website_bucket_and_cf.yaml

AWSTemplateFormatVersion: '2010-09-09'

Parameters:

  CertificateArn:
    Type: 'String'

  CustomErrorResponsePagePath:
    Type: 'String'
    Default: ''

  Debug:
    Type: 'String'
    Default: 'false'
    AllowedValues: ['true', 'false']

  Domain:
    Type: 'String'

  WebACLId:
    Type: 'String'
    Default: 'none'

Conditions:
  EnableDebug: !Equals [!Ref Debug, 'true']
  EnableWAF: !Not [!Equals [!Ref WebACLId, 'none']]
  HasCustomErrorResponsePagePath: !Not [!Equals [!Ref CustomErrorResponsePagePath, '']]

Resources:

  OriginAccessIdentity:
    Type: 'AWS::CloudFront::CloudFrontOriginAccessIdentity'
    Properties:
      CloudFrontOriginAccessIdentityConfig:
        Comment: !Sub "${Domain} OAI"

  WebsiteBucket:
    Type: 'AWS::S3::Bucket'
    Properties:
      AccessControl: 'Private'
      BucketEncryption:
        ServerSideEncryptionConfiguration:
          -
            ServerSideEncryptionByDefault:
              SSEAlgorithm: 'AES256'
      PublicAccessBlockConfiguration:
        BlockPublicAcls: true
        BlockPublicPolicy: true
        IgnorePublicAcls: true
        RestrictPublicBuckets: true
      Tags:
        - Key: Domain
          Value: !Ref Domain

  WebsiteBucketPolicy:
    Type: 'AWS::S3::BucketPolicy'
    Properties:
      Bucket: !Ref WebsiteBucket
      PolicyDocument:
        Statement:
          -
            Action: 's3:GetObject'
            Effect: 'Allow'
            Resource: !Sub "arn:aws:s3:::${WebsiteBucket}/*"
            Principal:
              CanonicalUser: !GetAtt OriginAccessIdentity.S3CanonicalUserId

  EdgeLambdaExecutionRole:
    Type: 'AWS::IAM::Role'
    Properties:
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - lambda.amazonaws.com
                - edgelambda.amazonaws.com
            Action:
              - sts:AssumeRole
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole
        - arn:aws:iam::aws:policy/AWSXrayWriteOnlyAccess

  EdgeLambdaVersion201912211027:
    Type: "AWS::Lambda::Version"
    Properties:
      FunctionName:
        Ref: EdgeLambdaFunction

  EdgeLambdaFunction:
    Type: 'AWS::Lambda::Function'
    # Edge Lambda functions can't be deleted until hours after their CloudFront distribution is deleted
    # https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/lambda-edge-delete-replicas.html
    DeletionPolicy: Retain
    Properties:
      Role: !GetAtt EdgeLambdaExecutionRole.Arn
      Code:
        ZipFile: |
          const path = require('path');
          exports.handler = async (event) => {
            const { request } = event.Records[0].cf;
            const { uri } = request;
            const extension = path.extname(uri);
            if (extension && extension.length > 0) {
              return request;
            }
            const last_character = uri.slice(-1);
            var newUri;
            if (last_character === "/") {
              newUri = `${uri}index.html`;
            } else {
              newUri = `${uri}/index.html`;
            }
            console.log(`Rewriting ${uri} to ${newUri}...`);
            request.uri = newUri;
            return request;
          };
      Runtime: nodejs20.x
      Timeout: 5
      Handler: index.handler
      MemorySize: 128

  CloudFrontDistribution:
    Type: 'AWS::CloudFront::Distribution'
    Properties:
      DistributionConfig:
        Aliases:
          - !Ref Domain
          - !Sub "www.${Domain}"
        CustomErrorResponses: !If
          - HasCustomErrorResponsePagePath
          -
            -
              ErrorCode: 403
              ResponseCode: 404
              ResponsePagePath: !Ref CustomErrorResponsePagePath
            -
              ErrorCode: 404
              ResponseCode: 404
              ResponsePagePath: !Ref CustomErrorResponsePagePath
          - !Ref 'AWS::NoValue'
        DefaultCacheBehavior:
          Compress: true
          ForwardedValues:
            Cookies:
              Forward: 'none'
            QueryString: true
          LambdaFunctionAssociations:
            -
              EventType: 'viewer-request'
              LambdaFunctionARN:  !Join [':', [!GetAtt EdgeLambdaFunction.Arn, !GetAtt EdgeLambdaVersion201912211027.Version]]
          DefaultTTL: !If [EnableDebug, 0, !Ref 'AWS::NoValue']
          MaxTTL: !If [EnableDebug, 0, !Ref 'AWS::NoValue']
          MinTTL: !If [EnableDebug, 0, !Ref 'AWS::NoValue']
          TargetOriginId: 'WebsiteBucket'
          ViewerProtocolPolicy: 'redirect-to-https'
        DefaultRootObject: 'index.html'
        Enabled: true
        HttpVersion: 'http2'
        Origins:
          -
            DomainName: !Join [ "", [!Ref WebsiteBucket, ".s3.amazonaws.com" ] ]
            Id: 'WebsiteBucket'
            S3OriginConfig:
              OriginAccessIdentity: !Sub "origin-access-identity/cloudfront/${OriginAccessIdentity}"
        PriceClass: 'PriceClass_All'
        ViewerCertificate:
          AcmCertificateArn: !Ref CertificateArn
          SslSupportMethod: 'sni-only'
        WebACLId: !If [EnableWAF, !Ref WebACLId, !Ref 'AWS::NoValue']
      Tags:
        - Key: Domain
          Value: !Ref Domain

  AliasDns:
    Type: 'AWS::Route53::RecordSetGroup'
    Properties:
      HostedZoneName: !Sub "${Domain}."
      RecordSets:
        -
          Name: !Sub "${Domain}."
          Type: 'A'
          AliasTarget:
            # http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-route53-aliastarget.html#cfn-route53-aliastarget-hostedzoneid
            HostedZoneId: 'Z2FDTNDATAQYW2'
            DNSName: !GetAtt CloudFrontDistribution.DomainName
        -
          Name: !Sub "www.${Domain}."
          TTL: '300'
          Type: 'CNAME'
          ResourceRecords:
            - !GetAtt CloudFrontDistribution.DomainName

Outputs:
  WebsiteBucket:
    Value: !Ref WebsiteBucket

  WebsiteBucketDns:
    Value: !GetAtt WebsiteBucket.DomainName

  CloudFrontDistributionDomain:
    Value: !GetAtt CloudFrontDistribution.DomainName

  CloudFrontDistributionId:
    Value: !Ref CloudFrontDistribution