUCKET: ${self:custom.transformBucketName}
  iamRoleStatements:
    - Effect: Allow
      Action:
        - s3:GetObject
      Resource:
        - "Fn::Join":
          - ""
          - - "arn:aws:s3:::"
            - Ref: TBUploadBucket
            - "*"
    - Effect: Allow
      Action:
        - s3:PutObject
        - s3:GetObject
      Resource:
        - "Fn::Join":
          - ""
          - - "arn:aws:s3:::"
            - Ref: TBTransformBucket
            - "*"

functions:
  uploadPostImage:
    handler: handler.handlePostImage
    events:
      - s3:
          bucket: ${self:custom.uploadBucketName}
          event: s3:ObjectCreated:*
          existing: true
          rules:
            - prefix: post-image/

  uploadInlinePostImage:
    handler: handler.handleInlinePostImage
    events:
      - s3:
          bucket: ${self:custom.uploadBucketName}
          event: s3:ObjectCreated:*
          existing: true
          rules:
            - prefix: inline-post-image/

  uploadAvatarImage:
    handler: handler.handleAvatarImage
    events:
      - s3:
          bucket: ${self:custom.uploadBucketName}
          event: s3:ObjectCreated:*
          existing: true
          rules:
            - prefix: avatar-image/

resources:
  Resources:
    TBUploadBucket:
      Type: AWS::S3::Bucket
      Properties:
        BucketName: ${self:custom.uploadBucketName}
        CorsConfiguration:
          CorsRules:
            - AllowedMethods:
                - PUT
              AllowedOrigins: ${file(./config/${opt:stage, 'dev'}.json):ALLOWED_ORIGINS}
              AllowedHeaders:
                - '*'
        
    TBTransformBucket:
      Type: AWS::S3::Bucket
      Properties:
        BucketName: ${self:custom.transformBucketName}
        AccessControl: PublicRead
        CorsConfiguration:
          CorsRules:
            - AllowedMethods:
                - HEAD
              AllowedOrigins:
                - '*'
              AllowedHeaders:
                - '*'

    TBTransformBucketPolicy:
      Type: AWS::S3::BucketPolicy
      Properties:
        Bucket:
          Ref: TBTransformBucket
        PolicyDocument:
          Statement:
            - Sid: PublicReadGetObject
              Effect: Allow
              Principal: "*"
              Action:
                - "s3:GetObject"
              Resource: arn:aws:s3:::${self:custom.transformBucketName}/*

    PublicDistribution:
      Type: AWS::CloudFront::Distribution
      Properties:
        DistributionConfig:
          Enabled: "true"
          DefaultCacheBehavior:
            AllowedMethods:
            - GET
            - HEAD
            MinTTL: "0"
            MaxTTL: "0"
            DefaultTTL: "0"
            TargetOriginId: ${self:custom.s3OriginId}
            ForwardedValues:
              QueryString: 'true'
              Cookies:
                Forward: all
            ViewerProtocolPolicy: redirect-to-https
          CacheBehaviors:
          - AllowedMethods:
            - GET
            - HEAD
            TargetOriginId: ${self:custom.s3OriginId}
            ForwardedValues:
              QueryString: "false"
            ViewerProtocolPolicy: https-only
            DefaultTTL: 86400
            PathPattern: '*'
          Origins:
            - DomainName: ${self:custom.transformBucketName}.s3.${self:provider.region}.amazonaws.com
              Id: ${self:custom.s3OriginId}
              S3OriginConfig:
                OriginAccessIdentity: ''

plugins:
  - serverless-plugin-typescript