functions:
  auth:
    handler: exampleAuth.verify
    iamRoleStatements:
      - Effect: Allow
        Action: ssm:GetParameters*
        Resource: arn:aws:ssm:#{AWS::Region}:#{AWS::AccountId}:parameter/${self:provider.apiname}/${self:provider.stage}/okta/*
      - Effect: 'Allow'
        Action: 'kms:Decrypt'
        Resource: arn:aws:kms:#{AWS::Region}:#{AWS::AccountId}:key/${ssm:/example/${self:provider.stage}/kms/keyid~true}