serverless.yml

service: bitwarden-serverless

custom:
  # When using the `prod` environment the DynamoDB tables will not be
  # delete when removing the Cloudformation stack. It's better to risk
  # having a forgotten table running than losing data
  tableDeletionPolicy:
    prod: Retain
    other: Delete

  default_cors: &default_cors
    cors:
      origin: "*"
      headers:
        - Content-Type
        - Authorization
        - Accept
        # Special serverless header being sent
        - Device-type
        - Pragma
        - Cache-Control
      allowMethods: "GET, POST, OPTIONS, PUT, DELETE"

plugins:
  - serverless-webpack
  - serverless-offline

provider:
  name: aws
  stage: ${opt:stage, 'prod'}
  runtime: nodejs10.x
  memorySize: 256
  timeout: 10
  logs:
    restApi: true
  environment:
    DEVICES_TABLE: ${self:service}-${self:provider.stage}-devices
    USERS_TABLE: ${self:service}-${self:provider.stage}-users
    CIPHERS_TABLE: ${self:service}-${self:provider.stage}-ciphers
    FOLDERS_TABLE: ${self:service}-${self:provider.stage}-folders
  iamRoleStatements:
    - Effect: Allow
      Action:
        - dynamodb:Query
        - dynamodb:Scan
        - dynamodb:GetItem
        - dynamodb:PutItem
        - dynamodb:UpdateItem
        - dynamodb:DeleteItem
      Resource:
        - "arn:aws:dynamodb:${opt:region, self:provider.region}:*:table/${self:provider.environment.DEVICES_TABLE}"
        - "arn:aws:dynamodb:${opt:region, self:provider.region}:*:table/${self:provider.environment.USERS_TABLE}"
        - "arn:aws:dynamodb:${opt:region, self:provider.region}:*:table/${self:provider.environment.CIPHERS_TABLE}"
        - "arn:aws:dynamodb:${opt:region, self:provider.region}:*:table/${self:provider.environment.FOLDERS_TABLE}"
  usagePlan:
    throttle:
      burstLimit: 300 # request burst
      rateLimit: 5 # requests per second



functions:
  # Identity endpoints

  login:
    handler: src/login.handler
    events:
      - http:
          method: post
          <<: *default_cors
          path: identity/connect/token

  # Accounts endpoints

  prelogin:
    handler: src/prelogin.handler
    events:
      - http:
          method: post
          <<: *default_cors
          path: api/accounts/prelogin
  profile:
    handler: src/accounts.profileHandler
    events:
      - http:
          method: get
          <<: *default_cors
          path: api/accounts/profile
  profile_put:
    handler: src/accounts.putProfileHandler
    events:
      - http:
          method: put
          <<: *default_cors
          path: api/accounts/profile
  keys:
    handler: src/keys.handler
    events:
      - http:
          method: post
          <<: *default_cors
          path: api/accounts/keys
  register:
    handler: src/register.handler
    environment:
      DISABLE_USER_REGISTRATION: ${env:DISABLE_USER_REGISTRATION, 'false'}
    events:
      - http:
          method: post
          <<: *default_cors
          path: api/accounts/register
  accounts_revision_date:
    handler: src/accounts.revisionDateHandler
    events:
      - http:
          method: get
          <<: *default_cors
          path: api/accounts/revision-date
  device_push_token:
    handler: src/accounts.pushTokenHandler
    events:
      - http:
          method: put
          <<: *default_cors
          path: api/devices/identifier/{uuid}/token

  # Other endpoints, ciphers and data

  sync:
    handler: src/sync.handler
    events:
      - http:
          method: get
          <<: *default_cors
          path: api/sync
  cipher_post:
    handler: src/ciphers.postHandler
    events:
      - http:
          method: post
          <<: *default_cors
          path: api/ciphers
  cipher_put:
    handler: src/ciphers.putHandler
    events:
      - http:
          method: put
          <<: *default_cors
          path: api/ciphers/{uuid}
  cipher_delete:
    handler: src/ciphers.deleteHandler
    events:
      - http:
          method: delete
          <<: *default_cors
          path: api/ciphers/{uuid}
  folder_post:
    handler: src/folders.postHandler
    events:
      - http:
          method: post
          <<: *default_cors
          path: api/folders
  folder_put:
    handler: src/folders.putHandler
    events:
      - http:
          method: put
          <<: *default_cors
          path: api/folders/{uuid}
  folder_delete:
    handler: src/folders.deleteHandler
    events:
      - http:
          method: delete
          <<: *default_cors
          path: api/folders/{uuid}
  migrate:
    handler: src/migrate.migrateHandler
    timeout: 300
    memorySize: 1024
  two_factor_setup:
    handler: src/two_factor.setupHandler
  two_factor_complete:
    handler: src/two_factor.completeHandler
  import:
    handler: src/import.postHandler
    timeout: 30
    events:
      - http:
          method: post
          <<: *default_cors
          path: /api/ciphers/import
  icons:
    handler: src/icons.handler
    events:
      - http:
          method: get
          path: /icons/{domain}/icon.png
  default:
    handler: src/default.handler
    events:
      - http:
          method: any
          <<: *default_cors
          path: /{fallback+}



resources:
  Resources:
    UsersTable:
      Type: AWS::DynamoDB::Table
      DeletionPolicy: ${self:custom.tableDeletionPolicy.${self:provider.stage}, self:custom.tableDeletionPolicy.other}
      Properties:
        TableName: ${self:provider.environment.USERS_TABLE}
        AttributeDefinitions:
          - AttributeName: uuid
            AttributeType: S
        KeySchema:
          - AttributeName: uuid
            KeyType: HASH
        ProvisionedThroughput:
          ReadCapacityUnits: 1
          WriteCapacityUnits: 1
        PointInTimeRecoverySpecification:
          PointInTimeRecoveryEnabled: true
    DevicesTable:
      Type: AWS::DynamoDB::Table
      DeletionPolicy: ${self:custom.tableDeletionPolicy.${self:provider.stage}, self:custom.tableDeletionPolicy.other}
      Properties:
        TableName: ${self:provider.environment.DEVICES_TABLE}
        AttributeDefinitions:
          - AttributeName: uuid
            AttributeType: S
        KeySchema:
          - AttributeName: uuid
            KeyType: HASH
        ProvisionedThroughput:
          ReadCapacityUnits: 1
          WriteCapacityUnits: 1
        PointInTimeRecoverySpecification:
          PointInTimeRecoveryEnabled: true
    CiphersTable:
      Type: AWS::DynamoDB::Table
      DeletionPolicy: ${self:custom.tableDeletionPolicy.${self:provider.stage}, self:custom.tableDeletionPolicy.other}
      Properties:
        TableName: ${self:provider.environment.CIPHERS_TABLE}
        AttributeDefinitions:
          - AttributeName: userUuid
            AttributeType: S
          - AttributeName: uuid
            AttributeType: S
        KeySchema:
          - AttributeName: userUuid
            KeyType: HASH
          - AttributeName: uuid
            KeyType: RANGE
        ProvisionedThroughput:
          ReadCapacityUnits: 1
          WriteCapacityUnits: 3
        PointInTimeRecoverySpecification:
          PointInTimeRecoveryEnabled: true
    FoldersTable:
      Type: AWS::DynamoDB::Table
      DeletionPolicy: ${self:custom.tableDeletionPolicy.${self:provider.stage}, self:custom.tableDeletionPolicy.other}
      Properties:
        TableName: ${self:provider.environment.FOLDERS_TABLE}
        AttributeDefinitions:
          - AttributeName: userUuid
            AttributeType: S
          - AttributeName: uuid
            AttributeType: S
        KeySchema:
          - AttributeName: userUuid
            KeyType: HASH
          - AttributeName: uuid
            KeyType: RANGE
        ProvisionedThroughput:
          ReadCapacityUnits: 1
          WriteCapacityUnits: 1
        PointInTimeRecoverySpecification:
          PointInTimeRecoveryEnabled: true