Serverless VPC lambda skeleton

lambda_handler.js

'use strict';
console.log('Loading function');

exports.handler = async (event, context) => {
  console.log('Received event:', JSON.stringify(event, null, 2));

  let responseBody = {
    message: "This is a message",
    input: event
  };

  let response = {
    statusCode: 200,
    headers: {},
    body: JSON.stringify(responseBody)
  };

  console.log('Sending response: ' + JSON.stringify(response))

  return response;
};

serverless.yml

service: serverless-network

provider:
  name: aws
  runtime: nodejs10.x
  stage: ${opt:stage, 'dev'}
  region: ${opt:region, 'us-east-1'}

custom:
  vpc:
    cidr: ${opt:vpc, '172.0.0.0/16'}
    public:
      subnet1:
        cidr: ${opt:public1, '172.0.0.0/18'}
      subnet2:
        cidr: ${opt:public2, '172.0.64.0/18'}
    private:
      subnet1:
        cidr: ${opt:private1, '172.0.128.0/18'}
      subnet2:
        cidr: ${opt:private2, '172.0.192.0/18'}

functions:
  VpcFunction:
    handler: lambda_handler.handler
    name: ${self:service}-${self:provider.stage}-function
    vpc:
      securityGroupIds:
        - Ref: VpcFunctionSecurityGroup
      subnetIds:
        - Ref: PrivateSubnet1
        - Ref: PrivateSubnet2
    DependsOn:
      - Ref: VpcFunctionSecurityGroup
      - Ref: PrivateSubnet1
      - Ref: PrivateSubnet2
    events:
      - http:
          path: /
          method: ANY
      - http: ANY {proxy+}

resources:
  Resources:
    Vpc:
      Type: AWS::EC2::VPC
      Properties:
        CidrBlock: ${self:custom.vpc.cidr}
        Tags:
        - Key: Name
          Value: ${self:service}-${self:provider.stage}
        EnableDnsHostnames: true
        EnableDnsSupport: true

    InternetGateway:
      Type: AWS::EC2::InternetGateway

    InternetGatewayAttachment:
      Type: AWS::EC2::VPCGatewayAttachment
      DependsOn:
        - Vpc
        - InternetGateway
      Properties:
        VpcId:
          Ref: Vpc
        InternetGatewayId:
          Ref: InternetGateway

    PublicRouteTable:
      Type: AWS::EC2::RouteTable
      DependsOn:
        - Vpc
      Properties:
        VpcId: 
          Ref: Vpc

    PublicRoute:
      Type: AWS::EC2::Route
      DependsOn:
        - PublicRouteTable
        - InternetGateway
      Properties:
        RouteTableId: 
          Ref: PublicRouteTable
        DestinationCidrBlock: 0.0.0.0/0
        GatewayId: 
          Ref: InternetGateway

    PublicSubnet1:
      Type: AWS::EC2::Subnet
      DependsOn:
        - Vpc
      Properties:
        VpcId:
          Ref: Vpc
        CidrBlock: ${self:custom.vpc.public.subnet1.cidr}
        AvailabilityZone: ${self:provider.region}a

    PublicSubnet1RouteTableAssociation:
      Type: AWS::EC2::SubnetRouteTableAssociation
      DependsOn:
        - PublicSubnet1
        - PublicRouteTable
      Properties:
        SubnetId: 
          Ref: PublicSubnet1
        RouteTableId: 
          Ref: PublicRouteTable

    PublicSubnet2:
      Type: AWS::EC2::Subnet
      DependsOn:
        - Vpc
      Properties:
        VpcId:
          Ref: Vpc
        CidrBlock: ${self:custom.vpc.public.subnet2.cidr}
        AvailabilityZone: ${self:provider.region}b

    PublicSubnet2RouteTableAssociation:
      Type: AWS::EC2::SubnetRouteTableAssociation
      DependsOn:
        - PublicSubnet2
        - PublicRouteTable
      Properties:
        SubnetId: 
          Ref: PublicSubnet2
        RouteTableId: 
          Ref: PublicRouteTable

    NatGateway1ElasticIp:
      Type: AWS::EC2::EIP
      DependsOn:
        - Vpc
      Properties:
        Domain: vpc

    NatGateway1:
      Type: AWS::EC2::NatGateway
      DependsOn:
        - PublicSubnet1
        - NatGateway1ElasticIp
      Properties:
        SubnetId:
          Ref: PublicSubnet1
        AllocationId:
          Fn::GetAtt: [NatGateway1ElasticIp, AllocationId]

    PrivateRouteTable1:
      Type: AWS::EC2::RouteTable
      DependsOn:
        - Vpc
      Properties:
        VpcId: 
          Ref: Vpc

    PrivateRoute1:
      Type: AWS::EC2::Route
      DependsOn:
        - PrivateRouteTable1
        - NatGateway1
      Properties:
        RouteTableId: 
          Ref: PrivateRouteTable1
        DestinationCidrBlock: 0.0.0.0/0
        NatGatewayId:
          Ref: NatGateway1

    PrivateSubnet1:
      Type: AWS::EC2::Subnet
      DependsOn:
        - Vpc
      Properties:
        VpcId:
          Ref: Vpc
        CidrBlock: ${self:custom.vpc.private.subnet1.cidr}
        AvailabilityZone: ${self:provider.region}a

    PrivateSubnet1RouteTableAssociation:
      Type: AWS::EC2::SubnetRouteTableAssociation
      DependsOn:
        - PrivateSubnet1
        - PrivateRouteTable1
      Properties:
        SubnetId: 
          Ref: PrivateSubnet1
        RouteTableId: 
          Ref: PrivateRouteTable1

    NatGateway2ElasticIp:
      Type: AWS::EC2::EIP
      DependsOn:
        - Vpc
      Properties:
        Domain: vpc

    NatGateway2:
      Type: AWS::EC2::NatGateway
      DependsOn:
        - PublicSubnet2
        - NatGateway2ElasticIp
      Properties:
        SubnetId:
          Ref: PublicSubnet2
        AllocationId:
          Fn::GetAtt: [NatGateway2ElasticIp, AllocationId]

    PrivateRouteTable2:
      Type: AWS::EC2::RouteTable
      DependsOn:
        - Vpc
      Properties:
        VpcId: 
          Ref: Vpc

    PrivateRoute2:
      Type: AWS::EC2::Route
      DependsOn:
        - PrivateRouteTable2
        - NatGateway2
      Properties:
        RouteTableId: 
          Ref: PrivateRouteTable2
        DestinationCidrBlock: 0.0.0.0/0
        NatGatewayId:
          Ref: NatGateway2

    PrivateSubnet2:
      Type: AWS::EC2::Subnet
      DependsOn:
        - Vpc
      Properties:
        VpcId:
          Ref: Vpc
        CidrBlock: ${self:custom.vpc.private.subnet2.cidr}
        AvailabilityZone: ${self:provider.region}b
    
    PrivateSubnet2RouteTableAssociation:
      Type: AWS::EC2::SubnetRouteTableAssociation
      DependsOn:
        - PrivateSubnet2
        - PrivateRouteTable2
      Properties:
        SubnetId: 
          Ref: PrivateSubnet2
        RouteTableId: 
          Ref: PrivateRouteTable2

    VpcFunctionSecurityGroup:
      Type: AWS::EC2::SecurityGroup
      DependsOn:
        - Vpc
      Properties:
        GroupName: Function
        GroupDescription: ${self:service}-${self:provider.stage}-function
        VpcId:
          Ref: Vpc

    DbSecurityGroup:
      Type: AWS::EC2::SecurityGroup
      DependsOn:
        - Vpc
        - VpcFunctionSecurityGroup
      Properties:
        GroupName: DB
        GroupDescription: ${self:service}-${self:provider.stage}-db
        SecurityGroupIngress:
          - SourceSecurityGroupId:
              Ref: VpcFunctionSecurityGroup
            IpProtocol: tcp
            FromPort: 5432
            ToPort: 5432
        VpcId:
          Ref: Vpc

    ElasticSearchSecurityGroup:
      Type: AWS::EC2::SecurityGroup
      DependsOn:
        - Vpc
        - VpcFunctionSecurityGroup
      Properties:
        GroupName: ElasticSearch
        GroupDescription: ${self:service}-${self:provider.stage}-elasticsearch
        SecurityGroupIngress:
          - SourceSecurityGroupId:
              Ref: VpcFunctionSecurityGroup
            IpProtocol: tcp
            FromPort: 80
            ToPort: 80
          - SourceSecurityGroupId:
              Ref: VpcFunctionSecurityGroup
            IpProtocol: tcp
            FromPort: 443
            ToPort: 443
        VpcId:
          Ref: Vpc

  Outputs:
    Vpc:
      Value:
        Fn::GetAtt: [Vpc, CidrBlock]

    PublicSubnet1:
      Value:
        Ref: PublicSubnet1

    PublicSubnet1AvailabilityZone:
      Value:
        Fn::GetAtt: [PublicSubnet1, AvailabilityZone]

    PublicSubnet2:
      Value:
        Ref: PublicSubnet2

    PublicSubnet2AvailabilityZone:
      Value:
        Fn::GetAtt: [PublicSubnet2, AvailabilityZone]

    PrivateSubnet1:
      Value:
        Ref: PrivateSubnet1

    PrivateSubnet1AvailabilityZone:
      Value:
        Fn::GetAtt: [PrivateSubnet1, AvailabilityZone]

    PrivateSubnet2:
      Value:
        Ref: PrivateSubnet2

    PrivateSubnet2AvailabilityZone:
      Value:
        Fn::GetAtt: [PrivateSubnet2, AvailabilityZone]

    NatGateway1ElasticIp:
      Value:
        Ref: NatGateway1ElasticIp

    NatGateway2ElasticIp:
      Value:
        Ref: NatGateway2ElasticIp