service: aws-ai-website-generator
frameworkVersion: '3'
provider:
name: aws
runtime: python3.9
region: us-east-1
stage: ${opt:stage, 'dev'}
timeout: 60
memorySize: 1024
environment:
S3_BUCKET: ${self:custom.bucketName}
DYNAMODB_TABLE: ${self:custom.tableName}
OPENAI_API_KEY: ${env:OPENAI_API_KEY}
SES_FROM_EMAIL: ${env:SES_FROM_EMAIL, ''}
iam:
role:
statements:
# S3 Permissions
- Effect: Allow
Action:
- s3:GetObject
- s3:PutObject
- s3:DeleteObject
- s3:ListBucket
Resource:
- arn:aws:s3:::${self:custom.bucketName}
- arn:aws:s3:::${self:custom.bucketName}/*
# DynamoDB Permissions
- Effect: Allow
Action:
- dynamodb:GetItem
- dynamodb:PutItem
- dynamodb:UpdateItem
- dynamodb:DeleteItem
- dynamodb:Scan
- dynamodb:Query
Resource:
- arn:aws:dynamodb:${self:provider.region}:*:table/$
{self:custom.tableName}
# Bedrock Permissions
- Effect: Allow
Action:
- bedrock:InvokeModel
Resource:
-
arn:aws:bedrock:${self:provider.region}::foundation-model/anthropic.claude-3-
sonnet-20240229-v1:0
-
arn:aws:bedrock:${self:provider.region}::foundation-model/anthropic.claude-3-haiku-
20240307-v1:0
# SES Permissions
- Effect: Allow
Action:
- ses:SendEmail
- ses:SendRawEmail
Resource: "*"
# CloudWatch Permissions
- Effect: Allow
Action:
- cloudwatch:PutMetricData
- logs:CreateLogGroup
- logs:CreateLogStream
- logs:PutLogEvents
Resource: "*"
# Rekognition Permissions (optional)
- Effect: Allow
Action:
- rekognition:DetectText
- rekognition:DetectLabels
Resource: "*"
custom:
bucketName: ai-website-generator-${self:provider.stage}-${self:provider.region}
tableName: ai-website-generator-${self:provider.stage}
pythonRequirements:
dockerizePip: non-linux
layer: true
functions:
app:
handler: lambda_function.lambda_handler
layers:
- {Ref: PythonRequirementsLambdaLayer}
events:
- http:
path: /
method: get
cors: true
- http:
path: /upload
method: post
cors: true
- http:
path: /preview
method: get
cors: true
- http:
path: /save
method: post
cors: true
- http:
path: /health
method: get
cors: true
environment:
PYTHONPATH: /var/runtime:/var/task:/opt/python
resources:
Resources:
# S3 Bucket
S3Bucket:
Type: AWS::S3::Bucket
Properties:
BucketName: ${self:custom.bucketName}
CorsConfiguration:
CorsRules:
- AllowedHeaders:
- "*"
AllowedMethods:
- GET
- PUT
- POST
- DELETE
AllowedOrigins:
- "*"
MaxAge: 3000
PublicAccessBlockConfiguration:
BlockPublicAcls: false
BlockPublicPolicy: false
IgnorePublicAcls: false
RestrictPublicBuckets: false
NotificationConfiguration:
CloudWatchConfigurations:
- Event: s3:ObjectCreated:*
CloudWatchConfiguration:
LogGroupName: /aws/s3/${self:custom.bucketName}
# S3 Bucket Policy
S3BucketPolicy:
Type: AWS::S3::BucketPolicy
Properties:
Bucket: !Ref S3Bucket
PolicyDocument:
Statement:
- Sid: PublicReadGetObject
Effect: Allow
Principal: "*"
Action: s3:GetObject
Resource: !Sub "${S3Bucket}/generated/*"
# DynamoDB Table
DynamoDBTable:
Type: AWS::DynamoDB::Table
