aws-cloudformation.yaml

AWSTemplateFormatVersion: '2010-09-09'

Parameters:
  ParamCertificateARN:
    Description: SSL Certificate for CloudFront
    Type: String
    Default: 'arn:aws:acm:us-east-1:ACCOUNT_ID_HERE:certificate/CERTIFICATE_ID'

Resources:
  CloudFrontDistribution:
    Type: AWS::CloudFront::Distribution
    Properties:
      DistributionConfig:
        Origins:
        - DomainName: !GetAtt 'S3Bucket.RegionalDomainName'
          Id: bigprimesCustomOrigin
          S3OriginConfig:
            OriginAccessIdentity: !Sub 'origin-access-identity/cloudfront/${CloudFrontOriginAccessIdentity}'
        Enabled: 'true'
        Comment: bigprimes.net infrastructure
        DefaultRootObject: index.html
        Aliases:
        - "www.bigprimes.net"
        HttpVersion: http2
        DefaultCacheBehavior:
          Compress: 'true'
          TargetOriginId: bigprimesCustomOrigin
          SmoothStreaming: 'false'
          ForwardedValues:
            QueryString: 'false'
            Cookies:
              Forward: all
          ViewerProtocolPolicy: redirect-to-https
        CustomErrorResponses:
        - ErrorCode: '404'
          ResponsePagePath: "/index.html"
          ResponseCode: '200'
          ErrorCachingMinTTL: '30'
        PriceClass: PriceClass_100
        ViewerCertificate:
          AcmCertificateArn: !Ref ParamCertificateARN
          MinimumProtocolVersion: TLSv1.1_2016
          SslSupportMethod: sni-only
      Tags:
        - Key: application
          Value: bigprimes.net

  RedirectCloudFrontDistribution:
    Type: AWS::CloudFront::Distribution
    Properties:
      DistributionConfig:
        Origins:
        - DomainName: !Sub bigprimes-redirect.s3-website-${AWS::Region}.amazonaws.com
          Id: bigprimesCustomOrigin
          CustomOriginConfig:
            OriginProtocolPolicy: http-only
        Enabled: 'true'
        Comment: bigprimes.net redirect
        Aliases:
        - "bigprimes.net"
        HttpVersion: http2
        DefaultCacheBehavior:
          Compress: 'true'
          TargetOriginId: bigprimesCustomOrigin
          SmoothStreaming: 'false'
          ForwardedValues:
            QueryString: 'false'
            Cookies:
              Forward: all
          ViewerProtocolPolicy: redirect-to-https
        PriceClass: PriceClass_100
        ViewerCertificate:
          AcmCertificateArn: !Ref ParamCertificateARN
          MinimumProtocolVersion: TLSv1.1_2016
          SslSupportMethod: sni-only
      Tags:
        - Key: application
          Value: bigprimes.net

  CloudFrontOriginAccessIdentity:
    Type: AWS::CloudFront::CloudFrontOriginAccessIdentity
    Properties:
      CloudFrontOriginAccessIdentityConfig:
        Comment: !Ref S3Bucket

  RedirectCloudFrontOriginAccessIdentity:
    Type: AWS::CloudFront::CloudFrontOriginAccessIdentity
    Properties:
      CloudFrontOriginAccessIdentityConfig:
        Comment: !Ref RedirectS3Bucket

  WWWDNSRecord:
    Type: AWS::Route53::RecordSet
    Properties:
      HostedZoneName: bigprimes.net.
      Comment: Bigprimes
      Name: "www.bigprimes.net"
      Type: CNAME
      TTL: '300'
      ResourceRecords: [!GetAtt 'CloudFrontDistribution.DomainName']

  ApexDNSRecord:
    Type: AWS::Route53::RecordSet
    Properties:
      AliasTarget:
        HostedZoneId: Z2FDTNDATAQYW2 #curiously this hardcoded value is recommened by AWS documentation
        DNSName: !GetAtt 'RedirectCloudFrontDistribution.DomainName'
      HostedZoneName: bigprimes.net.
      Comment: Bigprimes
      Name: "bigprimes.net"
      Type: A

  S3Bucket:
    Type: AWS::S3::Bucket
    Properties:
      BucketName: bigprimes
      AccessControl: PublicRead
      WebsiteConfiguration:
        IndexDocument: index.html
        ErrorDocument: index.html
    DeletionPolicy: Retain

  BucketPolicy:
    Type: AWS::S3::BucketPolicy
    Properties:
      Bucket: !Ref S3Bucket
      PolicyDocument:
        Id: MyPolicy
        Version: 2012-10-17
        Statement:
          - Sid: PublicReadForGetBucketObjects
            Effect: Allow
            Principal: '*'
            Action: 's3:GetObject'
            Resource:
              - !Sub 'arn:aws:s3:::${S3Bucket}/*'

  S3BucketReadPolicy:
    Type: AWS::S3::BucketPolicy
    Properties:
      Bucket: !Ref S3Bucket
      PolicyDocument:
        Statement:
        - Action: 's3:GetObject'
          Effect: Allow
          Resource: !Sub 'arn:aws:s3:::${S3Bucket}/*'
          Principal:
            CanonicalUser: !GetAtt CloudFrontOriginAccessIdentity.S3CanonicalUserId

  RedirectS3Bucket:
    Type: AWS::S3::Bucket
    Properties:
      BucketName: bigprimes-redirect
      AccessControl: PublicRead
      WebsiteConfiguration:
        RedirectAllRequestsTo:
          HostName: 'www.bigprimes.net'
          Protocol: https
    DeletionPolicy: Delete

  RedirectBucketPolicy:
    Type: AWS::S3::BucketPolicy
    Properties:
      Bucket: !Ref RedirectS3Bucket
      PolicyDocument:
        Id: MyPolicy
        Version: 2012-10-17
        Statement:
          - Action: 's3:GetObject'
            Effect: Allow
            Resource: !Sub 'arn:aws:s3:::${RedirectS3Bucket}/*'
            Principal:
              CanonicalUser: !GetAtt RedirectCloudFrontOriginAccessIdentity.S3CanonicalUserId

  PublishUser:
    Type: AWS::IAM::User
    Properties:
      Policies:
        - PolicyName: !Sub 'publish-to-${S3Bucket}'
          PolicyDocument:
            Statement:
            - Action: 's3:*'
              Effect: Allow
              Resource: 
              - !Sub 'arn:aws:s3:::${S3Bucket}'
              - !Sub 'arn:aws:s3:::${S3Bucket}/*'
            - Action: 'cloudfront:CreateInvalidation'
              Effect: Allow
              Resource:
              - !Sub 'arn:aws:cloudfront::${AWS::AccountId}:distribution/${CloudFrontDistribution}'

  PublishCredentials:
    Type: AWS::IAM::AccessKey
    Properties:
      UserName: !Ref PublishUser

Outputs:
  BucketName:
    Description: 'S3 Bucket Name'
    Value: !Ref S3Bucket
  AccessKeyId:
    Description: 'S3 Access Key'
    Value: !Ref PublishCredentials
  AccessKeySecret:
    Description: 'S3 Secret Key'
    Value: !GetAtt PublishCredentials.SecretAccessKey
  DistributionId:
    Description: 'CloudFront Distribution ID'
    Value: !Ref CloudFrontDistribution
  Domain:
    Description: 'Cloudfront Domain'
    Value: !GetAtt CloudFrontDistribution.DomainName