template.yml

AWSTemplateFormatVersion: "2010-09-09"
Transform: "AWS::Serverless-2016-10-31"
Description: >
  AWS project to deploy a CDN for hosting static assets in private S3 buckets

Metadata:
  "AWS::ServerlessRepo::Application":
    Name: cloudfront-cdn
    Description: >
      AWS project to deploy a CDN for hosting static assets in private S3 buckets
      Includes: S3 buckets, CloudFront distributions, Route53 record sets
    Author: smoketurner
    SpdxLicenseId: MIT
    LicenseUrl: LICENSE
    ReadmeUrl: README.md
    Labels: ["cdn", "cloudfront", "route53", "s3"]
    HomePageUrl: https://github.com/smoketurner/sam-cdn
    SemanticVersion: 2.2.0
    SourceCodeUrl: https://github.com/smoketurner/sam-cdn

  "AWS::CloudFormation::Interface":
    ParameterGroups:
      - Label:
          default: "Domain Configuration"
        Parameters:
          - DomainName
          - HostedZoneId
          - LogRetentionDays
          - Environment
      - Label:
          default: "Redirect Configuration"
        Parameters:
          - CreateRedirect
          - RedirectSubdomain
      - Label:
          default: "API Origin Configuration"
        Parameters:
          - ApiPath
          - ApiOriginDomainName
          - ApiOriginPath
          - ApiOriginKey
      - Label:
          default: "AppSync Origin Configuration"
        Parameters:
          - AppSyncOriginDomainName
    ParameterLabels:
      CreateRedirect:
        default: "Redirect http(s)://<RedirectSubdomain>.<DomainName> to https://<DomainName>?"

Parameters:
  DomainName:
    Type: String
    Default: ""
    Description: Optional domain name to use (leave blank for *.cloudfront.net)
  Environment:
    Type: String
    Default: dev
    Description: Environment tag value
  RedirectSubdomain:
    Type: String
    Default: www
    Description: Redirect subdomain
  HostedZoneId:
    Type: String
    Description: HostedZoneId for the Domain
    Default: ""
  ApiPath:
    Type: String
    Default: "/api"
    Description: URI path to route to API
  ApiOriginDomainName:
    Type: String
    Default: "api.example.com"
    Description: API origin domain name (set to empty string to disable API origin)
  ApiOriginPath:
    Type: String
    Default: ""
    Description: API origin path (must start with "/")
  ApiOriginKey:
    Type: String
    Default: "NO_API_KEY_SET"
    Description: x-api-key HTTP request header sent to API
  AppSyncOriginDomainName:
    Type: String
    Default: ""
    Description: AppSync origin domain name (will be available at /graphql)
  CreateRedirect:
    Type: String
    Default: "false"
    Description: Set to 'true' to create a CloudFront distribution that redirects https://<RedirectSubdomain>.<DomainName> to https://<DomainName>
    AllowedValues:
      - "true"
      - "false"
  LogRetentionDays:
    Type: Number
    Default: 30
    Description: Number of days to retain access logs

Conditions:
  HasDomainName: !Not [!Equals [!Ref DomainName, ""]]
  CreateRedirect: !And
    - !Condition HasDomainName
    - !Equals [!Ref CreateRedirect, "true"]
  HasApiOrigin: !Not [!Equals [!Ref ApiOriginDomainName, ""]]
  HasAppSyncOrigin: !Not [!Equals [!Ref AppSyncOriginDomainName, ""]]

Rules:
  ValidateRegion:
    Assertions:
      - Assert: !Equals [!Ref "AWS::Region", "us-east-1"]
        AssertDescription: Region must be us-east-1
  ValidateHostedZone:
    RuleCondition: !Not [!Equals [!Ref DomainName, ""]]
    Assertions:
      - Assert: !Not [!Equals [!Ref HostedZoneId, ""]]
        AssertDescription: HostedZoneId is required if DomainName provided

Resources:
  DefaultIndexFunction:
    Type: "AWS::CloudFront::Function"
    Properties:
      AutoPublish: true
      # https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/example-function-add-index.html
      FunctionCode: |-
        function handler(event) {
          var request = event.request;
          var uri = request.uri;

          // Check whether the URI is missing a file name.
          if (uri.endsWith('/')) {
            request.uri += 'index.html';
          }
          // Check whether the URI is missing a file extension.
          else if (!uri.includes('.')) {
            request.uri += '/index.html';
          }

          return request;
        }
      FunctionConfig:
        Comment: Viewer Request - Default Index
        Runtime: cloudfront-js-1.0
      Name: default_index

  TrueClientIpFunction:
    Type: "AWS::CloudFront::Function"
    Properties:
      AutoPublish: true
      # https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/example-function-add-true-client-ip-header.html
      FunctionCode: |-
        function handler(event) {
          var request = event.request;
          var clientIP = event.viewer.ip;

          // Add the true-client-ip header to the incoming request
          request.headers['true-client-ip'] = { value: clientIP };

          return request;
        }
      FunctionConfig:
        Comment: Viewer Request - True-Client-IP
        Runtime: cloudfront-js-1.0
      Name: true_client_ip

  ResponseHeadersPolicy:
    Type: "AWS::CloudFront::ResponseHeadersPolicy"
    Properties:
      ResponseHeadersPolicyConfig:
        Name: WebSecurity-Headers-Policy
        Comment: Common web security response headers
        CorsConfig:
          AccessControlAllowCredentials: false
          AccessControlAllowHeaders:
            Items:
              - "*"
          AccessControlAllowMethods:
            Items:
              - ALL
          AccessControlAllowOrigins:
            Items:
              - "*"
          AccessControlExposeHeaders:
            Items:
              - "*"
          OriginOverride: true
        CustomHeadersConfig:
          Items:
            # opt-out of Google Chrome's FLoC
            # @see https://plausible.io/blog/google-floc#how-to-opt-out-of-floc-as-a-web-developer-set-a-permissions-policy
            - Header: Permissions-Policy
              Value: accelerometer=(), ambient-light-sensor=(), autoplay=(), battery=(), camera=(), cross-origin-isolated=(), display-capture=(), document-domain=(), encrypted-media=(), execution-while-not-rendered=(), execution-while-out-of-viewport=(), fullscreen=(self), geolocation=(), gyroscope=(), keyboard-map=(), magnetometer=(), microphone=(), midi=(), navigation-override=(), payment=(), picture-in-picture=(), publickey-credentials-get=(), screen-wake-lock=(), sync-xhr=(), usb=(), web-share=(), xr-spatial-tracking=(), clipboard-read=(), clipboard-write=(), gamepad=(), speaker-selection=(), conversion-measurement=(), focus-without-user-activation=(), hid=(), idle-detection=(), interest-cohort=(), serial=(), sync-script=(), trust-token-redemption=(), window-placement=(), vertical-scroll=()
              Override: true
        SecurityHeadersConfig:
          ContentSecurityPolicy:
            ContentSecurityPolicy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'; frame-ancestors 'none'
            Override: false
          ContentTypeOptions: # You don't need to specify a value for 'X-Content-Type-Options'.
                              # Simply including it in the template sets its value to 'nosniff'.
            Override: true
          FrameOptions:
            FrameOption: DENY
            Override: true
          ReferrerPolicy:
            ReferrerPolicy: strict-origin-when-cross-origin
            Override: true
          StrictTransportSecurity:
            AccessControlMaxAgeSec: 63072000
            IncludeSubdomains: true
            Preload: true
            Override: false
          XSSProtection:
            ModeBlock: true
            Protection: true
            Override: true
        ServerTimingHeadersConfig:
          Enabled: false

  WebCertificate:
    Type: "AWS::CertificateManager::Certificate"
    Condition: HasDomainName
    Properties:
      CertificateTransparencyLoggingPreference: ENABLED
      DomainName: !Ref DomainName
      DomainValidationOptions:
        - DomainName: !Ref DomainName
          HostedZoneId: !Ref HostedZoneId
        - !If
          - CreateRedirect
          - DomainName: !Sub "${RedirectSubdomain}.${DomainName}"
            HostedZoneId: !Ref HostedZoneId
          - !Ref "AWS::NoValue"
      SubjectAlternativeNames:
        - !Sub "*.${DomainName}"
      ValidationMethod: DNS
      Tags:
        - Key: Name
          Value: !Ref DomainName
        - Key: Environment
          Value: !Ref Environment

  LogBucket:
    Type: "AWS::S3::Bucket"
    UpdateReplacePolicy: Retain
    DeletionPolicy: Retain
    Metadata:
      cfn_nag:
        rules_to_suppress:
          - id: W35
            reason: "Ignore access logging"
    Properties:
      AccessControl: LogDeliveryWrite
      BucketEncryption:
        ServerSideEncryptionConfiguration:
          - ServerSideEncryptionByDefault:
              SSEAlgorithm: AES256
      LifecycleConfiguration:
        Rules:
          - AbortIncompleteMultipartUpload:
              DaysAfterInitiation: 1
            ExpirationInDays: !Ref LogRetentionDays
            Id: RetentionRule
            NoncurrentVersionExpirationInDays: !Ref LogRetentionDays
            Status: Enabled
          - Id: TransitionRule
            Status: Enabled
            Transitions:
              - StorageClass: STANDARD_IA
                TransitionInDays: 30
              - StorageClass: GLACIER
                TransitionInDays: 90
              - StorageClass: DEEP_ARCHIVE
                TransitionInDays: 180
      OwnershipControls:
        Rules:
          - ObjectOwnership: BucketOwnerPreferred # can't use BucketOwnerEnforced with LogDeliveryWrite
      PublicAccessBlockConfiguration:
        BlockPublicAcls: true
        BlockPublicPolicy: true
        IgnorePublicAcls: true
        RestrictPublicBuckets: true
      Tags:
        - Key: Name
          Value: !Sub "${AWS::StackName} Logs"
        - Key: Environment
          Value: !Ref Environment
      VersioningConfiguration:
        Status: Enabled

  LogBucketPolicy:
    Type: "AWS::S3::BucketPolicy"
    Properties:
      Bucket: !Ref LogBucket
      PolicyDocument:
        Statement:
          - Effect: Deny
            Principal: "*"
            Action: "s3:*"
            Resource:
              - !Sub "${LogBucket.Arn}/*"
              - !GetAtt LogBucket.Arn
            Condition:
              Bool:
                "aws:SecureTransport": false

  WebBucket:
    Type: "AWS::S3::Bucket"
    Properties:
      BucketEncryption:
        ServerSideEncryptionConfiguration:
          - ServerSideEncryptionByDefault:
              SSEAlgorithm: AES256
      BucketName: !If
        - HasDomainName
        - !Ref DomainName
        - !Sub "web-${AWS::AccountId}-${AWS::Region}"
      LoggingConfiguration:
        DestinationBucketName: !Ref LogBucket
        LogFilePrefix: !If
          - HasDomainName
          - !Sub "AWSLogs/${AWS::AccountId}/S3/${DomainName}/"
          - !Sub "AWSLogs/${AWS::AccountId}/S3/web-${AWS::AccountId}-${AWS::Region}/"
      OwnershipControls:
        Rules:
          - ObjectOwnership: BucketOwnerEnforced
      PublicAccessBlockConfiguration:
        BlockPublicAcls: true
        BlockPublicPolicy: true
        IgnorePublicAcls: true
        RestrictPublicBuckets: true
      Tags:
        - Key: Name
          Value: !If
            - HasDomainName
            - !Ref DomainName
            - !Sub "web-${AWS::AccountId}-${AWS::Region}"
        - Key: Environment
          Value: !Ref Environment
      VersioningConfiguration:
        Status: Enabled

  WebBucketPolicy:
    Type: "AWS::S3::BucketPolicy"
    Properties:
      Bucket: !Ref WebBucket
      PolicyDocument:
        Statement:
          - Sid: AllowCloudFrontServicePrincipalReadOnly
            Effect: Allow
            Principal:
              Service: !Sub "cloudfront.${AWS::URLSuffix}"
            Action: "s3:GetObject"
            Resource: !Sub "${WebBucket.Arn}/*"
            Condition:
              ArnEquals:
                "aws:SourceArn": !Sub "arn:${AWS::Partition}:cloudfront::${AWS::AccountId}:distribution/${CloudFrontDistribution}"
          - Effect: Deny
            Principal: "*"
            Action: "s3:*"
            Resource:
              - !Sub "${WebBucket.Arn}/*"
              - !GetAtt WebBucket.Arn
            Condition:
              Bool:
                "aws:SecureTransport": false

  RedirectBucket:
    Type: "AWS::S3::Bucket"
    Condition: CreateRedirect
    Metadata:
      cfn_nag:
        rules_to_suppress:
          - id: W35
            reason: "Ignore access logging"
          - id: W51
            reason: "Ignore bucket policy"
    Properties:
      BucketEncryption:
        ServerSideEncryptionConfiguration:
          - ServerSideEncryptionByDefault:
              SSEAlgorithm: AES256
      WebsiteConfiguration:
        RedirectAllRequestsTo:
          HostName: !Ref WebBucket
          Protocol: https
      OwnershipControls:
        Rules:
          - ObjectOwnership: BucketOwnerEnforced
      PublicAccessBlockConfiguration:
        BlockPublicAcls: true
        BlockPublicPolicy: true
        IgnorePublicAcls: true
        RestrictPublicBuckets: true
      Tags:
        - Key: Name
          Value: !Sub "${RedirectSubdomain}.${DomainName}"
        - Key: Environment
          Value: !Ref Environment

  CloudFrontDistribution:
    Type: "AWS::CloudFront::Distribution"
    Properties:
      DistributionConfig:
        Aliases: !If
          - HasDomainName
          - - !Ref DomainName
          - !Ref "AWS::NoValue"
        CacheBehaviors:
          - !If
            - HasApiOrigin
            - AllowedMethods:
                - GET
                - HEAD
                - OPTIONS
                - PUT
                - PATCH
                - POST
                - DELETE
              CachePolicyId: "4135ea2d-6df8-44a3-9df3-4b5a84be39ad" # Managed-CachingDisabled
              Compress: true
              FunctionAssociations:
                - EventType: viewer-request
                  FunctionARN: !Ref TrueClientIpFunction
              OriginRequestPolicyId: "b689b0a8-53d0-40ab-baf2-68738e2966ac" # Managed-AllViewerExceptHostHeader
              PathPattern: !Sub "${ApiPath}*"
              ResponseHeadersPolicyId: !Ref ResponseHeadersPolicy
              TargetOriginId: api
              ViewerProtocolPolicy: redirect-to-https
            - !Ref "AWS::NoValue"
          - !If
            - HasAppSyncOrigin
            - AllowedMethods:
                - GET
                - HEAD
                - OPTIONS
                - PUT
                - PATCH
                - POST
                - DELETE
              CachePolicyId: "4135ea2d-6df8-44a3-9df3-4b5a84be39ad" # Managed-CachingDisabled
              Compress: true
              FunctionAssociations:
                - EventType: viewer-request
                  FunctionARN: !Ref TrueClientIpFunction
              OriginRequestPolicyId: "b689b0a8-53d0-40ab-baf2-68738e2966ac" # Managed-AllViewerExceptHostHeader
              PathPattern: "/graphql*"
              ResponseHeadersPolicyId: !Ref ResponseHeadersPolicy
              TargetOriginId: appsync
              ViewerProtocolPolicy: redirect-to-https
            - !Ref "AWS::NoValue"
        CustomErrorResponses:
          - ErrorCachingMinTTL: 0
            ErrorCode: 403
            ResponseCode: 404
            ResponsePagePath: "/index.html"
          - ErrorCachingMinTTL: 0
            ErrorCode: 404
            ResponseCode: 404
            ResponsePagePath: "/index.html"
        DefaultCacheBehavior:
          AllowedMethods:
            - GET
            - HEAD
            - OPTIONS
          CachedMethods:
            - GET
            - HEAD
            - OPTIONS
          CachePolicyId: "658327ea-f89d-4fab-a63d-7e88639e58f6" # Managed-CachingOptimized
          Compress: true
          FunctionAssociations:
            - EventType: viewer-request
              FunctionARN: !Ref DefaultIndexFunction
          OriginRequestPolicyId: "88a5eaf4-2fd4-4709-b370-b4c650ea3fcf" # Managed-CORS-S3Origin
          ResponseHeadersPolicyId: !Ref ResponseHeadersPolicy
          TargetOriginId: s3
          ViewerProtocolPolicy: redirect-to-https
        DefaultRootObject: "index.html"
        Enabled: true
        HttpVersion: http2and3
        IPV6Enabled: true
        Logging:
          Bucket: !GetAtt LogBucket.DomainName
          IncludeCookies: false
          Prefix: !Sub "AWSLogs/${AWS::AccountId}/CloudFront/"
        Origins:
          - !If
            - HasApiOrigin
            - Id: api
              ConnectionAttempts: 3 # default
              ConnectionTimeout: 10 # seconds
              DomainName: !Ref ApiOriginDomainName
              OriginPath: !Ref ApiOriginPath
              OriginCustomHeaders:
                - HeaderName: "x-api-key"
                  HeaderValue: !Ref ApiOriginKey
              CustomOriginConfig:
                OriginProtocolPolicy: https-only
                OriginSSLProtocols:
                  - "TLSv1.2"
            - !Ref "AWS::NoValue"
          - !If
            - HasAppSyncOrigin
            - Id: appsync
              ConnectionAttempts: 3 # default
              ConnectionTimeout: 10 # seconds
              DomainName: !Ref AppSyncOriginDomainName
              CustomOriginConfig:
                OriginProtocolPolicy: https-only
                OriginSSLProtocols:
                  - "TLSv1.2"
            - !Ref "AWS::NoValue"
          - Id: s3
            ConnectionAttempts: 3 # default
            ConnectionTimeout: 10 # seconds
            DomainName: !GetAtt WebBucket.RegionalDomainName
            OriginAccessControlId: !Ref CloudFrontOriginAccessControl
            S3OriginConfig: {}
        PriceClass: PriceClass_100
        ViewerCertificate: !If
          - HasDomainName
          - AcmCertificateArn: !Ref WebCertificate
            MinimumProtocolVersion: TLSv1.2_2021
            SslSupportMethod: sni-only
          - CloudFrontDefaultCertificate: true
      Tags:
        - !If
          - HasDomainName
          - Key: Name
            Value: !Ref DomainName
          - !Ref "AWS::NoValue"
        - Key: Environment
          Value: !Ref Environment

  RedirectCloudFrontDistribution:
    Type: "AWS::CloudFront::Distribution"
    Condition: CreateRedirect
    Metadata:
      cfn_nag:
        rules_to_suppress:
          - id: W10
            reason: "Ignore access logging"
    Properties:
      DistributionConfig:
        Aliases:
          - !Sub "${RedirectSubdomain}.${DomainName}"
        DefaultCacheBehavior:
          AllowedMethods:
            - GET
            - HEAD
          CachePolicyId: "658327ea-f89d-4fab-a63d-7e88639e58f6" # Managed-CachingOptimized
          Compress: true
          OriginRequestPolicyId: "acba4595-bd28-49b8-b9fe-13317c0390fa" # Managed-UserAgentRefererHeaders
          TargetOriginId: s3
          ViewerProtocolPolicy: redirect-to-https
        Enabled: true
        HttpVersion: http2and3
        IPV6Enabled: true
        Origins:
          - Id: s3
            ConnectionAttempts: 3 # default
            ConnectionTimeout: 10 # seconds
            DomainName: !Sub "${RedirectBucket}.s3-website-${AWS::Region}.amazonaws.com"
            CustomOriginConfig:
              OriginProtocolPolicy: http-only # private bucket access only works over HTTP
        PriceClass: PriceClass_100
        ViewerCertificate:
          AcmCertificateArn: !Ref WebCertificate
          MinimumProtocolVersion: TLSv1.2_2021
          SslSupportMethod: sni-only
      Tags:
        - Key: Name
          Value: !Sub "${RedirectSubdomain}.${DomainName}"
        - Key: Environment
          Value: !Ref Environment

  CloudFrontOriginAccessControl:
    Type: "AWS::CloudFront::OriginAccessControl"
    Properties:
      OriginAccessControlConfig:
        Description: !Ref "AWS::StackName"
        Name: !Ref "AWS::StackName"
        OriginAccessControlOriginType: s3
        SigningBehavior: always
        SigningProtocol: sigv4

  WebRecordSetGroup:
    Type: "AWS::Route53::RecordSetGroup"
    Condition: HasDomainName
    Properties:
      HostedZoneId: !Ref HostedZoneId
      RecordSets:
        - AliasTarget:
            DNSName: !GetAtt CloudFrontDistribution.DomainName
            EvaluateTargetHealth: false
            HostedZoneId: Z2FDTNDATAQYW2 # CloudFront hosted zone ID
          Name: !Ref DomainName
          Type: A
        - AliasTarget:
            DNSName: !GetAtt CloudFrontDistribution.DomainName
            EvaluateTargetHealth: false
            HostedZoneId: Z2FDTNDATAQYW2 # CloudFront hosted zone ID
          Name: !Ref DomainName
          Type: AAAA

  RedirectRecordSetGroup:
    Type: "AWS::Route53::RecordSetGroup"
    Condition: CreateRedirect
    Properties:
      HostedZoneId: !Ref HostedZoneId
      RecordSets:
        - AliasTarget:
            DNSName: !GetAtt RedirectCloudFrontDistribution.DomainName
            EvaluateTargetHealth: false
            HostedZoneId: Z2FDTNDATAQYW2 # CloudFront hosted zone ID
          Name: !Sub "${RedirectSubdomain}.${DomainName}"
          Type: A
        - AliasTarget:
            DNSName: !GetAtt RedirectCloudFrontDistribution.DomainName
            EvaluateTargetHealth: false
            HostedZoneId: Z2FDTNDATAQYW2 # CloudFront hosted zone ID
          Name: !Sub "${RedirectSubdomain}.${DomainName}"
          Type: AAAA

Outputs:
  CloudFrontDistributionId:
    Description: CloudFront Distribution ID
    Value: !Ref CloudFrontDistribution
  CloudFrontDomainName:
    Description: CloudFront Domain Name
    Value: !GetAtt CloudFrontDistribution.DomainName
  CertificateArn:
    Description: SSL Certficate ARN
    Value: !Ref WebCertificate
    Condition: HasDomainName
  WebBucketName:
    Description: Web S3 Bucket Name
    Value: !Ref WebBucket
  WebBucketArn:
    Description: Web S3 Bucket ARN
    Value: !GetAtt WebBucket.Arn
  WebBucketDomainName:
    Description: Web S3 Bucket Domain Name
    Value: !GetAtt WebBucket.RegionalDomainName
  LogBucketName:
    Description: Log S3 Bucket Name
    Value: !Ref LogBucket
  LogBucketArn:
    Description: Log S3 Bucket ARN
    Value: !GetAtt LogBucket.Arn
  LogBucketDomainName:
    Description: Log S3 Bucket Domain Name
    Value: !GetAtt LogBucket.RegionalDomainName