cognito-to-dynamodb-lambda/serverless.yml at master · vbudilov/cognito-to-dynamodb-lambda · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
service: syncService

custom:
  myRegion: us-east-1
  myDDB: Users
  myPool: my-userpool-name

provider:
  name: aws
  runtime: nodejs8.10

functions:
  UserOnboardingLambda:
    handler: cognitoToDDB.handler
    events:
      - cognitoUserPool:
          pool: ${self:custom.myPool}
          trigger: PostConfirmation
          existing: true
    role: CustomUserOnboardingRole
    environment:
      TABLE_NAME: ${self:custom.myDDB}
      REGION: ${self:custom.myRegion}

resources:
  Resources:
    CustomUserOnboardingRole:
      Type: AWS::IAM::Role
      Properties:
        RoleName: CustomUserOnboardingRole
        AssumeRolePolicyDocument:
          Version: '2012-10-17'
          Statement:
            - Effect: Allow
              Principal:
                Service:
                  - lambda.amazonaws.com
              Action: sts:AssumeRole
        Policies:
          - PolicyName: CustomCloudWatchLogsPolicy
            PolicyDocument:
              Version: '2012-10-17'
              Statement:
                - Effect: Allow
                  Action:
                    - logs:CreateLogGroup
                    - logs:CreateLogStream
                    - logs:PutLogEvents
                  Resource:
                    - 'Fn::Join':
                      - ':'
                      -
                        - 'arn:aws:logs'
                        - Ref: 'AWS::Region'
                        - Ref: 'AWS::AccountId'
                        - 'log-group:/aws/lambda/*:*:*'
          - PolicyName: CustomUserOnboardingPolicy
            PolicyDocument:
              Version: '2012-10-17'
              Statement:
                - Effect: Allow
                  Action:
                    - dynamodb:PutItem
                  Resource:
                    - 'Fn::Join':
                      - ':'
                      -
                        - 'arn:aws:dynamodb'
                        - Ref: 'AWS::Region'
                        - Ref: 'AWS::AccountId'
                        - 'table/${self:custom.myDDB}'