Solid Serverless

This guide is a step-by-step allowing to manually setup a fully working YoData Solid Serverless stack in AWS.

This guide will use example.org as "Base Domain" and other names with a placeholder intent.

Any path starting with repo:/ indicates paths relative to the folder where this repository is stored. Example: If the repository was cloned at /home/user/repo and for repo:/src/, the actual path would be /home/user/repo/src/.

The reader is expected to:

Adapt the various names/labels to whatever naming policy is used in your environment.
Use the same names for the same entities or their references while following this guide.
Replace hostnames accordingly to their environment. Only wildcards represented by * are expected to remain.

This guide will only give instructions and/or values for relevant fields/options. If an available option is not documented, its default value should not be changed. If a value is mandatory, it is left to the reader discretion.

Requirements

Requirements not directly related to the stack, like TLS certificates for the Load-balancer are considered out of scope as they directly depend on the target infrastructure itself rather than being specific to this stack.

The following is expected to be set up and/or available on your local machine before following this guide:

A working developer docker environment, from the Developer guide.
All command line commands listed in this guide must run in that environment.

The following is expected to be set up and/or available in AWS before following this guide:

A VPC for the various services. This can be the default or a dedicated one and is left at the discretion of the reader.
A valid TLS certificate in ACM with subject names:
- example.org
- *.example.org
AWS default policies:
- AmazonS3ReadOnlyAccess
- AmazonSQSReadOnlyAccess
- AWSLambdaBasicExecutionRole
- AWSLambdaSQSQueueExecutionRole

IAM

The following steps happen in the IAM view.

Policies

This section describes new policies to be created.

For each section:

Section name is the suggested policy name
First bullet point level is the AWS service
Second bullet point level are the actions to be allowed on the AWS service

LambdaInvokeOnly

Lamba
- InvokeFunction
- InvokeAsync

JSON equivalent:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "lambda:InvokeFunction",
                "lambda:InvokeAsync"
            ],
            "Resource": "*"
        }
    ]
}

SQSSendMessageOnly

SQS
- SendMessage
- SendMessageBatch

JSON equivalent:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "sqs:SendMessageBatch",
                "sqs:SendMessage"
            ],
            "Resource": "*"
        }
    ]
}

SNSPublishOnly

SNS
- Publish

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": "sns:Publish",
            "Resource": "*"
        }
    ]
}

S3WriteOnly

S3
- DeleteObject
- PutObject

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "s3:PutObject",
                "s3:DeleteObject"
            ],
            "Resource": "*"
        }
    ]
}

Roles

The following new roles are to be created:

Front API ECS task

Service: Elastic Container Service
Use case: Elastic Container Service Task
Policies to be applied:
- LambdaInvokeOnly
- SNSPublishOnly
- AmazonS3ReadOnlyAccess
- S3WriteOnly
Name: solid-server-api-front

Store events Lambda processor

Service: Lambda
Use case: Lambda
Policies to be applied:
- AWSLambdaSQSQueueExecutionRole
- AmazonS3ReadOnlyAccess
- LambdaInvokeOnly
- S3WriteOnly
- SNSPublishOnly
- SQSSendMessageOnly
Name: solid-server-store-event-processor

Inbox Lambda processor

Service: Lambda
Use case: Lambda
Policies to be applied:
- AmazonS3ReadOnlyAccess
- AWSLambdaSQSQueueExecutionRole
- LambdaInvokeOnly
- S3WriteOnly
- SNSPublishOnly
Name: solid-server-inbox-processor

Outbox Lambda processor

Service: Lambda
Use case: Lambda
Policies to be applied:
- AWSLambdaSQSQueueExecutionRole
- AmazonS3ReadOnlyAccess
- LambdaInvokeOnly
- S3WriteOnly
- SNSPublishOnly
Name: solid-server-outbox-processor

Profile Processor

Service: Lambda
Use case: Lambda
Policies to be applied:
- AWSLambdaSQSQueueExecutionRole
- AmazonS3ReadOnlyAccess
- LambdaInvokeOnly
- S3WriteOnly
- SNSPublishOnly
Name: solid-server-profile-processor

Push Processor

Service: Lambda
Use case: Lambda
Policies to be applied:
- AWSLambdaSQSQueueExecutionRole
- AmazonS3ReadOnlyAccess
- LambdaInvokeOnly
- S3WriteOnly
- SNSPublishOnly
Name: solid-server-push-processor

Publish Processor

Service: Lambda
Use case: Lambda
Policies to be applied:
- AWSLambdaSQSQueueExecutionRole
- AmazonS3ReadOnlyAccess
- LambdaInvokeOnly
- S3WriteOnly
- SNSPublishOnly
Name: solid-server-publish-processor

SNS

Create a new topic for the store events, consumed by the Subscription Manager:

Topic name: solid-server-store-events