cloudformation.yaml

AWSTemplateFormatVersion: '2010-09-09'
Parameters:
  BucketName:
    Type: String
  WebsiteCertificateARN:
    Type: String
  CorsAllowedOrigins:
    Type: String
    Default: "https://ivelum.com"
    Description: Comma-separated list of allowed origins for CORS
  apiGatewayStageName:
    Type: String
    AllowedPattern: '[a-z0-9]+'
    Default: handle

Resources:
  WebsiteBucket:
    Type: AWS::S3::Bucket
    Properties:
      BucketName:
        Ref: BucketName
      WebsiteConfiguration:
        IndexDocument: index.html
        ErrorDocument: 404.html

  WebsiteBucketPolicy:
    Type: AWS::S3::BucketPolicy
    Properties:
      Bucket:
        Ref: WebsiteBucket
      PolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Action: "s3:GetObject"
            Effect: Allow
            Principal: "*"
            Resource:
              Fn::Sub: "arn:aws:s3:::${WebsiteBucket}/*"

  WebsiteDistribution:
    Type: AWS::CloudFront::Distribution
    DependsOn: WebsiteBucket
    Properties:
      DistributionConfig:
        Aliases:
          - ivelum.com
        CustomErrorResponses:
          - ErrorCode: 403
            ResponseCode: 404
            ResponsePagePath: /404.html
        Origins:
          - DomainName:
              Ref: WebsiteBucket
            Id:
              Ref: WebsiteBucket
            CustomOriginConfig:
              HTTPPort: 80
              HTTPSPort: 443
              OriginProtocolPolicy: 'http-only'
        Enabled: 'true'
        DefaultRootObject: index.html
        DefaultCacheBehavior:
          TargetOriginId:
            Ref: WebsiteBucket
          ViewerProtocolPolicy: 'redirect-to-https'
          AllowedMethods:
            - GET
            - HEAD
            - OPTIONS
          CachedMethods:
            - GET
            - HEAD
            - OPTIONS
          Compress: true
          ForwardedValues:
            QueryString: false
            Cookies:
              Forward: none
            Headers:
              - Access-Control-Request-Headers
              - Access-Control-Request-Method
              - Origin
        ViewerCertificate:
          AcmCertificateArn:
            Ref: WebsiteCertificateARN
          MinimumProtocolVersion: TLSv1.2_2018
          SslSupportMethod: sni-only

  DeployUser:
    Type: AWS::IAM::User
    Properties:
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/AWSCloudFormationReadOnlyAccess
      Policies:
        - PolicyDocument:
            Statement:
              - Action:
                  - s3:ListBucket
                Effect: Allow
                Resource:
                  Fn::Sub: "arn:aws:s3:::${WebsiteBucket}"
              - Action:
                  - s3:*Object*
                Effect: Allow
                Resource:
                  Fn::Sub: "arn:aws:s3:::${WebsiteBucket}/*"
              - Action:
                  - cloudfront:CreateInvalidation
                Effect: Allow
                Resource: "*"
              - Action:
                  - lambda:GetFunction
                  - lambda:UpdateFunctionCode
                  - lambda:UpdateFunctionConfiguration
                Effect: Allow
                Resource: !GetAtt ContactFormLambda.Arn
          PolicyName: manage-static-website

  LambdaExecutionRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: "Allow"
            Principal:
              Service: lambda.amazonaws.com
            Action: sts:AssumeRole
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole
      Policies:
        - PolicyName: "ses-send-email"
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Effect: "Allow"
                Action:
                  - "ses:SendEmail"
                  - "ses:SendRawEmail"
                Resource: "*"

  ContactFormLambda:
    Type: "AWS::Lambda::Function"
    Properties:
      Handler: "lambda_function.lambda_handler"
      Role: !GetAtt LambdaExecutionRole.Arn
      Code:
        # use CF feature - it compares yaml config with its previous version
        # without looking at the actual state of the lambda function
        # this way we can update code, deps and env vars during deploy
        ZipFile: import this
      Runtime: "python3.9"
      Timeout: 10

  # IAM Role for API Gateway + CloudWatch Logging
  ApiGatewayLoggingRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          Action: 'sts:AssumeRole'
          Effect: Allow
          Principal:
            Service: apigateway.amazonaws.com
      Path: /
      ManagedPolicyArns:
        - 'arn:aws:iam::aws:policy/service-role/AmazonAPIGatewayPushToCloudWatchLogs'

  ApiGwAccountConfig:
    Type: AWS::ApiGateway::Account
    Properties:
      CloudWatchRoleArn: !GetAtt ApiGatewayLoggingRole.Arn

  ContactFormAPIGateway:
    Type: 'AWS::ApiGateway::RestApi'
    DependsOn:
      - ContactFormLambda
      - ApiGatewayLoggingRole
    Properties:
      Name: ContactFormAPIGateway
      FailOnWarnings: 'true'
      Description: 'Contact Form API Gateway'
      EndpointConfiguration:
        Types:
          - REGIONAL

  ContactFormAPIMethod:
    Type: 'AWS::ApiGateway::Method'
    Properties:
      AuthorizationType: NONE
      HttpMethod: ANY
      ResourceId: !GetAtt ContactFormAPIGateway.RootResourceId
      RestApiId: !Ref ContactFormAPIGateway
      Integration:
        IntegrationHttpMethod: POST
        Type: AWS
        Uri: !Sub
          - arn:aws:apigateway:${AWS::Region}:lambda:path/2015-03-31/functions/${LambdaArn}/invocations
          - LambdaArn: !GetAtt ContactFormLambda.Arn
        IntegrationResponses:
          - StatusCode: 200
            ResponseParameters:
              method.response.header.Access-Control-Allow-Origin: !Sub "'${CorsAllowedOrigins}'"
              method.response.header.Access-Control-Allow-Methods: "'*'"
              method.response.header.Access-Control-Allow-Headers: "'*'"
            ResponseTemplates:
              application/json: '{"status":"ok"}'
        RequestParameters:
          integration.request.header.X-Amz-Invocation-Type: "'Event'"
      MethodResponses:
        - StatusCode: 200
          ResponseParameters:
            method.response.header.Access-Control-Allow-Origin: true
            method.response.header.Access-Control-Allow-Methods: true
            method.response.header.Access-Control-Allow-Headers: true
      RequestParameters:
        method.request.header.Content-Type: false
      RequestModels:
        application/json: Empty

  ContactFormAPIOptionsMethod:
    Type: 'AWS::ApiGateway::Method'
    Properties:
      AuthorizationType: NONE
      HttpMethod: OPTIONS
      ResourceId: !GetAtt ContactFormAPIGateway.RootResourceId
      RestApiId: !Ref ContactFormAPIGateway
      Integration:
        IntegrationResponses:
          - StatusCode: 200
            ResponseParameters:
              method.response.header.Access-Control-Allow-Origin: !Sub "'${CorsAllowedOrigins}'"
              method.response.header.Access-Control-Allow-Methods: "'*'"
              method.response.header.Access-Control-Allow-Headers: "'*'"
            ResponseTemplates:
              application/json: Empty
        PassthroughBehavior: WHEN_NO_MATCH
        RequestTemplates:
          application/json: '{"statusCode": 200}'
        Type: MOCK
      MethodResponses:
        - StatusCode: 200
          ResponseParameters:
            method.response.header.Access-Control-Allow-Origin: true
            method.response.header.Access-Control-Allow-Methods: true
            method.response.header.Access-Control-Allow-Headers: true

  ContactFormAPIDeployment:
    Type: 'AWS::ApiGateway::Deployment'
    DependsOn:
      - ContactFormAPIMethod
    Properties:
      RestApiId: !Ref ContactFormAPIGateway

  # Enable logging of all HTTP requests
  ContactFormAPIStage:
    Type: AWS::ApiGateway::Stage
    Properties:
      DeploymentId: !Ref ContactFormAPIDeployment
      MethodSettings:
        - HttpMethod: '*'
          LoggingLevel: INFO
          ResourcePath: /*
          DataTraceEnabled: true
      RestApiId: !Ref ContactFormAPIGateway
      StageName: !Ref apiGatewayStageName

  # Create permission for API Gateway to invoke Lambda
  ContactFormAPIPermission:
    Type: 'AWS::Lambda::Permission'
    Properties:
      Action: lambda:InvokeFunction
      FunctionName: !Ref ContactFormLambda
      Principal: apigateway.amazonaws.com
      SourceArn: !Sub 'arn:aws:execute-api:${AWS::Region}:${AWS::AccountId}:${ContactFormAPIGateway}/*/*/'

Outputs:
  ContactFormInvokeURL:
    Value: !Sub 'https://${ContactFormAPIGateway}.execute-api.${AWS::Region}.amazonaws.com/${apiGatewayStageName}/'
    Description: URL for invoking the Contact Form API