build_modules.bat

rmdir /S /Q .\functions\originResponse\node_modules
docker build --tag amazonlinux:nodejs .
docker run --rm --volume "%cd%/functions/originResponse":/build amazonlinux:nodejs /bin/bash -c "source ~/.bashrc; npm install --only=prod"

build_modules.sh

#!/bin/bash
rm -rf './functions/originResponse/node_modules'
docker build --tag amazonlinux:nodejs .
docker run --rm --volume "${PWD}/functions/originResponse":/build amazonlinux:nodejs /bin/bash -c "source ~/.bashrc; npm install --only=prod"

Dockerfile

FROM amazonlinux:1

WORKDIR /tmp
#install the dependencies
RUN yum -y install gcc-c++ && yum -y install findutils

RUN touch ~/.bashrc && chmod +x ~/.bashrc

RUN curl -o- https://raw.githubusercontent.com/creationix/nvm/v0.33.5/install.sh | bash

RUN source ~/.bashrc && nvm install 8.10

WORKDIR /build

package.json

{
  "dependencies": {
    "prettyjson": "^1.2.1",
    "sharp": "^0.20.5"
  },
  "devDependencies": {
    "aws-sdk": "^2.294.0"
  }
}

package.json root

{
  "name": "acg-image-resizer",
  "version": "0.1.0",
  "private": true,
  "scripts": {
    "build": "sh ./scripts/build_modules.sh"
  },
  "eslintConfig": {
    "env": {
      "browser": false,
      "commonjs": true,
      "node": true,
      "es6": true
    },
    "extends": [
      "prettier"
    ],
    "plugins": [
      "prettier"
    ],
    "parser": "babel-eslint",
    "rules": {
      "prettier/prettier": [
        "error",
        {
          "singleQuote": true,
          "trailingComma": "all"
        }
      ]
    }
  },
  "dependencies": {},
  "devDependencies": {
    "babel-eslint": "^8.2.6",
    "eslint": "^5.2.0",
    "eslint-config-prettier": "^2.9.0",
    "eslint-plugin-prettier": "^2.6.2",
    "prettier": "^1.13.7",
    "prettier-eslint": "^8.8.2",
    "serverless": "^1.29.2",
    "serverless-plugin-cloudfront-lambda-edge": "^2.0.0",
    "serverless-scriptable-plugin": "^0.8.0"
  }
}

serverless.yml

service: acg-image-resizer-sls

frameworkVersion: ">=1.9.0 <2.0.0"

custom:
  stage: ${opt:stage, self:provider.stage}
  stackname: ${self:service}-${self:custom.stage}
  secrets: ${file(secrets.yml):secrets}
  s3Sync:
    - bucketName: ${self:custom.stackname}-bucket
      localDir: public
  scriptHooks:
    package:initialize: yarn build

provider:
  name: aws
  region: us-east-1
  runtime: nodejs8.10

functions:
  originResponse:
    name: ${self:custom.stackname}-originResponse
    handler: functions/originResponse/originResponse.handler
    memorySize: 128
    timeout: 5
    role: LambdaEdgeRole
    lambdaAtEdge:
      distribution: WebsiteDistribution
      eventType: origin-response
    package:
      include:
        - functions/originResponse/**/*

resources:
  Description: ACG Image Resizer
  Resources:
    LambdaEdgeRole: ${file(resources/roles/lambdaedge-role.yml)}
    CloudfrontOAI:
      Type: "AWS::CloudFront::CloudFrontOriginAccessIdentity"
      Properties:
        CloudFrontOriginAccessIdentityConfig:
          Comment: Created for ${self:custom.stackname} 
    DefaultBucket:
      Type: "AWS::S3::Bucket"
      Properties:
        BucketName: ${self:custom.stackname}-bucket
        AccessControl: Private
    BucketPolicy:
      Type: "AWS::S3::BucketPolicy"
      Properties:
        Bucket: {Ref: DefaultBucket}
        PolicyDocument:
          Version: "2012-10-17"
          Statement:
            - Effect: Allow
              Principal:
                CanonicalUser:
                  - {"Fn::GetAtt": [CloudfrontOAI, S3CanonicalUserId]}
              Action:
                - s3:ListBucket
                - s3:GetObject
              Resource:
                - {"Fn::Join": ["", ["arn:aws:s3:::", {Ref: DefaultBucket}]]}
                - {"Fn::Join": ["", ["arn:aws:s3:::", {Ref: DefaultBucket}, "/*"]]}
            - Effect: Allow
              Principal: "*"
              Action:
                - s3:ListBucket
                - s3:GetObject
              Resource:
                - {"Fn::Join": ["", ["arn:aws:s3:::", {Ref: DefaultBucket}]]}
                - {"Fn::Join": ["", ["arn:aws:s3:::", {Ref: DefaultBucket}, "/*"]]}
              Condition:
                IpAddress: 
                  aws:SourceIp: ${self:custom.secrets.homeIP}
    WebsiteDistribution:
      Type: "AWS::CloudFront::Distribution"
      Properties:
        DistributionConfig:
          ViewerCertificate:
            CloudFrontDefaultCertificate: true
          Enabled: true
          HttpVersion: http2
          PriceClass: PriceClass_100
          IPV6Enabled: true
          DefaultCacheBehavior:
            AllowedMethods:
              - GET
              - HEAD
            CachedMethods:
              - GET
              - HEAD
            Compress: true
            ForwardedValues:
              QueryString: false
              Cookies:
                Forward: none
            DefaultTTL: 0
            MaxTTL: 100
            MinTTL: 0
            SmoothStreaming: false
            TargetOriginId: WebsiteBucketOrigin
            ViewerProtocolPolicy: redirect-to-https
          Origins:
            - DomainName: {"Fn::GetAtt": [DefaultBucket, DomainName]}
              Id: WebsiteBucketOrigin
              S3OriginConfig:
                OriginAccessIdentity: {"Fn::Join": ["", ["origin-access-identity/cloudfront/", {Ref: CloudfrontOAI}]]}

plugins:
  - serverless-plugin-cloudfront-lambda-edge
  - serverless-scriptable-plugin
  - serverless-s3-sync

package:
  individually: true
  exclude:
    - '**/*'