serverless.yml

##
## This software is Copyright ©️ 2020 The University of Southern California. All Rights Reserved. 
## Permission to use, copy, modify, and distribute this software and its documentation for educational, research and non-profit purposes, without fee, and without a written agreement is hereby granted, provided that the above copyright notice and subject to the full license file found in the root of this software deliverable. Permission to make commercial use of this software may be obtained by contacting:  USC Stevens Center for Innovation University of Southern California 1150 S. Olive Street, Suite 2300, Los Angeles, CA 90115, USA Email: accounting@stevens.usc.edu
##
## The full terms of this copyright and license should always be found in the root directory of this software deliverable as "license.txt" and if these terms are not found with this software, please contact the USC Stevens Center for the full license.
##

# This file is the main config file for your service.
#
# For full config options, check the docs:
#    docs.serverless.com
#

service: mentor-classifier-service

# pin the service to only deploy with a specific Serverless version
frameworkVersion: '4'

plugins:
  - serverless-deployment-bucket
  - serverless-layers
  - serverless-domain-manager

custom:
  domain:
    dev: api.devmentorpal.org
    qa: api.qamentorpal.org
    prod: api.mentorpal.org
  customDomain:
    domainName: ${self:custom.domain.${opt:stage, 'dev'}}
    basePath: 'classifier'
    # certificateName: '*.mentorpal.org' didnt work
    # certificateName: 'c6107db7-c2ef-4e85-a21f-bee7d1ac008a' didnt work either
    stage: ${self:provider.stage}
    endpointType: 'regional'
    apiType: rest
    createRoute53Record: true
    securityPolicy: tls_1_2
    # we might have multiple services, better to manually invoke `sls create_domain`
    autoDomain: false

  stages:
    offline:
      LOG_LEVEL: 'trace'
      GRAPHQL_ENDPOINT: 'http://127.0.0.1:3001/graphql'
      SBERT_ENDPOINT: 'http://127.0.0.1:5566/v1'
      IS_SENTRY_ENABLED: false
    dev:
      LOG_LEVEL: 'trace'
      IS_SENTRY_ENABLED: false
      GRAPHQL_ENDPOINT: https://api.devmentorpal.org/graphql/graphql
      SBERT_ENDPOINT: 'https://sbert-qa.mentorpal.org/v1'
      SECRET_HEADER_VALUE: ${ssm:/mentorpal/newdev/shared/secret_header_value, ''}
      SECRET_HEADER_NAME: ${ssm:/mentorpal/newdev/shared/secret_header_name, ''}
      API_SECRET: ${ssm:/mentorpal/newdev/shared/api_secret, ''}
      JWT_SECRET: ${ssm:/mentorpal/newdev/shared/jwt_secret, ''}
      ALERT_SNS_ARN: 'no alarms in dev'
      WEBACL_ARN: ${ssm:/devmentorpal/api_firewall_arn, ''}
    qa:
      LOG_LEVEL: 'debug'
      IS_SENTRY_ENABLED: true
      GRAPHQL_ENDPOINT: https://api.qamentorpal.org/graphql/graphql
      SBERT_ENDPOINT: 'https://sbert-qa.mentorpal.org/v1'
      SECRET_HEADER_VALUE: ${ssm:/mentorpal/v2/shared/secret_header_value, ''}
      SECRET_HEADER_NAME: ${ssm:/mentorpal/v2/shared/secret_header_name, ''}
      API_SECRET: ${ssm:/mentorpal/v2/shared/api_secret, ''}
      JWT_SECRET: ${ssm:/mentorpal/v2/shared/jwt_secret, ''}
      ALERT_SNS_ARN: ${ssm:/qamentorpal/shared/sns_alert_topic_arn, ''}
      WEBACL_ARN: ${ssm:/qamentorpal/api_firewall_arn, ''}
    prod:
      LOG_LEVEL: 'info'
      IS_SENTRY_ENABLED: true
      GRAPHQL_ENDPOINT: https://api.mentorpal.org/graphql/graphql
      SBERT_ENDPOINT: 'https://sbert.mentorpal.org/v1'
      SECRET_HEADER_VALUE: ${ssm:/mentorpal/cf/shared/secret_header_value, ''}
      SECRET_HEADER_NAME: ${ssm:/mentorpal/cf/shared/secret_header_name, ''}
      ALERT_SNS_ARN: ${ssm:/mentorpal/shared/sns_alert_topic_arn, ''}
      API_SECRET: ${ssm:/mentorpal/cf/shared/api_secret, ''}
      JWT_SECRET: ${ssm:/mentorpal/cf/shared/jwt_secret, ''}
      WEBACL_ARN: ${ssm:/mentorpal/api_firewall_arn, ''}

  # serverless-layers requires a deployment bucket to be created before deploying this stack
  serverless-layers:
    - dependencies:
        layersDeploymentBucket: ${self:provider.deploymentBucket.name}
        dependenciesPath: ./requirements.txt
        compatibleRuntimes:
          - python3.9
        functions:
          - http_train
          - http_train_status
          - http_training_data
          - authorizer_func

provider:
  name: aws
  region: ${opt:region, 'us-east-1'}
  stage: ${opt:stage, 'dev'} # stage is dev unless otherwise specified with --stage flag
  runtime: python3.9
  stackTags:
    ENVIRONMENT: ${self:provider.stage}
    PROJECT: ${self:service}-${self:provider.stage}
    REPOSITORY: mentor-classifier-service
  deploymentBucket:
    name: '${self:service}-sls-deploy-${self:provider.stage}'
    blockPublicAccess: true
    serverSideEncryption: AES256
    versioning: false
  architecture: x86_64 # since we build on x86 and have native modules   
  ecr:
    # define images that will be built locally and uploaded to ECR
    images:
      train:
        path: ./
        file: Dockerfile
        # # Enable for deployment on Mac machines
        # platform: linux/amd64
        # buildOptions:
        #   [
        #     "--provenance",
        #     "false"
        #   ]
      predict:
        path: ./
        file: Dockerfile.predict
        # # Enable for deployment on Mac machines
        # platform: linux/amd64
        # buildOptions:
        #   [
        #     "--provenance",
        #     "false"
        #   ]
      followup:
        path: ./
        file: Dockerfile.followup
        # # Enable for deployment on Mac machines
        # platform: linux/amd64
        # buildOptions:
        #   [
        #     "--provenance",
        #     "false"
        #   ]

  endpointType: regional
  apiGateway:
    minimumCompressionSize: 1024
    usagePlan:
      throttle:
        burstLimit: 100
        rateLimit: 10
  tracing:
    lambda: true
    apiGateway: true
  logRetentionInDays: 30
  logs:
    restApi:
      # Enables HTTP access logs (default: true)
      accessLogging: true
      # # Log format to use for access logs
      # format: 'requestId: $context.requestId'
      # Enable execution logging (default: true)
      executionLogging: true
      level: INFO  # INFO or ERROR
      # Log full requests/responses for execution logging (default: true)
      fullExecutionData: false
  environment:
    STAGE: ${self:provider.stage}
    PYTHON_ENV: stage-${self:provider.stage}
    GRAPHQL_ENDPOINT: ${self:custom.stages.${self:provider.stage}.GRAPHQL_ENDPOINT}
    SBERT_ENDPOINT: ${self:custom.stages.${self:provider.stage}.SBERT_ENDPOINT}
    API_SECRET: ${self:custom.stages.${self:provider.stage}.API_SECRET}
    JWT_SECRET: ${self:custom.stages.${self:provider.stage}.JWT_SECRET}
    SECRET_HEADER_VALUE: ${self:custom.stages.${self:provider.stage}.SECRET_HEADER_VALUE}
    SECRET_HEADER_NAME: ${self:custom.stages.${self:provider.stage}.SECRET_HEADER_NAME}
    IS_SENTRY_ENABLED: ${self:custom.stages.${self:provider.stage}.IS_SENTRY_ENABLED}
    SENTRY_DSN_MENTOR_CLASSIFIER: '${ssm:/mentorpal/classifier/sentry_dsn}'
    SHARED_ROOT: '/app/shared' # as defined in Dockerfile
    MODELS_BUCKET: classifier-models-${self:provider.stage}
    JOBS_TABLE_NAME: classifier-jobs-${self:provider.stage}
    JOBS_SQS_NAME: classifier-jobs-${self:provider.stage}
    REGION: ${self:provider.region}
  iam:
    role:
      statements:
      # todo create dedicated roles for each function for increased security
        - Effect: "Allow"
          Action:
            - "s3:PutObject"
            - "s3:GetObject"
          Resource:
            - 'arn:aws:s3:::${self:provider.environment.MODELS_BUCKET}/*'
        - Effect: "Allow"
          Action:
            - "s3:ListBucket"
          Resource:
            - 'arn:aws:s3:::${self:provider.environment.MODELS_BUCKET}'
        - Effect: "Allow"
          Action:
            - dynamodb:GetItem
            - dynamodb:PutItem
            - dynamodb:UpdateItem
          Resource:
            Fn::GetAtt: [JobsTable, Arn]
        - Effect: "Allow"
          Action:
            - sqs:SendMessage
            - sqs:GetQueueUrl
          Resource:
            Fn::GetAtt: [TrainQueue, Arn]

package:
 individually: false
 patterns:
    # exclude everything:
     - '!./**'
    # and then add back in only the files we need:
     - '*.py'
     - 'module/**'

functions:
  authorizer_func:
    handler: authorizer.handler

  http_train:
    handler: train.handler
    memorySize: 1024
    timeout: 30
    events:
      - http:
          path: /train
          method: post
          cors: true
          authorizer: 
            name: authorizer_func
            resultTtlInSeconds: 300
            identitySource: method.request.header.Authorization
            type: token

  http_train_status:
    handler: status.handler
    memorySize: 512
    timeout: 10
    events:
      - http:
          path: /train/status/{id}
          method: get
          cors: true
          authorizer: 
            name: authorizer_func
            resultTtlInSeconds: 300
            identitySource: method.request.header.Authorization
            type: token
          request:
            parameters:
              paths:
                id: true
  sqs_train:
    image:
      name: train
      command:
        - trainjob.handler
    memorySize: 8192
    timeout: 600
    events:
      - sqs:
          arn:
            Fn::GetAtt: [TrainQueue, Arn]
          batchSize: 1
  http_answer:
    image:
      name: predict
      command:
        - predict.handler

    memorySize: 2048
    timeout: 30
    events:
      - http:
          path: /questions
          method: get
          cors: true
          request:
            parameters:
              querystrings:
                mentor: true
                query: true
                chatsessionid: true
                ping: false #optional
  
  http_followup:
    image:
      name: followup
      command:
        - followup.handler
    memorySize: 1024
    timeout: 30
    events:
      - http:
          path: /followups/category/{category}/{mentor}
          method: post
          cors: true
          authorizer: 
            name: authorizer_func
            resultTtlInSeconds: 300
            identitySource: method.request.header.Authorization
            type: token
          request:
            parameters:
              paths:
                category: true
                mentor: true

  http_training_data:
    handler: trainingdata.handler
    memorySize: 2048
    timeout: 30
    events:
      - http:
          path: /trainingdata/{mentor}
          method: get
          cors: true
          authorizer: 
            name: authorizer_func
            resultTtlInSeconds: 300
            identitySource: method.request.header.Authorization
            type: token
          request:
            parameters:
              paths:
                mentor: true


resources:
  Conditions:
    CreateCloudWatchAlarm:
      Fn::Or:
        - Fn::Equals: ['${self:provider.stage}', 'qa']
        - Fn::Equals: ['${self:provider.stage}', 'prod']
  Resources:
    TrainDLQ:
      Type: AWS::SQS::Queue
      Properties:
        DelaySeconds: 30
        QueueName: classifier-jobs-dlq-${self:provider.stage}
        MessageRetentionPeriod: 1209600 # max 14 days, default is 4 days
    TrainQueue:
      Type: AWS::SQS::Queue
      Properties:
        # https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-sqs-queues.html
        QueueName:  ${self:provider.environment.JOBS_SQS_NAME}
        VisibilityTimeout: 800 # AWS recommends 6 times lambdas timeout
        RedrivePolicy:
          deadLetterTargetArn:
            Fn::GetAtt: [TrainDLQ, Arn]
          maxReceiveCount: 5 # AWS recommends minimum 5
    
    TrainedModelsBucket:
      Type: AWS::S3::Bucket
      Properties:
        BucketName: ${self:provider.environment.MODELS_BUCKET}

    JobsTable:
      Type: AWS::DynamoDB::Table
      DeletionPolicy: Delete
      UpdateReplacePolicy: Delete
      Properties:
        TableName: ${self:provider.environment.JOBS_TABLE_NAME}
        BillingMode: PAY_PER_REQUEST
        AttributeDefinitions:
          - AttributeName: id
            AttributeType: S
        KeySchema:
          - AttributeName: id
            KeyType: HASH
        # to cleanup jobs after a while set this attribute as a number
        TimeToLiveSpecification: 
          AttributeName: ttl
          Enabled: true

    TrainDLQAlarm:
      Type: AWS::CloudWatch::Alarm
      Condition: CreateCloudWatchAlarm
      Properties:
        ActionsEnabled: true
        AlarmName: 'Number of failed train jobs ${self:resources.Resources.TrainDLQ.Properties.QueueName}'
        AlarmDescription: 'Number of failed train jobs greater than zero'
        Namespace: 'AWS/SQS'
        Statistic: 'Sum'
        MetricName: 'ApproximateNumberOfMessagesVisible'
        ComparisonOperator: 'GreaterThanThreshold'
        EvaluationPeriods: 1
        Period: 300 # 5 minutes in seconds
        Threshold: 0
        TreatMissingData: 'notBreaching'
        Dimensions:
          - Name: QueueName
            Value: ${self:resources.Resources.TrainDLQ.Properties.QueueName}
        AlarmActions:
          - ${self:custom.stages.${self:provider.stage}.ALERT_SNS_ARN}
        OKActions:
          - ${self:custom.stages.${self:provider.stage}.ALERT_SNS_ARN}

    ApiErrors:
      Type: AWS::CloudWatch::Alarm
      Condition: CreateCloudWatchAlarm
      Properties:
        ActionsEnabled: true
        AlarmName: 'classifier API Gateway 5xx errors - ${self:provider.stage}'
        AlarmDescription: 'classifier API Gateway 5xx errors - ${self:provider.stage}'
        Namespace: AWS/ApiGateway
        MetricName: 5XXError
        Statistic: Sum
        Threshold: 0
        ComparisonOperator: 'GreaterThanThreshold'
        EvaluationPeriods: 1
        Period: 60
        TreatMissingData: 'notBreaching'
        Dimensions:
          - Name: ApiName
            Value: '${self:provider.stage}-${self:service}'
        AlarmActions:
          - ${self:custom.stages.${self:provider.stage}.ALERT_SNS_ARN}

    Response5xx:
      Type: 'AWS::ApiGateway::GatewayResponse'
      Properties:
        ResponseParameters:
          gatewayresponse.header.Access-Control-Allow-Origin: 'method.request.header.origin'
        ResponseType: DEFAULT_5XX
        RestApiId:
          Ref: 'ApiGatewayRestApi'
    Response4xx:
      Type: 'AWS::ApiGateway::GatewayResponse'
      Properties:
        ResponseParameters:
          gatewayresponse.header.Access-Control-Allow-Origin: 'method.request.header.origin'
        ResponseType: DEFAULT_4XX
        RestApiId:
          Ref: 'ApiGatewayRestApi'

    FirewallAssociation:
      Type: AWS::WAFv2::WebACLAssociation
      Properties:
        ResourceArn:
          Fn::Sub: 'arn:aws:apigateway:${AWS::Region}::/restapis/${ApiGatewayRestApi}/stages/${self:provider.stage}'
        WebACLArn: '${self:custom.stages.${self:provider.stage}.WEBACL_ARN}'