cloudformation.yaml

---
AWSTemplateFormatVersion: "2010-09-09"

Description: |
  Static web site stack including:
  * S3 bucket for web site content
  * Redirect from "www." to base domain
  * Access logs written to logs bucket
  * ACM Certificate for SSL
  * CloudFront distributions for website https access
  * Route 53 hosted zone with DNS entries
  * CodePipeline (sourced from GitHub)
  * S3 bucket for CodePipeline artifacts
  * SNS topic for CodeCommit Git change notifications
  * Email address subscribed to SNS notification topic

Parameters:
  # Domain: example.com
  DomainName:
    Type: String
    Description: "The base domain name for the web site (no 'www')"
    MinLength: 4
    MaxLength: 253
    AllowedPattern: "[a-z0-9]+[-.a-z0-9]*(\\.[a-z][a-z]+)+"
    ConstraintDescription: "Provide a valid domain name using only lowercase letters, numbers, and dash (-)"

  # Email address to receive Git activity notifications: you@anotherdomain.com
  # CANNOT be in same domain!
  NotificationEmail:
    Type: String
    Description: "Initial email address to receive Git change notifications"
    MinLength: 6
    AllowedPattern: ".+@[a-z0-9]+[-.a-z0-9]*(\\.[a-z][a-z]+)+"
    ConstraintDescription: "Provide a valid email address"

  DefaultTTL:
    Type: Number
    Description: "TTL in seconds"
    Default: 30

  MinimumTTL:
    Description: "Minimum cache lifetime in seconds for the CloudFront distribution"
    Default: 5
    Type: Number

  PriceClass:
    Description: "Distribution price class. Default is US-only, PriceClass_All is worldwide but more expensive."
    Default: PriceClass_100
    AllowedValues:
      - PriceClass_100
      - PriceClass_200
      - PriceClass_All
    Type: String

  GitHubOwner:
    Description: "The owner of the repository used for the static site."
    Type: String

  GitHubRepo:
    Description: "The name of the repository used for the static site."
    Type: String

  GitHubBranch:
    Description: "The branch which will auto deploy the static site (default is master)"
    Type: String
    Default: master

  GitHubToken:
    Description: "The OAuth token which gives access to your repository."
    NoEcho: true
    Type: String

  PreExistingHostedZoneDomain:
    Description: "Optional domain name for pre-existing Route 53 hosted zone. Leave empty to have hosted zone created and managed by this stack."
    Type: String
    Default: ""

  PreExistingSiteBucket:
    Description: "Optional name of pre-existing website bucket. Leave empty to have website bucket created and managed by this stack."
    Type: String
    Default: ""

  PreExistingRedirectBucket:
    Description: "Optional name of pre-existing redirect bucket. Leave empty to have redirect bucket created and managed by this stack."
    Type: String
    Default: ""

  PreExistingLogsBucket:
    Description: "Optional name of pre-existing access logs bucket. Leave empty to have access logs bucket created and managed by this stack."
    Type: String
    Default: ""

  PreExistingCodePipelineBucket:
    Description: "Optional name of pre-existing CodePipeline artifact bucket. Leave empty to have CodePipeline bucket created and managed by this stack."
    Type: String
    Default: ""

Conditions:
  NeedsNewHostedZone: !Equals [!Ref PreExistingHostedZoneDomain, ""]
  NeedsNewSiteBucket: !Equals [!Ref PreExistingSiteBucket, ""]
  NeedsNewRedirectBucket: !Equals [!Ref PreExistingRedirectBucket, ""]
  NeedsNewLogsBucket: !Equals [!Ref PreExistingLogsBucket, ""]
  NeedsNewCodePipelineBucket: !Equals [!Ref PreExistingCodePipelineBucket, ""]

Resources:
  # Bucket for CloudFront and S3 access logs: logs.example.com
  LogsBucket:
    Condition: NeedsNewLogsBucket
    Type: "AWS::S3::Bucket"
    Properties:
      BucketName: !Sub "logs.${DomainName}"
      AccessControl: LogDeliveryWrite
    DeletionPolicy: Delete

  # Bucket for site content: example.com
  SiteBucket:
    Condition: NeedsNewSiteBucket
    Type: "AWS::S3::Bucket"
    Properties:
      BucketName: !Ref DomainName
      AccessControl: PublicRead
      WebsiteConfiguration:
        IndexDocument: index.html
        ErrorDocument: 404.html
      # logs.example.com/logs/s3/example.com/
      LoggingConfiguration:
        DestinationBucketName: !If [NeedsNewLogsBucket, !Ref LogsBucket, !Ref PreExistingLogsBucket]
        LogFilePrefix: !Sub "logs/s3/${DomainName}/"
    DeletionPolicy: Delete

  # Bucket to redirect to example.com: www.example.com
  RedirectBucket:
    Condition: NeedsNewRedirectBucket
    Type: "AWS::S3::Bucket"
    Properties:
      BucketName: !Sub "www.${DomainName}"
      AccessControl: BucketOwnerFullControl
      # logs.example.com/logs/s3/www.example.com/
      LoggingConfiguration:
        DestinationBucketName: !If [NeedsNewLogsBucket, !Ref LogsBucket, !Ref PreExistingLogsBucket]
        LogFilePrefix: !Sub "logs/s3/www.${DomainName}/"
      WebsiteConfiguration:
        RedirectAllRequestsTo:
          HostName: !Ref DomainName
          Protocol: https
    DeletionPolicy: Delete

  # Bucket for CodePipeline artifact storage: codepipeline.example.com
  CodePipelineBucket:
    Condition: NeedsNewCodePipelineBucket
    Type: "AWS::S3::Bucket"
    Properties:
      BucketName: !Sub "codepipeline.${DomainName}"
      VersioningConfiguration:
        Status: Enabled
    DeletionPolicy: Delete

  # Certificate for HTTPS accesss through CloudFront
  Certificate:
    Type: "AWS::CertificateManager::Certificate"
    Properties:
      DomainName: !Ref DomainName
      SubjectAlternativeNames:
        - !Sub "www.${DomainName}"

  # CDN serves S3 content over HTTPS for example.com
  CloudFrontDistribution:
    Type: "AWS::CloudFront::Distribution"
    Properties:
      DistributionConfig:
        Enabled: true
        Aliases:
          - !Ref DomainName
        DefaultRootObject: index.html
        PriceClass: !Ref PriceClass
        Origins:
          -
            DomainName: !Join ["", [!Ref DomainName, ".", !FindInMap [RegionMap, !Ref "AWS::Region", websiteendpoint]]]
            Id: S3Origin
            CustomOriginConfig:
              HTTPPort: 80
              HTTPSPort: 443
              OriginProtocolPolicy: http-only
        DefaultCacheBehavior:
          TargetOriginId: S3Origin
          AllowedMethods:
            - GET
            - HEAD
          Compress: true
          DefaultTTL: !Ref DefaultTTL
          MinTTL: !Ref MinimumTTL
          ForwardedValues:
            QueryString: false
            Cookies:
             Forward: none
          ViewerProtocolPolicy: redirect-to-https
        # logs.example.com/logs/cloudfront/example.com/
        Logging:
          Bucket: !Join ["", [!If [NeedsNewLogsBucket, !Ref LogsBucket, !Ref PreExistingLogsBucket], ".s3.amazonaws.com"]]
          Prefix: !Sub "logs/cloudfront/${DomainName}/"
          IncludeCookies: false
        ViewerCertificate:
          AcmCertificateArn: !Ref Certificate
          SslSupportMethod: sni-only

  # CDN serves S3 content over HTTPS for www.example.com
  RedirectCloudFrontDistribution:
    Type: "AWS::CloudFront::Distribution"
    Properties:
      DistributionConfig:
        Enabled: true
        Aliases:
          - !If [NeedsNewRedirectBucket, !Ref RedirectBucket, !Ref PreExistingRedirectBucket]
        PriceClass: PriceClass_100
        Origins:
          -
            DomainName: !Join ["", [!If [NeedsNewRedirectBucket, !Ref RedirectBucket, !Ref PreExistingRedirectBucket], ".", !FindInMap [RegionMap, !Ref "AWS::Region", websiteendpoint]]]
            Id: RedirectS3Origin
            CustomOriginConfig:
              HTTPPort: 80
              HTTPSPort: 443
              OriginProtocolPolicy: http-only
        DefaultCacheBehavior:
          TargetOriginId: RedirectS3Origin
          AllowedMethods:
            - GET
            - HEAD
          DefaultTTL: !Ref DefaultTTL
          MinTTL: !Ref MinimumTTL
          ForwardedValues:
            QueryString: false
            Cookies:
             Forward: none
          ViewerProtocolPolicy: allow-all
        # logs.example.com/logs/cloudfront/www.example.com/
        Logging:
          Bucket: !Join ["", [!If [NeedsNewLogsBucket, !Ref LogsBucket, !Ref PreExistingLogsBucket], ".s3.amazonaws.com"]]
          Prefix: !Sub "logs/cloudfront/www.${DomainName}/"
          IncludeCookies: false
        ViewerCertificate:
          AcmCertificateArn: !Ref Certificate
          SslSupportMethod: sni-only

  # DNS: example.com, www.example.com
  Route53HostedZone:
    Condition: NeedsNewHostedZone
    Type: "AWS::Route53::HostedZone"
    Properties:
      HostedZoneConfig:
        Comment: !Sub "Created by CloudFormation stack: ${AWS::StackName}"
      Name: !Ref DomainName
    DeletionPolicy: Delete
  Route53RecordSetGroup:
    Type: "AWS::Route53::RecordSetGroup"
    Properties:
      HostedZoneId: !If [NeedsNewHostedZone, !Ref Route53HostedZone, !Ref "AWS::NoValue"]
      HostedZoneName: !If [NeedsNewHostedZone, !Ref "AWS::NoValue", !Sub "${PreExistingHostedZoneDomain}."]
      RecordSets:
        # example.com
        - Name: !Sub "${DomainName}."
          Type: A
          # Resolve to CloudFront distribution
          AliasTarget:
            HostedZoneId: Z2FDTNDATAQYW2 # CloudFront
            DNSName: !GetAtt CloudFrontDistribution.DomainName
        # www.example.com
        - Name: !Sub "www.${DomainName}."
          Type: A
          # Resolve to Redirect CloudFront distribution
          AliasTarget:
            HostedZoneId: Z2FDTNDATAQYW2 # CloudFront
            DNSName: !GetAtt RedirectCloudFrontDistribution.DomainName

  # SNS topic for Git repository activity. Email subscription
  NotificationTopic:
    Type: "AWS::SNS::Topic"
    Properties:
      DisplayName: !Sub "Activity in ${DomainName} Git repository"
      Subscription:
        - Endpoint: !Ref NotificationEmail
          Protocol: email

  GatsbyCodeBuildRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          Effect: Allow
          Principal:
            Service: codebuild.amazonaws.com
          Action: sts:AssumeRole
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/AdministratorAccess

  GatsbyCodeBuild:
    Type: AWS::CodeBuild::Project
    Properties:
      Artifacts:
        Type: CODEPIPELINE
      Environment:
        ComputeType: BUILD_GENERAL1_SMALL
        Image: aws/codebuild/nodejs:6.3.1
        Type: LINUX_CONTAINER
        EnvironmentVariables:
          - Name: DESTINATION_S3_BUCKET
            Value: !Ref DomainName
      Name: !Sub "${AWS::StackName}GatsbyCodeBuild"
      ServiceRole: !Ref GatsbyCodeBuildRole
      Source:
        Type: CODEPIPELINE
        BuildSpec: |
          version: 0.2
          phases:
            install:
              commands:
                - touch .npmignore
                - npm install -g gatsby
            pre_build:
              commands:
                - npm install
            build:
              commands:
                - npm run build
            post_build:
              commands:
                - aws s3 sync "public/" "s3://$DESTINATION_S3_BUCKET" --delete --acl "public-read"
          artifacts:
            base-directory: public
            files:
              - "**/*"

  # IAM info for CodePipeline
  CodePipelineRole:
    Type: "AWS::IAM::Role"
    Properties:
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - "lambda.amazonaws.com"
                - "codepipeline.amazonaws.com"
            Action:
              - "sts:AssumeRole"
      Path: "/"
      Policies:
        - PolicyName: "codepipeline-service"
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Effect: "Allow"
                Action: "*"
                Resource: "*"

  # CodePipeline: Pass Git contents to AWS Lambda function on Git activity
  CodePipeline:
    Type: "AWS::CodePipeline::Pipeline"
    Properties:
      Name: !Sub "${DomainName}-codepipeline"
      ArtifactStore:
        Type: S3
        Location: !If [NeedsNewCodePipelineBucket, !Ref CodePipelineBucket, !Ref PreExistingCodePipelineBucket]
      RestartExecutionOnUpdate: false
      RoleArn: !Sub "arn:aws:iam::${AWS::AccountId}:role/${CodePipelineRole}"
      Stages:
        - Name: Source-from-GitHub
          Actions:
            - Name: SourceAction
              ActionTypeId:
                Category: Source
                Owner: ThirdParty
                Provider: GitHub
                Version: 1
              Configuration:
                Owner: !Ref GitHubOwner
                Repo: !Ref GitHubRepo
                Branch: !Ref GitHubBranch
                OAuthToken: !Ref GitHubToken
              OutputArtifacts:
                - Name: SiteSource
              RunOrder: 1
        - Name: Build-and-Deploy
          Actions:
            - Name: Gatsby-Build
              InputArtifacts:
                - Name: SiteSource
              ActionTypeId:
                Category: Build
                Owner: AWS
                Version: 1
                Provider: CodeBuild
              Configuration:
                ProjectName: !Ref GatsbyCodeBuild
              OutputArtifacts:
                - Name: StaticFiles
              RunOrder: 1

Mappings:
  RegionMap:
    ap-northeast-1:
      S3hostedzoneID: "Z2M4EHUR26P7ZW"
      websiteendpoint: "s3-website-ap-northeast-1.amazonaws.com"
    ap-northeast-2:
      S3hostedzoneID: "Z3W03O7B5YMIYP"
      websiteendpoint: "s3-website.ap-northeast-2.amazonaws.com"
    ap-south-1:
      S3hostedzoneID: "Z11RGJOFQNVJUP"
      websiteendpoint: "s3-website.ap-south-1.amazonaws.com"
    ap-southeast-1:
      S3hostedzoneID: "Z3O0J2DXBE1FTB"
      websiteendpoint: "s3-website-ap-southeast-1.amazonaws.com"
    ap-southeast-2:
      S3hostedzoneID: "Z1WCIGYICN2BYD"
      websiteendpoint: "s3-website-ap-southeast-2.amazonaws.com"
    eu-central-1:
      S3hostedzoneID: "Z21DNDUVLTQW6Q"
      websiteendpoint: "s3-website.eu-central-1.amazonaws.com"
    eu-west-1:
      S3hostedzoneID: "Z1BKCTXD74EZPE"
      websiteendpoint: "s3-website-eu-west-1.amazonaws.com"
    sa-east-1:
      S3hostedzoneID: "Z7KQH4QJS55SO"
      websiteendpoint: "s3-website-sa-east-1.amazonaws.com"
    us-east-1:
      S3hostedzoneID: "Z3AQBSTGFYJSTF"
      websiteendpoint: "s3-website-us-east-1.amazonaws.com"
    us-east-2:
      S3hostedzoneID: "Z2O1EMRO9K5GLX"
      websiteendpoint: "s3-website.us-east-2.amazonaws.com"
    us-west-1:
      S3hostedzoneID: "Z2F56UZL2M1ACD"
      websiteendpoint: "s3-website-us-west-1.amazonaws.com"
    us-west-2:
      S3hostedzoneID: "Z3BJ6K6RIION7M"
      websiteendpoint: "s3-website-us-west-2.amazonaws.com"

Outputs:
  DomainName:
    Description: Domain name
    Value: !Ref DomainName
  RedirectDomainName:
    Description: Redirect hostname
    Value: !If [NeedsNewRedirectBucket, !Ref RedirectBucket, !Ref PreExistingRedirectBucket]
  SiteBucket:
    Value: !If [NeedsNewSiteBucket, !Ref SiteBucket, !Ref PreExistingSiteBucket]
  RedirectBucket:
    Value: !If [NeedsNewRedirectBucket, !Ref RedirectBucket, !Ref PreExistingRedirectBucket]
  LogsBucket:
    Description: S3 Bucket with access logs
    Value: !If [NeedsNewLogsBucket, !Ref LogsBucket, !Ref PreExistingLogsBucket]
  HostedZoneId:
    Description: Route 53 Hosted Zone id
    Value: !If [NeedsNewHostedZone, !Ref Route53HostedZone, "N/A"]
  CloudFrontDomain:
    Description: CloudFront distribution domain name
    Value: !Ref CloudFrontDistribution
  RedirectCloudFrontDomain:
    Description: Redirect CloudFront distribution domain name
    Value: !Ref RedirectCloudFrontDistribution
  CodePipelineArn:
    Description: CodePipeline ARN
    Value: !Ref CodePipeline
  GitRepositoryName:
    Description: Git repository name
    Value: !Ref GitHubRepo

Metadata:
  AWS::CloudFormation::Interface:
    ParameterGroups:
      - Label:
          default: Website and Git repository
        Parameters:
          - DomainName
          - GitHubOwner
          - GitHubRepo
          - GitHubBranch
          - GitHubToken
      - Label:
          default: Git Activity
        Parameters:
          - NotificationEmail
      - Label:
          default: CloudFront CDN
        Parameters:
          - PriceClass
          - MinimumTTL
          - DefaultTTL
      - Label:
          default: PreExisting Resources To Use (Leave empty for stack to create and manage)
        Parameters:
          - PreExistingHostedZoneDomain
          - PreExistingSiteBucket
          - PreExistingRedirectBucket
          - PreExistingLogsBucket
          - PreExistingCodePipelineBucket