codepipeline-powered-static-website-cloudformation.yml

---
AWSTemplateFormatVersion: "2010-09-09"

Description: |
  Static web site stack including:
  * CodePipeline integrating:
    * Source stage from either code-commit or github
    * Build stage to run a buildspec (eg. upload the static website upon git commit)
  * S3 bucket for web site content
  * Redirect from "www." to base domain
  * Access logs written to logs bucket
  * ACM Certificate for SSL
  * CloudFront distributions for website https access
  * Route 53 hosted zone with DNS entries
  * S3 bucket for CodePipeline artifacts
  * SNS topic for CodeCommit Git change notifications
  * Email address subscribed to SNS notification topic

Parameters:
  # Domain: example.com
  DomainName:
    Type: String
    Description: "The base domain name for the web site (no 'www')"
    MinLength: 4
    MaxLength: 253
    AllowedPattern: "[a-z0-9]+[-.a-z0-9]*(\\.[a-z][a-z]+)+"
    ConstraintDescription: "Provide a valid domain name using only lowercase letters, numbers, and dash (-)"

  # Email address to receive Git activity notifications: you@anotherdomain.com
  # CANNOT be in same domain!
  NotificationEmail:
    Type: String
    Description: "Initial email address to receive Git change notifications"
    MinLength: 6
    AllowedPattern: ".+@[a-z0-9]+[-.a-z0-9]*(\\.[a-z][a-z]+)+"
    ConstraintDescription: "Provide a valid email address"

  DefaultTTL:
    Type: Number
    Description: "TTL in seconds"
    Default: 50000

  MinimumTTL:
    Description: "Minimum cache lifetime in seconds for the CloudFront distribution"
    Default: 60
    Type: Number

  PriceClass:
    Description: "Distribution price class. Default is US-only, PriceClass_All is worldwide but more expensive."
    Default: PriceClass_100
    AllowedValues:
      - PriceClass_100
      - PriceClass_200
      - PriceClass_All
    Type: String


  SourceType:
    Description: "CodeCommit | GitHub"
    Type: String
    Default: "CodeCommit"
    AllowedValues:
      - CodeCommit
      - GitHub
  BranchName:
    Description: "Name of branch to build from"
    Type: String
    Default: master
  GithubOauthToken:
    Type: String
    NoEcho: true
    Description: "For Github integrations this is necessary. Otherwise leave blank."
  GithubRepoOwner:
    Type: String
    Description: "For Github integrations this is necessary. Otherwise leave blank."

  GithubRepoName:
    Type: String
    Description: "For Github integrations this is necessary. Otherwise leave blank."



  BuildEnvironmentImage:
    Description: "Optional image to use for codebuild eg. docker:dind defaults to a ruby environment suitable for Jekyll builds."
    Type: String
    Default: "aws/codebuild/ruby:2.3.1"

  PreExistingGitRepository:
    Description: "Optional Git repository name for pre-existing git repository. Leave empty to have CodeCommit Repository created and managed by this stack."
    Type: String
    Default: ""

  PreExistingHostedZoneDomain:
    Description: "Optional domain name for pre-existing Route 53 hosted zone. Leave empty to have hosted zone created and managed by this stack."
    Type: String
    Default: ""

  PreExistingSiteBucket:
    Description: "Optional name of pre-existing website bucket. Leave empty to have website bucket created and managed by this stack."
    Type: String
    Default: ""

  PreExistingRedirectBucket:
    Description: "Optional name of pre-existing redirect bucket. Leave empty to have redirect bucket created and managed by this stack."
    Type: String
    Default: ""

  PreExistingLogsBucket:
    Description: "Optional name of pre-existing access logs bucket. Leave empty to have access logs bucket created and managed by this stack."
    Type: String
    Default: ""

  PreExistingCodePipelineBucket:
    Description: "Optional name of pre-existing CodePipeline artifact bucket. Leave empty to have CodePipeline bucket created and managed by this stack."
    Type: String
    Default: ""

Conditions:
  IsCodeCommit: !Equals [!Ref SourceType, "CodeCommit"]
  NeedsNewGitRepository: !And [!Equals [!Ref PreExistingGitRepository, ""], !Equals [!Ref SourceType, "CodeCommit"]]
  NeedsNewHostedZone: !Equals [!Ref PreExistingHostedZoneDomain, ""]
  NeedsNewSiteBucket: !Equals [!Ref PreExistingSiteBucket, ""]
  NeedsNewRedirectBucket: !Equals [!Ref PreExistingRedirectBucket, ""]
  NeedsNewLogsBucket: !Equals [!Ref PreExistingLogsBucket, ""]
  NeedsNewCodePipelineBucket: !Equals [!Ref PreExistingCodePipelineBucket, ""]

Resources:
  # Bucket for CloudFront and S3 access logs: logs.example.com
  LogsBucket:
    Condition: NeedsNewLogsBucket
    Type: "AWS::S3::Bucket"
    Properties:
      BucketName: !Sub "logs.${DomainName}"
      AccessControl: LogDeliveryWrite
    DeletionPolicy: Retain

  # Bucket for site content: example.com
  SiteBucket:
    Condition: NeedsNewSiteBucket
    Type: "AWS::S3::Bucket"
    Properties:
      BucketName: !Ref DomainName
      AccessControl: PublicRead
      WebsiteConfiguration:
        IndexDocument: index.html
        ErrorDocument: 404.html
      # logs.example.com/logs/s3/example.com/
      LoggingConfiguration:
        DestinationBucketName: !If [NeedsNewLogsBucket, !Ref LogsBucket, !Ref PreExistingLogsBucket]
        LogFilePrefix: !Sub "logs/s3/${DomainName}/"
    DeletionPolicy: Retain

  # bucket policy to provide read access to assets in SiteBucket
  SiteBucketPolicy:
    Type: "AWS::S3::BucketPolicy"
    Properties: 
      Bucket: !If [NeedsNewSiteBucket, !Ref SiteBucket, !Ref PreExistingSiteBucket]
      PolicyDocument: 
        Statement: 
          -
            Action: 
              - "s3:GetObject"
            Effect: "Allow"
            Resource: 
              - !Join ["", 
                [
                  "arn:aws:s3:::",
                  !If [
                    NeedsNewSiteBucket,
                    !Ref SiteBucket,
                    !Ref PreExistingSiteBucket
                  ],
                  "/*"
                ],
              ]
            Principal: "*"

  # Bucket to redirect to example.com: www.example.com
  RedirectBucket:
    Condition: NeedsNewRedirectBucket
    Type: "AWS::S3::Bucket"
    Properties:
      BucketName: !Sub "www.${DomainName}"
      AccessControl: BucketOwnerFullControl
      # logs.example.com/logs/s3/www.example.com/
      LoggingConfiguration:
        DestinationBucketName: !If [NeedsNewLogsBucket, !Ref LogsBucket, !Ref PreExistingLogsBucket]
        LogFilePrefix: !Sub "logs/s3/www.${DomainName}/"
      WebsiteConfiguration:
        RedirectAllRequestsTo:
          HostName: !Ref DomainName
          Protocol: https
    DeletionPolicy: Delete

  # Bucket for CodePipeline artifact storage: codepipeline.example.com
  CodePipelineBucket:
    Condition: NeedsNewCodePipelineBucket
    Type: "AWS::S3::Bucket"
    Properties:
      BucketName: !Sub "codepipeline.${DomainName}"
      VersioningConfiguration:
        Status: Enabled
    DeletionPolicy: Retain

  # Certificate for HTTPS accesss through CloudFront
  Certificate:
    Type: "AWS::CertificateManager::Certificate"
    Properties:
      DomainName: !Ref DomainName
      SubjectAlternativeNames:
        - !Sub "www.${DomainName}"

  # CDN serves S3 content over HTTPS for example.com
  CloudFrontDistribution:
    Type: "AWS::CloudFront::Distribution"
    Properties:
      DistributionConfig:
        Enabled: true
        Aliases:
          - !Ref DomainName
        DefaultRootObject: index.html
        PriceClass: !Ref PriceClass
        Origins:
          -
            DomainName: !Join ["", [!Ref DomainName, ".", !FindInMap [RegionMap, !Ref "AWS::Region", websiteendpoint]]]
            Id: S3Origin
            CustomOriginConfig:
              HTTPPort: 80
              HTTPSPort: 443
              OriginProtocolPolicy: http-only
        DefaultCacheBehavior:
          TargetOriginId: S3Origin
          AllowedMethods:
            - GET
            - HEAD
          Compress: true
          DefaultTTL: !Ref DefaultTTL
          MinTTL: !Ref MinimumTTL
          ForwardedValues:
            QueryString: false
            Cookies:
             Forward: none
          ViewerProtocolPolicy: redirect-to-https
        # logs.example.com/logs/cloudfront/example.com/
        Logging:
          Bucket: !Join ["", [!If [NeedsNewLogsBucket, !Ref LogsBucket, !Ref PreExistingLogsBucket], ".s3.amazonaws.com"]]
          Prefix: !Sub "logs/cloudfront/${DomainName}/"
          IncludeCookies: false
        ViewerCertificate:
          AcmCertificateArn: !Ref Certificate
          SslSupportMethod: sni-only

  # CDN serves S3 content over HTTPS for www.example.com
  RedirectCloudFrontDistribution:
    Type: "AWS::CloudFront::Distribution"
    Properties:
      DistributionConfig:
        Enabled: true
        Aliases:
          - !If [NeedsNewRedirectBucket, !Ref RedirectBucket, !Ref PreExistingRedirectBucket]
        PriceClass: PriceClass_100
        Origins:
          -
            DomainName: !Join ["", [!If [NeedsNewRedirectBucket, !Ref RedirectBucket, !Ref PreExistingRedirectBucket], ".", !FindInMap [RegionMap, !Ref "AWS::Region", websiteendpoint]]]
            Id: RedirectS3Origin
            CustomOriginConfig:
              HTTPPort: 80
              HTTPSPort: 443
              OriginProtocolPolicy: http-only
        DefaultCacheBehavior:
          TargetOriginId: RedirectS3Origin
          AllowedMethods:
            - GET
            - HEAD
          DefaultTTL: !Ref DefaultTTL
          MinTTL: !Ref MinimumTTL
          ForwardedValues:
            QueryString: false
            Cookies:
             Forward: none
          ViewerProtocolPolicy: allow-all
        # logs.example.com/logs/cloudfront/www.example.com/
        Logging:
          Bucket: !Join ["", [!If [NeedsNewLogsBucket, !Ref LogsBucket, !Ref PreExistingLogsBucket], ".s3.amazonaws.com"]]
          Prefix: !Sub "logs/cloudfront/www.${DomainName}/"
          IncludeCookies: false
        ViewerCertificate:
          AcmCertificateArn: !Ref Certificate
          SslSupportMethod: sni-only

  # DNS: example.com, www.example.com
  Route53HostedZone:
    Condition: NeedsNewHostedZone
    Type: "AWS::Route53::HostedZone"
    Properties:
      HostedZoneConfig:
        Comment: !Sub "Created by CloudFormation stack: ${AWS::StackName}"
      Name: !Ref DomainName
    DeletionPolicy: Retain
  Route53RecordSetGroup:
    Type: "AWS::Route53::RecordSetGroup"
    Properties:
      HostedZoneId: !If [NeedsNewHostedZone, !Ref Route53HostedZone, !Ref "AWS::NoValue"]
      HostedZoneName: !If [NeedsNewHostedZone, !Ref "AWS::NoValue", !Sub "${PreExistingHostedZoneDomain}."]
      RecordSets:
        # example.com
        - Name: !Sub "${DomainName}."
          Type: A
          # Resolve to CloudFront distribution
          AliasTarget:
            HostedZoneId: Z2FDTNDATAQYW2 # CloudFront
            DNSName: !GetAtt CloudFrontDistribution.DomainName
        # www.example.com
        - Name: !Sub "www.${DomainName}."
          Type: A
          # Resolve to Redirect CloudFront distribution
          AliasTarget:
            HostedZoneId: Z2FDTNDATAQYW2 # CloudFront
            DNSName: !GetAtt RedirectCloudFrontDistribution.DomainName

  # SNS topic for Git repository activity. Email subscription
  NotificationTopic:
    Type: "AWS::SNS::Topic"
    Properties:
      DisplayName: !Sub "Activity in ${DomainName} Git repository"
      Subscription:
        - Endpoint: !Ref NotificationEmail
          Protocol: email

  # Git repository: example.com
  GitRepository:
    Condition: NeedsNewGitRepository
    Type: "AWS::CodeCommit::Repository"
    Properties:
      RepositoryDescription: !Sub "Git repository for ${DomainName}"
      RepositoryName: !Ref DomainName
      Triggers:
        - Name: !Sub "Activity in ${DomainName} Git repository"
          DestinationArn: !Ref NotificationTopic
          Events:
            - all
    DeletionPolicy: Retain

  # IAM info for AWS Lambda functions
  CodeBuildExecutionRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          Effect: Allow
          Principal:
            Service: codebuild.amazonaws.com
          Action: sts:AssumeRole
        Version: '2012-10-17'
      Path: "/"
      Policies:
        - PolicyName: !Sub "${DomainName}-codebuild-policy"
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Effect: Allow
                Action: "logs:*"
                Resource: "arn:aws:logs:*:*:*"
              - Effect: Allow
                Action:
                  - s3:*
                Resource:
                  - !Join ["", ["arn:aws:s3:::", !If [NeedsNewSiteBucket, !Ref SiteBucket, !Ref PreExistingSiteBucket], "/*"]]
                  - !Join ["", ["arn:aws:s3:::", !If [NeedsNewCodePipelineBucket, !Ref CodePipelineBucket, !Ref PreExistingCodePipelineBucket], "/*"]]

  # IAM info for CodePipeline
  CodePipelineRole:
    Type: "AWS::IAM::Role"
    Properties:
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - "codebuild.amazonaws.com"
                - "codepipeline.amazonaws.com"
            Action:
              - "sts:AssumeRole"
      Path: "/"
      Policies:
        - PolicyName: "codepipeline-service"
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Effect: "Allow"
                Action: "*"
                Resource: "*"

  BuildCopySourceProject:
    Type: AWS::CodeBuild::Project
    Properties:
      Name: !Sub BuildCopySource-${AWS::StackName}
      Description: Build static site and copy to s3
      ServiceRole: !GetAtt CodeBuildExecutionRole.Arn
      Environment:
        Type: LINUX_CONTAINER
        ComputeType: BUILD_GENERAL1_SMALL
        Image: !Ref BuildEnvironmentImage
        EnvironmentVariables:
          - Name: TARGET_S3_BUCKET
            Value: !Join ["", ["s3://", !If [NeedsNewSiteBucket, !Ref SiteBucket, !Ref PreExistingSiteBucket]]]
      Source:
        Type: CODEPIPELINE
      Artifacts:
        Type: CODEPIPELINE
      TimeoutInMinutes: 15
      EncryptionKey: !Sub arn:aws:kms:${AWS::Region}:${AWS::AccountId}:alias/aws/s3
      Tags:
        - Key: Name
          Value: !Sub BuildCopySource-${AWS::StackName}

  # CodePipeline: Pass Git contents to AWS Lambda function on Git activity
  CodePipeline:
    Type: "AWS::CodePipeline::Pipeline"
    Properties:
      Name: !Sub "${DomainName}-codepipeline"
      ArtifactStore:
        Type: S3
        Location: !If [NeedsNewCodePipelineBucket, !Ref CodePipelineBucket, !Ref PreExistingCodePipelineBucket]
      RestartExecutionOnUpdate: false
      RoleArn: !Sub "arn:aws:iam::${AWS::AccountId}:role/${CodePipelineRole}"
      Stages:
        - Name: Source
          Actions:
            - Name: SourceAction
              ActionTypeId:
                Category: Source
                Owner: !If [IsCodeCommit, "AWS", "ThirdParty"]
                Provider: !Ref SourceType
                Version: 1
              Configuration:
                !If
                - IsCodeCommit
                - 
                  RepositoryName: !If [NeedsNewGitRepository, !Ref DomainName, !Ref PreExistingGitRepository]
                  BranchName: !Ref BranchName
                -
                  Owner: !Ref GithubRepoOwner
                  Repo: !Ref GithubRepoName
                  Branch: !Ref BranchName
                  OAuthToken: !Ref GithubOauthToken
              OutputArtifacts:
                - Name: SiteSource
              RunOrder: 1
        - Name: MakeWebsite
          Actions:
            - Name: Build
              InputArtifacts:
                - Name: SiteSource
              ActionTypeId:
                Category: Build
                Owner: AWS
                Version: 1
                Provider: CodeBuild
              Configuration:
                ProjectName:
                  Ref: BuildCopySourceProject
              RunOrder: 1
Mappings:
  RegionMap:
    ap-northeast-1:
      S3hostedzoneID: "Z2M4EHUR26P7ZW"
      websiteendpoint: "s3-website-ap-northeast-1.amazonaws.com"
    ap-northeast-2:
      S3hostedzoneID: "Z3W03O7B5YMIYP"
      websiteendpoint: "s3-website.ap-northeast-2.amazonaws.com"
    ap-south-1:
      S3hostedzoneID: "Z11RGJOFQNVJUP"
      websiteendpoint: "s3-website.ap-south-1.amazonaws.com"
    ap-southeast-1:
      S3hostedzoneID: "Z3O0J2DXBE1FTB"
      websiteendpoint: "s3-website-ap-southeast-1.amazonaws.com"
    ap-southeast-2:
      S3hostedzoneID: "Z1WCIGYICN2BYD"
      websiteendpoint: "s3-website-ap-southeast-2.amazonaws.com"
    eu-central-1:
      S3hostedzoneID: "Z21DNDUVLTQW6Q"
      websiteendpoint: "s3-website.eu-central-1.amazonaws.com"
    eu-west-1:
      S3hostedzoneID: "Z1BKCTXD74EZPE"
      websiteendpoint: "s3-website-eu-west-1.amazonaws.com"
    sa-east-1:
      S3hostedzoneID: "Z7KQH4QJS55SO"
      websiteendpoint: "s3-website-sa-east-1.amazonaws.com"
    us-east-1:
      S3hostedzoneID: "Z3AQBSTGFYJSTF"
      websiteendpoint: "s3-website-us-east-1.amazonaws.com"
    us-east-2:
      S3hostedzoneID: "Z2O1EMRO9K5GLX"
      websiteendpoint: "s3-website.us-east-2.amazonaws.com"
    us-west-1:
      S3hostedzoneID: "Z2F56UZL2M1ACD"
      websiteendpoint: "s3-website-us-west-1.amazonaws.com"
    us-west-2:
      S3hostedzoneID: "Z3BJ6K6RIION7M"
      websiteendpoint: "s3-website-us-west-2.amazonaws.com"

Outputs:
  DomainName:
    Description: Domain name
    Value: !Ref DomainName
  RedirectDomainName:
    Description: Redirect hostname
    Value: !If [NeedsNewRedirectBucket, !Ref RedirectBucket, !Ref PreExistingRedirectBucket]
  SiteBucket:
    Value: !If [NeedsNewSiteBucket, !Ref SiteBucket, !Ref PreExistingSiteBucket]
  RedirectBucket:
    Value: !If [NeedsNewRedirectBucket, !Ref RedirectBucket, !Ref PreExistingRedirectBucket]
  LogsBucket:
    Description: S3 Bucket with access logs
    Value: !If [NeedsNewLogsBucket, !Ref LogsBucket, !Ref PreExistingLogsBucket]
  HostedZoneId:
    Description: Route 53 Hosted Zone id
    Value: !If [NeedsNewHostedZone, !Ref Route53HostedZone, "N/A"]
  CloudFrontDomain:
    Description: CloudFront distribution domain name
    Value: !Ref CloudFrontDistribution
  RedirectCloudFrontDomain:
    Description: Redirect CloudFront distribution domain name
    Value: !Ref RedirectCloudFrontDistribution
  CodePipelineArn:
    Description: CodePipeline ARN
    Value: !Ref CodePipeline
  GitRepositoryName:
    Description: Git repository name
    Value: !If [NeedsNewGitRepository, !Ref DomainName, !Ref PreExistingGitRepository]
  GitCloneUrlHttp:
    Description: Git https clone endpoint
    Value: !If [NeedsNewGitRepository, !GetAtt GitRepository.CloneUrlHttp, "N/A"]
  GitCloneUrlSsh:
    Description: Git ssh clone endpoint
    Value: !If [NeedsNewGitRepository, !GetAtt GitRepository.CloneUrlSsh, "N/A"]

Metadata:
  AWS::CloudFormation::Interface:
    ParameterGroups:
      - Label:
          default: Website
        Parameters:
          - DomainName
      - Label:
          default: Source Code Repository
        Parameters:
          - SourceType
          - BranchName
          - GithubRepoOwner
          - GithubRepoName
          - GithubOauthToken
      - Label:
          default: Git Activity
        Parameters:
          - NotificationEmail
      - Label:
          default: CodeBuild
        Parameters:
          - BuildEnvironmentImage
      - Label:
          default: CloudFront CDN
        Parameters:
          - PriceClass
          - MinimumTTL
          - DefaultTTL
      - Label:
          default: PreExisting Resources To Use (Leave empty for stack to create and manage)
        Parameters:
          - PreExistingGitRepository
          - PreExistingHostedZoneDomain
          - PreExistingSiteBucket
          - PreExistingRedirectBucket
          - PreExistingLogsBucket
          - PreExistingCodePipelineBucket