Skip to content

Commit afb79a9

Browse files
aapelivaapeliv
committed
Add CloudFormation code to deploy a static website to S3 with CloudFront, redirects, and a certificate
0 parents  commit afb79a9

File tree

1 file changed

+233
-0
lines changed

1 file changed

+233
-0
lines changed

‎s3-cloudfront-website.yaml

+233
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,233 @@
1+
AWSTemplateFormatVersion: '2010-09-09'
2+
Parameters:
3+
DomainName:
4+
Description: Domain name to deploy to (e.g. www.example.com)
5+
Type: String
6+
BucketName:
7+
Description: Bucket name to create and deploy to
8+
Type: String
9+
RedirectDomainNames:
10+
Description: List of alternate domains to redirect to the deployment domain (e.g.
11+
example.com,www.example.net,example.net). You can specify at most two different
12+
sets of domains that you control (i.e. have email access to)
13+
Type: CommaDelimitedList
14+
ValidationDomainName:
15+
Description: Domain name to use to validate main domain of certificate (e.g. example.com)
16+
Type: String
17+
SecondValidationDomainName:
18+
Description: Domain name to use to validate set domain of certificate (e.g. example.net)
19+
Type: String
20+
LogBucketName:
21+
Description: Bucket name to use for CloudFront logs (leave blank for no logging)
22+
Type: String
23+
HostedZoneID:
24+
Description: ID of Route 53 hosted zone. Leave blank to not have DNS record set
25+
(redirect records have to be manually set)
26+
Type: String
27+
Conditions:
28+
HasRedirectDomains: !Not
29+
- !Equals
30+
- ''
31+
- !Select
32+
- 0
33+
- !Ref 'RedirectDomainNames'
34+
HasSecondValidationDomainName: !Not
35+
- !Equals
36+
- ''
37+
- !Ref 'SecondValidationDomainName'
38+
Logging: !Not
39+
- !Equals
40+
- ''
41+
- !Ref 'LogBucketName'
42+
HostedZoneIDSet: !Not
43+
- !Equals
44+
- ''
45+
- !Ref 'HostedZoneID'
46+
Resources:
47+
CertificateManagerCertificate:
48+
Type: AWS::CertificateManager::Certificate
49+
Properties:
50+
DomainName: !Ref 'DomainName'
51+
DomainValidationOptions:
52+
- DomainName: !Ref 'DomainName'
53+
ValidationDomain: !Ref 'ValidationDomainName'
54+
- !If
55+
- HasSecondValidationDomainName
56+
- DomainName: !Select
57+
- 0
58+
- !Ref 'RedirectDomainNames'
59+
ValidationDomain: !Ref 'SecondValidationDomainName'
60+
- !Ref 'AWS::NoValue'
61+
SubjectAlternativeNames: !If
62+
- HasRedirectDomains
63+
- !Ref 'RedirectDomainNames'
64+
- !Ref 'AWS::NoValue'
65+
S3Bucket:
66+
Type: AWS::S3::Bucket
67+
Properties:
68+
BucketName: !Ref 'BucketName'
69+
WebsiteConfiguration:
70+
IndexDocument: index.html
71+
ErrorDocument: error.html
72+
S3LogBucket:
73+
Type: AWS::S3::Bucket
74+
Condition: Logging
75+
Properties:
76+
BucketName: !Ref 'LogBucketName'
77+
S3RedirectBucket:
78+
Type: AWS::S3::Bucket
79+
Condition: HasRedirectDomains
80+
Properties:
81+
BucketName: !Join
82+
- '-'
83+
- - !Ref 'BucketName'
84+
- redirect
85+
WebsiteConfiguration:
86+
RedirectAllRequestsTo:
87+
HostName: !Ref 'DomainName'
88+
Protocol: https
89+
BucketPolicy:
90+
Type: AWS::S3::BucketPolicy
91+
Properties:
92+
PolicyDocument:
93+
Id: S3AllowPublicReadGetObject
94+
Version: '2012-10-17'
95+
Statement:
96+
- Sid: PublicReadGetObject
97+
Effect: Allow
98+
Principal: '*'
99+
Action: s3:GetObject
100+
Resource: !Join
101+
- ''
102+
- - 'arn:aws:s3:::'
103+
- !Ref 'S3Bucket'
104+
- /*
105+
Bucket: !Ref 'S3Bucket'
106+
RedirectBucketPolicy:
107+
Type: AWS::S3::BucketPolicy
108+
Condition: HasRedirectDomains
109+
Properties:
110+
PolicyDocument:
111+
Id: S3AllowPublicReadGetObject
112+
Version: '2012-10-17'
113+
Statement:
114+
- Sid: PublicReadGetObject
115+
Effect: Allow
116+
Principal: '*'
117+
Action: s3:GetObject
118+
Resource: !Join
119+
- ''
120+
- - 'arn:aws:s3:::'
121+
- !Ref 'S3RedirectBucket'
122+
- /*
123+
Bucket: !Ref 'S3RedirectBucket'
124+
CloudFrontDistribution:
125+
Type: AWS::CloudFront::Distribution
126+
Properties:
127+
DistributionConfig:
128+
Origins:
129+
- DomainName: !Select [2, !Split ["/", !GetAtt 'S3Bucket.WebsiteURL']]
130+
Id: S3BucketOrigin
131+
CustomOriginConfig:
132+
HTTPPort: '80'
133+
HTTPSPort: '443'
134+
OriginProtocolPolicy: http-only
135+
HttpVersion: http2
136+
Logging: !If
137+
- Logging
138+
- IncludeCookies: 'true'
139+
Bucket: !GetAtt 'S3LogBucket.DomainName'
140+
Prefix: !If
141+
- HasRedirectDomains
142+
- site
143+
- !Ref 'AWS::NoValue'
144+
- !Ref 'AWS::NoValue'
145+
Enabled: 'true'
146+
DefaultRootObject: index.html
147+
Aliases:
148+
- !Ref 'DomainName'
149+
DefaultCacheBehavior:
150+
TargetOriginId: S3BucketOrigin
151+
AllowedMethods:
152+
- DELETE
153+
- GET
154+
- HEAD
155+
- OPTIONS
156+
- PATCH
157+
- POST
158+
- PUT
159+
ForwardedValues:
160+
QueryString: 'false'
161+
Cookies:
162+
Forward: none
163+
ViewerProtocolPolicy: redirect-to-https
164+
ViewerCertificate:
165+
AcmCertificateArn: !Ref 'CertificateManagerCertificate'
166+
MinimumProtocolVersion: TLSv1.1_2016
167+
SslSupportMethod: sni-only
168+
DependsOn:
169+
- S3Bucket
170+
- CertificateManagerCertificate
171+
CloudFrontRedirectDistribution:
172+
Type: AWS::CloudFront::Distribution
173+
Condition: HasRedirectDomains
174+
Properties:
175+
DistributionConfig:
176+
Origins:
177+
- DomainName: !Select [2, !Split ["/", !GetAtt 'S3RedirectBucket.WebsiteURL']]
178+
Id: S3RedirectBucketOrigin
179+
CustomOriginConfig:
180+
HTTPPort: '80'
181+
HTTPSPort: '443'
182+
OriginProtocolPolicy: http-only
183+
HttpVersion: http2
184+
Logging: !If
185+
- Logging
186+
- IncludeCookies: 'true'
187+
Bucket: !GetAtt 'S3LogBucket.DomainName'
188+
Prefix: redirect
189+
- !Ref 'AWS::NoValue'
190+
Enabled: 'true'
191+
DefaultRootObject: index.html
192+
Aliases: !Ref 'RedirectDomainNames'
193+
DefaultCacheBehavior:
194+
TargetOriginId: S3RedirectBucketOrigin
195+
AllowedMethods:
196+
- DELETE
197+
- GET
198+
- HEAD
199+
- OPTIONS
200+
- PATCH
201+
- POST
202+
- PUT
203+
ForwardedValues:
204+
QueryString: 'false'
205+
Cookies:
206+
Forward: none
207+
ViewerProtocolPolicy: allow-all
208+
ViewerCertificate:
209+
AcmCertificateArn: !Ref 'CertificateManagerCertificate'
210+
MinimumProtocolVersion: TLSv1.1_2016
211+
SslSupportMethod: sni-only
212+
DependsOn:
213+
- S3RedirectBucket
214+
- CertificateManagerCertificate
215+
Route53RecordSet:
216+
Type: AWS::Route53::RecordSetGroup
217+
Condition: HostedZoneIDSet
218+
Properties:
219+
HostedZoneId: !Ref 'HostedZoneID'
220+
RecordSets:
221+
- Name: !Ref 'DomainName'
222+
Type: A
223+
AliasTarget:
224+
HostedZoneId: Z2FDTNDATAQYW2
225+
DNSName: !GetAtt 'CloudFrontDistribution.DomainName'
226+
Outputs:
227+
CloudFrontEndpoint:
228+
Description: CNAME for CloudFront distribution
229+
Value: !GetAtt 'CloudFrontDistribution.DomainName'
230+
CloudFrontRedirectEndpoint:
231+
Description: CNAME for CloudFront distribution for redirecting domains
232+
Value: !GetAtt 'CloudFrontRedirectDistribution.DomainName'
233+
Condition: HasRedirectDomains

0 commit comments

Comments
 (0)