serverless.yml

service: notice-email-parser

provider:
  name: aws
  runtime: python3.8
  stage: prod
  iamRoleStatements:
    - Effect: Allow
      Action:
        - s3:*
      Resource: "arn:aws:s3:::${ssm:/${self:provider.stage}/lambda/notice-emails/s3/bucket~true}/*"
  environment:
    S3_BUCKET: ${ssm:/${self:provider.stage}/lambda/notice-emails/s3/bucket~true}
    SENTRY_DSN: ${ssm:/${self:provider.stage}/lambda/notice-emails/sentry/dsn~true}
  stackTags:
    project: city-scrapers
    environment: ${self:provider.stage}
  tags:
    project: city-scrapers
    environment: ${self:provider.stage}

functions:
  parse_notice_email:
    handler: handler.handler
    events:
      - s3:
          bucket: ${ssm:/${self:provider.stage}/lambda/notice-emails/s3/bucket~true}
          event: s3:ObjectCreated:*
          existing: true
          rules:
            - prefix: inbound/

resources:
  Resources:
    EmailBucketPermission:
      Type: AWS::S3::BucketPolicy
      Properties:
        Bucket: ${ssm:/${self:provider.stage}/lambda/notice-emails/s3/bucket~true}
        PolicyDocument:
          Statement:
            - Principal: "*"
              Action:
                - s3:GetObject
              Effect: Allow
              Sid: AllowPublicRead
              Resource: "arn:aws:s3:::${ssm:/${self:provider.stage}/lambda/notice-emails/s3/bucket~true}/*"
            - Principal:
                Service: "ses.amazonaws.com"
              Action:
                - s3:PutObject
              Effect: Allow
              Sid: "AllowSESPuts"
              Resource: "arn:aws:s3:::${ssm:/${self:provider.stage}/lambda/notice-emails/s3/bucket~true}/*"
              Condition:
                StringEquals:
                  "aws:Referer": { Ref: AWS::AccountId }
    EmailReceiptRule:
      Type: AWS::SES::ReceiptRule
      DependsOn:
        - EmailBucketPermission
      Properties:
        RuleSetName: ${ssm:/${self:provider.stage}/lambda/notice-emails/ses/ruleSetName~true}
        Rule:
          Name: ${self:service}-s3
          Enabled: true
          Recipients:
            - ${ssm:/${self:provider.stage}/lambda/notice-emails/ses/recipient~true}
          Actions:
            - S3Action:
                BucketName: ${ssm:/${self:provider.stage}/lambda/notice-emails/s3/bucket~true}
                ObjectKeyPrefix: inbound/