serverless.yml

org: osiris
app: osiris-api
service: osiris-api
configValidationMode: error

frameworkVersion: '3'

custom:
  wsgi:
    app: app.app
  secrets:
    aws: ${ssm:/aws/reference/secretsmanager/app-secrets}

provider:
  name: aws
  region: eu-west-1
  runtime: python3.9
  stage: ${env:STAGE, 'dev'}
  iam:
    role:
      statements:
        - Effect: Allow
          Action:
            - 'secretsmanager:GetSecretValue'
            - 'secretsmanager:DescribeSecret'
          Resource: arn:aws:secretsmanager:*:*:secret:app-secrets*

functions:
  osiris-api:
    role: ApiRole
    handler: wsgi_handler.handler
    timeout: 25
    events:
      - httpApi: '*'
    environment:
      MONGO_URI: ${self:custom.secrets.aws.MONGO_URI}
      OPENAI_API_KEY: ${self:custom.secrets.aws.OPENAI_API_KEY}
      GOOGLE_CLIENT_ID: 720095072153-bl54auh9v367357cdfj7nti1eu2lvr05.apps.googleusercontent.com
      DOMAIN: ".project-osiris.net"
      APP_URI: "https://app.project-osiris.net"
      JWT_SECRET_KEY: ${self:custom.secrets.aws.JWT_SECRET_KEY}

  transcripts-processor:
    handler: app.microservices.process_transcript.handle_event
    role: TranscriptProcessorRole
    timeout: 90
    events:
      - sns:
          topicName: transcripts-queue
          arn:
            Ref: TranscriptQueue
    environment:
      MONGO_URI: ${self:custom.secrets.aws.MONGO_URI}
      OPENAI_API_KEY: ${self:custom.secrets.aws.OPENAI_API_KEY}
      TRANSCRIPTS_BUCKET: 'osiris-transcripts-${self:provider.stage}'

resources:
  Resources:
    TranscriptsBucket:
      Type: AWS::S3::Bucket
      Properties:
        BucketName: osiris-transcripts-${self:provider.stage}


    TranscriptQueue:
      Type: AWS::SNS::Topic
      Properties:
        DisplayName: Transcripts Queue
        TopicName: transcripts-queue
#        ContentBasedDeduplication: true
        FifoTopic: false

    ApiRole:
      Type: AWS::IAM::Role
      Properties:
        RoleName: Api-Role
        AssumeRolePolicyDocument:
          Version: '2012-10-17'
          Statement:
            - Effect: Allow
              Principal:
                Service:
                  - lambda.amazonaws.com
              Action: sts:AssumeRole
        Policies:
          - PolicyName: LogWriter
            PolicyDocument:
              Version: '2012-10-17'
              Statement:
                - Effect: Allow
                  Action:
                    - 'logs:CreateLogGroup'
                    - 'logs:CreateLogStream'
                    - 'logs:PutLogEvents'
                  Resource:
                    - 'arn:aws:logs:*:*:*'
          - PolicyName: Access-App-Secrets
            PolicyDocument:
              Version: '2012-10-17'
              Statement:
                - Effect: Allow
                  Action:
                    - 'secretsmanager:GetSecretValue'
                    - 'secretsmanager:DescribeSecret'
                  Resource: arn:aws:secretsmanager:*:*:secret:app-secrets*

    TranscriptProcessorRole:
      Type: AWS::IAM::Role
      Properties:
        RoleName: TranscriptProcessor-Role
        AssumeRolePolicyDocument:
          Version: '2012-10-17'
          Statement:
            - Effect: Allow
              Principal:
                Service:
                  - lambda.amazonaws.com
              Action: sts:AssumeRole
        Policies:
          - PolicyName: LogWriter
            PolicyDocument:
              Version: '2012-10-17'
              Statement:
                - Effect: Allow
                  Action:
                    - 'logs:CreateLogGroup'
                    - 'logs:CreateLogStream'
                    - 'logs:PutLogEvents'
                  Resource:
                    - 'arn:aws:logs:*:*:*'
          - PolicyName: Access-App-Secrets
            PolicyDocument:
              Version: '2012-10-17'
              Statement:
                - Effect: Allow
                  Action:
                    - 'secretsmanager:GetSecretValue'
                    - 'secretsmanager:DescribeSecret'
                  Resource: arn:aws:secretsmanager:*:*:secret:app-secrets*
          - PolicyName: Read-Transcripts
            PolicyDocument:
              Version: '2012-10-17'
              Statement:
                - Effect: Allow
                  Action:
                    - 's3:GetObject'
                    - 's3:GetBucketLocation'
                    - 's3:ListBucket'
                  Resource:
                    - 'arn:aws:s3:::osiris-transcripts-${self:provider.stage}'
                    - 'arn:aws:s3:::osiris-transcripts-${self:provider.stage}/*'
      DependsOn:
        - TranscriptsBucket

plugins:
  - serverless-wsgi
  - serverless-python-requirements

package:
  include:
    - app/**
  exclude:
    - .idea/**
    - tests/**
    - __pycache__/**
    - .git/**
    - .github/**
    - venv/**