Example serverless.yml

serverless.yml

# read cloudtrail things dropped off at s3, put them in ES
service: cloudtrailindexer

provider:
  name: aws
  runtime: python2.7

# you can overwrite defaults here
#  stage: dev
  region: us-west-2
  environment:
    ELASTICSEARCH_URL: ${env:ELASTICSEARCH_URL}

# you can add statements to the Lambda function's IAM Role here
  iamRoleStatements:
    - Effect: "Allow"
      Action:
        - "s3:ListBucket"
      Resource:
        Fn::Join:
          - ""
          - - "arn:aws:s3:::"
            - ${env:S3_BUCKET}
    - Effect: "Allow"
      Action:
        - "s3:GetObject"
      Resource:
        Fn::Join:
          - ""
          - - "arn:aws:s3:::"
            - ${env:S3_BUCKET}
            - "/*"
    - Effect: "Allow"
      Action:
        - "es:*"
      Resource: "arn:aws:es:us-west-2:514192441565:domain/edyesed-ebooks/*"
    - Effect: "Allow"
      Action:
        - "cloudwatch:PutMetricData"
      Resource: "*"


functions:
  copyintoes:
    handler: cloudtrail.insert
    events:
      - s3: ${env:S3_BUCKET}


# you can add CloudFormation resource templates here
resources:
  Resources:
    BucketPolicy: 
      Type: "AWS::S3::BucketPolicy"
      Properties: 
        Bucket: 
          Ref: S3BucketEdyesedcloudtraillambda
        PolicyDocument: 
          Version: "2012-10-17"
          Statement: 
            - 
              Sid: "AWSCloudTrailAclCheck"
              Effect: "Allow"
              Principal: 
                Service: "cloudtrail.amazonaws.com"
              Action: "s3:GetBucketAcl"
              Resource: 
                - arn:aws:s3:::${env:S3_BUCKET}
            - 
              Sid: "AWSCloudTrailWrite"
              Effect: "Allow"
              Principal: 
                Service: "cloudtrail.amazonaws.com"
              Action: "s3:PutObject"
              Resource:
                Fn::Join:
                  - ""
                  - - "arn:aws:s3:::"
                    - ${env:S3_BUCKET}
                    - "/AWSLogs/"
                    - { "Ref" : "AWS::AccountId" }
                    - "/*"
              Condition: 
                StringEquals:
                  s3:x-amz-acl: "bucket-owner-full-control"
    LambdaTrail: 
      DependsOn: 
        - BucketPolicy
      Type: "AWS::CloudTrail::Trail"
      Properties: 
        S3BucketName: 
          Ref: S3BucketEdyesedcloudtraillambda
        IncludeGlobalServiceEvents: true
        IsMultiRegionTrail: true
        IsLogging: true
        #CloudWatchLogsLogGroupArn: CloudTrail/DefaultLogGroup
        #CloudWatchLogsRoleArn: CloudTrail_CloudWatchLogs_Role