serverless.yml

service: lambda-database-demo

provider:
  name: aws
  runtime: nodejs10.x
  memorySize: 256
  stage: dev
  region: us-east-1
  timeout: 30 # maximum value allowed by api gateway
  environment: ${file(./.env.yml)}
  vpc:
    securityGroupIds:
      - Ref: LambdaSecurityGroup
    subnetIds:
      - Ref: PrivateSubnet1
      - Ref: PrivateSubnet2
      - Ref: PrivateSubnet3

functions:
  app:
    handler: handler.app
    events:
      - http: 'ANY {proxy+}'

resources:
  Resources:
    Vpc:
      Type: AWS::EC2::VPC
      Properties: 
        CidrBlock: 10.0.0.0/16

    PrivateSubnet1:
      Type: AWS::EC2::Subnet
      Properties:
        AvailabilityZone: us-east-1a
        CidrBlock: 10.0.1.0/24
        VpcId: 
          Ref: Vpc
    PrivateSubnet2:
      Type: AWS::EC2::Subnet
      Properties:
        AvailabilityZone: us-east-1b
        CidrBlock: 10.0.2.0/24
        VpcId: 
          Ref: Vpc
    PrivateSubnet3:
      Type: AWS::EC2::Subnet
      Properties:
        AvailabilityZone: us-east-1c
        CidrBlock: 10.0.3.0/24
        VpcId: 
          Ref: Vpc

    PublicSubnet1:
      Type: AWS::EC2::Subnet
      Properties:
        AvailabilityZone: us-east-1d
        CidrBlock: 10.0.21.0/24
        VpcId: 
          Ref: Vpc

    LambdaSecurityGroup:
      Type: "AWS::EC2::SecurityGroup"
      Properties:
        GroupName: ${self:service}-${self:provider.stage}-lambda
        GroupDescription: Allow all outbound traffic, no inbound
        SecurityGroupIngress:
          - IpProtocol: -1
            CidrIp: 127.0.0.1/32
        VpcId: 
          Ref: Vpc

    DbSecurityGroup:
      Type: "AWS::EC2::SecurityGroup"
      Properties:
        GroupName: ${self:service}-${self:provider.stage}-db
        GroupDescription: Allow local inbound to port 5432, no outbound
        SecurityGroupIngress:
          - CidrIp: 10.0.0.0/16
            IpProtocol: tcp
            FromPort: 5432
            ToPort: 5432
        SecurityGroupEgress:
          - IpProtocol: -1
            CidrIp: 127.0.0.1/32
        VpcId: 
          Ref: Vpc
    DbSubnetGroup:
      Type: "AWS::RDS::DBSubnetGroup"
      Properties: 
        DBSubnetGroupName: ${self:service}-${self:provider.stage}
        DBSubnetGroupDescription: Private database subnet group
        SubnetIds:
          - Ref: PrivateSubnet1
          - Ref: PrivateSubnet2
          - Ref: PrivateSubnet3
    Database:
      Type: AWS::RDS::DBInstance
      Properties:
        DBInstanceIdentifier: ${self:service}-${self:provider.stage}
        Engine: postgres
        DBName: dbname
        AllocatedStorage: 20
        EngineVersion: 11.2
        DBInstanceClass: db.t3.micro
        MasterUsername: ${self:provider.environment.DATABASE_USERNAME}
        MasterUserPassword: ${self:provider.environment.DATABASE_PASSWORD}
        DBSubnetGroupName:
          Ref: DbSubnetGroup
        VPCSecurityGroups:
          - Ref: DbSecurityGroup

    Eip:
      Type: AWS::EC2::EIP
      Properties:
        Domain: vpc
    NatGateway:
      Type: AWS::EC2::NatGateway
      Properties:
        AllocationId:
          Fn::GetAtt:
            - Eip
            - AllocationId
        SubnetId:
          Ref: PublicSubnet1
    PrivateRouteTable:
      Type: AWS::EC2::RouteTable
      Properties:
        VpcId:
          Ref: Vpc
    PrivateRoute:
      Type: AWS::EC2::Route
      Properties:
        RouteTableId:
          Ref: PrivateRouteTable
        DestinationCidrBlock: 0.0.0.0/0
        NatGatewayId:
          Ref: NatGateway
    SubnetRouteTableAssociationPrivate1:
      Type: AWS::EC2::SubnetRouteTableAssociation
      Properties:
        SubnetId:
          Ref: PrivateSubnet1
        RouteTableId:
          Ref: PrivateRouteTable
    SubnetRouteTableAssociationPrivate2:
      Type: AWS::EC2::SubnetRouteTableAssociation
      Properties:
        SubnetId:
          Ref: PrivateSubnet2
        RouteTableId:
          Ref: PrivateRouteTable
    SubnetRouteTableAssociationPrivate3:
      Type: AWS::EC2::SubnetRouteTableAssociation
      Properties:
        SubnetId:
          Ref: PrivateSubnet3
        RouteTableId:
          Ref: PrivateRouteTable

    InternetGateway:
      Type: AWS::EC2::InternetGateway
    VPCGatewayAttachment:
      Type: AWS::EC2::VPCGatewayAttachment
      Properties:
        VpcId:
          Ref: Vpc
        InternetGatewayId:
          Ref: InternetGateway
    PublicRouteTable:
      Type: AWS::EC2::RouteTable
      Properties:
        VpcId:
          Ref: Vpc
    PublicRoute:
      Type: AWS::EC2::Route
      Properties:
        RouteTableId:
          Ref: PublicRouteTable
        DestinationCidrBlock: 0.0.0.0/0
        GatewayId:
          Ref: InternetGateway
    SubnetRouteTableAssociationPublic1:
      Type: AWS::EC2::SubnetRouteTableAssociation
      Properties:
        SubnetId:
          Ref: PublicSubnet1
        RouteTableId:
          Ref: PublicRouteTable