A serverless config for deploying prerender services

serverless.yml

---
service: seo
provider:
  name: aws
  stage: ${opt:stage, 'dev'}

resources:
  Resources:
    PrerenderRepository:
      Type: AWS::ECR::Repository
      Properties:
        RepositoryName: ${self:service}-prerender-${self:provider.stage}
    Cluster:
      Type: AWS::ECS::Cluster
      Properties:
        ClusterName: ${self:service}-${self:provider.stage}
    PreRender:
      Type: AWS::ECS::TaskDefinition
      Properties:
        Family: ${self:service}-prerender-${self:provider.stage}
        Memory: 2048
        Cpu: 512
        RequiresCompatibilities:
          - FARGATE
        TaskRoleArn:
          Ref: TaskExecutionRole
        ExecutionRoleArn:
          Ref: TaskExecutionRole
        NetworkMode: awsvpc
        ContainerDefinitions:
          - Name: ${self:service}-prerender-${self:provider.stage}
            Image:
              Fn::Join:
                - ""
                - - Ref: AWS::AccountId
                  - ".dkr.ecr."
                  - Ref: AWS::Region
                  - ".amazonaws.com/${self:service}-prerender-${self:provider.stage}:latest"
            LogConfiguration:
              LogDriver: awslogs
              Options:
                awslogs-group:
                  Ref: PrerenderLogs
                awslogs-region:
                  Ref: AWS::Region
                awslogs-stream-prefix:
                  Fn::Sub: "${self:service}-prerender-${self:provider.stage}"
            EntryPoint:
              - "python"
            Command:
              - "index.py"
            Environment:
              - Name: AWS_DEFAULT_REGION
                Value:
                  Ref: AWS::Region
              - Name: AWS_ACCESS_KEY_ID
                Value: ${env:AWS_ACCESS_KEY_ID}
              - Name: AWS_SECRET_ACCESS_KEY
                Value: ${env:AWS_SECRET_ACCESS_KEY}
              - Name: ENVIRONMENT
                Value: ${self:provider.stage}
              - Name: robots_url
                Value: "https://tournamentmgr.com/robots.txt"
              - Name: s3_bucket
                Value: "tm-prerender"
    PrerenderLogs:
      Type: AWS::Logs::LogGroup
      Properties:
        LogGroupName: /ecs/${self:service}-prerender-${self:provider.stage}
        RetentionInDays: 5
    
    TaskExecutionRole:
      Type: AWS::IAM::Role
      Properties:
        AssumeRolePolicyDocument:
          Statement:
            - Effect: Allow
              Principal:
                Service:
                  - ecs-tasks.amazonaws.com
              Action:
                - 'sts:AssumeRole'
        Policies:
          - PolicyName: TaskExecutionRole
            PolicyDocument:
              Statement:
                - Effect: Allow
                  Action:
                    - 'ecr:GetAuthorizationToken'
                    - 'ecr:BatchCheckLayerAvailability'
                    - 'ecr:GetDownloadUrlForLayer'
                    - 'ecr:BatchGetImage'
                    - 'logs:CreateLogStream'
                    - 'logs:PutLogEvents'
                  Resource: '*'
                - Effect: Allow
                  Action:
                    - 's3:PutObject'
                  Resource:
                    - "arn:aws:s3:::tm-prerender/*"