chadkluck/serverless-webservice-template-for-pipeline-atlantis

3rd step and tutorial for creating AWS Serverless web services. A template for a API Gateway-Lambda function that is ready to be deployed using the serverless-deploy-pipeline-atlantis as the CI/CD. Utilizes built in caching using S3 and DynamoDb.

serverless-webservice-template-for-pipeline-atlantis's Issues

Stage stage shows up in API Gateway

There is an extra stage called Stage that shows up in API Gateway.

Add the following to Globals in the CF template:

Globals:

# [.......]

  Api:
    OpenApiVersion: 3.0.0 # Prevents extra stage called Stage in API Gateway https://www.internetkatta.com/how-to-prevent-aws-sam-from-creating-the-default-stage-in-api-gateway-stage

S3 Buckets should require requests to use Secure Socket Layer

Add a bucket policy for the App and Cache data storage:

# [...........]
# Place after the bucket definition

  # -- S3 Bucket Policy for Lambda App Data Storage --
  AppDataS3BucketPolicy:
    Type: AWS::S3::BucketPolicy
    Properties:
      Bucket: !Ref AppDataS3Bucket
      PolicyDocument:
        Statement:
              - Sid: "DenyNonSecureTransportAccess"
                Effect: Deny
                Principal: "*"
                Action: "s3:*"
                Resource:
                  - !GetAtt AppDataS3Bucket.Arn
                  - !Join [ '', [ !GetAtt AppDataS3Bucket.Arn, '/*' ] ]
                Condition:
                  Bool:
                    "aws:SecureTransport": false

Add npm audit and update Artifact section in buildspec

There is a way to run an npm audit for vulnerabilities and fail the deployment if there are vulnerable packages. This seems like a good thing to add to a template to make the application more secure.

  pre_build:
    commands:
      # Install dependencies needed for application
      - cd app
      - npm ci

      # Perform a fix to move us forward, then check to make sure there were no unresolved high fixes
      - npm audit fix --force
      - npm audit --audit-level=high
      
      - cd ..

      # Generate Key in SSM for cache
      - chmod a+x tools/generate-put-keys.sh
      - tools/generate-put-keys.sh $PARAM_STORE_PATH "256" $AWS_REGION $ACCOUNT_ID 

Since we are doing an install, we should bring those artifacts over with:

artifacts:
  files:
    - '**/*'
    # - template-export.yml
    # - template-configuration.json