serverless.yml

service: serverless-event
package:
  include:
    - "lib/*"
    - "node_modules/**"
  exclude:
    - "*.mp3"
    - "test/*"
    - "src/*"
    - ".git/**"

custom:
  stage: "${opt:stage, self:provider.stage}"
  region: "${opt:region, self:provider.region}"

provider:
  name: aws
  runtime: nodejs4.3
  profile: serverless
  stage: dev
  region: eu-west-1
  environment: ${file(env.yml):${self:custom.stage}}

functions:
  receiver:
    description: Receives events from clients and place into an SQS queue.
    handler: lib/receiver.handler
    events:
      - http: POST logger

  event-manager:
    description: Checks the event queue for message depth and then invokes an appropriate number of "processors" to drain the queue.
    handler: lib/event-manager.handler
    events:
      - schedule:
          rate: rate(1 minute)
          enabled: true

  processor:
    description: Takes events out of the queue and structures them into useful JSON blobs in S3. When the update to an S3 bucket is completed it will also send an SNS message to any interested parties.
    handler: lib/processor.handler

  aggregator:
    description: Rolls up transactional entries into aggregates (including daily, monthly, user, etc).
    handler: lib/aggregator.handler
    events:
      - schedule:
          rate: rate(60 minutes)
          enabled: true

resources:
  Resources:
    # ROLES
    # -----------------------------------------------------------
    reporter:
      Type: AWS::IAM::Role
      Properties:
        RoleName: serverless-event-${self:custom.stage}-reporter
        AssumeRolePolicyDocument:
          Version: '2012-10-17'
          Statement:
            - Effect: Allow
              Principal:
                Service:
                  - lambda.amazonaws.com
              Action: sts:AssumeRole

    receiver:
      Type: AWS::IAM::Role
      Properties:
        RoleName: serverless-event-${self:custom.stage}-receiver
        AssumeRolePolicyDocument:
          Version: '2012-10-17'
          Statement:
            - Effect: Allow
              Principal:
                Service:
                  - lambda.amazonaws.com
              Action: sts:AssumeRole
    
    processor:
      Type: AWS::IAM::Role
      Properties:
        RoleName: serverless-event-${self:custom.stage}-processor
        AssumeRolePolicyDocument:
          Version: '2012-10-17'
          Statement:
            - Effect: Allow
              Principal:
                Service:
                  - lambda.amazonaws.com
              Action: sts:AssumeRole

    aggregator:
      Type: AWS::IAM::Role
      Properties:
        RoleName: serverless-event-${self:custom.stage}-aggregator
        AssumeRolePolicyDocument:
          Version: '2012-10-17'
          Statement:
            - Effect: Allow
              Principal:
                Service:
                  - lambda.amazonaws.com
              Action: sts:AssumeRole

    retriever:
      Type: AWS::IAM::Role
      Properties:
        RoleName: serverless-event-${self:custom.stage}-retriever
        AssumeRolePolicyDocument:
          Version: '2012-10-17'
          Statement:
            - Effect: Allow
              Principal:
                Service:
                  - lambda.amazonaws.com
              Action: sts:AssumeRole

    # POLICIES
    # -----------------------------------------------------------
    logging:
      Type: AWS::IAM::Policy
      Properties:
        PolicyName: serverless-event-logging 
        PolicyDocument:
          Version: "2012-10-17"
          Statement:
            - Effect: Allow
              Action:
                - logs:CreateLogGroup
                - logs:CreateLogStream
                - logs:PutLogEvents
              Resource: arn:aws:logs:${self:provider.region}:*:log-group:/aws/lambda/*:*:*
            - Effect: "Allow"
              Action:
                - "s3:PutObject"
              Resource:
                Fn::Join:
                  - ""
                  - - "arn:aws:s3:::"
                    - "Ref" : "ServerlessDeploymentBucket" 
        Roles: 
          - serverless-event-${self:custom.stage}-${self:provider.region}-lambdaRole
          - serverless-event-${self:custom.stage}-receiver
          - serverless-event-${self:custom.stage}-reporter
          - serverless-event-${self:custom.stage}-aggregator
      
    lambdaInvocation:
      Type: AWS::IAM::Policy
      Properties:
        PolicyName: serverless-event-invocation
        PolicyDocument:
          Version: '2012-10-17'
          Statement:
            - Effect: Allow
              Action:
                - lambda:InvokeFunction
                - lambda:ListFunctions
              Resource: 
                - "arn:aws:lambda:${self:custom.region}:*:function:serverless-event-${self:custom.stage}-*"
        Roles:
          - serverless-event-${self:custom.stage}-${self:provider.region}-lambdaRole
          - serverless-event-${self:custom.stage}-reporter

    s3reader:
      Type: AWS::IAM::Policy
      Properties:
        PolicyName: serverless-event-reader
        PolicyDocument:
          Version: '2012-10-17'
          Statement:
            - Effect: Allow
              Action:
                - s3:GetObject
                - s3:ListAllMyBuckets
              Resource:
                - "arn:aws:s3:::*"
        Roles:
          - serverless-event-${self:custom.stage}-${self:provider.region}-lambdaRole
          - serverless-event-${self:custom.stage}-receiver

    s3writer:
      Type: AWS::IAM::Policy
      Properties:
        PolicyName: serverless-event-writer
        PolicyDocument:
          Version: '2012-10-17'
          Statement:
            - Effect: Allow
              Action:
                - s3:PutObject
                - s3:ListAllMyBuckets
              Resource:
                - "arn:aws:s3:::*"
        Roles:
          - serverless-event-${self:custom.stage}-${self:provider.region}-lambdaRole
          - serverless-event-${self:custom.stage}-processor

    queueWorker:
      Type: AWS::IAM::Policy
      Properties:
        PolicyName: serverless-event-queue-worker
        PolicyDocument:
          Version: '2012-10-17'
          Statement:
            - Effect: Allow
              Action:
                - sqs:ReceiveMessage
                - sqs:DeleteMessage
                - sqs:DeleteMessageBatch
              Resource:
                - "arn:aws:sqs:*"
        Roles:
          - serverless-event-${self:custom.stage}-${self:provider.region}-lambdaRole
          - serverless-event-${self:custom.stage}-reporter

    queuePublisher:
      Type: AWS::IAM::Policy
      Properties:
        PolicyName: serverless-event-queue-publisher
        PolicyDocument:
          Version: '2012-10-17'
          Statement:
            - Effect: Allow
              Action:
                - sqs:SendMessage
                - sqs:SendMessageBatch
                - sqs:SetQueueAttributes
              Resource:
                - "arn:aws:sqs:*"
        Roles:
          - serverless-event-${self:custom.stage}-${self:provider.region}-lambdaRole
          - serverless-event-${self:custom.stage}-reporter

    queueMeta:
      Type: AWS::IAM::Policy
      Properties:
        PolicyName: serverless-event-queue-meta
        PolicyDocument:
          Version: '2012-10-17'
          Statement:
            - Effect: Allow
              Action:
                - sqs:GetQueueAttributes
                - sqs:GetQueueUrl
                - sqs:ListQueues
              Resource:
                - "arn:aws:sqs:*"
        Roles:
          - serverless-event-${self:custom.stage}-${self:provider.region}-lambdaRole
          - serverless-event-${self:custom.stage}-reporter

    EventsBucket:
      Type: AWS::S3::Bucket
      Properties:
        BucketName: serverless-event-${self:custom.stage}

# you can add CloudFormation resource templates here
#resources:
#  Resources:
#    NewResource:
#      Type: AWS::S3::Bucket
#      Properties:
#        BucketName: my-new-bucket
#  Outputs:
#     NewOutput:
#       Description: "Description for the output"
#       Value: "Some output value"