serverless.yml

service: acme-certificate-runner

# Use serverless-webpack plugin to transpile ES6/ES7
plugins:
  - serverless-webpack

# Enable auto-packing of external modules
custom:
  webpackIncludeModules: true

provider:
  name: aws
  runtime: nodejs6.10
  stage: prod
  region: eu-west-1
  memorySize: 1024
  timeout: 10
  versionFunctions: true
  environment:
    RENEW_BEFORE_EXPIRY: 45
    S3_ACCOUNT_BUCKET: some-settings-bucket
    S3_CERTIFICATE_BUCKET: some-bucket
    S3_CERTIFICATE_FOLDER: ${self:provider.stage}/store
    ACME_ACCOUNT_EMAIL: someone@email.org
    USE_PRODUCTION: false

  iamRoleStatements:
    - Effect: Allow
      Action:
      - s3:ListBucket
      Resource:
      - arn:aws:s3:::${self:provider.environment.S3_CERTIFICATE_BUCKET}
      - arn:aws:s3:::${self:provider.environment.S3_ACCOUNT_BUCKET}
    - Effect: Allow
      Action:
      - s3:GetObject
      - s3:PutObject
      - s3:DeleteObject
      Resource:
      - arn:aws:s3:::${self:provider.environment.S3_CERTIFICATE_BUCKET}/*
      - arn:aws:s3:::${self:provider.environment.S3_ACCOUNT_BUCKET}/*
    - Effect: Allow
      Action:
      - s3:GetBucketLocation
      - s3:ListAllMyBuckets
      Resource:
      - "arn:aws:s3:::*"
    - Effect: Allow
      Action:
      - iam:ListServerCertificates
      - iam:UploadServerCertificate
      - iam:UpdateServerCertificate
      - iam:DeleteServerCertificate
      Resource:
      - "*"
    - Effect: Allow
      Action:
      - acm:DescribeCertificate
      - acm:ListCertificates
      - acm:ImportCertificate
      - acm:DeleteCertificate
      Resource:
      - "*"            
    - Effect: Allow
      Action:
      - route53:ListHostedZones
      - route53:ListHostedZonesByName
      - route53:ListResourceRecordSets
      - route53:GetChange
      - route53:GetHostedZone
      - route53:GetHostedZoneCount
      - route53:ChangeResourceRecordSets
      Resource:
        "*"

functions:
  runner:
    handler: runner.main
    name: ${self:provider.stage}-Certificate-Orchestrator
    description: Certificate Orchestrator ACMEv1
    runtime: nodejs6.10
    memorySize: 1024
    timeout: 300
    reservedConcurrency: 1
    events:
      - schedule: 
          rate: rate(2 hours)
          name: Certificate Orchestrator ACMEv1
          description: 'Attempt renewal of certificates every 2 hours'

  pem:
    handler: pem-creator.main
    name: ${self:provider.stage}-pem-creator
    description: Certificate Orchestrator ACMEv1 - Pem Addon
    runtime: nodejs6.10
    memorySize: 1024
    timeout: 300
    reservedConcurrency: 1