template.yaml

AWSTemplateFormatVersion: '2010-09-09'
Transform: AWS::Serverless-2016-10-31
Description: >
  A simple AWS Lambda implementing CRUD over NewsItems

Globals:
  Api:
    TracingEnabled: true
    Cors:
      AllowOrigin: "'*'"
      AllowHeaders: "'Content-Type'"
      MaxAge: "'300'"
    BinaryMediaTypes: # see Binary responses section
      - "*~1*" # converts to */* for any binary type
  Function:
    Timeout: 5
    Layers: #
      - !Sub arn:aws:lambda:${AWS::Region}:017000801446:layer:AWSLambdaPowertoolsPython:29

Resources:
  NewsCRUDFunction:
    Type: AWS::Serverless::Function # More info about Function Resource: https:l//github.com/awslabs/serverless-application-model/blob/master/versions/2016-10-31.md#awsserverlessfunction
    Properties:
      Role: !GetAtt NewsCRUDFunctionIamRole.Arn
      CodeUri: news_api/
      Handler: app.lambda_handler
      Runtime: python3.9
      Architectures:
        - x86_64
      Events:
        NewsList:
          Type: Api
          Properties:
            Path: /news
            Method: get
        NewsAdd:
          Type: Api
          Properties:
            Path: /newsitem
            Method: post
      VpcConfig:
        SecurityGroupIds:
          - sg-07e896e930f4faaf8
        SubnetIds:
          - subnet-0ea454e1c9763475e
          - subnet-0db7b016948f4bab7
          - subnet-0f46ac4997897811f
  NewsCRUDFunctionIamRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - lambda.amazonaws.com
            Action:
              - sts:AssumeRole
      Path: "/"
      Policies:
        - PolicyName: root
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Effect: Allow
                Action:
                  - "secretsmanager:GetResourcePolicy"
                  - "secretsmanager:GetSecretValue"
                  - "secretsmanager:DescribeSecret"
                  - "secretsmanager:ListSecretVersionIds"
                Resource: arn:aws:secretsmanager:eu-west-2:159421668328:secret:documentDB-d3KKGq
              - "Effect": "Allow"
                "Action": "secretsmanager:ListSecrets"
                "Resource": "*"
Outputs:
  NewsCRUDApi:
    Description: "API Gateway endpoint URL for Prod stage for News CRUD function"
    Value: !Sub "https://${ServerlessRestApi}.execute-api.${AWS::Region}.amazonaws.com/Prod/"
  NewsCRUDFunction:
    Description: "News CRUD Lambda Function ARN"
    Value: !GetAtt NewsCRUDFunction.Arn
  NewsCRUDFunctionIamRole:
    Description: "Implicit IAM Role created for News CRUD function"
    Value: !GetAtt NewsCRUDFunctionIamRole.Arn