serverless.yml

service: app-api

frameworkVersion: "3"

package:
  individually: true

plugins:
  - serverless-s3-bucket-helper
  - serverless-bundle
  - serverless-dotenv-plugin
  - serverless-offline
  - serverless-associate-waf
  - serverless-stack-termination-protection
  - serverless-iam-helper
  - serverless-offline-ssm
  - "@enterprise-cmcs/serverless-waf-plugin"

custom:
  project: "seds"
  stage: ${opt:stage, self:provider.stage}
  region: ${opt:region, self:provider.region}
  wafPlugin:
    name: ${self:service}-${self:custom.stage}-webacl-waf
  wafExcludeRules:
    awsCommon:
      - "SizeRestrictions_BODY"
  iamPath: ${env:IAM_PATH, ssm:/configuration/${self:custom.stage}/iam/path, ssm:/configuration/default/iam/path, "/"}
  iamPermissionsBoundaryPolicy: ${env:IAM_PERMISSIONS_BOUNDARY, ssm:/configuration/${self:custom.stage}/iam/permissionsBoundaryPolicy, ssm:/configuration/default/iam/permissionsBoundaryPolicy, ""}
  serverless-offline-ssm:
    stages:
      - local
  dotenv:
    path: ../../.env
  serverlessTerminationProtection:
    stages: # This is a list of common names for important envs that should not be destroyed.  You can remove the stage names your project doesn't use; this list is meant to be inclusive.
      - master
      - val
      - production
      - develop
      - main
      - impl
      - val
      - prod
  infrastructureType: ${env:INFRASTRUCTURE_TYPE, ssm:/configuration/${self:custom.stage}/infrastructure/type, ssm:/configuration/default/infrastructure/type, "development"}
  AgeRangesTableName: ${env:AGE_RANGES_TABLE_NAME, param:AgeRangesTableName}
  AgeRangesTableArn: ${env:AGE_RANGES_TABLE_ARN, param:AgeRangesTableArn}
  AgeRangesTableStreamArn: ${env:LOCAL_PLACEHOLDER_ARN,param:AgeRangesTableStreamArn, cf:database-master.AgeRangesTableStreamArn}
  FormAnswersTableName: ${env:FORM_ANSWERS_TABLE_NAME, param:FormAnswersTableName}
  FormAnswersTableArn: ${env:FORM_ANSWERS_TABLE_ARN, param:FormAnswersTableArn}
  FormAnswersTableStreamArn: ${env:LOCAL_PLACEHOLDER_ARN, param:FormAnswersTableStreamArn, cf:database-master.FormAnswersTableStreamArn}
  FormQuestionsTableName: ${env:FORM_QUESTIONS_TABLE_NAME, param:FormQuestionsTableName}
  FormQuestionsTableArn: ${env:FORM_QUESTIONS_TABLE_ARN, param:FormQuestionsTableArn}
  FormQuestionsTableStreamArn: ${env:LOCAL_PLACEHOLDER_ARN, param:FormQuestionsTableStreamArn, cf:database-master.FormQuestionsTableStreamArn}
  FormsTableName: ${env:FORMS_TABLE_NAME, param:FormsTableName}
  FormsTableArn: ${env:FORMS_TABLE_ARN, param:FormsTableArn}
  FormsTableStreamArn: ${env:LOCAL_PLACEHOLDER_ARN, param:FormsTableStreamArn, cf:database-master.FormsTableStreamArn}
  FormTemplatesTableName: ${env:FORM_TEMPLATES_TABLE_NAME, param:FormTemplatesTableName}
  FormTemplatesTableArn: ${env:FORM_TEMPLATES_TABLE_ARN, param:FormTemplatesTableArn}
  FormTemplatesTableStreamArn: ${env:LOCAL_PLACEHOLDER_ARN, param:FormTemplatesTableStreamArn, cf:database-master.FormTemplatesTableStreamArn}
  StateFormsTableName: ${env:STATE_FORMS_TABLE_NAME, param:StateFormsTableName}
  StateFormsTableArn: ${env:STATE_FORMS_TABLE_ARN, param:StateFormsTableArn}
  StateTableStreamArn: ${env:LOCAL_PLACEHOLDER_ARN, param:StateTableStreamArn, cf:database-master.StateTableStreamArn}
  StatesTableName: ${env:STATES_TABLE_NAME, param:StatesTableName}
  StatesTableArn: ${env:STATES_TABLE_ARN, param:StatesTableArn}
  StatusTableName: ${env:STATUS_TABLE_NAME, param:StatusTableName}
  StatusTableArn: ${env:STATUS_TABLE_ARN, param:StatusTableArn}
  StatusTableStreamArn: ${env:LOCAL_PLACEHOLDER_ARN, param:StatusTableStreamArn, cf:database-master.StatusTableStreamArn}
  AuthUserTableName: ${env:AUTH_USER_TABLE_NAME, param:AuthUserTableName}
  AuthUserTableArn: ${env:AUTH_USER_TABLE_ARN, param:AuthUserTableArn}
  AuthUserTableStreamArn: ${env:LOCAL_PLACEHOLDER_ARN,param:AuthUserTableStreamArn, cf:database-master.AuthUserTableStreamArn}
  AuthUserRolesTableName: ${env:AUTH_USER_ROLES_TABLE_NAME, param:AuthUserRolesTableName}
  AuthUserRolesTableArn: ${env:AUTH_USER_ROLES_TABLE_ARN, param:AuthUserRolesTableArn}
  AuthUserStatesTableName: ${env:AUTH_USER_STATES_TABLE_NAME, param:AuthUserStatesTableName}
  AuthUserStatesTableArn: ${env:AUTH_USER_STATES_TABLE_ARN, param:AuthUserStatesTableArn}
  AuthUserStatesTableStreamArn: ${env:LOCAL_PLACEHOLDER_ARN, param:AuthUserStatesTableStreamArn, cf:database-master.AuthUserStatesTableStreamArn}
  StateFormsTableStreamArn: ${env:LOCAL_PLACEHOLDER_ARN, param:StateFormsTableStreamArn, cf:database-master.StateFormsTableStreamArn}
  AuthUserRolesTableStreamArn: ${env:LOCAL_PLACEHOLDER_ARN, param:AuthUserRolesTableStreamArn, cf:database-master.AuthUserRolesTableStreamArn}
  bootstrapBrokerStringTls: ${env:LOCAL_DEFAULT_STRING, ssm:/configuration/${self:custom.stage}/seds/bootstrapBrokerStringTls, ssm:/configuration/default/seds/bootstrapBrokerStringTls, ""}
  vpcId: ${env:LOCAL_DEFAULT_STRING, ssm:/configuration/${self:custom.stage}/vpc/id, ssm:/configuration/default/vpc/id, ""}
  webAclName: ${self:service}-${self:custom.stage}-webacl-waf
  associateWaf:
    name: ${self:custom.webAclName}
    version: V2
  dataSubnets:
    - ${env:LOCAL_PLACEHOLDER_ARN, ssm:/configuration/${self:custom.stage}/vpc/subnets/kubernetes/a/id, ssm:/configuration/default/vpc/subnets/kubernetes/a/id, ""}
    - ${env:LOCAL_PLACEHOLDER_ARN, ssm:/configuration/${self:custom.stage}/vpc/subnets/kubernetes/b/id, ssm:/configuration/default/vpc/subnets/kubernetes/b/id, ""}
    - ${env:LOCAL_PLACEHOLDER_ARN, ssm:/configuration/${self:custom.stage}/vpc/subnets/kubernetes/c/id, ssm:/configuration/default/vpc/subnets/kubernetes/c/id, ""}
  privateSubnets:
    - ${env:LOCAL_PLACEHOLDER_ARN, ssm:/configuration/${self:custom.stage}/vpc/subnets/private/a/id, ssm:/configuration/default/vpc/subnets/private/a/id, ""}
    - ${env:LOCAL_PLACEHOLDER_ARN, ssm:/configuration/${self:custom.stage}/vpc/subnets/private/b/id, ssm:/configuration/default/vpc/subnets/private/b/id, ""}
    - ${env:LOCAL_PLACEHOLDER_ARN, ssm:/configuration/${self:custom.stage}/vpc/subnets/private/c/id, ssm:/configuration/default/vpc/subnets/private/c/id, ""}

provider:
  name: aws
  runtime: nodejs20.x
  region: us-east-1
  stackTags:  
    PROJECT: ${self:custom.project}
    SERVICE: ${self:service}  
  tracing:
    apiGateway: true
  logs:
    restApi: true
  iam:
    role:
      # Even though we are creating our own IAM role that is used in each lambda function below
      # These values are used by the serverless-iam-helper and need to be set
      path: ${self:custom.iamPath}
      permissionsBoundary:
        Fn::If:
          - CreatePermissionsBoundary
          - !Sub arn:aws:iam::${AWS::AccountId}:policy${self:custom.iamPermissionsBoundaryPolicy}
          - !Ref AWS::NoValue
  environment: # Service wide environment variables
    AgeRangesTableName: ${env:AGE_RANGES_TABLE_NAME, self:custom.AgeRangesTableName}
    AgeRangesTableArn: ${env:AGE_RANGES_TABLE_ARN, self:custom.AgeRangesTableArn}
    FormAnswersTableName: ${env:FORM_ANSWERS_TABLE_NAME, self:custom.FormAnswersTableName}
    FormAnswersTableArn: ${env:FORM_ANSWERS_TABLE_ARN, self:custom.FormAnswersTableArn}
    FormQuestionsTableName: ${env:FORM_QUESTIONS_TABLE_NAME, self:custom.FormQuestionsTableName}
    FormQuestionsTableArn: ${env:FORM_QUESTIONS_TABLE_ARN, self:custom.FormQuestionsTableArn}
    FormsTableName: ${env:FORMS_TABLE_NAME, self:custom.FormsTableName}
    FormsTableArn: ${env:FORMS_TABLE_ARN, self:custom.FormsTableArn}
    FormTemplatesTableName: ${env:FORM_TEMPLATES_TABLE_NAME, self:custom.FormTemplatesTableName}
    FormTemplatesTableArn: ${env:FORM_TEMPLATES_TABLE_ARN, self:custom.FormTemplatesTableArn}
    StateFormsTableName: ${env:STATE_FORMS_TABLE_NAME, self:custom.StateFormsTableName}
    StateFormsTableArn: ${env:STATE_FORMS_TABLE_ARN, self:custom.StateFormsTableArn}
    StatesTableName: ${env:STATES_TABLE_NAME, self:custom.StatesTableName}
    StatesTableArn: ${env:STATES_TABLE_ARN, self:custom.StatesTableArn}
    StatusTableName: ${env:STATUS_TABLE_NAME, self:custom.StatusTableName}
    StatusTableArn: ${env:STATUS_TABLE_ARN, self:custom.StatusTableArn}
    AuthUserTableName: ${env:AUTH_USER_TABLE_NAME, self:custom.AuthUserTableName}
    AuthUserTableArn: ${env:AUTH_USER_TABLE_ARN, self:custom.AuthUserTableArn}
    AuthUserRolesTableName: ${env:AUTH_USER_ROLES_TABLE_NAME, self:custom.AuthUserRolesTableName}
    AuthUserRolesTableArn: ${env:AUTH_USER_ROLES_TABLE_ARN, self:custom.AuthUserRolesTableArn}
    AuthUserStatesTableName: ${env:AUTH_USER_STATES_TABLE_NAME, self:custom.AuthUserStatesTableName}
    AuthUserStatesTableArn: ${env:AUTH_USER_STATES_TABLE_ARN, self:custom.AuthUserStatesTableArn}
    stage: ${self:custom.stage}

functions:
  ForceKafkaSync:
    handler: handlers/kafka/get/forceKafkaSync.main
    role: LambdaApiRole
    timeout: 900
    memorySize: 3072
  postKafkaData:
    handler: handlers/kafka/post/postKafkaData.handler
    events:
      - stream:
          type: dynamodb
          arn: ${self:custom.FormAnswersTableStreamArn}
          startingPosition: TRIM_HORIZON
          maximumRetryAttempts: 2
          enabled: true
      - stream:
          type: dynamodb
          arn: ${self:custom.StateFormsTableStreamArn}
          startingPosition: TRIM_HORIZON
          maximumRetryAttempts: 2
          enabled: true
      - stream:
          type: dynamodb
          arn: ${self:custom.FormQuestionsTableStreamArn}
          startingPosition: TRIM_HORIZON
          maximumRetryAttempts: 2
          enabled: true
      - stream:
          type: dynamodb
          arn: ${self:custom.FormsTableStreamArn}
          startingPosition: TRIM_HORIZON
          maximumRetryAttempts: 2
          enabled: true
      - stream:
          type: dynamodb
          arn: ${self:custom.StateTableStreamArn}
          startingPosition: TRIM_HORIZON
          maximumRetryAttempts: 2
          enabled: true
      - stream:
          type: dynamodb
          arn: ${self:custom.StatusTableStreamArn}
          startingPosition: TRIM_HORIZON
          maximumRetryAttempts: 2
          enabled: true
      - stream:
          type: dynamodb
          arn: ${self:custom.AuthUserTableStreamArn}
          startingPosition: TRIM_HORIZON
          maximumRetryAttempts: 2
          enabled: true
      - stream:
          type: dynamodb
          arn: ${self:custom.AuthUserStatesTableStreamArn}
          startingPosition: LATEST
          maximumRetryAttempts: 2
          enabled: true
      - stream:
          type: dynamodb
          arn: ${self:custom.AuthUserRolesTableStreamArn}
          startingPosition: LATEST
          maximumRetryAttempts: 2
          enabled: true
      - stream:
          type: dynamodb
          arn: ${self:custom.AgeRangesTableStreamArn}
          startingPosition: TRIM_HORIZON
          maximumRetryAttempts: 2
          enabled: true
      - stream:
          type: dynamodb
          arn: ${self:custom.FormTemplatesTableStreamArn}
          startingPosition: TRIM_HORIZON
          maximumRetryAttempts: 2
          enabled: true
    role: LambdaApiRole
    environment:
      BOOTSTRAP_BROKER_STRING_TLS: ${self:custom.bootstrapBrokerStringTls}
      STAGE: ${self:custom.stage}
    maximumRetryAttempts: 2
    timeout: 120
    memorySize: 2048
    vpc:
      securityGroupIds:
        - Ref: KafkaSecurityGroup
      subnetIds: ${self:custom.privateSubnets}
  dataConnectSource:
    handler: handlers/kafka/post/dataConnectSource.handler
    events:
      - stream:
          type: dynamodb
          arn: ${self:custom.FormAnswersTableStreamArn}
          startingPosition: TRIM_HORIZON
          maximumRetryAttempts: 2
          enabled: true
      - stream:
          type: dynamodb
          arn: ${self:custom.StateFormsTableStreamArn}
          startingPosition: TRIM_HORIZON
          maximumRetryAttempts: 2
          enabled: true
      - stream:
          type: dynamodb
          arn: ${self:custom.FormQuestionsTableStreamArn}
          startingPosition: TRIM_HORIZON
          maximumRetryAttempts: 2
          enabled: true
      - stream:
          type: dynamodb
          arn: ${self:custom.FormsTableStreamArn}
          startingPosition: TRIM_HORIZON
          maximumRetryAttempts: 2
          enabled: true
      - stream:
          type: dynamodb
          arn: ${self:custom.StateTableStreamArn}
          startingPosition: TRIM_HORIZON
          maximumRetryAttempts: 2
          enabled: true
      - stream:
          type: dynamodb
          arn: ${self:custom.StatusTableStreamArn}
          startingPosition: TRIM_HORIZON
          maximumRetryAttempts: 2
          enabled: true
      - stream:
          type: dynamodb
          arn: ${self:custom.AuthUserTableStreamArn}
          startingPosition: TRIM_HORIZON
          maximumRetryAttempts: 2
          enabled: true
      - stream:
          type: dynamodb
          arn: ${self:custom.AgeRangesTableStreamArn}
          startingPosition: TRIM_HORIZON
          maximumRetryAttempts: 2
          enabled: true
      - stream:
          type: dynamodb
          arn: ${self:custom.FormTemplatesTableStreamArn}
          startingPosition: TRIM_HORIZON
          maximumRetryAttempts: 2
          enabled: true
    role: LambdaApiRole
    environment:
      BOOTSTRAP_BROKER_STRING_TLS: ${self:custom.bootstrapBrokerStringTls}
      STAGE: ${self:custom.stage}
    maximumRetryAttempts: 2
    timeout: 120
    memorySize: 2048
    vpc:
      securityGroupIds:
        - Ref: KafkaSecurityGroup
      subnetIds: ${self:custom.privateSubnets}
  getUserById:
    handler: handlers/users/get/getUserById.main
    role: LambdaApiRole
    events:
      - http:
          path: users/{id}
          method: get
          cors: true
          authorizer: aws_iam
  getUsers:
    handler: handlers/users/get/listUsers.main
    role: LambdaApiRole
    events:
      - http:
          path: users
          method: get
          cors: true
          authorizer: aws_iam
  obtainUserByUsername:
    handler: handlers/users/post/obtainUserByUsername.main
    role: LambdaApiRole
    events:
      - http:
          path: users/get
          method: post
          cors: true
          authorizer: aws_iam
  obtainUserByEmail:
    handler: handlers/users/post/obtainUserByEmail.main
    role: LambdaApiRole
    events:
      - http:
          path: users/get/email
          method: post
          cors: true
          authorizer: aws_iam
  createUser:
    handler: handlers/users/post/createUser.main
    role: LambdaApiRole
    events:
      - http:
          path: users/add
          method: post
          cors: true
          authorizer: aws_iam
  adminCreateUser:
    handler: handlers/users/post/createUser.adminCreateUser
    role: LambdaApiRole
    events:
      - http:
          path: users/admin-add
          method: post
          cors: true
          authorizer: aws_iam
  deleteUser:
    handler: handlers/users/post/deleteUser.main
    role: LambdaApiRole
  updateUser:
    handler: handlers/users/post/updateUser.main
    role: LambdaApiRole
    events:
      - http:
          path: users/update/{userId}
          method: post
          cors: true
          authorizer: aws_iam
  getForm:
    handler: handlers/forms/get.main
    role: LambdaApiRole
    events:
      - http:
          path: single-form/{state}/{specifiedYear}/{quarter}/{form}
          method: get
          cors: true
          authorizer: aws_iam
  getStateFormList:
    handler: handlers/forms/post/obtainFormsList.main
    role: LambdaApiRole
    events:
      - http:
          path: forms/obtain-state-forms
          method: post
          cors: true
          authorizer: aws_iam
  updateStateFormList:
    handler: handlers/state-forms/post/updateStateForms.main
    role: LambdaApiRole
    events:
      - http:
          path: state-forms/update
          method: post
          cors: true
          authorizer: aws_iam
  generateEnrollmentTotals:
    handler: handlers/state-forms/post/generateEnrollmentTotals.main
    role: LambdaApiRole
    events:
      - http:
          path: generate-enrollment-totals
          method: post
          cors: true
          authorizer: aws_iam
          async: true
    timeout: 900
  obtainAvailableForms:
    handler: handlers/forms/post/obtainAvailableForms.main
    role: LambdaApiRole
    events:
      - http:
          path: forms/obtainAvailableForms
          method: post
          cors: true
          authorizer: aws_iam
  getFormTypes:
    handler: handlers/forms/get/getFormTypes.main
    role: LambdaApiRole
    events:
      - http:
          path: form-types
          method: get
          cors: true
          authorizer: aws_iam
  generateQuarterForms:
    handler: handlers/forms/post/generateQuarterForms.main
    role: LambdaApiRole
    events:
      - http:
          path: generate-forms
          method: post
          cors: true
          authorizer: aws_iam
    timeout: 900
  generateQuarterFormsOnSchedule:
    handler: handlers/forms/post/generateQuarterForms.scheduled
    role: LambdaApiRole
    events:
      - schedule:
          enabled: true
          rate: cron(0 0 1 JAN,APR,JUL,OCT ? *)
    timeout: 900
  #
  # NOTE: The SEDS business owners have requested that the email flow to users be disabled, but would like to be
  # able to re-enable it at a future point (see: https://bit.ly/3w3mVmT). For now, this handler will be commented out
  # and not removed.
  #
  # stateUsersEmail:
  #   handler: handlers/notification/stateUsers.main
  #   role: LambdaApiRole
  #   events:
  #     - http:
  #         path: notification/stateUsersEmail
  #         method: post
  #         cors: true
  #         authorizer: aws_iam
  #     - schedule:
  #         enabled: true
  #         rate: cron(0 0 1 */3 ? *)
  #
  # businessUsersEmail:
  #   handler: handlers/notification/businessUsers.main
  #   role: LambdaApiRole
  #   events:
  #     - http:
  #         path: notification/businessUsersEmail
  #         method: post
  #         cors: true
  #         authorizer: aws_iam
  #     - schedule:
  #         enabled: false
  #         rate: cron(0 0 1 */3 ? *)
  #
  # uncertified:
  #   handler: handlers/notification/uncertified.main
  #   role: LambdaApiRole
  #   events:
  #     - http:
  #         path: notification/uncertified
  #         method: post
  #         cors: true
  #         authorizer: aws_iam
  #
  saveForm:
    handler: handlers/forms/post/saveForm.main
    role: LambdaApiRole
    events:
      - http:
          path: single-form/save
          method: post
          cors: true
          authorizer: aws_iam
  getFormTemplate:
    handler: handlers/form-templates/post/obtainFormTemplate.main
    role: LambdaApiRole
    events:
      - http:
          path: form-template
          method: post
          cors: true
          authorizer: aws_iam
  getFormTemplateYears:
    handler: handlers/form-templates/post/obtainFormTemplateYears.main
    role: LambdaApiRole
    events:
      - http:
          path: form-templates/years
          method: post
          cors: true
          authorizer: aws_iam
  updateCreateFormTemplate:
    handler: handlers/form-templates/post/updateCreateFormTemplate.main
    role: LambdaApiRole
    events:
      - http:
          path: form-templates/add
          method: post
          cors: true
          authorizer: aws_iam

resources:
  Description: ${self:service} ${self:custom.stage}
  Conditions:
    CreatePermissionsBoundary:
      Fn::Not:
        - Fn::Equals:
            - ""
            - ${self:custom.iamPermissionsBoundaryPolicy}
  Resources:
    LambdaApiRole: # Why isn't this with the function as an iamRoleStatements?  https://github.com/serverless/serverless/issues/6485
      Type: "AWS::IAM::Role"
      Properties:
        AssumeRolePolicyDocument:
          Version: "2012-10-17"
          Statement:
            - Effect: "Allow"
              Principal:
                Service: "lambda.amazonaws.com"
              Action: "sts:AssumeRole"
        Path: ${self:custom.iamPath}
        PermissionsBoundary:
          Fn::If:
            - CreatePermissionsBoundary
            - !Sub arn:aws:iam::${AWS::AccountId}:policy${self:custom.iamPermissionsBoundaryPolicy}
            - !Ref AWS::NoValue
        ManagedPolicyArns:
          - arn:aws:iam::aws:policy/service-role/AWSLambdaVPCAccessExecutionRole
        Policies:
          - PolicyName: "LambdaApiRolePolicy"
            PolicyDocument:
              Version: "2012-10-17"
              Statement:
                - Effect: "Allow"
                  Action:
                    - logs:CreateLogGroup
                    - logs:CreateLogStream
                    - logs:PutLogEvents
                  Resource: "arn:aws:logs:*:*:*"
                - Effect: "Allow"
                  Action:
                    - dynamodb:DescribeTable
                    - dynamodb:Query
                    - dynamodb:Scan
                    - dynamodb:GetItem
                    - dynamodb:PutItem
                    - dynamodb:UpdateItem
                    - dynamodb:DeleteItem
                    - dynamodb:ListTables
                    - dynamodb:BatchWriteItem
                  Resource:
                    - ${self:custom.AgeRangesTableArn}
                    - ${self:custom.FormAnswersTableArn}
                    - ${self:custom.FormQuestionsTableArn}
                    - ${self:custom.FormsTableArn}
                    - ${self:custom.StateFormsTableArn}
                    - ${self:custom.StatesTableArn}
                    - ${self:custom.StatusTableArn}
                    - ${self:custom.AuthUserTableArn}
                    - ${self:custom.AuthUserRolesTableArn}
                    - ${self:custom.AuthUserStatesTableArn}
                    - ${self:custom.FormTemplatesTableArn}
                - Effect: "Allow"
                  Action:
                    - dynamodb:DescribeStream
                    - dynamodb:GetRecords
                    - dynamodb:GetShardIterator
                    - dynamodb:ListShards
                    - dynamodb:ListStreams
                  Resource:
                    - ${self:custom.AgeRangesTableStreamArn}
                    - ${self:custom.FormAnswersTableStreamArn}
                    - ${self:custom.FormQuestionsTableStreamArn}
                    - ${self:custom.FormsTableStreamArn}
                    - ${self:custom.StateTableStreamArn}
                    - ${self:custom.StateFormsTableStreamArn}
                    - ${self:custom.StatusTableStreamArn}
                    - ${self:custom.AuthUserTableStreamArn}
                    - ${self:custom.AuthUserRolesTableStreamArn}
                    - ${self:custom.AuthUserStatesTableStreamArn}
                    - ${self:custom.FormTemplatesTableStreamArn}
                    #- ${self:custom.AuthUserTableArn}
                    #- ${self:custom.StatusTableArn}
                    #- ${self:custom.AuthUserRolesTableArn}
                    #- ${self:custom.StatesTableArn}
                    #- ${self:custom.FormsTableArn}
                    #- ${self:custom.FormQuestionsTableArn}
                    #- ${self:custom.FormAnswersTableArn}
                    #- ${self:custom.AuthUserStatesTableArn}
                - Effect: "Allow"
                  Action:
                    - dynamodb:Query
                    - dynamodb:Scan
                  Resource:
                    - arn:aws:dynamodb:*:*:table/${self:custom.FormAnswersTableName}/index/*
                - Effect: "Allow"
                  Action:
                    - logs:CreateLogStream
                    - logs:CreateLogGroup
                  Resource: !Sub /arn:aws:execute-api:${AWS::Region}:${AWS::AccountId}:${ApiGatewayRestApi}
                - Effect: "Allow"
                  Action:
                    - cognito-idp:AdminGetUser
                  Resource: "*"
                - Effect: "Allow"
                  Action:
                    - ses:SendEmail
                    - ses:SendRawEmail
                  Resource: "*"
                - Effect: "Allow"
                  Action:
                    - lambda:InvokeFunction
                  Resource: "*"
                - Effect: "Allow"
                  Action:
                    - ssm:GetParameter
                  Resource: "*"
    KafkaSecurityGroup:
      Type: AWS::EC2::SecurityGroup
      Properties:
        GroupDescription: Security Group for streaming functions.  Egress all is set by default.
        VpcId: ${self:custom.vpcId}
    GatewayResponseDefault4XX:
      Type: "AWS::ApiGateway::GatewayResponse"
      Properties:
        ResponseParameters:
          gatewayresponse.header.Access-Control-Allow-Origin: "'*'"
          gatewayresponse.header.Access-Control-Allow-Headers: "'*'"
        ResponseType: DEFAULT_4XX
        RestApiId: !Ref ApiGatewayRestApi
    GatewayResponseDefault5XX:
      Type: "AWS::ApiGateway::GatewayResponse"
      Properties:
        ResponseParameters:
          gatewayresponse.header.Access-Control-Allow-Origin: "'*'"
          gatewayresponse.header.Access-Control-Allow-Headers: "'*'"
        ResponseType: DEFAULT_5XX
        RestApiId: !Ref ApiGatewayRestApi

  Outputs:
    ApiGatewayRestApiName:
      Value: !Ref ApiGatewayRestApi
    ApiGatewayRestApiUrl:
      Value: !Sub https://${ApiGatewayRestApi}.execute-api.${self:provider.region}.amazonaws.com/${self:custom.stage}
    Region:
      Value: !Sub ${AWS::Region}