serverless.yml

service: ${env:NAME}

plugins:
 - serverless-pseudo-parameters
 - serverless-iam-roles-per-function

provider:
  name: aws
  runtime: nodejs6.10
  stage: dev
  region: {env:REGION}
  versionFunctions: true

functions:
  ship-logs:
    handler: functions/ship-logs/handler.handler
    description: Sends CloudWatch logs to Logz.io
    memorySize: 128
    environment:
      logstash_host: ${env:LOGSTASH_HOST}
      logstash_port: ${env:LOGSTASH_PORT}
      ssm_logz_io_token_key: ${env:SSM_LOGZ_IO_TOKEN_KEY}
    iamRoleStatements:
      - Effect: "Allow"
        Action:
          - "ssm:GetParameters"
          - "ssm:GetParameter"
        Resource: "arn:aws:ssm:#{AWS::Region}:#{AWS::AccountId}:parameter/*"
      - Effect: "Allow"
        Action:
         - "kms:DescribeKey"
         - "kms:Decrypt"
        Resource: "*"

  set-retention:
    handler: functions/set-retention/handler.handler
    description: Sets the log retention policy to the specified no. of days
    memorySize: 128
    environment:
      retention_days: ${env:RETENTION_DAYS}
    iamRoleStatements:
      - Effect: "Allow"
        Action:
          - "logs:PutRetentionPolicy"
        Resource: "*"
    events:
      - cloudwatchEvent:
          event:
            source:
              - aws.logs
            detail-type:
              - AWS API Call via CloudTrail
            detail:
              eventSource:
                - logs.amazonaws.com
              eventName:
                - CreateLogGroup

  subscribe:
    handler: functions/subscribe/handler.handler
    description: Subscribe logs to the ship-logs function
    memorySize: 128
    environment:
      dest_func: "${self:service}-${self:provider.stage}-ship-logs"
      account_id: "#{AWS::AccountId}"
      prefixes: ${env:CLOUDWATCH_LOGS_PREFIXES}
    iamRoleStatements:
      - Effect: "Allow"
        Action:
          - "logs:PutSubscriptionFilter"
        Resource: "*"
    events:
      - cloudwatchEvent:
          event:
            source:
              - aws.logs
            detail-type:
              - AWS API Call via CloudTrail
            detail:
              eventSource:
                - logs.amazonaws.com
              eventName:
                - CreateLogGroup

resources:
  Resources:
    LambdaInvokePermission:
      Type: AWS::Lambda::Permission
      Properties:
        Action: lambda:InvokeFunction
        FunctionName:
          Fn::Join:
            - ""
            - - "Ref" : "ShipDashlogsLambdaFunction"
        Principal: logs.#{AWS::Region}.amazonaws.com