serverless.yml

service: auto-cleanup

custom:
  company: servian # change to your company name
  log_level: INFO # DEBUG for dev | INFO for prod
  region: ${opt:region, "ap-southeast-2"} # AWS deployment region
  pythonRequirements: # allows us to deploy a newer version of boto3
    noDeploy:
      [
        "docutils",
        "jmespath",
        "python-dateutil",
        "s3transfer",
        "six",
        "pip",
        "setuptools",
      ]
  remover:
    prompt: false
    buckets:
      - ${self:service}-${self:provider.stage}-resourcetreebucket-${self:custom.company}

provider:
  name: aws
  runtime: python3.7
  stage: ${opt:stage, "prod"} # Override via CLI "--stage dev"
  region: ${self:custom.region}
  profile: ${opt:profile, ""} # Override via CLI "--aws-profile saml"
  environment:
    PYTHONPATH: "/var/task/auto_cleanup:/var/task/boto3:/var/task/botocore:/var/task/dynamodb_json:/var/task/simplejson:/var/task/treelib:/var/runtime"
  iamRoleStatements:
    - Effect: Allow
      Action:
        - cloudformation:DeleteStack
        - cloudformation:DescribeStacks
      Resource: "*"
    - Effect: Allow
      Action:
        - dynamodb:BatchWriteItem
        - dynamodb:DeleteTable
        - dynamodb:DescribeTable
        - dynamodb:GetItem
        - dynamodb:ListTables
        - dynamodb:PutItem
        - dynamodb:Scan
      Resource: "*"
    - Effect: Allow
      Action:
        - ec2:DeleteSecurityGroup
        - ec2:DeleteSnapshot
        - ec2:DeleteVolume
        - ec2:DescribeAddresses
        - ec2:DescribeImages
        - ec2:DescribeInstanceAttribute
        - ec2:DescribeInstances
        - ec2:DescribeSecurityGroups
        - ec2:DescribeSnapshots
        - ec2:DescribeVolumes
        - ec2:DescribeVolumes
        - ec2:ModifyInstanceAttribute
        - ec2:ReleaseAddress
        - ec2:StopInstances
        - ec2:TerminateInstances
      Resource: "*"
    - Effect: Allow
      Action:
        - elasticbeanstalk:DeleteApplication
        - elasticbeanstalk:DescribeApplications
      Resource: "*"
    - Effect: Allow
      Action:
        - elasticmapreduce:ListClusters
        - elasticmapreduce:TerminateJobFlows
      Resource: "*"
    - Effect: Allow
      Action:
        - iam:DeleteInstanceProfile
        - iam:DeleteRole
        - iam:DeleteRolePolicy
        - iam:DetachRolePolicy
        - iam:GenerateServiceLastAccessedDetails
        - iam:GetServiceLastAccessedDetails
        - iam:ListAttachedRolePolicies
        - iam:ListInstanceProfilesForRole
        - iam:ListRolePolicies
        - iam:ListRoles
        - iam:RemoveRoleFromInstanceProfile
      Resource: "*"
    - Effect: Allow
      Action:
        - lambda:DeleteFunction
        - lambda:ListFunctions
      Resource: "*"
    - Effect: Allow
      Action:
        - redshift:DeleteCluster
        - redshift:DeleteClusterSnapshot
        - redshift:DescribeClusterSnapshots
        - redshift:DescribeClusters
      Resource: "*"
    - Effect: Allow
      Action:
        - rds:DeleteDBInstance
        - rds:DeleteDBSnapshot
        - rds:DescribeDBInstances
        - rds:DescribeDBSnapshots
        - rds:ModifyDBInstance
      Resource: "*"
    - Effect: Allow
      Action:
        - s3:DeleteBucket
        - s3:DeleteObject
        - s3:DeleteObjectVersion
        - s3:List*
        - s3:PutObject
      Resource: "*"
  tracing:
    lambda: true

package:
  individually: true
  exclude:
    - node_modules/**

functions:
  AutoCleanup:
    handler: auto_cleanup.lambda_handler.lambda_handler
    name: ${self:service}-${self:provider.stage}
    description: Auto Cleanup removes unused AWS resources
    memorySize: 128
    timeout: 300
    package:
      include:
        - auto-cleanup/**
        - data/**
        - dynamodb_json/**
        - simplejson/**
        - treelib/**
    environment:
      LOGLEVEL: INFO # change to DEBUG for testing
      RESOURCETREEBUCKET: ${self:service}-${self:provider.stage}-resourcetreebucket-${self:custom.company}
      SETTINGSTABLE: ${self:service}-settings-${self:provider.stage}
      WHITELISTTABLE: ${self:service}-whitelist-${self:provider.stage}
    events:
      - schedule:
          rate: rate(3 days)
          enabled: true

resources:
  Resources:
    SettingsTable:
      Type: AWS::DynamoDB::Table
      Properties:
        TableName: ${self:service}-settings-${self:provider.stage}
        AttributeDefinitions:
          - AttributeName: key
            AttributeType: S
        KeySchema:
          - AttributeName: key
            KeyType: HASH
        ProvisionedThroughput:
          ReadCapacityUnits: 1
          WriteCapacityUnits: 1
    WhitelistTable:
      Type: AWS::DynamoDB::Table
      Properties:
        TableName: ${self:service}-whitelist-${self:provider.stage}
        AttributeDefinitions:
          - AttributeName: resource_id
            AttributeType: S
          - AttributeName: expire_at
            AttributeType: N
        KeySchema:
          - AttributeName: resource_id
            KeyType: HASH
          - AttributeName: expire_at
            KeyType: RANGE
        TimeToLiveSpecification:
          AttributeName: expire_at
          Enabled: true
        ProvisionedThroughput:
          ReadCapacityUnits: 1
          WriteCapacityUnits: 1
    ResourceTreeBuckett:
      Type: AWS::S3::Bucket
      Properties:
        BucketName: ${self:service}-${self:provider.stage}-resourcetreebucket-${self:custom.company}

plugins:
  - serverless-python-requirements
  - serverless-s3-remover