CloudFormation Example Static Site

cloudfront-s3.yaml

AWSTemplateFormatVersion: 2010-09-09

Description: Static Landing (s3+cloudfront)

Parameters:
  pDomainName:
    Description: The site domain name (non www).
    Type: String
    AllowedPattern: (?!-)[a-zA-Z0-9-.]{1,63}(?<![.-])
    ConstraintDescription: Must be a valid domain name.
  pSslCertificate:
    Description: SSL certificate to use
    Type: String

Resources:            
  WebAddress:
    Type: AWS::Route53::RecordSetGroup
    Properties:
      HostedZoneName: !Sub ${pDomainName}.
      RecordSets:
        - Name: !Sub ${pDomainName}.
          Type: A
          AliasTarget:
            HostedZoneId: Z2FDTNDATAQYW2
            DNSName: !Sub ${RedirectCloudFront.DomainName}
        - Name: !Sub www.${pDomainName}.
          Type: A
          AliasTarget:
            HostedZoneId: Z2FDTNDATAQYW2
            DNSName: !Sub ${MainCloudFront.DomainName}

  RedirectBucket:
    Type: AWS::S3::Bucket
    DeletionPolicy: Delete
    Properties:
      BucketName: !Sub ${pDomainName}.redirect
      AccessControl: BucketOwnerFullControl
      WebsiteConfiguration:
        RedirectAllRequestsTo:
          HostName: !Sub www.${pDomainName}
          Protocol: https

  StaticSiteBucketPolicy:
    Type: AWS::S3::BucketPolicy
    Properties:
      Bucket: !Ref StaticSiteBucket
      PolicyDocument:
        Statement:
          - Effect: Allow
            Action:
              - s3:GetObject
            Principal:
              CanonicalUser: wxipdbulbbfhfevplmxpcc88g6rb5snusxmgh5yhj8wwjumgrbcr4fghl6bj
            Resource: !Sub arn:aws:s3:::${StaticSiteBucket}/*

  StaticSiteBucket:
    Type: AWS::S3::Bucket
    DeletionPolicy: Delete
    Properties:
      BucketName: !Sub ${pDomainName}.static
      AccessControl: BucketOwnerFullControl
      WebsiteConfiguration:
        IndexDocument: index.html
        ErrorDocument: 404.html

  RedirectCloudFront:
    Type: AWS::CloudFront::Distribution    
    Properties:
      DistributionConfig:
        Enabled: true
        Comment: !Sub ${pDomainName} (redirect)
        Aliases: 
          - !Ref pDomainName
        DefaultCacheBehavior:
          AllowedMethods:
            - GET
            - HEAD
            - OPTIONS
          CachedMethods:
            - GET
            - HEAD
            - OPTIONS
          Compress: true
          TargetOriginId: S3Bucket
          ForwardedValues:
            QueryString: false
            Cookies:
              Forward: none
            Headers:
              - Host
          DefaultTTL: 31536000
          MinTTL: 0
          MaxTTL: 31536000
          SmoothStreaming: false
          ViewerProtocolPolicy: redirect-to-https
        Origins:
          - Id: S3Bucket
            DomainName: !Sub ${RedirectBucket}.s3-website-${AWS::Region}.amazonaws.com
            CustomOriginConfig:
              HTTPPort: 80
              OriginProtocolPolicy: http-only
        HttpVersion: http2
        PriceClass: PriceClass_All
        ViewerCertificate:
          SslSupportMethod: sni-only
          AcmCertificateArn: !Ref pSslCertificate

  MainCloudFront:
    Type: AWS::CloudFront::Distribution
    Properties:
      DistributionConfig:
        Enabled: true        
        Comment: !Ref pDomainName
        Aliases:
          - !Sub www.${pDomainName}
        CacheBehaviors:
          - PathPattern: assets/*
            TargetOriginId: S3Bucket
            AllowedMethods:
              - GET
              - HEAD
              - OPTIONS
            CachedMethods:
              - GET
              - HEAD
              - OPTIONS
            Compress: true
            ForwardedValues:
              QueryString: false
              Cookies:
                Forward: none              
            DefaultTTL: 86400
            MinTTL: 86400
            MaxTTL: 31536000
            ViewerProtocolPolicy: redirect-to-https
            SmoothStreaming: false
        DefaultCacheBehavior:
          TargetOriginId: S3Bucket
          AllowedMethods:
            - GET
            - HEAD
            - OPTIONS
          CachedMethods:
            - GET
            - HEAD
            - OPTIONS
          Compress: true
          ForwardedValues:
            QueryString: false
            Cookies:
              Forward: none
          DefaultTTL: 0
          MinTTL: 0
          MaxTTL: 31536000
          SmoothStreaming: false
          ViewerProtocolPolicy: redirect-to-https        
        Origins:
          - Id: S3Bucket
            DomainName: !Sub ${StaticSiteBucket}.s3.amazonaws.com
            S3OriginConfig: 
              OriginAccessIdentity: origin-access-identity/cloudfront/T3R89SCA11K9PQ
        HttpVersion: http2
        PriceClass: PriceClass_All
        ViewerCertificate:
          SslSupportMethod: sni-only
          AcmCertificateArn: !Ref pSslCertificate

Outputs:
  RedirectCdnDnsName:
    Value: !GetAtt RedirectCloudFront.DomainName
  MainCdnDnsName:
    Value: !GetAtt MainCloudFront.DomainName
  MainCdnDistributionId:
    Value: !Ref MainCloudFront
  S3BucketName:
    Value: !Ref StaticSiteBucket