serverless-sender.yml

service: cross-account-eventbridge
frameworkVersion: '2'

plugins:
  - serverless-offline
  - serverless-dotenv-plugin

custom:
  receiverAccountEventBusArn: "arn:aws:events:${env:REGION}:${env:RECEIVER_AWS_ACCOUNT_ID}:event-bus/${env:RECEIVER_BUS_NAME}"
  senderAccountEventBusArn: "arn:aws:events:${env:REGION}:${env:SENDER_AWS_ACCOUNT_ID}:event-bus/${env:SENDER_BUS_NAME}"

provider:
  name: aws
  runtime: nodejs12.x
  lambdaHashingVersion: 20201221
  stage: dev
  region: ${env:REGION}
  profile: ${env:SENDER_AWS_PROFILE}
  iam:
    role:
      managedPolicies:
        - "arn:aws:iam::aws:policy/AWSLambda_FullAccess"
      statements:
        - Effect: "Allow"
          Action:
            - events:*
          Resource:
            - "Fn::GetAtt": [ EventBus, Arn ]
        - Effect: Allow
          Action:
            - dynamodb:GetItem
            - dynamodb:PutItem
          Resource:
            - "Fn::GetAtt": [ QueryCacheTable, Arn ]
  environment:
    REGION: ${env:REGION}
    DEFAULT_EVENT_BUS_NAME: ${env:DEFAULT_EVENT_BUS_NAME}
    RECEIVER_AWS_ACCOUNT_ID: ${env:RECEIVER_AWS_ACCOUNT_ID}
    SENDER_AWS_ACCOUNT_ID: ${env:SENDER_AWS_ACCOUNT_ID}
    RECEIVER_BUS_NAME: ${env:RECEIVER_BUS_NAME}
    SENDER_BUS_NAME: ${env:SENDER_BUS_NAME}
    QUERY_CACHE_TABLE_NAME: ${env:QUERY_CACHE_TABLE_NAME}

functions:
  logEvent:
    handler: log.handler
    events:
      - eventBridge:
          eventBus: ${self:custom.receiverAccountEventBusArn}
          existing: true
          pattern:
            source:
              - whiteprompt
  sendQuery:
    handler: sendQuery.handler
    events:
      - http:
          path: /query
          method: POST
  processResponse:
    handler: processResponse.handler
    events:
      - eventBridge:
          eventBus: ${self:custom.receiverAccountEventBusArn}
          existing: true
          pattern:
            source:
              - whiteprompt
            detail-type:
              - query.response
resources:
  Resources:
    EventBus:
      Type: AWS::Events::EventBus
      Properties:
        Name: ${env:SENDER_BUS_NAME}
    EventBusPolicy:
      Type: AWS::Events::EventBusPolicy
      DependsOn: EventBus
      Properties:
        StatementId: sender-policy
        Action: events:PutEvents
        Principal: ${env:RECEIVER_AWS_ACCOUNT_ID}
        EventBusName: ${env:SENDER_BUS_NAME}
    SendToReceiverAccountRule:
      Type: AWS::Events::Rule
      DependsOn: EventBus
      Properties:
        Description: Send query requests to the Sender Account
        EventBusName: ${env:SENDER_BUS_NAME}
        EventPattern:
          source:
            - whiteprompt
          detail-type:
            - query.execute
        Name: send-to-receiver
        State: ENABLED
        Targets:
          - Id: Id1
            Arn: ${self:custom.receiverAccountEventBusArn}
    QueryCacheTable:
      Type: AWS::DynamoDB::Table
      Properties:
        BillingMode: PAY_PER_REQUEST
        AttributeDefinitions:
          - AttributeName: queryhash
            AttributeType: S
        KeySchema:
          - AttributeName: queryhash
            KeyType: HASH
        TableName: ${env:QUERY_CACHE_TABLE_NAME}