adamjacques.com/cloudformation.yml at master · ajacques/adamjacques.com · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
Parameters:
  DomainName:
    Type: String
    Description: Domain name for the CDN + Certificate
Resources:
  WebsiteFileS3Bucket:
    Type: AWS::S3::Bucket
    Properties:
      AccessControl: Private
  StaticS3Permission:
    Type: AWS::S3::BucketPolicy
    DependsOn:
      - WebsiteFileS3Bucket
    Properties:
      Bucket:
        Ref: WebsiteFileS3Bucket
      PolicyDocument:
        Statement:
          - Action:
              - s3:GetObject
            Effect: Allow
            Resource:
              Fn::Sub: arn:aws:s3:::${WebsiteFileS3Bucket}/web_content/*
            Condition:
              Bool:
                aws:SecureTransport: 'true'
            Principal:
              AWS:
                Fn::Sub: arn:aws:iam::cloudfront:user/CloudFront Origin Access Identity ${CloudFrontAccessIdentity}
  Certificate:
    Type: AWS::CertificateManager::Certificate
    Properties:
      DomainName:
        Ref: DomainName
      ValidationMethod: DNS
  CloudFrontAccessIdentity:
    Type: AWS::CloudFront::CloudFrontOriginAccessIdentity
    Properties:
      CloudFrontOriginAccessIdentityConfig:
        Comment: AdamJacques.com
  ExternalCloudFront:
    Type: AWS::CloudFront::Distribution
    Properties:
      DistributionConfig:
        Aliases:
          - Ref: DomainName
        DefaultCacheBehavior:
          TargetOriginId: staticAssetOrigin
          ViewerProtocolPolicy: redirect-to-https
          ForwardedValues:
            QueryString: false
            Cookies:
              Forward: whitelist
              WhitelistedNames:
                - rack.session
        DefaultRootObject: index.html
        Enabled: true
        HttpVersion: http2
        Origins:
          - Id: staticAssetOrigin
            DomainName:
              Fn::Sub: ${WebsiteFileS3Bucket}.s3.amazonaws.com
            OriginPath: /web_content
            S3OriginConfig:
              OriginAccessIdentity:
                Fn::Sub: origin-access-identity/cloudfront/${CloudFrontAccessIdentity}
        PriceClass: PriceClass_100
        ViewerCertificate:
          AcmCertificateArn:
            Ref: Certificate
          MinimumProtocolVersion: TLSv1.2_2021
          SslSupportMethod: sni-only
  AssetUploadUser:
    Type: AWS::IAM::User
    Properties:
      Policies:
        - PolicyName: CanUploadFiles
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Action:
                  - s3:ListBucket
                Effect: Allow
                Resource:
                  Fn::Sub: arn:aws:s3:::${WebsiteFileS3Bucket}
                Condition:
                  Bool:
                    aws:SecureTransport: 'true'
              - Action:
                  - s3:PutObject
                  - s3:GetObject
                Effect: Allow
                Resource:
                  Fn::Sub: arn:aws:s3:::${WebsiteFileS3Bucket}/web_content/*
                Condition:
                  Bool:
                    aws:SecureTransport: 'true'
Outputs:
  WebsiteS3Bucket:
    Description: Stores static content for website
    Value:
      Ref: WebsiteFileS3Bucket
  URL:
    Description: Raw CloudFront hostname
    Value:
      Fn::GetAtt:
        - ExternalCloudFront
        - DomainName