cloudformation.yml

AWSTemplateFormatVersion: '2010-09-09'

#
# CloudFormation input parameters
#
Parameters:
  TLD:
    Type: String
    Description: TLD name needed by Route53 to perform DNS (example.com)
  Domain:
    Type: String
    Description: Domain name for your website (example.com)
  Redirect:
    Type: String
    Description: Redirect to Domain (www.example.com redirects to example.com)
    Default: ''
  GitHubOwner:
    Type: String
    Description: GitHub repository owner
    Default: ''
  GitHubRepo:
    Type: String
    Default: aws-codepipeline-nested-stack
    Description: GitHub repository name
    Default: ''
  GitHubToken:
    Type: String
    Description: GitHub repository OAuth token
    Default: ''
  GitHubBranch:
    Type: String
    Description: GitHub repository branch
    Default: ''

Conditions:
  NeedsRedirect: !Not [!Equals [!Ref Redirect, '']]
  NeedsCICD: !And
    - !Not [!Equals [!Ref GitHubOwner, '']]
    - !Not [!Equals [!Ref GitHubRepo, '']]
    - !Not [!Equals [!Ref GitHubToken, '']]
    - !Not [!Equals [!Ref GitHubBranch, '']]


#
# CloudFormation resources
#
Resources:

  #
  # Website buckets
  #
  WebsiteBucket:
    Type: AWS::S3::Bucket
    Properties:
      BucketName: !Ref Domain
      AccessControl: PublicRead
      WebsiteConfiguration:
        IndexDocument: 'index.html'
        ErrorDocument: '404.html'

  RedirectBucket:
    Type: AWS::S3::Bucket
    Condition: NeedsRedirect
    Properties:
      BucketName: !Ref Redirect
      AccessControl: BucketOwnerFullControl
      WebsiteConfiguration:
        RedirectAllRequestsTo:
          HostName: !Ref Domain

  #
  # SSL Certificate needed by CloudFront.
  #
  SSL:
    Type: AWS::CertificateManager::Certificate
    Properties:
      DomainName: !Ref Domain
      DomainValidationOptions:
        - DomainName: !Ref Domain
          ValidationDomain: !Ref TLD

  #
  # CloudFront CDN
  #
  CDN:
    Type: AWS::CloudFront::Distribution
    Properties:
      DistributionConfig:
        Aliases:
          - !Ref Domain
        Enabled: true
        PriceClass: 'PriceClass_All'
        CacheBehaviors:
          -
            TargetOriginId: !Ref WebsiteBucket
            PathPattern: '*.js'
            ViewerProtocolPolicy: 'redirect-to-https'
            MinTTL: 0
            AllowedMethods:
              - 'HEAD'
              - 'GET'
            CachedMethods:
              - 'HEAD'
              - 'GET'
            ForwardedValues:
              QueryString: true
              Cookies:
                Forward: 'none'
          -
            TargetOriginId: !Ref WebsiteBucket
            PathPattern: '*.css'
            ViewerProtocolPolicy: 'redirect-to-https'
            MinTTL: 0
            AllowedMethods:
              - 'HEAD'
              - 'GET'
            CachedMethods:
              - 'HEAD'
              - 'GET'
            ForwardedValues:
              QueryString: true
              Cookies:
                Forward: 'none'
        DefaultCacheBehavior:
          TargetOriginId: !Ref WebsiteBucket
          ViewerProtocolPolicy: 'redirect-to-https'
          MinTTL: 0
          AllowedMethods:
            - 'HEAD'
            - 'GET'
          CachedMethods:
            - 'HEAD'
            - 'GET'
          ForwardedValues:
            QueryString: false
            Cookies:
              Forward: none
        Origins:
          -
            Id: !Ref WebsiteBucket
            DomainName:
              Fn::Join:
                - ''
                - - !Ref Domain
                  - '.s3-website-'
                  - !Ref AWS::Region
                  - '.amazonaws.com'
            CustomOriginConfig:
              HTTPPort: 80
              HTTPSPort: 443
              OriginProtocolPolicy: 'http-only'
        Restrictions:
          GeoRestriction:
            RestrictionType: 'none'
        ViewerCertificate:
          SslSupportMethod: 'sni-only'
          MinimumProtocolVersion: 'TLSv1'
          AcmCertificateArn: !Ref SSL

  #
  # Route53 DNS record set to map our domain to our CDN
  #
  DomainDNS:
    Type: AWS::Route53::RecordSetGroup
    Properties:
      HostedZoneName:
        Fn::Join:
          - ''
          - - !Ref TLD
            - '.'
      RecordSets:
        -
          Name: !Ref Domain
          Type: 'A'
          AliasTarget:
            HostedZoneId: 'Z2FDTNDATAQYW2' # http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-route53-aliastarget.html#cfn-route53-aliastarget-hostedzoneid
            DNSName: !GetAtt CDN.DomainName

  #
  # Route53 DNS record set to map our redirect to our domain (www.example.com -> example.com)
  #
  RedirectDNS:
    Type: AWS::Route53::RecordSet
    Condition: NeedsRedirect
    Properties:
      HostedZoneName:
        Fn::Join:
          - ''
          - - !Ref TLD
            - '.'
      Name: !Ref Redirect
      Type: 'CNAME'
      TTL: 900
      ResourceRecords:
        -
          Fn::Join:
            - ''
            - - !Ref Domain
              - '.s3-website-'
              - !Ref AWS::Region
              - '.amazonaws.com'

  #
  # CI/CD
  #
  ArtifactsBucket:
    Type: AWS::S3::Bucket
    Condition: NeedsCICD
    Properties:
      AccessControl: Private

  #
  # CodeBuild Permissions
  #
  CodeBuildRole:
    Type: AWS::IAM::Role
    Condition: NeedsCICD
    Properties:
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Action:
              - sts:AssumeRole
            Principal:
              Service:
                - codebuild.amazonaws.com

  CodeBuildRolePolicy:
    Type: AWS::IAM::Policy
    Condition: NeedsCICD
    Properties:
      PolicyName: CodeBuildRolePolicy
      PolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Action:
              - logs:CreateLogGroup
              - logs:CreateLogStream
              - logs:PutLogEvents
            Resource: '*'
          - Effect: Allow
            Action:
              - s3:*
            Resource:
              - !Sub 'arn:aws:s3:::${ArtifactsBucket}'
              - !Sub 'arn:aws:s3:::${ArtifactsBucket}/*'
              - !Sub 'arn:aws:s3:::${WebsiteBucket}'
              - !Sub 'arn:aws:s3:::${WebsiteBucket}/*'
      Roles:
        - !Ref CodeBuildRole

  #
  # CodeBuild
  #
  CodeBuildProject:
    Type: AWS::CodeBuild::Project
    Condition: NeedsCICD
    Properties:
      Artifacts:
        Type: CODEPIPELINE
      Environment:
        ComputeType: BUILD_GENERAL1_SMALL
        Image: aws/codebuild/eb-nodejs-6.10.0-amazonlinux-64:4.0.0
        Type: LINUX_CONTAINER
        EnvironmentVariables:
          -
            Name: 'BUCKET_NAME'
            Value: !Ref WebsiteBucket
      Name:
        Fn::Join:
          - ''
          - - Ref: AWS::StackName
            - '-code-build'
      ServiceRole: !GetAtt CodeBuildRole.Arn
      Source:
        Type: CODEPIPELINE
        BuildSpec: buildspec.yml
      TimeoutInMinutes: 5 # must be between 5 minutes and 8 hours

  #
  # CodePipeline Permissions
  #
  CodePipelineRole:
    Type: AWS::IAM::Role
    Condition: NeedsCICD
    Properties:
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Action:
              - sts:AssumeRole
            Principal:
              Service:
                - codepipeline.amazonaws.com
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/AdministratorAccess

  #
  # CodePipeline
  #
  CodePipeline:
    Type: AWS::CodePipeline::Pipeline
    Condition: NeedsCICD
    Properties:
      ArtifactStore:
        Type: S3
        Location: !Ref ArtifactsBucket
      RestartExecutionOnUpdate: true
      RoleArn: !GetAtt CodePipelineRole.Arn
      Stages:
      - Name: Source
        Actions:
        - Name: Source
          ActionTypeId:
            Category: Source
            Owner: ThirdParty
            Version: 1
            Provider: GitHub
          Configuration:
            Owner: !Ref GitHubOwner
            Repo: !Ref GitHubRepo
            Branch: !Ref GitHubBranch
            OAuthToken: !Ref GitHubToken
          OutputArtifacts:
            - Name: SourceOutput
          RunOrder: 1
      - Name: Build
        Actions:
          - Name: BuildTestDeploy
            ActionTypeId:
              Category: Build
              Owner: AWS
              Provider: CodeBuild
              Version: 1
            Configuration:
              ProjectName: !Ref CodeBuildProject
            InputArtifacts:
              - Name: SourceOutput
            OutputArtifacts:
              - Name: BuildOutput

#
# Outputs to be used by other CloudFormation templates if needed.
#
#Outputs:
#  LambdaFunction:
#    Description: Lambda Function
#    Value: !Ref LambdaFunction
#    Export:
#      Name: !Sub '${AWS::StackName}-LambdaFunction'
#  S3Bucket:
#    Description: S3 Bucket
#    Value: !Ref S3Bucket
#    Export:
#      Name: !Sub '${AWS::StackName}-S3Bucket'