serverless.yml

service: helper-lambdas

frameworkVersion: ">=2.0.0 <3.0.0"

plugins:
  - serverless-pseudo-parameters
  - serverless-prune-plugin

provider:
  name: aws
  runtime: nodejs12.x
  stage: ${opt:stage, 'dev'}
  region: us-east-1

custom:
  prune:
    automatic: true
    number: 2

functions:
  addSecurityHeaders:
    handler: addSecurityHeaders.handler
    role: edgeRole

resources:
  Resources:
    edgeRole:
      Type: AWS::IAM::Role
      Properties:
        Path: /
        RoleName: EdgeRole # required if you want to use 'serverless deploy --function' later on
        AssumeRolePolicyDocument:
          Version: "2012-10-17"
          Statement:
            - Effect: Allow
              Principal:
                Service:
                  - lambda.amazonaws.com
                  - edgelambda.amazonaws.com
              Action: sts:AssumeRole
        # note that these rights are needed if you want your function to be able to communicate with resources within your vpc
        #ManagedPolicyArns:
        #- arn:aws:iam::aws:policy/service-role/AWSLambdaVPCAccessExecutionRole
        Policies:
          - PolicyName: edgePolicy
            PolicyDocument:
              Version: "2012-10-17"
              Statement:
                - Effect: Allow
                  Action:
                    - logs:CreateLogGroup
                    - logs:CreateLogStream
                    - logs:PutLogEvents
                  Resource:
                    - "Fn::Join":
                        - ":"
                        - - "arn:aws:logs"
                          - Ref: "AWS::Region"
                          - Ref: "AWS::AccountId"
                          - "log-group:/aws/lambda/*:*:*"
                - Effect: "Allow"
                  Action:
                    - "s3:PutObject"
                  Resource:
                    Fn::Join:
                      - ""
                      - - "arn:aws:s3:::"
                        - "Ref": "ServerlessDeploymentBucket"