serverless.yml

service:
  name: shelvery

provider:
  name: aws
  runtime: python3.11
  iamRoleStatements:
    # read only ec2, rds
    - Effect: Allow
      Action:
        - 'ec2:Describe*'
        - 'rds:Describe*'
        - 'rds:ListTagsForResource'
      Resource: '*'
    # manage ebs snapshots and tags
    - Effect: Allow
      Action:
        - ec2:CreateSnapshot
        - ec2:ModifySnapshotAttribute
        - ec2:ResetSnapshotAttribute
        - ec2:DeleteSnapshot
        - ec2:DescribeTags
        - ec2:CreateTags
        - ec2:DeleteTags
        - ec2:CopySnapshot
      Resource: '*'
    # manage rds snaphosts and tags
    - Effect: Allow
      Action:
        - rds:ModifyDBSnapshotAttribute
        - rds:ModifyDBClusterSnapshotAttribute
        - rds:CopyDBSnapshot
        - rds:CopyDBClusterSnapshot
        - rds:DeleteDBSnapshot
        - rds:DeleteDBClusterSnapshot
        - rds:CreateDBSnapshot
        - rds:CreateDBClusterSnapshot
        - rds:AddTagsToResource
        - rds:RemoveTagsFromResource
      Resource: '*'
    - Effect: Allow
      Action:
        - 'lambda:Invoke*'
      Resource:
        'Fn::Join':
          - ''
          - - 'arn:aws:lambda:'
            - Ref: 'AWS::Region'
            - ':'
            - Ref: 'AWS::AccountId'
            - ':function:shelvery'
    # manage AMIs (limited)
    - Effect: Allow
      Action:
        - ec2:CopyImage
        - ec2:CreateImage
        - ec2:DeregisterImage
        - ec2:DescribeImageAttribute
        - ec2:DescribeImages
        - ec2:DescribeInstances
        - ec2:ModifyImageAttribute
        - ec2:DeleteSnapshot
      Resource: '*'
    - Effect: Allow
      Action:
        - s3:Get*
        - s3:List*
        - s3:CreateBucket
        - s3:PutBucketPolicy
        - s3:PutBucketAcl
        - s3:PutObject
        - s3:PutObjectAcl
        - s3:DeleteObject
      Resource: '*'
    - Effect: Allow
      Action:
        - sns:Publish*
      Resource: '*'

package:
  include:
    - shelvery/*
    - shelvery_lambda/*
  exclude:
    - shelvery_cli/*
    - tests/**
    - build/**
    - dist/**
    - Jenkinsfile
    - nosetests.xml
    - setup.py
    - shelvery.egg-info/**
  excludeDevDependencies: true

functions:
  shelvery:
    handler: shelvery_lambda/lambda_handler.lambda_handler
    name: shelvery
    runtime: python3.11
    timeout: 300
    events:

      ## Create backups schedule

      # create buckets
      - schedule:
          rate: "cron(0 0 ? * * *)"
          enabled: true
          input:
            backup_type: ebs
            action: create_data_buckets
      # create ebs
      - schedule:
          rate: "cron(0 1 ? * * *)"
          enabled: true
          input:
            backup_type: ebs
            action: create_backups
      # create rds
      - schedule:
          rate: "cron(0 1 ? * * *)"
          enabled: true
          input:
            backup_type: rds
            action: create_backups
      # create rds cluster
      - schedule:
          rate: "cron(0 1 ? * * *)"
          enabled: true
          input:
            backup_type: rds_cluster
            action: create_backups
      # create ec2 amis
      - schedule:
          rate: "cron(0 1 ? * * *)"
          enabled: true
          input:
            backup_type: ec2ami
            action: create_backups

      ## Clean backups schedule ##

      # clean ebs
      - schedule:
          rate: "cron(0 2 ? * * *)"
          enabled: true
          input:
            backup_type: ebs
            action: clean_backups
      # clean rds
      - schedule:
          rate: "cron(0 2 ? * * *)"
          enabled: true
          input:
            backup_type: rds
            action: clean_backups
      # clean rds cluster
      - schedule:
          rate: "cron(0 2 ? * * *)"
          enabled: true
          input:
            backup_type: rds_cluster
            action: clean_backups
      # clean amis
      - schedule:
          rate: "cron(0 2 ? * * *)"
          enabled: true
          input:
            backup_type: ec2ami
            action: clean_backups

      ### Pull shared backups ####

      # pull ebs
      - schedule:
          rate: "cron(0 2 ? * * *)"
          enabled: true
          input:
            backup_type: ebs
            action: pull_shared_backups
      # pull rds
      - schedule:
          rate: "cron(0 2 ? * * *)"
          enabled: true
          input:
            backup_type: rds
            action: pull_shared_backups
      # pull rds cluster
      - schedule:
          rate: "cron(0 2 ? * * *)"
          enabled: true
          input:
            backup_type: rds_cluster
            action: pull_shared_backups
      # pull amis
      - schedule:
          rate: "cron(0 2 ? * * *)"
          enabled: true
          input:
            backup_type: ec2ami
            action: pull_shared_backups
    environment:
      shelvery_keep_daily_backups: ${env:shelvery_keep_daily_backups,'14'}
      shelvery_keep_weekly_backups: ${env:shelvery_keep_weekly_backups,'8'}
      shelvery_keep_monthly_backups: ${env:shelvery_keep_monthly_backups,'12'}
      shelvery_keep_yearly_backups: ${env:shelvery_keep_yearly_backups,'10'}
      shelvery_dr_regions: ${env:shelvery_dr_regions,''}
      shelvery_share_aws_account_ids: ${env:shelvery_share_aws_account_ids,''}
      shelvery_source_aws_account_ids: ${env:shelvery_source_aws_account_ids,''}
      shelvery_rds_backup_mode: ${env:shelvery_rds_backup_mode,'RDS_COPY_AUTOMATED_SNAPSHOT'}