Serverless template for global backend in VPC with DynamoDB endpoint

Command Line to create the VPC

# create VPC in region us-east-1
aws ec2 create-vpc --cidr-block 10.0.0.0/16 --region us-east-1
{
    "Vpc": {
        "CidrBlock": "10.0.0.0/16",
        "DhcpOptionsId": "dopt-f14eca94",
        "State": "pending",
        "VpcId": "vpc-xxxxxx",
        "InstanceTenancy": "default",
        "Ipv6CidrBlockAssociationSet": [],
        "CidrBlockAssociationSet": [
            {
                "AssociationId": "vpc-cidr-assoc-792d0a14",
                "CidrBlock": "10.0.0.0/16",
                "CidrBlockState": {
                    "State": "associated"
                }
            }
        ],
        "IsDefault": false,
        "Tags": []
    }
}

Create dynamodb endpoint and add routine

# Create DynamoDB endpoint in VPC

aws ec2 create-vpc-endpoint --vpc-id vpc-xxxxxx --service-name com.amazonaws.us-east-1.dynamodb --region us-east-1
{
    "VpcEndpoint": {
        "VpcEndpointId": "vpce-xxxxxx",
        "VpcEndpointType": "Gateway",
        "VpcId": "vpc-xxxxxxx",
        "ServiceName": "com.amazonaws.us-east-1.dynamodb",
        "State": "available",
        "PolicyDocument": "{\"Version\":\"2008-10-17\",\"Statement\":[{\"Effect\":\"Allow\",\"Principal\":\"*\",\"Action\":\"*\",\"Resource\":\"*\"}]}",
        "RouteTableIds": [],
        "SubnetIds": [],
        "Groups": [],
        "PrivateDnsEnabled": false,
        "NetworkInterfaceIds": [],
        "DnsEntries": [],
        "CreationTimestamp": "2018-05-03T08:25:18Z"
    }
}


# Finally adding the routing information for the endpoint
aws ec2 modify-vpc-endpoint --vpc-endpoint-id vpce-xxxxxx --add-route-table-ids rtb-xxxxxx  --region us-east-1
{
    "Return": true
}

Create subnet in VPC

# Create subnet associated with the VPC
aws ec2 create-subnet --vpc-id vpc-xxxxxx --cidr-block 10.0.1.0/24 --region us-east-1
{
    "Subnet": {
        "AvailabilityZone": "us-east-1b",
        "AvailableIpAddressCount": 251,
        "CidrBlock": "10.0.1.0/24",
        "DefaultForAz": false,
        "MapPublicIpOnLaunch": false,
        "State": "pending",
        "SubnetId": "subnet-xxxxxx",
        "VpcId": "vpc-xxxxxx",
        "AssignIpv6AddressOnCreation": false,
        "Ipv6CidrBlockAssociationSet": []
    }
}

env_us-east-1.yml

STATUS: 200
lambdaExecSecurityGroups: ["sg-xxxxxxx"]
subnets: ["subnet-xxxxxx"]

Get routing information from VPC

# Get the routing info from the VPC.
aws ec2 describe-route-tables --filters "Name=vpc-id,Values=vpc-xxxxxxx" --region us-east-1
{
    "RouteTables": [
        {
            "Associations": [
                {
                    "Main": true,
                    "RouteTableAssociationId": "rtbassoc-4112743e",
                    "RouteTableId": "rtb-xxxxxx"
                }
            ],
            "PropagatingVgws": [],
            "RouteTableId": "rtb-xxxxxx",
            "Routes": [
                {
                    "DestinationCidrBlock": "10.0.0.0/16",
                    "GatewayId": "local",
                    "Origin": "CreateRouteTable",
                    "State": "active"
                },
                {
                    "DestinationPrefixListId": "pl-02cd2c6b",
                    "GatewayId": "vpce-xxxxxx",
                    "Origin": "CreateRoute",
                    "State": "active"
                }
            ],
            "Tags": [],
            "VpcId": "vpc-xxxxxx"
        }
    ]
}

serverless.yml

service: blogv2
provider:
  name: aws
  vpc:
      securityGroupIds:
        ${file(env_${opt:region}.yml):lambdaExecSecurityGroups}
      subnetIds:
        ${file(env_${opt:region}.yml):subnets}
  runtime: python2.7
  memorySize: 512
  environment:
    STATUS: ${file(env.yml):STATUS}
  iamRoleStatements:
      -  Effect: "Allow"
         Action:
           - "dynamodb:*"
         Resource:
           - "arn:aws:dynamodb:${opt:region}:322549714802:table/MyGlobalTable"
      -  Effect: "Allow"
         Action:
           - "logs:CreateLogGroup"
           - "logs:CreateLogStream"
           - "logs:PutLogEvents"
           - "xray:PutTraceSegments"
           - "xray:PutTelemetryRecords"
         Resource:
           - "*"

package:
  include:
    - vendored/**
  exclude:
    - .git/**

functions:
  get_item:
    handler: get.get_item
    events:
      - http:
          path: get/{item_id}
          method: GET
          cors: true

  create_item:
    handler: post.create_item
    events:
      - http:
          path: create
          method: POST
          cors: true

  get_health:
    handler: health.lambda_handler
    events:
      - http:
          path: health
          method: GET
          cors: true